[crodas]

Description

This is a simpler solution for #2425 before #2473 is matured.

Every integer column is signed, and the bind path narrowed with an unchecked cast, so a value past the signed maximum wrapped to a negative value and was committed, while Amount::to_i64 erased an oversized amount into NULL. Narrowing is checked now and refuses the write instead.

Postgres declared most of those columns int4 and truncated silently, storing an expiry past 2038 as a date already gone, so we widened them to int8. The balance query casts its aggregate back because a wider sum returns numeric. Storing amounts at their full u64 width stays a separate change.

---

Notes to the reviewers

---

Suggested CHANGELOG Updates

CHANGED

ADDED

REMOVED

FIXED

---

Checklist

• I followed the code style guidelines
• I ran just quick-check before committing
• If the Wallet API was modified (added/removed/changed), I have reflected those changes in the FFI bindings (crates/cdk-ffi)

[crodas]

@cdk-bot review

[comwanga]

Could we retain the public Amount<()>::to_i64, Amount<()>::from_i64, and Amount<CurrencyUnit>::to_i64 methods here?

Moving the SQL persistence paths to checked i64::try_from(...) conversions addresses the unsafe narrowing from #2425, but removing these methods also turns the database-integrity fix into a public cashu::Amount API change.

This seems especially worth preserving because the split-out direction discussed on #2473 explicitly called for retaining the public Amount::to_i64() methods while fixing the checked database conversions separately. from_i64 is likewise unrelated to the persistence bug.

Unless removing these helpers is an intentional breaking API change, keeping them and their boundary tests would preserve downstream compatibility without affecting the database fix.

[crodas]

@cdk-bot review

[cdk-bot]

Verified findings approved for disclosure:

• Wallet mint_quote reads now hard-fail on legacy negative amounts instead of returning amount: None (low) - see inline comment

[crodas]

@cdk-bot review

[j-kon]

Findings

• No critical, warning, or nit-level issues found.
  • The migration safely widens integer columns to BIGINT for Postgres without altering immutable past migrations.
  • Replacing implicit truncations with checked try_from conversions ensures out-of-range database writes fail fast at the persistence layer rather than silently corrupting state.
  • Commit 08e5f8a4 properly restored the public Amount::to_i64 and Amount::from_i64 helpers along with thorough boundary unit tests, preserving API stability.

Summary

Reviewed database widening migrations, SQL parameter bindings, checked numeric conversions in cdk-sql-common and cdk-postgres, and the restored public Amount helpers. The changes prevent silent data truncation and keep public API backwards-compatible.

Verdict

APPROVE

[thesimplekid]

One of the things that give me most pause about the other PR is the database migration so the motivation of this PR was to avoid that and just error on anything we cannot store instead of silently wrapping and leave a migration to a follow up.

[crodas]

@cdk-bot review