fix: sanitize Jobs and Auditor API error responses

[anastasia-nesterenko]

Summary

Fixes AIRCORE-240 by preventing raw Python and backend exception details from being returned by Jobs and Auditor API endpoints.

Changes

• Replace raw exception details with actionable, resource-specific messages.
• Include resource names and workspaces in not-found responses.
• Provide safe validation guidance for:
  • missing or invalid job fields
  • invalid job-status filters
  • incompatible GPU/Docker configurations
• Provide actionable conflict responses for:
  • duplicate or conflicting job creation
  • invalid job state transitions
  • concurrently modified Auditor configs and targets
• Log internal exception details server-side without exposing them to API clients.
• Add regression coverage for string, list, and dictionary validation details and conflict sanitization.
• Update existing tests for the more descriptive not-found responses.

Validation

• uv run --frozen pytest services/core/jobs/tests/test_jobs_api.py -q
  • 40 passed, 1 skipped
• Ruff lint and formatting checks passed for the changed files.

Security impact

API clients no longer receive internal exception class names, database-version details, entity internals, or state-transition implementation details.

Summary by CodeRabbit

• Bug Fixes
  • Improved 409 conflict handling for audit config and target updates with fixed, user-friendly “refresh and retry” messaging and no raw DB/exception leakage.
  • Enhanced Jobs API error details for validation/compilation/state-transition conflicts, including clearer workspace-specific 404s.
• Tests
  • Expanded assertions for sanitized 409/422/404 responses and verified CR/LF-safe logging across audit config/target updates, job creation, cancellation, and job-step status flows.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 26621c6f-4ff0-44de-9e13-8eb110dcb358

📥 Commits

Reviewing files that changed from the base of the PR and between 3b4cdca and 6a4868b.

📒 Files selected for processing (3)

• services/core/jobs/src/nmp/core/jobs/api/v2/jobs/endpoints.py
• services/core/jobs/src/nmp/core/jobs/app/dispatcher.py
• services/core/jobs/tests/test_jobs_api.py

🚧 Files skipped from review as they are similar to previous changes (2)

• services/core/jobs/tests/test_jobs_api.py
• services/core/jobs/src/nmp/core/jobs/api/v2/jobs/endpoints.py

---

📝 Walkthrough

Walkthrough

Changes

Auditor conflict responses now use fixed 409 messages and sanitized logging. Jobs APIs add structured error formatting, dedicated dispatcher exceptions, contextual 404 responses, explicit conflict handling, and expanded sanitization tests.

Nemo Auditor conflict responses

Layer / File(s)	Summary
Sanitized config and target conflicts plugins/nemo-auditor/src/nemo_auditor/api/v2/configs.py, plugins/nemo-auditor/src/nemo_auditor/api/v2/targets.py, plugins/nemo-auditor/tests/*	Config and target update conflicts log sanitized context while returning fixed 409 refresh-and-retry messages; tests verify internal details are omitted.

Jobs API error responses

Layer / File(s)	Summary
Job creation exception contracts and formatting services/core/jobs/src/nmp/core/jobs/app/dispatcher.py, services/core/jobs/src/nmp/core/jobs/api/v2/jobs/endpoints.py	Dedicated duplicate-job and secret-validation exceptions feed structured validation, compilation, entity, conflict, and filter error responses.
Job resource conflicts and not-found details services/core/jobs/src/nmp/core/jobs/api/v2/jobs/endpoints.py	Job, result, step, and task endpoints return contextual 404 details and distinguish state-transition from concurrent-modification conflicts.
Error response coverage services/core/jobs/tests/*	Tests cover sanitized creation and conflict details, filter validation output, contextual not-found responses, and CR/LF-free logging.

Suggested labels: test

Suggested reviewers: marcusds, matthewgrossman

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 61.70% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: sanitizing Jobs and Auditor API error responses.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch anesterenko/aircore-240-generic-error-messages-expose-internal-exceptions-in-api

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	27105/34823	77.8%	62.1%
Integration Tests	15886/33434	47.5%	19.9%

[mckornfield]

bit skeptical of some of the str matching, otherwise fine

[mckornfield]

also pushed to my other PR for the failing test, we'll see 🙏