review fixes

backend/src/db/migrations/20250508210717_identity-oci-auth.ts

@@ -17,7 +17,7 @@ export async function up(knex: Knex): Promise<void> {
       t.string("type").notNullable();
 
       t.string("tenancyOcid").notNullable();
-      t.string("allowedUsernames").notNullable();
+      t.string("allowedUsernames").nullable();
     });
   }
 

backend/src/db/schemas/identity-oci-auths.ts

@@ -18,7 +18,7 @@ export const IdentityOciAuthsSchema = z.object({
   identityId: z.string().uuid(),
   type: z.string(),
   tenancyOcid: z.string(),
-  allowedUsernames: z.string()
+  allowedUsernames: z.string().nullable().optional()
 });
 
 export type TIdentityOciAuths = z.infer<typeof IdentityOciAuthsSchema>;

backend/src/ee/services/audit-log/audit-log-types.ts

@@ -1022,7 +1022,7 @@ interface AddIdentityOciAuthEvent {
   metadata: {
     identityId: string;
     tenancyOcid: string;
-    allowedUsernames: string;
+    allowedUsernames: string | null;
     accessTokenTTL: number;
     accessTokenMaxTTL: number;
     accessTokenNumUsesLimit: number;
@@ -1042,7 +1042,7 @@ interface UpdateIdentityOciAuthEvent {
   metadata: {
     identityId: string;
     tenancyOcid?: string;
-    allowedUsernames?: string;
+    allowedUsernames: string | null;
     accessTokenTTL?: number;
     accessTokenMaxTTL?: number;
     accessTokenNumUsesLimit?: number;

backend/src/server/routes/v1/identity-oci-auth-router.ts

@@ -143,7 +143,7 @@ export const registerIdentityOciAuthRouter = async (server: FastifyZodProvider)
           metadata: {
             identityId: identityOciAuth.identityId,
             tenancyOcid: identityOciAuth.tenancyOcid,
-            allowedUsernames: identityOciAuth.allowedUsernames,
+            allowedUsernames: identityOciAuth.allowedUsernames || null,
             accessTokenTTL: identityOciAuth.accessTokenTTL,
             accessTokenMaxTTL: identityOciAuth.accessTokenMaxTTL,
             accessTokenTrustedIps: identityOciAuth.accessTokenTrustedIps as TIdentityTrustedIp[],
@@ -214,7 +214,8 @@ export const registerIdentityOciAuthRouter = async (server: FastifyZodProvider)
         actorAuthMethod: req.permission.authMethod,
         actorOrgId: req.permission.orgId,
         ...req.body,
-        identityId: req.params.identityId
+        identityId: req.params.identityId,
+        allowedUsernames: req.body.allowedUsernames || null
       });
 
       await server.services.auditLog.createAuditLog({
@@ -225,7 +226,7 @@ export const registerIdentityOciAuthRouter = async (server: FastifyZodProvider)
           metadata: {
             identityId: identityOciAuth.identityId,
             tenancyOcid: identityOciAuth.tenancyOcid,
-            allowedUsernames: identityOciAuth.allowedUsernames,
+            allowedUsernames: identityOciAuth.allowedUsernames || null,
             accessTokenTTL: identityOciAuth.accessTokenTTL,
             accessTokenMaxTTL: identityOciAuth.accessTokenMaxTTL,
             accessTokenTrustedIps: identityOciAuth.accessTokenTrustedIps as TIdentityTrustedIp[],

backend/src/services/identity-oci-auth/identity-oci-auth-service.ts

@@ -1,5 +1,6 @@
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
 import { ForbiddenError } from "@casl/ability";
+import { AxiosError } from "axios";
 import jwt from "jsonwebtoken";
 import RE2 from "re2";
 
@@ -15,6 +16,7 @@ import { getConfig } from "@app/lib/config/env";
 import { request } from "@app/lib/config/request";
 import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
+import { logger } from "@app/lib/logger";
 import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -60,15 +62,20 @@ export const identityOciAuthServiceFactory = ({
     await blockLocalAndPrivateIpAddresses(headers.host);
 
     // Validate OCI host format
-    if (!headers.host || !new RE2("^identity\\.[a-zA-Z0-9-]+\\.oraclecloud\\.com$").test(headers.host)) {
+    if (!headers.host || !new RE2("^identity\\.([a-z]{2}-[a-z]+-[1-9])\\.oraclecloud\\.com$").test(headers.host)) {
       throw new BadRequestError({
         message: "Invalid OCI host format. Expected format: identity.<region>.oraclecloud.com"
       });
     }
 
-    const { data } = await request.get<TOciGetUserResponse>(`https://${headers.host}/20160918/users/${userOcid}`, {
-      headers
-    });
+    const { data } = await request
+      .get<TOciGetUserResponse>(`https://${headers.host}/20160918/users/${userOcid}`, {
+        headers
+      })
+      .catch((err: AxiosError) => {
+        logger.error(err.response, "OciIdentityLogin: Failed to authenticate with Oracle Cloud");
+        throw err;
+      });
 
     if (data.compartmentId !== identityOciAuth.tenancyOcid) {
       throw new UnauthorizedError({

backend/src/services/identity-oci-auth/identity-oci-auth-types.ts

@@ -13,7 +13,7 @@ export type TLoginOciAuthDTO = {
 export type TAttachOciAuthDTO = {
   identityId: string;
   tenancyOcid: string;
-  allowedUsernames: string;
+  allowedUsernames: string | null;
   accessTokenTTL: number;
   accessTokenMaxTTL: number;
   accessTokenNumUsesLimit: number;
@@ -23,8 +23,8 @@ export type TAttachOciAuthDTO = {
 
 export type TUpdateOciAuthDTO = {
   identityId: string;
-  tenancyOcid?: string;
-  allowedUsernames?: string;
+  tenancyOcid: string;
+  allowedUsernames: string | null;
   accessTokenTTL?: number;
   accessTokenMaxTTL?: number;
   accessTokenNumUsesLimit?: number;

backend/src/services/identity-oci-auth/identity-oci-auth-validators.ts

@@ -9,16 +9,18 @@ export const validateUsernames = z
   .string()
   .trim()
   .max(500, "Input exceeds the maximum limit of 500 characters")
-  .transform((val) =>
-    val
+  .nullish()
+  .transform((val) => {
+    if (!val) return [];
+    return val
       .split(",")
       .map((s) => s.trim())
-      .filter(Boolean)
-  )
+      .filter(Boolean);
+  })
   .refine((arr) => arr.every((name) => usernameSchema.safeParse(name).success), {
     message: "One or more usernames are invalid"
   })
-  .transform((arr) => arr.join(", "));
+  .transform((arr) => (arr.length > 0 ? arr.join(", ") : null));
 
 export const validateTenancy = z
   .string()