Report a rejected argument as 400 with its reason, not an opaque 500

[p-hoffmann]

Reported in OHDSI/Atlas3#291.

Problem

CcServiceImpl raises IllegalArgumentException in eighteen places for conditions the caller caused and can act on, each with a message naming exactly what was not found:

throw new IllegalArgumentException(String.format("There is no generation with id = %d.", id));
() -> new IllegalArgumentException("Cohort characterization cannot be found by id: " + id)
() -> new IllegalArgumentException(String.format("Preset analysis with id=%s does not exist", feAnalysis.getId()))

None of it reaches the caller. IllegalArgumentException has no handler, so it falls to the generic Throwable fallback:

RuntimeException sanitizedException = new RuntimeException("An exception occurred: " + ex.getClass().getName());
return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body(errorMessage);

A POST /cohort-characterization/generation/{id}/result whose characterization references a preset that no longer resolves therefore answers 500 with

{"message":"An exception occurred: java.lang.IllegalArgumentException"}

which says neither what was rejected nor that the fault lay with the request. In Atlas3#291 the reporter could not tell whether the generation itself had failed or only the results retrieval, and had to read the network tab to get even the class name.

Change

• IllegalArgumentException is handled as 400 carrying the message the service layer already wrote.
• The same unwrapping applies when it arrives through a proxy as an UndeclaredThrowableException, matching how BadRequestAtlasException and ConversionAtlasException are already treated there.
• An exception with no message at all falls back to naming its class, so the body is never null, which would tell the caller less than the old behaviour did.

On exposure: these messages are written by this codebase for exactly this purpose. Anything not raised deliberately still reaches the generic handler and is still sanitised, and stack traces are still stripped.

Incidental

The proxy branch reported ex.getClass().getName(), where ex is the UndeclaredThrowableException wrapper rather than the exception inside it, so every unexpected failure arriving through a proxy was described as UndeclaredThrowableException. It now names the real one.

Scope

This does not change why a given characterization's results request is rejected; it makes the server say so. Atlas3 side, OHDSI/Atlas3#311 stops the client presenting a rejected results request as an empty table beside a healthy-looking run.

Related precedent: #2539 did the same for tag creation, moving a deliberate rejection off the generic 500 path.

Tests

Four new cases in GlobalExceptionHandlerTest, all failing before the change:

• a rejected argument answers 400 and keeps its reason
• one with no message names its class instead of returning a null body
• one arriving through a proxy is unwrapped to 400 with its reason
• an unexpected proxied failure names the underlying exception, not the wrapper

GlobalExceptionHandlerTest: 9 run, 0 failures. The 3 VocabularyServiceIT failures in a full run are pre-existing on a clean checkout here (no vocabulary schema available) and unrelated.