From 660d039b80325bdea1ee33b110706086e672dd98 Mon Sep 17 00:00:00 2001
From: lorentz <lorentz@wulfconsulting.com>
Date: Thu, 7 May 2026 17:21:26 -0400
Subject: [PATCH] fix(07.1-02): allowlist UTC, Etc/UTC, GMT in IANA validator

---
 app/api/me/timezone/route.ts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/app/api/me/timezone/route.ts b/app/api/me/timezone/route.ts
index fc8f407..e46690d 100644
--- a/app/api/me/timezone/route.ts
+++ b/app/api/me/timezone/route.ts
@@ -17,8 +17,15 @@ function getDefaultTimezone(): string {
   return process.env.DEFAULT_TIMEZONE || 'UTC';
 }
 
+// Node's Intl.supportedValuesOf('timeZone') returns canonical IANA zones only —
+// it omits 'UTC', 'Etc/UTC', 'GMT', and the entire Etc/* alias namespace, even
+// though those are valid for Postgres AT TIME ZONE and JS Date methods. The
+// migration default is 'UTC', so the validator must accept it explicitly.
+const EXTRA_ALLOWED_TIMEZONES = new Set(['UTC', 'Etc/UTC', 'GMT', 'Etc/GMT']);
+
 function isValidIanaTimezone(tz: unknown): tz is string {
   if (typeof tz !== 'string' || tz.length === 0 || tz.length > 64) return false;
+  if (EXTRA_ALLOWED_TIMEZONES.has(tz)) return true;
   try {
     const zones = Intl.supportedValuesOf('timeZone');
     return zones.includes(tz);