fix(sql): reject float literals that overflow a declared REAL column

Narrowing an f64 to f32 rounds and is never an error, so writes had no
declared-width check for floats at all — including on the KV and
document-schemaless engines' untyped write paths and on ON CONFLICT DO
UPDATE assignments. A finite value beyond f32's range would silently
narrow to Infinity on read instead of being refused on write, unlike
the equivalent integer check. Add a FloatOutOfRange error and a
check_declared_float_ranges pass (mirroring the integer range check)
on both the row insert and ON CONFLICT DO UPDATE assignment paths, and
route the existing pgwire narrowing guard's docs to point at it as the
new write-time backstop it now layers under.

Author: farhan-syah

nodedb-sql/src/error.rs

@@ -35,6 +35,22 @@ pub enum SqlError {
         declared_type: &'static str,
     },
 
+    /// A write supplied a finite float that overflows to infinity when
+    /// narrowed to the column's declared `REAL` width.
+    ///
+    /// Narrowing an `f64` to `f32` normally rounds — `1.1` becoming
+    /// `1.10000002` is correct PostgreSQL `real` behaviour, never an error —
+    /// so this is not the float mirror of [`SqlError::IntegerOutOfRange`]'s
+    /// full-range check. The single case rejected is a finite value beyond
+    /// `f32`'s range, which would otherwise silently become `Infinity`.
+    /// PostgreSQL rejects the same write with the same message.
+    #[error("value {value} is out of range for column '{column}' of type {declared_type}")]
+    FloatOutOfRange {
+        column: String,
+        value: f64,
+        declared_type: &'static str,
+    },
+
     #[error("unsupported: {detail}")]
     Unsupported { detail: String },
 

nodedb-sql/src/planner/dml.rs

@@ -6,8 +6,9 @@ use nodedb_types::DatabaseId;
 use sqlparser::ast::{self};
 
 use super::dml_helpers::{
-    build_kv_insert_plan, build_vector_primary_insert_plan, coerce_and_check_rows,
-    convert_value_rows, resolve_insert_columns,
+    build_kv_insert_plan, build_vector_primary_insert_plan,
+    check_declared_float_ranges_in_assignments, check_declared_int_ranges_in_assignments,
+    coerce_and_check_rows, convert_value_rows, resolve_insert_columns,
 };
 use crate::engine_rules::{self, InsertParams};
 use crate::error::{Result, SqlError};
@@ -317,6 +318,8 @@ fn plan_upsert_with_on_conflict(
         &mut on_conflict_updates,
         info.primary_key.as_deref(),
     )?;
+    check_declared_int_ranges_in_assignments(&info.columns, &on_conflict_updates)?;
+    check_declared_float_ranges_in_assignments(&info.columns, &on_conflict_updates)?;
     let column_defaults: Vec<(String, String)> = info
         .columns
         .iter()

nodedb-sql/src/planner/dml_helpers/kv_insert.rs

@@ -5,7 +5,10 @@
 
 use sqlparser::ast;
 
-use super::range_check::check_declared_int_ranges;
+use super::range_check::{
+    check_declared_float_ranges, check_declared_float_ranges_in_assignments,
+    check_declared_int_ranges, check_declared_int_ranges_in_assignments,
+};
 use super::value_convert::expr_to_sql_value;
 use crate::error::{Result, SqlError};
 use crate::planner::declared_type_coerce::{
@@ -91,6 +94,7 @@ pub(crate) fn build_kv_insert_plan(
     // values so a literal that only becomes an integer through coercion is
     // still range-checked against its declared width.
     check_declared_int_ranges(declared_columns, &coerced_rows)?;
+    check_declared_float_ranges(declared_columns, &coerced_rows)?;
     // `ON CONFLICT DO UPDATE SET col = <literal>` writes through the same
     // untyped KV path as the inserted row, so its literals need the same
     // declared-type coercion.
@@ -99,6 +103,8 @@ pub(crate) fn build_kv_insert_plan(
         &mut on_conflict_updates,
         Some(key_col_name),
     )?;
+    check_declared_int_ranges_in_assignments(declared_columns, &on_conflict_updates)?;
+    check_declared_float_ranges_in_assignments(declared_columns, &on_conflict_updates)?;
 
     let mut entries = Vec::with_capacity(coerced_rows.len());
     let mut ttl_secs: u64 = 0;
@@ -130,3 +136,109 @@ pub(crate) fn build_kv_insert_plan(
         on_conflict_updates,
     }])
 }
+
+#[cfg(test)]
+mod kv_on_conflict_range_tests {
+    use sqlparser::ast::{Expr, Value, ValueWithSpan};
+    use sqlparser::tokenizer::Span;
+
+    use super::*;
+    use nodedb_types::columnar::{FloatWidth, IntWidth};
+
+    fn string_column(name: &str) -> ColumnInfo {
+        ColumnInfo {
+            name: name.to_string(),
+            data_type: SqlDataType::String,
+            nullable: true,
+            is_primary_key: false,
+            default: None,
+            raw_type: None,
+            int_width: None,
+            float_width: None,
+        }
+    }
+
+    fn int_column(name: &str, width: Option<IntWidth>) -> ColumnInfo {
+        ColumnInfo {
+            name: name.to_string(),
+            data_type: SqlDataType::Int64,
+            nullable: true,
+            is_primary_key: false,
+            default: None,
+            raw_type: None,
+            int_width: width,
+            float_width: None,
+        }
+    }
+
+    fn float_column(name: &str, width: Option<FloatWidth>) -> ColumnInfo {
+        ColumnInfo {
+            name: name.to_string(),
+            data_type: SqlDataType::Float64,
+            nullable: true,
+            is_primary_key: false,
+            default: None,
+            raw_type: None,
+            int_width: None,
+            float_width: width,
+        }
+    }
+
+    fn key_value_expr(key: &str) -> Expr {
+        Expr::Value(ValueWithSpan {
+            value: Value::SingleQuotedString(key.to_string()),
+            span: Span::empty(),
+        })
+    }
+
+    /// Build a single-row `INSERT ... ON CONFLICT (key) DO UPDATE SET ...`
+    /// plan against a `key TEXT PRIMARY KEY` collection with `n INT` and
+    /// `r REAL` columns, and return the result of range-checking `updates`.
+    fn plan_with_on_conflict(updates: Vec<(String, SqlExpr)>) -> Result<Vec<SqlPlan>> {
+        let declared = [
+            string_column("key"),
+            int_column("n", Some(IntWidth::I32)),
+            float_column("r", Some(FloatWidth::F32)),
+        ];
+        build_kv_insert_plan(
+            "t".to_string(),
+            &["key".to_string()],
+            &[vec![key_value_expr("a")]],
+            KvInsertIntent::Put,
+            updates,
+            Some("key"),
+            &declared,
+        )
+    }
+
+    #[test]
+    fn on_conflict_int_beyond_declared_width_is_rejected() {
+        let updates = vec![(
+            "n".to_string(),
+            SqlExpr::Literal(SqlValue::Int(9_876_543_210)),
+        )];
+        let err = plan_with_on_conflict(updates).expect_err("i32 column must reject overflow");
+        assert!(matches!(err, SqlError::IntegerOutOfRange { .. }));
+    }
+
+    #[test]
+    fn on_conflict_int_in_range_is_accepted() {
+        let updates = vec![("n".to_string(), SqlExpr::Literal(SqlValue::Int(42)))];
+        plan_with_on_conflict(updates).expect("in-range i32 literal must be accepted");
+    }
+
+    #[test]
+    fn on_conflict_float_beyond_f32_range_is_rejected() {
+        let updates = vec![("r".to_string(), SqlExpr::Literal(SqlValue::Float(1e300)))];
+        let err = plan_with_on_conflict(updates).expect_err("real column must reject f32 overflow");
+        assert!(matches!(err, SqlError::FloatOutOfRange { .. }));
+    }
+
+    #[test]
+    fn on_conflict_float_rounding_is_accepted() {
+        // Pinned per `check_declared_float_ranges`: narrowing to f32 rounds,
+        // it does not reject, so a future change must not tighten this.
+        let updates = vec![("r".to_string(), SqlExpr::Literal(SqlValue::Float(1.1)))];
+        plan_with_on_conflict(updates).expect("rounding into f32 must not be rejected");
+    }
+}

nodedb-sql/src/planner/dml_helpers/mod.rs

@@ -19,6 +19,9 @@ pub use ast_extract::extract_point_keys;
 pub(super) use ast_extract::extract_table_name_from_table_with_joins;
 pub(super) use insert_columns::resolve_insert_columns;
 pub(super) use kv_insert::build_kv_insert_plan;
-pub(super) use range_check::{check_declared_int_ranges_in_assignments, coerce_and_check_rows};
+pub(super) use range_check::{
+    check_declared_float_ranges_in_assignments, check_declared_int_ranges_in_assignments,
+    coerce_and_check_rows,
+};
 pub(super) use value_convert::{convert_value_rows, expr_to_sql_value};
 pub(super) use vector_primary_insert::build_vector_primary_insert_plan;

nodedb-sql/src/planner/dml_helpers/range_check.rs

@@ -33,8 +33,7 @@ pub(crate) fn coerce_and_check_rows(
 ) -> Result<()> {
     coerce_rows_to_declared_types(&info.columns, rows, info.primary_key.as_deref())?;
     check_declared_int_ranges(&info.columns, rows)?;
-    coerce_rows_to_declared_types(&info.columns, rows, info.primary_key.as_deref())?;
-    check_declared_int_ranges(&info.columns, rows)
+    check_declared_float_ranges(&info.columns, rows)
 }
 
 /// Reject any integer value that does not fit its column's declared width.
@@ -92,6 +91,69 @@ pub(crate) fn check_declared_int_ranges(
     Ok(())
 }
 
+/// Reject a finite float value that overflows to infinity when narrowed to
+/// its column's declared `REAL` width.
+///
+/// This is deliberately *not* the float mirror of
+/// [`check_declared_int_ranges`]'s full-range check: narrowing an `f64` to
+/// `f32` normally **rounds**, and `1.1` becoming `1.10000002` is correct
+/// PostgreSQL `real` behaviour — accepted, never rejected. The one narrowing
+/// that is not value-preserving is a finite value beyond `f32`'s range, which
+/// would otherwise silently become `Infinity` on read; that is refused here at
+/// write time, exactly as PostgreSQL refuses it (`value out of range: real`).
+/// A value that is *already* infinite or `NaN` in the source is legitimately
+/// representable in both widths and passes through unchanged — it is not an
+/// overflow.
+///
+/// This runs in the planner, on the same coerce-then-check path as
+/// [`check_declared_int_ranges`], for the same reason: the declared width is
+/// engine-independent, and parameters are bound into the AST before planning,
+/// so one check here covers literal `VALUES` and `$1` placeholders alike, for
+/// every engine, on every DML path.
+///
+/// See `nodedb::control::server::pgwire::numeric_narrow::checked_narrow_f32`
+/// for the read-side backstop this check is layered with: rows written before
+/// a column's width was declared, or written via non-SQL ingest, are not
+/// covered by this planner-time check, so the read-side guard stays in place
+/// as the last line of defence. Neither is redundant with the other.
+pub(crate) fn check_declared_float_ranges(
+    columns: &[ColumnInfo],
+    rows: &[Vec<(String, SqlValue)>],
+) -> Result<()> {
+    // Overwhelmingly the common case — skip the per-cell name lookup entirely
+    // when the collection declares no `REAL`-width column.
+    if !columns
+        .iter()
+        .any(|c| c.float_width == Some(nodedb_types::columnar::FloatWidth::F32))
+    {
+        return Ok(());
+    }
+
+    for row in rows {
+        for (name, value) in row {
+            let SqlValue::Float(v) = value else { continue };
+            let Some(width) = columns
+                .iter()
+                .find(|c| c.name.eq_ignore_ascii_case(name))
+                .and_then(|c| c.float_width)
+            else {
+                continue;
+            };
+            if width != nodedb_types::columnar::FloatWidth::F32 {
+                continue;
+            }
+            if v.is_finite() && !(*v as f32).is_finite() {
+                return Err(SqlError::FloatOutOfRange {
+                    column: name.clone(),
+                    value: *v,
+                    declared_type: width.pg_type_name(),
+                });
+            }
+        }
+    }
+    Ok(())
+}
+
 /// [`check_declared_int_ranges`] for `UPDATE ... SET col = <literal>`.
 ///
 /// Only literal assignments are checkable at plan time; a computed assignment
@@ -116,3 +178,94 @@ pub(crate) fn check_declared_int_ranges_in_assignments(
     check_declared_int_ranges(columns, std::slice::from_ref(&literals))
 }
 
+/// [`check_declared_float_ranges`] for `UPDATE ... SET col = <literal>`.
+///
+/// Same literal-only scope and same computed-assignment carve-out as
+/// [`check_declared_int_ranges_in_assignments`] — see its docs.
+pub(crate) fn check_declared_float_ranges_in_assignments(
+    columns: &[ColumnInfo],
+    assignments: &[(String, SqlExpr)],
+) -> Result<()> {
+    let literals: Vec<(String, SqlValue)> = assignments
+        .iter()
+        .filter_map(|(col, expr)| match expr {
+            SqlExpr::Literal(v @ SqlValue::Float(_)) => Some((col.clone(), v.clone())),
+            _ => None,
+        })
+        .collect();
+    if literals.is_empty() {
+        return Ok(());
+    }
+    check_declared_float_ranges(columns, std::slice::from_ref(&literals))
+}
+
+#[cfg(test)]
+mod float_range_tests {
+    use super::*;
+    use nodedb_types::columnar::FloatWidth;
+
+    fn float_column(name: &str, width: Option<FloatWidth>) -> ColumnInfo {
+        ColumnInfo {
+            name: name.to_string(),
+            data_type: SqlDataType::Float64,
+            nullable: true,
+            is_primary_key: false,
+            default: None,
+            raw_type: None,
+            int_width: None,
+            float_width: width,
+        }
+    }
+
+    fn row(name: &str, value: f64) -> Vec<Vec<(String, SqlValue)>> {
+        vec![vec![(name.to_string(), SqlValue::Float(value))]]
+    }
+
+    #[test]
+    fn out_of_f32_range_literal_into_real_column_is_rejected() {
+        let columns = [float_column("r", Some(FloatWidth::F32))];
+        let rows = row("r", 1e300);
+        let err = check_declared_float_ranges(&columns, &rows).expect_err("must overflow f32");
+        assert!(matches!(err, SqlError::FloatOutOfRange { .. }));
+    }
+
+    #[test]
+    fn same_literal_into_double_column_is_accepted() {
+        let columns = [float_column("r", Some(FloatWidth::F64))];
+        let rows = row("r", 1e300);
+        check_declared_float_ranges(&columns, &rows).expect("f64 has no narrower width to check");
+    }
+
+    #[test]
+    fn merely_rounding_value_into_real_column_is_accepted() {
+        // The load-bearing case: `1.1` narrows to `1.10000002` under `f32`,
+        // which is correct rounding, never an error.
+        let columns = [float_column("r", Some(FloatWidth::F32))];
+        let rows = row("r", 1.1);
+        check_declared_float_ranges(&columns, &rows).expect("rounding must not be rejected");
+    }
+
+    #[test]
+    fn f32_max_itself_is_accepted() {
+        let columns = [float_column("r", Some(FloatWidth::F32))];
+        let rows = row("r", f32::MAX as f64);
+        check_declared_float_ranges(&columns, &rows).expect("f32::MAX fits f32 exactly");
+    }
+
+    #[test]
+    fn already_infinite_or_nan_literal_is_accepted() {
+        let columns = [float_column("r", Some(FloatWidth::F32))];
+        for v in [f64::INFINITY, f64::NEG_INFINITY, f64::NAN] {
+            let rows = row("r", v);
+            check_declared_float_ranges(&columns, &rows)
+                .expect("already-infinite/NaN source values are not an overflow");
+        }
+    }
+
+    #[test]
+    fn no_declared_float_width_skips_check() {
+        let columns = [float_column("r", None)];
+        let rows = row("r", 1e300);
+        check_declared_float_ranges(&columns, &rows).expect("untyped float column is unchecked");
+    }
+}

nodedb-sql/src/planner/dml_update_delete.rs

@@ -9,8 +9,8 @@ use super::super::ast_helpers::{
     flatten_and_expr, qualified_ident_pair, strip_and_convert_filters,
 };
 use super::super::dml_helpers::{
-    check_declared_int_ranges_in_assignments, extract_point_keys,
-    extract_table_name_from_table_with_joins,
+    check_declared_float_ranges_in_assignments, check_declared_int_ranges_in_assignments,
+    extract_point_keys, extract_table_name_from_table_with_joins,
 };
 use crate::engine_rules::{self, DeleteParams, UpdateFromParams, UpdateParams};
 use crate::error::{Result, SqlError};
@@ -54,6 +54,7 @@ pub fn plan_update(stmt: &ast::Statement, catalog: &dyn SqlCatalog) -> Result<Ve
     // an `INSERT` that does (see `declared_type_coerce`).
     coerce_assignments_to_declared_types(&info.columns, &mut assigns, info.primary_key.as_deref())?;
     check_declared_int_ranges_in_assignments(&info.columns, &assigns)?;
+    check_declared_float_ranges_in_assignments(&info.columns, &assigns)?;
 
     let filters = match &update.selection {
         Some(expr) => super::super::select::convert_where_to_filters(expr)?,