fix(auctions): reject partial dollar amounts

app/api/auctions/route.ts

@@ -10,6 +10,7 @@ import {
   highBid,
   acceptBid,
 } from "@/lib/db";
+import { dollarsToCents as parseDollarCents } from "@/lib/money";
 import { fireDomainEvent } from "@/lib/webhooks";
 
 export const runtime = "nodejs";
@@ -27,10 +28,7 @@ async function resolveAccountId(req: NextRequest): Promise<string | null> {
 
 /** Dollars → integer cents; "" / null / 0 → null (clears the field). */
 function dollarsToCents(v: unknown): number | null {
-  if (v === "" || v == null) return null;
-  const n = typeof v === "number" ? v : parseFloat(String(v).replace(/[$,\s]/g, ""));
-  if (!isFinite(n) || n <= 0) return null;
-  return Math.round(n * 100);
+  return parseDollarCents(v);
 }
 
 // GET /api/auctions?dn= — public status; owner also gets reserve + the bid list.

app/api/bids/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { readSession, SESSION_COOKIE } from "@/lib/session";
 import { safeDomain } from "@/lib/config";
 import { addBid, getAuction, highBid } from "@/lib/db";
+import { dollarsToCents as parseDollarCents } from "@/lib/money";
 import { fireDomainEvent } from "@/lib/webhooks";
 
 export const runtime = "nodejs";
@@ -11,9 +12,7 @@ const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 
 /** Dollars string/number → integer cents, or null if not a positive amount. */
 function dollarsToCents(v: unknown): number | null {
-  const n = typeof v === "number" ? v : parseFloat(String(v ?? "").replace(/[$,\s]/g, ""));
-  if (!isFinite(n) || n <= 0) return null;
-  return Math.round(n * 100);
+  return parseDollarCents(v);
 }
 
 // GET /api/bids?dn= — public auction status (never leaks the reserve amount).

lib/money.ts

@@ -0,0 +1,16 @@
+const MONEY_RE = /^\$?(?:\d+|\d{1,3}(?:,\d{3})+)(?:\.\d{1,2})?$/;
+
+export function dollarsToCents(value: unknown): number | null {
+  if (value === "" || value == null) return null;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value) || value <= 0) return null;
+    return Math.round(value * 100);
+  }
+
+  const text = String(value).trim().replace(/\s+/g, "");
+  if (!MONEY_RE.test(text)) return null;
+
+  const amount = Number(text.replace(/[$,]/g, ""));
+  if (!Number.isFinite(amount) || amount <= 0) return null;
+  return Math.round(amount * 100);
+}

tests/money.test.mjs

@@ -0,0 +1,25 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { dollarsToCents } from "../lib/money.ts";
+
+test("dollarsToCents accepts ordinary dollar strings", () => {
+  assert.equal(dollarsToCents("1"), 100);
+  assert.equal(dollarsToCents("$1.25"), 125);
+  assert.equal(dollarsToCents("$1,234.56"), 123456);
+  assert.equal(dollarsToCents("  $ 10.50  "), 1050);
+});
+
+test("dollarsToCents rejects partial or non-decimal strings", () => {
+  assert.equal(dollarsToCents("1abc"), null);
+  assert.equal(dollarsToCents("1e2"), null);
+  assert.equal(dollarsToCents("0x10"), null);
+  assert.equal(dollarsToCents("$1.234"), null);
+  assert.equal(dollarsToCents("0"), null);
+});
+
+test("dollarsToCents handles numeric values without accepting non-finite numbers", () => {
+  assert.equal(dollarsToCents(2.5), 250);
+  assert.equal(dollarsToCents(Number.NaN), null);
+  assert.equal(dollarsToCents(Number.POSITIVE_INFINITY), null);
+});