[sentry]

Problem

When an anonymous client executes a GraphQL query requesting non-existent fields (such as TestResult.lastRun), schema validation raises a GraphQLError ("Cannot query field ...").

In graphql_api/views.py, error_formatter only treated bad queries as client-side errors when not is_anonymous. For anonymous users, these validation errors fell through to the unhandled exception branch, which logged a GraphQL internal server error, reported the error to Sentry via capture_exception, and responded to the client with INTERNAL SERVER ERROR (500).

Fix

• Explicitly handle is_bad_query when the user is anonymous in error_formatter.
• Return a generic Bad Request / ValidationError to anonymous users (avoiding schema disclosure / suggestions) instead of INTERNAL SERVER ERROR.
• Downgrade logging from log.error to log.warning with validation details, and avoid invoking capture_exception for harmless malformed client queries.
• Update test_when_bad_query_and_anonymous in graphql_api/tests/test_views.py to match the new behavior.

Legal Boilerplate

Look, I get it. The entity doing business as "Codecov" is owned by Harness, Inc. In 2026 Harness acquired Codecov and as a result Harness is going to need some rights from me in order to utilize my contributions in this PR. So here's the deal: I retain all rights, title and interest in and to my contributions, and by keeping this boilerplate intact I confirm that Harness can use, modify, copy, and redistribute my contributions, under Harness's choice of terms.

Fixes API-FAR

_{@sentry <feedback>: Autofix iterates on these changes
@sentry stop iterating: Autofix stops iterating on this run}

_{This PR was automatically generated by Sentry. You can adjust this setting at any time.}

---

Note

Low Risk
Narrows error handling for anonymous malformed GraphQL queries only; reduces false Sentry noise and improves client-facing semantics without changing authenticated behavior.

Overview
Anonymous GraphQL clients that request non-existent fields were incorrectly treated as server failures: responses said INTERNAL SERVER ERROR, errors went to Sentry, and logging used the internal-error path.

error_formatter now handles schema validation failures (Cannot query field…) for anonymous users the same way as a client mistake: the API returns a generic Bad Request with ValidationError, without exposing schema details. Those cases are logged at warning with validation metadata and no longer hit capture_exception / the internal-server-error branch.

The anonymous bad-query test is updated to assert the new message and error type.

^{Reviewed by Cursor Bugbot for commit a1ebd5b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.65%. Comparing base (d108da8) to head (a1ebd5b).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2579   +/-   ##
=======================================
  Coverage   91.64%   91.65%           
=======================================
  Files        1341     1341           
  Lines       53339    53344    +5     
  Branches     1649     1649           
=======================================
+ Hits        48885    48890    +5     
  Misses       4133     4133           
  Partials      321      321           

Flag	Coverage Δ
apiunit	94.02% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.