Skip to content

fix(stores): text expiry_date vs date('now') on Postgres - #96

Merged
ralyodio merged 1 commit into
masterfrom
fix/pg-text-dates-wt-c0upons
Oct 21, 2026
Merged

ralyodio merged 1 commit into
masterfrom
fix/pg-text-dates-wt-c0upons

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

/stores/<slug> 404'd and /api/stores/<slug> returned 500 with PG operator does not exist: text >= date.

coupons.expiry_date is TEXT YYYY-MM-DD (or ''), so a timestamptz/date migration is not safe. Both queries now bind today's UTC date as a YYYY-MM-DD string, which compares correctly as text. Audited every other date query in apps/web: the rest bind ISO strings into timestamptz columns or use CURRENT_TIMESTAMP in assignments, which work.

🤖 Generated with Claude Code

…_date

Postgres has no text >= date operator, so /stores/<slug> 404'd and
/api/stores/<slug> returned 500. expiry_date is stored as TEXT
'YYYY-MM-DD' (and sometimes ''), so compare against a bound string in
the same format.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

38 finding(s)

MEDIUM: 32 | LOW: 6

Severity Rule Location
MEDIUM sql-template-interpolation apps/web/app/api/bounties/[id]/claim/route.ts:18
MEDIUM sql-template-interpolation apps/web/app/api/bounties/[id]/claim/route.ts:34
MEDIUM sql-template-interpolation apps/web/app/api/bounties/[id]/claim/route.ts:43
MEDIUM sql-template-interpolation apps/web/app/api/bounties/route.ts:95
MEDIUM sql-template-interpolation apps/web/app/api/coupons/route.ts:68
MEDIUM sql-template-interpolation apps/web/app/api/coupons/route.ts:75
MEDIUM sql-template-interpolation apps/web/app/api/coupons/vote/route.ts:31
MEDIUM sql-template-interpolation apps/web/app/api/coupons/vote/route.ts:33
MEDIUM sql-template-interpolation apps/web/app/api/stores/[slug]/route.ts:9
MEDIUM sql-template-interpolation apps/web/app/api/webhooks/crawlproof/route.ts:83
MEDIUM sql-template-interpolation apps/web/app/api/webhooks/crawlproof/route.ts:90
MEDIUM js-open-redirect apps/web/app/bounties/new/page.tsx:61
MEDIUM js-unescaped-html-sink apps/web/app/coupons/[id]/page.tsx:57
MEDIUM js-unescaped-html-sink apps/web/app/layout.tsx:89
MEDIUM sql-template-interpolation apps/web/app/stores/[slug]/page.tsx:16
MEDIUM js-unescaped-html-sink apps/web/components/PitFooter.tsx:24
MEDIUM sql-template-interpolation apps/web/lib/bbs-post.ts:164
MEDIUM sql-template-interpolation apps/web/lib/flipp-sync.ts:445
MEDIUM sql-template-interpolation apps/web/lib/inbound-email.ts:573
MEDIUM sql-template-interpolation apps/web/lib/inbound-email.ts:643
MEDIUM sql-template-interpolation apps/web/lib/mcp-tools.ts:81
MEDIUM sql-template-interpolation apps/web/lib/members.ts:54
MEDIUM sql-template-interpolation apps/web/lib/nichedb-sync.ts:186
MEDIUM sql-template-interpolation apps/web/lib/nichedb-sync.ts:206
MEDIUM sql-template-interpolation apps/web/lib/reddit-sync.ts:336
MEDIUM sql-template-interpolation apps/web/lib/reddit-sync.ts:355
MEDIUM sql-template-interpolation apps/web/lib/reddit-sync.ts:361
MEDIUM sql-template-interpolation apps/web/lib/reveal-coupon.ts:115
MEDIUM sql-template-interpolation apps/web/lib/reveal-coupon.ts:170
MEDIUM sh-predictable-temp-path apps/web/public/install.sh:37
MEDIUM sh-predictable-temp-path apps/web/public/install.sh:39
MEDIUM sql-template-interpolation apps/web/scripts/migrate.mjs:192
LOW sql-template-interpolation test/bbs-post.test.mjs:129
LOW sql-template-interpolation test/bbs-post.test.mjs:143
LOW sql-template-interpolation test/bbs-post.test.mjs:164
LOW sql-template-interpolation test/inbound-email.test.mjs:139
LOW sql-template-interpolation test/reveal-sweep.test.mjs:69
LOW sql-template-interpolation test/reveal-sweep.test.mjs:112

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 36c67af into master Oct 21, 2026
5 checks passed
@ralyodio
ralyodio deleted the fix/pg-text-dates-wt-c0upons branch October 21, 2026 13:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant