Bug: Raw Error throws in customer/website mutations and actions not caught by Convex error boundary

[yannickmonney]

Area

services/platform/convex/customers/ and services/platform/convex/websites/ — public mutations and actions.

Steps to reproduce

Any of the following client-triggered operations will surface a generic "Server Error" in the Convex console (and potentially leak internal details) instead of a structured ConvexError the frontend can catch and display:

1. Not-found on update/delete — call updateWebsite, deleteWebsite, updateCustomer, deleteCustomer, updateCustomers, or updateCustomerMetadata with an ID that does not exist, or whose org doesn't match the caller's (IDOR guard branch).
2. Unauthenticated — invoke any of the public action() exports in websites/actions.ts or the mutation() in websites/mutations.ts without a valid session.
3. Duplicate-on-update — update a customer's email/externalId or a website's domain to one that already belongs to a different record (distinct from the duplicate-add case filed in Bug: Duplicate website/customer/vendor add throws a raw Error (not ConvexError) → uncaught Server Error in the client console #1993).
4. Validation — call createCustomerPublic with a blank email (after trimming to empty), or call updateCustomers without providing either customerId or organizationId.
5. Crawler not found — in websites/actions.ts updateWebsite, when updateCrawlerScanInterval surfaces a CRAWLER_WEBSITE_NOT_FOUND sentinel, the re-throw is a raw Error not a ConvexError.

Expected

All user-facing error paths throw ConvexError({ code: '...' }) so the client's .onError / ConvexError catch block receives a typed, displayable error instead of a generic server-error boundary activation.

Actual

Raw throw new Error(...) is used, which Convex treats as an unhandled server error, logs it to the Convex dashboard as a 500, and does not deliver a structured payload to the client.

Evidence

File	Line	Message
services/platform/convex/websites/actions.ts	32, 64, 113, 154, 227	'Unauthenticated'
services/platform/convex/websites/actions.ts	38, 119, 160	'Website not found' (in loadOwnedWebsite and deleteWebsite/updateWebsite handlers)
services/platform/convex/websites/actions.ts	199	'Website not found in crawler. Please delete and re-add it.'
services/platform/convex/websites/mutations.ts	22, 27	'Unauthenticated' / 'Website not found'
services/platform/convex/websites/update_website.ts	41, 49	'Website not found' (not-found + IDOR guard)
services/platform/convex/websites/update_website.ts	68	'Website with domain X already exists' (update-path duplicate, separate from #1993 create-path)
services/platform/convex/websites/delete_website.ts	15	'Website not found'
services/platform/convex/customers/update_customer.ts	42	'Customer not found'
services/platform/convex/customers/update_customer.ts	76, 80	'Customer with email/externalId X already exists' (update-path duplicate, separate from #1993)
services/platform/convex/customers/delete_customer.ts	16	'Customer not found'
services/platform/convex/customers/update_customers.ts	74, 86, 95	Safety validation / not-found
services/platform/convex/customers/update_customer_metadata.ts	30	'Customer not found: X'
services/platform/convex/customers/create_customer_public.ts	34	'Email is required'

Notes

• websites/bulk_create_websites.ts:42 is excluded — the duplicate-domain throw is caught internally and folded into a results.errors[] array; it never propagates to the client as a raw error.
• websites/internal_actions.ts:49,69 are excluded — these are infrastructure/sentinel throws in internalAction helpers, not directly client-callable.
• customers/create_customer_public.ts:47,63 (duplicate-create) is covered by Bug: Duplicate website/customer/vendor add throws a raw Error (not ConvexError) → uncaught Server Error in the client console #1993.
• websites/create_website.ts:43 (duplicate-create) is covered by Bug: Duplicate website/customer/vendor add throws a raw Error (not ConvexError) → uncaught Server Error in the client console #1993.
• Convention: throw new ConvexError({ code: 'WEBSITE_NOT_FOUND' }) — see services/platform/convex/tasks/mutations.ts for the established pattern.