fix(observability-proxy): refuse a non-finite per-user rate

NaN fails the negative check, as every comparison does, and +Inf
refills a bucket instantly, so either value switched the per-user rate
limit off while the flag looked set. Both now stop the proxy at
startup.

Assisted-by: LLM
Signed-off-by: ZverGuy <maximbel2003@gmail.com>

cmd/observability-proxy/main.go

@@ -27,6 +27,7 @@ import (
 	"fmt"
 	"io"
 	"log/slog"
+	"math"
 	"net/http"
 	"os"
 	"os/signal"
@@ -108,6 +109,10 @@ func parseFlags(args []string) (options, error) {
 		return o, errors.New("--logs-max-tail-resume must not be negative")
 	case o.requestTimeout < 0 || o.tailIdleTimeout < 0 || o.authCacheTTL < 0 || o.shutdownTimeout < 0:
 		return o, errors.New("timeouts and the auth cache TTL must not be negative")
+	// NaN passes every comparison and +Inf never empties a bucket; either
+	// would switch the rate limit off without saying so.
+	case math.IsNaN(o.limiter.RatePerUser) || math.IsInf(o.limiter.RatePerUser, 0):
+		return o, errors.New("--rate-limit-per-user must be a finite number")
 	case o.limiter.RatePerUser < 0 || o.limiter.RateBurst < 0 || o.limiter.MaxConcurrentPerUser < 0 ||
 		o.limiter.MaxTailsPerUser < 0 || o.limiter.MaxTails < 0:
 		return o, errors.New("limits must not be negative; 0 disables a limit")

cmd/observability-proxy/main_test.go

@@ -63,6 +63,8 @@ func TestParseFlagsInvalid(t *testing.T) {
 		{"--tail-idle-timeout=-1s"},
 		{"--auth-cache-ttl=-1s"},
 		{"--rate-limit-per-user=-1"},
+		{"--rate-limit-per-user=NaN"},
+		{"--rate-limit-per-user=+Inf"},
 		{"--rate-limit-burst=-1"},
 		{"--max-concurrent-per-user=-1"},
 		{"--max-tails-per-user=-1"},