kobotoolbox / kpi / 30519181860

push

github

fix(api): return generic messages instead of raw exception text DEV-2489 (#7338)

### 📣 Summary

Error messages shown when something can't be saved are now short and
readable instead of long technical text.

### 📖 Description

In a few places — setting up two-factor authentication, turning on
automatic transcription or translation for a question, and saving a
setting that contains JSON — KoboToolbox used to show a long, technical
error message when something went wrong. Those messages now read as a
short plain sentence, and they can be translated. The technical detail
is still recorded on the server, so support can still investigate.

### 💭 Notes

Four CodeQL alerts from DEV-2422
([#186](https://github.com/kobotoolbox/kpi/security/code-scanning/186),
[#153](https://github.com/kobotoolbox/kpi/security/code-scanning/153),
[#185](https://github.com/kobotoolbox/kpi/security/code-scanning/185),
[#77](https://github.com/kobotoolbox/kpi/security/code-scanning/77)) —
all four returned exception text straight to the client.

- `mfa/views.py`: `str(cause)` → fixed string. The UI never read that
key (`mfaActions.ts` falls back to `non_field_errors`), so nothing
visible changes.
- `subsequences/serializers.py` ×2: a raw `jsonschema` error stringifies
to the **entire schema plus the submitted instance**. Now a generic
message, wrapped in `gettext_lazy` at the constant so `makemessages`
extracts it.
- `writable_json.py`: narrowed the bare `except Exception`.
`RecursionError` is deliberately kept in the tuple — deeply nested JSON
raises it (confirmed at ~100k levels) and it is neither `ValueError` nor
`TypeError`, so dropping it would turn a 400 into a 500.
- **Sentry:** the MFA case already reports — `logging.error(…,
exc_info=True)` is above the `event_level=WARNING` of our
`LoggingIntegration`. The three DRF `ValidationError`s deliberately do
not: they are user-input rejections, not bugs, and one event per
malformed payload would drown the real errors.
- **Tradeo... (continued)

9488 of 12791 branches covered (74.18%)

30729 of 37503 relevant lines covered (81.94%)

5.51 hits per line