CodeQL 6: refactor: catch specific exceptions across CTS/RAPS/shared

web/Areas/CTS/Controllers/BundleCompetencyController.cs

@@ -5,6 +5,7 @@
 using Viper.Classes.SQLContext;
 using Viper.Models.CTS;
 using Web.Authorization;
+using Microsoft.Data.SqlClient;
 
 namespace Viper.Areas.CTS.Controllers
 {
@@ -158,7 +159,7 @@ public async Task<ActionResult<BundleCompetencyDto>> DeleteBundleCompetency(int
                 await context.SaveChangesAsync();
                 AdjustBundleCompetencyOrders(bundleComp);
             }
-            catch (Exception)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
                 return BadRequest("Cannot delete this bundle competency.");
             }

web/Areas/CTS/Controllers/BundleCompetencyGroupController.cs

@@ -5,6 +5,7 @@
 using Viper.Classes.SQLContext;
 using Viper.Models.CTS;
 using Web.Authorization;
+using Microsoft.Data.SqlClient;
 
 namespace Viper.Areas.CTS.Controllers
 {
@@ -116,7 +117,7 @@ public async Task<ActionResult<BundleCompetencyGroupDto>> DeleteGroup(int bundle
                 await context.SaveChangesAsync();
                 AdjustGroupOrders(group);
             }
-            catch (Exception)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
                 return BadRequest("Cannot delete group. Competencies must be removed from the group, and the group cannot have been used to document a student competency.");
             }

web/Areas/CTS/Controllers/BundleController.cs

@@ -5,6 +5,7 @@
 using Viper.Classes.SQLContext;
 using Viper.Models.CTS;
 using Web.Authorization;
+using Microsoft.Data.SqlClient;
 
 namespace Viper.Areas.CTS.Controllers
 {
@@ -139,7 +140,7 @@ public async Task<ActionResult<BundleDto>> DeleteBundle(int bundleId)
                 await context.SaveChangesAsync();
                 await trans.CommitAsync();
             }
-            catch (Exception)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
                 return BadRequest("Could not delete bundle. If this bundle has been used, it cannot be deleted.");
             }

web/Areas/CTS/Controllers/CompetencyController.cs

@@ -1,4 +1,5 @@
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Data.SqlClient;
 using Microsoft.EntityFrameworkCore;
 using Viper.Areas.CTS.Models;
 using Viper.Classes;
@@ -176,9 +177,9 @@ public async Task<ActionResult<CompetencyDto>> DeleteCompetency(int competencyId
             {
                 await context.SaveChangesAsync();
             }
-            catch (Exception)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
-                return BadRequest("Could not remove domain. It may be linked to other objects.");
+                return BadRequest("Could not remove competency. It may be linked to other objects.");
             }
             await UpdateCompetencyOrders();
             return new CompetencyDto(c);

web/Areas/CTS/Controllers/CourseController.cs

@@ -1,4 +1,5 @@
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Data.SqlClient;
 using Microsoft.EntityFrameworkCore;
 using Viper.Areas.CTS.Models;
 using Viper.Classes;
@@ -105,7 +106,7 @@ public async Task<ActionResult<List<RoleDto>>> SetCourseRoles(int courseId, List
                 await context.SaveChangesAsync();
                 await trans.CommitAsync();
             }
-            catch (Exception)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
                 return BadRequest("Could not set roles.");
             }
@@ -279,7 +280,7 @@ public async Task<ActionResult<List<SessionCompetencyDto>>> UpdateSessionCompete
                 await context.SaveChangesAsync();
                 await trans.CommitAsync();
             }
-            catch (Exception)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
                 return BadRequest("Could not update levels.");
             }

web/Areas/CTS/Controllers/DomainController.cs

@@ -5,6 +5,7 @@
 using Viper.Classes.SQLContext;
 using Viper.Models.CTS;
 using Web.Authorization;
+using Microsoft.Data.SqlClient;
 
 namespace Viper.Areas.CTS.Controllers
 {
@@ -91,7 +92,7 @@ public async Task<ActionResult<DomainDto>> DeleteDomain(int domainId)
             {
                 await context.SaveChangesAsync();
             }
-            catch (Exception)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
                 return BadRequest("Could not remove domain. It may be linked to other objects.");
             }

web/Areas/CTS/Controllers/EpaController.cs

@@ -1,4 +1,5 @@
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Data.SqlClient;
 using Microsoft.EntityFrameworkCore;
 using Viper.Classes;
 using Viper.Classes.SQLContext;
@@ -105,9 +106,9 @@ public async Task<ActionResult<Epa>> GetEpa(int epaId)
                 context.Entry(epa).State = EntityState.Deleted;
                 await context.SaveChangesAsync();
             }
-            catch (Exception ex)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
-                return BadRequest(ex.Message);
+                return BadRequest("Could not delete EPA. It may be linked to other objects.");
             }
 
             return epa;

web/Areas/CTS/Controllers/LevelsController.cs

@@ -5,6 +5,7 @@
 using Viper.Classes.SQLContext;
 using Viper.Models.CTS;
 using Web.Authorization;
+using Microsoft.Data.SqlClient;
 
 namespace Viper.Areas.CTS.Controllers
 {
@@ -151,7 +152,7 @@ public async Task<ActionResult> DeleteLevel(int levelId)
                 AdjustLevelOrders(existing);
                 await trans.CommitAsync();
             }
-            catch (Exception)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
                 return BadRequest("Could not delete level. If this level has been used in an assessment, it cannot be deleted.");
             }

web/Areas/CTS/Controllers/RoleController.cs

@@ -4,6 +4,7 @@
 using Viper.Classes;
 using Viper.Classes.SQLContext;
 using Web.Authorization;
+using Microsoft.Data.SqlClient;
 
 namespace Viper.Areas.CTS.Controllers
 {
@@ -84,7 +85,7 @@ public async Task<ActionResult<RoleDto>> DeleteRole(int roleId)
                 context.Entry(role).State = EntityState.Deleted;
                 await context.SaveChangesAsync();
             }
-            catch (Exception)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
                 return BadRequest("Could not delete role. If this role has been added to a bundle, it cannot be deleted.");
             }

web/Areas/ClinicalScheduler/Controllers/CliniciansController.cs

@@ -1,4 +1,5 @@
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Data.SqlClient;
 using Microsoft.EntityFrameworkCore;
 using Viper.Areas.ClinicalScheduler.Services;
 using Viper.Areas.Curriculum.Services;
@@ -122,7 +123,7 @@
         [ProducesResponseType(StatusCodes.Status200OK)]
         [ProducesResponseType(StatusCodes.Status403Forbidden)]
         [ProducesResponseType(StatusCodes.Status500InternalServerError)]
         public async Task<IActionResult> GetClinicianSchedule(string mothraId, [FromQuery] int? year = null)
         {
             var correlationId = HttpContext.TraceIdentifier ?? Guid.NewGuid().ToString();
 
@@ -334,7 +335,7 @@
                     schedules.Count, LogSanitizer.SanitizeId(mothraId), LogSanitizer.SanitizeYear(targetYear));
                 return Ok(result);
             }
-            catch (Exception)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
                 // Store context for ApiExceptionFilter to use in logging
                 SetExceptionContext("MothraId", mothraId);
@@ -381,7 +382,7 @@
                 _logger.LogDebug("Found {RotationCount} unique rotations for clinician {MothraId}", rotations.Count, LogSanitizer.SanitizeId(mothraId));
                 return Ok(rotations);
             }
-            catch (Exception)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
                 // Store context for ApiExceptionFilter to use in logging
                 SetExceptionContext("MothraId", mothraId);
@@ -575,7 +576,7 @@
                 // All other cases (Admin, Manage, EditClnSchedules, rotation view, or service-specific permissions) see all clinicians
                 return clinicians;
             }
-            catch (Exception ex)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
                 _logger.LogError(ex, "Error filtering clinicians by permissions. Returning unfiltered list.");
                 return clinicians; // Return unfiltered list on error to avoid breaking functionality
@@ -653,7 +654,7 @@
                     LogSanitizer.SanitizeId(currentUser.MothraId), LogSanitizer.SanitizeId(targetMothraId));
                 return false;
             }
-            catch (Exception ex)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
                 _logger.LogError(ex, "Error checking clinician schedule view permission for target {TargetMothraId}", LogSanitizer.SanitizeId(targetMothraId));
                 return false; // Deny access on error

web/Areas/ClinicalScheduler/Controllers/InstructorScheduleController.cs

@@ -1,4 +1,6 @@
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Data.SqlClient;
+using Microsoft.EntityFrameworkCore;
 using Viper.Areas.ClinicalScheduler.Constants;
 using Viper.Areas.ClinicalScheduler.Extensions;
 using Viper.Areas.ClinicalScheduler.Models;
@@ -106,7 +108,7 @@ public async Task<IActionResult> AddInstructor(
             {
                 return HandleInvalidOperation(ex, correlationId);
             }
-            catch (Exception ex)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
                 return HandleSystemError(ex, request.RotationId!.Value, correlationId);
             }
@@ -335,7 +337,7 @@ public async Task<IActionResult> RemoveInstructor(
                     userMessage,
                     correlationId));
             }
-            catch (Exception ex)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
                 _logger.LogError(ex, "Error removing instructor schedule {ScheduleId} (CorrelationId: {CorrelationId})",
                     instructorScheduleId, correlationId);
@@ -414,7 +416,7 @@ public async Task<IActionResult> SetPrimaryEvaluator(
                     instructorScheduleId, correlationId);
                 return Forbid();
             }
-            catch (Exception ex)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
                 _logger.LogError(ex, "Error setting primary evaluator for instructor schedule {ScheduleId} (CorrelationId: {CorrelationId})",
                     instructorScheduleId, correlationId);
@@ -507,7 +509,7 @@ public async Task<IActionResult> CheckScheduleConflicts(
 
                 return Ok(response);
             }
-            catch (Exception ex)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
                 _logger.LogError(ex, "Error checking schedule conflicts for {MothraId}", LogSanitizer.SanitizeId(mothraId));
                 return StatusCode(500, "An error occurred while checking for schedule conflicts");
@@ -532,7 +534,7 @@ public async Task<IActionResult> GetAuditHistory(
                 var auditHistory = await _auditService.GetInstructorScheduleAuditHistoryAsync(instructorScheduleId, cancellationToken);
                 return Ok(auditHistory);
             }
-            catch (Exception ex)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
                 _logger.LogError(ex, "Error retrieving audit history for instructor schedule {ScheduleId}", instructorScheduleId);
                 return StatusCode(500, "An error occurred while retrieving audit history");

web/Areas/ClinicalScheduler/Controllers/PermissionsController.cs

@@ -1,4 +1,5 @@
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Data.SqlClient;
 using Microsoft.EntityFrameworkCore;
 using Viper.Areas.ClinicalScheduler.Services;
 using Viper.Classes.SQLContext;
@@ -153,7 +154,7 @@ public async Task<ActionResult<object>> CanEditService(int serviceId)
 
                 return Ok(new { canEdit });
             }
-            catch (Exception)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
                 // Store context for ApiExceptionFilter to use in logging
                 SetExceptionContext("ServiceId", serviceId);
@@ -215,7 +216,7 @@ public async Task<ActionResult<object>> CanEditRotation(int rotationId)
 
                 return Ok(new { canEdit });
             }
-            catch (Exception)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
                 // Store context for ApiExceptionFilter to use in logging
                 SetExceptionContext("RotationId", rotationId);
@@ -277,7 +278,7 @@ public async Task<ActionResult<object>> CanEditOwnSchedule(int instructorSchedul
 
                 return Ok(new { canEditOwn });
             }
-            catch (Exception)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
                 // Store context for ApiExceptionFilter to use in logging
                 SetExceptionContext("InstructorScheduleId", instructorScheduleId);

web/Areas/ClinicalScheduler/Controllers/RotationsController.cs

@@ -8,6 +8,7 @@
 using Viper.Models.ClinicalScheduler;
 using Web.Authorization;
 using Person = Viper.Models.ClinicalScheduler.Person;
+using Microsoft.Data.SqlClient;
 
 namespace Viper.Areas.ClinicalScheduler.Controllers
 {
@@ -70,7 +71,7 @@ public async Task<ActionResult<IEnumerable<RotationDto>>> GetRotations(int? serv
                     rotations.Count, filteredRotations.Count);
                 return Ok(filteredRotations);
             }
-            catch (Exception)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
                 // Store context for ApiExceptionFilter to use in logging
                 SetExceptionContext(new Dictionary<string, object>
@@ -131,7 +132,7 @@ public async Task<ActionResult<object>> GetRotation(int id)
                 _logger.LogInformation("Retrieved rotation via RotationService: {RotationName}", rotation.Name);
                 return Ok(response);
             }
-            catch (Exception)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
                 // Store context for ApiExceptionFilter to use in logging
                 SetExceptionContext("RotationId", id);
@@ -233,7 +234,7 @@ public async Task<ActionResult<object>> GetRotationSchedule(int id, [FromQuery]
 
                 return Ok(BuildRotationScheduleResponse(rotation, targetYear, groupedSchedules, recentCliniciansList));
             }
-            catch (Exception)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
                 // Store context for ApiExceptionFilter to use in logging
                 SetExceptionContext("RotationId", id);
@@ -298,7 +299,7 @@ join w in _context.Weeks on i.WeekId equals w.WeekId
                 _logger.LogInformation("Retrieved {Count} rotations with scheduled weeks for year {Year} (filtered to {FilteredCount})", rotationsWithSchedules.Count, LogSanitizer.SanitizeYear(targetYear), filteredRotations.Count);
                 return Ok(filteredRotations);
             }
-            catch (Exception)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
                 // Store context for ApiExceptionFilter to use in logging
                 SetExceptionContext("Year", year?.ToString() ?? "null");

web/Areas/Computing/Services/BiorenderStudentLookup.cs

@@ -95,7 +95,7 @@ static private bool IsValidEmail(string email)
                 var addr = new MailAddress(email);
                 return addr.Address == trimmed;
             }
-            catch
+            catch (Exception ex) when (ex is FormatException or ArgumentException)
             {
                 return false;
             }

web/Areas/RAPS/Controllers/AdGroupsController.cs

@@ -10,6 +10,7 @@
 using Viper.Classes.Utilities;
 using Viper.Models.RAPS;
 using Web.Authorization;
+using Microsoft.Data.SqlClient;
 
 namespace Viper.Areas.RAPS.Controllers
 {
@@ -113,10 +114,10 @@ public async Task<ActionResult<OuGroup>> CreateGroup(GroupAddEdit group)
                 OuGroup newOuGroup = await _ouGroupService.CreateRapsGroup(group.Name, group.Description);
                 return CreatedAtAction("CreateGroup", new { id = newOuGroup.OugroupId }, newOuGroup);
             }
-            catch (Exception ex)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
-                //Exception message could be indication user is trying to create a group that exists or is invalid.
-                return ValidationProblem(ex.Message);
+                // Return a generic message; the raw exception may reveal internal details.
+                return ValidationProblem("Unable to create or update the group. Verify the request and try again.");
             }
         }
 

web/Areas/RAPS/Controllers/RoleMembersController.cs

@@ -267,7 +267,7 @@ private static void UpdateTblRoleMemberWithDto(TblRoleMember tblRoleMember, Role
                         return vmacsResponse;
                     }
                 }
-                catch
+                catch (JsonException)
                 {
                     return new VmacsResponse
                     {

web/Areas/RAPS/Controllers/RolesController.cs

@@ -6,6 +6,7 @@
 using Viper.Classes;
 using Viper.Classes.SQLContext;
 using Viper.Models.RAPS;
+using Microsoft.Data.SqlClient;
 
 namespace Viper.Areas.RAPS.Controllers
 {
@@ -218,13 +219,13 @@ public async Task<ActionResult<TblRole>> PostTblRole(string instance, RoleCreate
 
                 return CreatedAtAction("GetTblRole", new { id = tblRole.RoleId }, tblRole);
             }
-            catch (DbUpdateConcurrencyException ex)
+            catch (DbUpdateConcurrencyException)
             {
-                return Problem("The record was not updated because it was locked. " + ex.InnerException?.Message);
+                return Problem("The record was not updated because it was locked.");
             }
-            catch (Exception ex)
+            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
             {
-                return Problem("There was a problem updating the database. " + ex.InnerException?.Message);
+                return Problem("There was a problem updating the database.");
             }
 
         }