From ea8ac04e18b3cd139c4c0b91407738004f971f3c Mon Sep 17 00:00:00 2001
From: rissrice2105-agent <rissrice2105-agent@users.noreply.github.com>
Date: Wed, 15 Jul 2026 18:28:55 -0600
Subject: [PATCH] fix(qryptinvite): validate quota and TTL env values

---
 internal/qryptinvite/config.go      |  4 +--
 internal/qryptinvite/config_test.go | 48 +++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+), 2 deletions(-)
 create mode 100644 internal/qryptinvite/config_test.go

diff --git a/internal/qryptinvite/config.go b/internal/qryptinvite/config.go
index 462b22d..b2b84a8 100644
--- a/internal/qryptinvite/config.go
+++ b/internal/qryptinvite/config.go
@@ -45,12 +45,12 @@ func ConfigFromEnv() Config {
 		c.RedeemURL = v
 	}
 	if v := os.Getenv("AGENTBBS_QRYPT_INVITE_TTL"); v != "" {
-		if d, err := time.ParseDuration(v); err == nil {
+		if d, err := time.ParseDuration(v); err == nil && d > 0 {
 			c.TTL = d
 		}
 	}
 	if v := os.Getenv("AGENTBBS_QRYPT_INVITE_QUOTA"); v != "" {
-		if n, err := strconv.Atoi(v); err == nil {
+		if n, err := strconv.Atoi(v); err == nil && n >= 0 {
 			c.Quota = n
 		}
 	}
diff --git a/internal/qryptinvite/config_test.go b/internal/qryptinvite/config_test.go
new file mode 100644
index 0000000..cffb349
--- /dev/null
+++ b/internal/qryptinvite/config_test.go
@@ -0,0 +1,48 @@
+package qryptinvite
+
+import (
+	"strconv"
+	"testing"
+	"time"
+)
+
+func TestConfigFromEnvRejectsNonPositiveTTL(t *testing.T) {
+	for _, value := range []string{"0s", "-1h"} {
+		t.Run(value, func(t *testing.T) {
+			t.Setenv("AGENTBBS_QRYPT_INVITE_TTL", value)
+
+			if got := ConfigFromEnv().TTL; got != DefaultTTL {
+				t.Fatalf("TTL = %s, want default %s", got, DefaultTTL)
+			}
+		})
+	}
+}
+
+func TestConfigFromEnvQuotaValidation(t *testing.T) {
+	tests := []struct {
+		value string
+		want  int
+	}{
+		{value: "-1", want: DefaultQuota},
+		{value: "0", want: 0},
+		{value: "12", want: 12},
+	}
+
+	for _, tt := range tests {
+		t.Run(strconv.Quote(tt.value), func(t *testing.T) {
+			t.Setenv("AGENTBBS_QRYPT_INVITE_QUOTA", tt.value)
+
+			if got := ConfigFromEnv().Quota; got != tt.want {
+				t.Fatalf("Quota = %d, want %d", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestConfigFromEnvAcceptsPositiveTTL(t *testing.T) {
+	t.Setenv("AGENTBBS_QRYPT_INVITE_TTL", "24h")
+
+	if got := ConfigFromEnv().TTL; got != 24*time.Hour {
+		t.Fatalf("TTL = %s, want %s", got, 24*time.Hour)
+	}
+}