fix: disallow negative ttls

Closes #1276

autopush/tests/test_integration.py

@@ -1058,6 +1058,12 @@ def test_ttl_expired(self):
         assert result is None
         yield self.shut_down(client)
 
+    @inlineCallbacks
+    def test_ttl_neg(self):
+        client = yield self.quick_register()
+        yield client.send_notification(ttl=-1, status=400)
+        yield self.shut_down(client)
+
     @inlineCallbacks
     def test_ttl_batch_expired_and_good_one(self):
         data = str(uuid.uuid4())

autopush/web/webpush.py

@@ -179,6 +179,11 @@ def validate_topic(self, value):
             raise InvalidRequest("Topic must be URL and Filename safe Base"
                                  "64 alphabet", errno=113)
 
+    @validates('ttl')
+    def validate_ttl(self, value):
+        if value is not None and value < 0:
+            raise InvalidRequest("TTL must be greater than 0", errno=114)
+
     @post_load
     def cap_ttl(self, d):
         if 'ttl' in d: