Skip to content

purchaseorderline: polQty + polPrice accept Infinity/-Infinity — DOUBLE column stores them as inf #193

@CryptoJones

Description

@CryptoJones

Problem

Same class of bug as #179 (injbAmount) and #171 (cpayAmount), on the
PurchaseOrderLine schema. Both polQty and polPrice are typed as
bare z.coerce.number(). zod's .number() rejects NaN by default
but lets Infinity / -Infinity slip through. The coerce path turns
the string "Infinity" into the float, so even via JSON (which has
no Infinity literal) a client can land non-finite values in either
column.

Both columns are Sequelize DOUBLE and will store inf happily.
An inf on a PO line silently corrupts every downstream
calculation: PO totals, inventory valuation, GL reconciliation.

Fix

Add .finite() via shared polQtyField + polPriceField validators.
Zero and negative values still pass — a $0 freebie line and a
negative inline-credit line are both real PO use cases.

Acceptance

  • Schema rejects polQty: 'Infinity' / polQty: '-Infinity'
  • Schema rejects polPrice: 'Infinity' / polPrice: '-Infinity'
  • Schema still accepts zero / negative
  • PATCH path covered too
  • Tests in tests/api/purchaseorderline.test.js cover all of the above

Proudly Made in Nebraska. Go Big Red! 🌽 https://xkcd.com/2347/

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions