Validate config bounds for rate limits and currencies

src/types/config.ts

@@ -205,7 +205,8 @@ export interface AssetsConfig {
   assets: Asset[];
 
   /**
-   * Default fiat currency code (ISO 4217)
+   * Default fiat currency code (ISO 4217).
+   * Only standard three-letter uppercase fiat codes are accepted; custom or non-fiat values are not allowed.
    * @optional
    */
   defaultCurrency?: string;

src/utils/validation-helpers.ts

@@ -18,6 +18,14 @@ function isFinitePositiveNumber(value: unknown): boolean {
   return typeof value === 'number' && Number.isFinite(value) && value > 0;
 }
 
+function isPositiveSafeInteger(value: unknown): boolean {
+  return typeof value === 'number' && Number.isSafeInteger(value) && value > 0;
+}
+
+function isValidIso4217CurrencyCode(value: unknown): value is string {
+  return typeof value === 'string' && /^[A-Z]{3}$/.test(value);
+}
+
 function isSafePositiveInteger(value: unknown): value is number {
   return (
     typeof value === 'number' && Number.isInteger(value) && Number.isSafeInteger(value) && value > 0
@@ -117,9 +125,9 @@ function validateFrameworkNumbers(framework: AnchorKitConfig['framework']): bool
 
   if (
     framework.watchers?.transactionTimeoutMs !== undefined &&
-    !isFinitePositiveNumber(framework.watchers.transactionTimeoutMs)
+    !isPositiveSafeInteger(framework.watchers.transactionTimeoutMs)
   ) {
-    throw new Error('framework.watchers.transactionTimeoutMs must be a finite number > 0');
+    throw new Error('framework.watchers.transactionTimeoutMs must be a positive safe integer');
   }
 
   if (
@@ -158,11 +166,8 @@ function validateFrameworkRateLimit(framework: AnchorKitConfig['framework']): bo
   for (const key of numericKeys) {
     const value = framework.rateLimit[key];
     if (value === undefined) continue;
-    if (typeof value !== 'number' || !Number.isFinite(value)) {
-      throw new Error(`framework.rateLimit.${key} must be a finite number`);
-    }
-    if (value <= 0) {
-      throw new Error('framework.rateLimit values must be > 0');
+    if (!isPositiveSafeInteger(value)) {
+      throw new Error(`framework.rateLimit.${key} must be a positive safe integer`);
     }
   }
 
@@ -418,6 +423,10 @@ function validateAnchorKitConfig(config: AnchorKitConfig): boolean {
     throw new Error('At least one asset must be configured in assets.assets');
   }
 
+  if (assets.defaultCurrency !== undefined && !isValidIso4217CurrencyCode(assets.defaultCurrency)) {
+    throw new Error('assets.defaultCurrency must be a three-letter uppercase ISO 4217 code');
+  }
+
   const seenCodes = new Set<string>();
   for (let i = 0; i < assets.assets.length; i++) {
     const asset = assets.assets[i];

tests/core/config-validation-improvements.test.ts

@@ -104,24 +104,27 @@ describe('Config Validation Improvements (#124, #125)', () => {
     });
   });
 
-  it('should reject non-numeric rateLimit values (#250)', () => {
-    const nonNumericCases = [
-      'windowMs',
-      'authChallengeMax',
-      'authTokenMax',
-      'webhookMax',
-      'depositMax',
-    ];
-    for (const key of nonNumericCases) {
-      const config = new AnchorConfig({
-        ...validBaseConfig,
-        framework: {
-          ...validBaseConfig.framework,
-          rateLimit: { [key]: 'fast' as unknown as number },
-        },
-      });
-      expect(() => config.validate()).toThrow(ConfigError);
-      expect(() => config.validate()).toThrow(/must be a finite number/);
+  it('should reject non-numeric and unsafe rateLimit values (#250, #483, #484)', () => {
+    const invalidCasesByKey: Record<string, unknown[]> = {
+      windowMs: [0, -1, 1.5, NaN, Infinity, '60000' as unknown as number],
+      authChallengeMax: [0, -1, 1.5, NaN, Infinity, '30' as unknown as number],
+      authTokenMax: [0, -1, 1.5, NaN, Infinity, '30' as unknown as number],
+      webhookMax: [0, -1, 1.5, NaN, Infinity, '120' as unknown as number],
+      depositMax: [0, -1, 1.5, NaN, Infinity, '60' as unknown as number],
+    };
+
+    for (const [key, invalidValues] of Object.entries(invalidCasesByKey)) {
+      for (const value of invalidValues) {
+        const config = new AnchorConfig({
+          ...validBaseConfig,
+          framework: {
+            ...validBaseConfig.framework,
+            rateLimit: { [key]: value as number },
+          },
+        });
+        expect(() => config.validate()).toThrow(ConfigError);
+        expect(() => config.validate()).toThrow(/must be a positive safe integer/);
+      }
     }
   });
 
@@ -142,6 +145,58 @@ describe('Config Validation Improvements (#124, #125)', () => {
     expect(() => config.validate()).not.toThrow();
   });
 
+  it('should validate watcher transactionTimeoutMs as a positive safe integer (#482)', () => {
+    for (const value of [0, -1, 1.5, NaN, Infinity, '5000' as unknown as number]) {
+      const config = new AnchorConfig({
+        ...validBaseConfig,
+        framework: {
+          ...validBaseConfig.framework,
+          watchers: { transactionTimeoutMs: value as number },
+        },
+      });
+      expect(() => config.validate()).toThrow(ConfigError);
+      expect(() => config.validate()).toThrow(
+        /transactionTimeoutMs must be a positive safe integer/,
+      );
+    }
+
+    for (const value of [1, 300000]) {
+      const config = new AnchorConfig({
+        ...validBaseConfig,
+        framework: {
+          ...validBaseConfig.framework,
+          watchers: { transactionTimeoutMs: value },
+        },
+      });
+      expect(() => config.validate()).not.toThrow();
+    }
+  });
+
+  it('should validate defaultCurrency as a three-letter ISO 4217 code (#485)', () => {
+    for (const value of ['usd', 'US', 'US$', 'US D', 'U1D']) {
+      const config = new AnchorConfig({
+        ...validBaseConfig,
+        assets: {
+          ...validBaseConfig.assets,
+          defaultCurrency: value,
+        },
+      });
+      expect(() => config.validate()).toThrow(ConfigError);
+      expect(() => config.validate()).toThrow(
+        /defaultCurrency must be a three-letter uppercase ISO 4217 code/,
+      );
+    }
+
+    const config = new AnchorConfig({
+      ...validBaseConfig,
+      assets: {
+        ...validBaseConfig.assets,
+        defaultCurrency: 'USD',
+      },
+    });
+    expect(() => config.validate()).not.toThrow();
+  });
+
   it('should accept valid sqlite URLs', () => {
     const sqliteConfigs = ['sqlite:./local.db', 'file:./data.db'];