Fixes for Coderabbit review

server/api_server/api_server_start.py

@@ -7,6 +7,7 @@ import os
 from flask import Flask, request, jsonify, Response
 from models.device_instance import DeviceInstance  # noqa: E402
 from flask_cors import CORS
+from werkzeug.exceptions import HTTPException
 
 # Register NetAlertX directories
 INSTALL_PATH = os.getenv("NETALERTX_APP", "/app")
@@ -105,6 +106,8 @@ app = Flask(__name__)
 @app.errorhandler(Exception)
 def handle_500_error(e):
     """Global error handler for uncaught exceptions."""
+    if isinstance(e, HTTPException):
+        return e
     mylog("none", [f"[API] Uncaught exception: {e}"])
     return jsonify({
         "success": False,

server/api_server/openapi/schemas.py

@@ -679,6 +679,7 @@ class CreateEventRequest(BaseModel):
 # =============================================================================
 # SESSIONS SCHEMAS
 # =============================================================================
+class SessionInfo(BaseModel):
     """Session information."""
     model_config = ConfigDict(
         extra="allow",

server/api_server/openapi/spec_generator.py

@@ -77,7 +77,7 @@ def generate_openapi_spec(
             # Apply default disabled tools from setting `MCP_DISABLED_TOOLS`, env var, or hard-coded defaults
             # Format: comma-separated operation IDs, e.g. "dbquery_read,dbquery_write"
             try:
-                disabled_env = ""
+                disabled_env = None
                 # Prefer setting from app.conf/settings when available
                 try:
                     from helper import get_setting_value
@@ -88,9 +88,9 @@ def generate_openapi_spec(
                     # If helper is unavailable, fall back to environment
                     pass
 
-                if disabled_env is None:
+                if not disabled_env:
                     env_val = os.getenv("MCP_DISABLED_TOOLS")
-                    if env_val is not None:
+                    if env_val:
                         disabled_env = env_val.strip()
 
                 # If still not set, apply safe hard-coded defaults