fix(api): stop returning stack traces to clients

The deployed public overlay API was returning `data.stack` — internal file
paths and line numbers — in every error response. Sending a bad overlay token
to `state.getPublic` was enough to read it, from an endpoint that is public by
design because OBS can't authenticate through Cloudflare Access.

tRPC attaches the stack unless it believes it's running in production, and a
Worker's NODE_ENV is not a reliable signal, so an `errorFormatter` now strips it
unconditionally rather than gating on an env check that could silently move.
The full error still reaches the Worker logs, which is where diagnosis belongs.

Everything a client legitimately renders is untouched: message, code,
httpStatus, path, and the zodError payload.

Verified through tRPC's real fetch handler, not just the pure helper — a
formatter that isn't wired up would pass a unit test either way.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: nathanialhenniges

packages/api/src/index.test.ts

@@ -0,0 +1,53 @@
+import { expect, test } from "bun:test";
+
+import { stripErrorStack } from "./index";
+
+/**
+ * The deployed public overlay API was returning `data.stack` — internal file
+ * paths and line numbers — to anyone who sent a bad overlay token. tRPC adds it
+ * unless it believes it's in production, and a Worker's NODE_ENV isn't a reliable
+ * signal, so it is stripped unconditionally.
+ */
+
+test("stripErrorStack removes the stack from an error shape", () => {
+	const shape = {
+		message: "Invalid overlay token.",
+		code: -32001,
+		data: {
+			code: "UNAUTHORIZED",
+			httpStatus: 401,
+			path: "state.getPublic",
+			stack: "TRPCError: Invalid overlay token.\n    at assertToken (index.js:28330:11)",
+		},
+	};
+	const out = stripErrorStack(shape);
+	expect("stack" in out.data).toBe(false);
+	expect(JSON.stringify(out)).not.toContain("index.js");
+	// Everything a client legitimately needs survives.
+	expect(out.message).toBe("Invalid overlay token.");
+	expect(out.code).toBe(-32001);
+	expect(out.data.code).toBe("UNAUTHORIZED");
+	expect(out.data.httpStatus).toBe(401);
+	expect(out.data.path).toBe("state.getPublic");
+});
+
+test("stripErrorStack leaves a shape that never had a stack alone", () => {
+	const shape = { message: "nope", code: -32600, data: { code: "BAD_REQUEST", httpStatus: 400 } };
+	expect(stripErrorStack(shape)).toEqual(shape);
+});
+
+test("stripErrorStack preserves the zodError payload the client renders", () => {
+	const shape = {
+		message: "Input validation failed",
+		code: -32600,
+		data: {
+			code: "BAD_REQUEST",
+			httpStatus: 400,
+			stack: "at zod",
+			zodError: { fieldErrors: { goals: ["Required"] } },
+		},
+	};
+	const out = stripErrorStack(shape);
+	expect("stack" in out.data).toBe(false);
+	expect(out.data.zodError).toEqual({ fieldErrors: { goals: ["Required"] } });
+});

packages/api/src/index.ts

@@ -2,7 +2,29 @@ import { initTRPC, TRPCError } from "@trpc/server";
 
 import type { Context } from "./context";
 
-const t = initTRPC.context<Context>().create();
+/**
+ * Drop `stack` from an error response.
+ *
+ * tRPC attaches a stack trace unless it believes it is running in production, and
+ * a Worker's `NODE_ENV` is not a reliable signal — so the deployed PUBLIC overlay
+ * API was returning internal file paths and line numbers to anyone who sent a bad
+ * overlay token. Free reconnaissance with no upside: the full error still reaches
+ * the Worker logs, which is where diagnosis belongs.
+ *
+ * Stripped unconditionally rather than gated on an env check, so this cannot
+ * silently start leaking again because a build flag moved.
+ *
+ * Exported for the regression test — `errorFormatter` has no other seam.
+ */
+export function stripErrorStack<T extends { data: Record<string, unknown> }>(shape: T): T {
+	if (!("stack" in shape.data)) return shape;
+	const { stack: _stack, ...data } = shape.data;
+	return { ...shape, data };
+}
+
+const t = initTRPC.context<Context>().create({
+	errorFormatter: ({ shape }) => stripErrorStack(shape),
+});
 
 export const router = t.router;