Skip to content

fix: properly handle HTTP 4xx errors instead of wrapping as 503#468

Open
gibaros wants to merge 2 commits intomojaloop:mainfrom
gibaros:fix/i4198-error-handling-and-deps
Open

fix: properly handle HTTP 4xx errors instead of wrapping as 503#468
gibaros wants to merge 2 commits intomojaloop:mainfrom
gibaros:fix/i4198-error-handling-and-deps

Conversation

@gibaros
Copy link
Copy Markdown
Contributor

@gibaros gibaros commented Apr 10, 2026

Summary

  • Fix incorrect error handling where all axios errors (including HTTP 4xx) were blanket-converted to DESTINATION_COMMUNICATION_ERROR (1001 → HTTP 503), hiding the actual error
  • Now properly differentiates HTTP response errors from network/connection errors across 4 files
  • Update dependencies to latest versions and fix vulnerabilities

Error Handling Fix

Applies the same pattern from mojaloop/central-services-shared#474 to quoting-service's own request handling code:

Error Type Before After
Response with FSPIOP errorInformation 503 DESTINATION_COMMUNICATION_ERROR Propagated directly (preserves original error)
HTTP 4xx without errorInformation 503 DESTINATION_COMMUNICATION_ERROR CLIENT_ERROR (preserves actual status)
HTTP 5xx / network errors 503 DESTINATION_COMMUNICATION_ERROR 503 DESTINATION_COMMUNICATION_ERROR (unchanged)

Files Changed

  • src/lib/http.js — central httpRequest function
  • src/model/quotes.jssendErrorCallback catch block
  • src/model/fxQuotes.jssendErrorCallback + sendHttpRequest
  • src/model/bulkQuotes.jssendErrorCallback catch block

Dependency Updates

  • @mojaloop/central-services-shared: 18.35.6 → 18.35.7
  • axios: 1.13.6 → 1.15.0
  • @hapi/hapi: 21.4.7 → 21.4.8
  • knex: 3.2.5 → 3.2.9, mysql2: 3.20.0 → 3.22.0
  • Node.js: 22.22.1 → 22.22.2
  • Security overrides: lodash 4.18.1, undici 7.24.7, fast-xml-parser 5.5.10, cross-spawn 7.0.6
  • Added yaml overrides for transitive widdershins/swagger2openapi/oas-resolver deps

Refs: mojaloop/project#4198

Test plan

  • All 621 unit tests pass
  • Lint passes
  • audit-ci passes (only unfixable convict CVEs allowlisted)
  • CI pipeline passes
  • Integration test: POST/GET that triggers downstream 400 should return proper error, not 503

🤖 Generated with Claude Code

Axios throws on non-2xx responses, and catch blocks were blanket-converting
all errors to DESTINATION_COMMUNICATION_ERROR (1001 → HTTP 503). This hid
the actual error (e.g. 400 Bad Request) behind a generic 503.

Now differentiates HTTP response errors from network errors:
- If response contains FSPIOP errorInformation, propagate it directly
- 4xx client errors → CLIENT_ERROR (preserves actual error code)
- 5xx / network errors → DESTINATION_COMMUNICATION_ERROR (unchanged)

Also updates dependencies, fixes vulnerabilities, and bumps Node to 22.22.2.

Refs: mojaloop/project#4198

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Add tests for FSPIOP errorInformation propagation from HTTP 4xx responses
- Add tests for CLIENT_ERROR handling on 4xx without errorInformation
- Add tests for 5xx DESTINATION_COMMUNICATION_ERROR handling
- Add convict CVEs to .grype.yaml ignore list (unfixable transitive dep)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@sonarqubecloud
Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant