fix(security): sanitize provider span failures

Author: Aitomates

src/cas_reference_product/app.py

@@ -13,10 +13,6 @@
 _tracer = trace.get_tracer(__name__)
 
 
-def _raise_workflow_backend_failure(error: WorkflowAgentServiceError) -> None:
-    raise HTTPException(status_code=502, detail="Workflow backend request failed") from error
-
-
 def create_app(settings: Settings | None = None) -> FastAPI:
     app_settings = settings or get_settings()
 
@@ -59,7 +55,7 @@ def execute(envelope: PromptEnvelope, request: Request) -> WorkflowResult:
             orchestrator = WorkflowOrchestrator(service, app_settings.repository)
             try:
                 result = orchestrator.execute(envelope)
-            except WorkflowAgentServiceError as error:
+            except WorkflowAgentServiceError:
                 span.add_event(
                     "workflow.failed",
                     attributes={
@@ -68,7 +64,9 @@ def execute(envelope: PromptEnvelope, request: Request) -> WorkflowResult:
                         "error": True,
                     },
                 )
-                _raise_workflow_backend_failure(error)
+                raise HTTPException(
+                    status_code=502, detail="Workflow backend request failed"
+                ) from None
             span.add_event(
                 "workflow.completed",
                 attributes={

src/cas_reference_product/workflow.py

@@ -56,8 +56,8 @@ def run(self, envelope: PromptEnvelope) -> str:
                         }
                     },
                 )
-            except Exception as error:
-                raise WorkflowAgentServiceError("Foundry workflow invocation failed") from error
+            except Exception:
+                raise WorkflowAgentServiceError("Foundry workflow invocation failed") from None
         return response.output_text
 
 

tests/test_api.py

@@ -1,11 +1,9 @@
 from typing import Any
 from unittest.mock import patch
 
-import pytest
-from fastapi import HTTPException
 from fastapi.testclient import TestClient
 
-from cas_reference_product.app import _raise_workflow_backend_failure, create_app
+from cas_reference_product.app import create_app
 from cas_reference_product.config import Settings
 from cas_reference_product.workflow import WorkflowAgentServiceError
 
@@ -71,23 +69,3 @@ def test_workflow_api_sanitizes_external_service_failures(envelope: "Any") -> No
     assert response.status_code == 502
     assert response.json() == {"detail": "Workflow backend request failed"}
     assert "sensitive" not in response.text
-
-
-def test_workflow_backend_failure_preserves_exception_chain() -> None:
-    with pytest.raises(HTTPException) as caught:
-        try:
-            raise RuntimeError("sensitive provider detail")
-        except RuntimeError as provider_error:
-            try:
-                raise WorkflowAgentServiceError("Foundry workflow invocation failed") from (
-                    provider_error
-                )
-            except WorkflowAgentServiceError as workflow_error:
-                _raise_workflow_backend_failure(workflow_error)
-
-    assert caught.value.status_code == 502
-    assert caught.value.detail == "Workflow backend request failed"
-    assert isinstance(caught.value.__cause__, WorkflowAgentServiceError)
-    assert str(caught.value.__cause__) == "Foundry workflow invocation failed"
-    assert isinstance(caught.value.__cause__.__cause__, RuntimeError)
-    assert str(caught.value.__cause__.__cause__) == "sensitive provider detail"

tests/test_service_factory.py

@@ -93,5 +93,4 @@ def test_foundry_service_sanitizes_sdk_failure(envelope: "Any") -> None:
         ) as caught:
             service.run(envelope)
 
-    assert isinstance(caught.value.__cause__, RuntimeError)
-    assert str(caught.value.__cause__) == "sensitive provider detail"
+    assert caught.value.__cause__ is None