fix: journaliser le code SQL sans paramètre

server/webImportSourcesError.test.ts

@@ -1,5 +1,9 @@
 import { describe, expect, it } from "vitest";
-import { WEB_IMPORT_SOURCE_SAVE_ERROR, getSafeWebImportSourceError } from "./webImportSourcesError";
+import {
+  WEB_IMPORT_SOURCE_SAVE_ERROR,
+  getSafeWebImportSourceError,
+  getWebImportSourceTechnicalCode,
+} from "./webImportSourcesError";
 
 describe("getSafeWebImportSourceError", () => {
   it("never returns the SQL statement or connector parameters to the client", () => {
@@ -14,4 +18,12 @@ describe("getSafeWebImportSourceError", () => {
     expect(safeError.message).not.toContain("insert into");
     expect(safeError.message).not.toContain("secret-value");
   });
+
+  it("retient uniquement le code du pilote, même lorsque celui-ci est imbriqué", () => {
+    const databaseError = Object.assign(new Error("params: user@example.fr, secret-value"), {
+      cause: { code: "ER_NO_SUCH_TABLE", message: "contains secret-value" },
+    });
+
+    expect(getWebImportSourceTechnicalCode(databaseError)).toBe("ER_NO_SUCH_TABLE");
+  });
 });

server/webImportSourcesError.ts

@@ -14,12 +14,24 @@ export function getSafeWebImportSourceError(_error: unknown): TRPCError {
   });
 }
 
+/** Extrait uniquement le code du pilote, sans conserver son message ni ses paramètres. */
+export function getWebImportSourceTechnicalCode(error: unknown): string {
+  if (!error || typeof error !== "object") return "unknown";
+
+  const directCode = "code" in error && typeof error.code === "string" ? error.code : null;
+  if (directCode) return directCode;
+
+  const cause = "cause" in error ? error.cause : null;
+  if (cause && typeof cause === "object" && "code" in cause && typeof cause.code === "string") {
+    return cause.code;
+  }
+
+  return "unknown";
+}
+
 /** Journalise uniquement les métadonnées techniques non sensibles. */
 export function logWebImportSourceSaveFailure(error: unknown): void {
-  const technicalCode =
-    error && typeof error === "object" && "code" in error && typeof error.code === "string"
-      ? error.code
-      : "unknown";
+  const technicalCode = getWebImportSourceTechnicalCode(error);
 
   console.error("[WebImportSources] Échec d’enregistrement", { technicalCode });
 }