apps/api/src/routes/setup.ts

@@ -179,10 +179,10 @@ setupRouter.post('/validate/oidc', async (c) => {
     }
     return c.json({ ok: true }, 200);
   } catch (err) {
-    return c.json({
+    // IN-01: Log raw error server-side only — do not echo internal network detail
-      ok: false,
+    // (e.g. "connect ECONNREFUSED 192.168.1.50:9091") to the pre-auth caller.
-      error: 'OIDC discovery failed: ' + (err instanceof Error ? err.message : String(err)),
+    console.error('[setup/validate/oidc]', err instanceof Error ? err.message : String(err));
-    }, 400);
+    return c.json({ ok: false, error: 'OIDC discovery failed. Check the issuer URL.' }, 400);
   }
 });