[devin-ai-integration]

Description

Fixes #1104

Audit of error handling across packages/app and packages/ui, fixing paths where failures were swallowed or reported as success.

Backend:

• New middlewares/errorHandler.js — until now next(err) from controllers fell through to Express' default HTML error page. Adds a JSON error boundary matching the existing { statusCode, error, message } envelope, maps Mongoose validation/cast, body-parse and CORS errors to 4xx, and hides internal messages for 5xx. Also adds a JSON 404 handler, plus mongoose.connection.on("error") and unhandledRejection/uncaughtException logging in server.js.
• sendEmail used to catch and only log, so callers saw a successful send. It now throws a 502-tagged error (original preserved in cause). Signup responds 201 { emailSent: false, message: VERIFICATION_EMAIL_FAILED } (the account is already created), and the operator reply endpoint responds 502 (the reply is already persisted), instead of both claiming delivery.
• mfa.updateMfaUser no longer converts encryption/persistence failures into return false (indistinguishable from "user not found"); mfaLogin throws when the stored secret is missing instead of treating server-side corruption as a wrong token, and only swallows the authenticator.verify failure of a malformed client token.
• webLogoSearch: the Clearbit lookup resolved null on request/parse errors, so an outage looked like "no such company"; it now rejects, and grabCompanyLogos reports error on its result. catalog rethrows that into its existing 502 path.
• logo: the usage-count increment is awaited instead of fire-and-forget, so a failed increment no longer returns 200 with unmetered usage. Same for the session activity refresh in middlewares/auth.js — still non-fatal, but awaited so the rejection is logged during the request instead of after it (this dangling promise was also what made jest exit non-zero locally; the 9 suites that stubbed validateSession with a bare { userId } now stub touchSession too).
• Contextual logging for the refreshUsageCount script rejection and the user-data export path (which previously logged after next(err)).

Frontend:

• getErrorMessage helper in utils/Helpers.js; UserContext/OperatorContext passed the raw Error object to toast.error(err) (rendering as an object), and now show the API message.
• OperatorDashboard messages/requests/logos fetches only logged to the console — failures were invisible in the UI; they now toast.
• processWebImage restores fallback dimensions when SVG parsing fails.

What type of PR is this? (Check all applicable)

• 🍕 Feature
• 🐛 Bug Fix
• 📄 Documentation Update
• 👨‍💻 Code Refactor
• 🔥 Performance Improvements
• ✅ Test
• 🛠️ CI/CD

Screenshots (if applicable)

N/A — no visual changes beyond error toasts.

Checklist

• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

Link to Devin session: https://app.devin.ai/sessions/8f35695ae1024fc0af8b0ee6bd66966b
Requested by: @sunnykgupta

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openlogo-prod-web	Ready	Preview	Aug 26, 2026 6:43am
openlogo-staging-web	Ready	Preview	Aug 26, 2026 6:43am

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[sonarqubecloud]

Quality Gate failed

Failed conditions
B Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE