🐛 LoginUser handler returns empty error message for non-ServiceError failures

[sulthonzh]

Description

The LoginUser handler in api/handlers/auth.go has a logic bug where the error message (errMsg) is initialized as an empty string and only populated for specific ServiceError codes. If the login error is not a *services.ServiceError, the response body will contain an empty error message.

Context

• File: api/handlers/auth.go:230-248
• Component: Authentication / Login

Current Behavior

var errMsg string

if se, ok := err.(*services.ServiceError); ok {
    switch se.Code {
    case services.ErrCodeLicenseExpired:
        errMsg = se.ErrMsg
    default:
        errMsg = "Invalid credentials"
    }
}

_ = render.Render(w, r, util.NewErrorResponse(errMsg, http.StatusForbidden))

When err is not a *services.ServiceError, errMsg stays as "" (empty string). The API returns:

{"status": "error", "message": "", "code": 403}

This is problematic because:

1. Clients receive an unhelpful empty error message
2. It breaks API consistency — all other endpoints return descriptive error messages
3. It could confuse debugging efforts

Expected Behavior

All authentication failures should return a descriptive error message, even if the error type is unexpected.

Suggested Fix

Add a fallback for non-ServiceError cases:

  var errMsg string

  if se, ok := err.(*services.ServiceError); ok {
      switch se.Code {
      case services.ErrCodeLicenseExpired:
          errMsg = se.ErrMsg
      default:
          errMsg = "Invalid credentials"
      }
+ } else {
+     errMsg = "Authentication failed"
  }

Impact

• Severity: Low — No security impact, but degrades API usability and debugging experience
• Who is affected: API clients integrating with Convoy authentication

Positively — happy to submit a PR if this is welcome.

[linear]

PDE-767