Merge pull request #93 from MrDemonWolf/claude/trpc-error-formatter

fix(api): stop returning stack traces to clients

Author: nathanialhenniges

packages/api/src/index.test.ts

@@ -0,0 +1,53 @@
+import { expect, test } from "bun:test";
+
+import { stripErrorStack } from "./index";
+
+/**
+ * The deployed public overlay API was returning `data.stack` — internal file
+ * paths and line numbers — to anyone who sent a bad overlay token. tRPC adds it
+ * unless it believes it's in production, and a Worker's NODE_ENV isn't a reliable
+ * signal, so it is stripped unconditionally.
+ */
+
+test("stripErrorStack removes the stack from an error shape", () => {
+	const shape = {
+		message: "Invalid overlay token.",
+		code: -32001,
+		data: {
+			code: "UNAUTHORIZED",
+			httpStatus: 401,
+			path: "state.getPublic",
+			stack: "TRPCError: Invalid overlay token.\n    at assertToken (index.js:28330:11)",
+		},
+	};
+	const out = stripErrorStack(shape);
+	expect("stack" in out.data).toBe(false);
+	expect(JSON.stringify(out)).not.toContain("index.js");
+	// Everything a client legitimately needs survives.
+	expect(out.message).toBe("Invalid overlay token.");
+	expect(out.code).toBe(-32001);
+	expect(out.data.code).toBe("UNAUTHORIZED");
+	expect(out.data.httpStatus).toBe(401);
+	expect(out.data.path).toBe("state.getPublic");
+});
+
+test("stripErrorStack leaves a shape that never had a stack alone", () => {
+	const shape = { message: "nope", code: -32600, data: { code: "BAD_REQUEST", httpStatus: 400 } };
+	expect(stripErrorStack(shape)).toEqual(shape);
+});
+
+test("stripErrorStack preserves the zodError payload the client renders", () => {
+	const shape = {
+		message: "Input validation failed",
+		code: -32600,
+		data: {
+			code: "BAD_REQUEST",
+			httpStatus: 400,
+			stack: "at zod",
+			zodError: { fieldErrors: { goals: ["Required"] } },
+		},
+	};
+	const out = stripErrorStack(shape);
+	expect("stack" in out.data).toBe(false);
+	expect(out.data.zodError).toEqual({ fieldErrors: { goals: ["Required"] } });
+});

packages/api/src/index.ts

@@ -2,7 +2,29 @@ import { initTRPC, TRPCError } from "@trpc/server";
 
 import type { Context } from "./context";
 
-const t = initTRPC.context<Context>().create();
+/**
+ * Drop `stack` from an error response.
+ *
+ * tRPC attaches a stack trace unless it believes it is running in production, and
+ * a Worker's `NODE_ENV` is not a reliable signal — so the deployed PUBLIC overlay
+ * API was returning internal file paths and line numbers to anyone who sent a bad
+ * overlay token. Free reconnaissance with no upside: the full error still reaches
+ * the Worker logs, which is where diagnosis belongs.
+ *
+ * Stripped unconditionally rather than gated on an env check, so this cannot
+ * silently start leaking again because a build flag moved.
+ *
+ * Exported for the regression test — `errorFormatter` has no other seam.
+ */
+export function stripErrorStack<T extends { data: Record<string, unknown> }>(shape: T): T {
+	if (!("stack" in shape.data)) return shape;
+	const { stack: _stack, ...data } = shape.data;
+	return { ...shape, data };
+}
+
+const t = initTRPC.context<Context>().create({
+	errorFormatter: ({ shape }) => stripErrorStack(shape),
+});
 
 export const router = t.router;