Query UI returns an opaque 500 for unknown or non-queryable functions

[julietshen]

Summary

Submitting a query in the Investigate UI that references a function which isn't a query UDF fails with an opaque HTTP 500 and no indication of what is wrong. This includes rules-only UDFs (e.g. TextContains, ListLength) and names that don't exist. The docs currently have to warn users about it (docs/user/investigate/query-syntax.md, docs/user/manage.md).

Root cause

DruidQueryTransformer.transform_Call raises DruidQueryTransformException(node, 'Unknown function call type') when the referenced UDF is not a QueryUdfBase:

• osprey_worker/src/osprey/engine/query_language/ast_druid_translator.py (~line 105)

That exception is never caught (a repo-wide search finds no except DruidQueryTransformException), and it is raised inside the request path (invoked from osprey_worker/src/osprey/worker/ui_api/osprey/lib/druid.py:464), so it propagates to Flask as a generic 500.

Only four functions currently work in queries: RegexMatch, DidAddLabel, DidRemoveLabel, DidDeclareVerdict. Any other function name triggers this, including valid rules UDFs that a user might reasonably expect to work from the UDF Registry.

Impact

• Users get a bare 500 with no message saying which function is the problem, or that it is not queryable.
• The exception message ("Unknown function call type") does not even name the offending function.

Suggested fix

• Catch DruidQueryTransformException in the query endpoints (events.py) and return a 400 with a clear message naming the function, e.g. "TextContains is not a query function; queries support RegexMatch, DidAddLabel, DidRemoveLabel, DidDeclareVerdict."
• Include the function name in the exception message.
• Optionally validate query functions up front so the error surfaces consistently with other query validation errors.

Repro

Run any query in the Investigate UI that uses a rules-only or nonexistent function, e.g. TextContains(text=PostText, phrase="x") or Nonexistent().