- normalize.ts num(): parseFloat truncated at the first comma, so "1,200"
silently became 1 (1000x error) and "5,5" became 5. Now strictly matches
either US thousands-grouping or a plain number spanning the whole string;
anything else (incl. ambiguous "5,5") returns null instead of a wrong value.
- labs.ts confirm handler: the pending-status check ran before the request
body was read, so two concurrent confirms could both pass it and
double-insert. Added a guarded UPDATE ... WHERE status = 'pending' as the
first statement inside the existing synchronous transaction; zero rows
affected throws and the route returns 409, with the fast-path check kept
for the common case.
- Added missing `await` on two rejects.toThrow assertions (llm.test.ts,
extract.test.ts) that were previously resolving before the assertion
settled.
- Bumped the 11th-failed-login rate-limit test to a 30s timeout — 10
sequential argon2id verifies can exceed bun:test's 5s default under load.
The login rate limiter keyed on the client-controlled x-forwarded-for
header, letting an attacker rotate XFF for unlimited password guesses
while also growing the failures Map unboundedly (memory DoS). Since
this is a single-password instance, replace with one global
{count, resetAt} tracker per app instance: check the 15-min window and
reject at >=10 failures before verifying the password, increment on
failure, reset on success.
