From a46d7b18b388b1dc75152b8f28ece4a207189b21 Mon Sep 17 00:00:00 2001
From: Arnaud <arnaud@status.im>
Date: Fri, 5 Jun 2026 18:25:19 +0400
Subject: [PATCH] Add config validation

---
 storage/conf.nim           | 21 +++++++++
 storage/storage.nim        | 11 +----
 tests/storage/testconf.nim | 89 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 112 insertions(+), 9 deletions(-)
 create mode 100644 tests/storage/testconf.nim

diff --git a/storage/conf.nim b/storage/conf.nim
index 10e1f81b..5af6c497 100644
--- a/storage/conf.nim
+++ b/storage/conf.nim
@@ -394,6 +394,27 @@ func defaultAddress*(conf: StorageConf): IpAddress =
 func defaultNatConfig*(): NatConfig =
   result = NatConfig(hasExtIp: false, nat: NatStrategy.NatAuto)
 
+func validateAutonatConfig*(config: StorageConf): ?!void =
+  # An autonat or relay server must be Reachable, assumed with extIp.
+  # In other words, a node cannot be autonat server AND autonat client.
+  # Currently, only bootstrap nodes should be autonat servers.
+  if config.autonatServer and not config.nat.hasExtIp:
+    return failure "--autonat-server requires --nat=extip:<IP>"
+
+  if config.isRelayServer and not config.nat.hasExtIp:
+    return failure "--relay-server requires --nat=extip:<IP>"
+
+  if config.natMaxQueueSize < 1:
+    return failure "--nat-max-queue-size must be at least 1"
+
+  if config.natNumPeersToAsk < 1:
+    return failure "--nat-num-peers-to-ask must be at least 1"
+
+  if config.natMinConfidence < 0.0 or config.natMinConfidence > 1.0:
+    return failure "--nat-min-confidence must be between 0 and 1"
+
+  success()
+
 proc getStorageVersion(): string =
   let tag = strip(staticExec("git describe --tags --abbrev=0"))
   if tag.isEmptyOrWhitespace:
diff --git a/storage/storage.nim b/storage/storage.nim
index 45200da1..08d3f71f 100644
--- a/storage/storage.nim
+++ b/storage/storage.nim
@@ -241,15 +241,8 @@ proc new*(
 ): StorageServer =
   ## create StorageServer including setting up datastore, repostore, etc
 
-  # Ensure that you can run an autonat server if the node is Reachable, assumed
-  # with extIp.
-  # In other words, a node cannot have autonat server AND autonat client.
-  # Currently, only bootstrap node should be autonat server.
-  if config.autonatServer and not config.nat.hasExtIp:
-    raise newException(StorageError, "--autonat-server requires --nat=extip:<IP>")
-
-  if config.isRelayServer and not config.nat.hasExtIp:
-    raise newException(StorageError, "--relay-server requires --nat=extip:<IP>")
+  if err =? config.validateAutonatConfig().errorOption:
+    raise newException(StorageError, err.msg)
 
   # Switch
   let listenMultiAddr = getMultiAddrWithIpAndTcpPort(config.listenIp, config.listenPort)
diff --git a/tests/storage/testconf.nim b/tests/storage/testconf.nim
new file mode 100644
index 00000000..2a3e23c4
--- /dev/null
+++ b/tests/storage/testconf.nim
@@ -0,0 +1,89 @@
+import std/net
+import pkg/questionable/results
+
+import ../asynctest
+import ./helpers
+import ../../storage/conf
+
+proc validConfig(): StorageConf =
+  StorageConf(
+    nat: defaultNatConfig(),
+    natMaxQueueSize: 3,
+    natNumPeersToAsk: 5,
+    natMinConfidence: 0.7,
+  )
+
+suite "Conf - validateAutonatConfig":
+  test "accepts a valid config":
+    check validConfig().validateAutonatConfig().isOk
+
+  test "rejects autonat server without extip":
+    var config = validConfig()
+    config.autonatServer = true
+
+    check config.validateAutonatConfig().isErr
+
+  test "accepts autonat server with extip":
+    var config = validConfig()
+    config.autonatServer = true
+    config.nat = NatConfig(hasExtIp: true, extIp: parseIpAddress("1.2.3.4"))
+
+    check config.validateAutonatConfig().isOk
+
+  test "rejects relay server without extip":
+    var config = validConfig()
+    config.isRelayServer = true
+
+    check config.validateAutonatConfig().isErr
+
+  test "accepts relay server with extip":
+    var config = validConfig()
+    config.isRelayServer = true
+    config.nat = NatConfig(hasExtIp: true, extIp: parseIpAddress("1.2.3.4"))
+
+    check config.validateAutonatConfig().isOk
+
+  test "rejects nat-max-queue-size below 1":
+    var config = validConfig()
+    config.natMaxQueueSize = 0
+
+    check config.validateAutonatConfig().isErr
+
+  test "accepts nat-max-queue-size of 1":
+    var config = validConfig()
+    config.natMaxQueueSize = 1
+
+    check config.validateAutonatConfig().isOk
+
+  test "rejects nat-num-peers-to-ask below 1":
+    var config = validConfig()
+    config.natNumPeersToAsk = 0
+
+    check config.validateAutonatConfig().isErr
+
+  test "accepts nat-num-peers-to-ask of 1":
+    var config = validConfig()
+    config.natNumPeersToAsk = 1
+
+    check config.validateAutonatConfig().isOk
+
+  test "rejects negative nat-min-confidence":
+    var config = validConfig()
+    config.natMinConfidence = -0.1
+
+    check config.validateAutonatConfig().isErr
+
+  test "rejects nat-min-confidence above 1":
+    var config = validConfig()
+    config.natMinConfidence = 1.1
+
+    check config.validateAutonatConfig().isErr
+
+  test "accepts nat-min-confidence bounds":
+    var config = validConfig()
+
+    config.natMinConfidence = 0.0
+    check config.validateAutonatConfig().isOk
+
+    config.natMinConfidence = 1.0
+    check config.validateAutonatConfig().isOk