feat(#337): validate market-price orders against the node's sats limits

lib/features/order/providers/exchange_rate_provider.dart

@@ -0,0 +1,41 @@
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+
+import 'package:mostro/core/mostro_defaults.dart';
+import 'package:mostro/features/settings/widgets/mostro_node_selector.dart';
+import 'package:mostro/src/rust/api/nostr.dart' as nostr_api;
+
+/// Price of one BTC in [fiatCode], as published by the active Mostro node in
+/// its Kind 30078 (`d` = `mostro-rates`) event.
+///
+/// Exists so a market-price order can be checked against the node's sats
+/// limits before it is submitted (#337): the daemon prices such an order from
+/// this same rate, so it is the number its range check will use.
+///
+/// Reads the node pubkey from [mostroPubkeyProvider], like
+/// `mostroNodeProvider`, so the rate always belongs to the node the order will
+/// be sent to.
+///
+/// Resolves to `null` whenever the node has no usable rate to give — it
+/// publishes none (publishing is optional), the event has expired, or it
+/// quotes no such currency — and an unreachable relay surfaces as an error.
+/// Callers must treat both as "not checkable" and submit anyway, leaving the
+/// daemon as the authority, which is what PR #302 chose for fixed-sats
+/// amounts.
+///
+/// `autoDispose` and keyed by currency: switching currency starts a fetch for
+/// the new one, which the Rust-side cache usually answers without another
+/// relay query.
+final exchangeRateProvider =
+    FutureProvider.autoDispose.family<double?, String>((ref, fiatCode) async {
+  final code = fiatCode.trim();
+  if (code.isEmpty) return null;
+
+  final pubkey = ref.watch(mostroPubkeyProvider);
+  final resolvedPubkey =
+      pubkey.trim().isEmpty ? defaultMostroPubkey : pubkey.trim();
+
+  return nostr_api.fetchExchangeRate(
+    mostroPubkeyHex: resolvedPubkey,
+    fiatCode: code,
+  );
+});

lib/features/order/screens/add_order_screen.dart

@@ -10,12 +10,15 @@ import 'package:mostro/core/automation/automation_ids.dart';
 import 'package:mostro/core/daemon_errors.dart';
 import 'package:mostro/features/order/widgets/currency_section.dart';
 import 'package:mostro/features/settings/providers/settings_provider.dart';
+import 'package:mostro/features/about/models/mostro_instance.dart';
 import 'package:mostro/features/about/providers/mostro_node_provider.dart';
+import 'package:mostro/features/order/providers/exchange_rate_provider.dart';
 import 'package:mostro/features/order/widgets/order_preset_selector.dart';
 import 'package:mostro/features/order/widgets/payment_method_section.dart';
 import 'package:mostro/features/order/widgets/price_section.dart';
 import 'package:mostro/features/trades/providers/trades_providers.dart'
     show refreshTrades;
+import 'package:mostro/shared/utils/order_amount_limits.dart';
 import 'package:mostro/src/rust/api/orders.dart' as rust_orders;
 import 'package:mostro/src/rust/api/types.dart';
 
@@ -57,6 +60,30 @@ class AddOrderScreen extends ConsumerStatefulWidget {
   return null;
 }
 
+/// Returns the node's accepted `(min, max)` sats range, and that range in
+/// fiat, when a market-price order's amount prices outside it, otherwise null.
+///
+/// Pure and testable, like [satsOutOfNodeRange] above, which is the fixed-sats
+/// counterpart. Takes every amount the daemon will price — one for a
+/// single-amount order, both ends for a range order — because the daemon
+/// prices each of them and rejects the order if any one is out of range
+/// (`mostro/src/app/order.rs`). Fails open on anything it cannot judge; see
+/// [fiatOutOfNodeRange].
+@visibleForTesting
+({int minSats, int maxSats, FiatAmountLimits limits})?
+    marketAmountsOutOfNodeRange(
+  List<String> fiatAmounts,
+  int? minOrder,
+  int? maxOrder,
+  double? rate,
+) {
+  for (final amount in fiatAmounts) {
+    final error = fiatOutOfNodeRange(amount, minOrder, maxOrder, rate);
+    if (error != null) return error;
+  }
+  return null;
+}
+
 class _AddOrderScreenState extends ConsumerState<AddOrderScreen> {
   final _amountController = TextEditingController();
   final _minController = TextEditingController();
@@ -106,6 +133,51 @@ class _AddOrderScreenState extends ConsumerState<AddOrderScreen> {
     }
   }
 
+  /// [marketAmountsOutOfNodeRange] over whichever amount fields are in play.
+  ({int minSats, int maxSats, FiatAmountLimits limits})? _fiatRangeError(
+    MostroInstance? node,
+    double? rate,
+  ) =>
+      marketAmountsOutOfNodeRange(
+        _isRange
+            ? [_minController.text, _maxController.text]
+            : [_amountController.text],
+        node?.minOrderAmount,
+        node?.maxOrderAmount,
+        rate,
+      );
+
+  /// The out-of-range warning to show under the price card, or null when the
+  /// entered amount is fine — or cannot be checked at all, in which case the
+  /// daemon stays the only authority.
+  String? _rangeWarning({
+    required AppLocalizations l10n,
+    required ({int min, int max})? satsRangeError,
+    required ({int minSats, int maxSats, FiatAmountLimits limits})?
+        fiatRangeError,
+    required String fiatCode,
+  }) {
+    if (satsRangeError != null) {
+      return l10n.orderAmountOutOfRange(satsRangeError.min, satsRangeError.max);
+    }
+    if (fiatRangeError == null) return null;
+    // The sats bounds mean nothing to most users, so a market-price range is
+    // shown in the currency they typed in. Sats are the fallback for when the
+    // whole valid range is under one fiat unit, leaving no enterable whole
+    // number to name.
+    final limits = fiatRangeError.limits;
+    return limits.isDisplayable
+        ? l10n.orderAmountOutOfRangeFiat(
+            limits.minFiat,
+            limits.maxFiat,
+            fiatCode,
+          )
+        : l10n.orderAmountOutOfRange(
+            fiatRangeError.minSats,
+            fiatRangeError.maxSats,
+          );
+  }
+
   bool _checkValid(
     List<String> selectedMethods,
     String customMethod,
@@ -202,19 +274,26 @@ class _AddOrderScreenState extends ConsumerState<AddOrderScreen> {
     // out of the node's sats range, but re-check here so no code path submits
     // an out-of-range fixed-sats order (#282).
     final node = ref.read(mostroNodeProvider).valueOrNull;
+    final fiatCode = ref.read(selectedFiatCodeProvider);
     final outOfRange = !isMarket && !_isRange && fixedSatsStr.isNotEmpty
         ? satsOutOfNodeRange(
             fixedSatsStr, node?.minOrderAmount, node?.maxOrderAmount)
         : null;
+    final fiatOutOfRange = isMarket
+        ? _fiatRangeError(
+            node,
+            ref.read(exchangeRateProvider(fiatCode)).valueOrNull,
+          )
+        : null;
     if (_submitting ||
         !_checkValid(selectedMethods, customMethod, isMarket, fixedSatsStr) ||
-        outOfRange != null) {
+        outOfRange != null ||
+        fiatOutOfRange != null) {
       return;
     }
     setState(() => _submitting = true);
 
     try {
-      final fiatCode = ref.read(selectedFiatCodeProvider);
       final isMarket = ref.read(isMarketPriceProvider);
       final premium = isMarket ? ref.read(premiumValueProvider) : 0.0;
       final fixedSatsStr = ref.read(fixedSatsProvider);
@@ -289,10 +368,24 @@ class _AddOrderScreenState extends ConsumerState<AddOrderScreen> {
         ? satsOutOfNodeRange(
             fixedSatsStr, node?.minOrderAmount, node?.maxOrderAmount)
         : null;
+    // Watched rather than read on submit, so the fetch is already in flight by
+    // the time an amount is typed. Null while it is — and for good when the
+    // node publishes no rate — which fails the check open (#337).
+    final rate = isMarket
+        ? ref.watch(exchangeRateProvider(fiatCode)).valueOrNull
+        : null;
+    final fiatRangeError = isMarket ? _fiatRangeError(node, rate) : null;
     final isValid =
         _checkValid(selectedMethods, customMethod, isMarket, fixedSatsStr) &&
-            satsRangeError == null;
+            satsRangeError == null &&
+            fiatRangeError == null;
     final l10n = AppLocalizations.of(context);
+    final rangeWarning = _rangeWarning(
+      l10n: l10n,
+      satsRangeError: satsRangeError,
+      fiatRangeError: fiatRangeError,
+      fiatCode: fiatCode,
+    );
 
     return Scaffold(
       appBar: AppBar(title: Text(l10n.creatingNewOrderTitle)),
@@ -412,18 +505,16 @@ class _AddOrderScreenState extends ConsumerState<AddOrderScreen> {
             color: cardBg,
             child: const PriceSection(),
           ),
-          // Out-of-range warning for fixed-sats orders (#282): show the node's
-          // accepted range so the user can correct it before submitting,
-          // instead of the daemon rejecting the order after the fact.
-          if (satsRangeError != null) ...[
+          // Out-of-range warning, for fixed-sats (#282) and market-price
+          // (#337) orders alike: show the node's accepted range so the user can
+          // correct it before submitting, instead of the daemon rejecting the
+          // order after the fact.
+          if (rangeWarning != null) ...[
             const SizedBox(height: AppSpacing.sm),
             Padding(
               padding: const EdgeInsets.symmetric(horizontal: AppSpacing.sm),
               child: Text(
-                l10n.orderAmountOutOfRange(
-                  satsRangeError.min,
-                  satsRangeError.max,
-                ),
+                rangeWarning,
                 style: TextStyle(
                   color: colors?.destructiveRed ?? const Color(0xFFD84D4D),
                   fontSize: 13,

lib/l10n/app_de.arb

@@ -602,6 +602,7 @@
   "minHint": "Min",
   "maxHint": "Max",
   "orderAmountOutOfRange": "Der Betrag muss für diesen Mostro-Knoten zwischen {min} und {max} Sats liegen",
+  "orderAmountOutOfRangeFiat": "Der Betrag muss für diesen Mostro-Knoten zwischen {min} und {max} {currency} liegen",
   "fiatAmountHint": "Fiat-Betrag",
   "enterAmountForPreview": "Gib einen Betrag ein, um eine Live-Vorschau zu sehen.",
   "previewLabel": "VORSCHAU",

lib/l10n/app_en.arb

@@ -1291,6 +1291,15 @@
       "max": {"type": "int"}
     }
   },
+  "orderAmountOutOfRangeFiat": "Amount must be between {min} and {max} {currency} for this Mostro node",
+  "@orderAmountOutOfRangeFiat": {
+    "description": "Shown when a market-price order amount converts outside the node min/max order amount, with the range expressed in the user's fiat currency",
+    "placeholders": {
+      "min": {"type": "int"},
+      "max": {"type": "int"},
+      "currency": {"type": "String"}
+    }
+  },
   "fiatAmountHint": "Fiat amount",
   "@fiatAmountHint": {"description": "Hint for the fiat amount input"},
   "enterAmountForPreview": "Enter an amount to see a live preview.",

lib/l10n/app_es.arb

@@ -602,6 +602,7 @@
   "minHint": "Mín",
   "maxHint": "Máx",
   "orderAmountOutOfRange": "El monto debe estar entre {min} y {max} sats para este nodo Mostro",
+  "orderAmountOutOfRangeFiat": "El monto debe estar entre {min} y {max} {currency} para este nodo Mostro",
   "fiatAmountHint": "Monto fiat",
   "enterAmountForPreview": "Ingresa un monto para ver una vista previa en vivo.",
   "previewLabel": "VISTA PREVIA",

lib/l10n/app_fr.arb

@@ -602,6 +602,7 @@
   "minHint": "Min",
   "maxHint": "Max",
   "orderAmountOutOfRange": "Le montant doit être compris entre {min} et {max} sats pour ce nœud Mostro",
+  "orderAmountOutOfRangeFiat": "Le montant doit être compris entre {min} et {max} {currency} pour ce nœud Mostro",
   "fiatAmountHint": "Montant fiat",
   "enterAmountForPreview": "Saisissez un montant pour voir un aperçu en direct.",
   "previewLabel": "APERÇU",

lib/l10n/app_it.arb

@@ -602,6 +602,7 @@
   "minHint": "Min",
   "maxHint": "Max",
   "orderAmountOutOfRange": "L'importo deve essere compreso tra {min} e {max} sats per questo nodo Mostro",
+  "orderAmountOutOfRangeFiat": "L'importo deve essere compreso tra {min} e {max} {currency} per questo nodo Mostro",
   "fiatAmountHint": "Importo fiat",
   "enterAmountForPreview": "Inserisci un importo per vedere un'anteprima in tempo reale.",
   "previewLabel": "ANTEPRIMA",

lib/shared/utils/order_amount_limits.dart

@@ -0,0 +1,92 @@
+import 'dart:math';
+
+import 'package:flutter/foundation.dart';
+
+/// Expresses a Mostro node's sats order limits in the fiat currency the user
+/// types in, so a market-price order can be checked before it is submitted
+/// (#337).
+///
+/// A market-price order carries no sats amount: the daemon derives one from
+/// the fiat amount at its own rate and rejects the order with
+/// `OutOfRangeSatsAmount` when the result falls outside
+/// `min_order_amount`/`max_order_amount`. Everything here mirrors that
+/// derivation so the client reaches the same verdict beforehand.
+
+/// Sats per BTC.
+const int _satsPerBtc = 100000000;
+
+/// The sats amount the daemon will price [fiat] at, given [rate] (the price of
+/// one BTC in that fiat).
+///
+/// Truncates rather than rounds, because that is what the daemon does:
+/// `(fiat_amount / price * 1E8) as i64` (`mostro/src/app/order.rs`). Rounding
+/// up would let the client accept an amount one sat below the node's minimum
+/// and still see it rejected — the exact surprise this check exists to remove.
+int satsFromFiat(double fiat, double rate) =>
+    (fiat / rate * _satsPerBtc).truncate();
+
+/// A node's sats limits converted to whole fiat units.
+@immutable
+class FiatAmountLimits {
+  const FiatAmountLimits({required this.minFiat, required this.maxFiat});
+
+  final int minFiat;
+  final int maxFiat;
+
+  /// Whether the range is worth showing. False when the node's whole valid
+  /// range collapses below one unit of fiat, leaving no enterable whole
+  /// number; callers then fall back to the raw sats bounds.
+  bool get isDisplayable => minFiat >= 1 && maxFiat >= minFiat;
+}
+
+/// Converts the node's sats limits to whole-fiat bounds at [rate].
+///
+/// The minimum rounds up and the maximum rounds down, so every whole number
+/// inside the returned range converts back to a sats amount inside the node's
+/// real range — a bound shown to the user is never itself rejected. The
+/// minimum is floored at 1 because the amount field takes whole numbers only.
+FiatAmountLimits fiatAmountLimits({
+  required int minSats,
+  required int maxSats,
+  required double rate,
+}) {
+  if (rate <= 0) return const FiatAmountLimits(minFiat: 0, maxFiat: 0);
+  return FiatAmountLimits(
+    minFiat: max(1, (minSats / _satsPerBtc * rate).ceil()),
+    maxFiat: (maxSats / _satsPerBtc * rate).floor(),
+  );
+}
+
+/// Returns the node's accepted range — in sats, and converted to fiat — when
+/// the entered market-price [fiatStr] prices outside it, otherwise null.
+///
+/// Pure and testable, like `satsOutOfNodeRange` in `add_order_screen.dart`,
+/// its fixed-sats counterpart. Fails open on everything it cannot
+/// judge: no rate ([rate] null or non-positive, i.e. the node publishes none),
+/// a node advertising only one bound, or an amount that is not a positive
+/// number. In those cases the daemon stays the only authority, exactly as it
+/// was before this check existed.
+({int minSats, int maxSats, FiatAmountLimits limits})? fiatOutOfNodeRange(
+  String fiatStr,
+  int? minOrder,
+  int? maxOrder,
+  double? rate,
+) {
+  if (minOrder == null || maxOrder == null) return null;
+  if (rate == null || rate <= 0) return null;
+  final fiat = double.tryParse(fiatStr.trim());
+  if (fiat == null || fiat <= 0) return null;
+
+  final sats = satsFromFiat(fiat, rate);
+  if (sats >= minOrder && sats <= maxOrder) return null;
+
+  return (
+    minSats: minOrder,
+    maxSats: maxOrder,
+    limits: fiatAmountLimits(
+      minSats: minOrder,
+      maxSats: maxOrder,
+      rate: rate,
+    ),
+  );
+}