fix(api-express-router): honour errorStatusCode and JSON error envelope in default adapter

.changeset/provider-admin-error-status.md

@@ -0,0 +1,5 @@
+---
+"@prosopo/api-express-router": patch
+---
+
+Honour the adapter's `errorStatusCode` and the `{ error: ... }` JSON envelope in the default endpoint adapter's catch block. `ProsopoBaseError`s now surface their own status code via `unwrapError`; unexpected errors fall back to the configured `errorStatusCode` as JSON, instead of a hardcoded 500 plain-text response.

packages/api-express-router/src/endpointAdapter/apiExpressDefaultEndpointAdapter.ts

@@ -13,7 +13,11 @@
 // limitations under the License.
 
 import type { ApiEndpoint } from "@prosopo/api-route";
-import { ProsopoApiError } from "@prosopo/common";
+import {
+	ProsopoApiError,
+	ProsopoBaseError,
+	unwrapError,
+} from "@prosopo/common";
 import type { LogLevel } from "@prosopo/logger";
 import { stringifyBigInts } from "@prosopo/util";
 import type { NextFunction, Request, Response } from "express";
@@ -58,7 +62,28 @@ class ApiExpressDefaultEndpointAdapter implements ApiExpressEndpointAdapter {
 				err: error,
 			}));
 
-			response.status(500).send("An internal server error occurred.");
+			// Errors that already carry a proper status code (e.g. a 400 admin
+			// auth/validation error) should surface that code with the standard
+			// `{ error: ... }` JSON envelope rather than a hardcoded 500. For
+			// truly-unexpected errors fall back to this adapter's configured
+			// errorStatusCode.
+			if (error instanceof ProsopoBaseError) {
+				const { code, statusMessage, jsonError } = unwrapError(
+					error,
+					request.i18n,
+				);
+				response.statusMessage = statusMessage;
+				response.status(code).json({ error: jsonError });
+				return;
+			}
+
+			response.status(this.errorStatusCode).json({
+				error: {
+					code: this.errorStatusCode,
+					key: "API.UNKNOWN",
+					message: "An internal server error occurred.",
+				},
+			});
 		}
 	}
 }