`lib/ids.js`

24 lines
// The ONE guard for every path where a client-supplied value reaches a bigint id
// column. A bad value that slips through throws "invalid input syntax for type
// bigint" (non-numeric) or "bigint out of range" (overflow) → a 500 on, among
// others, the affiliate REVENUE redirect. This closes all of it in one place.
//
// Rejects: non-digits (abc), zero/negatives, leading-zero, scientific/hex notation
// (1e3, 0x10 — Number() would accept these and silently query the wrong id), and
// anything above MAX_SAFE_INTEGER (which overflows the bigint column). A digit-only
// regex FIRST is what makes it robust — Number.isInteger(1e20) is true, so a numeric
// check alone lets overflow through.
function intOrNull(v) {
  if (!/^[1-9][0-9]*$/.test(String(v == null ? '' : v).trim())) return null;
  const n = Number(v);
  return Number.isSafeInteger(n) && n >= 1 ? n : null;
}

// Sanitize an array of client-supplied ids to valid positive ints (bad entries
// dropped, not throwing). Used for product_ids on the room-builder endpoints.
function intIds(arr) {
  return Array.isArray(arr) ? arr.map(intOrNull).filter((n) => n != null) : [];
}

module.exports = { intOrNull, intIds };