From 181ef11c657d601a27b5867bbfc58a6d9d4c5543 Mon Sep 17 00:00:00 2001
From: samsamtrum <pytynguyen@gmail.com>
Date: Tue, 16 Jun 2026 03:59:34 +0700
Subject: [PATCH 1/2] Validate payment timeout values

---
 python/x402_a2a/src/x402_a2a/core/merchant.py |  7 ++++
 python/x402_a2a/tests/test_core.py            | 35 +++++++++++++++++++
 2 files changed, 42 insertions(+)

diff --git a/python/x402_a2a/src/x402_a2a/core/merchant.py b/python/x402_a2a/src/x402_a2a/core/merchant.py
index a41af5f2..0972372c 100644
--- a/python/x402_a2a/src/x402_a2a/core/merchant.py
+++ b/python/x402_a2a/src/x402_a2a/core/merchant.py
@@ -51,6 +51,13 @@ def create_payment_requirements(
         PaymentRequirements object ready for x402PaymentRequiredResponse
     """
 
+    if not isinstance(max_timeout_seconds, int) or isinstance(
+        max_timeout_seconds, bool
+    ):
+        raise ValueError("max_timeout_seconds must be an integer")
+    if max_timeout_seconds <= 0:
+        raise ValueError("max_timeout_seconds must be positive")
+
     max_amount_required, asset_address, eip712_domain = process_price_to_atomic_amount(
         price, network
     )
diff --git a/python/x402_a2a/tests/test_core.py b/python/x402_a2a/tests/test_core.py
index 16001db6..917c3c6d 100644
--- a/python/x402_a2a/tests/test_core.py
+++ b/python/x402_a2a/tests/test_core.py
@@ -26,6 +26,7 @@
     SettleResponse,
 )
 from x402_a2a.core.utils import x402Utils
+from x402_a2a.core.merchant import create_payment_requirements
 
 # --- Fixtures ---
 
@@ -129,6 +130,40 @@ def test_get_payment_payload_from_message(utils, sample_payment_payload):
     assert extracted_payload.payload.signature == "0xabc"
 
 
+def test_create_payment_requirements_rejects_invalid_timeouts(monkeypatch):
+    """Payment requirements should not include invalid timeout values."""
+
+    monkeypatch.setattr(
+        "x402_a2a.core.merchant.process_price_to_atomic_amount",
+        lambda price, network: ("100", "0x456", {}),
+    )
+
+    for timeout in (0, -1, 1.5, True):
+        with pytest.raises(ValueError):
+            create_payment_requirements(
+                price="$1.00",
+                pay_to_address="0x123",
+                resource="/test",
+                max_timeout_seconds=timeout,
+            )
+
+
+def test_create_payment_requirements_accepts_positive_integer_timeout(monkeypatch):
+    monkeypatch.setattr(
+        "x402_a2a.core.merchant.process_price_to_atomic_amount",
+        lambda price, network: ("100", "0x456", {}),
+    )
+
+    requirements = create_payment_requirements(
+        price="$1.00",
+        pay_to_address="0x123",
+        resource="/test",
+        max_timeout_seconds=60,
+    )
+
+    assert requirements.max_timeout_seconds == 60
+
+
 # --- Tests for x402ServerExecutor ---
 
 

From 49d68f925276072aa6cfdb679e4d3d6536d01109 Mon Sep 17 00:00:00 2001
From: samsamtrum <pytynguyen@gmail.com>
Date: Tue, 16 Jun 2026 04:16:54 +0700
Subject: [PATCH 2/2] Trigger CLA check