feat(inbound-api): method-script exception detail on the inbound audit row, never on the HTTP body (D3)

2026-09-09 12:15:00 -04:00
parent a45857ddd6
commit 98c6809a66
6 changed files with 188 additions and 4 deletions
@@ -280,6 +280,16 @@ public static class EndpointExtensions
            // production call so Replay of a real integration call is complete.
            trace: method.TraceAllCalls);

+        // Flow Debugger step logs (design 2026-09-09 D3): the executor sanitises the
+        // caller-facing message, so this stash is the ONLY place a method script's real
+        // exception survives for the inbound audit row. AuditWriteMiddleware consumes the
+        // slot once when it builds that row; the HTTP body below still carries only the
+        // safe ErrorMessage.
+        if (scriptResult.ErrorDetail is { } scriptErrorDetail)
+        {
+            httpContext.Items[AuditWriteMiddleware.ErrorDetailItemKey] = scriptErrorDetail;
+        }
+
        if (!scriptResult.Success)
        {
            // A client-aborted request is not a script failure.