feat(api2): validate and freeze dataclasses

[cfm]

• Depends on feat(api2): Prefer: securedrop=x limits response shape to minor version 2.x #7703

Closes #7682 with two out of its three goals:

1. Cover more dataclasses with __post_init__() validation
2. Mark input dataclasses as read-only via frozen
3. Add some generics (despite /api/v2/data: handle batched events from clients #7672 (comment)) to explicitly mark untrusted values as tainted until sanitized
   • After some time-boxed experiments, it turns out that Mypy won't enforce this via annotations, only via explicit NewTypes, and it's just not worth it. Consider this experience more evidence in support of Evaluate and implement improvements to code analysis #6111 and Add annotations for data sources and sinks and further static analysis securedrop-client#385.

Overall I much prefer the declarative schema-based approach that the app has taken with Zod. Since we've decided to avoid further such dependencies on the server side, however, this has to be done separately and imperatively like this.

Test plan

• The app works as expected.
• The app's server tests pass without modification.

Checklist

This change accounts for:

• any required additional documentation
• any necessary AppArmor changes (added or removed application files)
• any impact on new SecureDrop installs and upgrades
• our dependency update policy

[Copilot]

Pull Request Overview

This PR enhances type safety and validation in the API v2 implementation by making dataclasses frozen (immutable), adding comprehensive validation in __post_init__ methods, and updating tests to properly instantiate immutable Event objects instead of mutating existing ones.

• Adds validation for version strings (must be 64 hex digits), UUIDs, and event IDs
• Makes Target, EventData, Event, EventResult, and BatchRequest dataclasses frozen to prevent mutation
• Updates test cases to create new Event instances instead of modifying existing ones

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
securedrop/journalist_app/api2/types.py	Adds VERSION_LEN constant, implements __post_init__ validation for all dataclasses, makes dataclasses frozen, and enhances type annotations
securedrop/tests/test_journalist_api2.py	Updates tests to create new Event instances rather than mutating existing ones, and uses VERSION_LEN constant for test data

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.