Update input validation

[MoMannn]

Description

In this PR we update input validation from the point of developer setting permission parameters:

1. we make startTime nullable -> defaults to Date.now
2. if startTime is defined its validated that the date is today or later
3. tokenAddress is validated that is really is an address
4. expiryTime is validated that is in the future
5. validation is moved to zod where feasable

Manual testing steps

1. Go to http://localhost:8000/
2. Change inputs into invalid versions
3. Should fail directly before opening up the snap

Screenshots/Recordings

Before

Uploading Screen Recording 2025-07-31 at 13.01.09.mov…

After

Screen.Recording.2025-07-31.at.12.56.47.mov

Pre-merge author checklist

• I've followed MetaMask 7715 Permissions Snaps Contributor Docs and MetaMask 7715 Permissions Snaps Coding Standards.
• I've completed the PR template to the best of my ability
• I’ve included tests if applicable
• I’ve documented my code using JSDoc format if applicable

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​metamask/​delegation-toolkit@​0.13.0-rc.1

View full report

[jeffsmale90]

Looking good!

I'm definitely looking forward to de-duplicating the permission type logic!

[jeffsmale90]

Snapshot conflicts aside, this looks great!

[jeffsmale90]

🍏

[cursor]

Bug: Invalid Input Handling Causes NaN StartTime

The handleStartTimeChange function in ERC20TokenStreamForm, NativeTokenPeriodicForm, ERC20TokenPeriodicForm, and NativeTokenStreamForm components directly converts user input to a number without validating if it's a valid numeric string. This can result in NaN being set as the startTime state for non-numeric inputs, leading to confusing validation errors.

Additional Locations (3)

• packages/site/src/components/permissions/ERC20TokenPeriodicForm.tsx#L51-L56
• packages/site/src/components/permissions/NativeTokenStreamForm.tsx#L70-L75
• packages/site/src/components/permissions/NativeTokenPeriodicForm.tsx#L47-L52