fix(server): reject a retention.conversationsDays that isn't above 0

.changeset/retention-days-check.md

@@ -0,0 +1,5 @@
+---
+"@chatcops/server": patch
+---
+
+`createChatHandler` now throws when `retention.conversationsDays` is 0, negative or not a finite number. Before, 0 or a negative value made `purge()` delete every conversation.

packages/server/src/handler.ts

@@ -77,6 +77,10 @@ export function createChatHandler(config: ChatCopsServerConfig) {
   }
   const rateLimit = { maxRequests: 30, windowMs: 60_000, ...config.rateLimit };
   if (rateLimit.maxRequests <= 0) throw new Error('maxRequests must be greater than 0');
+  const retentionDays = config.retention?.conversationsDays;
+  if (retentionDays !== undefined && (!Number.isFinite(retentionDays) || retentionDays <= 0)) {
+    throw new Error('retention.conversationsDays must be a number greater than 0');
+  }
   const rateLimiter = createRateLimiter(counters, {
     limit: rateLimit.maxRequests,
     windowMs: rateLimit.windowMs,

packages/server/tests/storage-config.test.ts

@@ -77,6 +77,12 @@ describe('purge', () => {
     cleanup();
   });
 
+  it.each([0, -1, Number.NaN, Number.POSITIVE_INFINITY])('throws when conversationsDays is %s', (days) => {
+    expect(() => createChatHandler({ provider: scriptedProvider([]), systemPrompt: 'x', retention: { conversationsDays: days } })).toThrow(
+      'retention.conversationsDays must be a number greater than 0'
+    );
+  });
+
   it('resolves null when the store has no purge', async () => {
     const conversationStore = { get: async () => null, save: async () => {}, delete: async () => {} };
     const { purge, cleanup } = createChatHandler({ allowAnonymous: true, provider: scriptedProvider([]), systemPrompt: 'x', storage: { conversations: conversationStore } });