Optional / possibly-missing dict keys – codebase scan

Scanned for obj[key]-style access where the key might be missing (potential KeyError). Grouped by category. Use .get(key, default) or check key in obj before subscript when the key is optional.

---

Category 1: Movie dict – keys that may be absent

Source: get_movie() / get_movie_metadata() / DynamoDB movies table. Movies can be in different states (just created, uploading, processing, zip not built yet, etc.).

Location	Key	Risk	Notes
odb.py ~1486	LAST_FRAME_TRACKED	FIXED	Now uses .get(LAST_FRAME_TRACKED, None).
odb.py 1356	COURSE_ID	Low	Set at movie create; could be missing only if DB is inconsistent.
odb.py 1361	MOVIE_DATA_URN	FIXED	movie_data_urn_for_movie_id() now uses .get(MOVIE_DATA_URN).
odb.py 1367	MOVIE_ZIPFILE_URN	FIXED	movie_zipfile_urn_for_movie_id() now uses .get(MOVIE_ZIPFILE_URN).
odb_movie_data.py 108–110	MOVIE_ZIPFILE_URN, MOVIE_DATA_URN	FIXED	get_movie_data() uses .get(); no try/except needed.
odb_movie_data.py 131, 145	VERSION	FIXED	set_movie_data() uses movie.get(VERSION, 0).
odb_movie_data.py 186	MOVIE_ZIPFILE_URN	FIXED	purge_movie_zipfile() uses urn = movie.get(...) then delete_object(urn).
flask_api.py 449	MOVIE_ZIPFILE_URN	Medium	After if movie_metadata.get(MOVIE_ZIPFILE_URN, None); then we do movie_metadata[MOVIE_ZIPFILE_URN] – safe if logic is correct.

Recommendations: All high-priority movie URN/version fixes above are implemented.

---

Category 2: User dict – keys that may be absent

Source: get_user() / DynamoDB users table. Some attributes are set only when the user is an admin or has a primary course.

Location	Key	Risk	Notes
flask_api.py 314	'primary_course_id'	High	New user or user without primary course → KeyError when creating a movie.
odb.py 1268	PRIMARY_COURSE_ID	High	course_id = user[PRIMARY_COURSE_ID] in list_movies; can be missing.
apikey.py 176	'primary_course_id'	Medium	user_dict['primary_course_id']; may be None for some users (apikey sets it to None in one branch).
odb.py 517, 618, 959, 966, 992, 1002, 1104–1105, 1130, 1172, 1245, 1343, 1576–1577, 1593	COURSES, ADMIN_FOR_COURSES, USER_ID, etc.	Low–Medium	Schema and add-course logic usually set these; missing only on legacy or partial records.

Recommendations:

• flask_api.api_new_movie: use user.get('primary_course_id') (or PRIMARY_COURSE_ID) and return 400 if missing (e.g. “Set a primary course before creating a movie”).

• odb.list_movies: use user.get(PRIMARY_COURSE_ID) and handle None (e.g. no movies for that user, or fetch by another rule).

• apikey.py: use user_dict.get('primary_course_id') and handle None where needed.

---

Category 3: Course dict – keys from DynamoDB

Source: get_course() / DynamoDB courses table. Schema defines expected attributes.

Location	Key	Risk	Notes
odb.py (multiple)	COURSE_ID, COURSE_NAME, ADMINS_FOR_COURSE	Low	Part of core course schema; only risky if table is corrupted or schema changed.

No change suggested unless you add stricter typing (e.g. TypedDict).

---

Category 4: DynamoDB / boto3 response shapes

Source: response from query(), scan(), get_item(), etc.

Location	Key	Risk	Notes
odb.py 845	response['LastEvaluatedKey']	Low	Only used when 'LastEvaluatedKey' in response (line 843).
Various	response['Items']	Low	Standard DynamoDB contract; use response.get('Items', []) if you want to be defensive.
Various	e.response['Error']['Code']	Low	boto3 ClientError contract; documented structure.

Optional hardening: use response.get('Items', []) and response.get('LastEvaluatedKey') where pagination is used.

---

Category 5: Item/frame from query or batch

Source: Items from response['Items'], or from get_movie_frame(), etc.

Location	Key	Risk	Notes
odb.py 734–735	movie_frame[MOVIE_ID], movie_frame[FRAME_NUMBER]	Low	From movie_frames table; primary key attributes.
odb.py 1424, 1435–1437	frame[FRAME_NUMBER], frame[MOVIE_ID], frame[FRAME_URN]	Low	Same table, expected attributes.
odb.py 506, 1201	item[API_KEY], item[USER_ID]	Low	From api_keys / users tables; key attributes.

Generally safe; only change if you add optional attributes to those tables.

---

Category 6: Newly created / in-memory dicts

Source: ret = {'error': False}, create_new_movie return value, etc.

Location	Key	Risk	Notes
flask_api.py 313–328	ret[MOVIE_ID], user['primary_course_id']	High (user)	ret is built in this function; user is from get_user() – use .get('primary_course_id') as above.

---

Summary – high‑value fixes

1. Movie (done): movie_data_urn_for_movie_id, movie_zipfile_urn_for_movie_id, get_movie_data, set_movie_data, purge_movie_zipfile, and Lambda lambda_tracking_env.get_movie_data now use .get() for URNs and VERSION.

2. User (pending): flask_api new-movie path – use user.get('primary_course_id') and handle None.

3. User (pending): odb.list_movies – use user.get(PRIMARY_COURSE_ID) and handle None.

4. User (pending): apikey – use user_dict.get('primary_course_id') where appropriate.

Optional: add a TypedDict (or similar) for movie/user so Pyright can warn on missing optional keys when you use [] instead of .get().

---

Pydantic types for User and Movie – scope evaluation

Current state: schema.py already defines Pydantic User and Movie models. They are used for validation on write (put_user, put_movie use User(**user) / Movie(**moviedict)). get_user and get_movie return plain dicts (DynamoDB items, with fix_movie() applied for movies in some code paths).

What “moving to Pydantic” would mean: Have get_user() and get_movie() return User and Movie instances instead of dicts, and type hints accordingly. That would give attribute access, optional-field safety, and better static checking.

Extent of change

Area	Effort	Notes
Return type of get_movie / get_user	Small	In odb.py, have get_movie return Movie(**fix_movie(item)) and get_user return User(**fix_user(item)) (see below). Handle ValidationError for bad DB data (log and re-raise or return None per policy).
fix_user	Small	There is fix_movie / fix_movie_prop_value for DynamoDB→Python types (Decimal→int, etc.). You’d add a similar fix_user (and possibly fix_course) so DynamoDB output fits the Pydantic model.
Call sites using dict subscript	None	Pydantic BaseModel supports obj['key'] via __getitem__, so existing movie[MOVIE_ID], user[USER_ID] etc. keep working.
Call sites using .get()	Medium	Models don’t have .get(key, default). There are ~15+ places that do movie.get(...) or user.get(...) (in odb.py, odb_movie_data.py, resize.py, lambda_tracking_env.py, flask_api.py, etc.). Each would need to become getattr(obj, attr, default) or a small helper (e.g. get_model_attr(m, KEY, default)), or you keep a .get()-like method on the model (e.g. a custom method or model_dump().get()).
Lambda / vendored app	Medium	Same .get() and type changes in lambda-resize and any vendored copies of app code.
Tests	Low–medium	Tests that build dicts and pass to code expecting User/Movie may need to use User(...) / Movie(...) or .model_dump() where a dict is required.
Schema optionality	Small	User currently has primary_course_id: str. For legacy users or “no course yet”, that would need to be str | None and call sites that assume “always set” would need to handle None (as in the Category 2 fixes).

Recommendation

• Short term: Keep returning dicts from get_movie/get_user; keep validating on write with existing Pydantic models. The optional-key fixes (e.g. .get() for primary_course_id, URNs, version) are the main win and are done or documented.

• If you move to Pydantic return types:

  1. Add fix_user() (and optionally fix_course()) for DynamoDB payloads.

  2. Change get_movie/get_user to return Movie/User, with ValidationError handling.

  3. Replace every movie.get(KEY, default) / user.get(KEY, default) with a single pattern: e.g. getattr(m, KEY, default) or a helper so Pyright and readers see one convention. Expect on the order of 20–30 call sites across app and lambda.

  4. Make User.primary_course_id optional (str \| None) if that reflects real data; then handle None in the few places that use it.

Overall: moderate effort (roughly half a day to a day of focused refactor plus tests), with the main cost being the .get() call sites and keeping lambda/vendored code in sync.