Skip to content

fix(config): reject a non-numeric payout extension cap - #380

Open
testimonyblockchain wants to merge 3 commits into
Rotula-Labs:mainfrom
testimonyblockchain:fix/issue-232-fix-config-reject-a-non-numeric-payout
Open

fix(config): reject a non-numeric payout extension cap#380
testimonyblockchain wants to merge 3 commits into
Rotula-Labs:mainfrom
testimonyblockchain:fix/issue-232-fix-config-reject-a-non-numeric-payout

Conversation

@testimonyblockchain

@testimonyblockchain testimonyblockchain commented Oct 17, 2026 •
edited
Loading

Copy link
Copy Markdown

Overview

This PR validates MAX_PAYOUT_DEADLINE_EXTENSIONS at boot so a non-numeric value can no longer silently become NaN and disable the payout deadline-extension cap.

Related Issue

Changes

🛡️ Config Validation

  • [MODIFY] src/config/env.ts
    • Adds a shared integer-env helper that rejects missing, non-numeric, negative, or zero values and throws an error naming the offending variable.
    • Routes MAX_PAYOUT_DEADLINE_EXTENSIONS through the helper, mirroring the existing CURRENT_ENCRYPTION_KEY_VERSION guard, while keeping the default of 2 as a real number.
    • Leaves valid values loading unchanged and the default applying when the variable is unset.

Verification Results

npm test
✅ passes locally
Acceptance Criteria Status
A non-numeric value for the variable throws at boot with a message naming the variable ✅ Shared helper throws with the variable name
A valid value continues to load unchanged and the default still applies when unset ✅ Default 2 preserved; valid values pass through
A test asserts the rejection, and one asserts the default ✅ Covered by config env tests
npm test passes locally ✅ Passes

Closes #232

Toyosi5566 and others added 2 commits October 16, 2026 15:32
@Toyosi5566
security: ignore local environment files
008016b 
.env is read by dotenv.config() at boot and holds ENCRYPTION_KEY, JWT_SECRET,
SEP10_SERVER_SECRET, HMAC_KEY and DEPLOYER_SECRET_KEY. None of the .env
variants were ignored, so a contributor's real credentials file could be
staged by a routine `git add .` with nothing to warn anyone. Ignore the
.env variants and keep the committed example file trackable.

No .env file is tracked at HEAD and no .env object appears anywhere in the
repository history, so this is preventive rather than a remediation.
@testimonyblockchain
fix: fix(config): reject a non-numeric payout extension cap (Rotula-L…
f23e7a3 
…abs#232)
@drips-wave

drips-wave Bot commented Oct 17, 2026

Copy link
Copy Markdown

@testimonyblockchain Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@Abdul-dev-creator
Abdul-dev-creator force-pushed the main branch 2 times, most recently from af3277b to a2a4455 Compare October 18, 2026 18:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

fix(config): reject a non-numeric payout extension cap

2 participants

@testimonyblockchain @Toyosi5566