Publish curated Unraid-AppOps-Gateway source from 034c9f844d2455850ba37b31379b7edaa786583e

backend/app/core/api_validation.py

@@ -0,0 +1,22 @@
+"""Validation errors for sensitive AI payloads must never echo their input."""
+from fastapi import Request
+from fastapi.exceptions import RequestValidationError
+from fastapi.responses import JSONResponse
+from fastapi.routing import APIRoute
+
+
+class SensitivePayloadRoute(APIRoute):
+    def get_route_handler(self):
+        handler = super().get_route_handler()
+        async def handle(request: Request):
+            try:
+                return await handler(request)
+            except RequestValidationError as error:
+                # Pydantic's input/ctx and custom field names may contain secrets.
+                # Keep stable error kinds and safe schema field locations only.
+                schema_fields = {"body", "enabled", "gatewayUrl", "capability", "credential", "content", "logs", "key", "value", "category", "pinned"}
+                return JSONResponse(status_code=422, content={"detail": [
+                    {"loc": [field if field in schema_fields else "field" for field in item.get("loc", [])], "type": item["type"], "msg": "Invalid field value"}
+                    for item in error.errors()
+                ]})
+        return handle