fix(mailer): return a generic client message on resend mail-transport failures

resendVerification (auth.controller.js) and the invitations resend endpoint
now surface propagated mail-transport failures via errors.getMessage(err),
which relayed the raw SMTP/Resend provider error string to the client on
these two endpoints — a low-severity infra-detail leak flagged by the
pre-push critical-review gate on #3966.

Both catches now log the real error server-side with context (userId /
invitationId) and respond with a stable generic message. invitations.resend
still threads deliberate AppError statuses (409 conflict, 404 not found, 422
mailer-not-configured) through unchanged — only the untagged transport
rejection (no `.status`) gets the generic treatment. resendVerification's
catch is resend-email-scoped end-to-end, so the whole catch goes generic.

Claude-Session: https://claude.ai/code/session_01WfNC8bt1TgL4AsiYgCEGup

Author: PierreBrisorgueil

modules/auth/controllers/auth.controller.js

@@ -850,7 +850,17 @@ const resendVerification = async (req, res) => {
     if (!acceptedCount) return responses.error(res, 400, 'Bad Request', 'Failure sending email')();
     return responses.success(res, 'Verification email sent')({ status: true });
   } catch (err) {
-    responses.error(res, 422, 'Unprocessable Entity', errors.getMessage(err))(err);
+    // #3966 hardening: sendVerificationEmail (mailer.sendMail) now propagates a
+    // transport failure instead of swallowing it — the raw SMTP/provider error
+    // string must not leak to the client. Log the real error server-side with
+    // context (this catch is resend-email-scoped: an unexpected failure here is
+    // effectively always the mail send); respond with a stable generic message.
+    logger.error('[auth.resendVerification] failed', {
+      userId: req.user?.id,
+      message: err?.message,
+      stack: err?.stack,
+    });
+    responses.error(res, 422, 'Unprocessable Entity', 'Failed to send the email, please try again.')(err);
   }
 };
 

modules/auth/tests/auth.silent.catch.unit.tests.js

@@ -411,3 +411,137 @@ describe('auth.password.controller silent-catch error logging:', () => {
     });
   });
 });
+
+describe('auth.controller resendVerification mail-transport failure hardening (#3966):', () => {
+  let mockError;
+
+  beforeEach(() => {
+    jest.resetModules();
+
+    mockError = jest.fn();
+
+    jest.unstable_mockModule('../../../lib/services/logger.js', () => ({
+      default: { warn: jest.fn(), error: mockError, info: jest.fn() },
+    }));
+  });
+
+  test('responds with a generic message (never the raw provider error) and still logs the real error server-side', async () => {
+    // sendVerificationEmail → mailer.sendMail is awaited directly (not
+    // fire-and-forget) and now propagates a transport failure (#3966) instead
+    // of swallowing it — the controller catch must not leak this raw string.
+    const providerError = new Error('Resend API error: 401 Unauthorized — invalid API key sk_live_abc123');
+
+    jest.unstable_mockModule('../../../modules/users/services/users.service.js', () => ({
+      default: {
+        create: jest.fn(),
+        getBrut: jest.fn().mockResolvedValue({ id: 'u1', email: 'x@y.com', emailVerified: false }),
+        update: jest.fn().mockResolvedValue({}),
+        remove: jest.fn(),
+        count: jest.fn().mockResolvedValue(0),
+      },
+    }));
+
+    jest.unstable_mockModule('../../../modules/auth/services/auth.eligibility.js', () => ({
+      default: {
+        registerSignupEligibility: jest.fn(),
+        assertSignupEligible: jest.fn().mockResolvedValue(undefined),
+        _reset: jest.fn(),
+      },
+    }));
+
+    jest.unstable_mockModule('../../../modules/organizations/services/organizations.service.js', () => ({
+      default: { handleSignupOrganization: jest.fn() },
+    }));
+
+    jest.unstable_mockModule('../../../modules/organizations/services/organizations.crud.service.js', () => ({
+      default: { autoSetCurrentOrganization: jest.fn() },
+    }));
+
+    jest.unstable_mockModule('../../../modules/organizations/services/organizations.membership.service.js', () => ({
+      default: { findByUserAndOrganization: jest.fn(), listPendingByUser: jest.fn().mockResolvedValue([]) },
+    }));
+
+    jest.unstable_mockModule('../../../config/index.js', () => ({
+      default: {
+        sign: { up: true, in: true },
+        jwt: { secret: 'test-secret', expiresIn: 3600 },
+        cookie: { secure: false, sameSite: 'lax' },
+        organizations: { enabled: false },
+        app: { title: 'Test', contact: 'test@test.com' },
+      },
+    }));
+
+    jest.unstable_mockModule('../../../lib/middlewares/model.js', () => ({
+      default: { getResultFromZod: jest.fn(), checkError: jest.fn() },
+    }));
+
+    // Mailer configured, sendMail rejects with a raw provider error
+    jest.unstable_mockModule('../../../lib/helpers/mailer/index.js', () => ({
+      default: {
+        isConfigured: jest.fn().mockReturnValue(true),
+        sendMail: jest.fn().mockRejectedValue(providerError),
+      },
+    }));
+
+    const successInner = jest.fn();
+    const errorInner = jest.fn();
+    const success = jest.fn(() => successInner);
+    const error = jest.fn(() => errorInner);
+    jest.unstable_mockModule('../../../lib/helpers/responses.js', () => ({
+      default: { success, error },
+    }));
+
+    jest.unstable_mockModule('../../../lib/helpers/errors.js', () => ({
+      default: { getMessage: jest.fn().mockReturnValue(providerError.message) },
+    }));
+
+    jest.unstable_mockModule('../../../lib/helpers/AppError.js', () => ({
+      default: class AppError extends Error {
+        constructor(msg, opts) {
+          super(msg);
+          this.status = opts?.status;
+          this.code = opts?.code;
+          this.details = opts?.details;
+        }
+      },
+    }));
+
+    jest.unstable_mockModule('../../../modules/users/models/users.schema.js', () => ({
+      default: { User: {} },
+    }));
+
+    jest.unstable_mockModule('../../../lib/middlewares/policy.js', () => ({
+      default: { defineAbilityFor: jest.fn().mockResolvedValue({}) },
+    }));
+
+    jest.unstable_mockModule('../../../lib/helpers/abilities.js', () => ({
+      default: jest.fn().mockReturnValue([]),
+    }));
+
+    jest.unstable_mockModule('../../../lib/helpers/getBaseUrl.js', () => ({
+      default: jest.fn().mockReturnValue('http://localhost:3000'),
+    }));
+
+    jest.unstable_mockModule('../../../lib/services/analytics.js', () => ({
+      default: { identify: jest.fn(), groupIdentify: jest.fn(), capture: jest.fn() },
+    }));
+
+    const { default: AuthController } = await import('../../../modules/auth/controllers/auth.controller.js');
+
+    const req = { user: { id: 'u1' } };
+    const res = {};
+
+    await AuthController.resendVerification(req, res);
+
+    expect(error).toHaveBeenCalledWith(res, 422, 'Unprocessable Entity', 'Failed to send the email, please try again.');
+    const clientMessage = error.mock.calls[0][3];
+    expect(clientMessage).not.toContain('sk_live_abc123');
+    expect(clientMessage).not.toContain('Resend API error');
+
+    // Real error still logged server-side with context, so it is not lost.
+    expect(mockError).toHaveBeenCalledWith('[auth.resendVerification] failed', expect.objectContaining({
+      userId: 'u1',
+      message: providerError.message,
+    }));
+  });
+});

modules/invitations/controllers/invitations.controller.js

@@ -3,6 +3,7 @@
  */
 import errors from '../../../lib/helpers/errors.js';
 import responses from '../../../lib/helpers/responses.js';
+import logger from '../../../lib/services/logger.js';
 import InvitationService from '../services/invitations.service.js';
 
 /**
@@ -83,10 +84,24 @@ const resend = async (req, res) => {
     responses.success(res, 'invitation resent')(invitation);
   } catch (err) {
     // Thread ANY service-thrown AppError status (409 duplicate-pending, 404
-    // unknown id, etc.) rather than flattening everything but 409 to 422 — a
-    // 404 must not surface as Unprocessable Entity if a future caller reaches
-    // the service without the invitationByID param-loader's 404 guard.
-    const status = err.status ?? 422;
+    // unknown id, 422 mailer-not-configured, etc.) rather than flattening
+    // everything but 409 to 422 — a 404 must not surface as Unprocessable
+    // Entity if a future caller reaches the service without the
+    // invitationByID param-loader's 404 guard.
+    // #3966 hardening: InvitationService.resend's mails.sendMail(...) call is
+    // unguarded and now propagates (#3966) — a raw transport rejection has no
+    // `.status` (unlike the AppErrors thrown deliberately above) and must not
+    // leak the raw SMTP/provider error string to the client. Log the real
+    // error server-side with context; respond with a stable generic message.
+    if (err.status == null) {
+      logger.error('[invitations.resend] failed', {
+        invitationId: req.invitation?.id,
+        message: err?.message,
+        stack: err?.stack,
+      });
+      return responses.error(res, 422, 'Unprocessable Entity', 'Failed to send the email, please try again.')(err);
+    }
+    const status = err.status;
     const title = status === 409 ? 'Conflict' : status === 404 ? 'Not Found' : 'Unprocessable Entity';
     responses.error(res, status, title, errors.getMessage(err))(err);
   }

modules/invitations/tests/invitations.controller.unit.tests.js

@@ -13,10 +13,12 @@ const successInner = jest.fn();
 const errorInner = jest.fn();
 const success = jest.fn(() => successInner);
 const error = jest.fn(() => errorInner);
+const mockLogger = { error: jest.fn(), warn: jest.fn(), info: jest.fn() };
 
 jest.unstable_mockModule('../services/invitations.service.js', () => ({ default: mockService }));
 jest.unstable_mockModule('../../../lib/helpers/responses.js', () => ({ default: { success, error } }));
 jest.unstable_mockModule('../../../lib/helpers/errors.js', () => ({ default: { getMessage: jest.fn((e) => e?.message || 'err') } }));
+jest.unstable_mockModule('../../../lib/services/logger.js', () => ({ default: mockLogger }));
 
 const controller = (await import('../controllers/invitations.controller.js')).default;
 
@@ -94,6 +96,26 @@ describe('invitations.controller.resend', () => {
     await controller.resend({ invitation: { id: 'i1' } }, makeRes());
     expect(error).toHaveBeenCalledWith(expect.anything(), 422, 'Unprocessable Entity', expect.any(String));
   });
+  // #3966 hardening: a bare transport rejection (no `.status`, unlike the
+  // deliberate AppErrors above) must not leak the raw provider/SMTP error
+  // string to the client — only a stable generic message — while the real
+  // error still gets logged server-side with context.
+  test('mail-transport failure (no .status) responds with a generic message, never the raw provider error, and logs server-side', async () => {
+    const providerError = new Error('Resend API error: 401 Unauthorized — invalid API key sk_live_abc123');
+    mockService.resend.mockRejectedValue(providerError);
+    await controller.resend({ invitation: { id: 'i1' } }, makeRes());
+
+    expect(error).toHaveBeenCalledWith(expect.anything(), 422, 'Unprocessable Entity', expect.any(String));
+    const clientMessage = error.mock.calls[0][3];
+    expect(clientMessage).not.toContain('sk_live_abc123');
+    expect(clientMessage).not.toContain('Resend API error');
+    expect(clientMessage).toBe('Failed to send the email, please try again.');
+
+    expect(mockLogger.error).toHaveBeenCalledWith('[invitations.resend] failed', expect.objectContaining({
+      invitationId: 'i1',
+      message: providerError.message,
+    }));
+  });
 });
 
 describe('invitations.controller.verify', () => {