security: sanitize exception messages in v1 API responses (FIX-11)

app/controllers/api/v1/accounts_controller.rb

@@ -28,7 +28,7 @@ def index
 
     render json: {
       error: "internal_server_error",
-      message: "Error: #{e.message}"
+      message: "An unexpected error occurred"
     }, status: :internal_server_error
 end
 

app/controllers/api/v1/auth_controller.rb

@@ -54,7 +54,8 @@ def signup
             device = MobileDevice.upsert_device!(user, device_params)
             token_response = device.issue_token!
           rescue ActiveRecord::RecordInvalid => e
-            render json: { error: "Failed to register device: #{e.message}" }, status: :unprocessable_entity
+            Rails.logger.error("[Auth] Device registration failed: #{e.message}")
+            render json: { error: "Failed to register device" }, status: :unprocessable_entity
             return
           end
 
@@ -90,7 +91,8 @@ def login
             device = MobileDevice.upsert_device!(user, device_params)
             token_response = device.issue_token!
           rescue ActiveRecord::RecordInvalid => e
-            render json: { error: "Failed to register device: #{e.message}" }, status: :unprocessable_entity
+            Rails.logger.error("[Auth] Device registration failed: #{e.message}")
+            render json: { error: "Failed to register device" }, status: :unprocessable_entity
             return
           end
 
@@ -373,7 +375,8 @@ def issue_mobile_tokens(user, device_info)
 
           render json: token_response.merge(user: mobile_user_payload(user))
         rescue ActiveRecord::RecordInvalid => e
-          render json: { error: "Failed to register device: #{e.message}" }, status: :unprocessable_entity
+          Rails.logger.error("[Auth] Device registration failed: #{e.message}")
+          render json: { error: "Failed to register device" }, status: :unprocessable_entity
         end
 
         def ensure_write_scope

app/controllers/api/v1/categories_controller.rb

@@ -29,7 +29,7 @@ def index
 
     render json: {
       error: "internal_server_error",
-      message: "Error: #{e.message}"
+      message: "An unexpected error occurred"
     }, status: :internal_server_error
   end
 
@@ -41,7 +41,7 @@ def show
 
     render json: {
       error: "internal_server_error",
-      message: "Error: #{e.message}"
+      message: "An unexpected error occurred"
     }, status: :internal_server_error
   end
 

app/controllers/api/v1/holdings_controller.rb

@@ -102,7 +102,7 @@ def log_and_render_error(action, exception)
       Rails.logger.error exception.backtrace.join("\n")
       render json: {
         error: "internal_server_error",
-        message: "Error: #{exception.message}"
+        message: "An unexpected error occurred"
       }, status: :internal_server_error
     end
 end

app/controllers/api/v1/sync_controller.rb

@@ -21,7 +21,7 @@ def create
 
     render json: {
       error: "internal_server_error",
-      message: "Error: #{e.message}"
+      message: "An unexpected error occurred"
     }, status: :internal_server_error
   end
 

app/controllers/api/v1/trades_controller.rb

@@ -292,7 +292,7 @@ def log_and_render_error(action, exception)
       Rails.logger.error exception.backtrace.join("\n")
       render json: {
         error: "internal_server_error",
-        message: "Error: #{exception.message}"
+        message: "An unexpected error occurred"
       }, status: :internal_server_error
     end
 

app/controllers/api/v1/transactions_controller.rb

@@ -47,7 +47,7 @@ def index
 
     render json: {
       error: "internal_server_error",
-      message: "Error: #{e.message}"
+      message: "An unexpected error occurred"
     }, status: :internal_server_error
   end
 
@@ -61,7 +61,7 @@ def show
 
     render json: {
       error: "internal_server_error",
-      message: "Error: #{e.message}"
+      message: "An unexpected error occurred"
     }, status: :internal_server_error
   end
 
@@ -102,7 +102,7 @@ def create
 
     render json: {
       error: "internal_server_error",
-      message: "Error: #{e.message}"
+      message: "An unexpected error occurred"
     }, status: :internal_server_error
 end
 
@@ -148,7 +148,7 @@ def update
 
     render json: {
       error: "internal_server_error",
-      message: "Error: #{e.message}"
+      message: "An unexpected error occurred"
     }, status: :internal_server_error
   end
 
@@ -171,7 +171,7 @@ def destroy
 
     render json: {
       error: "internal_server_error",
-      message: "Error: #{e.message}"
+      message: "An unexpected error occurred"
     }, status: :internal_server_error
   end
 

app/controllers/api/v1/valuations_controller.rb

@@ -13,7 +13,7 @@ def show
 
     render json: {
       error: "internal_server_error",
-      message: "Error: #{e.message}"
+      message: "An unexpected error occurred"
     }, status: :internal_server_error
   end
 
@@ -100,7 +100,7 @@ def create
 
     render json: {
       error: "internal_server_error",
-      message: "Error: #{e.message}"
+      message: "An unexpected error occurred"
     }, status: :internal_server_error
   end
 
@@ -181,7 +181,7 @@ def update
 
     render json: {
       error: "internal_server_error",
-      message: "Error: #{e.message}"
+      message: "An unexpected error occurred"
     }, status: :internal_server_error
   end
 

app/controllers/settings/providers_controller.rb

@@ -71,8 +71,8 @@ def update
       redirect_to settings_providers_path, notice: "No changes were made"
     end
   rescue => error
-    Rails.logger.error("Failed to update provider settings: #{error.message}")
-    flash.now[:alert] = "Failed to update provider settings: #{error.message}"
+    Rails.logger.error("Failed to update provider settings: #{error.class} - #{error.message}")
+    flash.now[:alert] = "Failed to update provider settings. Please try again."
     prepare_show_context
     render :show, status: :unprocessable_entity
   end

app/controllers/webhooks_controller.rb

@@ -15,7 +15,8 @@ def plaid
     render json: { received: true }, status: :ok
   rescue => error
     Sentry.capture_exception(error)
-    render json: { error: "Invalid webhook: #{error.message}" }, status: :bad_request
+    Rails.logger.error("Webhook error: #{error.class} - #{error.message}")
+    render json: { error: "Invalid webhook" }, status: :bad_request
   end
 
   def plaid_eu
@@ -31,7 +32,8 @@ def plaid_eu
     render json: { received: true }, status: :ok
   rescue => error
     Sentry.capture_exception(error)
-    render json: { error: "Invalid webhook: #{error.message}" }, status: :bad_request
+    Rails.logger.error("Webhook error: #{error.class} - #{error.message}")
+    render json: { error: "Invalid webhook" }, status: :bad_request
   end
 
   def stripe

test/controllers/settings/providers_controller_test.rb

@@ -270,16 +270,16 @@ class Settings::ProvidersControllerTest < ActionDispatch::IntegrationTest
       # We'll force an error by making the []= method raise
       Setting.expects(:[]=).with("plaid_client_id", "test").raises(StandardError.new("Database error")).once
 
-      # Mock logger to verify error is logged
+      # Mock logger to verify error is logged (includes class and message for debugging)
       Rails.logger.expects(:error).with(regexp_matches(/Failed to update provider settings.*Database error/)).once
 
       patch settings_providers_url, params: {
         setting: { plaid_client_id: "test" }
       }
 
-      # Controller should handle the error gracefully
+      # Controller should handle the error gracefully with generic message (no internal details)
       assert_response :unprocessable_entity
-      assert_equal "Failed to update provider settings: Database error", flash[:alert]
+      assert_equal "Failed to update provider settings. Please try again.", flash[:alert]
     end
   end