fix: avoid leaking raw postgres error details in duplicate key response

nip47/controllers/map_nip47_error.go

@@ -6,10 +6,12 @@ import (
 	"github.com/getAlby/hub/constants"
 	"github.com/getAlby/hub/nip47/models"
 	"github.com/getAlby/hub/transactions"
+	"gorm.io/gorm"
 )
 
 func mapNip47Error(err error) *models.Error {
 	code := constants.ERROR_INTERNAL
+	message := err.Error()
 	if errors.Is(err, transactions.NewNotFoundError()) {
 		code = constants.ERROR_NOT_FOUND
 	}
@@ -19,9 +21,13 @@ func mapNip47Error(err error) *models.Error {
 	if errors.Is(err, transactions.NewQuotaExceededError()) {
 		code = constants.ERROR_QUOTA_EXCEEDED
 	}
+	if errors.Is(err, gorm.ErrDuplicatedKey) {
+		// avoid leaking raw driver/SQL error details (e.g. constraint names) to NWC apps
+		message = gorm.ErrDuplicatedKey.Error()
+	}
 
 	return &models.Error{
 		Code:    code,
-		Message: err.Error(),
+		Message: message,
 	}
 }