Ophir LOJKINE
4b487c1acb
In production, error responses must not leak the SQL statement, the source file path, the raw database error, environment values, or configuration, for ANY output format. In development the full detail is shown, and the full error is always logged server-side. This centralizes the dev-vs-production decision in a single place. An internal error stays a full `anyhow::Error` everywhere; the only place that turns it into a user-facing representation is `ClientError::new` in `src/webserver/error.rs`, which is also the only caller of `DevOrProd::is_prod`. Every renderer (HTML, JSON, NDJSON, SSE, CSV) and the header/pre-body path obtains a `ClientError` from that one function and only formats it; none of them inspect the environment. Leaking is therefore impossible by construction: a renderer cannot emit what it never receives. The error type, the production message, `get_backtrace_as_strings`, and the error-component data construction live in `error.rs`; `render.rs` only renders components and formats a `ClientError`.
5 lines
181 B
SQL
5 lines
181 B
SQL
select 'csv' as component;
|
|
-- Error before any data row: the CSV header is never written, so columns is
|
|
-- empty when handle_error runs.
|
|
select * from definitely_missing_table_xyz;
|