analytics-api: register routes via toolkit OperationBuilder

[cyberantonz]

Replace the raw axum::Router::route chain (21 endpoints) with the gears-rust toolkit OperationBuilder, so every route records an OpenAPI OperationSpec plus auth/license metadata in one place — the framework idiom used by api-gateway and the gears under gears-rust/gears.

Scope is handler-registration only: the builder is driven standalone against a local OpenApiRegistryImpl, and main.rs keeps serving the resulting axum::Router. AppState, every handler signature, and the tenant_middleware layer are unchanged. Serving /openapi.json and the full bootstrap-host/gear migration are tracked in #1505.

Summary by CodeRabbit

• Documentation
  • Improved API metadata across service endpoints, including clearer summaries, authentication expectations, response details, and license information.
  • Added more consistent OpenAPI coverage for existing routes, making the API easier to understand and integrate with.

[coderabbitai]

Warning

Review limit reached

@cyberantonz, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 6 minutes and 6 seconds. Learn how PR review limits work.

To continue reviewing without waiting, enable usage-based billing in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 21778fcf-0c92-41ac-9407-ad9e52271d7f

📥 Commits

Reviewing files that changed from the base of the PR and between f381ad7 and 579a6a1.

📒 Files selected for processing (2)

• src/backend/services/analytics-api/Dockerfile
• src/backend/services/analytics-api/src/api/mod.rs

📝 Walkthrough

Walkthrough

The analytics API crate now depends on toolkit, and its router registration was migrated to OperationBuilder with an in-process OpenAPI registry. The same endpoints remain registered, with per-route auth, license, and response metadata.

Changes

Analytics API Router Migration

Layer / File(s)	Summary
Toolkit dependency and registry setup src/backend/services/analytics-api/Cargo.toml, src/backend/services/analytics-api/src/api/mod.rs	Adds the toolkit dependency, imports OperationBuilder and OpenApiRegistryImpl, and initializes the router around an in-process OpenAPI registry.
Metric routes src/backend/services/analytics-api/src/api/mod.rs	Re-registers metric CRUD and query endpoints with OperationBuilder, including operation IDs, summaries, auth, license, and response metadata.
Threshold and lookup routes src/backend/services/analytics-api/src/api/mod.rs	Re-registers the metric-threshold, person lookup, and column catalog endpoints with the same handlers and new builder-based metadata.
Catalog, admin, and health routes src/backend/services/analytics-api/src/api/mod.rs	Re-registers the catalog lookup, admin metric-threshold CRUD, and health endpoint through OperationBuilder with route documentation and response definitions.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related issues

• analytics-api: serve OpenAPI spec from OperationBuilder registry (make it visible) #1505 — The PR migrates analytics-api route registration to OperationBuilder and adds the toolkit dependency, matching the issue topic.

Poem

I hopped through routes with twitchy nose,
and tucked new metadata in tidy rows.
OpenAPI carrots, bright and neat,
make every endpoint jump to its beat. 🐰

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: migrating analytics-api route registration to the toolkit OperationBuilder.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/backend/services/analytics-api/src/api/mod.rs`:
- Around line 302-309: The `/health` route is marked public in the router, but
that only affects docs and does not bypass runtime auth, so requests still hit
`tenant_middleware` and fail without X-Insight-Tenant-Id. Update the middleware
in `tenant_middleware` to explicitly skip tenant validation for the `/health`
path, or remove `/health` from the middleware-wrapped routes so
`handlers::health` can respond unauthenticated as intended.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 96289829-fb6a-4e0c-ae17-3736be401ae9

📥 Commits

Reviewing files that changed from the base of the PR and between 636f64d and f381ad7.

⛔ Files ignored due to path filters (1)

• src/backend/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• src/backend/services/analytics-api/Cargo.toml
• src/backend/services/analytics-api/src/api/mod.rs