feat: complete catalog sensitivity enhancements

backend/src/routes/catalog-schema.ts

@@ -19,8 +19,14 @@ const metadataSchema = z.object({
   description: z.string().max(20_000).nullable().optional(),
   generatedDescription: z.string().max(20_000).nullable().optional(),
   sensitive: z.boolean().optional(),
+  sensitivityReason: z.string().max(2_000).nullable().optional(),
 }).strict().refine((value) => (
-  "description" in value || "generatedDescription" in value || "sensitive" in value
+  "description" in value
+  || "generatedDescription" in value
+  || "sensitive" in value
+  || "sensitivityReason" in value
+)).refine((value) => (
+  value.sensitivityReason == null || value.sensitive === true
 ));
 const createRunSchema = z.object({
   version: z.number().int().positive(),
@@ -56,7 +62,10 @@ function safeError(reply: FastifyReply, error: unknown) {
     return reply.code(409).send({ code: "schema_sync_conflict", message: error.message });
   }
   if (error instanceof CatalogConnectorError) {
-    return reply.code(502).send({ code: "schema_introspection_failed", message: "The database schema could not be read safely." });
+    return reply.code(502).send({
+      code: "schema_introspection_failed",
+      message: "The database schema could not be read. Check the connection and credentials, then try again.",
+    });
   }
   if (error instanceof z.ZodError) {
     return reply.code(400).send({ code: "schema_request_invalid", message: "Schema request is invalid." });
@@ -113,6 +122,12 @@ export function catalogSchemaRoutes(
         if (current.version !== input.version) {
           return reply.code(409).send({ code: "column_stale", message: "Column metadata changed. Reload and try again." });
         }
+        const nextSensitive = input.sensitive ?? current.sensitive;
+        const nextSensitivityReason = nextSensitive
+          ? ("sensitivityReason" in input
+              ? normalized(input.sensitivityReason ?? null)
+              : current.sensitivityReason)
+          : null;
         const updated = await deps.repository.updateColumnMetadata(
           databaseId,
           tableId,
@@ -123,6 +138,7 @@ export function catalogSchemaRoutes(
             ? normalized(input.generatedDescription ?? null)
             : current.generatedDescription,
           input.sensitive,
+          nextSensitivityReason,
         );
         if (!updated) return reply.code(409).send({ code: "column_stale", message: "Column metadata changed. Reload and try again." });
         return updated;