P1 auth, CORS, and SQL filtering

backend/database.py

@@ -5,7 +5,7 @@ from statistics import median
 from typing import Any
 from uuid import UUID
 
-from sqlalchemy import create_engine, inspect, select
+from sqlalchemy import create_engine, inspect, select, func
 from sqlalchemy.orm import declarative_base, sessionmaker
 import os
 
@@ -210,10 +210,18 @@ class SQLCaseRepository:
             session.refresh(case)
             return CaseDTO(case)
 
-    def list_cases(self) -> list[CaseDTO]:
+    def list_cases(self, status: str | None = None, age_min: int | None = None, age_max: int | None = None) -> list[CaseDTO]:
         Case = _case_model()
         with SessionLocal() as session:
-            cases = session.scalars(select(Case).order_by(Case.created_at.desc())).all()
+            query = select(Case)
+            if status:
+                query = query.where(Case.status == status)
+            if age_min is not None:
+                query = query.where(Case.age_years >= age_min)
+            if age_max is not None:
+                query = query.where(Case.age_years <= age_max)
+            query = query.order_by(Case.created_at.desc())
+            cases = session.scalars(query).all()
             return [CaseDTO(case) for case in cases]
 
     def get_case(self, case_id: str) -> CaseDTO | None: