Error 500 after incorrect passphrase passed for submission decryption

[matthew-white]

Filing an issue related to this forum post: https://forum.getodk.org/t/odk-cental-returns-500-if-encrypted-submission-export-is-called-multiple-times-with-incorrect-passphrase/33407. This issue has also shown up in Sentry: https://sentry.io/organizations/getodk/issues/2379582792. First reported at ropensci/ruODK#30 (comment)

When a project uses managed encryption, submission decryption requires a passphrase. If you pass an incorrect passphrase, Backend is designed to return a 400.12 Problem. However, in some cases (for example, if the user tries an incorrect passphrase 3–4 times), the actual result is an error 500 and a database error in the logs.

This issue was first reported for v1.1 when we were using Knex. However, it still seems to be an issue in v1.2 with Slonik. Slonik throws a ConnectionError:

See the forum post for more information.