@oneuptime/common 11.3.26 → 11.4.0

package/build/dist/Server/Services/OnCallDutyPolicyScheduleService.js

@@ -16,6 +16,8 @@ import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import OneUptimeDate from "../../Types/Date";
 import ObjectID from "../../Types/ObjectID";
 import LayerUtil from "../../Types/OnCallDutyPolicy/Layer";
+import { RestrictionType } from "../../Types/OnCallDutyPolicy/RestrictionTimes";
+import Recurring from "../../Types/Events/Recurring";
 import UserOverrideUtil from "../../Types/OnCallDutyPolicy/UserOverrideUtil";
 import QueryHelper from "../Types/Database/QueryHelper";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
@@ -29,6 +31,7 @@ import NotificationSettingEventType from "../../Types/NotificationSetting/Notifi
 import BadDataException from "../../Types/Exception/BadDataException";
 import Timezone from "../../Types/Timezone";
 import logger from "../Utils/Logger";
+import Semaphore from "../Infrastructure/Semaphore";
 import OnCallDutyPolicyFeedService from "./OnCallDutyPolicyFeedService";
 import { OnCallDutyPolicyFeedEventType } from "../../Models/DatabaseModels/OnCallDutyPolicyFeed";
 import { Green500 } from "../../Types/BrandColors";
@@ -111,7 +114,7 @@ export class Service extends DatabaseService {
     }
     async sendNotificationToUserOnScheduleHandoff(data) {
         // Before we send any notification, we need to check if this schedule is attached to any on-call policy.
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2, _3, _4, _5, _6;
         const escalationRulesAttachedToSchedule = await OnCallDutyPolicyEscalationRuleScheduleService.findBy({
             query: {
                 onCallDutyPolicyScheduleId: data.scheduleId,
@@ -275,14 +278,24 @@ export class Service extends DatabaseService {
                         },
                     });
                 }
-                if ((_m = newInformation.currentUserIdOnRoster) === null || _m === void 0 ? void 0 : _m.toString()) {
+                /*
+                 * Only notify "you are now on-call" when the current user ACTUALLY
+                 * changed — not merely when the handoff time changed. The enclosing
+                 * guard also fires on a rosterHandoffAt change, which happens every
+                 * rotation period; without this user-changed check a continuing (e.g.
+                 * single-user) roster was re-sent the full email + SMS + phone call +
+                 * push + WhatsApp bundle every period. Mirrors the removal branch above.
+                 */
+                if (((_m = previousInformation.currentUserIdOnRoster) === null || _m === void 0 ? void 0 : _m.toString()) !==
+                    ((_o = newInformation.currentUserIdOnRoster) === null || _o === void 0 ? void 0 : _o.toString()) &&
+                    ((_p = newInformation.currentUserIdOnRoster) === null || _p === void 0 ? void 0 : _p.toString())) {
                     // send email to the new current user.
                     const sendEmailToUserId = newInformation.currentUserIdOnRoster;
                     const userTimezone = await UserService.getTimezoneForUser(sendEmailToUserId);
                     const vars = {
                         onCallPolicyName: onCallPolicy.name || "No name provided",
                         escalationRuleName: onCallDutyPolicyEscalationRule.name || "No name provided",
-                        escalationRuleOrder: ((_o = onCallDutyPolicyEscalationRule.order) === null || _o === void 0 ? void 0 : _o.toString()) || "-",
+                        escalationRuleOrder: ((_q = onCallDutyPolicyEscalationRule.order) === null || _q === void 0 ? void 0 : _q.toString()) || "-",
                         reason: "You are now on-call for the policy " +
                             onCallPolicy.name +
                             " because your on-call roster on schedule " +
@@ -371,7 +384,7 @@ export class Service extends DatabaseService {
                         feedInfoInMarkdown: `📞 **${await UserService.getUserMarkdownString({
                             userId: sendEmailToUserId,
                             projectId: projectId,
-                        })}** is currently on call for [On-Call Policy ${(_p = escalationRule.onCallDutyPolicy) === null || _p === void 0 ? void 0 : _p.name}](${(await OnCallDutyPolicyService.getOnCallDutyPolicyLinkInDashboard(projectId, onCallDutyPolicyId)).toString()}) escalation rule **${(_q = escalationRule.onCallDutyPolicyEscalationRule) === null || _q === void 0 ? void 0 : _q.name}** with order **${(_r = escalationRule.onCallDutyPolicyEscalationRule) === null || _r === void 0 ? void 0 : _r.order}** because of schedule **${onCallSchedule.name}** and your on-call roster starts at **${OneUptimeDate.getDateAsFormattedStringInMultipleTimezones({
+                        })}** is currently on call for [On-Call Policy ${(_r = escalationRule.onCallDutyPolicy) === null || _r === void 0 ? void 0 : _r.name}](${(await OnCallDutyPolicyService.getOnCallDutyPolicyLinkInDashboard(projectId, onCallDutyPolicyId)).toString()}) escalation rule **${(_s = escalationRule.onCallDutyPolicyEscalationRule) === null || _s === void 0 ? void 0 : _s.name}** with order **${(_t = escalationRule.onCallDutyPolicyEscalationRule) === null || _t === void 0 ? void 0 : _t.order}** because of schedule **${onCallSchedule.name}** and your on-call roster starts at **${OneUptimeDate.getDateAsFormattedStringInMultipleTimezones({
                             date: newInformation.rosterStartAt,
                             timezones: userTimezone ? [userTimezone] : [Timezone.GMT],
                         })}** and ends at **${OneUptimeDate.getDateAsFormattedStringInMultipleTimezones({
@@ -387,20 +400,31 @@ export class Service extends DatabaseService {
                 }
             }
             // send an email to the next user.
-            if (((_s = previousInformation.nextUserIdOnRoster) === null || _s === void 0 ? void 0 : _s.toString()) !==
-                ((_t = newInformation.nextUserIdOnRoster) === null || _t === void 0 ? void 0 : _t.toString()) ||
-                ((_u = previousInformation.nextHandOffTimeAt) === null || _u === void 0 ? void 0 : _u.toString()) !==
-                    ((_v = newInformation.nextHandOffTimeAt) === null || _v === void 0 ? void 0 : _v.toString()) ||
-                ((_w = previousInformation.nextRosterStartAt) === null || _w === void 0 ? void 0 : _w.toString()) !==
-                    ((_x = newInformation.nextRosterStartAt) === null || _x === void 0 ? void 0 : _x.toString())) {
-                if ((_y = newInformation.nextUserIdOnRoster) === null || _y === void 0 ? void 0 : _y.toString()) {
+            if (((_u = previousInformation.nextUserIdOnRoster) === null || _u === void 0 ? void 0 : _u.toString()) !==
+                ((_v = newInformation.nextUserIdOnRoster) === null || _v === void 0 ? void 0 : _v.toString()) ||
+                ((_w = previousInformation.nextHandOffTimeAt) === null || _w === void 0 ? void 0 : _w.toString()) !==
+                    ((_x = newInformation.nextHandOffTimeAt) === null || _x === void 0 ? void 0 : _x.toString()) ||
+                ((_y = previousInformation.nextRosterStartAt) === null || _y === void 0 ? void 0 : _y.toString()) !==
+                    ((_z = newInformation.nextRosterStartAt) === null || _z === void 0 ? void 0 : _z.toString())) {
+                /*
+                 * Only notify "you are next on-call" when the next user ACTUALLY
+                 * changed — not merely when the next handoff/start time advanced. The
+                 * enclosing guard also fires when nextHandOffTimeAt / nextRosterStartAt
+                 * change, which happens every rotation period; without this
+                 * user-changed check a continuing (e.g. single-user) roster re-sent the
+                 * full email + SMS + phone call + push + WhatsApp bundle every period.
+                 * Mirrors the current-user "now on-call" branch above.
+                 */
+                if (((_0 = previousInformation.nextUserIdOnRoster) === null || _0 === void 0 ? void 0 : _0.toString()) !==
+                    ((_1 = newInformation.nextUserIdOnRoster) === null || _1 === void 0 ? void 0 : _1.toString()) &&
+                    ((_2 = newInformation.nextUserIdOnRoster) === null || _2 === void 0 ? void 0 : _2.toString())) {
                     // send email to the next user.
                     const sendEmailToUserId = newInformation.nextUserIdOnRoster;
                     const userTimezone = await UserService.getTimezoneForUser(sendEmailToUserId);
                     const vars = {
                         onCallPolicyName: onCallPolicy.name || "No name provided",
                         escalationRuleName: onCallDutyPolicyEscalationRule.name || "No name provided",
-                        escalationRuleOrder: ((_z = onCallDutyPolicyEscalationRule.order) === null || _z === void 0 ? void 0 : _z.toString()) || "-",
+                        escalationRuleOrder: ((_3 = onCallDutyPolicyEscalationRule.order) === null || _3 === void 0 ? void 0 : _3.toString()) || "-",
                         reason: "You are next on-call for the policy " +
                             onCallPolicy.name +
                             " because your on-call roster on schedule " +
@@ -469,7 +493,7 @@ export class Service extends DatabaseService {
                         feedInfoInMarkdown: `➡️ **${await UserService.getUserMarkdownString({
                             userId: sendEmailToUserId,
                             projectId: projectId,
-                        })}** is next on call for [On-Call Policy ${(_0 = escalationRule.onCallDutyPolicy) === null || _0 === void 0 ? void 0 : _0.name}](${(await OnCallDutyPolicyService.getOnCallDutyPolicyLinkInDashboard(projectId, onCallDutyPolicyId)).toString()}) escalation rule **${(_1 = escalationRule.onCallDutyPolicyEscalationRule) === null || _1 === void 0 ? void 0 : _1.name}** with order **${(_2 = escalationRule.onCallDutyPolicyEscalationRule) === null || _2 === void 0 ? void 0 : _2.order}**. The on-call roster on schedule **${onCallSchedule.name}** will start when the next handoff happens which is at **${OneUptimeDate.getDateAsFormattedStringInMultipleTimezones({
+                        })}** is next on call for [On-Call Policy ${(_4 = escalationRule.onCallDutyPolicy) === null || _4 === void 0 ? void 0 : _4.name}](${(await OnCallDutyPolicyService.getOnCallDutyPolicyLinkInDashboard(projectId, onCallDutyPolicyId)).toString()}) escalation rule **${(_5 = escalationRule.onCallDutyPolicyEscalationRule) === null || _5 === void 0 ? void 0 : _5.name}** with order **${(_6 = escalationRule.onCallDutyPolicyEscalationRule) === null || _6 === void 0 ? void 0 : _6.order}**. The on-call roster on schedule **${onCallSchedule.name}** will start when the next handoff happens which is at **${OneUptimeDate.getDateAsFormattedStringInMultipleTimezones({
                             date: newInformation.nextRosterStartAt,
                             timezones: userTimezone ? [userTimezone] : [Timezone.GMT],
                         })}** and will end at **${OneUptimeDate.getDateAsFormattedStringInMultipleTimezones({
@@ -487,6 +511,50 @@ export class Service extends DatabaseService {
         }
     }
     async refreshCurrentUserIdAndHandoffTimeInSchedule(scheduleId) {
+        /*
+         * Serialize per-schedule refreshes across processes (audit L2). This method
+         * reads the persisted roster, diffs it, SENDS the handoff notification
+         * bundle + feed items, and only THEN persists — notifying before persisting
+         * is deliberate (audit F11). Without a lock the override-triggered refresh
+         * (API process) and the EVERY_MINUTE RefreshHandoffTime cron (Workers
+         * process) can both read the same stale roster and both send the full page
+         * before either persists, double-paging the incoming user. A blocking
+         * per-schedule mutex makes the second caller wait, then read the
+         * already-persisted new roster and diff to "no change" -> no duplicate page.
+         * Best-effort: if the lock cannot be acquired (Redis unavailable, or the
+         * acquire window is exceeded) we proceed unlocked — no worse than before.
+         */
+        let mutex = null;
+        try {
+            mutex = await Semaphore.lock({
+                key: scheduleId.toString(),
+                namespace: "OnCallDutyPolicyScheduleService.refreshRoster",
+                lockTimeout: 60000,
+                acquireTimeout: 15000,
+                retryInterval: 200,
+                acquireAttemptsLimit: 100,
+            });
+        }
+        catch (err) {
+            logger.debug("Proceeding with roster refresh without a per-schedule lock (could not acquire) for scheduleId: " +
+                scheduleId.toString());
+            logger.debug(err);
+        }
+        try {
+            return await this.refreshCurrentUserIdAndHandoffTimeInScheduleInternal(scheduleId);
+        }
+        finally {
+            if (mutex) {
+                try {
+                    await Semaphore.release(mutex);
+                }
+                catch (err) {
+                    logger.error(err);
+                }
+            }
+        }
+    }
+    async refreshCurrentUserIdAndHandoffTimeInScheduleInternal(scheduleId) {
         logger.debug("refreshCurrentUserIdAndHandoffTimeInSchedule called with scheduleId: " +
             scheduleId.toString(), { onCallDutyPolicyScheduleId: scheduleId.toString() });
         // get previoius result.
@@ -525,10 +593,51 @@ export class Service extends DatabaseService {
         });
         logger.debug("Fetching new schedule information for scheduleId: " +
             scheduleId.toString(), { onCallDutyPolicyScheduleId: scheduleId.toString() });
-        const newInformation = await this.getCurrrentUserIdAndHandoffTimeInSchedule(scheduleId);
+        /*
+         * When this schedule is attached to exactly one on-call policy, resolve the
+         * roster in that policy's context so its policy-scoped overrides are
+         * reflected in the persisted roster, handoff notifications and time logs —
+         * matching the live paging path, which already passes the policy id (audit
+         * F10). Attached to zero or multiple policies, the roster stays
+         * policy-agnostic (global overrides only), because a single schedule-level
+         * roster cannot represent divergent per-policy overrides.
+         */
+        const singleAttachedPolicyId = await this.getSingleAttachedPolicyId(scheduleId);
+        const newInformation = await this.getCurrrentUserIdAndHandoffTimeInSchedule(scheduleId, {
+            onCallDutyPolicyId: singleAttachedPolicyId,
+        });
         logger.debug(newInformation, {
             onCallDutyPolicyScheduleId: scheduleId.toString(),
         });
+        logger.debug("Updating schedule with new information for scheduleId: " +
+            scheduleId.toString(), { onCallDutyPolicyScheduleId: scheduleId.toString() });
+        logger.debug("Sending notifications for schedule handoff for scheduleId: " +
+            scheduleId.toString(), { onCallDutyPolicyScheduleId: scheduleId.toString() });
+        /*
+         * Send the handoff notification BEFORE persisting the new roster. The
+         * decision to notify is a diff of the persisted-previous vs new roster; if
+         * we persisted first and the notification then threw (a transient DB error
+         * in the notification-settings / timezone lookup, or a partial send), the
+         * row would already show the new user, so the next tick's diff would show
+         * "no change" and the newly-on-call user would NEVER be told they are on
+         * call — the handoff page would be silently and permanently lost (audit
+         * F11). By notifying first, a failed send leaves the roster un-advanced, so
+         * the schedule is re-selected next tick and the notification is retried
+         * (at worst a duplicate send, which is far better than a missed page for an
+         * on-call system).
+         */
+        await this.sendNotificationToUserOnScheduleHandoff({
+            scheduleId: scheduleId,
+            previousInformation: previousInformation,
+            newInformation: {
+                currentUserIdOnRoster: newInformation.currentUserId,
+                rosterHandoffAt: newInformation.handOffTimeAt,
+                nextUserIdOnRoster: newInformation.nextUserId,
+                nextHandOffTimeAt: newInformation.nextHandOffTimeAt,
+                rosterStartAt: newInformation.rosterStartAt,
+                nextRosterStartAt: newInformation.nextRosterStartAt,
+            },
+        });
         logger.debug("Updating schedule with new information for scheduleId: " +
             scheduleId.toString(), { onCallDutyPolicyScheduleId: scheduleId.toString() });
         await this.updateOneById({
@@ -546,26 +655,11 @@ export class Service extends DatabaseService {
                 ignoreHooks: true,
             },
         });
-        logger.debug("Sending notifications for schedule handoff for scheduleId: " +
-            scheduleId.toString(), { onCallDutyPolicyScheduleId: scheduleId.toString() });
-        // send notification to the users.
-        await this.sendNotificationToUserOnScheduleHandoff({
-            scheduleId: scheduleId,
-            previousInformation: previousInformation,
-            newInformation: {
-                currentUserIdOnRoster: newInformation.currentUserId,
-                rosterHandoffAt: newInformation.handOffTimeAt,
-                nextUserIdOnRoster: newInformation.nextUserId,
-                nextHandOffTimeAt: newInformation.nextHandOffTimeAt,
-                rosterStartAt: newInformation.rosterStartAt,
-                nextRosterStartAt: newInformation.nextRosterStartAt,
-            },
-        });
         logger.debug("Returning new schedule information for scheduleId: " +
             scheduleId.toString(), { onCallDutyPolicyScheduleId: scheduleId.toString() });
         return newInformation;
     }
-    async getCurrrentUserIdAndHandoffTimeInSchedule(scheduleId) {
+    async getCurrrentUserIdAndHandoffTimeInSchedule(scheduleId, options) {
         logger.debug("getCurrrentUserIdAndHandoffTimeInSchedule called with scheduleId: " +
             scheduleId.toString(), { onCallDutyPolicyScheduleId: scheduleId.toString() });
         const resultReturn = {
@@ -582,6 +676,7 @@ export class Service extends DatabaseService {
         const events = await this.getEventByIndexInSchedule({
             scheduleId: scheduleId,
             getNumberOfEvents: 2,
+            onCallDutyPolicyId: options === null || options === void 0 ? void 0 : options.onCallDutyPolicyId,
         });
         logger.debug("Events fetched: " + JSON.stringify(events), {
             onCallDutyPolicyScheduleId: scheduleId.toString(),
@@ -620,10 +715,28 @@ export class Service extends DatabaseService {
             // get start time
             const startTime = currentEvent === null || currentEvent === void 0 ? void 0 : currentEvent.start; // this is user id in string.
             if (startTime) {
-                logger.debug("Current rosterStartAt: " + startTime.toISOString(), {
+                logger.debug("Current rosterStartAt (clamped): " + startTime.toISOString(), {
                     onCallDutyPolicyScheduleId: scheduleId.toString(),
                 });
-                resultReturn.rosterStartAt = startTime;
+                /*
+                 * currentEvent.start is clamped to the resolution window start (now).
+                 * Recover the true start of the current coverage window so the
+                 * persisted/displayed "on call since" reflects when the shift actually
+                 * began, not ~now (audit F12). Best-effort with a fallback to the
+                 * clamped value.
+                 */
+                if (resultReturn.currentUserId) {
+                    resultReturn.rosterStartAt = await this.getTrueRosterStartAt({
+                        scheduleId: scheduleId,
+                        currentUserId: resultReturn.currentUserId,
+                        now: OneUptimeDate.getCurrentDate(),
+                        onCallDutyPolicyId: options === null || options === void 0 ? void 0 : options.onCallDutyPolicyId,
+                        fallbackStart: startTime,
+                    });
+                }
+                else {
+                    resultReturn.rosterStartAt = startTime;
+                }
             }
         }
         // do the same for next event.
@@ -660,9 +773,85 @@ export class Service extends DatabaseService {
         });
         return resultReturn;
     }
+    /*
+     * Returns the on-call policy this schedule is attached to IFF it is attached
+     * to exactly one; otherwise undefined (audit F10). A lazy require avoids a
+     * circular import — OnCallDutyPolicyEscalationRuleScheduleService imports this
+     * service.
+     */
+    async getSingleAttachedPolicyId(scheduleId) {
+        var _a;
+        try {
+            const escalationRuleScheduleService = require("./OnCallDutyPolicyEscalationRuleScheduleService").default;
+            const links = await escalationRuleScheduleService.findBy({
+                query: { onCallDutyPolicyScheduleId: scheduleId },
+                select: { onCallDutyPolicyId: true },
+                limit: LIMIT_PER_PROJECT,
+                skip: 0,
+                props: { isRoot: true },
+            });
+            const distinctPolicyIds = new Set();
+            for (const link of links) {
+                const policyId = (_a = link.onCallDutyPolicyId) === null || _a === void 0 ? void 0 : _a.toString();
+                if (policyId) {
+                    distinctPolicyIds.add(policyId);
+                }
+            }
+            if (distinctPolicyIds.size === 1) {
+                return new ObjectID(Array.from(distinctPolicyIds)[0]);
+            }
+        }
+        catch (err) {
+            logger.error(err);
+        }
+        return undefined;
+    }
+    /**
+     * Re-resolve and persist the roster for every schedule in the project whose
+     * layers include `userId`. Called when a user override is created / updated /
+     * deleted so the persisted roster, handoff notifications and on-call time logs
+     * reflect the override mid-period instead of waiting for the next natural
+     * handoff or the per-minute cron (which does not re-select an established
+     * roster) — audit F4. Best-effort and idempotent: refreshing an unaffected
+     * schedule simply recomputes the same roster; per-schedule errors are logged
+     * and never abort the rest.
+     */
+    async refreshRostersForUserInProject(data) {
+        var _a;
+        const layerUsers = await OnCallDutyPolicyScheduleLayerUserService.findBy({
+            query: {
+                projectId: data.projectId,
+                userId: data.userId,
+            },
+            select: {
+                onCallDutyPolicyScheduleId: true,
+            },
+            limit: LIMIT_PER_PROJECT,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+        const scheduleIds = new Set();
+        for (const layerUser of layerUsers) {
+            const scheduleId = (_a = layerUser.onCallDutyPolicyScheduleId) === null || _a === void 0 ? void 0 : _a.toString();
+            if (scheduleId) {
+                scheduleIds.add(scheduleId);
+            }
+        }
+        for (const scheduleId of scheduleIds) {
+            try {
+                await this.refreshCurrentUserIdAndHandoffTimeInSchedule(new ObjectID(scheduleId));
+            }
+            catch (err) {
+                logger.error(`Error refreshing roster for schedule ${scheduleId} after a user override change.`);
+                logger.error(err);
+            }
+        }
+    }
     async getScheduleLayerProps(data) {
         // get schedule layers.
-        var _a, _b;
+        var _a, _b, _c;
         const scheduleId = data.scheduleId;
         const layers = await OnCallDutyPolicyScheduleLayerService.findBy({
             query: {
@@ -706,6 +895,21 @@ export class Service extends DatabaseService {
                 isRoot: true,
             },
         });
+        /*
+         * The schedule's timezone (if set) is applied to every layer so restriction
+         * wall-clock times resolve in that zone. When null (existing schedules), the
+         * layer engine falls back to server-local time — unchanged legacy behavior.
+         */
+        const schedule = await this.findOneById({
+            id: scheduleId,
+            select: {
+                timezone: true,
+            },
+            props: {
+                isRoot: true,
+            },
+        });
+        const scheduleTimezone = ((_a = schedule === null || schedule === void 0 ? void 0 : schedule.timezone) === null || _a === void 0 ? void 0 : _a.toString()) || undefined;
         const layerProps = [];
         const scheduleUserIds = [];
         const seenUserIds = new Set();
@@ -723,7 +927,7 @@ export class Service extends DatabaseService {
                 return Boolean(user);
             });
             for (const user of usersForLayer) {
-                const idStr = ((_a = user.id) === null || _a === void 0 ? void 0 : _a.toString()) || "";
+                const idStr = ((_b = user.id) === null || _b === void 0 ? void 0 : _b.toString()) || "";
                 if (idStr && !seenUserIds.has(idStr)) {
                     seenUserIds.add(idStr);
                     scheduleUserIds.push(user.id);
@@ -735,9 +939,10 @@ export class Service extends DatabaseService {
                 restrictionTimes: layer.restrictionTimes,
                 rotation: layer.rotation,
                 handOffTime: layer.handOffTime,
+                timezone: scheduleTimezone,
             });
         }
-        const projectId = ((_b = layers[0]) === null || _b === void 0 ? void 0 : _b.projectId) || null;
+        const projectId = ((_c = layers[0]) === null || _c === void 0 ? void 0 : _c.projectId) || null;
         return { layerProps, projectId, scheduleUserIds };
     }
     async fetchOverridesForSchedule(data) {
@@ -796,6 +1001,166 @@ export class Service extends DatabaseService {
             };
         });
     }
+    /*
+     * Compute how far out to resolve calendar events. Returns at least 1 year
+     * from `from`, but extends far enough to contain (getNumberOfEvents + 1)
+     * rotation periods for the slowest layer, so multi-year rotations still yield
+     * a current and next event.
+     */
+    computeResolutionWindowEnd(layerProps, from, getNumberOfEvents) {
+        const periodsNeeded = Math.max(2, getNumberOfEvents + 1);
+        let windowEnd = from;
+        let anyLayerRestricted = false;
+        for (const layer of layerProps) {
+            if (this.isLayerRestricted(layer)) {
+                anyLayerRestricted = true;
+            }
+            if (!layer.rotation) {
+                continue;
+            }
+            let recurring;
+            try {
+                recurring =
+                    layer.rotation instanceof Recurring
+                        ? layer.rotation
+                        : Recurring.fromJSON(layer.rotation);
+            }
+            catch (_a) {
+                continue;
+            }
+            let candidate = from;
+            for (let i = 0; i < periodsNeeded; i++) {
+                candidate = Recurring.getNextDateInterval(candidate, recurring);
+            }
+            if (OneUptimeDate.isAfter(candidate, windowEnd)) {
+                windowEnd = candidate;
+            }
+        }
+        /*
+         * Floor the window. Restricted layers can have long coverage gaps (a
+         * weekend-only or business-hours restriction), so the next COVERED event may
+         * be far past the naive (getNumberOfEvents + 1)-period horizon — keep a
+         * generous 1-year floor for them so a current/next user is still found.
+         * UNRESTRICTED layers produce exactly one event per rotation period, so the
+         * per-layer candidate above already spans the events we need; flooring those
+         * at a full year forced a fast (hourly/daily) rotation to materialize
+         * thousands of events on every resolution, and getMultiLayerEvents then ran
+         * an O(n^2) overlap merge over them — a real worker stall (audit H2). For
+         * unrestricted layers a small 1-day floor is ample margin.
+         */
+        const floor = anyLayerRestricted
+            ? OneUptimeDate.addRemoveYears(from, 1)
+            : OneUptimeDate.addRemoveDays(from, 1);
+        if (OneUptimeDate.isBefore(windowEnd, floor)) {
+            windowEnd = floor;
+        }
+        return windowEnd;
+    }
+    /*
+     * True when the layer carries an active (non-None) restriction. Handles both a
+     * hydrated RestrictionTimes instance (exposes `restictionType`) and the raw
+     * serialized JSON form ({ _type, value: { restictionType } }) so it is safe
+     * regardless of where the LayerProps came from.
+     */
+    isLayerRestricted(layer) {
+        var _a;
+        const rt = layer.restrictionTimes;
+        if (!rt) {
+            return false;
+        }
+        const anyRt = rt;
+        const type = anyRt.restictionType || ((_a = anyRt.value) === null || _a === void 0 ? void 0 : _a.restictionType);
+        return Boolean(type) && type !== RestrictionType.None;
+    }
+    /*
+     * Mirror of computeResolutionWindowEnd, stepping BACKWARDS: the earliest of
+     * `from` minus `periodsBack` rotation periods across the layers (at least a
+     * day). Used to recover the true, un-clamped start of the current coverage
+     * window for rosterStartAt (audit F12).
+     */
+    computeResolutionWindowStart(layerProps, from, periodsBack) {
+        let windowStart = OneUptimeDate.addRemoveDays(from, -1);
+        for (const layer of layerProps) {
+            if (!layer.rotation) {
+                continue;
+            }
+            let recurring;
+            try {
+                recurring =
+                    layer.rotation instanceof Recurring
+                        ? layer.rotation
+                        : Recurring.fromJSON(layer.rotation);
+            }
+            catch (_a) {
+                continue;
+            }
+            let candidate = from;
+            for (let i = 0; i < periodsBack; i++) {
+                candidate = Recurring.getNextDateInterval(candidate, recurring, true);
+            }
+            if (OneUptimeDate.isBefore(candidate, windowStart)) {
+                windowStart = candidate;
+            }
+        }
+        return windowStart;
+    }
+    /*
+     * Recover the TRUE start of the current on-call coverage window for
+     * `currentUserId`. getEventByIndexInSchedule always expands from `now`, and
+     * LayerUtil clamps the first event's start to the window start, so the current
+     * event's start reads ~now rather than when the shift actually began. We
+     * re-expand over a bounded lookback window and return the start of the segment
+     * that covers `now` for the current user. Best-effort: any failure (or no
+     * covering segment found) falls back to the clamped value, so the who-is-paged
+     * path is never affected (audit F12).
+     */
+    async getTrueRosterStartAt(data) {
+        var _a;
+        try {
+            const { layerProps, projectId, scheduleUserIds } = await this.getScheduleLayerProps({ scheduleId: data.scheduleId });
+            if (layerProps.length === 0) {
+                return data.fallbackStart;
+            }
+            const windowStart = this.computeResolutionWindowStart(layerProps, data.now, 2);
+            const windowEnd = OneUptimeDate.addRemoveSeconds(data.now, 1);
+            let events = this.layerUtil.getMultiLayerEvents({
+                layers: layerProps,
+                calendarStartDate: windowStart,
+                calendarEndDate: windowEnd,
+            });
+            if (projectId && events.length > 0) {
+                const overrides = await this.fetchOverridesForSchedule({
+                    projectId,
+                    scheduleUserIds,
+                    windowStart,
+                    windowEnd,
+                    currentOnCallDutyPolicyId: data.onCallDutyPolicyId,
+                });
+                if (overrides.length > 0) {
+                    events = UserOverrideUtil.applyOverridesToEvents({
+                        events,
+                        overrides,
+                        currentOnCallDutyPolicyId: (_a = data.onCallDutyPolicyId) === null || _a === void 0 ? void 0 : _a.toString(),
+                    });
+                }
+            }
+            const currentUserIdStr = data.currentUserId.toString();
+            for (const event of events) {
+                if (!event) {
+                    continue;
+                }
+                if (event.title === currentUserIdStr &&
+                    OneUptimeDate.isOnOrBefore(event.start, data.now) &&
+                    OneUptimeDate.isOnOrAfter(event.end, data.now)) {
+                    return event.start;
+                }
+            }
+        }
+        catch (err) {
+            logger.error(err);
+        }
+        return data.fallbackStart;
+    }
     async getEventByIndexInSchedule(data) {
         var _a;
         logger.debug("getEventByIndexInSchedule called with data: " + JSON.stringify(data), {
@@ -817,7 +1182,15 @@ export class Service extends DatabaseService {
         logger.debug("Current start time: " + currentStartTime.toISOString(), {
             onCallDutyPolicyScheduleId: data.scheduleId.toString(),
         });
-        const currentEndTime = OneUptimeDate.addRemoveYears(currentStartTime, 1);
+        /*
+         * Size the resolution window from the layers' rotations rather than a fixed
+         * 1 year. A rotation period longer than a year (e.g. a 3-year rotation)
+         * would otherwise clamp the current event's end to now+1yr and report a
+         * bogus handoff time with no "next" user. The window is at least 1 year and
+         * large enough to contain the requested number of events for the slowest
+         * layer.
+         */
+        const currentEndTime = this.computeResolutionWindowEnd(layerProps, currentStartTime, data.getNumberOfEvents);
         logger.debug("Current end time: " + currentEndTime.toISOString(), {
             onCallDutyPolicyScheduleId: data.scheduleId.toString(),
         });