compute_next_run parsed scheduled_time as "HH:MM" with int(parts[0]), int(parts[1]) and no validation, so "9", "9am", "25:00", "9:" or ":30" raised IndexError/ValueError. The POST /tasks create route passes the user/LLM-supplied scheduled_time before its try block (and only validates the cron field), so a bad value surfaced as an unhandled 500 rather than the clean 400 used for other invalid fields — and the same crash could fire inside the scheduler loop when recomputing next_run for an already-stored bad row. Guard the parse and fail closed (warn + return None), matching the existing invalid-cron handling in the same function. Adds tests/test_scheduler_scheduled_time_validation.py — malformed values return None (fail before with IndexError/ValueError), valid HH:MM still computes.
1.1 KiB
1.1 KiB