docs: record remote preview acceptance and verify example error logging

examples/userService/internal/service/user/errors_test.go

@@ -0,0 +1,36 @@
+package user
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"strings"
+	"testing"
+
+	"example.com/userService/internal/servicecontext"
+	apierrors "git.yuntuo.hk/k2safe/go-omni/errors"
+	"git.yuntuo.hk/k2safe/go-omni/logx"
+)
+
+func TestDriverMessageDoesNotReachAccessOrBusinessLogs(t *testing.T) {
+	var output bytes.Buffer
+	cfg := logx.Default()
+	cfg.Writer = &output
+	logger, err := logx.New(cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer logger.Close()
+	service := New(&servicecontext.Context{Logger: logger})
+	secret := "private-user-input-in-driver-error"
+	got := service.failure(context.Background(), errors.New(secret))
+	if apierrors.From(got).Status != 500 {
+		t.Fatal("wrong error mapping")
+	}
+	if strings.Contains(got.Error(), secret) || strings.Contains(output.String(), secret) {
+		t.Fatal("driver detail leaked into logging path")
+	}
+	if !strings.Contains(output.String(), "user.operationFailed") {
+		t.Fatal("failure event missing")
+	}
+}

examples/userService/internal/service/user/service.go

@@ -44,7 +44,9 @@ func (s *Service) failure(ctx context.Context, err error) error {
 	default:
 		// Do not log SQL/DSN or user input; requestId correlates the failed operation.
 		s.deps.Logger.ErrorContext(ctx, "user.operationFailed", "category", "persistence")
-		return apierrors.Internal(err)
+		// HTTP access logging also sees the returned error. Keep raw driver
+		// errors out of that path because their messages may contain input.
+		return apierrors.New(500, "INTERNAL_ERROR", "internal server error")
 	}
 }
 func (s *Service) mutate(ctx context.Context, operation string, fn func(repo.UserRepository) (model.User, error)) (*types.UserResp, error) {