review fixes

backend/src/services/identity-oci-auth/identity-oci-auth-service.ts

@@ -1,5 +1,6 @@
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
 import { ForbiddenError } from "@casl/ability";
+import { AxiosError } from "axios";
 import jwt from "jsonwebtoken";
 import RE2 from "re2";
 
@@ -15,6 +16,7 @@ import { getConfig } from "@app/lib/config/env";
 import { request } from "@app/lib/config/request";
 import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
+import { logger } from "@app/lib/logger";
 import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -60,15 +62,20 @@ export const identityOciAuthServiceFactory = ({
     await blockLocalAndPrivateIpAddresses(headers.host);
 
     // Validate OCI host format
-    if (!headers.host || !new RE2("^identity\\.[a-zA-Z0-9-]+\\.oraclecloud\\.com$").test(headers.host)) {
+    if (!headers.host || !new RE2("^identity\\.([a-z]{2}-[a-z]+-[1-9])\\.oraclecloud\\.com$").test(headers.host)) {
       throw new BadRequestError({
         message: "Invalid OCI host format. Expected format: identity.<region>.oraclecloud.com"
       });
     }
 
-    const { data } = await request.get<TOciGetUserResponse>(`https://${headers.host}/20160918/users/${userOcid}`, {
-      headers
-    });
+    const { data } = await request
+      .get<TOciGetUserResponse>(`https://${headers.host}/20160918/users/${userOcid}`, {
+        headers
+      })
+      .catch((err: AxiosError) => {
+        logger.error(err.response, "OciIdentityLogin: Failed to authenticate with Oracle Cloud");
+        throw err;
+      });
 
     if (data.compartmentId !== identityOciAuth.tenancyOcid) {
       throw new UnauthorizedError({

backend/src/services/identity-oci-auth/identity-oci-auth-types.ts

@@ -13,7 +13,7 @@ export type TLoginOciAuthDTO = {
 export type TAttachOciAuthDTO = {
   identityId: string;
   tenancyOcid: string;
-  allowedUsernames: string;
+  allowedUsernames: string | null;
   accessTokenTTL: number;
   accessTokenMaxTTL: number;
   accessTokenNumUsesLimit: number;
@@ -23,8 +23,8 @@ export type TAttachOciAuthDTO = {
 
 export type TUpdateOciAuthDTO = {
   identityId: string;
-  tenancyOcid?: string;
-  allowedUsernames?: string;
+  tenancyOcid: string;
+  allowedUsernames: string | null;
   accessTokenTTL?: number;
   accessTokenMaxTTL?: number;
   accessTokenNumUsesLimit?: number;

backend/src/services/identity-oci-auth/identity-oci-auth-validators.ts

@@ -9,16 +9,18 @@ export const validateUsernames = z
   .string()
   .trim()
   .max(500, "Input exceeds the maximum limit of 500 characters")
-  .transform((val) =>
-    val
+  .nullish()
+  .transform((val) => {
+    if (!val) return [];
+    return val
       .split(",")
       .map((s) => s.trim())
-      .filter(Boolean)
-  )
+      .filter(Boolean);
+  })
   .refine((arr) => arr.every((name) => usernameSchema.safeParse(name).success), {
     message: "One or more usernames are invalid"
   })
-  .transform((arr) => arr.join(", "));
+  .transform((arr) => (arr.length > 0 ? arr.join(", ") : null));
 
 export const validateTenancy = z
   .string()