API Error exposing internals

[Nek-]

Sylius version affected: 1.13

Description
I wrongly formatted the following http request and ended with an error related to internals. I think such information should not be exposed WDYT?

Steps to reproduce

$ http POST https://master.demo.sylius.com/api/v2/shop/orders/2jHUl3N19G/items accept:application/ld+json Content-
Type:application/ld+json --raw='{"paymentMethod":"/api/v2/shop/payment-methods/bank_transfer"}'

HTTP/1.1 400 Bad Request
Cache-Control: no-cache, private
Connection: keep-alive
Content-Type: application/ld+json; charset=utf-8
Date: Wed, 15 Feb 2023 10:05:35 GMT
Link: <https://master.demo.sylius.com/api/v2/docs.jsonld>; rel="http://www.w3.org/ns/hydra/core#apiDocumentation"
Server: nginx/1.18.0 (Ubuntu)
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
X-Frame-Options: sameorigin

{
    "code": 400,
    "message": "Cannot create an instance of \"Sylius\\Bundle\\ApiBundle\\Command\\Cart\\AddItemToCart\" from serialized data because its constructor requires parameter \"productVariantCode\" to be present."
}

[NoResponseMate]

Hi @Nek-

Agreed, leaking internals is a problem.
The class part should have been resolved by #15568

ATM for the same request you'll get:

{
  "code": 400,
  "message": "Request does not have the following required fields specified: productVariantCode."
}

which is still not perfect since productVariantCode is a constructor argument/property name instead of the name set in serialization, should've been productVariant instead and trying to use the former will just reiterate the same error so you'll loop with no end in sight... and at this moment of writing, I just went there and fixed it, lol.

Should be fine after #15775 gets merged and I'll close this once that happens.

Cheers 🍻