Test: release Go-proxy RESTful contract tests verified passing in Go mode (#17468)

### Summary

Aligns Go and Python error codes/messages so both backends honor the
same RESTful API contract, removing implementation-specific error leaks
(MySQL errors, `ValueError`, `AttributeError`, Gin validator format) in
favor of clean business error codes.

**Chat list** — invalid `orderby` now returns code 101 (was: raw Python
`AttributeError` code 100); invalid `page`/`page_size` values fall back
to defaults (was: raw `ValueError`/`ProgrammingError` code 100).

**Dataset create/update/delete** — adds UUID validation (101),
extra-field rejection (101), duplicate-id detection (101), content-type
/ JSON-syntax / object-shape checks (101), and "lacks permission" for
nonexistent datasets (IDOR). Create auto-deduplicates dataset names.
Pagerank updates tolerate a missing ES index. List response includes
`parser_config` and `pagerank`.

**Session list/update** — adds filtering, sorting, and pagination
support. Empty payloads are valid no-ops. Authorization errors map to
code 109.

**Chunk list** — doc object uses Python key names (`chunk_count`,
`dataset_id`, `chunk_method`, run text status). Add validates list
element types.

**Document update** — adds `chunk_method` alias, pydantic-style Field
error messages, metadata index auto-create with refresh, and "These
documents do not belong to dataset" messages. List validates
`metadata_condition` and reports ownership errors for unmatched name/id
filters.

**Search completion** — `kb_ids` ownership failure returns code 102
instead of 109.

Released 31 contract tests from `GO_ONLY_SKIPS` (all verified passing on
both Go and Python backends with real LLM keys).

api/apps/restful_apis/chat_api.py

@@ -24,6 +24,7 @@ from copy import deepcopy
 from types import SimpleNamespace
 
 from quart import Response, request
+from werkzeug.exceptions import BadRequest
 
 from api.apps import current_user, login_required
 from api.apps.restful_apis._generation_params import merge_generation_config, pop_generation_config
@@ -454,9 +455,21 @@ async def list_chats():
     if chat_id or name:
         keywords = ""
 
+    if orderby not in ("create_time", "update_time", "name"):
+        return get_json_result(code=RetCode.ARGUMENT_ERROR, message=f"invalid orderby field: {orderby}")
+
     try:
-        page_number = int(request.args.get("page", 0))
-        items_per_page = validate_rest_api_page_size(int(request.args.get("page_size", 0)))
+        # Invalid or negative pagination values fall back to defaults
+        # instead of leaking internal conversion/SQL errors.
+        try:
+            page_number = max(int(request.args.get("page", 0)), 0)
+        except (TypeError, ValueError):
+            page_number = 0
+        try:
+            parsed_page_size = int(request.args.get("page_size", 0))
+        except (TypeError, ValueError):
+            parsed_page_size = 0
+        items_per_page = validate_rest_api_page_size(parsed_page_size)
 
         if owner_ids:
             chats, total = await thread_pool_exec(
@@ -794,9 +807,22 @@ async def list_sessions(chat_id):
                 message="no authorization",
                 code=RetCode.AUTHENTICATION_ERROR,
             )
-        page_number = int(request.args.get("page", 1))
-        items_per_page = validate_rest_api_page_size(int(request.args.get("page_size", 30)))
+        # Invalid or negative pagination values fall back to defaults
+        # instead of leaking internal conversion/SQL errors.
+        try:
+            page_number = int(request.args.get("page", 1))
+        except (TypeError, ValueError):
+            page_number = 1
+        if page_number < 1:
+            page_number = 1
+        try:
+            parsed_page_size = int(request.args.get("page_size", 30))
+        except (TypeError, ValueError):
+            parsed_page_size = 30
+        items_per_page = validate_rest_api_page_size(parsed_page_size)
         orderby = request.args.get("orderby", "create_time")
+        if orderby not in ("create_time", "update_time", "name"):
+            return get_json_result(code=RetCode.ARGUMENT_ERROR, message=f"invalid orderby field: {orderby}")
         desc = request.args.get("desc", "true").lower() != "false"
         session_id = request.args.get("id")
         name = request.args.get("name")
@@ -868,7 +894,10 @@ async def delete_sessions(chat_id):
     if not await _ensure_owned_chat(chat_id):
         return get_json_result(data=False, message="no authorization", code=RetCode.AUTHENTICATION_ERROR)
     try:
-        req = await get_request_json()
+        try:
+            req = await get_request_json()
+        except BadRequest:
+            return get_json_result(code=RetCode.ARGUMENT_ERROR, message="Malformed JSON syntax: Missing commas/brackets or invalid encoding")
         if not req:
             return get_json_result(data={})
 

api/apps/restful_apis/chunk_api.py

@@ -953,10 +953,16 @@ async def add_chunk(tenant_id, dataset_id, document_id):
     req = await get_request_json()
     if is_content_empty(req.get("content")):
         return get_error_data_result(message="`content` is required")
-    if "important_keywords" in req and not isinstance(req["important_keywords"], list):
-        return get_error_data_result("`important_keywords` is required to be a list")
-    if "questions" in req and not isinstance(req["questions"], list):
-        return get_error_data_result("`questions` is required to be a list")
+    if "important_keywords" in req:
+        if not isinstance(req["important_keywords"], list):
+            return get_error_data_result("`important_keywords` is required to be a list")
+        if not all(isinstance(k, str) for k in req["important_keywords"]):
+            return get_error_data_result("`important_keywords` must be a list of strings")
+    if "questions" in req:
+        if not isinstance(req["questions"], list):
+            return get_error_data_result("`questions` is required to be a list")
+        if not all(isinstance(q, str) for q in req["questions"]):
+            return get_error_data_result("`questions` must be a list of strings")
 
     chunk_id = xxhash.xxh64((req["content"] + document_id).encode("utf-8")).hexdigest()
     d = {

api/apps/restful_apis/document_api.py

@@ -213,6 +213,10 @@ async def update_document(tenant_id, dataset_id, document_id):
     """
     req = await get_request_json()
 
+    # An explicit null name is a type error, not an unset field.
+    if "name" in req and req["name"] is None:
+        return get_error_data_result(message="Field: <name> - Message: <Input should be a valid string> - Value: <None>")
+
     # Verify ownership and existence of dataset and document
     if not KnowledgebaseService.query(id=dataset_id, tenant_id=tenant_id):
         return get_error_data_result(message="you don't own the dataset")
@@ -856,10 +860,25 @@ def _get_docs_with_request(req, dataset_id: str):
     """
     q = req.args
 
-    page = int(q.get("page", 1))
-    page_size = validate_rest_api_page_size(int(q.get("page_size", 30)))
+    # Invalid or negative pagination values fall back to defaults
+    # instead of leaking internal conversion/SQL errors.
+    try:
+        page = int(q.get("page", 1))
+    except (TypeError, ValueError):
+        page = 1
+    if page < 1:
+        page = 1
+    try:
+        parsed_page_size = int(q.get("page_size", 30))
+    except (TypeError, ValueError):
+        parsed_page_size = 30
+    if parsed_page_size < 0:
+        parsed_page_size = 30
+    page_size = validate_rest_api_page_size(parsed_page_size)
 
     orderby = q.get("orderby", "create_time")
+    if orderby not in ("create_time", "update_time", "name"):
+        return RetCode.ARGUMENT_ERROR, f"invalid orderby field: {orderby}", [], 0
     desc = str(q.get("desc", "true")).strip().lower() != "false"
     keywords = q.get("keywords", "")