Dev backend returns 500 on /api/auth/user/info/ and /api/search/aimodel/

[saqibmanan]

What: the dev backend returns HTTP 500 on GET /api/auth/user/info/ and GET /api/search/aimodel/.
Evidence: dev nginx, 2026-09-15 09:49–09:50 UTC: two 500s on each path; the user/info responses are 96KB (Django debug error page — dev runs with DEBUG=True).
Fix: not fixed — needs the traceback from the dev backend logs.

[saqibmanan]

Opening — seen in dev nginx logs during a PR-gate test run.

[saqibmanan]

Both endpoints traced to two unrelated causes, and user/info is failing on prod as well as dev — not dev-only as the card says.

1. /api/auth/user/info/ — UserInfoView declares no permission_classes, so it inherits the project-wide AllowAny default. An anonymous request reaches the handler and reading .email off AnonymousUser raises AttributeError. Every other view touching request.user either sets permission_classes or guards with is_authenticated, so this is the only one.
2. /api/search/aimodel/ — PaginatedElasticSearchAPIView.get caches the response, and cache.set pickles it. Serialized hits keep AttrList/AttrDict/InnerDoc values for nested fields; those classes are rebuilt per document type, so pickling raises "it's not the same object as elasticsearch_dsl.document.InnerDoc" and the except Exception turns it into a 500.

Fix in progress on fix/user-info-auth-and-search-cache.

[saqibmanan]

Fixed by #187/#190 (dev) and released in #191. Both 500s were live on prod as well as dev.

• /api/auth/user/info/ → 401 for anonymous callers (was AttributeError on AnonymousUser)
• /api/search/aimodel/ → 200 (was a PicklingError on cached InnerDoc values)

Prod deploy 35076532737: read-only tests passed, finalized. Verified on prod: user/info 401, search/aimodel 200.

[saqibmanan]

Verified on prod after release run 35111923858 (deploy, read-only tests and finalize all green): /api/auth/user/info/ returns 401 (was 500) and /api/search/aimodel/ returns 200 (was 500). Same on dev.