fix(cases): return 400 for over-length auto-created tag names

[devin-ai-integration]

Checklist

• Read CONTRIBUTING.md.
• PR title is short and non-generic.
• PR only implements a single feature or fixes a single bug.
• Tests passing (uv run pytest tests/unit/api/test_api_internal_cases.py tests/unit/test_case_tags_service.py)
• Lint passing (ruff check, ruff format --check, basedpyright on changed files)

Description

POST /internal/cases/{case_id}/tags accepts a tag_id of up to 100 characters (InternalCaseTagCreate). With create_if_missing=true, CaseTagsService.add_case_tag passes that value to TagCreate(name=...), which allows at most 50 characters. The pydantic ValidationError was not caught in the internal add_tag route, so it went to generic_exception_handler. The route returned a 500 and fired an Urgent Sentry page in prod.

This PR maps ValidationError to a 400 in that route. That matches POST /internal/cases/simple, which already returns 400 for the same TagCreate error through its except ValueError. The public tags route does not pass create_if_missing, so it is not affected.

Category	+	-
Logic	5	0
Tests	31	0

Related Issues

Prod Sentry issue TRACECAT-RUNTIME-15F (ValidationError: Tracecat API failure on /internal/cases/{case_id}/tags).

Screenshots / Recordings

N/A (backend only)

Steps to QA

tests/unit/api/test_api_internal_cases.py::test_internal_add_case_tag_invalid_tag_name_returns_400 returns 500 without this change and 400 with it.

Link to Devin session: https://app.devin.ai/sessions/032bee86a4124458845be23f52f680dc
Open in Devin Desktop: https://app.devin.ai/desktop/session/032bee86a4124458845be23f52f680dc?variant=devin

---

Summary by cubic

Fixes the internal case add-tag route returning a 500 when an auto-created tag name exceeds 50 characters.

POST /internal/cases/{case_id}/tags with create_if_missing=true now returns a 400 when the tag name fails TagCreate validation, matching the behavior of the create-case route. Previously the uncaught ValidationError triggered an urgent Sentry page. The public tags route is unaffected since it doesn't auto-create tags.

^{Written for commit d1868f4. Summary will update on new commits.}

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to d1868f4.

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/00dffd6c-8834-4dc9-b6d8-b44cd1622986?scanId=89809788-6bc8-4b1e-bbd6-0ed52485abe5&codeScanTypes=PrScan&tab=issues&detectionTypes=traditional,businessLogic,customRule,IAC,SECRETS,CICD,EOL,uncategorized

Detected Code Changes

Change Type	Relevant files
Enhancement	► tests/unit/api/test_api_internal_cases.py     Add test for invalid internal case tag name validation and patch internal_case_tags_router CaseTagsService accordingly ► tracecat/cases/tags/internal_router.py     Handle ValidationError from TagCreate and return 400 with error detail