From a1a809cb17d28de538c2e78a7a44745f3a5e29f3 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sun, 13 Sep 2026 23:02:29 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[MEDIUM]=20?=
 =?UTF-8?q?Fix=20sensitive=20information=20disclosure=20in=20auth=20utils?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Pmaster-dev <293764797+Pmaster-dev@users.noreply.github.com>
---
 auth/utils.py      |  4 ++--
 tests/test_auth.py | 29 +++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+), 2 deletions(-)
 create mode 100644 tests/test_auth.py

diff --git a/auth/utils.py b/auth/utils.py
index 4bded89..a060433 100644
--- a/auth/utils.py
+++ b/auth/utils.py
@@ -128,8 +128,8 @@ def decorated_function(*args, **kwargs):
             g.user_id = user_id
             g.user = user_data
             return f(*args, **kwargs)
-        except Exception as e:
-            return jsonify({'error': 'Unauthorized', 'details': str(e)}), 401
+        except Exception:
+            return jsonify({'error': 'Unauthorized'}), 401
     return decorated_function
 
 
diff --git a/tests/test_auth.py b/tests/test_auth.py
new file mode 100644
index 0000000..b179111
--- /dev/null
+++ b/tests/test_auth.py
@@ -0,0 +1,29 @@
+import sys
+from unittest.mock import MagicMock
+
+# Mock cache_db module before importing auth.utils
+cache_db_mock = MagicMock()
+sys.modules['cache_db'] = cache_db_mock
+sys.modules['cache_db.redis_client'] = cache_db_mock
+sys.modules['cache_db.models'] = cache_db_mock
+
+from flask import Flask
+import pytest
+from auth.utils import login_required
+
+def test_login_required_unauthorized_hides_error_details():
+    app = Flask(__name__)
+    app.config['TESTING'] = True
+
+    @app.route('/test')
+    @login_required
+    def protected():
+        return 'success'
+
+    with app.test_client() as client:
+        # Request without JWT will raise an exception during verify_jwt_in_request
+        response = client.get('/test')
+        assert response.status_code == 401
+        data = response.get_json()
+        assert data == {'error': 'Unauthorized'}
+        assert 'details' not in data