"""Validation errors for sensitive AI payloads must never echo their input."""
from fastapi import Request
from fastapi.exceptions import RequestValidationError
from fastapi.responses import JSONResponse
from fastapi.routing import APIRoute


class SensitivePayloadRoute(APIRoute):
    def get_route_handler(self):
        handler = super().get_route_handler()
        async def handle(request: Request):
            try:
                return await handler(request)
            except RequestValidationError as error:
                # Pydantic's input/ctx and custom field names may contain secrets.
                # Keep stable error kinds and safe schema field locations only.
                schema_fields = {"body", "enabled", "gatewayUrl", "capability", "credential", "content", "logs", "key", "value", "category", "pinned"}
                return JSONResponse(status_code=422, content={"detail": [
                    {"loc": [field if field in schema_fields else "field" for field in item.get("loc", [])], "type": item["type"], "msg": "Invalid field value"}
                    for item in error.errors()
                ]})
        return handle