fix: validate training progress identifiers early

src/api/server.py

@@ -54,10 +54,15 @@ def route_request(
     method: str = "GET",
     body: Optional[dict] = None,
 ) -> tuple[int, dict]:
-    deps = dependencies or build_api_dependencies()
     method = method.upper()
     path_parts = _path_parts(path)
 
+    if _is_training_progress_post(method, path):
+        _validate_progress_identifier_body(body or {})
+        return 404, {"error": "not_found"}
+
+    deps = dependencies or build_api_dependencies()
+
     if method == "GET" and path == "/health":
         return 200, deps["health"]()
     if method == "GET" and path == "/candles":
@@ -245,6 +250,10 @@ def _get_single(query: dict, key: str, default: Optional[str] = None) -> Optiona
     return values[0]
 
 
+def _is_training_progress_post(method: str, path: str) -> bool:
+    return method == "POST" and path == "/training/progress"
+
+
 def _path_parts(path: str) -> list[str]:
     return [part for part in path.strip("/").split("/") if part]
 
@@ -269,6 +278,24 @@ def _parse_path_int(value: str, key: str) -> int:
     return parsed
 
 
+def _validate_progress_identifier_body(body: dict) -> None:
+    for key in ("attempt_id", "case_id"):
+        if key in body:
+            _parse_body_identifier(body[key], key)
+
+
+def _parse_body_identifier(value, key: str) -> int:
+    if isinstance(value, bool):
+        raise ValueError(f"invalid_body_field:{key}")
+    try:
+        parsed = int(value)
+    except (TypeError, ValueError) as exc:
+        raise ValueError(f"invalid_body_field:{key}") from exc
+    if parsed < 1:
+        raise ValueError(f"invalid_body_field:{key}")
+    return parsed
+
+
 def _read_json_body(handler: BaseHTTPRequestHandler) -> dict:
     try:
         length = int(handler.headers.get("Content-Length", "0"))