- Ya
- 15 Agosti 2026, 19:58 UTC
- Mwandishi
- kamo
- Ahadi ya
- b301337
SecurityService now sends ids past Number.MAX_SAFE_INTEGER as strings so they survive JSON.parse. That was being undone one line into the client: OrganizationDTOSchema typed id as z.union([z.coerce.number(), z.coerce.bigint(), z.string()]), and a zod union takes the first branch that matches -- so coerce.number won, turned the exact string back into a lossy double, and the org id was truncated again before anything downstream saw it. Same ordering bug on OrgFeatureBase.id. String first, uncoerced. A number in that position now only comes from a service still sending one, where the value is already rounded and nothing can recover it. Organization.id widens to number | string to match, as app/types/avatar.ts already does for the same reason. Callers should compare and key on String(org.id) -- LabelManager already does, preferring getOrgIdString() and refusing to fall back to an id that is not a safe integer.