Bug
The authenticated createReferralsRouteHandler accepts any truthy JavaScript number for action: "apply". Values such as -100, 1.5, and Infinity pass if (!code || !amount) and reach applyReferral.
Because amount represents integer cents, invalid values can produce and persist negative or fractional amount_cents, commission_cents, and discount_cents records. This can corrupt affiliate accounting instead of returning a client validation error.
Expected behavior
Only positive safe integers should be accepted for amount. Zero, negative, fractional, non-finite, unsafe, missing, and non-number values should return HTTP 400 before applyReferral writes a usage.
Proposed fix
Validate amount with Number.isSafeInteger(amount) && amount > 0, keep the existing response contract, and add route-level regression tests that verify no usage is saved.
Bug
The authenticated
createReferralsRouteHandleraccepts any truthy JavaScript number foraction: "apply". Values such as-100,1.5, andInfinitypassif (!code || !amount)and reachapplyReferral.Because
amountrepresents integer cents, invalid values can produce and persist negative or fractionalamount_cents,commission_cents, anddiscount_centsrecords. This can corrupt affiliate accounting instead of returning a client validation error.Expected behavior
Only positive safe integers should be accepted for
amount. Zero, negative, fractional, non-finite, unsafe, missing, and non-number values should return HTTP 400 beforeapplyReferralwrites a usage.Proposed fix
Validate
amountwithNumber.isSafeInteger(amount) && amount > 0, keep the existing response contract, and add route-level regression tests that verify no usage is saved.