From 415df400f49d35a2999fa0292c8d244664f58b26 Mon Sep 17 00:00:00 2001
From: Iain <Iain1970@protonmail.com>
Date: Tue, 6 Oct 2026 18:21:46 +0100
Subject: [PATCH] Validate the Duo and SSO purge schedules on startup (#7819)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Daniel García <dani-garcia@users.noreply.github.com>
---
 src/config.rs | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/config.rs b/src/config.rs
index 7d35461c..bf6ea724 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -1266,6 +1266,14 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
         err!("`AUTH_REQUEST_PURGE_SCHEDULE` is not a valid cron expression")
     }
 
+    if !cfg.duo_context_purge_schedule.is_empty() && cfg.duo_context_purge_schedule.parse::<Schedule>().is_err() {
+        err!("`DUO_CONTEXT_PURGE_SCHEDULE` is not a valid cron expression")
+    }
+
+    if !cfg.purge_incomplete_sso_auth.is_empty() && cfg.purge_incomplete_sso_auth.parse::<Schedule>().is_err() {
+        err!("`PURGE_INCOMPLETE_SSO_AUTH` is not a valid cron expression")
+    }
+
     if !cfg.disable_admin_token {
         match cfg.admin_token.as_ref() {
             Some(t) if t.starts_with("$argon2") => {