This pull request introduces a new reports feature for bots (behind a feature flag), refactors bot access control logic to use model methods instead of service calls, and simplifies session and event management. The most significant changes are the addition of the reports API endpoints, improved access checks, and cleanup of unnecessary dependencies in route handlers.

New Reports Feature:

• Added a new reports module under src/api/routes/bots/bot/ (gated by the reports feature flag), providing endpoints to subscribe, unsubscribe, and list report subscriptions for a bot. The endpoints enforce proper authorization and handle duplicate or missing subscriptions. (src/api/routes/bots/bot/reports/mod.rs, src/api/routes/bots/bot/mod.rs) [1] [2] [3]

Access Control Refactor:

• Replaced calls to services.auth.user_has_bot_access and services.auth.user_owns_bot with direct bot.has_access and bot.is_owner method calls in all relevant bot, achievements, and event route handlers, improving readability and encapsulation. (src/api/routes/bots/bot/mod.rs, src/api/routes/bots/bot/achievements/mod.rs, src/api/routes/bots/bot/events/mod.rs, src/api/routes/bots/bot/events/event/mod.rs) [1] [2] [3] [4] [5] [6] [7] [8]

• Removed unnecessary Services dependencies from route handler signatures and imports, further simplifying the code. (src/api/routes/bots/bot/mod.rs, src/api/routes/bots/bot/achievements/mod.rs, src/api/routes/bots/bot/events/mod.rs, src/api/routes/bots/bot/events/event/mod.rs) [1] [2] [3] [4] [5] [6] [7] [8] [9] [10]

Session and Event Management Improvements:

• In the sessions API, improved the logic for marking the current session and refactored session revocation to use a new revoke_many_for_user repository method for efficiency. (src/api/routes/auth/sessions/mod.rs) [1] [2] [3]

• Cleaned up redundant code in the bot deletion handler by removing a duplicate existence check. (src/api/routes/bots/bot/mod.rs)

These changes collectively improve maintainability, security, and extensibility of the bot API.