Function errorHandler

apps/api/src/middleware/error-handler.ts:104–171

({
  code,
  error,
  set,
}: IErrorHandlerArgs)

};

export const errorHandler = ({
  code,
  error,
  set,
}: IErrorHandlerArgs): IApiErrorResponse => {
  const isClientError = isClientErrorCode(code) || isClientApiError(error);
  const finalStatus = resolveFinalStatus(code, error);

  const basePayload = {
    errorCode: code,
    statusCode: finalStatus,
    message:
      error instanceof ApiError ? error.message : safeMessageFor(code, error),
    stack:
      env.isDevelopment && error instanceof Error ? error.stack : undefined,
  };

  if (isClientError) {
    logger.warn(`Client error ${code}`, {
      ...basePayload,
      event: "request.client_error",
    });
  } else {
    logger.error(`Error ${code}`, {
      ...basePayload,
      event: "request.error",
    });
  }

  if (error instanceof ApiError) {
    set.status = finalStatus;

    return error.toResponse();
  }

  set.status = finalStatus;

  let apiError: ApiError;

  switch (code) {
    case ElysiaErrorCodes.NOT_FOUND:
      apiError = ApiErrors.notFound();
      break;
    case ElysiaErrorCodes.VALIDATION:
    case ElysiaErrorCodes.PARSE:
      apiError = ApiErrors.validation(
        safeMessageFor(code, error),
        extractFieldErrors(error)
      );
      break;
    case ElysiaErrorCodes.INVALID_COOKIE_SIGNATURE:
      /*
       * Elysia's cookie middleware throws this BEFORE auth-route derive
       * code runs when a signed cookie's signature is missing or wrong
       * — i.e. when an attacker sends a tampered or guessed auth cookie.
       * It's untrusted user input, not an internal error.
       */
      apiError = ApiErrors.unauthorized();