COMP-1146 Fix error messages

[munishchouhan]

Overview

This PR adds error message sanitization to the ErrorHandler class to prevent Wave from exposing internal implementation details, class names, and stack traces in API error responses.

What Changed

1. Added sanitizeErrorMessage() Method

Added a new private static method that removes sensitive internal details from error messages:

private static String sanitizeErrorMessage(String message) {
    // Removes:
    // - "Failed to convert argument [xxx] due to:" prefixes
    // - Jackson source locations (e.g., "at [Source: ...]")
    // - Reference chains with internal class paths
    // - Backtick-wrapped class names (e.g., `io.seqera.wave.api.PackagesSpec$Type`)
    // - Unquoted fully qualified class names
    // - Simplifies "Cannot deserialize" messages
    // - Cleans up extra whitespace
}

2. Updated Error Handling Logic

Modified the handle() method to:

• Log the original unsanitized error message with full details for server-side debugging
• Sanitize the error message before sending it to API clients
• Add error IDs to both logs and client responses for correlation

3. Comprehensive Test Coverage

Created ErrorHandlerTest.groovy with 9 test cases covering:

• Removal of "due to:" prefixes
• Removal of Jackson source locations
• Removal of reference chains
• Replacement of backtick-wrapped class names
• Replacement of fully qualified class names
• Complex multi-pattern sanitization
• Null/empty message handling
• User-friendly message preservation

Before/After Examples

Unsanitized (Logged Server-Side)	Sanitized (Sent to Client)
Failed to convert argument [packages] for value [INVALID] due to: Cannot deserialize value of type 'io.seqera.wave.api.PackagesSpec$Type' from String "INVALID"	Invalid value "INVALID"
Cannot deserialize value of type 'io.seqera.wave.api.PackagesSpec$Type' at [Source: (String)"..."; line: 1, column: 24]	Cannot deserialize value of type the specified type
Invalid type (through reference chain: io.seqera.wave.api.ContainerRequest["packages"]->io.seqera.wave.api.PackagesSpec["type"])	Invalid type
null or empty	Invalid request

Security Improvement

Before: API clients received error messages containing:

• Internal package structure (io.seqera.wave.api.*)
• Class names and inner classes (PackagesSpec$Type)
• Jackson library implementation details
• Source code line/column information
• Object reference chains

After: API clients receive clean, user-friendly error messages:

• Generic type references instead of class names
• Simplified messages without technical jargon
• Error IDs for support correlation
• No internal implementation details

[pditommaso]

Can be added more explicit examples, both the PR description and test, the message before and after the sanitisation ?

[munishchouhan]

Can be added more explicit examples, both the PR description and test, the message before and after the sanitisation ?

done