---
name: scanner-user-cards-quantity-guard
classification: fix
success_metric: |
  POST /api/user-cards rejects non-numeric and sub-1 quantity with 400, matching
  the decks/[id]/cards handler contract.
depends_on:
  - redesign-scanner-flow
status: open
created: 2026-05-27
---

# Convoy: scanner-user-cards-quantity-guard

P2 follow-up from `audit-redesign-scanner-flow-44` reviewer report.

## Scope

- `pages/api/user-cards.js` — `parseInt(quantity, 10)` + NaN / `< 1` guard on POST

## Acceptance criteria

1. `quantity: "abc"` → 400 `Quantity must be at least 1`
2. `quantity: 0` → 400
3. Valid integer ≥ 1 uses parsed value for INSERT and UPDATE increment