From f7414915bd01ada3bfe78fe7ca19a3ff6ea411e5 Mon Sep 17 00:00:00 2001
From: Eleazar Resendez <eleazar.resendez@processmaker.com>
Date: Tue, 21 Jul 2026 11:34:55 -0600
Subject: [PATCH 1/2] FOUR-32304: Prevent duplicate DevLinks from breaking
 bundle lists

---
 .../Controllers/Api/DevLinkController.php     |  72 ++++--
 .../Http/Requests/DevLinkStoreRequest.php     |  31 +++
 ProcessMaker/Rules/HttpOrigin.php             |  29 +++
 .../admin/devlink/components/BundleDetail.vue |   9 +-
 .../devlink/components/CreateDevLinkModal.vue |  12 +-
 .../js/admin/devlink/components/Index.vue     |  12 +
 .../admin/devlink/components/LocalBundles.vue |  20 +-
 .../admin/devlink/components/VersionCheck.vue |  46 +++-
 resources/lang/en.json                        |   4 +
 tests/Feature/Api/DevLinkTest.php             | 209 +++++++++++++++++-
 10 files changed, 416 insertions(+), 28 deletions(-)
 create mode 100644 ProcessMaker/Http/Requests/DevLinkStoreRequest.php
 create mode 100644 ProcessMaker/Rules/HttpOrigin.php

diff --git a/ProcessMaker/Http/Controllers/Api/DevLinkController.php b/ProcessMaker/Http/Controllers/Api/DevLinkController.php
index 01a56364fe..b7ec2297b7 100644
--- a/ProcessMaker/Http/Controllers/Api/DevLinkController.php
+++ b/ProcessMaker/Http/Controllers/Api/DevLinkController.php
@@ -3,12 +3,15 @@
 namespace ProcessMaker\Http\Controllers\Api;
 
 use Illuminate\Database\Eloquent\ModelNotFoundException;
+use Illuminate\Http\Client\ConnectionException;
+use Illuminate\Http\Client\RequestException;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Notification;
 use Illuminate\Validation\Rule;
 use ProcessMaker\Events\CustomizeUiUpdated;
 use ProcessMaker\Exception\ValidationException;
 use ProcessMaker\Http\Controllers\Controller;
+use ProcessMaker\Http\Requests\DevLinkStoreRequest;
 use ProcessMaker\Http\Resources\ApiCollection;
 use ProcessMaker\Jobs\CompileUI;
 use ProcessMaker\Jobs\DevLinkInstall;
@@ -56,20 +59,24 @@ public function show(DevLink $devLink)
         return $devLink;
     }
 
-    public function store(Request $request)
+    public function store(DevLinkStoreRequest $request)
     {
-        $request->validate([
-            'name' => ['required'],
-            'url' => ['required', 'url'],
-        ]);
-        $devLink = DevLink::where('name', $request->input('name'))->first();
-        if ($devLink) {
-            $devLink->url = $request->input('url');
-        } else {
-            $devLink = new DevLink();
-            $devLink->name = $request->input('name');
-            $devLink->url = $request->input('url');
+        $normalizedUrl = $this->normalizeUrl($request->input('url'));
+        $existingDevLink = DevLink::query()
+            ->get(['id', 'name', 'url'])
+            ->first(fn (DevLink $devLink) => $this->normalizeUrl($devLink->url) === $normalizedUrl);
+        if ($existingDevLink) {
+            throw ValidationException::withMessages([
+                'url' => __(
+                    'This instance is already linked as :name. Open or reconnect the existing connection.',
+                    ['name' => $existingDevLink->name]
+                ),
+            ]);
         }
+
+        $devLink = new DevLink();
+        $devLink->name = $request->input('name');
+        $devLink->url = $normalizedUrl;
         $devLink->saveOrFail();
 
         return $devLink;
@@ -77,6 +84,13 @@ public function store(Request $request)
 
     public function update(Request $request, DevLink $devLink)
     {
+        $request->merge([
+            'name' => trim((string) $request->input('name')),
+        ]);
+        $request->validate([
+            'name' => ['required', 'string', Rule::unique('dev_links', 'name')->ignore($devLink->id)],
+        ]);
+
         $devLink->name = $request->input('name');
         $devLink->saveOrFail();
 
@@ -373,7 +387,39 @@ public function installRemoteAsset(Request $request, DevLink $devLink)
 
     public function remoteBundleVersion(DevLink $devLink, int $remoteBundleId)
     {
-        return $devLink->remoteBundle($remoteBundleId);
+        try {
+            $payload = $devLink->remoteBundle($remoteBundleId)->json();
+        } catch (RequestException|ConnectionException $e) {
+            return [
+                'available' => false,
+                'version' => null,
+            ];
+        }
+
+        if (!is_array($payload)) {
+            return [
+                'available' => false,
+                'version' => null,
+            ];
+        }
+
+        $payload['available'] = true;
+
+        return $payload;
+    }
+
+    private function normalizeUrl(string $url): string
+    {
+        $parts = parse_url(trim($url));
+        $scheme = strtolower($parts['scheme']);
+        $host = strtolower($parts['host']);
+        $port = $parts['port'] ?? null;
+
+        if (($scheme === 'http' && $port === 80) || ($scheme === 'https' && $port === 443)) {
+            $port = null;
+        }
+
+        return $scheme . '://' . $host . ($port === null ? '' : ':' . $port);
     }
 
     public function deleteBundleAsset(BundleAsset $bundleAsset)
diff --git a/ProcessMaker/Http/Requests/DevLinkStoreRequest.php b/ProcessMaker/Http/Requests/DevLinkStoreRequest.php
new file mode 100644
index 0000000000..6d6c1d5115
--- /dev/null
+++ b/ProcessMaker/Http/Requests/DevLinkStoreRequest.php
@@ -0,0 +1,31 @@
+<?php
+
+namespace ProcessMaker\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+use ProcessMaker\Rules\HttpOrigin;
+
+class DevLinkStoreRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    protected function prepareForValidation(): void
+    {
+        $this->merge([
+            'name' => trim((string) $this->input('name')),
+            'url' => trim((string) $this->input('url')),
+        ]);
+    }
+
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', Rule::unique('dev_links', 'name')],
+            'url' => ['bail', 'required', 'url', new HttpOrigin()],
+        ];
+    }
+}
diff --git a/ProcessMaker/Rules/HttpOrigin.php b/ProcessMaker/Rules/HttpOrigin.php
new file mode 100644
index 0000000000..582ac8583b
--- /dev/null
+++ b/ProcessMaker/Rules/HttpOrigin.php
@@ -0,0 +1,29 @@
+<?php
+
+namespace ProcessMaker\Rules;
+
+use Closure;
+use Illuminate\Contracts\Validation\ValidationRule;
+
+class HttpOrigin implements ValidationRule
+{
+    public function validate(string $attribute, mixed $value, Closure $fail): void
+    {
+        $parts = parse_url($value);
+        if ($parts === false) {
+            $fail(__('The instance URL must contain only an HTTP or HTTPS origin.'));
+
+            return;
+        }
+
+        $path = $parts['path'] ?? '';
+        if (
+            !isset($parts['scheme'], $parts['host'])
+            || !in_array(strtolower($parts['scheme']), ['http', 'https'], true)
+            || !in_array($path, ['', '/'], true)
+            || isset($parts['query'], $parts['fragment'], $parts['user'], $parts['pass'])
+        ) {
+            $fail(__('The instance URL must contain only an HTTP or HTTPS origin.'));
+        }
+    }
+}
diff --git a/resources/js/admin/devlink/components/BundleDetail.vue b/resources/js/admin/devlink/components/BundleDetail.vue
index 0e191dbe16..fe2f7d822d 100644
--- a/resources/js/admin/devlink/components/BundleDetail.vue
+++ b/resources/js/admin/devlink/components/BundleDetail.vue
@@ -20,6 +20,7 @@
         <VersionCheck
           :dev-link="bundle"
           @updateAvailable="updateAvailable = $event"
+          @availabilityChanged="remoteAvailable = $event"
         />
       </div>
       <div class="header-actions">
@@ -37,6 +38,7 @@
         <button
           v-if="bundle.dev_link_id !== null"
           class="btn btn-outline-secondary mr-2 dropdown-toggle"
+          :disabled="remoteAvailable !== true"
           data-toggle="dropdown"
           data-offset="5, 5"
           aria-haspopup="true"
@@ -49,7 +51,7 @@
           class="dropdown-menu dropdown-menu-right"
         >
           <a
-            v-if="updateAvailable"
+            v-if="updateAvailable && remoteAvailable"
             class="dropdown-item"
             href="#"
             @click.prevent="reinstallBundle.show(bundle)"
@@ -58,7 +60,7 @@
             {{ $t('Update Bundle') }}
           </a>
           <a
-            v-if="bundle.dev_link_id !== null"
+            v-if="bundle.dev_link_id !== null && remoteAvailable"
             class="dropdown-item"
             href="#"
             @click.prevent="executeReinstall('copy')"
@@ -67,7 +69,7 @@
             {{ $t('Add a Copy') }}
           </a>
           <a
-            v-if="bundle.dev_link_id !== null"
+            v-if="bundle.dev_link_id !== null && remoteAvailable"
             class="dropdown-item"
             href="#"
             @click.prevent="executeReinstall('update')"
@@ -178,6 +180,7 @@ const route = useRoute();
 const bundleId = route.params.id;
 const bundleForEdit = ref({});
 const updateAvailable = ref(false);
+const remoteAvailable = ref(null);
 const selected = ref(null);
 const confirmPublishNewVersion = ref(null);
 
diff --git a/resources/js/admin/devlink/components/CreateDevLinkModal.vue b/resources/js/admin/devlink/components/CreateDevLinkModal.vue
index bfa0ad89a5..4afae6df2e 100644
--- a/resources/js/admin/devlink/components/CreateDevLinkModal.vue
+++ b/resources/js/admin/devlink/components/CreateDevLinkModal.vue
@@ -10,7 +10,13 @@
       :ok-title="$t('Create')"
       :cancel-title="$t('Cancel')"
     >
-      <div v-if="status === 'error'" class="alert alert-danger" role="alert">
+      <div v-if="errorMessage" class="alert alert-danger" role="alert">
+        <div class="alert-header">
+          <span class="icon">!</span>
+          <strong>{{ errorMessage }}</strong>
+        </div>
+      </div>
+      <div v-else-if="status === 'error'" class="alert alert-danger" role="alert">
         <div class="alert-header">
           <span class="icon">!</span>
           <strong>Connection Error</strong>
@@ -58,6 +64,10 @@ const props = defineProps({
     type: String,
     default: ''
   },
+  errorMessage: {
+    type: String,
+    default: ''
+  },
   showDetails: {
     type: Boolean,
     default: false
diff --git a/resources/js/admin/devlink/components/Index.vue b/resources/js/admin/devlink/components/Index.vue
index 3f5e0e962f..fd36048c23 100644
--- a/resources/js/admin/devlink/components/Index.vue
+++ b/resources/js/admin/devlink/components/Index.vue
@@ -56,6 +56,7 @@ onMounted(() => {
 const newName = ref('');
 const newUrl = ref('');
 const status = ref('');
+const createError = ref('');
 
 const load = () => {
   ProcessMaker.apiClient
@@ -79,10 +80,12 @@ const onNavigate = (action, data, index) => {
 const clear = () => {
   newName.value = '';
   newUrl.value = '';
+  createError.value = '';
 }
 
 const create = (name, url) => {
   status.value = '';
+  createError.value = '';
   ProcessMaker.apiClient
     .post('/devlink', {
       name: name,
@@ -112,6 +115,13 @@ const create = (name, url) => {
             status.value = 'error';
           }
         });
+    })
+    .catch((error) => {
+      createError.value = error.response?.data?.errors?.url?.[0]
+        || error.response?.data?.errors?.name?.[0]
+        || error.response?.data?.error?.message
+        || error.response?.data?.message
+        || vue.$t('Unable to create the linked instance.');
     });
 };
 
@@ -162,6 +172,7 @@ const handleFilterChange = () => {
 
 const showCreateModal = () => {
   status.value = '';
+  createError.value = '';
   createDevLinkModal.value.show();
 };
 
@@ -218,6 +229,7 @@ const urlIsValid = computed(() => {
       :newUrl="newUrl"
       :urlIsValid="urlIsValid"
       :status="status"
+      :errorMessage="createError"
       @clear="clear"
       @create="create"
       @update:newUrl="handleNewUrlUpdate"
diff --git a/resources/js/admin/devlink/components/LocalBundles.vue b/resources/js/admin/devlink/components/LocalBundles.vue
index 6a57f68285..8e9c54a84a 100644
--- a/resources/js/admin/devlink/components/LocalBundles.vue
+++ b/resources/js/admin/devlink/components/LocalBundles.vue
@@ -22,13 +22,14 @@ const bundleModal = ref(null);
 const updateBundle = ref(null);
 const deleteWarningTitle = ref(vue.$t("Delete Confirmation"));
 const updatesAvailable = reactive({});
+const remoteAvailability = reactive({});
 const refreshKey = ref(0);
 
 const actions = [
   { value: "open-item", content: "Open" },
   { value: "increase-item", content: "Publish New Version", conditional: "if(not(dev_link_id), true, false)" },
   { value: "update-item", content: "Update Bundle", conditional: "if(update_available, true, false)" },
-  { value: "reinstall-item", content: "Reinstall Bundle", conditional: "if(dev_link_id, true, false)" },
+  { value: "reinstall-item", content: "Reinstall Bundle", conditional: "if(dev_link_id, remote_available, false)" },
   { value: "edit-item", content: "Edit", conditional: "if(not(dev_link_id) , true, false)" },
   { value: "delete-item", content: "Delete" },
 ]
@@ -44,6 +45,10 @@ const setUpdateAvailable = (bundle, updateAvailable) => {
   set(updatesAvailable, bundle.id, updateAvailable);
 };
 
+const setRemoteAvailability = (bundle, available) => {
+  set(remoteAvailability, bundle.id, available);
+};
+
 onMounted(() => {
   load();
 })
@@ -280,9 +285,10 @@ const handleInstallationComplete = () => {
           <Origin :dev-link="data.item.dev_link"></Origin>
         </template>
         <template #cell(version)="data">
-          {{ data.item.version }} <VersionCheck 
-            :key="`version-check-${data.item.id}-${refreshKey}`" 
-            @updateAvailable="setUpdateAvailable(data.item, $event)" 
+          {{ data.item.version }} <VersionCheck
+            :key="`version-check-${data.item.id}-${refreshKey}`"
+            @updateAvailable="setUpdateAvailable(data.item, $event)"
+            @availabilityChanged="setRemoteAvailability(data.item, $event)"
             :dev-link="data.item">
           </VersionCheck>
         </template>
@@ -290,7 +296,11 @@ const handleInstallationComplete = () => {
           <EllipsisMenu
             class="ellipsis-devlink"
             :actions="actions"
-            :data="{ ...data.item, update_available: updatesAvailable[data.item.id] ?? false }"
+            :data="{
+              ...data.item,
+              update_available: updatesAvailable[data.item.id] ?? false,
+              remote_available: remoteAvailability[data.item.id] ?? false,
+            }"
             :custom-button="customButton"
             @navigate="onNavigate"
           />
diff --git a/resources/js/admin/devlink/components/VersionCheck.vue b/resources/js/admin/devlink/components/VersionCheck.vue
index 2513cc1efc..87f62c3ef9 100644
--- a/resources/js/admin/devlink/components/VersionCheck.vue
+++ b/resources/js/admin/devlink/components/VersionCheck.vue
@@ -1,26 +1,47 @@
 <script setup>
 import { ref, onMounted, defineEmits } from 'vue';
-import { useRouter, useRoute } from 'vue-router/composables';
 
-const router = useRouter();
-const emit = defineEmits(['updateAvailable']);
+const emit = defineEmits(['updateAvailable', 'availabilityChanged']);
 
 const checkNewVersion = ref(false);
+const loading = ref(false);
+const connectionAvailable = ref(null);
 
 const props = defineProps({
   devLink: { type: Object },
 });
 
 const remote = () => {
+  loading.value = true;
   ProcessMaker.apiClient
     .get(`/devlink/${props.devLink.dev_link_id}/remote-version/${props.devLink.remote_id}`)
     .then((response) => {
+      if (response.data.available === false) {
+        connectionAvailable.value = false;
+        checkNewVersion.value = false;
+        emit('updateAvailable', false);
+        emit('availabilityChanged', false);
+        return;
+      }
+
+      connectionAvailable.value = true;
+      emit('availabilityChanged', true);
       if (Number(response.data.version) > Number(props.devLink.version)) {
         checkNewVersion.value = true;
         emit('updateAvailable', true);
       } else {
+        checkNewVersion.value = false;
         emit('updateAvailable', false);
       }
+    })
+    .catch(() => {
+      connectionAvailable.value = false;
+      checkNewVersion.value = false;
+      emit('updateAvailable', false);
+      emit('availabilityChanged', false);
+    })
+    .finally(() => {
+      loading.value = false;
     });
 };
 
@@ -35,10 +56,16 @@ onMounted(() => {
 
 <template>
   <span
-    v-if="checkNewVersion"
+    v-if="!loading && connectionAvailable === false"
+    class="badge badge-unavailable"
+  >
+    {{ $t('Connection unavailable') }}
+  </span>
+  <span
+    v-else-if="!loading && checkNewVersion"
     class="badge badge-update"
   >
-    Update Available
+    {{ $t('Update Available') }}
   </span>
 </template>
 
@@ -51,4 +78,13 @@ onMounted(() => {
     border-radius: 6px;
     height: 24px;
 }
+
+.badge-unavailable {
+    background-color: #F3F5F7;
+    color: #596372;
+    font-size: 14px;
+    font-weight: 500;
+    border-radius: 6px;
+    height: 24px;
+}
 </style>
diff --git a/resources/lang/en.json b/resources/lang/en.json
index f5747fc4d6..c80d4cc1b8 100644
--- a/resources/lang/en.json
+++ b/resources/lang/en.json
@@ -457,6 +457,7 @@
   "Congratulations": "Congratulations",
   "Connecting Driver": "Connecting Driver",
   "Connection Type": "Connection Type",
+  "Connection unavailable": "Connection unavailable",
   "Contact Information": "Contact Information",
   "Contact your administrator for more information": "Contact your administrator for more information",
   "Contains a number or symbol": "Contains a number or symbol",
@@ -2251,6 +2252,7 @@
   "The image was deleted": "The image was deleted",
   "The inbox rule '{{name}}' was created.": "The inbox rule '{{name}}' was created.",
   "The inbox rule '{{name}}' was updated.": "The inbox rule '{{name}}' was updated.",
+  "The instance URL must contain only an HTTP or HTTPS origin.": "The instance URL must contain only an HTTP or HTTPS origin.",
   "The Input Data field is required": "The Input Data field is required",
   "The label describes the button's text": "The label describes the button's text",
   "The label describes the field's name": "The label describes the field's name",
@@ -2364,6 +2366,7 @@
   "This field accepts mustache syntax": "This field accepts mustache syntax",
   "This field is required!": "This field is required!",
   "This file is password protected. Enter the password below to continue with the import.": "This file is password protected. Enter the password below to continue with the import.",
+  "This instance is already linked as :name. Open or reconnect the existing connection.": "This instance is already linked as :name. Open or reconnect the existing connection.",
   "This is a Beta version and when using Quickfill, it may replace the pre-filled information in the form.": "This is a Beta version and when using Quickfill, it may replace the pre-filled information in the form.",
   "This is an AI feature and can provide inaccurate or biased responses.": "This is an AI feature and can provide inaccurate or biased responses.",
   "This is the only time you will be able to view the client secret. Keep it in a safe place.": "This is the only time you will be able to view the client secret. Keep it in a safe place.",
@@ -2444,6 +2447,7 @@
   "Type to search": "Type to search",
   "Type value": "Type value",
   "Type": "Type",
+  "Unable to create the linked instance.": "Unable to create the linked instance.",
   "Unable to import the process.": "Unable to import the process.",
   "Unable to import": "Unable to import",
   "Unable to save: Verify your internet connection.": "Unable to save: Verify your internet connection.",
diff --git a/tests/Feature/Api/DevLinkTest.php b/tests/Feature/Api/DevLinkTest.php
index f2d0027e20..79ff8ce074 100644
--- a/tests/Feature/Api/DevLinkTest.php
+++ b/tests/Feature/Api/DevLinkTest.php
@@ -2,6 +2,7 @@
 
 namespace Tests\Feature\Api;
 
+use Illuminate\Http\Client\ConnectionException;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Storage;
 use PHPUnit\Framework\Attributes\DataProvider;
@@ -18,6 +19,212 @@ class DevLinkTest extends TestCase
 {
     use RequestHelper;
 
+    private const REMOTE_QA_NAME = 'Remote QA';
+
+    private const REMOTE_INSTANCE_URL = 'https://remote-instance.test';
+
+    private const EXISTING_LINK_NAME = 'Existing Link';
+
+    private const FIRST_LINK_NAME = 'First Link';
+
+    private const SECOND_LINK_NAME = 'Second Link';
+
+    private const FIRST_INSTANCE_URL = 'https://first-instance.test';
+
+    private const SECOND_INSTANCE_URL = 'https://second-instance.test';
+
+    public function testStoreCreatesADevLinkWithANormalizedUrl()
+    {
+        $response = $this->apiCall('POST', route('api.devlink.store'), [
+            'name' => self::REMOTE_QA_NAME,
+            'url' => ' https://REMOTE-INSTANCE.test:443/ ',
+        ]);
+
+        $response->assertCreated()->assertJson([
+            'name' => self::REMOTE_QA_NAME,
+            'url' => self::REMOTE_INSTANCE_URL,
+        ]);
+        $this->assertDatabaseHas('dev_links', [
+            'name' => self::REMOTE_QA_NAME,
+            'url' => self::REMOTE_INSTANCE_URL,
+        ]);
+    }
+
+    #[DataProvider('duplicateUrlProvider')]
+    public function testStoreRejectsNormalizedDuplicateUrls(string $storedUrl, string $duplicateUrl)
+    {
+        DevLink::factory()->create([
+            'name' => self::EXISTING_LINK_NAME,
+            'url' => $storedUrl,
+        ]);
+
+        $response = $this->apiCall('POST', route('api.devlink.store'), [
+            'name' => 'Duplicate Link',
+            'url' => $duplicateUrl,
+        ]);
+
+        $response->assertUnprocessable()->assertJsonPath(
+            'errors.url.0',
+            'This instance is already linked as Existing Link. Open or reconnect the existing connection.'
+        );
+        $this->assertDatabaseCount('dev_links', 1);
+    }
+
+    public static function duplicateUrlProvider(): array
+    {
+        return [
+            'host case and trailing slash' => [
+                self::REMOTE_INSTANCE_URL,
+                'https://REMOTE-INSTANCE.test/',
+            ],
+            'default HTTPS port' => [
+                self::REMOTE_INSTANCE_URL,
+                'https://remote-instance.test:443',
+            ],
+            'default HTTP port' => [
+                'http://remote-instance.test',
+                'http://remote-instance.test:80/',
+            ],
+        ];
+    }
+
+    public function testStoreRejectsAnExistingNameWithoutUpdatingItsUrl()
+    {
+        $devLink = DevLink::factory()->create([
+            'name' => self::EXISTING_LINK_NAME,
+            'url' => self::FIRST_INSTANCE_URL,
+        ]);
+
+        $response = $this->apiCall('POST', route('api.devlink.store'), [
+            'name' => self::EXISTING_LINK_NAME,
+            'url' => self::SECOND_INSTANCE_URL,
+        ]);
+
+        $response->assertUnprocessable()->assertJsonValidationErrors('name');
+        $this->assertSame(self::FIRST_INSTANCE_URL, $devLink->fresh()->url);
+        $this->assertDatabaseMissing('dev_links', ['url' => self::SECOND_INSTANCE_URL]);
+    }
+
+    public function testStoreAllowsDifferentNormalizedUrls()
+    {
+        DevLink::factory()->create([
+            'name' => self::FIRST_LINK_NAME,
+            'url' => self::FIRST_INSTANCE_URL,
+        ]);
+
+        $response = $this->apiCall('POST', route('api.devlink.store'), [
+            'name' => self::SECOND_LINK_NAME,
+            'url' => self::SECOND_INSTANCE_URL,
+        ]);
+
+        $response->assertCreated();
+        $this->assertDatabaseCount('dev_links', 2);
+    }
+
+    public function testUpdateRejectsANameUsedByAnotherDevLink()
+    {
+        DevLink::factory()->create([
+            'name' => self::FIRST_LINK_NAME,
+            'url' => self::FIRST_INSTANCE_URL,
+        ]);
+        $secondDevLink = DevLink::factory()->create([
+            'name' => self::SECOND_LINK_NAME,
+            'url' => self::SECOND_INSTANCE_URL,
+        ]);
+
+        $response = $this->apiCall('PUT', route('api.devlink.update', [
+            'devLink' => $secondDevLink->id,
+        ]), [
+            'name' => self::FIRST_LINK_NAME,
+        ]);
+
+        $response->assertUnprocessable()->assertJsonValidationErrors('name');
+        $this->assertSame(self::SECOND_LINK_NAME, $secondDevLink->fresh()->name);
+    }
+
+    public function testRemoteBundleVersionReportsAnAvailableRemoteBundle()
+    {
+        Http::preventStrayRequests();
+        $devLink = DevLink::factory()->create([
+            'url' => self::REMOTE_INSTANCE_URL,
+            'access_token' => 'valid-token',
+        ]);
+        Http::fake([
+            'https://remote-instance.test/api/1.0/devlink/local-bundles/123' => Http::response([
+                'id' => 123,
+                'name' => 'Remote Bundle',
+                'version' => '4',
+            ]),
+        ]);
+
+        $response = $this->apiCall('GET', route('api.devlink.remote-version', [
+            'devLink' => $devLink->id,
+            'bundle' => 123,
+        ]));
+
+        $response->assertOk()->assertJson([
+            'id' => 123,
+            'name' => 'Remote Bundle',
+            'version' => '4',
+            'available' => true,
+        ]);
+    }
+
+    #[DataProvider('unavailableRemoteStatusProvider')]
+    public function testRemoteBundleVersionHandlesRemoteHttpErrors(int $status)
+    {
+        Http::preventStrayRequests();
+        $devLink = DevLink::factory()->create([
+            'url' => self::REMOTE_INSTANCE_URL,
+            'access_token' => 'revoked-token',
+        ]);
+        Http::fake([
+            'https://remote-instance.test/api/1.0/devlink/local-bundles/123' => Http::response([], $status),
+        ]);
+
+        $response = $this->apiCall('GET', route('api.devlink.remote-version', [
+            'devLink' => $devLink->id,
+            'bundle' => 123,
+        ]));
+
+        $response->assertOk()->assertExactJson([
+            'available' => false,
+            'version' => null,
+        ]);
+    }
+
+    public static function unavailableRemoteStatusProvider(): array
+    {
+        return [
+            'unauthorized' => [401],
+            'forbidden' => [403],
+            'missing bundle' => [404],
+            'remote server error' => [500],
+        ];
+    }
+
+    public function testRemoteBundleVersionHandlesConnectionErrors()
+    {
+        Http::preventStrayRequests();
+        $devLink = DevLink::factory()->create([
+            'url' => self::REMOTE_INSTANCE_URL,
+            'access_token' => 'unreachable-token',
+        ]);
+        Http::fake(function () {
+            throw new ConnectionException('Unable to connect to remote instance.');
+        });
+
+        $response = $this->apiCall('GET', route('api.devlink.remote-version', [
+            'devLink' => $devLink->id,
+            'bundle' => 123,
+        ]));
+
+        $response->assertOk()->assertExactJson([
+            'available' => false,
+            'version' => null,
+        ]);
+    }
+
     public function testShowBundle()
     {
         $bundle = Bundle::factory()->create();
@@ -207,7 +414,7 @@ public function testInstallRemoteAsset()
     {
         $screen = Screen::factory()->create();
         $devLink = DevLink::factory()->create([
-            'url' => 'https://remote-instance.test',
+            'url' => self::REMOTE_INSTANCE_URL,
         ]);
 
         Http::fake([

From 70ec525aa81fb07d0e8ad8d8b16c7a7661dac66f Mon Sep 17 00:00:00 2001
From: Eleazar Resendez <eleazar.resendez@processmaker.com>
Date: Wed, 22 Jul 2026 08:26:40 -0600
Subject: [PATCH 2/2] FOUR-32304: Align DevLink URL validation

---
 ProcessMaker/Rules/HttpOrigin.php             |  5 +++-
 .../js/admin/devlink/components/Index.vue     | 21 ++++++++++++++++-
 tests/Feature/Api/DevLinkTest.php             | 23 +++++++++++++++++++
 3 files changed, 47 insertions(+), 2 deletions(-)

diff --git a/ProcessMaker/Rules/HttpOrigin.php b/ProcessMaker/Rules/HttpOrigin.php
index 582ac8583b..461fafd3ff 100644
--- a/ProcessMaker/Rules/HttpOrigin.php
+++ b/ProcessMaker/Rules/HttpOrigin.php
@@ -21,7 +21,10 @@ public function validate(string $attribute, mixed $value, Closure $fail): void
             !isset($parts['scheme'], $parts['host'])
             || !in_array(strtolower($parts['scheme']), ['http', 'https'], true)
             || !in_array($path, ['', '/'], true)
-            || isset($parts['query'], $parts['fragment'], $parts['user'], $parts['pass'])
+            || isset($parts['query'])
+            || isset($parts['fragment'])
+            || isset($parts['user'])
+            || isset($parts['pass'])
         ) {
             $fail(__('The instance URL must contain only an HTTP or HTTPS origin.'));
         }
diff --git a/resources/js/admin/devlink/components/Index.vue b/resources/js/admin/devlink/components/Index.vue
index fd36048c23..60088ad3b0 100644
--- a/resources/js/admin/devlink/components/Index.vue
+++ b/resources/js/admin/devlink/components/Index.vue
@@ -180,8 +180,27 @@ const handleNewUrlUpdate = (newValue) => {
   newUrl.value = newValue;
 };
 
+const isValidInstanceUrl = (value) => {
+  const trimmedValue = value.trim();
+  if (trimmedValue.includes('?') || trimmedValue.includes('#')) {
+    return false;
+  }
+
+  try {
+    const url = new URL(trimmedValue);
+
+    return ['http:', 'https:'].includes(url.protocol)
+      && url.hostname !== ''
+      && url.pathname === '/'
+      && url.username === ''
+      && url.password === '';
+  } catch {
+    return false;
+  }
+};
+
 const urlIsValid = computed(() => {
-  return /^(https?:\/\/[a-zA-Z0-9.-]+\.[a-zA-Z]{2,})(:\d{1,5})?$/.test(newUrl.value);
+  return isValidInstanceUrl(newUrl.value);
 });
 
 </script>
diff --git a/tests/Feature/Api/DevLinkTest.php b/tests/Feature/Api/DevLinkTest.php
index 79ff8ce074..f0a0af7b0e 100644
--- a/tests/Feature/Api/DevLinkTest.php
+++ b/tests/Feature/Api/DevLinkTest.php
@@ -88,6 +88,29 @@ public static function duplicateUrlProvider(): array
         ];
     }
 
+    #[DataProvider('nonOriginUrlProvider')]
+    public function testStoreRejectsUrlsThatAreNotHttpOrigins(string $url)
+    {
+        $response = $this->apiCall('POST', route('api.devlink.store'), [
+            'name' => self::REMOTE_QA_NAME,
+            'url' => $url,
+        ]);
+
+        $response->assertUnprocessable()->assertJsonValidationErrors('url');
+        $this->assertDatabaseCount('dev_links', 0);
+    }
+
+    public static function nonOriginUrlProvider(): array
+    {
+        return [
+            'path' => [self::REMOTE_INSTANCE_URL . '/api'],
+            'query' => [self::REMOTE_INSTANCE_URL . '?x=1'],
+            'fragment' => [self::REMOTE_INSTANCE_URL . '#section'],
+            'username' => ['https://user@remote-instance.test'],
+            'username and password' => ['https://user:password@remote-instance.test'],
+        ];
+    }
+
     public function testStoreRejectsAnExistingNameWithoutUpdatingItsUrl()
     {
         $devLink = DevLink::factory()->create([