Function writeInternalError

internal/server/server.go:2249–2306

writeInternalError logs the real error server-side and sends a generic message to the client. This prevents leaking SQL errors, file paths, and other internal details.

(w http.ResponseWriter, err error)

// message to the client. This prevents leaking SQL errors, file paths,
// and other internal details.
func writeInternalError(w http.ResponseWriter, err error) {
	// The store's NUL refusal is a DECISION, not a fault, and it is mapped
	// here rather than at each handler for the same reason Layer A lives at
	// the driver: this is the one funnel every 500 already passes through, so
	// mapping it once covers every handler that exists and every one that will
	// (DOC-2823 S1). Enumerating error blocks is what the item-title unit had
	// to do three times in one function before a structural test caught the
	// third.
	//
	// 400, matching what the HTTP gate answers for the SAME value refused at
	// the door. Two statuses for one rule would be the layers disagreeing
	// again, in the response this time instead of in the predicate.
	//
	// The honest residual: a value can reach the store from something the
	// SERVER composed rather than the caller supplied — that is BUG-2814's
	// re-emit population — and for those a 400 tells the caller their request
	// was bad when it was our stored data. It is still the better answer than
	// 500, because the request is understood and will be refused identically
	// on retry, and the log line below keeps the detail. If the re-emit case
	// ever needs its own status, it needs its own error type first.
	if reason, ok := nulRefusalReason(err); ok {
		slog.Warn("write refused: invalid text parameter", "error", err)
		writeError(w, http.StatusBadRequest, "bad_request", reason)
		return
	}
	// The outbox row cap is likewise a decision, not a fault, and is mapped in
	// the same funnel for the same reason (BUG-2827). 413 with a *_too_large
	// code follows the house precedent set by rename_cascade_too_large rather
	// than inventing a second spelling for "this operation produces more than
	// the server will process in one go".
	//
	// The literal reading of 413 is that the REQUEST entity is too large, and
	// here the request is small while the event it derives is not. Taken
	// alone that argues for 422. It loses to consistency: an operator watching
	// for cascade refusals should not have to know which of two size bounds
	// fired to know which status to grep for, and the message says plainly
	// what was actually too big.
	//
	// Composed from the TYPED fields, never by splicing err.Error(), so no
	// wrapper the call path added is published to the caller.
	var oversized *store.OversizedOutboxPayloadError
	if errors.As(err, &oversized) {
		slog.Warn("write refused: outbox payload over the size limit",
			"event_type", oversized.EventType, "bytes", oversized.Bytes, "limit", oversized.Limit)
		// The message names WHAT was measured, because the store refuses on two
		// different measurements — the member content before marshalling, and
		// the row as stored — and a caller told only "%d bytes" for both
		// cannot reconcile two different numbers for one mutation (codex
		// round 3).
		writeError(w, http.StatusRequestEntityTooLarge, "event_payload_too_large",
			fmt.Sprintf("This change would record a %s event larger than the server will store in one "+
				"row: %s is %d bytes, and the limit is %d. Split the change into smaller ones and try again.",
				oversized.EventType, oversized.Measured, oversized.Bytes, oversized.Limit))
		return
	}
	slog.Error("internal server error", "error", err)
	writeError(w, http.StatusInternalServerError, "internal_error", "An internal error occurred")
}