Content-pack import errors put raw exception text in a 400 (CA-003) #781

New issue

Closed

opened 2026-09-23 16:36:25 +00:00 by claude-bot · 0 comments

claude-bot commented

2026-09-23 16:36:25 +00:00

Collaborator

Found building Settings → Content packs (#729).

webapp/backend/app/reference/import_service.py builds some of its 400 responses from str(exc) — around lines 262, 339 and 725. So a parser's own exception text reaches the person loading a pack, as a 4xx detail.

SH-7's CA-003 is about exactly this: its drawn example of what must never be shown is "Request failed with status code 500: IntegrityError (psycopg.errors.UniqueViolation)…". Lane 3 added utils/plainError.js, which shows a 4xx's detail because a 4xx sentence is meant to be written for people — and these three are not. So the frontend cannot filter them without also throwing away the real sentences beside them.

Fix

At each site, say what went wrong with the file, in the product's own words — which part of the pack could not be read, and what to do about it — and log exc server-side for whoever debugs it. The detail should never depend on which library raised.

Worth a test per site that the detail contains no exception class name and no library-internal text.

🤖 Generated with Claude Code

Found building Settings → Content packs (#729). `webapp/backend/app/reference/import_service.py` builds some of its 400 responses from `str(exc)` — around lines 262, 339 and 725. So a parser's own exception text reaches the person loading a pack, as a 4xx `detail`. SH-7's `CA-003` is about exactly this: its drawn example of what must never be shown is *"Request failed with status code 500: IntegrityError (psycopg.errors.UniqueViolation)…"*. Lane 3 added `utils/plainError.js`, which shows a 4xx's `detail` because a 4xx sentence is meant to be written for people — and these three are not. So the frontend cannot filter them without also throwing away the real sentences beside them. ## Fix At each site, say what went wrong with the *file*, in the product's own words — which part of the pack could not be read, and what to do about it — and log `exc` server-side for whoever debugs it. The detail should never depend on which library raised. Worth a test per site that the detail contains no exception class name and no library-internal text. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot referenced this issue

2026-09-23 16:59:51 +00:00

Lane 3: Settings' last sections, D22's leave prompt, and a regression fix for players (#729, CAMP-15, CAMP-17, SH-7) #783

claude-bot referenced this issue

2026-09-23 20:56:52 +00:00

Build lane 3: the campaign core and Settings (CAMP-1 to CAMP-17, SH-7) #729

claude-bot referenced this issue

2026-09-23 21:13:32 +00:00

Build lane 3: the campaign core and Settings (CAMP-1 to CAMP-17, SH-7) #729

claude-bot referenced this issue from a pull request that will close it,

2026-09-24 03:12:35 +00:00

Lane 3 completions: the recap line, never-expiring invites, chapter rules, import errors, the bin's real grace period (D91, D92, #773, #781, #729) #802