fix: review findings -- timezone safety, cache empty list bug, return type annotations

1. indexing.py: naive datetime comparison could TypeError when
   expires_at has no tzinfo. Now normalizes to UTC before comparing.
   Added TypeError to except clause as safety net.
2. search.py: 'if cached_results' treated empty list [] as cache miss,
   causing re-search. Changed to 'if cached_results is not None'.
3. Added return type annotations (-> dict) to all 8 playground
   endpoint functions per CLAUDE.md.

Skipped: X-Forwarded-For trust (always behind Railway proxy),
load_demo_repos sync (runs once at startup), Redis pre-check
(redundant, outer except handles), create_session error (exception
propagates, response never sent), _resolve_repo_id sync (rare
fallback path).

289 tests pass.

Author: DevanshuNEU

backend/routes/playground/indexing.py

@@ -44,7 +44,7 @@ async def start_anonymous_indexing(
     req: Request,
     response: Response,
     background_tasks: BackgroundTasks,
-):
+) -> dict:
     """Start indexing a public GitHub repository for anonymous users."""
     start_time = time.time()
     limiter = get_limiter()
@@ -69,8 +69,11 @@ async def start_anonymous_indexing(
         if expires_at_str:
             try:
                 expires_at = datetime.fromisoformat(expires_at_str.replace("Z", "+00:00"))
+                # Ensure timezone-aware comparison
+                if expires_at.tzinfo is None:
+                    expires_at = expires_at.replace(tzinfo=timezone.utc)
                 is_expired = datetime.now(timezone.utc) > expires_at
-            except (ValueError, AttributeError):
+            except (ValueError, AttributeError, TypeError):
                 is_expired = True
 
         if not is_expired:
@@ -189,7 +192,7 @@ async def start_anonymous_indexing(
 
 
 @router.get("/index/{job_id}")
-async def get_indexing_status(job_id: str, req: Request):
+async def get_indexing_status(job_id: str, req: Request) -> dict:
     """Check the status of an anonymous indexing job."""
     if not job_id or not job_id.startswith("idx_"):
         raise HTTPException(status_code=400, detail={

backend/routes/playground/search.py

@@ -111,7 +111,7 @@ async def playground_search(
     request: PlaygroundSearchRequest,
     req: Request,
     response: Response,
-):
+) -> dict:
     """Public playground search - rate limited by session/IP."""
     session_token = get_session_token(req)
     client_ip = get_client_ip(req)
@@ -145,7 +145,7 @@ async def playground_search(
         cache_key = f"{sanitized_query}:v3={request.use_v3}:tests={request.include_tests}"
 
         cached_results = cache.get_search_results(cache_key, repo_id)
-        if cached_results:
+        if cached_results is not None:
             return {
                 "results": cached_results, "count": len(cached_results),
                 "cached": True, "remaining_searches": limit_result.remaining,
@@ -200,7 +200,7 @@ async def playground_search(
 
 
 @router.get("/repos")
-async def list_playground_repos():
+async def list_playground_repos() -> dict:
     """List available demo repositories."""
     return {
         "repos": [
@@ -212,7 +212,7 @@ async def list_playground_repos():
 
 
 @router.get("/stats")
-async def get_playground_stats():
+async def get_playground_stats() -> dict:
     """Get playground usage stats (for monitoring/debugging)."""
     limiter = get_limiter()
     return limiter.get_usage_stats()

backend/routes/playground/session.py

@@ -11,7 +11,7 @@
 
 
 @router.get("/limits")
-async def get_playground_limits(req: Request):
+async def get_playground_limits(req: Request) -> dict:
     """
     Get current rate limit status for this user.
 
@@ -32,7 +32,7 @@ async def get_playground_limits(req: Request):
 
 
 @router.get("/session")
-async def get_session_info(req: Request, response: Response):
+async def get_session_info(req: Request, response: Response) -> dict:
     """
     Get current session state including indexed repo info.
 

backend/routes/playground/validation.py

@@ -115,7 +115,7 @@ async def count_code_files(
 
 
 @router.post("/validate-repo")
-async def validate_github_repo(request: ValidateRepoRequest, req: Request):
+async def validate_github_repo(request: ValidateRepoRequest, req: Request) -> dict:
     """Validate a GitHub repository URL for anonymous indexing."""
     start_time = time.time()