Prevent session errors from swallowing API error responses (#2059)

Why is this change needed?
Prior to this change, ErrorReporter::reportError() only wrapped its
call to storeSessionFeedback() in a finally block, not a catch. On
stateless routes (e.g. the /api/connections metadata push endpoint),
starting the native PHP session while storing feedback info can fail
(e.g. "headers already sent"). That failure propagated out of
reportError(), out of the calling exception listener, and skipped
$event->setResponse() in ApiHttpExceptionListener — so the intended
400/500 JSON error response for a failed push was never set and the
client received an HTTP 200 instead.

How does it address the issue?
This change adds a catch (Throwable) around storeSessionFeedback(),
logging the secondary failure as a warning instead of letting it
escape. reportError() can no longer throw, so every exception
listener that calls it (API, feedback page, fallback) reliably
finishes and sets its intended error response.

#2051

Author: kayjoosten

src/OpenConext/EngineBlockBridge/ErrorReporter.php

@@ -27,6 +27,7 @@
 use OpenConext\EngineBlock\Service\FeedbackStateHelperInterface;
 use Psr\Log\LoggerInterface;
 use Symfony\Component\HttpFoundation\RequestStack;
+use Throwable;
 
 class ErrorReporter
 {
@@ -66,6 +67,10 @@ public function reportError(Exception $exception, string $messageSuffix): void
 
         try {
             $this->storeSessionFeedback($exception);
+        } catch (Throwable $sessionException) {
+            $this->logger->warning(
+                'Unable to store feedback info in session: ' . $sessionException->getMessage(),
+            );
         } finally {
             // flush all messages in queue, something went wrong!
             $this->engineBlockApplicationSingleton->flushLog('An error was caught');

tests/unit/OpenConext/EngineBlockBridge/ErrorReporterTest.php

@@ -142,4 +142,16 @@ public function it_stores_the_pep_policy_decision_in_the_session(): void
 
         self::assertSame($decision, $this->session->get('error_authorization_policy_decision'));
     }
+
+    #[Test]
+    public function it_does_not_propagate_exceptions_thrown_while_storing_feedback_in_the_session(): void
+    {
+        $this->feedbackInfoCollector
+            ->shouldReceive('collect')
+            ->andThrow(new Exception('Failed to start the session because headers have already been sent'));
+
+        $this->applicationSingleton->shouldReceive('flushLog')->with('An error was caught')->once();
+
+        $this->reporter->reportError(new Exception('test'), '');
+    }
 }