fix(activation-service): stop leaking internal errors, drop unused KYC_PUBLIC_KEY

[sameh-farouk]

Two follow-ups from #1105. Supersedes #1107, which GitHub auto-closed when #1105 merged and its branch — #1107's base — was deleted. Same content, rebased onto development.

1. Internal error messages were returned to callers

The error middleware computed http-errors' expose flag and then ignored it. Both branches of the NODE_ENV check sent the message anyway, because lodash's omit(err, ['stack']) copies message through:

omit(httpError(500, 'Insufficient Balance Error: ...'), ['stack'])
// => {"message":"Insufficient Balance Error: ...","status":500,"statusCode":500,"expose":false}
//                                                                              ^^^^^^^^^^^^^^

And the development branch — the default, since NODE_ENV is set in neither the Dockerfile nor the chart — sent the whole error including the stack trace. Every deployment has been running in that mode.

Verified against the built image before the fix: a request that failed because the funding account was empty replied with Insufficient Balance Error: Failed to apply 'transfer' on section 'balances' with args '<address>,1000000.

Now the flag decides:

400 -> {"message":"substrateAccountID is not a valid account id"}
500 -> {"message":"Internal Server Error"}        # log: "error happened handling the request"

NODE_ENV no longer affects what is returned, so a deployment cannot leak by omitting it — which is what every deployment does today.

Behaviour change: bodies are consistently { message }. 4xx previously also carried status, statusCode and expose; non-http errors fell through to res.send(err.message) as text rather than JSON. The frontend catches errors and renders a fixed string without reading the body, so there is no UI impact.

2. KYC_PUBLIC_KEY was required but unread

In bin/www's required env variables since the service was written, but nothing reads it: the signature verification was commented out years ago and its only caller, POST /activation/create-entity, was removed in #1103 as an unauthenticated route that signed a fee-paying extrinsic from the service wallet. Requiring an unused variable only gives the service a reason to refuse to start.

Removed from the required list, the chart and the documented .env. Re-add it alongside the verification code if KYC checks return.

While in the readme, two claims that no longer held: it documented the removed /activation/create-entity endpoint, and said activation "puts 500 tokens" on an account — true in 2021, since reduced by three orders of magnitude.

Verification

• lint + unit: 27/27
• against live devnet: 400 exposes its message, 500 returns Internal Server Error while the underlying error still reaches the log, service boots with no KYC_PUBLIC_KEY set, SIGTERM exits 0

🤖 Generated with Claude Code

https://claude.ai/code/session_011YKJm3zuWdSepriT9KL9zy