Improve decryption error handling

backend/services/main/routes/envelope_messaging.py

@@ -14,7 +14,9 @@ import time
 from datetime import datetime
 from pathlib import Path
 from typing import Optional
+
 import httpx
+from nacl.exceptions import CryptoError
 from fastapi import APIRouter, Depends, HTTPException, status, Request
 from sqlalchemy.orm import Session
 from pydantic import BaseModel, Field
@@ -376,6 +378,20 @@ async def send_encrypted_message(
 
     except HTTPException:
         raise
+    except CryptoError as e:
+        logger.warning(
+            "DM send: transport NaCl decrypt failed (message/file key mismatch or corrupt ciphertext): %s",
+            e,
+        )
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=(
+                "Transport decryption failed: the encrypted message and each attachment must be "
+                "encrypted with the same client ephemeral keypair. For resumable uploads, the "
+                "ciphertext bytes on the server must match the transport fields in this request—"
+                "re-encrypt on the client or abort the upload session and start over."
+            ),
+        ) from e
     except Exception as e:
         logger.exception("Error sending encrypted message: %s", e)
         raise HTTPException(

backend/services/main/service_calls.py

@@ -10,6 +10,9 @@ import os
 import logging
 import json
 
+import httpx
+from fastapi import HTTPException, status
+
 # Import request models for in-process calls
 
 logger = logging.getLogger("uvicorn.error")
@@ -418,11 +421,23 @@ async def process_message_with_files_in_messaging_service(
         "files": transport_files,
     }
     try:
-        import httpx
         async with httpx.AsyncClient(timeout=timeout) as client:
             r = await client.post(url, json=payload)
             r.raise_for_status()
             return r.json()
+    except httpx.HTTPStatusError as e:
+        if e.response.status_code == status.HTTP_400_BAD_REQUEST:
+            try:
+                body = e.response.json()
+                detail = body.get("detail", str(body)) if isinstance(body, dict) else str(body)
+            except Exception:
+                detail = (e.response.text or "").strip() or str(e)
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail=detail,
+            ) from e
+        logger.error("Failed to process message+files in messaging service: %s", e)
+        raise
     except Exception as e:
         logger.error("Failed to process message+files in messaging service: %s", e)
         raise