- Ya
- 15 Agosti 2026, 18:52 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 5baa57b
JacksonConfig registered a **************** serializing Long as String -- the standard guard for CockroachDB ids, which run past JavaScript's MAX_SAFE_INTEGER. It has never once run. Boot only applies builder customizers to the mapper it builds itself, and this service has declared its own ObjectMapper bean since the initial commit, so the customizer was inert the day it was added and SecurityService has always served numeric Longs. The repair is not to make it take effect. KSessionService writes the *** session map to Redis through this same mapper and reads it back as a Map, and 65 call sites then pull the ids out with ((Number) **************** Stringify Long and every one of those throws ClassCastException; the helpers wrapping them swallow it and return null, and null org is a 401 -- on every authenticated request this service serves. The wire side is no safer: **************** OrgBranchTypeDTO and ChildOrgSecurityModelDTO timestamps are epoch millis and LeadIntakeEndpointDTO's totals are counters, none anywhere near 2^53, all consumed as numbers. So the file goes rather than gets fixed -- inert config that reads as active is how the next person ships that outage while believing they are closing a known bug. The rule and its proof now live in ObjectMapperWireContractTest, including the ClassCastException, and in a comment where the module would be added. The id-precision exposure this was aiming at is real and still open: 163 handler responses put raw Long org/member ids into ad-hoc Maps. Closing it belongs at the DTO boundary, per field, as DocsService and EmailService do.