diff --git a/apps/coordinator-api/src/app/routers/marketplace_gpu.py b/apps/coordinator-api/src/app/routers/marketplace_gpu.py index 2e03b3fa..76d23608 100755 --- a/apps/coordinator-api/src/app/routers/marketplace_gpu.py +++ b/apps/coordinator-api/src/app/routers/marketplace_gpu.py @@ -229,9 +229,29 @@ async def book_gpu( detail=f"GPU {gpu_id} is not available", ) + # Input validation for booking duration + if request.duration_hours <= 0: + raise HTTPException( + status_code=http_status.HTTP_400_BAD_REQUEST, + detail="Booking duration must be greater than 0 hours" + ) + + if request.duration_hours > 8760: # 1 year maximum + raise HTTPException( + status_code=http_status.HTTP_400_BAD_REQUEST, + detail="Booking duration cannot exceed 8760 hours (1 year)" + ) + start_time = datetime.utcnow() end_time = start_time + timedelta(hours=request.duration_hours) + # Validate booking end time is in the future + if end_time <= start_time: + raise HTTPException( + status_code=http_status.HTTP_400_BAD_REQUEST, + detail="Booking end time must be in the future" + ) + # Calculate dynamic price at booking time try: dynamic_result = await engine.calculate_dynamic_price(