fix: Return 400 for malformed request bodies

An unparseable request body (e.g. a double comma in JSON) made the body
mapper throw its library-specific runtime exception, which fell through to
the default 500 branch of the exception handler.

Convert any parse failure at the single mapper.readFrom call site into a
ValidationException so it renders as a 400 application/problem+json response,
consistent with the other body-validation errors. Covers all body mappers.

HCC-14723

Author: thced

src/main/java/com/retailsvc/http/internal/RequestPreparationFilter.java

@@ -243,7 +243,18 @@ private ParsedBody validateAndParseBody(HttpExchange exchange, Operation op, byt
           new ValidationError(
               BODY_POINTER, "content-type", "unsupported content type: " + mediaType, null));
     }
-    Object parsed = mapper.readFrom(body, header);
+    Object parsed;
+    try {
+      parsed = mapper.readFrom(body, header);
+    } catch (ValidationException e) {
+      throw e;
+    } catch (RuntimeException e) {
+      // Body could not be parsed (e.g. malformed JSON). Untrusted input -> 400, not 500.
+      LOG.debug("Failed to parse request body", e);
+      throw new ValidationException(
+          new ValidationError(
+              BODY_POINTER, "malformed", "request body is not valid " + mediaType, null));
+    }
     if (mediaType.equals("application/x-www-form-urlencoded") && parsed instanceof Map<?, ?> map) {
       @SuppressWarnings("unchecked")
       Map<String, Object> typed = (Map<String, Object>) map;

src/test/java/com/retailsvc/http/OpenApiServerIT.java

@@ -127,6 +127,34 @@ void postDataShouldReturnJsonBody() {
       }
     }
 
+    @Test
+    void postDataShouldReturnBadRequestOnMalformedJson() {
+      try (var server = newServer(Map.of("post-data", new EchoHandler()));
+          var client = httpClient()) {
+
+        // Double comma after a property is invalid JSON; must be 400, not 500 (HCC-14723).
+        var body = "{\"id\":\"some-id\",,\"age\":42}";
+        var headers = Map.of("correlation-id", UUID.randomUUID().toString());
+        var request = newRequest(server, path, "POST", ofString(body), headers);
+
+        var response = client.send(request, BodyHandlers.ofString());
+        var statusCode = response.statusCode();
+        var contentType = response.headers().firstValue("Content-Type").orElse("");
+        var responseBody = response.body();
+
+        assertThat(statusCode).isEqualTo(400);
+        assertThat(contentType).contains("application/problem+json");
+        assertThat(responseBody).contains("keyword");
+        assertThat(responseBody).contains("pointer");
+
+      } catch (IOException e) {
+        fail(e);
+      } catch (InterruptedException e) {
+        Thread.currentThread().interrupt();
+        fail(e);
+      }
+    }
+
     @Test
     void postDataShouldReturnBadRequestOnMissingRequiredProperties() {
       Map<String, RequestHandler> handlers = Map.of("post-data", new EchoHandler());