CORE-2783: Add outcome and cardDecisionSource mapping to DTOs and models

[henriquesalvaro]

Description of PR and Why

Unit is adding new fields to help understanding the decisions behind an authorization being approved or declined, their SDK isn't updated very frequently, and we use it in a lot of places in our codebase.

More info on their docs: Understanding Authorization Decisions, and on this slack announcement.

This PR just adds the outcome and card_decision_source to the proper authorization request / authorization / transaction DTOs and models.

Risks and Impacted Systems

No risk, I'll bump the unit version on a benefitsapi PR where we start tracking those fields.

Related Links

• Resolves CORE-2783

---

Note

Low Risk
Additive optional JSON:API field mapping with no behavior changes; risk is limited to consumers assuming new attributes are always present.

Overview
Adds Unit API fields that explain card authorization decisions: outcome on authorization-request DTOs and cardDecisionSource on authorization and card-related transaction DTOs.

BaseAuthorizationRequest now maps optional outcome (Approved, Declined, PostTimeout, etc.). AuthorizationDTO gains cardDecisionSource with a typed literal (Org, Unit, IssuerStandIn, timeout defaults, etc.). Purchase, ATM, and card transaction DTOs expose the same cardDecisionSource attribute from JSON:API.

E2e tests assert decoding for these fields across authorization requests, authorizations, and the three transaction types; purchase authorization request tests now fully decode and assert outcome.

^{Reviewed by Cursor Bugbot for commit 692f9fa. Bugbot is set up for automated code reviews on this repo. Configure here.}

[linear-code]

CORE-2783

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 692f9fa. Configure here.}

[cursor]

Unused type alias AuthorizationRequestOutcome never referenced

Low Severity

AuthorizationRequestOutcome is defined as a Literal type alias but is never used in any type annotation. The outcome field in BaseAuthorizationRequest is stored via attributes.get("outcome") without referencing this type. Compare this with CardDecisionSource in authorization.py, which is actually used as a type hint for card_decision_source in AuthorizationDTO.__init__.

 

^{Reviewed by Cursor Bugbot for commit 692f9fa. Configure here.}

[henriquesalvaro]

that is also true for the PurchaseAuthorizationRequestStatus 🤷 this is an SDK that can be imported by others, so those literals can be used by SDK users, just following w/e established pattern Unit defined. The AuthorizationRequest object is not handled the same way the authorization/transaction objects are.