Fail fast on malformed numeric stackflow-node env values

Author: warmidris

README.md

@@ -284,6 +284,9 @@ cannot be disabled accidentally via negative values.
 Boolean env vars accept `true/false`, `1/0`, `yes/no`, and `on/off`
 (case-insensitive); invalid boolean text now fails fast to prevent silent
 misconfiguration.
+Integer env vars must be plain integer text (for example `10000`, not `10s`
+or `12.5`); malformed numeric values fail fast instead of being silently
+coerced.
 Observer ingress controls:
 
 - `STACKFLOW_NODE_OBSERVER_LOCALHOST_ONLY` defaults to `true` and restricts

server/src/config.ts

@@ -26,25 +26,37 @@ const DEFAULT_DB_FILE = path.resolve(
   'server/data/stackflow-node-state.db',
 );
 
-function parseInteger(value: unknown, fallback: number): number {
+function parseInteger(value: unknown, fallback: number, key: string): number {
   if (value === undefined || value === null || value === '') {
     return fallback;
   }
 
-  const parsed = Number.parseInt(String(value), 10);
-  return Number.isFinite(parsed) ? parsed : fallback;
+  const normalized = String(value).trim();
+  if (!/^-?\d+$/.test(normalized)) {
+    throw new Error(`${key} must be an integer`);
+  }
+
+  const parsed = Number.parseInt(normalized, 10);
+  if (!Number.isSafeInteger(parsed)) {
+    throw new Error(`${key} must be a safe integer`);
+  }
+
+  return parsed;
 }
 
 function parsePort(value: unknown): number {
-  const parsed = parseInteger(value, DEFAULT_PORT);
+  const parsed = parseInteger(value, DEFAULT_PORT, 'STACKFLOW_NODE_PORT');
   if (!Number.isInteger(parsed) || parsed < 1 || parsed > 65_535) {
     throw new Error('STACKFLOW_NODE_PORT must be an integer between 1 and 65535');
   }
   return parsed;
 }
 
 function parseMaxRecentEvents(value: unknown): number {
-  return Math.max(1, parseInteger(value, DEFAULT_MAX_RECENT_EVENTS));
+  return Math.max(
+    1,
+    parseInteger(value, DEFAULT_MAX_RECENT_EVENTS, 'STACKFLOW_NODE_MAX_RECENT_EVENTS'),
+  );
 }
 
 function parseCsv(value: unknown): string[] {
@@ -218,6 +230,7 @@ export function loadConfig(env: NodeJS.ProcessEnv = process.env): StackflowNodeC
       parseInteger(
         env.STACKFLOW_NODE_PEER_WRITE_RATE_LIMIT_PER_MINUTE,
         DEFAULT_PEER_WRITE_RATE_LIMIT_PER_MINUTE,
+        'STACKFLOW_NODE_PEER_WRITE_RATE_LIMIT_PER_MINUTE',
       ),
     ),
     trustProxy: parseBoolean(
@@ -249,13 +262,18 @@ export function loadConfig(env: NodeJS.ProcessEnv = process.env): StackflowNodeC
     ),
     forwardingMinFee: Math.max(
       0,
-      parseInteger(env.STACKFLOW_NODE_FORWARDING_MIN_FEE, 0),
+      parseInteger(
+        env.STACKFLOW_NODE_FORWARDING_MIN_FEE,
+        0,
+        'STACKFLOW_NODE_FORWARDING_MIN_FEE',
+      ),
     ).toString(10),
     forwardingTimeoutMs: Math.max(
       1_000,
       parseInteger(
         env.STACKFLOW_NODE_FORWARDING_TIMEOUT_MS,
         DEFAULT_FORWARDING_TIMEOUT_MS,
+        'STACKFLOW_NODE_FORWARDING_TIMEOUT_MS',
       ),
     ),
     forwardingAllowPrivateDestinations: parseBoolean(
@@ -271,13 +289,15 @@ export function loadConfig(env: NodeJS.ProcessEnv = process.env): StackflowNodeC
       parseInteger(
         env.STACKFLOW_NODE_FORWARDING_REVEAL_RETRY_INTERVAL_MS,
         DEFAULT_FORWARDING_REVEAL_RETRY_INTERVAL_MS,
+        'STACKFLOW_NODE_FORWARDING_REVEAL_RETRY_INTERVAL_MS',
       ),
     ),
     forwardingRevealRetryMaxAttempts: Math.max(
       1,
       parseInteger(
         env.STACKFLOW_NODE_FORWARDING_REVEAL_RETRY_MAX_ATTEMPTS,
         DEFAULT_FORWARDING_REVEAL_RETRY_MAX_ATTEMPTS,
+        'STACKFLOW_NODE_FORWARDING_REVEAL_RETRY_MAX_ATTEMPTS',
       ),
     ),
   };

tests/stackflow-node-config.test.ts

@@ -83,6 +83,20 @@ describe('stackflow-node config parsing', () => {
     ).toThrow(/STACKFLOW_NODE_FORWARDING_ENABLED must be a boolean/);
   });
 
+  it('fails fast when integer env vars contain non-integer text', () => {
+    expect(() =>
+      loadConfig({
+        STACKFLOW_NODE_FORWARDING_TIMEOUT_MS: '30s',
+      }),
+    ).toThrow(/STACKFLOW_NODE_FORWARDING_TIMEOUT_MS must be an integer/);
+
+    expect(() =>
+      loadConfig({
+        STACKFLOW_NODE_PEER_WRITE_RATE_LIMIT_PER_MINUTE: '12.5',
+      }),
+    ).toThrow(/STACKFLOW_NODE_PEER_WRITE_RATE_LIMIT_PER_MINUTE must be an integer/);
+  });
+
   it('rejects stackflow-node ports outside the TCP range', () => {
     expect(() =>
       loadConfig({