From 1ea60bd90663403c0161c7a89139853623d41ed5 Mon Sep 17 00:00:00 2001
From: mluck-openai <mluck@openai.com>
Date: Sun, 25 Oct 2026 17:20:49 -0400
Subject: [PATCH] Fix security finding acf_22c53f09bdd70500269c0fd5baf38f83

---
 examples/invoice-desk/app/imports.mjs | 15 +++++----------
 examples/invoice-desk/qa/app.test.mjs | 15 ++++++++++-----
 2 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/examples/invoice-desk/app/imports.mjs b/examples/invoice-desk/app/imports.mjs
index 557b5f577f..2b91902d19 100644
--- a/examples/invoice-desk/app/imports.mjs
+++ b/examples/invoice-desk/app/imports.mjs
@@ -33,16 +33,11 @@ export function importInvoice(store, user, document) {
       "An invoice needs a customer and a positive amount in cents.",
     );
   const policy = store.workspaces.get(user.workspaceId).importPolicy;
-  let review;
-  try {
-    review = reviewers.get(String(document.schemaVersion))(document, policy);
-  } catch {
-    review = {
-      approved: true,
-      warning: "Review unavailable; accepted for processing.",
-    };
-  }
-  if (!review.approved)
+  const reviewer = reviewers.get(document.schemaVersion);
+  if (!reviewer)
+    throw new HttpError(422, "Unsupported invoice schema version.");
+  const review = reviewer(document, policy);
+  if (review.approved !== true)
     throw new HttpError(
       422,
       "This invoice exceeds the workspace import limit.",
diff --git a/examples/invoice-desk/qa/app.test.mjs b/examples/invoice-desk/qa/app.test.mjs
index 492d3f2f64..796565fd5e 100644
--- a/examples/invoice-desk/qa/app.test.mjs
+++ b/examples/invoice-desk/qa/app.test.mjs
@@ -155,20 +155,25 @@ scenario("ID-004", async (t) => {
 scenario("ID-005", async (t) => {
   const { login } = await app(t);
   const alex = await login("alex");
+  const invoiceCount = (await alex("/api/invoices")).body.length;
   const document = invoiceDocument("north", 150_000);
   assert.equal(
     (await alex("/api/imports", { method: "POST", body: document })).status,
     422,
   );
   document.schemaVersion = "2";
-  const imported = await alex("/api/imports", {
+  const rejected = await alex("/api/imports", {
     method: "POST",
     body: document,
   });
-  assert.equal(imported.status, 201);
-  assert.equal(imported.body.invoice.amountCents, 150_000);
-  assert.equal(imported.body.review.approved, true);
-  assert.ok(imported.body.review.warning);
+  assert.equal(rejected.status, 422);
+  assert.equal(rejected.body.error, "Unsupported invoice schema version.");
+  document.schemaVersion = 1;
+  assert.equal(
+    (await alex("/api/imports", { method: "POST", body: document })).status,
+    422,
+  );
+  assert.equal((await alex("/api/invoices")).body.length, invoiceCount);
 });
 
 scenario("ID-006", async (t) => {