Mejora de seguridad

backend/app/api/v1/endpoints/reports.py

@@ -7,7 +7,7 @@ Accesible por ADMIN y SUPPORT_MANAGER.
 
 from fastapi import APIRouter, Depends, Query, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
-from sqlalchemy import select, func, and_, case, text
+from sqlalchemy import select, func, and_, case, text, literal_column
 from typing import Optional, List
 from datetime import datetime, timedelta, timezone
 import uuid
@@ -505,20 +505,23 @@ async def get_report_trends(
     tenant_filter = Ticket.tenant_id == current_user.tenant_id
 
     # Tickets creados por día
+    # literal_column("'day'") evita que SQLAlchemy genere múltiples parámetros
+    # ($1, $4, $5) para 'day', lo que confunde a PostgreSQL en el GROUP BY.
+    _day_lit = literal_column("'day'")
     created_rows = (await db.execute(
         select(
-            func.date_trunc("day", Ticket.created_at).label("day"),
+            func.date_trunc(_day_lit, Ticket.created_at).label("day"),
             func.count(Ticket.id).label("cnt"),
         )
         .where(and_(tenant_filter, Ticket.created_at >= period_start))
-        .group_by(func.date_trunc("day", Ticket.created_at))
-        .order_by(func.date_trunc("day", Ticket.created_at))
+        .group_by(func.date_trunc(_day_lit, Ticket.created_at))
+        .order_by(func.date_trunc(_day_lit, Ticket.created_at))
     )).all()
 
     # Tickets resueltos por día (según resolved_at)
     resolved_rows = (await db.execute(
         select(
-            func.date_trunc("day", Ticket.resolved_at).label("day"),
+            func.date_trunc(_day_lit, Ticket.resolved_at).label("day"),
             func.count(Ticket.id).label("cnt"),
         )
         .where(and_(
@@ -526,8 +529,8 @@ async def get_report_trends(
             Ticket.resolved_at >= period_start,
             Ticket.resolved_at.isnot(None),
         ))
-        .group_by(func.date_trunc("day", Ticket.resolved_at))
-        .order_by(func.date_trunc("day", Ticket.resolved_at))
+        .group_by(func.date_trunc(_day_lit, Ticket.resolved_at))
+        .order_by(func.date_trunc(_day_lit, Ticket.resolved_at))
     )).all()
 
     created_map: dict[str, int] = {r.day.strftime("%Y-%m-%d"): r.cnt for r in created_rows}