Backend

Files (1)

• SKILL.md

SKILL.md (first lines)

## Error Handling

- Never expose stack traces to clients—log internally, return generic message
- Structured error responses: code, message, request ID—enables debugging without leaking
- Fail fast on bad input—validate at entry point, not deep in business logic
- Unexpected errors: 500 + alert—expected errors: appropriate 4xx

### Examples

**Node.js/Express:**
```javascript
// Error handler middleware
app.use((err, req, res, next) => {
  const requestId = req.id || uuid();
  
  // Log full error internally
  logger.error({
    requestId,
    error: err.message,
    stack: err.stack,
    path: req.path
  });
  
  // Return safe error to client
  res.status(err.statusCode || 500).json({
    error: {
      code: err.code || 'INTERNAL_ERROR',
      message: err.statusCode < 500 ? err.message : 'Internal server error',
      requestId
    }
  });
});
```

**Python/FastAPI:**
```python
from fastapi import FastAPI, Request
from fastapi.responses import JSONResponse
import logging

app = FastAPI()

@app.exception_handler(Exception)
async def global_exception_handler(request: Request, exc: Exception):
    request_id = request.headers.get("X-Request-ID", str(uuid.uuid4()))
    
    # Log full error
    logging.error(f"Request {request_id} failed: {exc}", exc_info=True)
    
    # Return safe error
    return JSONResponse(
        status_code=500,
        content={
            "error": {
                "code": "INTERNAL_ERROR",
                "message": "Internal server error",
                "requestId": request_id
            }
        }
    )
```

---

## Input Validation

- Validate everything from outside—query params, headers, body, path params
- Whitelist valid input, don't blacklist bad—reject unknown fields
- Validate early, before any processing—save resources, clearer errors
- Size limits on all inputs—prevent memory exhaustion attacks

### Examples

**Zod (TypeScript):**
```typescript
import { z } from 'zod';

const createUserSchema = z.object({
  email: z.string().email().max(255),
  password: z.string().min(8).max(100),
  age: z.number().int().min(18).max(120),
  role: z.enum(['user', 'admin']).default('user')
}).strict(); // Reject unknown fields

app.post('/users', async (req, res) => {
  try {
    const data = createUserSchema.parse(req.body);
    const user = await createUser(data);
    res.status(201).json(user);
  } catch (err) {
    if (err instanceof z.ZodError) {
      return res.status(400).json({
        error: {
          code: 'VALIDATION_ERROR',
          message: 'Invalid input',
          details: err.errors
        }
      });
    }
    throw err;
  }
});
```

**Pydantic (Python):**
```python
from pydantic import BaseModel, EmailStr, Field, validator

class CreateUserRequest(BaseModel):
    email: EmailStr
    password: str = Field(min_length=8, max_length=100)
    age: int = Field(ge=18, le=120)
    role: str = Field(default="user", pattern="^(user|admin)$")
    
    class Config:
        extra = "forbid"  # Reject unknown fields

@app.post("/users")
async def create_user(data: CreateUserRequest):

From sigitpoerwo/repoworkspace_zahra, MIT.

More from sigitpoerwo/repoworkspace_zahra