fix(trust-graph): map edge identity lookup errors

docs/api/trust-graph.yaml

@@ -76,6 +76,10 @@ paths:
                     format: uuid
         "400":
           $ref: "#/components/responses/BadRequest"
+        "404":
+          $ref: "#/components/responses/NotFound"
+        "503":
+          $ref: "#/components/responses/ServiceUnavailable"
         "429":
           $ref: "#/components/responses/RateLimited"
 

services/trust-graph/src/routes/trust.ts

@@ -17,8 +17,8 @@ export function createTrustRoutes(db: DbClient, discoveryUrl?: string) {
       c.header('Cache-Control', 'no-store')
       return c.json({ id }, 201)
     } catch (error) {
-      const message = error instanceof Error ? error.message : 'Unknown error'
-      return c.json({ error: message }, 400)
+      const mapped = mapTrustWriteError(error)
+      return c.json({ error: mapped.message }, mapped.status)
     }
   })
 

services/trust-graph/test/routes.test.ts

@@ -303,6 +303,60 @@ describe('HTTP Routes', () => {
       expect(json.error).toContain('Trust level')
     })
 
+    it('POST /v1/trust should return 404 when an edge identity is absent from discovery', async () => {
+      vi.stubGlobal('fetch', vi.fn(() => Promise.resolve(new Response('not found', { status: 404 }))))
+      mockDb.select = vi.fn(() => ({
+        from: vi.fn(() => ({
+          where: vi.fn(() => ({
+            limit: vi.fn(() => Promise.resolve([])),
+          })),
+        })),
+      }))
+
+      const app = createTrustRoutes(mockDb, 'http://discovery.test')
+      const res = await app.request('/v1/trust', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          issuerDid: 'did:fides:alice',
+          subjectDid: 'did:fides:bob',
+          trustLevel: 80,
+          signature: 'deadbeef',
+          payload: '{}',
+        }),
+      })
+
+      expect(res.status).toBe(404)
+      expect((await res.json()).error).toContain('Identity not found')
+    })
+
+    it('POST /v1/trust should return 503 when discovery is unavailable for edge identities', async () => {
+      vi.stubGlobal('fetch', vi.fn(() => Promise.resolve(new Response('unavailable', { status: 503 }))))
+      mockDb.select = vi.fn(() => ({
+        from: vi.fn(() => ({
+          where: vi.fn(() => ({
+            limit: vi.fn(() => Promise.resolve([])),
+          })),
+        })),
+      }))
+
+      const app = createTrustRoutes(mockDb, 'http://discovery.test')
+      const res = await app.request('/v1/trust', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          issuerDid: 'did:fides:alice',
+          subjectDid: 'did:fides:bob',
+          trustLevel: 80,
+          signature: 'deadbeef',
+          payload: '{}',
+        }),
+      })
+
+      expect(res.status).toBe(503)
+      expect((await res.json()).error).toContain('Discovery service unavailable')
+    })
+
     it('GET /v1/trust/:did/score should return reputation score', async () => {
       let selectCallCount = 0
       mockDb.select = vi.fn(() => ({