From 7789c12b6b77f53f548dd1a6495c10163d1c1e1b Mon Sep 17 00:00:00 2001
From: henrique221 <hborgesdasilva9294@gmail.com>
Date: Fri, 19 Jun 2026 19:38:27 -0300
Subject: [PATCH] fix(usfm): stop leaking raw error detail in sync export 500s
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The sync export and exportable-books handlers returned the raw exception
message to the client via `details`. The full error is already logged
server-side (logger.error → App Insights with projectUnitId/bookIds), so
drop `details` from the client response and remove the now-unused
ErrorResponse interface. Async-path handlers are left for the async
pipeline hardening (#196).

Refs #195
---
 src/domains/usfm/usfm.route.ts | 25 +++++++------------------
 1 file changed, 7 insertions(+), 18 deletions(-)

diff --git a/src/domains/usfm/usfm.route.ts b/src/domains/usfm/usfm.route.ts
index 1d0a2fb6..0a6d05f4 100644
--- a/src/domains/usfm/usfm.route.ts
+++ b/src/domains/usfm/usfm.route.ts
@@ -12,11 +12,6 @@ import { server } from '@/server/server';
 
 import * as usfmService from './usfm.service';
 
-interface ErrorResponse {
-  error: string;
-  details?: string;
-}
-
 const projectUnitIdParam = z.object({
   projectUnitId: z.coerce.number().int().positive(),
 });
@@ -182,12 +177,11 @@ server.openapi(getExportableBooksRoute, async (c) => {
       projectUnitId: c.req.param('projectUnitId'),
     });
 
-    const errorResponse: ErrorResponse = {
-      error: 'Failed to get exportable books',
-      details: errorMessage,
-    };
-
-    return c.json(errorResponse, HttpStatusCodes.INTERNAL_SERVER_ERROR);
+    // Detail is logged above; do not leak the raw error message to the client.
+    return c.json(
+      { error: 'Failed to get exportable books' },
+      HttpStatusCodes.INTERNAL_SERVER_ERROR
+    );
   }
 });
 
@@ -281,13 +275,8 @@ server.openapi(exportProjectUSFMRoute, async (c) => {
     const errorMessage = error instanceof Error ? error.message : 'Unknown error';
     logger.error('USFM export error', { error: errorMessage, projectUnitId, bookIds });
 
-    return c.json(
-      {
-        error: 'Failed to export USFM',
-        details: errorMessage,
-      },
-      HttpStatusCodes.INTERNAL_SERVER_ERROR
-    );
+    // Detail is logged above; do not leak the raw error message to the client.
+    return c.json({ error: 'Failed to export USFM' }, HttpStatusCodes.INTERNAL_SERVER_ERROR);
   }
 });