Skip to content

fix(domain): read a deck group position too large to hold as none - #658

Merged
ixuz merged 1 commit into
mainfrom
fix/group-position-bound
Nov 8, 2026
Merged

ixuz merged 1 commit into
mainfrom
fix/group-position-bound

Conversation

@ixuz

@ixuz ixuz commented Nov 8, 2026

Copy link
Copy Markdown
Member

What and why

A deck group's sm:position is an xsd:integer of 0 or more, and the reader dropped only a negative one. A valid integer too large for a JavaScript number read as Infinity, or as a rounded number, and stayed on the group. Renaming the group, or moving a deck into it, wrote that value back, and the write check refused the result, so the edit failed until the group itself was moved.

  • A position counts only when it is a whole number of 0 or more that a number holds exactly (usablePosition). Any other reads as none, for a group and a deck alike.
  • The node then sorts last, and a group written again is written without it, or renumbered when its level is reordered.
  • Tests cover the record, the mapper, and a rename and a fill through the repository with the real write check.
  • docs/data-model.md states the rule.

Refs: GHSA-438g-wf4q-xj9g

A deck group's sm:position is an xsd:integer of 0 or more, and the
reader dropped only a negative one. A valid integer too large for a
JavaScript number read as Infinity, or as a rounded number, and stayed
on the group. Renaming the group, or moving a deck into it, wrote that
value back, and the write check refused the result, so the edit failed
until the group itself was moved.

A position now counts only when it is a whole number of 0 or more that
a number holds exactly. Any other is read as none, for a group and a
deck alike, so the node sorts last and a group written again is
written without it, or renumbered when its level is reordered.

Refs: GHSA-438g-wf4q-xj9g
@ixuz ixuz added the bug Something isn't working label Nov 8, 2026
@ixuz
ixuz enabled auto-merge November 8, 2026 12:43
@ixuz
ixuz added this pull request to the merge queue Nov 8, 2026
Merged via the queue into main with commit bc09786 Nov 8, 2026
51 checks passed
@ixuz
ixuz deleted the fix/group-position-bound branch November 8, 2026 13:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant