[boluwatifeajayi]

Issue:

Fixes #3898

The issue lists several controllers that sent the caught error straight into res.json(). I checked them against current develop and all but one already return a generic message (the user controllers now send Internal server error). The remaining one is changeProjectVisibility in server/controllers/project.controller.js, whose catch block did res.status(500).json(error). That sends the error object as the response body, so a database failure could expose a stack trace or mongoose internals to the client, and it also bypasses the global error handler because it never calls next().

Changes:

• Log the error on the server with console.error, like the other handlers in this file do.
• Respond with { success: false, message: 'Failed to change project visibility.' }, the same shape the rest of this function and the other project endpoints use.
• Added a test that makes the update throw and checks that the response only contains the generic message and that the error is logged. It fails on develop and passes with the change.

I have verified that this pull request:

• has no linting errors (npm run lint), I ran eslint on the two changed files
• has no test errors (npm run test), I ran the project controller test file (10 passing)
• has no typecheck errors (npm run typecheck), not run, only plain JS changed
• is from a uniquely-named feature branch and is up to date with the develop branch.
• is descriptively named and links to an issue number, i.e. Fixes #123
• meets the standards outlined in the accessibility guidelines (no UI change)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.