From 0351d5e0b91105e0354faebbc641c1a74bbfb3b8 Mon Sep 17 00:00:00 2001
From: Nico <47644445+nicotsx@users.noreply.github.com>
Date: Mon, 4 May 2026 17:47:25 +0200
Subject: [PATCH] refactor(auth): translate better-auth errors allowedHosts
 (#854)

Closes #852
---
 app/server/app.ts          |  6 +++---
 app/server/utils/errors.ts | 24 +++++++++++++++++++++++-
 2 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/app/server/app.ts b/app/server/app.ts
index 76bffbba..6c55f566 100644
--- a/app/server/app.ts
+++ b/app/server/app.ts
@@ -86,14 +86,14 @@ export const createApp = () => {
 	app.get("/api/v1/docs", requireAuth, scalarDescriptor);
 
 	app.onError((err, c) => {
-		logger.error(`${c.req.url}: ${err.message}`);
+		const { status, message, details } = handleServiceError(err);
+
+		logger.error(`${c.req.url}: ${message}`);
 
 		if (err.cause instanceof Error) {
 			logger.error(err.cause.message);
 		}
 
-		const { status, message, details } = handleServiceError(err);
-
 		return c.json(details ? { message, details } : { message }, status as 500);
 	});
 
diff --git a/app/server/utils/errors.ts b/app/server/utils/errors.ts
index 1282dbf7..03d6742e 100644
--- a/app/server/utils/errors.ts
+++ b/app/server/utils/errors.ts
@@ -3,6 +3,28 @@ import { sanitizeSensitiveData } from "@zerobyte/core/node";
 import { ResticError } from "@zerobyte/core/restic";
 import { toErrorDetails as getErrorDetails, toMessage as getMessage } from "@zerobyte/core/utils";
 
+const formatAllowedHostsMessage = (message: string) => {
+	const referencesAllowedHosts = /\ballowed\s+hosts?\b|\ballowedHosts\b/i.test(message);
+	const referencesBaseUrlResolution = /\bbase\s*url\b|\bhost\b|\bfallback\s+URL\b/i.test(message);
+
+	if (!referencesAllowedHosts || !referencesBaseUrlResolution) {
+		return message;
+	}
+
+	const requestedHost = message.match(/\bHost\s+"([^"]+)"/i)?.[1];
+	const configuredHosts = message.match(/\bAllowed\s+hosts:\s*(.*?)(?:\.\s+Add\b|$)/i)?.[1]?.trim();
+	const hostDetails = [
+		requestedHost ? `Requested host: ${requestedHost}.` : undefined,
+		configuredHosts ? `Configured BASE_URL/TRUSTED_ORIGINS hosts: ${configuredHosts}.` : undefined,
+	].filter(Boolean);
+
+	return [
+		"Could not resolve the auth base URL from this request.",
+		...hostDetails,
+		"Set BASE_URL to the URL you use to access Zerobyte, or add this origin to TRUSTED_ORIGINS.",
+	].join(" ");
+};
+
 export const handleServiceError = (error: unknown) => {
 	if (error instanceof HttpError) {
 		return { message: sanitizeSensitiveData(error.message), status: error.statusCode };
@@ -16,7 +38,7 @@ export const handleServiceError = (error: unknown) => {
 		};
 	}
 
-	return { message: sanitizeSensitiveData(toMessage(error)), status: 500 as const };
+	return { message: formatAllowedHostsMessage(sanitizeSensitiveData(toMessage(error))), status: 500 as const };
 };
 
 export const toMessage = (err: unknown): string => {