feat(pit): the operator sets the price, not the form - #170
Merged
Conversation
$2 a name and $5 an ending are defaults, not ceilings. The server already knew that -- setTldPrice deliberately does not enforce MAX_CHILD_PRICE_USD, which is why .love sits at $10,000 today. The claim form did not: it shipped max="2" on the price input, so the UI refused what the API would have accepted and looked like policy while being a typo's worth of markup. The remaining bound was $1,000,000, low enough to be a policy decision nobody made. It is now MAX_LISTING_PRICE_USD, a named overflow guard at $1e9 whose only job is keeping Infinity, NaN and 1e300 out of a column that later gets charged. MAX_CHILD_PRICE_USD is untouched: it is part of the vendored namespace rules that must match the published package byte for byte in behaviour, and it is still the right default. It just is not a limit. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
vu1nz Security Review0 finding(s) in PR #? No security issues found. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
$2 a name and $5 an ending are defaults, not ceilings. The server already knew this —
setTldPricedeliberately does not enforceMAX_CHILD_PRICE_USD, which is why.lovesits at $10,000 in prod today.The claim form did not know it. It shipped
max="2"on the price input, so the UI refused what the API would happily accept. That read as policy while being a typo's worth of markup.What changed
value="$2"stays — it's still the right starting point.$1,000,000, low enough to be a policy decision nobody actually made. It's nowMAX_LISTING_PRICE_USDat$1e9, documented as what it is: an overflow guard keepingInfinity,NaNand1e300out of a column that later gets charged. Not a price ceiling.MAX_CHILD_PRICE_USDis untouched — it's part of the vendored namespace rules that must match the published@moshcoder/moshpit-namein behaviour (there's a drift test), and it's still the right default. It just isn't a limit.Testing
moshpit-sales.test.mjs: the old test asserted5_000_000was refused, which is now legal — it asserts5_000_000_000instead, so the guard is still pinned.apps/pwa: 324 pass, 0 fail. Repo root: 763 pass, 0 fail, 2 skipped.Not in this PR
Selling or auctioning the ending itself (
/buy,/sell,/bid) is a separate piece of work — this only covers what names under an ending cost.🤖 Generated with Claude Code