Skip a malformed app record instead of 500ing the whole marketplace listing

[ZachL111]

What

The public app marketplace listings are built by looping over raw Firestore documents and constructing App(**doc) for each, with no per-record guard:

• get_popular_apps() feeds GET /v1/apps/popular
• get_available_apps() feeds GET /v1/apps
• get_approved_available_apps() feeds GET /v2/apps and GET /v1/approved-apps

App has required no-default fields (id, name, category, author, description, image, capabilities). A single legacy or malformed app document that is missing one of these raises pydantic.ValidationError, which is unhandled and 500s the entire listing. Because these listings are shared and Redis/process-cached across all users, one bad record takes the marketplace down for everyone, not just its owner.

Change

Add a _safe_build_app(app_dict) helper that builds the App, and on ValidationError skips the record (returns None) and logs its id plus the offending field names only (never the field values, per the logging-security rules). Use it at all three build sites so a malformed record is dropped instead of failing the whole page.

Single-file change in backend/utils/apps.py. No change to the model, the database layer, or the routers.

Test

New backend/tests/unit/test_apps_marketplace_poison_guard.py:

• a valid record builds an App.
• a record missing required fields, and an empty record, each return None instead of raising.
• a poison record between two valid ones does not take the batch down (the two valid apps still come through).

The helper is a pure function, so the test imports and calls it directly (functional core, no monkeypatch, no sys.modules). Auto-discovered by scripts/select_backend_unit_tests.py --all; passes the import-purity and stub-pollution scanners.

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[kodjima33]

Backend bug fix w/ tests: skip malformed app record instead of 500ing marketplace listings. Established poison-record pattern.