Coupon deduction exceeds applicable amount (negative payable persisted)

Affected Product / Version

• Product: macrozheng/mall (module mall-portal)
• Affected: all releases up to and including 1.0.3 (latest release), and current master branch (verified on commit 0504e86, Spring Boot 3.5 line)
• Component: order placement — POST /order/generateOrder, coupon application path

Summary

The coupon deduction is never capped by the applicable order amount (no upper bound, no non-negative floor). The per-item pro-rata share is re-multiplied by quantity and reconstitutes the coupon's full face value regardless of the cart total. Persisted oms_order.coupon_amount can exceed total_amount and pay_amount is persisted as a negative value.

PoC-A — Deduction exceeds applicable amount; negative payable persisted

1.Admin creates a coupon via the management API (note: accepted without any validation): POST http://:8080/coupon/create (admin token) {"type":0,"name":"DV-coupon","platform":0,"publishCount":50,"amount":1000, "perLimit":10,"minPoint":100,"useType":0, "startTime":"2026-01-01T00:00:00.000+08:00", "endTime":"2027-12-31T23:59:59.000+08:00", "enableTime":"2026-01-01T00:00:00.000+08:00"}

-- persisted: sms_coupon id=32, amount=1000.00, min_point=100.00 2.Member claims the coupon, adds 2 × ¥88.00 (cart total ¥176.00 ≥ minPoint ¥100), and places the order: POST http://:8085/member/coupon/add/32

POST http://:8085/cart/add (SKU 179 × 2)

POST http://:8085/order/generateOrder {"memberReceiveAddressId":,"useIntegration":0,"payType":1,"couponId":32} → HTTP 200

3.Persisted order row (oms_order, read back identically via GET /order/detail/{id}):