fix(http): preserve Effect error responses (#1011)

Author: patrikduksin

packages/alchemy/src/Http.ts

@@ -2,11 +2,15 @@ import * as Cause from "effect/Cause";
 import * as Config from "effect/Config";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
+import * as ErrorReporter from "effect/ErrorReporter";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import type { Scope } from "effect/Scope";
 import type { HttpBodyError } from "effect/unstable/http/HttpBody";
-import type { HttpServerError } from "effect/unstable/http/HttpServerError";
+import {
+  causeResponse,
+  type HttpServerError,
+} from "effect/unstable/http/HttpServerError";
 import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
 import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
 
@@ -82,26 +86,45 @@ export const safeHttpEffect = <Req = never>(
           : response,
       ),
     ) as any as HttpEffect<Req>,
-    (cause) => {
-      // ClientAbort interrupts are not real failures — the client closed
-      // the connection. Skip logging and respond with 499 if applicable.
-      if (Cause.hasInterruptsOnly(cause)) {
-        return Effect.succeed(HttpServerResponse.empty({ status: 499 }));
-      }
-      // Log the full cause server-side so operators can debug, but return
-      // a generic 500 to the client. Causes can contain sensitive data
-      // (prompt contents, API keys baked into error messages, internal
-      // file paths) and should never be echoed back to the network.
-      return Effect.logError("HTTP handler failed", cause).pipe(
-        Effect.as(
-          HttpServerResponse.text("Internal Server Error", {
-            status: 500,
-            statusText: "Internal Server Error",
-          }),
+    (cause) =>
+      // `causeResponse` is effect's native failure boundary: Respondable
+      // failures keep their intended response (e.g. RouteNotFound -> 404),
+      // client aborts map to 499, and everything else becomes an empty 500 —
+      // the cause is never echoed to the network, as it can contain sensitive
+      // data (prompt contents, API keys baked into error messages, internal
+      // file paths).
+      causeResponse(cause).pipe(
+        Effect.flatMap(([response, reportableCause]) =>
+          Effect.withFiber((fiber) =>
+            fiber.getRef(ErrorReporter.CurrentErrorReporters).size > 0
+              ? ErrorReporter.report(reportableCause)
+              : logUnreportedCause(reportableCause),
+          ).pipe(Effect.as(response)),
         ),
-      );
-    },
+      ),
+  );
+
+/**
+ * No `ErrorReporter` is registered by default, so without a fallback a defect
+ * in a deployed Function/Worker would produce a bare 500 and vanish without a
+ * trace. Log the cause server-side so operators can debug, applying the same
+ * filtering `ErrorReporter.make` reporters do: interrupts (client aborts) and
+ * `ErrorReporter.ignore`-annotated values (Respondable errors like
+ * RouteNotFound, and the response `causeResponse` appends) are not failures
+ * and are skipped.
+ */
+const logUnreportedCause = (cause: Cause.Cause<unknown>) => {
+  const failures = cause.reasons.filter(
+    (reason) =>
+      reason._tag !== "Interrupt" &&
+      !ErrorReporter.isIgnored(
+        reason._tag === "Fail" ? reason.error : reason.defect,
+      ),
   );
+  return failures.length === 0
+    ? Effect.void
+    : Effect.logError("HTTP handler failed", Cause.fromReasons(failures));
+};
 
 export const resolvePort = (options: { port?: number } | undefined) =>
   options?.port !== undefined

packages/alchemy/test/AWS/Lambda/HttpServer.test.ts

@@ -215,9 +215,14 @@ describe("AWS.Lambda.HttpServer", () => {
       ),
     );
 
+    // Defects render effect's native `causeResponse` fallback — an empty
+    // `500` with no body or content-type (the same wire shape effect's own
+    // servers produce) — instead of alchemy's former hand-rolled
+    // "Internal Server Error" text response. The cause is reported/logged
+    // server-side, never echoed to the client.
     expect(result.statusCode).toBe(500);
-    expect(result.headers?.["content-type"]).toContain("text/plain");
-    expect(result.body).toBe("Internal Server Error");
+    expect(result.headers?.["content-type"]).toBeUndefined();
+    expect(result.body).toBeUndefined();
   });
 });
 

packages/alchemy/test/Cloudflare/Workers/HttpServer.test.ts

@@ -0,0 +1,76 @@
+import * as Cloudflare from "@/Cloudflare/index.ts";
+import * as Alchemy from "@/index.ts";
+import * as Test from "@/Test/Alchemy";
+import { expect } from "alchemy-test";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import { expectUrlContains } from "../Utils/Http.ts";
+import HttpServerWorker, {
+  readyMarker,
+  sensitiveContext,
+} from "./fixtures/http-server-worker.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+
+const Stack = Alchemy.Stack(
+  "WorkersHttpServerStack",
+  { providers: Cloudflare.providers(), state: Cloudflare.state() },
+  Effect.gen(function* () {
+    const worker = yield* HttpServerWorker;
+    return { url: worker.url.as<string>() };
+  }),
+);
+
+const stack = beforeAll(deploy(Stack));
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+/**
+ * GET `url` until it serves `status` with an empty body. Both error routes
+ * respond with no body, which also distinguishes them from the workers.dev
+ * placeholder page (a 404 *with* a body) during edge propagation.
+ */
+const getEmptyResponse = (url: string, status: number) =>
+  Effect.gen(function* () {
+    const client = yield* HttpClient.HttpClient;
+    const response = yield* client.get(url);
+    const body = yield* response.text;
+    if (response.status !== status || body !== "") {
+      return yield* Effect.fail(
+        new Error(
+          `expected empty ${status} from ${url}, got ${response.status}: ${body.slice(0, 160)}`,
+        ),
+      );
+    }
+    return response;
+  }).pipe(
+    Effect.retry({ schedule: Schedule.spaced("1500 millis"), times: 20 }),
+  );
+
+test(
+  "a Respondable defect keeps its intended response over the wire",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    yield* expectUrlContains(url, readyMarker);
+
+    yield* getEmptyResponse(`${url}/missing`, 404);
+  }),
+  { timeout: 180_000 },
+);
+
+test(
+  "a failed handler responds 500 without exposing the cause",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    yield* expectUrlContains(url, readyMarker);
+
+    const response = yield* getEmptyResponse(`${url}/boom`, 500);
+    const wireResponse = JSON.stringify(response.headers);
+    for (const sensitiveValue of sensitiveContext) {
+      expect(wireResponse).not.toContain(sensitiveValue);
+    }
+  }),
+  { timeout: 180_000 },
+);

packages/alchemy/test/Cloudflare/Workers/fixtures/http-server-worker.ts

@@ -0,0 +1,47 @@
+import * as Cloudflare from "@/Cloudflare/index.ts";
+import * as Effect from "effect/Effect";
+import * as HttpServerError from "effect/unstable/http/HttpServerError";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+export const readyMarker = "http-server-worker-ready";
+
+/**
+ * Values that must never escape the Worker over the wire when a handler
+ * fails. The test asserts none of them appear in the HTTP response.
+ */
+export const sensitiveContext = [
+  "sk_live_alchemy_super_secret",
+  "tenant-customer-42",
+  "/srv/alchemy/private/customer-42.json",
+  "10.42.0.17",
+];
+
+export default class HttpServerWorker extends Cloudflare.Worker<HttpServerWorker>()(
+  "HttpServerWorker",
+  {
+    main: import.meta.url,
+  },
+  Effect.gen(function* () {
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        if (request.url.startsWith("/missing")) {
+          // A Respondable error escaping as a defect must keep its intended
+          // response (404), not be flattened into a generic 500.
+          return yield* Effect.die(
+            new HttpServerError.RouteNotFound({ request }),
+          );
+        }
+        if (request.url.startsWith("/boom")) {
+          return yield* Effect.fail(
+            new Error(
+              `Sensitive handler context: ${sensitiveContext.join(" ")}`,
+            ),
+          ).pipe(Effect.orDie);
+        }
+        return HttpServerResponse.text(readyMarker);
+      }),
+    };
+  }),
+) {}