From 1af94fd2019868f7000ebbfe42b5b0c712d3ebc5 Mon Sep 17 00:00:00 2001
From: MayurK-cmd <mayurgk2006@gmail.com>
Date: Thu, 27 Aug 2026 20:18:28 +0530
Subject: [PATCH] fix: add upper bound validation for spot history --limit

The spot history command now validates that --limit is between 1 and 15,
matching the API's maximum allowed value. Previously, users could pass
--limit 1000 which would fail silently at the API level.

Changes:
- Add limit > 15 check in SpotCommand.history()
- Throw clear error: '--limit must be between 1 and 15'
- Add4 e2e tests validating bounds (reject >15, 0, negative; accept 1-15)
---
 src/commands/SpotCommand.ts |  4 +--
 src/e2e.test.ts             | 63 +++++++++++++++++++++++++++++++++++++
 2 files changed, 65 insertions(+), 2 deletions(-)

diff --git a/src/commands/SpotCommand.ts b/src/commands/SpotCommand.ts
index ab28856..15ae65c 100644
--- a/src/commands/SpotCommand.ts
+++ b/src/commands/SpotCommand.ts
@@ -610,8 +610,8 @@ export class SpotCommand {
     }
 
     const limit = Number(opts.limit);
-    if (isNaN(limit) || limit <= 0) {
-      throw new Error("--limit must be a positive number.");
+    if (isNaN(limit) || limit <= 0 || limit > 15) {
+      throw new Error("--limit must be between 1 and 15.");
     }
 
     const address =
diff --git a/src/e2e.test.ts b/src/e2e.test.ts
index fc3f878..1fef834 100644
--- a/src/e2e.test.ts
+++ b/src/e2e.test.ts
@@ -106,3 +106,66 @@ describe("keys add (dist/index.js)", () => {
     expect(second.stdout + second.stderr).toContain("already exists");
   });
 });
+
+describe("spot history", () => {
+  test("rejects --limit greater than 15", () => {
+    const result = runCli(
+      "spot",
+      "history",
+      "--limit",
+      "16",
+      "--address",
+      TEST_SEED_ADDRESS
+    );
+    expect(result.status).not.toBe(0);
+    expect(result.stdout + result.stderr).toContain(
+      "--limit must be between 1 and 15"
+    );
+  });
+
+  test("rejects --limit of 0", () => {
+    const result = runCli(
+      "spot",
+      "history",
+      "--limit",
+      "0",
+      "--address",
+      TEST_SEED_ADDRESS
+    );
+    expect(result.status).not.toBe(0);
+    expect(result.stdout + result.stderr).toContain(
+      "--limit must be between 1 and 15"
+    );
+  });
+
+  test("rejects --limit of negative number", () => {
+    const result = runCli(
+      "spot",
+      "history",
+      "--limit",
+      "-5",
+      "--address",
+      TEST_SEED_ADDRESS
+    );
+    expect(result.status).not.toBe(0);
+    expect(result.stdout + result.stderr).toContain(
+      "--limit must be between 1 and 15"
+    );
+  });
+
+  test("accepts valid --limit between 1 and 15", () => {
+    // This will fail on API call (no real address), but validation should pass
+    const result = runCli(
+      "spot",
+      "history",
+      "--limit",
+      "10",
+      "--address",
+      TEST_SEED_ADDRESS
+    );
+    // Should fail due to API, not validation
+    expect(result.stdout + result.stderr).not.toContain(
+      "--limit must be between 1 and 15"
+    );
+  });
+});