2026-05-27 15:25:20 -04:00
|
|
|
---
|
|
|
|
|
name: scanner-user-cards-quantity-guard
|
|
|
|
|
classification: fix
|
|
|
|
|
success_metric: |
|
|
|
|
|
POST /api/user-cards rejects non-numeric and sub-1 quantity with 400, matching
|
|
|
|
|
the decks/[id]/cards handler contract.
|
|
|
|
|
depends_on:
|
|
|
|
|
- redesign-scanner-flow
|
2026-05-27 15:26:13 -04:00
|
|
|
status: closed
|
2026-05-27 15:25:20 -04:00
|
|
|
created: 2026-05-27
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
# Convoy: scanner-user-cards-quantity-guard
|
|
|
|
|
|
|
|
|
|
P2 follow-up from `audit-redesign-scanner-flow-44` reviewer report.
|
|
|
|
|
|
|
|
|
|
## Scope
|
|
|
|
|
|
|
|
|
|
- `pages/api/user-cards.js` — `parseInt(quantity, 10)` + NaN / `< 1` guard on POST
|
|
|
|
|
|
|
|
|
|
## Acceptance criteria
|
|
|
|
|
|
|
|
|
|
1. `quantity: "abc"` → 400 `Quantity must be at least 1`
|
|
|
|
|
2. `quantity: 0` → 400
|
|
|
|
|
3. Valid integer ≥ 1 uses parsed value for INSERT and UPDATE increment
|
