Bug: website.create tRPC mutation fails with SQL INSERT error (500)

[aliosmandev]

Description

Creating a new website through the onboarding flow fails with a tRPC INTERNAL_SERVER_ERROR on the website.create procedure.

Steps to Reproduce

1. Go to the dashboard → "Create your website" step
2. Fill in:
   • Website Name: Better-i18n
   • Domain: better-i18n.com
   • Framework: React
3. Click "Start your integration"

Error Response

[
  {
    "error": {
      "json": {
        "message": "Failed to create website: Failed query: insert into \"website\" (\"id\", \"name\", \"slug\", \"domain\", \"contact_email\", \"is_domain_ownership_verified\", \"description\", \"logo_url\", \"whitelisted_domains\", \"default_participant_ids\", \"installation_target\", \"organization_id\", \"team_id\", \"status\", \"created_at\", \"updated_at\", \"deleted_at\") values ($1, $2, $3, $4, default, $5, default, default, $6, default, $7, $8, $9, default, $10, $11, default) returning ...",
        "code": -32603,
        "data": {
          "code": "INTERNAL_SERVER_ERROR",
          "httpStatus": 500,
          "path": "website.create"
        }
      }
    }
  }
]

Request data:

{
  "name": "Better-i18n",
  "installationTarget": "react",
  "domain": "better-i18n.com",
  "isDomainOwnershipVerified": true,
  "whitelistedDomains": ["https://better-i18n.com", "http://localhost:3000"],
  "slug": "better-i18n"
}

Expected Behavior

Website should be created successfully and proceed to step 2 (Install Cossistant locally).

Actual Behavior

website.create tRPC mutation returns HTTP 500 with a raw SQL error. The full INSERT query, column names, and internal IDs (organization_id, team_id) are leaked in the error response.

Observations

1. DB error — The INSERT uses default for several columns (contact_email, description, logo_url, default_participant_ids, status, deleted_at). One of these likely lacks a DEFAULT constraint in the DB schema, causing the query to fail.
2. Security concern — The raw SQL query, internal ULIDs, and DB schema are exposed to the client. Error responses should be sanitized for production.
3. tRPC path — website.create — the error is server-side, not a client validation issue.

Environment

• Browser: Chrome (macOS)
• Date: 2026-04-01
• Account: newly created