Cap sync_interval at 30 days (#174)

sync_interval has no upper bound, so a value above MaxInt32 passes validation and then fails the INTEGER column insert as a 500, and very large values overflow time.Duration.

- add MaxSyncInterval (30 days in seconds)
- reject sync_interval above it with a 400 via ValidateSyncInterval
- cover the boundary in TestValidateSyncInterval and over-limit values in TestSyncIntervalAPI

Reviewed-on: #174
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

pkg/models/remote.go

@@ -189,11 +189,14 @@ func syncPhase(name string, period time.Duration) time.Duration {
 	return time.Duration(h.Sum64() % uint64(period))
 }
 
-// ValidateSyncInterval rejects a negative sync_interval, or one set on a type
-// without a background syncer.
+// MaxSyncInterval caps sync_interval at 30 days (seconds).
+const MaxSyncInterval = 30 * 24 * 60 * 60
+
+// ValidateSyncInterval rejects a sync_interval outside 0..MaxSyncInterval, or
+// one set on a type without a background syncer.
 func (r *Remote) ValidateSyncInterval() error {
-	if r.SyncInterval < 0 {
-		return fmt.Errorf("sync_interval must be >= 0, got %d", r.SyncInterval)
+	if r.SyncInterval < 0 || r.SyncInterval > MaxSyncInterval {
+		return fmt.Errorf("sync_interval must be between 0 and %d, got %d", MaxSyncInterval, r.SyncInterval)
 	}
 	switch r.PackageType {
 	case PackageGitHubRPM, PackageGitHubDeb, PackageGitHubAlpine:

pkg/models/remote_test.go

@@ -153,6 +153,8 @@ func TestValidateSyncInterval(t *testing.T) {
 		{PackageGitHubDeb, 3600, true},
 		{PackageGitHubAlpine, 3600, true},
 		{PackageGitHubRPM, -1, false},
+		{PackageGitHubRPM, MaxSyncInterval, true},
+		{PackageGitHubRPM, MaxSyncInterval + 1, false},
 		{PackageRPM, 0, true},
 		{PackageRPM, 60, false},
 	} {