feat: add query layer (CM-1059)

[ulemons]

DevStats Affiliations API + Generic DAL resolver

Implements the /v1/dev-stats/affiliations endpoint that allows external tools (e.g. DevStats/gitdm) to resolve GitHub contributor affiliations in bulk.

API

POST /v1/dev-stats/affiliations
Authorization: Bearer <api-key>

{ "githubHandles": ["handle1", "handle2"] }

Accepts up to 1,000 handles per request. Returns resolved, non-overlapping affiliation periods per contributor, sorted by most recent first.

Implementation

services/libs/data-access-layer/src/affiliations/ — new generic module, usable by any consumer:

• IAffiliationPeriod — public type representing a single affiliation window
• resolveAffiliationsByMemberIds — bulk resolver for up to N members in 2 DB queries
• findWorkExperiencesBulk / findManualAffiliationsBulk — exported separately for reuse
• Conflict resolution mirrors prepareMemberOrganizationAffiliationTimeline but uses an interval-based approach (boundary dates) instead of day-by-day iteration, making it viable for bulk requests

---

Note

Medium Risk
Adds a new public API endpoint that returns contributor emails and computed affiliation timelines, plus new DAL query/resolution logic; mistakes could expose data or generate incorrect affiliations. Public API auth routing changes (moving middleware to per-route) may unintentionally change protection/behavior of existing endpoints if misconfigured.

Overview
Adds a new public endpoint POST /v1/affiliations (static API key + READ_AFFILIATIONS scope, rate-limited) that accepts GitHub handles and returns paginated contributors with verified emails and resolved, non-overlapping affiliation periods.

Introduces a new DAL module affiliations to bulk-fetch work experiences/manual affiliations and compute primary affiliation timelines via boundary-interval resolution, and adds DAL helpers to look up members by verified GitHub username plus verified emails.

Tightens API behavior by converting invalid JSON bodies into a 400 BadRequestError, adds a default NotFoundError handler for v1, adjusts public API auth middleware to be applied per-route, and reduces error logging to structured {name,message,stack} fields.

^{Written by Cursor Bugbot for commit 7377aae. This will update automatically on new commits. Configure here.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

Conventional Commits FTW!

[Copilot]

Pull request overview

Adds a DevStats-oriented query layer and exposes a new public API endpoint to bulk-resolve GitHub contributor affiliations (including timeline conflict resolution) from existing member work experience and manual affiliation data.

Changes:

• Exports new DAL modules (affiliations, devStats) from the data-access-layer package.
• Adds DAL query helpers for DevStats lookups (members by GitHub handle; verified emails by memberId).
• Implements POST /v1/dev-stats/affiliations handler wired into the public router.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
services/libs/data-access-layer/src/index.ts	Re-exports new DAL entrypoints so downstream services can consume them.
services/libs/data-access-layer/src/devStats/index.ts	Adds DevStats-focused queries for bulk member lookup and verified emails.
services/libs/data-access-layer/src/affiliations/index.ts	Introduces bulk affiliation resolution and timeline-building logic.
backend/src/api/public/v1/dev-stats/index.ts	Wires the /affiliations route to the new handler with scope protection.
backend/src/api/public/v1/dev-stats/getAffiliations.ts	Implements request validation, DAL lookups, and response shaping for the endpoint.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[skwowet]

nitpick: could we rename the router?

let’s not bake the consumer into the public api.

[skwowet]

also, for other stuff - file, func, etc