From 3bb5e03779a191e244157ee0bb17f8c87e47436e Mon Sep 17 00:00:00 2001
From: Efe Baran Durmaz <efebarandurmaz@users.noreply.github.com>
Date: Wed, 6 May 2026 21:21:48 +0300
Subject: [PATCH] fix(trust-graph): map edge identity lookup errors

---
 docs/api/trust-graph.yaml                |  4 ++
 services/trust-graph/src/routes/trust.ts |  4 +-
 services/trust-graph/test/routes.test.ts | 54 ++++++++++++++++++++++++
 3 files changed, 60 insertions(+), 2 deletions(-)

diff --git a/docs/api/trust-graph.yaml b/docs/api/trust-graph.yaml
index 7809020..50308bf 100644
--- a/docs/api/trust-graph.yaml
+++ b/docs/api/trust-graph.yaml
@@ -76,6 +76,10 @@ paths:
                     format: uuid
         "400":
           $ref: "#/components/responses/BadRequest"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "503":
+          $ref: "#/components/responses/ServiceUnavailable"
         "429":
           $ref: "#/components/responses/RateLimited"
 
diff --git a/services/trust-graph/src/routes/trust.ts b/services/trust-graph/src/routes/trust.ts
index a6e08bd..266a510 100644
--- a/services/trust-graph/src/routes/trust.ts
+++ b/services/trust-graph/src/routes/trust.ts
@@ -17,8 +17,8 @@ export function createTrustRoutes(db: DbClient, discoveryUrl?: string) {
       c.header('Cache-Control', 'no-store')
       return c.json({ id }, 201)
     } catch (error) {
-      const message = error instanceof Error ? error.message : 'Unknown error'
-      return c.json({ error: message }, 400)
+      const mapped = mapTrustWriteError(error)
+      return c.json({ error: mapped.message }, mapped.status)
     }
   })
 
diff --git a/services/trust-graph/test/routes.test.ts b/services/trust-graph/test/routes.test.ts
index 6600970..5220edc 100644
--- a/services/trust-graph/test/routes.test.ts
+++ b/services/trust-graph/test/routes.test.ts
@@ -303,6 +303,60 @@ describe('HTTP Routes', () => {
       expect(json.error).toContain('Trust level')
     })
 
+    it('POST /v1/trust should return 404 when an edge identity is absent from discovery', async () => {
+      vi.stubGlobal('fetch', vi.fn(() => Promise.resolve(new Response('not found', { status: 404 }))))
+      mockDb.select = vi.fn(() => ({
+        from: vi.fn(() => ({
+          where: vi.fn(() => ({
+            limit: vi.fn(() => Promise.resolve([])),
+          })),
+        })),
+      }))
+
+      const app = createTrustRoutes(mockDb, 'http://discovery.test')
+      const res = await app.request('/v1/trust', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          issuerDid: 'did:fides:alice',
+          subjectDid: 'did:fides:bob',
+          trustLevel: 80,
+          signature: 'deadbeef',
+          payload: '{}',
+        }),
+      })
+
+      expect(res.status).toBe(404)
+      expect((await res.json()).error).toContain('Identity not found')
+    })
+
+    it('POST /v1/trust should return 503 when discovery is unavailable for edge identities', async () => {
+      vi.stubGlobal('fetch', vi.fn(() => Promise.resolve(new Response('unavailable', { status: 503 }))))
+      mockDb.select = vi.fn(() => ({
+        from: vi.fn(() => ({
+          where: vi.fn(() => ({
+            limit: vi.fn(() => Promise.resolve([])),
+          })),
+        })),
+      }))
+
+      const app = createTrustRoutes(mockDb, 'http://discovery.test')
+      const res = await app.request('/v1/trust', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          issuerDid: 'did:fides:alice',
+          subjectDid: 'did:fides:bob',
+          trustLevel: 80,
+          signature: 'deadbeef',
+          payload: '{}',
+        }),
+      })
+
+      expect(res.status).toBe(503)
+      expect((await res.json()).error).toContain('Discovery service unavailable')
+    })
+
     it('GET /v1/trust/:did/score should return reputation score', async () => {
       let selectCallCount = 0
       mockDb.select = vi.fn(() => ({