Stop leaking the raw error from changeProjectVisibility

server/controllers/__tests__/project.controller.test.js

@@ -4,7 +4,11 @@
 import { Request, Response } from 'jest-express';
 import Project from '../../models/project';
 import { User } from '../../models/user';
-import { getProject, downloadProjectAsZip } from '../project.controller';
+import {
+  getProject,
+  downloadProjectAsZip,
+  changeProjectVisibility
+} from '../project.controller';
 
 jest.mock('../../models/project');
 jest.mock('../../models/user');
@@ -208,4 +212,37 @@ describe('project.controller', () => {
       expect(ownerId.equals).toHaveBeenCalledWith('other-user-id');
     });
   });
+
+  describe('changeProjectVisibility()', () => {
+    it('does not leak the error object when the update fails', async () => {
+      const request = new Request();
+      request.setBody({ projectId: 'project-123', visibility: 'Private' });
+      request.user = { _id: 'owner-id' };
+      const response = new Response();
+      const consoleError = jest
+        .spyOn(console, 'error')
+        .mockImplementation(() => {});
+
+      const dbError = new Error('connection to mongo lost');
+      Project.findOne = jest.fn().mockResolvedValue({
+        user: { equals: jest.fn().mockReturnValue(true) }
+      });
+      Project.findByIdAndUpdate = jest.fn().mockImplementation(() => {
+        throw dbError;
+      });
+
+      await changeProjectVisibility(request, response);
+
+      expect(response.status).toHaveBeenCalledWith(500);
+      expect(response.json).toHaveBeenCalledWith({
+        success: false,
+        message: 'Failed to change project visibility.'
+      });
+      expect(consoleError).toHaveBeenCalledWith(
+        'Error in changeProjectVisibility:',
+        dbError
+      );
+      consoleError.mockRestore();
+    });
+  });
 });

server/controllers/project.controller.js

@@ -482,6 +482,10 @@ export async function changeProjectVisibility(req, res) {
 
     return res.status(200).json(updatedProject);
   } catch (error) {
-    return res.status(500).json(error);
+    console.error('Error in changeProjectVisibility:', error);
+    return res.status(500).json({
+      success: false,
+      message: 'Failed to change project visibility.'
+    });
   }
 }