Backend Challenge — Reporting Service

A small multi-tenant API (Django Ninja + pytest), modelled on a sustainability / ESG reporting product.

The domain in one paragraph. Companies have to publish sustainability reports (climate impact, supply-chain practices, governance, etc.). Each report is made up of many disclosures — individual answers to specific regulatory requirements (for example ESRS E1-1, "climate change mitigation"). A team drafts each disclosure, so every disclosure carries a completion_status that moves through a workflow: OPEN → DONE → COMPLETED.

This service models that with two things:

• Report — owned by one tenant (a "reporting entity", i.e. a company).
• Disclosure — belongs to a report; has a requirement_code (e.g. ESRS E1-1), some data (the answer text), an assignee, and a completion_status.

Disclosure lifecycle

completion_status is a small state machine:

        reopen
      ┌────────────┐
      ▼            │
    OPEN  ───►   DONE  ───►  COMPLETED  (final)

• OPEN → DONE — the draft is finished and ready for review.
• DONE → COMPLETED — signed off; COMPLETED is final (nothing moves out of it).
• DONE → OPEN — reopened for more edits.
• Any other move — e.g. skipping straight from OPEN → COMPLETED, or trying to leave COMPLETED — is not a valid transition.

It's multi-tenant: every report (and its disclosures) belongs to one reporting entity, and a caller must only ever see their own tenant's data.

The exercise

There's nothing to prepare in advance. The tasks will be given to you **one at a time during the interview **. The code is mostly complete, but with some important pieces left which are attached to failing tests.

Run in the browser (no local setup)

This repo has a dev container, so you can open it in GitHub Codespaces: the green Code button → Codespaces → Create codespace on main. It builds a ready environment (Python + deps + seeded DB) in your browser. Then:

make up     # serve on :8000 — click the forwarded port to open /docs
make test   # run the tests

Run

First time only, create and activate a virtualenv if you decide to run without Docker:

python3 -m venv .venv
source .venv/bin/activate        # Windows: .venv\Scripts\activate

Then (with the venv active):

make up        # install, migrate, seed, serve on :8000  (docs at /docs)
make test      # run the tests
OR
make dev       # optional: run in Docker with live reload (no venv needed)

Auth

No login. The bearer token is your tenant id. With no token you act as the demo tenant (A), so /docs "Try it out" and a plain curl just work. Send a token to act as another tenant:

# default (tenant A):
curl http://localhost:8000/v1/disclosures
# tenant B (use Authorize in /docs, or the header here):
curl -H "Authorization: Bearer 22222222-2222-2222-2222-222222222222" \
     http://localhost:8000/v1/disclosures

Layout

service/      Django project (settings, urls, wsgi)
reporting/
  api.py      all endpoints
  auth.py     token auth + tenant_queryset helper
  models.py   Report, Disclosure
  schemas.py  request/response schemas
  fixtures/   seed.json (loaded on startup)
  tests/      test_api.py + fixtures