From 173240ac9a95b3e6f414b0c4d5cc35a14a32d2f8 Mon Sep 17 00:00:00 2001
From: Florian Wartner <fwartner@users.noreply.github.com>
Date: Wed, 18 Mar 2026 09:48:49 +0100
Subject: [PATCH] Potential fix for code scanning alert no. 3: Information
 exposure through a stack trace

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 server.mjs | 35 ++++++++++++++++++++++++++++-------
 1 file changed, 28 insertions(+), 7 deletions(-)

diff --git a/server.mjs b/server.mjs
index 9e2a28e..b3de4b9 100644
--- a/server.mjs
+++ b/server.mjs
@@ -379,7 +379,10 @@ const server = http.createServer(async (req, res) => {
           json(res, 200, { ok: true, agent, source: 'file' })
         })
       }
-    } catch (e) { json(res, 400, { error: String(e) }) }
+    } catch (e) {
+      console.error('Error handling PATCH /api/office/agent/:id', e)
+      json(res, 400, { error: 'Invalid request body' })
+    }
     return
   }
 
@@ -408,7 +411,10 @@ const server = http.createServer(async (req, res) => {
           json(res, 200, { ok: true, assignment, source: 'file' })
         })
       }
-    } catch (e) { json(res, 400, { error: String(e) }) }
+    } catch (e) {
+      console.error('Error handling PATCH /api/office/assignment/:id', e)
+      json(res, 400, { error: 'Invalid request body' })
+    }
     return
   }
 
@@ -445,7 +451,10 @@ const server = http.createServer(async (req, res) => {
         origin: 'office_ui'
       })
       json(res, 200, { ok: true, persisted, result, source: 'postgres' })
-    } catch (e) { json(res, 400, { error: String(e) }) }
+    } catch (e) {
+      console.error('Error handling POST /api/office/assign', e)
+      json(res, 400, { error: 'Invalid request body' })
+    }
     return
   }
 
@@ -506,7 +515,10 @@ const server = http.createServer(async (req, res) => {
           json(res, 201, { ok: true, id: input.id, source: 'file' })
         })
       }
-    } catch (e) { json(res, 400, { error: String(e) }) }
+    } catch (e) {
+      console.error('Error handling POST /api/office/agent', e)
+      json(res, 400, { error: 'Invalid request body' })
+    }
     return
   }
 
@@ -573,7 +585,10 @@ const server = http.createServer(async (req, res) => {
           json(res, 200, { ok: true, agent, source: 'file' })
         })
       }
-    } catch (e) { json(res, 400, { error: String(e) }) }
+    } catch (e) {
+      console.error('Error handling PUT /api/office/agent/:id', e)
+      json(res, 400, { error: 'Invalid request body' })
+    }
     return
   }
 
@@ -605,7 +620,10 @@ const server = http.createServer(async (req, res) => {
           json(res, 200, { ok: true, source: 'file' })
         })
       }
-    } catch (e) { json(res, 400, { error: String(e) }) }
+    } catch (e) {
+      console.error('Error handling DELETE /api/office/agent/:id', e)
+      json(res, 400, { error: 'Internal error' })
+    }
     return
   }
 
@@ -635,7 +653,10 @@ const server = http.createServer(async (req, res) => {
           json(res, 200, { ok: true, source: 'file' })
         })
       }
-    } catch (e) { json(res, 400, { error: String(e) }) }
+    } catch (e) {
+      console.error('Error handling POST /api/office/activity', e)
+      json(res, 400, { error: 'Invalid request body' })
+    }
     return
   }