feat : it work on my machice

lib/security/http.test.ts

@@ -1,4 +1,4 @@
-import { afterEach, describe, expect, it } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 import { boundedBody, errorResponse, HttpError, readJson, requireSameOrigin, withUploadSlot } from "./http";
 import { trustedClientAddress } from "./rate-limit";
 
@@ -6,6 +6,7 @@ const originalAuthUrl = process.env.BETTER_AUTH_URL;
 const originalClientIpHeader = process.env.TRUSTED_CLIENT_IP_HEADER;
 
 afterEach(() => {
+  vi.restoreAllMocks();
   if (originalAuthUrl === undefined) delete process.env.BETTER_AUTH_URL;
   else process.env.BETTER_AUTH_URL = originalAuthUrl;
   if (originalClientIpHeader === undefined) delete process.env.TRUSTED_CLIENT_IP_HEADER;
@@ -54,11 +55,25 @@ describe("request boundaries", () => {
     await expect(withUploadSlot(async () => "ok")).resolves.toBe("ok");
   });
 
-  it("returns retry timing and hides internal errors", async () => {
+  it("preserves explicit HTTP errors and retry timing", async () => {
     const response = errorResponse(new HttpError(429, "too-many-requests", 10));
     expect(response.status).toBe(429);
     expect(response.headers.get("retry-after")).toBe("10");
-    expect(await errorResponse(new Error("secret password")).text()).not.toContain("password");
+    expect(await response.json()).toEqual({ error: "too-many-requests" });
+    const unavailable = errorResponse(new HttpError(503, "dependency-unavailable", 5));
+    expect(unavailable.status).toBe(503);
+    expect(unavailable.headers.get("retry-after")).toBe("5");
+    expect(await unavailable.json()).toEqual({ error: "dependency-unavailable" });
+  });
+
+  it.each([new Error("secret password"), "unexpected thrown value", null])("returns 500 for unexpected errors and logs the original cause: %s", async (cause) => {
+    const log = vi.spyOn(console, "error").mockImplementation(() => {});
+    const response = errorResponse(cause);
+    expect(response.status).toBe(500);
+    expect(await response.json()).toEqual({ error: "internal-server-error" });
+    expect(response.headers.get("cache-control")).toBe("no-store");
+    expect(response.headers.get("retry-after")).toBeNull();
+    expect(log).toHaveBeenCalledWith("Unhandled request error", cause);
   });
 
   it("ignores spoofed forwarding headers unless explicitly configured", () => {

lib/security/http.ts

@@ -10,8 +10,8 @@ export function securityLog(event: string, details: { actorId?: string; targetId
 }
 
 export function errorResponse(cause: unknown): Response {
-  const error = cause instanceof HttpError ? cause : new HttpError(503, "service-unavailable");
-  if (!(cause instanceof HttpError)) securityLog("dependency-unavailable", { status: 503 });
+  const error = cause instanceof HttpError ? cause : new HttpError(500, "internal-server-error");
+  if (!(cause instanceof HttpError)) console.error("Unhandled request error", cause);
   return Response.json({ error: error.message }, {
     status: error.status,
     headers: {