Allow PATCH /api/v1/config to tune eventLogCap and surface rejected unknown keys

[mikewheeleer]

Enhance config PATCH to cover eventLogCap and report ignored keys

Description

PATCH /api/v1/config in src/index.ts advertises four config values via GET /api/v1/config (rateLimitPerWindow, rateLimitWindowMs, bulkMaxItems, eventLogCap) but its allowed allowlist for writes is only the first three — eventLogCap is readable but not writable, a silent inconsistency. Worse, any key the caller sends that is not in the allowlist (including a misspelled known key) is silently ignored with a 200 and no feedback, so a typo looks like success. This issue closes both gaps.

Requirements and context

• Repository scope: Agentpay-Org/Agentpay-backend only.
• Add eventLogCap to the writable allowlist (validated as a positive integer) so the advertised value can actually be tuned, and coordinate with the event-log ring-buffer/cap direction so the new value is honoured.
• Reject unknown keys in the PATCH body with 400 invalid_request (or return them in an ignored array) instead of silently dropping them, so a typo is visible.
• Keep the positive-integer validation and the existing 200 { config } success response for valid updates.
• Preserve the read-only nature of GET /api/v1/config.

Suggested execution

• Fork the repo and create a branch
• git checkout -b enhancement/config-91-eventlogcap-writable
• Implement changes
  • Write code in: the PATCH /api/v1/config handler in src/index.ts.
  • Write comprehensive tests in: new src/config-patch.test.ts — eventLogCap accepted, unknown key surfaced/rejected, non-integer rejected, valid multi-key update.
  • Add documentation: document the full writable config set in README.md.
  • Add TSDoc on the handler.
  • Validate security assumptions: no out-of-range or non-integer config can be set; a huge eventLogCap cannot enable memory exhaustion (bound it).
• Test and commit

Test and commit

• Run npm test and npm run lint.
• Cover edge cases: set eventLogCap, unknown key, misspelled key, zero/negative, valid combo.
• Include the full npm test output in the PR description.

Example commit message

feat: make eventLogCap writable and surface unknown config keys

Guidelines

• Minimum 95 percent test coverage for impacted modules.
• Clear, reviewer-focused documentation.
• Timeframe: 96 hours.

Community & contribution rewards

• 💬 Join the AgentPay community on Discord for questions, reviews, and faster merges: https://discord.gg/eXvRKkgcv
• ⭐ This is a GrantFox OSS / Official Campaign task and may be rewarded. When your PR is merged you'll be prompted to rate the project — if this issue and the maintainers helped you ship, we'd be grateful for a 5-star rating. Clear questions in Discord and tidy, well-tested PRs are the fastest path to a merge and a reward.

[GBOYEE]

Hello! I can work on this. I'll implement the backend changes with proper error handling, auth middleware, and database optimizations. PR incoming shortly.

[alan-provable]

Hi, I would like to take this one if it is still available. I have a scoped patch ready that adds eventLogCap to the writable config set, rejects unknown config keys with 400 invalid_request, updates the README, and covers eventLogCap, unknown keys, non-integers, zero/negative values, and valid multi-key updates. I will wait for GrantFox or maintainer assignment/confirmation before opening the PR.