Validate max_retry_after at construction

Round out the constructor validation: rate and burst already raise on
out-of-range values, but max_retry_after did not, so a nan/negative value
would silently misbehave in the Retry-After clamp. Reject anything that is
not None or a non-negative finite number. Clarify the docs to distinguish
this config validation from the (separate) handling of hostile server-sent
Retry-After values.

Author: rodrigobnogueira

aiohttp_client_middlewares/rate_limit.py

@@ -118,10 +118,13 @@ class RateLimitMiddleware:
         numeric ``Retry-After`` header on an HTTP 429 response before returning
         it to the caller.
     :param max_retry_after: Upper bound, in seconds, on how long a
-        ``Retry-After`` header may make the client sleep. ``None`` removes the
-        cap. Non-finite (``inf``/``nan``) and non-positive values are always
+        ``Retry-After`` header may make the client sleep. Must be ``None`` (no
+        cap) or a non-negative, finite number. A server-sent ``Retry-After``
+        that is itself non-finite (``inf``/``nan``) or non-positive is always
         ignored, so a hostile server cannot stall the client indefinitely.
     :type max_retry_after: float or None
+    :raises ValueError: if ``rate``, ``burst`` or ``max_retry_after`` is out of
+        range.
     """
 
     rate: float
@@ -148,6 +151,13 @@ def __init__(
         self._domain_buckets: dict[str, TokenBucket] = defaultdict(
             lambda: TokenBucket(rate, burst)
         )
+        if max_retry_after is not None and (
+            not math.isfinite(max_retry_after) or max_retry_after < 0
+        ):
+            raise ValueError(
+                "max_retry_after must be None or a non-negative finite "
+                f"number, got {max_retry_after!r}"
+            )
 
     def _get_bucket(self, request: ClientRequest) -> TokenBucket:
         if self.per_domain:

docs/api.rst

@@ -95,18 +95,19 @@ Rate limiting
       ``Retry-After`` header on an HTTP 429 response before returning it to the
       caller.
    :param max_retry_after: Upper bound, in seconds, on how long a ``Retry-After``
-      header may make the client sleep. ``None`` removes the cap. Non-finite
-      (``inf``/``nan``) and non-positive values are always ignored, so a hostile
-      server cannot stall the client indefinitely.
+      header may make the client sleep. Must be ``None`` (no cap) or a
+      non-negative, finite number. A server-sent ``Retry-After`` that is itself
+      non-finite (``inf``/``nan``) or non-positive is always ignored, so a
+      hostile server cannot stall the client indefinitely.
    :type max_retry_after: float or None
 
    The middleware delays each request until the bucket grants it a slot, so the
    client never sends faster than ``rate`` requests per second while still
    allowing short bursts of up to ``burst`` requests. Slots are served in strict
    FIFO order.
 
-   ``rate`` and ``burst`` are validated on construction and raise
-   :exc:`ValueError` if out of range.
+   ``rate``, ``burst`` and ``max_retry_after`` are validated on construction and
+   raise :exc:`ValueError` if out of range.
 
    **Usage**
 

tests/test_rate_limit.py

@@ -224,6 +224,20 @@ def test_invalid_burst_raises(burst: int) -> None:
         RateLimitMiddleware(burst=burst)
 
 
+@pytest.mark.parametrize("value", [float("nan"), float("inf"), float("-inf"), -1.0])
+def test_invalid_max_retry_after_raises(value: float) -> None:
+    """A non-finite or negative max_retry_after is rejected at construction."""
+    with pytest.raises(ValueError, match="max_retry_after"):
+        RateLimitMiddleware(max_retry_after=value)
+
+
+@pytest.mark.parametrize("value", [None, 0.0, 0.5, 300.0])
+def test_valid_max_retry_after_accepted(value: "float | None") -> None:
+    """None and any non-negative finite max_retry_after are accepted."""
+    middleware = RateLimitMiddleware(max_retry_after=value)
+    assert middleware.max_retry_after == value
+
+
 # --- Retry-After edge cases -------------------------------------------------