feat: enhance error handling and configuration validation

- Added a global exception handler to log unhandled exceptions and return a generic 500 JSON response without exposing details to the client.
- Updated the configuration to validate the `DATABASE_URL` format, ensuring it starts with `sqlite://` or `postgresql://`, and log warnings for invalid formats.
- Introduced safe parsing for numeric environment variables (`HTTP_PORT`, `INIT_DATA_MAX_AGE_SECONDS`) with defaults on invalid values, including logging warnings for out-of-range values.
- Enhanced the duty schedule parser to enforce limits on the number of schedule rows and the length of full names and duty strings, raising appropriate errors when exceeded.
- Updated internationalization messages to include generic error responses for import failures and parsing issues, improving user experience.
- Added unit tests to verify the new error handling and configuration validation behaviors.

tests/test_app.py

@@ -23,6 +23,21 @@ def test_health(client):
     assert r.json() == {"status": "ok"}
 
 
+def test_unhandled_exception_returns_500_json(client):
+    """Global exception handler returns 500 JSON without leaking exception details."""
+    from unittest.mock import MagicMock
+
+    from duty_teller.api.app import global_exception_handler
+
+    # Call the registered handler directly: it returns JSON and does not expose str(exc).
+    request = MagicMock()
+    exc = RuntimeError("internal failure")
+    response = global_exception_handler(request, exc)
+    assert response.status_code == 500
+    assert response.body.decode() == '{"detail":"Internal server error"}'
+    assert "internal failure" not in response.body.decode()
+
+
 def test_health_has_vary_accept_language(client):
     """NoCacheStaticMiddleware adds Vary: Accept-Language to all responses."""
     r = client.get("/health")
@@ -60,6 +75,20 @@ def test_app_config_js_returns_lang_from_default_language(client):
     assert config.DEFAULT_LANGUAGE in body
 
 
+@patch("duty_teller.api.app.config.DEFAULT_LANGUAGE", '"; alert(1); "')
+@patch("duty_teller.api.app.config.LOG_LEVEL_STR", "DEBUG\x00INJECT")
+def test_app_config_js_sanitizes_lang_and_log_level(client):
+    """config.js uses whitelist: invalid lang/log_level produce safe defaults, no script injection."""
+    r = client.get("/app/config.js")
+    assert r.status_code == 200
+    body = r.text
+    # Must be valid JS and not contain the raw malicious strings.
+    assert 'window.__DT_LANG = "en"' in body or 'window.__DT_LANG = "ru"' in body
+    assert "alert" not in body
+    assert "INJECT" not in body
+    assert "window.__DT_LOG_LEVEL" in body
+
+
 def test_duties_invalid_date_format(client):
     r = client.get("/api/duties", params={"from": "2025-01-01", "to": "invalid"})
     assert r.status_code == 400
@@ -74,6 +103,30 @@ def test_duties_from_after_to(client):
     assert "from" in detail or "to" in detail or "after" in detail or "позже" in detail
 
 
+@patch("duty_teller.api.app.config.MINI_APP_SKIP_AUTH", True)
+def test_duties_range_too_large_400(client):
+    """Date range longer than MAX_DATE_RANGE_DAYS returns 400 with dates.range_too_large message."""
+    from datetime import date, timedelta
+
+    from duty_teller.utils.dates import MAX_DATE_RANGE_DAYS
+
+    from_d = date(2020, 1, 1)
+    to_d = from_d + timedelta(days=MAX_DATE_RANGE_DAYS + 1)
+    r = client.get(
+        "/api/duties",
+        params={"from": from_d.isoformat(), "to": to_d.isoformat()},
+    )
+    assert r.status_code == 400
+    detail = r.json()["detail"]
+    # EN: "Date range is too large. Request a shorter period." / RU: "Диапазон дат слишком большой..."
+    assert (
+        "range" in detail.lower()
+        or "short" in detail.lower()
+        or "короткий" in detail
+        or "большой" in detail
+    )
+
+
 @patch("duty_teller.api.dependencies.config.MINI_APP_SKIP_AUTH", False)
 def test_duties_403_without_init_data(client):
     """Without X-Telegram-Init-Data and without MINI_APP_SKIP_AUTH → 403 (any client)."""
@@ -309,20 +362,21 @@ def test_duties_200_with_unknown_event_type_mapped_to_duty(client):
 
 
 def test_calendar_ical_team_404_invalid_token_format(client):
-    """GET /api/calendar/ical/team/{token}.ics with invalid token format returns 404 without DB."""
+    """GET /api/calendar/ical/team/{token}.ics with invalid token format returns 404 JSON."""
     r = client.get("/api/calendar/ical/team/short.ics")
     assert r.status_code == 404
-    assert "not found" in r.text.lower()
+    assert r.headers.get("content-type", "").startswith("application/json")
+    assert r.json() == {"detail": "Not found"}
 
 
 @patch("duty_teller.api.app.get_user_by_calendar_token")
 def test_calendar_ical_team_404_unknown_token(mock_get_user, client):
-    """GET /api/calendar/ical/team/{token}.ics with unknown token returns 404."""
+    """GET /api/calendar/ical/team/{token}.ics with unknown token returns 404 JSON."""
     mock_get_user.return_value = None
     valid_format_token = "B" * 43
     r = client.get(f"/api/calendar/ical/team/{valid_format_token}.ics")
     assert r.status_code == 404
-    assert "not found" in r.text.lower()
+    assert r.json() == {"detail": "Not found"}
     mock_get_user.assert_called_once()
 
 
@@ -374,11 +428,10 @@ def test_calendar_ical_team_200_only_duty_and_description(
 
 
 def test_calendar_ical_404_invalid_token_format(client):
-    """GET /api/calendar/ical/{token}.ics with invalid token format returns 404 without DB call."""
-    # Token format must be base64url, 40–50 chars; short or invalid chars → 404
+    """GET /api/calendar/ical/{token}.ics with invalid token format returns 404 JSON."""
     r = client.get("/api/calendar/ical/short.ics")
     assert r.status_code == 404
-    assert "not found" in r.text.lower()
+    assert r.json() == {"detail": "Not found"}
     r2 = client.get("/api/calendar/ical/" + "x" * 60 + ".ics")
     assert r2.status_code == 404
     r3 = client.get("/api/calendar/ical/../../../etc/passwd.ics")
@@ -387,13 +440,12 @@ def test_calendar_ical_404_invalid_token_format(client):
 
 @patch("duty_teller.api.app.get_user_by_calendar_token")
 def test_calendar_ical_404_unknown_token(mock_get_user, client):
-    """GET /api/calendar/ical/{token}.ics with unknown token returns 404."""
+    """GET /api/calendar/ical/{token}.ics with unknown token returns 404 JSON."""
     mock_get_user.return_value = None
-    # Use a token that passes format validation (base64url, 40–50 chars)
     valid_format_token = "A" * 43
     r = client.get(f"/api/calendar/ical/{valid_format_token}.ics")
     assert r.status_code == 404
-    assert "not found" in r.text.lower()
+    assert r.json() == {"detail": "Not found"}
     mock_get_user.assert_called_once()
 
 

tests/test_config.py

@@ -91,3 +91,29 @@ def test_require_bot_token_does_not_raise_when_set(monkeypatch):
     """require_bot_token() does nothing when BOT_TOKEN is set."""
     monkeypatch.setattr(config, "BOT_TOKEN", "123:ABC")
     config.require_bot_token()
+
+
+def test_settings_from_env_invalid_http_port_uses_default(monkeypatch):
+    """Invalid HTTP_PORT (non-numeric or out of range) yields default or clamped value."""
+    monkeypatch.delenv("HTTP_PORT", raising=False)
+    settings = config.Settings.from_env()
+    assert 1 <= settings.http_port <= 65535
+
+    monkeypatch.setenv("HTTP_PORT", "not-a-number")
+    settings = config.Settings.from_env()
+    assert settings.http_port == 8080
+
+    monkeypatch.setenv("HTTP_PORT", "0")
+    settings = config.Settings.from_env()
+    assert settings.http_port == 1
+
+    monkeypatch.setenv("HTTP_PORT", "99999")
+    settings = config.Settings.from_env()
+    assert settings.http_port == 65535
+
+
+def test_settings_from_env_invalid_init_data_max_age_uses_default(monkeypatch):
+    """Invalid INIT_DATA_MAX_AGE_SECONDS yields default 0."""
+    monkeypatch.setenv("INIT_DATA_MAX_AGE_SECONDS", "invalid")
+    settings = config.Settings.from_env()
+    assert settings.init_data_max_age_seconds == 0

tests/test_duty_schedule_parser.py

@@ -1,11 +1,14 @@
 """Tests for duty-schedule JSON parser."""
 
+import json
 from datetime import date
 
 import pytest
 
 from duty_teller.importers.duty_schedule import (
     DUTY_MARKERS,
+    MAX_FULL_NAME_LENGTH,
+    MAX_SCHEDULE_ROWS,
     UNAVAILABLE_MARKER,
     VACATION_MARKER,
     DutyScheduleParseError,
@@ -118,3 +121,38 @@ def test_unavailable_and_vacation_markers():
     assert entry.unavailable_dates == [date(2026, 2, 1)]
     assert entry.vacation_dates == [date(2026, 2, 2)]
     assert entry.duty_dates == [date(2026, 2, 3)]
+
+
+def test_parse_start_date_year_out_of_range():
+    """start_date year must be current ± 1; otherwise DutyScheduleParseError."""
+    # Use a year far in the past/future so it fails regardless of test run date.
+    raw_future = b'{"meta": {"start_date": "2030-01-01"}, "schedule": [{"name": "A", "duty": ""}]}'
+    with pytest.raises(DutyScheduleParseError, match="year|2030"):
+        parse_duty_schedule(raw_future)
+    raw_past = b'{"meta": {"start_date": "2019-01-01"}, "schedule": [{"name": "A", "duty": ""}]}'
+    with pytest.raises(DutyScheduleParseError, match="year|2019"):
+        parse_duty_schedule(raw_past)
+
+
+def test_parse_too_many_schedule_rows():
+    """More than MAX_SCHEDULE_ROWS rows raises DutyScheduleParseError."""
+    rows = [{"name": f"User {i}", "duty": ""} for i in range(MAX_SCHEDULE_ROWS + 1)]
+    today = date.today()
+    start = today.replace(month=1, day=1)
+    payload = {"meta": {"start_date": start.isoformat()}, "schedule": rows}
+    raw = json.dumps(payload).encode("utf-8")
+    with pytest.raises(DutyScheduleParseError, match="too many|max"):
+        parse_duty_schedule(raw)
+
+
+def test_parse_full_name_too_long():
+    """full_name longer than MAX_FULL_NAME_LENGTH raises DutyScheduleParseError."""
+    long_name = "A" * (MAX_FULL_NAME_LENGTH + 1)
+    today = date.today()
+    start = today.replace(month=1, day=1)
+    raw = (
+        f'{{"meta": {{"start_date": "{start.isoformat()}"}}, '
+        f'"schedule": [{{"name": "{long_name}", "duty": ""}}]}}'
+    ).encode("utf-8")
+    with pytest.raises(DutyScheduleParseError, match="exceed|character"):
+        parse_duty_schedule(raw)

tests/test_handlers_import_duty_schedule.py

@@ -278,8 +278,8 @@ async def test_handle_duty_schedule_document_non_json_replies_need_json():
 
 
 @pytest.mark.asyncio
-async def test_handle_duty_schedule_document_parse_error_replies_and_clears_user_data():
-    """handle_duty_schedule_document: parse_duty_schedule raises DutyScheduleParseError -> reply, clear user_data."""
+async def test_handle_duty_schedule_document_parse_error_replies_generic_and_clears_user_data():
+    """handle_duty_schedule_document: DutyScheduleParseError -> reply generic message (no str(e)), clear user_data."""
     message = MagicMock()
     message.document = _make_document()
     message.reply_text = AsyncMock()
@@ -299,17 +299,17 @@ async def test_handle_duty_schedule_document_parse_error_replies_and_clears_user
             with patch.object(mod, "parse_duty_schedule") as mock_parse:
                 mock_parse.side_effect = DutyScheduleParseError("Bad JSON")
                 with patch.object(mod, "t") as mock_t:
-                    mock_t.return_value = "Parse error: Bad JSON"
+                    mock_t.return_value = "The file could not be parsed."
                     await mod.handle_duty_schedule_document(update, context)
-    message.reply_text.assert_called_once_with("Parse error: Bad JSON")
-    mock_t.assert_called_with("en", "import.parse_error", error="Bad JSON")
+    message.reply_text.assert_called_once_with("The file could not be parsed.")
+    mock_t.assert_called_with("en", "import.parse_error_generic")
     assert "awaiting_duty_schedule_file" not in context.user_data
     assert "handover_utc_time" not in context.user_data
 
 
 @pytest.mark.asyncio
-async def test_handle_duty_schedule_document_import_error_replies_and_clears_user_data():
-    """handle_duty_schedule_document: run_import in executor raises -> reply import_error, clear user_data."""
+async def test_handle_duty_schedule_document_import_error_replies_generic_and_clears_user_data():
+    """handle_duty_schedule_document: run_import raises -> reply generic message (no str(e)), clear user_data."""
     message = MagicMock()
     message.document = _make_document()
     message.reply_text = AsyncMock()
@@ -340,10 +340,10 @@ async def test_handle_duty_schedule_document_import_error_replies_and_clears_use
                     with patch.object(mod, "run_import") as mock_run:
                         mock_run.side_effect = ValueError("DB error")
                         with patch.object(mod, "t") as mock_t:
-                            mock_t.return_value = "Import error: DB error"
+                            mock_t.return_value = "Import failed. Please try again."
                             await mod.handle_duty_schedule_document(update, context)
-    message.reply_text.assert_called_once_with("Import error: DB error")
-    mock_t.assert_called_with("en", "import.import_error", error="DB error")
+    message.reply_text.assert_called_once_with("Import failed. Please try again.")
+    mock_t.assert_called_with("en", "import.import_error_generic")
     assert "awaiting_duty_schedule_file" not in context.user_data
     assert "handover_utc_time" not in context.user_data
 

tests/test_run.py

@@ -24,14 +24,23 @@ def test_main_builds_app_and_starts_thread():
     mock_scope.return_value.__exit__.return_value = None
 
     with patch("duty_teller.run.require_bot_token"):
-        with patch("duty_teller.run.ApplicationBuilder", return_value=mock_builder):
-            with patch("duty_teller.run.register_handlers") as mock_register:
-                with patch("duty_teller.run.threading.Thread") as mock_thread_class:
-                    with patch("duty_teller.db.session.session_scope", mock_scope):
-                        mock_thread = MagicMock()
-                        mock_thread_class.return_value = mock_thread
-                        with pytest.raises(KeyboardInterrupt):
-                            main()
+        with patch("duty_teller.run.config") as mock_cfg:
+            mock_cfg.MINI_APP_SKIP_AUTH = False
+            mock_cfg.HTTP_HOST = "127.0.0.1"
+            mock_cfg.HTTP_PORT = 8080
+            with patch("duty_teller.run.ApplicationBuilder", return_value=mock_builder):
+                with patch("duty_teller.run.register_handlers") as mock_register:
+                    with patch("duty_teller.run.threading.Thread") as mock_thread_class:
+                        with patch(
+                            "duty_teller.run._wait_for_http_ready", return_value=True
+                        ):
+                            with patch(
+                                "duty_teller.db.session.session_scope", mock_scope
+                            ):
+                                mock_thread = MagicMock()
+                                mock_thread_class.return_value = mock_thread
+                                with pytest.raises(KeyboardInterrupt):
+                                    main()
     mock_register.assert_called_once_with(mock_app)
     mock_builder.token.assert_called_once()
     mock_thread.start.assert_called_once()

tests/test_utils.py

@@ -1,6 +1,6 @@
 """Unit tests for utils (dates, user, handover)."""
 
-from datetime import date
+from datetime import date, timedelta
 
 import pytest
 
@@ -62,6 +62,23 @@ def test_validate_date_range_from_after_to():
     assert exc_info.value.kind == "from_after_to"
 
 
+def test_validate_date_range_too_large():
+    """Range longer than MAX_DATE_RANGE_DAYS raises range_too_large."""
+    from duty_teller.utils.dates import MAX_DATE_RANGE_DAYS
+
+    # from 2023-01-01 to 2025-06-01 is more than 731 days
+    with pytest.raises(DateRangeValidationError) as exc_info:
+        validate_date_range("2023-01-01", "2025-06-01")
+    assert exc_info.value.kind == "range_too_large"
+
+    # Exactly MAX_DATE_RANGE_DAYS + 1 day
+    from_d = date(2024, 1, 1)
+    to_d = from_d + timedelta(days=MAX_DATE_RANGE_DAYS + 1)
+    with pytest.raises(DateRangeValidationError) as exc_info:
+        validate_date_range(from_d.isoformat(), to_d.isoformat())
+    assert exc_info.value.kind == "range_too_large"
+
+
 # --- user ---