From f18b04ba20ffdcbfe13d2222b9c831e99fb850a7 Mon Sep 17 00:00:00 2001
From: Dorian <dorian@Dorians-MacBook-Air.local>
Date: Thu, 12 Mar 2026 23:51:12 +0000
Subject: [PATCH] test: verify global error handler returns 500 without stack
 traces (BUG-S7)

Global app.onError handler already in app.ts catches all unhandled route
exceptions. Production mode returns "Internal server error" only.
Tests verify no stack traces or file paths leak in responses.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 server/src/routes/error-handling.test.ts | 52 ++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 server/src/routes/error-handling.test.ts

diff --git a/server/src/routes/error-handling.test.ts b/server/src/routes/error-handling.test.ts
new file mode 100644
index 0000000..8493449
--- /dev/null
+++ b/server/src/routes/error-handling.test.ts
@@ -0,0 +1,52 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { Hono } from 'hono'
+
+describe('global error handler', () => {
+  it('returns 500 with sanitized error in production mode', async () => {
+    const originalEnv = process.env.NODE_ENV
+    process.env.NODE_ENV = 'production'
+
+    const app = new Hono()
+    app.onError((_err, c) => {
+      const msg = process.env.NODE_ENV === 'production' ? 'Internal server error' : _err.message
+      return c.json({ error: msg }, 500)
+    })
+    app.get('/test', () => { throw new Error('DB connection failed at /path/to/file.ts:42') })
+
+    const res = await app.request('/test')
+    expect(res.status).toBe(500)
+    const body = await res.json() as { error: string }
+    expect(body.error).toBe('Internal server error')
+    // Must NOT contain stack trace or file paths
+    expect(body.error).not.toContain('.ts')
+    expect(body.error).not.toContain('Error')
+    expect(body.error).not.toContain('DB connection')
+
+    process.env.NODE_ENV = originalEnv
+  })
+
+  it('returns error message in development mode', async () => {
+    const app = new Hono()
+    app.onError((_err, c) => {
+      const msg = process.env.NODE_ENV === 'production' ? 'Internal server error' : _err.message
+      return c.json({ error: msg }, 500)
+    })
+    app.get('/test', () => { throw new Error('Something broke') })
+
+    const res = await app.request('/test')
+    expect(res.status).toBe(500)
+    const body = await res.json() as { error: string }
+    expect(body.error).toBe('Something broke')
+  })
+
+  it('async route handler errors are caught', async () => {
+    const app = new Hono()
+    app.onError((_err, c) => c.json({ error: 'Internal server error' }, 500))
+    app.get('/test', async () => {
+      throw new Error('async failure')
+    })
+
+    const res = await app.request('/test')
+    expect(res.status).toBe(500)
+  })
+})