fix(pairing): reject malformed store entries

nanobot/pairing/store.py

@@ -43,6 +43,9 @@ def _load() -> dict[str, Any]:
     except (json.JSONDecodeError, OSError):
         logger.warning("Corrupted pairing store, resetting")
         return {"approved": {}, "pending": {}}
+    if not isinstance(data, dict):
+        logger.warning("Corrupted pairing store, resetting")
+        return {"approved": {}, "pending": {}}
 
     # JSON stores may contain null maps after partial edits; treat like {}.
     approved = data.get("approved") or {}
@@ -89,7 +92,15 @@ def _gc_pending(data: dict[str, Any]) -> None:
     expired = [
         code
         for code, info in pending.items()
-        if not isinstance(info, dict) or info.get("expires_at", 0) < now
+        if (
+            not isinstance(info, dict)
+            or not isinstance(info.get("channel"), str)
+            or not info.get("channel")
+            or info.get("sender_id") is None
+            or isinstance(info.get("expires_at"), bool)
+            or not isinstance(info.get("expires_at"), (int, float))
+            or info["expires_at"] < now
+        )
     ]
     for code in expired:
         del pending[code]
@@ -220,6 +231,7 @@ def clear_channel(channel: str) -> dict[str, int]:
     """Remove approved senders and pending requests for *channel*."""
     with _LOCK:
         data = _load()
+        _gc_pending(data)
         approved: dict[str, set[str]] = data.get("approved", {})
         approved_users = approved.pop(channel, set())
 

tests/pairing/test_store.py

@@ -272,6 +272,15 @@ def test_load_treats_null_approved_and_pending_maps_as_empty(tmp_path, monkeypat
     assert store.get_approved("telegram") == []
 
 
+@pytest.mark.parametrize("payload", ["null", "[]", "true"])
+def test_load_treats_non_object_store_as_empty(tmp_path, monkeypatch, payload):
+    path = tmp_path / "pairing.json"
+    path.write_text(payload, encoding="utf-8")
+    monkeypatch.setattr(store, "_store_path", lambda: path)
+    assert store.list_pending() == []
+    assert store.is_approved("telegram", "123") is False
+
+
 def test_list_pending_skips_null_pending_entries(tmp_path, monkeypatch):
     """Null pending entry values must be dropped instead of crashing list_pending."""
     path = tmp_path / "pairing.json"
@@ -281,3 +290,17 @@ def test_list_pending_skips_null_pending_entries(tmp_path, monkeypatch):
     )
     monkeypatch.setattr(store, "_store_path", lambda: path)
     assert store.list_pending() == []
+    assert store.clear_channel("telegram") == {"approved": 0, "pending": 0}
+
+
+def test_pending_gc_drops_malformed_entries(tmp_path, monkeypatch):
+    path = tmp_path / "pairing.json"
+    path.write_text(
+        '{"approved": {}, "pending": {'
+        '"bad-expiry": {"channel": "telegram", "sender_id": "123", "expires_at": null},'
+        '"missing-sender": {"channel": "telegram", "expires_at": 9999999999}'
+        "}}",
+        encoding="utf-8",
+    )
+    monkeypatch.setattr(store, "_store_path", lambda: path)
+    assert store.list_pending() == []