[harbor-commons] Public REST API for 990 transparency data

[Copilot]

990 financial data is currently only accessible via direct Supabase queries. This adds a public FastAPI service reading from sailing_filer_core to make it legible to parents, journalists, funders, and researchers.

Endpoints (packages/harbor-commons/src/api/main.py)

• GET /clubs — paginated, EIN-deduplicated list (latest tax year per org), optional state filter
• GET /clubs/{ein} — full financial profile, up to 3 years of 990 data
• GET /clubs/{ein}/quiet-yield — volunteer labor valuation via existing calculate_quiet_yield + BLS benchmarks
• GET /clubs/compare?eins=ein1,ein2 — side-by-side comparison (2–10 clubs)
• GET /health — healthcheck
• GET /docs — OpenAPI (built-in)

Rate limiting

slowapi at 60 req/min/IP on all endpoints.

Supabase access pattern

Reads via anon key (SUPABASE_ANON_KEY), RLS-protected. Lazy singleton client. No writes.

# All queries target sailing_filer_core with column names matching the schema exactly
supabase.table("sailing_filer_core").select(columns).eq("ein", ein).order("tax_year", desc=True).limit(3).execute()

Tests

15 unit tests in test_api.py — all Supabase calls mocked via monkeypatched _get_supabase. Covers pagination, deduplication, 404s, validation (min 2 / max 10 EINs for compare), and OpenAPI schema correctness.

Deps

Added slowapi>=0.1.9 to root and package requirements.txt. Advisory DB clean.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[harbor-commons] Public API: expose 990 transparency data via REST endpoints</issue_title>
<issue_description>Harbor Commons' public-good case rests on making 990 data legible to anyone -- parents, journalists, funders, researchers. Currently accessible only via direct Supabase queries. Work: (1) Create packages/harbor-commons/src/api/main.py (FastAPI) with endpoints: GET /clubs -- paginated list of sailing orgs (name, ein, state, type, latest_revenue), GET /clubs/{ein} -- full financial profile (3 years of 990 data), GET /clubs/{ein}/quiet-yield -- estimated volunteer labor value, GET /clubs/compare?eins=ein1,ein2 -- side-by-side comparison, (2) All endpoints read from Supabase sailing_filer_core via anon key (public data, RLS already configured), (3) Add OpenAPI docs at /docs, (4) Add rate limiting (slowapi, 60 req/min/IP), (5) Deploy target: Railway or Fly.io (free tier). This is the SEO surface + civic credibility layer for funder conversations.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes [harbor-commons] Public API: expose 990 transparency data via REST endpoints #20

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.