From 4d52b4e87b9b6fe22fa9adcf4e84d713ecac680f Mon Sep 17 00:00:00 2001
From: rcourtman <courtmanr@gmail.com>
Date: Sun, 10 May 2026 14:33:45 +0100
Subject: [PATCH] Add bounds to email SMTP port and rate-limit inputs

Two number inputs on /alerts/notifications had no min/max bounds:

  - SMTP port: missing min/max. The browser would accept any
    integer, including negative numbers and values outside the TCP
    port range. Added min="1" max="65535".
  - Rate limit (per minute): missing min. Negative rate limits make
    no sense. Added min="1" so the browser surfaces a validation
    bubble when an invalid value is typed.

Both bounds are enforced by the browser's native number-input UI and
form validation, which catches typos before they hit the API.
---
 frontend-modern/src/components/Alerts/EmailProviderSelect.tsx | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/frontend-modern/src/components/Alerts/EmailProviderSelect.tsx b/frontend-modern/src/components/Alerts/EmailProviderSelect.tsx
index 2ce4929cc..5ff73e2bd 100644
--- a/frontend-modern/src/components/Alerts/EmailProviderSelect.tsx
+++ b/frontend-modern/src/components/Alerts/EmailProviderSelect.tsx
@@ -117,6 +117,8 @@ export function EmailProviderSelect(props: EmailProviderSelectProps) {
           <label class={labelClass()}>{ALERT_EMAIL_SMTP_PORT_LABEL}</label>
           <input
             type="number"
+            min="1"
+            max="65535"
             value={props.config.port || ''}
             onInput={(e) => {
               const value = e.currentTarget.value;
@@ -243,6 +245,7 @@ export function EmailProviderSelect(props: EmailProviderSelectProps) {
                 </label>
                 <input
                   type="number"
+                  min="1"
                   value={props.config.rateLimit || 60}
                   onInput={(e) =>
                     props.onChange({ ...props.config, rateLimit: parseInt(e.currentTarget.value) })