fix(tables): read exponent-form amounts and reject bad currency PATCHes up front

Two P1s from review.

Scientific notation lost magnitude. `String()` emits exponent form past 1e21,
so a stored amount round-trips through the editor as `1e+21` — and the
sanitizer treated the `e` as decoration to strip, reading it back as 121. An
untouched cell silently lost 19 orders of magnitude on its next edit. Exponent
form is now taken at face value, but only when the string is wholly a numeric
literal once symbols are removed, so `12 EUR` (whose `E` survives the strip)
still parses through the separator path.

A failed currency PATCH left a partial rename. `renameColumn` commits in its
own transaction before the currency write, so a `currencyCode` the service
would reject — an unsupported code, or any code on a non-currency column —
errored only after the rename had stuck. Both are now caught before the first
write, matching the guard the route already applies to unique-on-select for
exactly this reason.

Author: waleedlatif1

apps/sim/app/api/table/[tableId]/columns/route.ts

@@ -20,6 +20,7 @@ import {
   updateColumnType,
 } from '@/lib/table'
 import { columnMatchesRef } from '@/lib/table/column-keys'
+import { isSupportedCurrencyCode } from '@/lib/table/currency'
 import {
   accessError,
   checkAccess,
@@ -143,6 +144,28 @@ export const PATCH = withRouteHandler(async (request: NextRequest, context: Colu
     // changing: an options-only update on an existing select column carries the
     // same hazard as a conversion does.
     const resultingType = updates.type ?? currentColumn?.type
+    // Same reason as the constraint guard below: `renameColumn` runs first and
+    // commits on its own, so anything `updateColumnCurrency` would reject has
+    // to be caught before that write rather than inside the last one —
+    // otherwise the rename sticks and the request still errors.
+    if (updates.currencyCode !== undefined) {
+      if (resultingType !== 'currency') {
+        return NextResponse.json(
+          {
+            error: `Cannot set currency on column "${validated.columnName}" of type "${resultingType}"`,
+          },
+          { status: 400 }
+        )
+      }
+      if (!isSupportedCurrencyCode(updates.currencyCode)) {
+        return NextResponse.json(
+          {
+            error: `Invalid currency code "${updates.currencyCode}". Use an ISO 4217 code, e.g. USD`,
+          },
+          { status: 400 }
+        )
+      }
+    }
     if (updates.unique === true && resultingType === 'select') {
       return NextResponse.json({ error: 'Cannot set a select column as unique' }, { status: 400 })
     }

apps/sim/app/api/v1/tables/[tableId]/columns/route.ts

@@ -19,6 +19,7 @@ import {
   updateColumnType,
 } from '@/lib/table'
 import { columnMatchesRef } from '@/lib/table/column-keys'
+import { isSupportedCurrencyCode } from '@/lib/table/currency'
 import {
   accessError,
   checkAccess,
@@ -177,6 +178,28 @@ export const PATCH = withRouteHandler(async (request: NextRequest, context: Colu
     // changing: an options-only update on an existing select column carries the
     // same hazard as a conversion does.
     const resultingType = updates.type ?? currentColumn?.type
+    // Same reason as the constraint guard below: `renameColumn` runs first and
+    // commits on its own, so anything `updateColumnCurrency` would reject has
+    // to be caught before that write rather than inside the last one —
+    // otherwise the rename sticks and the request still errors.
+    if (updates.currencyCode !== undefined) {
+      if (resultingType !== 'currency') {
+        return NextResponse.json(
+          {
+            error: `Cannot set currency on column "${validated.columnName}" of type "${resultingType}"`,
+          },
+          { status: 400 }
+        )
+      }
+      if (!isSupportedCurrencyCode(updates.currencyCode)) {
+        return NextResponse.json(
+          {
+            error: `Invalid currency code "${updates.currencyCode}". Use an ISO 4217 code, e.g. USD`,
+          },
+          { status: 400 }
+        )
+      }
+    }
     if (updates.unique === true && resultingType === 'select') {
       return NextResponse.json({ error: 'Cannot set a select column as unique' }, { status: 400 })
     }

apps/sim/lib/table/__tests__/currency.test.ts

@@ -64,6 +64,31 @@ describe('parseCurrencyInput', () => {
     expect(parseCurrencyInput('1234.5')).toBe(1234.5)
   })
 
+  it('reads exponent form at face value', () => {
+    // `String()` emits exponent form past 1e21, so a stored amount round-trips
+    // through the editor as `1e+21`. Treating the `e` as decoration to strip
+    // read that back as 121 — a silent 19-orders-of-magnitude loss on the next
+    // edit of an untouched cell.
+    expect(parseCurrencyInput('1e5')).toBe(100000)
+    expect(parseCurrencyInput('1e+21')).toBe(1e21)
+    expect(parseCurrencyInput('1.5e-3')).toBe(0.0015)
+    expect(parseCurrencyInput('-1e5')).toBe(-100000)
+    expect(parseCurrencyInput('(1e5)')).toBe(-100000)
+    expect(parseCurrencyInput('$1e5')).toBe(100000)
+  })
+
+  it('does not mistake an ISO code or prose for an exponent', () => {
+    // `EUR` survives the symbol strip with its `E` intact; it must still parse
+    // through the ordinary separator path.
+    expect(parseCurrencyInput('12 EUR')).toBe(12)
+    expect(parseCurrencyInput('EUR 12,50')).toBe(12.5)
+    expect(parseCurrencyInput('Revenue 5')).toBe(5)
+  })
+
+  it('round-trips a magnitude that stringifies to exponent form', () => {
+    expect(parseCurrencyInput(formatCurrencyForInput(1e21))).toBe(1e21)
+  })
+
   it('rejects values carrying no amount', () => {
     expect(parseCurrencyInput('')).toBeNull()
     expect(parseCurrencyInput('   ')).toBeNull()

apps/sim/lib/table/currency.ts

@@ -120,6 +120,20 @@ export function parseCurrencyInput(raw: unknown): number | null {
   const parenthesized = /^\((.*)\)$/.exec(trimmed)
   const body = parenthesized ? parenthesized[1] : trimmed
 
+  // Exponent form first, and taken at face value. `String()` emits it for any
+  // magnitude past 1e21, so a stored amount round-trips through the editor as
+  // `1e+21` — and stripping the `e` as decoration would read that back as 121,
+  // silently losing 19 orders of magnitude. Only a string that is *wholly* a
+  // numeric literal once symbols are removed qualifies, so `12 EUR` (whose `E`
+  // survives the strip) still falls through to the separator logic below.
+  const exponentCandidate = body.replace(/[^\d.,\-+eE]/g, '')
+  if (/[eE]/.test(exponentCandidate)) {
+    const parsed = Number(exponentCandidate)
+    if (Number.isFinite(parsed)) {
+      return parenthesized ? -Math.abs(parsed) : parsed
+    }
+  }
+
   // Drop symbols, letters, and every flavor of space, leaving only digits, the
   // two separator characters, and a leading sign.
   const stripped = body.replace(/[^\d.,\-+]/g, '')