TASK22102: slice4 larger file set + production detail suppression

memory-bank/change-log.md

@@ -1403,3 +1403,37 @@ Validation:
 Follow-ups:
 
 - Next slice should target non-proxy file handlers that still return raw `error` payloads.
+
+---
+
+### CL-038: TASK22102 API contract consistency — Slice 4 (security hardening + larger non-proxy file set)
+
+date: 2026-03-17
+author: Cline
+scope: `pages/api/middleware/apiResponse.js`, `pages/api/file/{createappealcompletemessage_api,updatecase_api,createcaseinvolvement_api,createrepinvolvement_api,createcase_api,generatepdf}.js`
+type: change
+rationale: Apply requested security hardening for error detail exposure and deliver a larger non-proxy file-handler slice to improve codex usage efficiency while keeping contract risk low.
+impact: Suppresses sensitive `details` payloads in production, improves structured API consistency in selected non-proxy file handlers, and preserves existing success-path payload compatibility.
+status: completed
+
+Summary:
+
+- Hardened shared error helper:
+    - `respondError` now omits `error.details` when `NODE_ENV === "production"`.
+    - debug detail visibility remains available in non-production environments.
+- Migrated a larger batch of non-proxy file handlers to helper-based responses:
+    - `createappealcompletemessage_api`
+    - `updatecase_api`
+    - `createcaseinvolvement_api`
+    - `createrepinvolvement_api`
+    - `createcase_api`
+    - `generatepdf`
+- Standardized missing-input/hash/failure paths to structured `respondError` codes/messages while retaining success bodies and existing 200 semantics (including 412->record exists handling in involvement endpoints).
+
+Validation:
+
+- `npx next lint --file pages/api/middleware/apiResponse.js --file pages/api/file/createappealcompletemessage_api.js --file pages/api/file/updatecase_api.js --file pages/api/file/createcaseinvolvement_api.js --file pages/api/file/createrepinvolvement_api.js --file pages/api/file/createcase_api.js --file pages/api/file/generatepdf.js` -> pass (no warnings/errors)
+
+Follow-ups:
+
+- Continue next larger slice on remaining non-proxy file handlers still returning raw error payloads.