🛡️ Sentinel: [MEDIUM] Fix error message information exposure

[socialawy-dev]

🚨 Severity: MEDIUM
💡 Vulnerability: The API route for ingesting files exposed raw exception strings directly to the client via HTTPException detail fields when a failure occurred during the UploadFile processing.
🎯 Impact: If an upload fails due to filesystem permission issues, disk space, or a corrupted stream, the internal path, environment details, or stack trace could be leaked to an attacker.
🔧 Fix: Replaced the string interpolation ({e}) in the client-facing response with a generic "Upload failed due to an internal error" message, and added an internal logger.error call to ensure the exception details are securely preserved for debugging.
✅ Verification: Verified via pytest test suite (pytest -k ...) that internal error handling does not break the expected failure flows.

---

PR created automatically by Jules for task 7392054006076093360 started by @socialawy

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[gemini-code-assist]

Code Review

This pull request addresses an information disclosure vulnerability in the ingest_files endpoint by masking internal exception details from the client and logging them server-side. It also updates the sentinel log to document this security practice. A suggestion was made to use logger.exception() instead of logger.error() to ensure full stack traces are captured for debugging purposes.

[gemini-code-assist]

To ensure that exception details are fully preserved for debugging as intended by this PR, use logger.exception() instead of logger.error(). While logger.error() with string interpolation only captures the exception's message, logger.exception() automatically includes the full stack trace in the logs, which is essential for diagnosing the root cause of internal server errors (500).

Suggested change

	logger.error(f"Upload failed for project {project_id}: {e}")
	logger.exception(f"Upload failed for project {project_id}")

[socialawy]

Superseded by #90 (merged ac23b55). The Sentinel/Jules SafeStaticFiles chain was iterating on the same middleware; #90's Path(str(path).lower()) fix addresses the root AttributeError. Closing as duplicate; re-open if a distinct vulnerability emerges.

[google-labs-jules]

Superseded by #90 (merged ac23b55). The Sentinel/Jules SafeStaticFiles chain was iterating on the same middleware; #90's Path(str(path).lower()) fix addresses the root AttributeError. Closing as duplicate; re-open if a distinct vulnerability emerges.

Understood. Acknowledging that this work is now superseded by #90 and stopping work on this task.