@oneuptime/common 11.3.25 → 11.3.28

package/Types/OnCallDutyPolicy/RestrictionTimes.ts

@@ -111,8 +111,15 @@ export default class RestrictionTimes extends DatabaseProperty {
       "dayRestrictionTimes"
     ] as StartAndEndTime | null;
 
+    /*
+     * Fall back to an empty ARRAY, not an object. `|| {}` produced a non-array
+     * `{}` when the field was absent, which is truthy with an `undefined`
+     * `.length`, so Layer.getEventsByWeeklyRestriction's
+     * `!x || x.length === 0` guard passed through and `for (const w of {})`
+     * threw "not iterable", aborting event expansion for the layer (audit F20).
+     */
     const weeklyRestrictionTimes: Array<WeeklyResctriction> =
-      (data["weeklyRestrictionTimes"] as Array<WeeklyResctriction>) || {};
+      (data["weeklyRestrictionTimes"] as Array<WeeklyResctriction>) || [];
 
     restrictionTimes.weeklyRestrictionTimes = weeklyRestrictionTimes;
 
@@ -151,19 +158,38 @@ export default class RestrictionTimes extends DatabaseProperty {
   }
 
   public static getDefaultWeeklyRestrictionTIme(): WeeklyResctriction {
+    const startDay: DayOfWeek = DayOfWeek.Sunday;
+    const endDay: DayOfWeek = DayOfWeek.Monday;
+
+    /*
+     * Build the timestamps ON the named weekday. The rotation engine derives the
+     * ENFORCED weekday purely from the timestamp (getDayOfWeek(startTime)), NOT
+     * from startDay/endDay — so stamping TODAY's date (getDateWithCustomTime uses
+     * the current date) made an untouched default enforce coverage on TODAY's
+     * weekday while the dropdown still displayed Sunday -> Monday, i.e. the
+     * displayed config never matched who was actually on call (audit M4).
+     * moveDateToTheDayOfWeek keeps the time-of-day and moves to the target
+     * weekday, so timestamp, dropdown enum, preview and summary all agree.
+     */
+    const now: Date = OneUptimeDate.getCurrentDate();
+
+    const startTime: Date = OneUptimeDate.moveDateToTheDayOfWeek(
+      OneUptimeDate.getDateWithCustomTime({ hours: 0, minutes: 0, seconds: 0 }),
+      now,
+      startDay,
+    );
+
+    const endTime: Date = OneUptimeDate.moveDateToTheDayOfWeek(
+      OneUptimeDate.getDateWithCustomTime({ hours: 1, minutes: 0, seconds: 0 }),
+      now,
+      endDay,
+    );
+
     return {
-      startDay: DayOfWeek.Sunday,
-      endDay: DayOfWeek.Monday,
-      startTime: OneUptimeDate.getDateWithCustomTime({
-        hours: 0,
-        minutes: 0,
-        seconds: 0,
-      }),
-      endTime: OneUptimeDate.getDateWithCustomTime({
-        hours: 1,
-        minutes: 0,
-        seconds: 0,
-      }),
+      startDay,
+      endDay,
+      startTime,
+      endTime,
     };
   }
 

package/Types/OnCallDutyPolicy/UserOverrideUtil.ts

@@ -92,16 +92,32 @@ export default class UserOverrideUtil {
     event: CalendarEvent,
     override: UserOverrideRecord,
   ): Array<CalendarEvent> {
+    /*
+     * Overrides are non-transitive: an override must never act on a segment
+     * that is itself the RESULT of a previous override. Otherwise a chain
+     * (global A->B applied first, then B->C) would double-substitute the same
+     * window, and the resolved user would depend on override ordering. A
+     * segment produced by a prior override carries OVERRIDE_META_KEY, so we
+     * leave it untouched here.
+     */
+    if (UserOverrideUtil.getOverrideMeta(event)) {
+      return [event];
+    }
+
     if (event.title !== override.overrideUserId) {
       return [event];
     }
 
-    // Override window doesn't overlap event window at all.
+    /*
+     * Override window doesn't overlap event window at all. Use second-precision
+     * comparisons consistently (isOnOrAfter / isOnOrBefore) so a sub-second
+     * offset cannot slip past as "overlapping" and produce an inverted segment
+     * (previously isSame used millisecond precision while isAfter/isBefore used
+     * seconds, an inconsistent mix).
+     */
     if (
-      OneUptimeDate.isAfter(override.startsAt, event.end) ||
-      OneUptimeDate.isSame(override.startsAt, event.end) ||
-      OneUptimeDate.isBefore(override.endsAt, event.start) ||
-      OneUptimeDate.isSame(override.endsAt, event.start)
+      OneUptimeDate.isOnOrAfter(override.startsAt, event.end) ||
+      OneUptimeDate.isOnOrBefore(override.endsAt, event.start)
     ) {
       return [event];
     }

package/UI/Components/Events/RecurringFieldElement.tsx

@@ -45,6 +45,22 @@ const RecurringFieldElement: FunctionComponent<ComponentProps> = (
               valueNumber = parseInt(valueNumber.toString());
             }
 
+            /*
+             * Ignore transient invalid input (e.g. an empty field mid-edit) so
+             * we never persist NaN as the rotation interval, and enforce a
+             * whole-number minimum of 1. A 0 / NaN interval count previously
+             * broke the rotation handoff math.
+             */
+            if (!Number.isFinite(valueNumber) || isNaN(valueNumber)) {
+              return;
+            }
+
+            if (valueNumber < 1) {
+              valueNumber = 1;
+            }
+
+            valueNumber = Math.floor(valueNumber);
+
             let tempRecurring: Recurring | undefined = recurring;
 
             if (!tempRecurring) {

package/UI/Components/Header/HeaderIconDropdownButton.tsx

@@ -37,21 +37,28 @@ const HeaderIconDropdownButton: FunctionComponent<ComponentProps> = (
     setIsComponentVisible(Boolean(props.showDropdown));
   }, [props.showDropdown]);
 
+  const hasLabel: boolean = Boolean(props.title);
+  const hasDropdown: boolean = Boolean(props.children);
+
+  const sizeClassName: string = hasLabel
+    ? "h-9 gap-1.5 pl-2.5 pr-3"
+    : "h-9 w-9 justify-center";
+
   return (
-    <div className="relative ml-1 flex-shrink-0">
+    <div className="relative ml-2 flex-shrink-0">
       <div>
         <button
           type="button"
-          className="flex items-center justify-center h-9 w-9 rounded-lg bg-gray-50 border border-gray-200 hover:bg-gray-100 hover:border-gray-300 focus:outline-none focus:ring-2 focus:ring-indigo-500 focus:ring-offset-1 transition-all duration-150"
-          id="user-menu-button"
-          aria-expanded="false"
-          aria-haspopup="true"
+          className={`flex items-center rounded-lg border border-gray-200 bg-gray-50 hover:bg-gray-100 hover:border-gray-300 focus:outline-none focus:ring-2 focus:ring-indigo-500 focus:ring-offset-1 transition-all duration-150 ${sizeClassName}`}
+          id={hasDropdown ? "user-menu-button" : undefined}
+          aria-expanded={hasDropdown ? isDropdownVisible : undefined}
+          aria-haspopup={hasDropdown ? "true" : undefined}
           onClick={() => {
             props.onClick?.();
             setIsComponentVisible(!isDropdownVisible);
           }}
         >
-          <span className="sr-only">{props.name}</span>
+          {!hasLabel && <span className="sr-only">{props.name}</span>}
           {props.iconImageUrl && (
             <Image
               className="h-7 w-7 rounded-md object-cover"
@@ -63,14 +70,17 @@ const HeaderIconDropdownButton: FunctionComponent<ComponentProps> = (
             />
           )}
           {props.icon && (
-            <Icon className="h-5 w-5 text-gray-500" icon={props.icon} />
+            <Icon
+              className={`${hasLabel ? "h-4 w-4" : "h-5 w-5"} text-gray-500`}
+              icon={props.icon}
+            />
+          )}
+          {hasLabel && (
+            <span className="text-sm font-medium text-gray-700 whitespace-nowrap">
+              {props.title}
+            </span>
           )}
         </button>
-        {props.title && (
-          <span className="ml-2 text-sm font-medium text-gray-700">
-            {props.title}
-          </span>
-        )}
         {props.badge && props.badge > 0 && (
           <span className="absolute -top-1 -right-1 flex h-5 w-5 items-center justify-center rounded-full bg-red-500 text-xs font-semibold text-white ring-2 ring-white">
             {props.badge}

package/UI/Components/Markdown.tsx/MarkdownViewer.tsx

@@ -144,6 +144,14 @@ const MermaidDiagram: FunctionComponent<{ chart: string }> = ({
 
 export interface ComponentProps {
   text: string;
+  /*
+   * Hardened rendering for untrusted / LLM-generated content. When true, links
+   * render as non-clickable text and images are never fetched — both are
+   * neutralized on react-markdown's PARSED tree, so (unlike pre-processing the
+   * raw markdown with regexes) no CommonMark syntax trick can smuggle a
+   * clickable exfil link or a zero-click tracking pixel through.
+   */
+  safeMode?: boolean;
 }
 
 // Language display names
@@ -348,6 +356,9 @@ const extractTextFromChildren: (children: unknown) => string = (
 const MarkdownViewer: FunctionComponent<ComponentProps> = (
   props: ComponentProps,
 ): ReactElement => {
+  // Captured here because the component overrides below shadow `props`.
+  const safeMode: boolean = props.safeMode === true;
+
   return (
     <div className="max-w-none">
       <ReactMarkdown
@@ -409,19 +420,40 @@ const MarkdownViewer: FunctionComponent<ComponentProps> = (
               />
             );
           },
-          a: ({ ...props }: any) => {
+          a: ({ children, ...props }: any) => {
+            if (safeMode) {
+              // Keep the link text, drop the href: no navigation, no exfil.
+              return (
+                <span className="underline decoration-dotted text-gray-700 font-medium">
+                  {children}
+                </span>
+              );
+            }
             return (
               <a
                 className="underline text-blue-600 hover:text-blue-800 font-medium transition-colors"
                 {...props}
-              />
+              >
+                {children}
+              </a>
             );
           },
-          img: ({ ...props }: any) => {
+          img: ({ alt, ...props }: any) => {
+            if (safeMode) {
+              /*
+               * Never emit an <img> for untrusted content — the browser would
+               * fetch its src on render (a zero-click exfil channel). Show the
+               * alt text (already plain, React-escaped) instead.
+               */
+              return alt ? (
+                <span className="text-gray-500 italic">{`[image: ${alt}]`}</span>
+              ) : null;
+            }
             return (
               <img
                 className="max-w-full h-auto rounded-md border border-gray-200 my-3"
                 loading="lazy"
+                alt={alt}
                 {...props}
               />
             );

package/UI/Components/ModelFormModal/ModelFormModal.tsx

@@ -7,8 +7,10 @@ import ModelForm, {
   ComponentProps as ModelFormComponentProps,
 } from "../Forms/ModelForm";
 import FormValues from "../Forms/Types/FormValues";
+import { IconType } from "../Icon/Icon";
 import Modal, { ModalWidth } from "../Modal/Modal";
 import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import IconProp from "../../../Types/Icon/IconProp";
 import { JSONObject } from "../../../Types/JSON";
 import ObjectID from "../../../Types/ObjectID";
 import React, { MutableRefObject, ReactElement, useRef, useState } from "react";
@@ -31,6 +33,12 @@ export interface ComponentProps<TBaseModel extends BaseModel> {
     | ((item: TBaseModel, miscDataProps: JSONObject) => Promise<TBaseModel>)
     | undefined;
   footer?: ReactElement | undefined;
+  /*
+   * A header icon (rendered in a colored circle) to make the modal feel
+   * purpose-built. Forwarded to the underlying <Modal> via the props spread.
+   */
+  icon?: IconProp | undefined;
+  iconType?: IconType | undefined;
   formRef?: undefined | MutableRefObject<FormProps<FormValues<TBaseModel>>>;
 }
 

package/UI/Components/Page/Page.tsx

@@ -10,6 +10,12 @@ import React, { FunctionComponent, ReactElement, useEffect } from "react";
 
 export interface ComponentProps {
   title?: string | undefined;
+  /*
+   * Optional one-line subtitle rendered under the title. Use it to say what the
+   * page is for when the title alone is not self-explanatory. Kept optional so
+   * existing pages that carry their description in a content card are unchanged.
+   */
+  description?: string | undefined;
   breadcrumbLinks?: Array<Link> | undefined;
   children: Array<ReactElement> | ReactElement;
   sideMenu?: undefined | ReactElement;
@@ -25,6 +31,9 @@ const Page: FunctionComponent<ComponentProps> = (
 ): ReactElement => {
   const { translateString } = useTranslateValue();
   const translatedTitle: string | undefined = translateString(props.title);
+  const translatedDescription: string | undefined = translateString(
+    props.description,
+  );
 
   useEffect(() => {
     if (props.breadcrumbLinks && props.breadcrumbLinks.length > 0) {
@@ -92,6 +101,11 @@ const Page: FunctionComponent<ComponentProps> = (
                   <h1 className="text-xl font-semibold leading-7 text-gray-900 sm:text-xl sm:tracking-tight sm:truncate">
                     {translatedTitle}
                   </h1>
+                  {translatedDescription && (
+                    <p className="max-w-3xl text-sm leading-6 text-gray-500">
+                      {translatedDescription}
+                    </p>
+                  )}
                 </div>
                 {props.headerRight && (
                   <div className="flex flex-wrap items-center sm:justify-end gap-3">

package/UI/Components/RadioButtons/BasicRadioButtons.tsx

@@ -60,7 +60,7 @@ const BasicRadioButton: FunctionComponent<ComponentProps> = (
                       type="radio"
                       name={id}
                       checked={checked}
-                      onClick={() => {
+                      onChange={() => {
                         handleChange(radioButton.value);
                       }}
                       className="h-4 w-4 border-gray-300 text-indigo-600 focus:ring-indigo-600"

package/UI/Utils/LlmTypeDropdownOptions.ts

@@ -0,0 +1,40 @@
+import { DropdownOption } from "../Components/Dropdown/Dropdown";
+import LlmType from "../../Types/LLM/LlmType";
+
+/*
+ * Human-friendly display labels for each LLM provider. The dropdown `value`
+ * remains the raw LlmType enum value (which is persisted in the database), so
+ * only the label shown to the user changes.
+ */
+const LlmTypeDropdownOptions: Array<DropdownOption> = [
+  {
+    label: "OpenAI",
+    value: LlmType.OpenAI,
+  },
+  {
+    label: "Azure OpenAI",
+    value: LlmType.AzureOpenAI,
+  },
+  {
+    label: "Anthropic",
+    value: LlmType.Anthropic,
+  },
+  {
+    label: "Groq",
+    value: LlmType.Groq,
+  },
+  {
+    label: "Mistral",
+    value: LlmType.Mistral,
+  },
+  {
+    label: "Ollama",
+    value: LlmType.Ollama,
+  },
+  {
+    label: "OpenAI-Compatible (vLLM, LocalAI, etc.)",
+    value: LlmType.OpenAICompatible,
+  },
+];
+
+export default LlmTypeDropdownOptions;

package/UI/Utils/TestLLMProvider.ts

@@ -0,0 +1,59 @@
+import URL from "../../Types/API/URL";
+import Dictionary from "../../Types/Dictionary";
+import HTTPErrorResponse from "../../Types/API/HTTPErrorResponse";
+import HTTPResponse from "../../Types/API/HTTPResponse";
+import { JSONObject } from "../../Types/JSON";
+import { APP_API_URL } from "../Config";
+import API from "./API/API";
+
+export interface LLMProviderTestResult {
+  success: boolean;
+  message: string;
+}
+
+export default class TestLLMProvider {
+  /*
+   * Sends a small test prompt to an LLM provider (by id) via the
+   * /llm-provider/test endpoint and returns a friendly success/failure result.
+   * Callers pass the appropriate common headers (project tenant header for
+   * project providers, or none for admin/global providers).
+   */
+  public static async test(data: {
+    llmProviderId: string;
+    headers?: Dictionary<string> | undefined;
+  }): Promise<LLMProviderTestResult> {
+    try {
+      const response: HTTPResponse<JSONObject> | HTTPErrorResponse =
+        await API.post({
+          url: URL.fromString(APP_API_URL.toString()).addRoute(
+            "/llm-provider/test",
+          ),
+          data: {
+            llmProviderId: data.llmProviderId,
+          },
+          ...(data.headers ? { headers: data.headers } : {}),
+        });
+
+      if (response.isFailure()) {
+        return {
+          success: false,
+          message: API.getFriendlyMessage(response),
+        };
+      }
+
+      const responseData: JSONObject = response.data as JSONObject;
+
+      return {
+        success: true,
+        message:
+          (responseData["message"] as string) ||
+          "Connection successful. The LLM provider responded to a test prompt.",
+      };
+    } catch (err) {
+      return {
+        success: false,
+        message: API.getFriendlyMessage(err),
+      };
+    }
+  }
+}