From 385288dae3fec8754412ae6df5de912c6e41c4d0 Mon Sep 17 00:00:00 2001
From: Kurdistan Tech Ministry <info@pezkuwichain.io>
Date: Tue, 24 Feb 2026 23:01:50 +0300
Subject: [PATCH] fix: extract actual error from process-withdraw edge function
 response

Supabase JS client wraps non-2xx responses as generic FunctionsHttpError
("Edge Function returned a non-2xx status code"), hiding the real error.
Now reads the response body to show the actual error message.

Also adds migration to drop auth.users FK on p2p_withdrawal_limits
(already absent in production, added for migration completeness).
---
 shared/lib/p2p-fiat.ts                            | 15 +++++++++++++--
 ...60224080000_drop_withdrawal_limits_auth_fk.sql | 13 +++++++++++++
 2 files changed, 26 insertions(+), 2 deletions(-)
 create mode 100644 web/supabase/migrations/20260224080000_drop_withdrawal_limits_auth_fk.sql

diff --git a/shared/lib/p2p-fiat.ts b/shared/lib/p2p-fiat.ts
index b25f665f..f0de9164 100644
--- a/shared/lib/p2p-fiat.ts
+++ b/shared/lib/p2p-fiat.ts
@@ -1046,11 +1046,22 @@ export async function requestWithdraw(
 
     toast.info('Processing withdrawal...');
 
-    const { data, error } = await supabase.functions.invoke('process-withdraw', {
+    const { data, error, response } = await supabase.functions.invoke('process-withdraw', {
       body: { userId, token, amount, walletAddress }
     });
 
-    if (error) throw error;
+    // Supabase client wraps non-2xx as generic FunctionsHttpError (data=null).
+    // Extract the actual error from the unread response body.
+    if (error) {
+      let errorMessage = 'Withdrawal failed';
+      if (response) {
+        try {
+          const body = await response.json();
+          errorMessage = body?.error || errorMessage;
+        } catch { /* response body already consumed or not JSON */ }
+      }
+      throw new Error(errorMessage);
+    }
 
     if (!data?.success) {
       throw new Error(data?.error || 'Withdrawal failed');
diff --git a/web/supabase/migrations/20260224080000_drop_withdrawal_limits_auth_fk.sql b/web/supabase/migrations/20260224080000_drop_withdrawal_limits_auth_fk.sql
new file mode 100644
index 00000000..4297b913
--- /dev/null
+++ b/web/supabase/migrations/20260224080000_drop_withdrawal_limits_auth_fk.sql
@@ -0,0 +1,13 @@
+-- Migration: Drop auth.users FK constraint on p2p_withdrawal_limits
+-- This table was missed in 20260223120000 and 20260224050000 migrations.
+-- user_id is now a deterministic UUID v5 derived from citizen/visa number,
+-- not an auth.users entry. The FK causes check_withdrawal_limit() to fail
+-- with a constraint violation on INSERT.
+
+ALTER TABLE public.p2p_withdrawal_limits
+  DROP CONSTRAINT IF EXISTS p2p_withdrawal_limits_user_id_fkey;
+
+-- Also drop the ON DELETE CASCADE since auth.users is no longer the source
+-- The constraint name may vary; try the default naming convention too
+ALTER TABLE public.p2p_withdrawal_limits
+  DROP CONSTRAINT IF EXISTS p2p_withdrawal_limits_pkey_fkey;