fix: address CodeRabbit review — guard OIDC group types and CPU division

packages/auth/events.ts

@@ -33,12 +33,21 @@ export const createSignInEventHandler = (db: Database): Exclude<NextAuthConfig["
     const groupsKey = env.AUTH_OIDC_GROUPS_ATTRIBUTE;
     // Groups from oidc provider are provided from the profile, it's not typed.
     // Some providers send a single group as a string instead of an array — normalize it.
+    // Only accept string or string[] claims; reject null, numbers, objects, etc.
     const oidcGroups = profile && groupsKey in profile ? profile[groupsKey] : undefined;
-    const normalizedOidcGroups =
-      oidcGroups !== undefined ? (Array.isArray(oidcGroups) ? oidcGroups : [oidcGroups]) : undefined;
+    const normalizedOidcGroups: string[] | undefined = (() => {
+      if (typeof oidcGroups === "string") return [oidcGroups];
+      if (Array.isArray(oidcGroups) && oidcGroups.every((group): group is string => typeof group === "string")) {
+        return oidcGroups;
+      }
+      if (oidcGroups !== undefined) {
+        logger.warn(`Invalid OIDC groups claim "${groupsKey}"`);
+      }
+      return undefined;
+    })();
     if (!env.AUTH_OIDC_GROUPS_LOCAL_MANAGEMENT && dbUser.provider === "oidc" && normalizedOidcGroups !== undefined) {
       logger.debug(`Using profile groups (${groupsKey}): ${JSON.stringify(normalizedOidcGroups)}`);
-      await synchronizeGroupsWithExternalForUserAsync(db, user.id, normalizedOidcGroups as string[]);
+      await synchronizeGroupsWithExternalForUserAsync(db, user.id, normalizedOidcGroups);
     }
 
     // In ldap-authroization we return the groups from ldap, it's not typed.

packages/integrations/src/unraid/unraid-integration.ts

@@ -41,6 +41,9 @@ export class UnraidIntegration extends Integration implements ISystemHealthMonit
 
     // We use the thread count (not physical cores) because each logical CPU entry in cpus[]
     // represents a thread. Dividing by cores would over-report utilization on SMT systems.
+    // Guard against zero or negative thread counts to avoid Infinity/NaN.
+    const cpuUtilizationNormalized = cpuCount > 0 ? cpuUtilization / cpuCount : 0;
+
     const totalMemory = systemInfo.info.memory.layout.reduce((acc, layout) => layout.size + acc, 0);
     const usedMemory = totalMemory * (systemInfo.metrics.memory.percentTotal / 100);
     const uptime = dayjs(systemInfo.info.os.uptime);
@@ -48,7 +51,7 @@ export class UnraidIntegration extends Integration implements ISystemHealthMonit
     return {
       version: systemInfo.info.os.release,
       cpuModelName: systemInfo.info.cpu.brand,
-      cpuUtilization: cpuUtilization / cpuCount,
+      cpuUtilization: cpuUtilizationNormalized,
       memUsedInBytes: usedMemory,
       memAvailableInBytes: totalMemory - usedMemory,
       uptime: dayjs().diff(uptime, "seconds"),