CSV export returns 500 when a column is named accession or the variant is deleted mid-request #844

Summary

Two CSV export cases fail with a 500 error and a Slack alert, even though neither is a server fault. If a score set has a score or count column named accession, every download of it fails. If a variant is deleted while someone is downloading it, the request fails instead of returning 404. This issue makes both return proper responses.

Column named accession

Un-namespaced exports (GET /score-sets/{urn}/scores and GET /score-sets/{urn}/counts) put the built-in accession column and the investigator's columns under bare headers. When an investigator's column is also named accession, assemble_csv_headers (src/mavedb/lib/csv/columns.py) finds two identical headers and raises ValueError. Nothing at upload time stops the column being created.

accession is the only built-in name that can collide. The other built-in columns (hgvs_nt, hgvs_splice, hgvs_pro) are the variant columns themselves: upload removes them from the score and count data (create_variants_data in src/mavedb/lib/score_sets.py), so they never reach the exports as investigator columns.

1. Export: in un-namespaced output, when an investigator's column collides with a built-in one, put its namespace in front (scores.accession, counts.accession) and leave the built-in column as is. Headers and row keys both come from _format_column_key, so make the decision once and use it for both. Document the rule in assemble_csv_headers's docstring.
2. Upload: reject a score or count column named accession in validate_column_names (src/mavedb/lib/validation/dataframe/dataframe.py). Match case-insensitively, as the existing duplicate-name check does.

Variant deleted mid-request

get_variant_csv and available_variant_csv_namespaces (src/mavedb/lib/csv/variant.py) raise ValueError when the variant doesn't exist. The routers check that the variant exists first, so this only happens when the variant is deleted between the check and the lib call. Raise NonexistentIdentifierError (src/mavedb/lib/exceptions.py) instead. It already has a handler in server_main.py that returns 404.

Acceptance criteria

• GET /score-sets/{urn}/scores for a score set with a score column named accession returns 200, with that column headed scores.accession.
• GET /score-sets/{urn}/counts for a score set with a count column named accession returns 200, with that column headed counts.accession.
• Uploading a score or count column named accession, in any letter case, is rejected with a validation error.
• Uploads with hgvs_nt, hgvs_splice and hgvs_pro columns are still accepted.
• When get_variant_csv or available_variant_csv_namespaces can't find the variant, GET /variants/{urn}/csv and GET /variants/{urn}/csv-namespaces return 404.
• Nothing in src/mavedb/lib/csv/ raises a bare ValueError to a router for user data or a missing variant.