update

Backend/src/shared/middleware/error_handler.py

@@ -100,7 +100,22 @@ async def general_exception_handler(request: Request, exc: Exception):
     from ...shared.config.logging_config import get_logger
     logger = get_logger(__name__)
     request_id = getattr(request.state, 'request_id', None)
-    logger.error(f'Unhandled exception: {type(exc).__name__}: {str(exc)}', extra={'request_id': request_id, 'path': request.url.path, 'method': request.method, 'exception_type': type(exc).__name__}, exc_info=True)
+    
+    # Log full error details server-side
+    logger.error(
+        f'Unhandled exception: {type(exc).__name__}: {str(exc)}',
+        extra={
+            'request_id': request_id,
+            'path': request.url.path,
+            'method': request.method,
+            'exception_type': type(exc).__name__,
+            'client_ip': request.client.host if request.client else None,
+            'user_agent': request.headers.get('User-Agent')
+        },
+        exc_info=True
+    )
+    
+    # Determine status code and message
     if isinstance(exc, Exception) and hasattr(exc, 'status_code'):
         status_code = exc.status_code
         if hasattr(exc, 'detail'):
@@ -113,11 +128,17 @@ async def general_exception_handler(request: Request, exc: Exception):
             message = str(exc) if str(exc) else 'Internal server error'
     else:
         status_code = status.HTTP_500_INTERNAL_SERVER_ERROR
-        message = str(exc) if str(exc) else 'Internal server error'
+        # Don't expose internal error details in production
+        if settings.is_production:
+            message = 'An internal server error occurred. Please try again later.'
+        else:
+            message = str(exc) if str(exc) else 'Internal server error'
+    
     response_content = error_response(
         message=message,
         request_id=request_id
     )
+    
     # NEVER include stack traces in production responses
     # Always log stack traces server-side only for debugging
     if settings.is_development:
@@ -126,6 +147,7 @@ async def general_exception_handler(request: Request, exc: Exception):
         env_check = os.getenv('ENVIRONMENT', 'development').lower()
         if env_check == 'development':
             response_content['stack'] = traceback.format_exc()
+            response_content['error_type'] = type(exc).__name__
         else:
             # Log warning if development flag is set but environment says otherwise
             logger.warning(f'is_development=True but ENVIRONMENT={env_check}. Not including stack trace in response.')

Backend/src/shared/utils/role_helpers.py

@@ -7,8 +7,13 @@ from ...auth.models.role import Role
 
 def get_user_role_name(user: User, db: Session) -> str:
     """Get the role name for a user"""
-    role = db.query(Role).filter(Role.id == user.role_id).first()
-    return role.name if role else 'customer'
+    if not user or not user.role_id:
+        return 'customer'
+    try:
+        role = db.query(Role).filter(Role.id == user.role_id).first()
+        return role.name if role else 'customer'
+    except Exception:
+        return 'customer'
 
 def is_admin(user: User, db: Session) -> bool:
     """Check if user is admin"""