test(api): align error envelope assertions

Author: ponmileleke54-dev

backend/swagger/flowfi.openapi.json

@@ -829,7 +829,10 @@
         "properties": {
           "error": {
             "type": "object",
-            "required": ["code", "message"],
+            "required": [
+              "code",
+              "message"
+            ],
             "properties": {
               "code": {
                 "type": "string",
@@ -849,7 +852,9 @@
             }
           }
         },
-        "required": ["error"]
+        "required": [
+          "error"
+        ]
       }
     }
   },

backend/tests/integration/streams/cancel.test.ts

@@ -108,7 +108,7 @@ describe('POST /v1/streams/:streamId/cancel', () => {
       .set('Authorization', 'Bearer dummy_token');
 
     expect(res.status).toBe(400);
-    expect(res.body.message).toContain('senderSecret');
+    expect(res.body.error.message).toContain('senderSecret');
     expect(sorobanService.cancelStream).not.toHaveBeenCalled();
   });
 
@@ -127,7 +127,10 @@ describe('POST /v1/streams/:streamId/cancel', () => {
       .set('Authorization', 'Bearer dummy_token');
 
     expect(res.status).toBe(403);
-    expect(res.body.error).toBe('Forbidden');
+    expect(res.body.error).toMatchObject({
+      code: 'FORBIDDEN',
+      message: 'Only the sender can cancel the stream',
+    });
     expect(sorobanService.cancelStream).not.toHaveBeenCalled();
   });
 
@@ -158,7 +161,7 @@ describe('POST /v1/streams/:streamId/cancel', () => {
       .set('Authorization', 'Bearer dummy_token');
 
     expect(res.status).toBe(409);
-    expect(res.body.message).toContain('already cancelled');
+    expect(res.body.error.message).toContain('already cancelled');
   });
 
   it('handles concurrent cancel requests correctly', async () => {

backend/tests/integration/streams/withdraw.test.ts

@@ -150,7 +150,10 @@ describe('POST /api/v1/streams/:streamId/withdraw', () => {
       .set('Authorization', `Bearer ${token}`);
 
     expect(response.status).toBe(403);
-    expect(response.body.error).toBe('Forbidden');
+    expect(response.body.error).toMatchObject({
+      code: 'FORBIDDEN',
+      message: 'Only the stream recipient can withdraw from the stream',
+    });
   });
 
   it('returns 404 if stream not found', async () => {
@@ -164,7 +167,10 @@ describe('POST /api/v1/streams/:streamId/withdraw', () => {
       .set('Authorization', `Bearer ${token}`);
 
     expect(response.status).toBe(404);
-    expect(response.body.error).toBe('Stream not found');
+    expect(response.body.error).toMatchObject({
+      code: 'NOT_FOUND',
+      message: 'Stream not found',
+    });
   });
 
   it('returns 409 if no claimable balance available', async () => {
@@ -192,7 +198,7 @@ describe('POST /api/v1/streams/:streamId/withdraw', () => {
       .set('Authorization', `Bearer ${token}`);
 
     expect(response.status).toBe(409);
-    expect(response.body.message).toBe('No claimable balance is currently available');
+    expect(response.body.error.message).toBe('No claimable balance is currently available');
   });
 
   it('does not double-count withdrawnAmount when the same claim window is withdrawn twice in a row', async () => {
@@ -291,7 +297,7 @@ describe('POST /api/v1/streams/:streamId/withdraw', () => {
       // lastUpdateTime, so the second call correctly finds nothing left to
       // claim in this window and is rejected.
       expect(second.status).toBe(409);
-      expect(second.body.message).toBe('No claimable balance is currently available');
+      expect(second.body.error.message).toBe('No claimable balance is currently available');
     }
 
     // The critical assertion: withdrawnAmount reflects only the ONE

backend/tests/integration/top-up.test.ts

@@ -182,7 +182,7 @@ describe('POST /v1/streams/:streamId/top-up', () => {
       .send({ amount: '1000' });
 
     expect(res.status).toBe(409);
-    expect(res.body.message).toMatch(/inactive stream/);
+    expect(res.body.error.message).toMatch(/inactive stream/);
   });
 
   it('returns 409 when stream is paused', async () => {
@@ -194,7 +194,7 @@ describe('POST /v1/streams/:streamId/top-up', () => {
       .send({ amount: '1000' });
 
     expect(res.status).toBe(409);
-    expect(res.body.message).toMatch(/paused stream/);
+    expect(res.body.error.message).toMatch(/paused stream/);
   });
 
   it('leaves DB unchanged when topUpStream fails on-chain', async () => {

backend/tests/stream.test.ts

@@ -159,7 +159,10 @@ describe('POST /v1/streams', () => {
       .set('Accept', 'application/json');
 
     expect(response.status).toBe(403);
-    expect(response.body).toHaveProperty('error', 'Forbidden');
+    expect(response.body.error).toMatchObject({
+      code: 'FORBIDDEN',
+      message: 'sender must match the authenticated wallet',
+    });
     expect(prisma.stream.upsert).not.toHaveBeenCalled();
   });
 

frontend/src/lib/api-types.generated.ts

@@ -2801,20 +2801,14 @@ export interface components {
             };
         };
         Error: {
-            /**
-             * @description Error message
-             * @example Resource not found
-             */
-            error?: string;
-            /**
-             * @description Error code
-             * @example NOT_FOUND
-             */
-            code?: string;
-            /** @description Human-readable detail (present on many error responses) */
-            message?: string | null;
-            /** @description Structured validation issues (zod) when the error is a 400 */
-            details?: Record<string, never>[] | null;
+            error: {
+                /** @example NOT_FOUND */
+                code: string;
+                /** @example Resource not found */
+                message: string;
+                /** @description Structured validation issues when applicable */
+                details?: Record<string, never>[];
+            };
         };
     };
     responses: never;