fix(python-fastapi): stop exposing exception details in API errors

[cbullinger]

Summary

Resolves 16 CodeQL py/stack-trace-exposure findings in movies.py by returning generic error messages to clients while logging full exceptions server-side.

Changes

• Add server_error_response() in errorResponse.py (uses logger.exception())
• Replace all str(e) in HTTP error payloads in movies.py with fixed messages
• Harden get_embedding() Voyage AI error handling (generic VoyageAPIError messages + logging)
• Remove exc.message from VoyageAPIError handler details in main.py

Test plan

• Unit tests pass (65/65)
• pip-audit and Run Python Tests CI pass
• Code scanning alerts README updates and add issue template #7–fix(java): index creation logic #22 close after merge

Related

• CodeQL remediation PR 2 of 5 (after chore(ci): add explicit GITHUB_TOKEN permissions to workflows #116 workflow permissions)
• Alerts: https://github.com/mongodb/docs-sample-apps/security/code-scanning

Made with Cursor

[Copilot]

Pull request overview

Remediates CodeQL py/stack-trace-exposure findings in the Python FastAPI mflix app by ensuring API responses don’t echo raw exception details, while preserving full exception context in server logs.

Changes:

• Introduces a shared server_error_response() helper that logs exceptions and returns a generic error payload.
• Replaces str(e) usage in multiple movies.py endpoints with fixed client-safe messages.
• Tightens Voyage AI embedding error handling by logging SDK exceptions and returning generic VoyageAPIError messages; removes exc.message from the Voyage API error handler response.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
mflix/server/python-fastapi/src/utils/errorResponse.py	Adds server_error_response() to centralize “log + generic 500 response” behavior.
mflix/server/python-fastapi/src/routers/movies.py	Replaces exception-detail responses with server_error_response() and logs Voyage AI SDK errors in get_embedding().
mflix/server/python-fastapi/main.py	Removes exc.message from VoyageAPIError handler payload to avoid leaking internal details.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[dacharyc]

VoyageAuthError is the one path that still has no server-side logging. voyage_error.AuthenticationError is caught here and re-raised as VoyageAuthError, but neither this site nor the voyage_auth_error_handler in main.py calls logger.exception(). A rotated or revoked key would produce no trace in the logs. Consider adding a log call before the re-raise:

except voyage_error.AuthenticationError:
    logger.exception("Voyage AI authentication failed")
    raise VoyageAuthError("Invalid Voyage AI API key. Please check your VOYAGE_API_KEY in the .env file")

[dacharyc]

Small suggested improvement, but overall LGTM. ✅

[cbullinger]

Added logger.exception("Voyage AI authentication failed") before raising VoyageAuthError in get_embedding() — pushed in 48c91c1. Matches the logging pattern used for the other Voyage error paths.