From ef9ead60ba865743013b9870ee1fb3830d47a8ec Mon Sep 17 00:00:00 2001
From: Thomas Camlong <thomas@ajnart.fr>
Date: Mon, 3 Aug 2026 17:08:59 +0200
Subject: [PATCH] =?UTF-8?q?fix:=20address=20CodeRabbit=20review=20?=
 =?UTF-8?q?=E2=80=94=20guard=20OIDC=20group=20types=20and=20CPU=20division?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 packages/auth/events.ts                           | 15 ++++++++++++---
 .../integrations/src/unraid/unraid-integration.ts |  5 ++++-
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/packages/auth/events.ts b/packages/auth/events.ts
index 8d2a75495..1f7098e72 100644
--- a/packages/auth/events.ts
+++ b/packages/auth/events.ts
@@ -33,12 +33,21 @@ export const createSignInEventHandler = (db: Database): Exclude<NextAuthConfig["
     const groupsKey = env.AUTH_OIDC_GROUPS_ATTRIBUTE;
     // Groups from oidc provider are provided from the profile, it's not typed.
     // Some providers send a single group as a string instead of an array — normalize it.
+    // Only accept string or string[] claims; reject null, numbers, objects, etc.
     const oidcGroups = profile && groupsKey in profile ? profile[groupsKey] : undefined;
-    const normalizedOidcGroups =
-      oidcGroups !== undefined ? (Array.isArray(oidcGroups) ? oidcGroups : [oidcGroups]) : undefined;
+    const normalizedOidcGroups: string[] | undefined = (() => {
+      if (typeof oidcGroups === "string") return [oidcGroups];
+      if (Array.isArray(oidcGroups) && oidcGroups.every((group): group is string => typeof group === "string")) {
+        return oidcGroups;
+      }
+      if (oidcGroups !== undefined) {
+        logger.warn(`Invalid OIDC groups claim "${groupsKey}"`);
+      }
+      return undefined;
+    })();
     if (!env.AUTH_OIDC_GROUPS_LOCAL_MANAGEMENT && dbUser.provider === "oidc" && normalizedOidcGroups !== undefined) {
       logger.debug(`Using profile groups (${groupsKey}): ${JSON.stringify(normalizedOidcGroups)}`);
-      await synchronizeGroupsWithExternalForUserAsync(db, user.id, normalizedOidcGroups as string[]);
+      await synchronizeGroupsWithExternalForUserAsync(db, user.id, normalizedOidcGroups);
     }
 
     // In ldap-authroization we return the groups from ldap, it's not typed.
diff --git a/packages/integrations/src/unraid/unraid-integration.ts b/packages/integrations/src/unraid/unraid-integration.ts
index b4decb8d0..403eb8c9f 100644
--- a/packages/integrations/src/unraid/unraid-integration.ts
+++ b/packages/integrations/src/unraid/unraid-integration.ts
@@ -41,6 +41,9 @@ export class UnraidIntegration extends Integration implements ISystemHealthMonit
 
     // We use the thread count (not physical cores) because each logical CPU entry in cpus[]
     // represents a thread. Dividing by cores would over-report utilization on SMT systems.
+    // Guard against zero or negative thread counts to avoid Infinity/NaN.
+    const cpuUtilizationNormalized = cpuCount > 0 ? cpuUtilization / cpuCount : 0;
+
     const totalMemory = systemInfo.info.memory.layout.reduce((acc, layout) => layout.size + acc, 0);
     const usedMemory = totalMemory * (systemInfo.metrics.memory.percentTotal / 100);
     const uptime = dayjs(systemInfo.info.os.uptime);
@@ -48,7 +51,7 @@ export class UnraidIntegration extends Integration implements ISystemHealthMonit
     return {
       version: systemInfo.info.os.release,
       cpuModelName: systemInfo.info.cpu.brand,
-      cpuUtilization: cpuUtilization / cpuCount,
+      cpuUtilization: cpuUtilizationNormalized,
       memUsedInBytes: usedMemory,
       memAvailableInBytes: totalMemory - usedMemory,
       uptime: dayjs().diff(uptime, "seconds"),