fix: handle exclusion failures in session load try block

Author: clean6378-max-it

api/_session_handlers.py

@@ -59,6 +59,13 @@ def resolve_loaded_session(
 
     try:
         session = get_cached_session(filepath)
+        rules = current_app.config.get("EXCLUSION_RULES") or []
+        if is_session_excluded(rules, session, project_name):
+            return error_response(
+                ErrorCode.SESSION_NOT_FOUND,
+                "Session not found",
+                404,
+            )
     except SESSION_LOAD_ERRORS:
         current_app.logger.exception(parse_log_action, session_id)
         return error_response(
@@ -67,14 +74,6 @@ def resolve_loaded_session(
             500,
         )
 
-    rules = current_app.config.get("EXCLUSION_RULES") or []
-    if is_session_excluded(rules, session, project_name):
-        return error_response(
-            ErrorCode.SESSION_NOT_FOUND,
-            "Session not found",
-            404,
-        )
-
     return LoadedSession(session=session, filepath=filepath)
 
 

tests/test_error_propagation.py

@@ -32,6 +32,7 @@ class names from a defensive blocklist.
 
 from flask import Flask
 
+from api.export_api import export_bp
 from api.projects import projects_bp
 from api.search import _IndexSearchOutcome
 from api.sessions import sessions_bp
@@ -94,6 +95,13 @@ def _write_session(tmp_path, project: str, session_id: str, content: str):
     return p
 
 
+def _patch_exclusion_raises(monkeypatch):
+    def _boom(*_args, **_kwargs):
+        raise ValueError("internal_exclusion_secret")
+
+    monkeypatch.setattr("api._session_handlers.is_session_excluded", _boom)
+
+
 # ---------------------------------------------------------------------------
 # /api/sessions/<project>/<id>
 # ---------------------------------------------------------------------------
@@ -122,6 +130,18 @@ def _boom(*args, **kwargs):
         assert "internal_secret_field_id" not in json.dumps(body)
         _assert_no_class_name_leak(json.dumps(body))
 
+    def test_500_when_exclusion_raises_does_not_leak(self, tmp_path, client, monkeypatch):
+        _write_session(tmp_path, "proj", "abc", '{"type":"user","message":{}}')
+        _patch_exclusion_raises(monkeypatch)
+
+        resp = client.get("/api/sessions/proj/abc")
+        assert resp.status_code == 500
+        body = resp.get_json()
+        assert body.get("error") == "Failed to parse session"
+        assert body.get("code") == "PARSE_ERROR"
+        assert "internal_exclusion_secret" not in json.dumps(body)
+        _assert_no_class_name_leak(json.dumps(body))
+
     def test_404_on_missing_file_keeps_session_id_safe(self, tmp_path, client):
         # Session ID is part of the URL so it appears in the 404 message —
         # that's fine; what we're guarding is exception-class leakage, which
@@ -163,6 +183,47 @@ def _boom(*args, **kwargs):
         assert "/private/path" not in json.dumps(body)
         _assert_no_class_name_leak(json.dumps(body))
 
+    def test_500_when_exclusion_raises_does_not_leak(self, tmp_path, client, monkeypatch):
+        _write_session(tmp_path, "proj", "abc", '{"type":"user","message":{}}')
+        _patch_exclusion_raises(monkeypatch)
+
+        resp = client.get("/api/sessions/proj/abc/stats")
+        assert resp.status_code == 500
+        body = resp.get_json()
+        assert body.get("error") == "Failed to parse session"
+        assert body.get("code") == "PARSE_ERROR"
+        assert "internal_exclusion_secret" not in json.dumps(body)
+        _assert_no_class_name_leak(json.dumps(body))
+
+
+# ---------------------------------------------------------------------------
+# /api/export/session
+# ---------------------------------------------------------------------------
+
+
+class TestExportSessionErrorBody:
+    @pytest.fixture
+    def export_client(self, tmp_path):
+        app = Flask(__name__)
+        app.config["TESTING"] = True
+        app.config["CLAUDE_PROJECTS_DIR"] = str(tmp_path)
+        app.register_blueprint(export_bp)
+        return app.test_client()
+
+    def test_500_when_exclusion_raises_does_not_leak(
+        self, tmp_path, export_client, monkeypatch
+    ):
+        _write_session(tmp_path, "proj", "abc", '{"type":"user","message":{}}')
+        _patch_exclusion_raises(monkeypatch)
+
+        resp = export_client.get("/api/export/session/proj/abc")
+        assert resp.status_code == 500
+        body = resp.get_json()
+        assert body.get("error") == "Failed to parse session"
+        assert body.get("code") == "PARSE_ERROR"
+        assert "internal_exclusion_secret" not in json.dumps(body)
+        _assert_no_class_name_leak(json.dumps(body))
+
 
 # ---------------------------------------------------------------------------
 # /api/projects (per-session card)

utils/session_errors.py

@@ -1,11 +1,7 @@
 """Exception types treated as session load/parse failures."""
 
-import json
-
 SESSION_LOAD_ERRORS: tuple[type[BaseException], ...] = (
-    json.JSONDecodeError,
     KeyError,
     ValueError,
     OSError,
-    FileNotFoundError,
 )