Refactor duty authentication and event type handling

- Introduced a new function `get_authenticated_username` to centralize Mini App authentication logic, improving code readability and maintainability.
- Updated the duty fetching logic to map unknown event types to "duty" for consistent API responses.
- Enhanced the `get_duties` function to include duties starting on the last day of the specified date range.
- Improved session management in the database layer to ensure rollback on exceptions.
- Added tests to validate the new authentication flow and event type handling.

tests/test_app.py

@@ -131,3 +131,31 @@ def test_duties_e2e_auth_real_validation(client, monkeypatch):
     assert r.status_code == 200
     assert r.json() == []
     mock_fetch.assert_called_once_with("2025-01-01", "2025-01-31")
+
+
+@patch("api.app.config.MINI_APP_SKIP_AUTH", True)
+def test_duties_200_with_unknown_event_type_mapped_to_duty(client):
+    """When DB returns duty with event_type not in (duty, unavailable, vacation), API returns 200 with event_type='duty'."""
+    from types import SimpleNamespace
+
+    fake_duty = SimpleNamespace(
+        id=1,
+        user_id=10,
+        start_at="2025-01-15T09:00:00Z",
+        end_at="2025-01-15T18:00:00Z",
+        event_type="unknown",
+    )
+
+    def fake_get_duties(session, from_date, to_date):
+        return [(fake_duty, "User A")]
+
+    with patch("api.app.get_duties", side_effect=fake_get_duties):
+        r = client.get(
+            "/api/duties",
+            params={"from": "2025-01-01", "to": "2025-01-31"},
+        )
+    assert r.status_code == 200
+    data = r.json()
+    assert len(data) == 1
+    assert data[0]["event_type"] == "duty"
+    assert data[0]["full_name"] == "User A"