fix(go): redact internal handler errors (#15746)

### What problem does this PR solve?

Refs #15743

Some Go API handlers return raw `err.Error()` strings in
`CodeServerError` responses. Those errors can include internal backend
details such as database, storage, search engine, or host information.

This PR adds a small shared `jsonInternalError` helper for handler-level
internal failures. The helper logs the raw error server-side with
request method/path context, then returns the existing generic
`common.CodeServerError.Message()` to API clients.

This first slice migrates the existing `jsonError(c,
common.CodeServerError, err.Error())` production call sites in agent,
dataset graph, file, and system handlers. It intentionally does not
close the full issue because direct `c.JSON` error responses in other
handlers remain for follow-up PRs.

### Type of change

- [x] Bug Fix (non-breaking change which fixes an issue)
- [ ] New Feature (non-breaking change which adds functionality)
- [ ] Documentation Update
- [ ] Refactoring
- [ ] Performance Improvement
- [ ] Other (please describe):

### Tests

- `/root/go/bin/go test ./internal/handler -count=1`

---------

Co-authored-by: Yingfeng <yingfeng.zhang@gmail.com>

internal/handler/agent.go

@@ -435,11 +435,7 @@ func (h *AgentHandler) ListAgentVersions(c *gin.Context) {
 
 	versions, err := h.agentService.ListVersions(agentID)
 	if err != nil {
-		c.JSON(http.StatusOK, gin.H{
-			"code":    common.CodeServerError,
-			"data":    nil,
-			"message": err.Error(),
-		})
+		jsonInternalError(c, err)
 		return
 	}
 
@@ -466,7 +462,7 @@ func (h *AgentHandler) ListTemplates(c *gin.Context) {
 
 	templates, err := h.agentService.ListTemplates()
 	if err != nil {
-		jsonError(c, common.CodeServerError, err.Error())
+		jsonInternalError(c, err)
 		return
 	}
 	if templates == nil {

internal/handler/datasets.go

@@ -373,7 +373,7 @@ func (h *DatasetsHandler) GetKnowledgeGraph(c *gin.Context) {
 	indexName := fmt.Sprintf("ragflow_%s", tenantID)
 	exists, err := docEngine.ChunkStoreExists(c.Request.Context(), indexName, datasetID)
 	if err != nil {
-		jsonError(c, common.CodeServerError, err.Error())
+		jsonInternalError(c, err)
 		return
 	}
 
@@ -398,7 +398,7 @@ func (h *DatasetsHandler) GetKnowledgeGraph(c *gin.Context) {
 		},
 	})
 	if err != nil {
-		jsonError(c, common.CodeServerError, err.Error())
+		jsonInternalError(c, err)
 		return
 	}
 	if searchResult == nil || len(searchResult.Chunks) == 0 {
@@ -473,7 +473,7 @@ func (h *DatasetsHandler) DeleteKnowledgeGraph(c *gin.Context) {
 	if _, err := docEngine.DeleteChunks(c.Request.Context(), map[string]interface{}{
 		"knowledge_graph_kwd": []string{"graph", "subgraph", "entity", "relation", "community_report"},
 	}, indexName, datasetID); err != nil {
-		jsonError(c, common.CodeServerError, err.Error())
+		jsonInternalError(c, err)
 		return
 	}
 

internal/handler/error.go

@@ -18,12 +18,24 @@ package handler
 
 import (
 	"net/http"
+
 	"ragflow/internal/common"
 
 	"github.com/gin-gonic/gin"
 	"go.uber.org/zap"
 )
 
+// jsonInternalError logs the original error while returning a generic message
+// to avoid exposing internal implementation details in API responses.
+func jsonInternalError(c *gin.Context, err error) {
+	common.Warn("handler internal error",
+		zap.Error(err),
+		zap.String("method", c.Request.Method),
+		zap.String("path", c.Request.URL.Path),
+	)
+	jsonError(c, common.CodeServerError, common.CodeServerError.Message())
+}
+
 // HandleNoRoute handles requests to undefined routes
 func HandleNoRoute(c *gin.Context) {
 	// Python parity: GET /api/v1/auth/login/ (an empty OAuth channel) resolves

internal/handler/error_response_test.go

@@ -0,0 +1,59 @@
+//
+//  Copyright 2026 The InfiniFlow Authors. All Rights Reserved.
+//
+//  Licensed under the Apache License, Version 2.0 (the "License");
+//  you may not use this file except in compliance with the License.
+//  You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+//  Unless required by applicable law or agreed to in writing, software
+//  distributed under the License is distributed on an "AS IS" BASIS,
+//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//  See the License for the specific language governing permissions and
+//  limitations under the License.
+//
+
+package handler
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"ragflow/internal/common"
+
+	"github.com/gin-gonic/gin"
+)
+
+func TestJSONInternalErrorRedactsRawError(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+
+	recorder := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(recorder)
+	c.Request = httptest.NewRequest(http.MethodGet, "/api/v1/files?tenant_id=secret-tenant", nil)
+
+	jsonInternalError(c, errors.New("postgres password=secret host=10.0.0.1 table=tenant"))
+
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("status=%d, want %d", recorder.Code, http.StatusOK)
+	}
+
+	var body map[string]interface{}
+	if err := json.Unmarshal(recorder.Body.Bytes(), &body); err != nil {
+		t.Fatalf("decode response body: %v", err)
+	}
+
+	if got := body["message"]; got != common.CodeServerError.Message() {
+		t.Fatalf("message=%v, want %q", got, common.CodeServerError.Message())
+	}
+	if got := body["code"]; got != float64(common.CodeServerError) {
+		t.Fatalf("code=%v, want %d", got, common.CodeServerError)
+	}
+	if strings.Contains(recorder.Body.String(), "password=secret") || strings.Contains(recorder.Body.String(), "10.0.0.1") {
+		t.Fatalf("response leaked raw error details: %s", recorder.Body.String())
+	}
+}

internal/handler/file.go

@@ -108,7 +108,7 @@ func (h *FileHandler) ListFiles(c *gin.Context) {
 
 	result, err := h.fileService.ListFiles(userID, parentID, page, pageSize, orderby, desc, keywords)
 	if err != nil {
-		jsonError(c, common.CodeServerError, err.Error())
+		jsonInternalError(c, err)
 		return
 	}
 
@@ -138,7 +138,7 @@ func (h *FileHandler) GetRootFolder(c *gin.Context) {
 	// Get root folder
 	rootFolder, err := h.fileService.GetRootFolder(userID)
 	if err != nil {
-		jsonError(c, common.CodeServerError, err.Error())
+		jsonInternalError(c, err)
 		return
 	}
 
@@ -176,7 +176,7 @@ func (h *FileHandler) GetParentFolder(c *gin.Context) {
 	// Get parent folder with permission check
 	parentFolder, err := h.fileService.GetParentFolder(userID, fileID)
 	if err != nil {
-		jsonError(c, common.CodeServerError, err.Error())
+		jsonInternalError(c, err)
 		return
 	}
 
@@ -214,7 +214,7 @@ func (h *FileHandler) GetAllParentFolders(c *gin.Context) {
 	// Get all parent folders with permission check
 	parentFolders, err := h.fileService.GetAllParentFolders(userID, fileID)
 	if err != nil {
-		jsonError(c, common.CodeServerError, err.Error())
+		jsonInternalError(c, err)
 		return
 	}
 
@@ -251,7 +251,7 @@ func (h *FileHandler) GetFileAncestors(c *gin.Context) {
 	// Get all parent folders with permission check
 	parentFolders, err := h.fileService.GetAllParentFolders(userID, fileID)
 	if err != nil {
-		jsonError(c, common.CodeServerError, err.Error())
+		jsonInternalError(c, err)
 		return
 	}
 
@@ -305,7 +305,7 @@ func (h *FileHandler) UploadFile(c *gin.Context) {
 		if parentID == "" {
 			rootFolder, err := h.fileService.GetRootFolder(userID)
 			if err != nil {
-				jsonError(c, common.CodeServerError, err.Error())
+				jsonInternalError(c, err)
 				return
 			}
 			parentID = rootFolder["id"].(string)
@@ -352,7 +352,7 @@ func (h *FileHandler) UploadFile(c *gin.Context) {
 		if parentID == "" {
 			rootFolder, err := h.fileService.GetRootFolder(userID)
 			if err != nil {
-				jsonError(c, common.CodeServerError, err.Error())
+				jsonInternalError(c, err)
 				return
 			}
 			parentID = rootFolder["id"].(string)

internal/handler/kb.go

@@ -187,7 +187,7 @@ func (h *KnowledgebaseHandler) GetDetail(c *gin.Context) {
 		return
 	}
 
-		jsonResponse(c, common.CodeSuccess, result, "success")
+	jsonResponse(c, common.CodeSuccess, result, "success")
 }
 
 // ListTags handles the list tags request for a knowledge base
@@ -432,4 +432,4 @@ func (h *KnowledgebaseHandler) GetBasicInfo(c *gin.Context) {
 	}
 
 	jsonResponse(c, common.CodeSuccess, map[string]interface{}{}, "success")
-}
+}

internal/handler/system.go

@@ -125,7 +125,7 @@ func (h *SystemHandler) GetStatus(c *gin.Context) {
 
 	status, err := h.systemService.GetStatus()
 	if err != nil {
-		jsonError(c, common.CodeServerError, err.Error())
+		jsonInternalError(c, err)
 		return
 	}