Reject Model Target request bodies which are not valid UTF-8 - #3440

Towards #3193.

What

POST /modeltargets/datasets, POST /modeltargets/advancedDatasets and POST /oauth2/token raised an uncaught UnicodeDecodeError when given a request body which is not valid UTF-8.

Dataset creation passed the raw body to json.loads, which decodes internally and raises UnicodeDecodeError — a ValueError but not a JSONDecodeError, so it fell through the except json.JSONDecodeError clause. The OAuth2 token route called request.body.decode(encoding="utf-8") with no handling at all.

This is the same category as #3391 and #3392: a body-parsing path which raises rather than returning an error response.

Changes

• Dataset creation decodes the body explicitly and returns the existing Vuforia-shaped 400 / ERROR / Invalid Json: ... response for a body which is not valid UTF-8, as it already does for malformed JSON.
• The OAuth2 token route decodes its form body leniently, so a body which cannot be decoded is treated as one which does not name a grant type.
• Verified fake test TestInvalidJson::test_body_not_utf_8, which runs over every Model Target endpoint via the model_target_endpoint fixture: body-reading endpoints return the error, body-less endpoints ignore the body as before.
• TestMockOnlyErrors::test_oauth2_token_body_not_utf_8 is mock-only because the real response to a form body which cannot be decoded has not been observed.
• docs/source/differences-to-vws.rst records both behaviours.

Testing

tests/mock_vws/test_model_target_web_api.py passes against the in-memory and Docker-in-memory backends. The real-Vuforia parametrisations need CI secrets and are not run locally.

🤖 Generated with Claude Code