From 16c51af3404d023b855e99b361fc8627c9d495ec Mon Sep 17 00:00:00 2001
From: x032205 <x032205@gmail.com>
Date: Sat, 17 May 2025 02:17:41 -0400
Subject: [PATCH] review fixes

---
 .../src/server/routes/v1/organization-router.ts    |  7 ++++++-
 .../secret-sharing/secret-sharing-service.ts       |  4 +++-
 .../OrgSecurityTab/OrgSecretShareLimitSection.tsx  | 14 ++++++++++++++
 3 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/backend/src/server/routes/v1/organization-router.ts b/backend/src/server/routes/v1/organization-router.ts
index c39c0ab4d..c489d685d 100644
--- a/backend/src/server/routes/v1/organization-router.ts
+++ b/backend/src/server/routes/v1/organization-router.ts
@@ -282,9 +282,14 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
         sshProductEnabled: z.boolean().optional(),
         scannerProductEnabled: z.boolean().optional(),
         shareSecretsProductEnabled: z.boolean().optional(),
-        maxSharedSecretLifetime: z.number().max(2592000, "Max Shared Secret lifetime cannot exceed 30 days").optional(),
+        maxSharedSecretLifetime: z
+          .number()
+          .min(300, "Max Shared Secret lifetime cannot be under 5 minutes")
+          .max(2592000, "Max Shared Secret lifetime cannot exceed 30 days")
+          .optional(),
         maxSharedSecretViewLimit: z
           .number()
+          .min(1, "Max Shared Secret view count cannot be lower than 1")
           .max(1000, "Max Shared Secret view count cannot exceed 1000")
           .nullable()
           .optional()
diff --git a/backend/src/services/secret-sharing/secret-sharing-service.ts b/backend/src/services/secret-sharing/secret-sharing-service.ts
index a40861790..e216cb939 100644
--- a/backend/src/services/secret-sharing/secret-sharing-service.ts
+++ b/backend/src/services/secret-sharing/secret-sharing-service.ts
@@ -60,7 +60,9 @@ export const secretSharingServiceFactory = ({
     }
 
     const fiveMins = 5 * 60 * 1000;
-    if (expiryTime - currentTime < fiveMins) {
+
+    // 1 second buffer
+    if (expiryTime - currentTime + 1000 < fiveMins) {
       throw new BadRequestError({ message: "Expiration time cannot be less than 5 mins" });
     }
   };
diff --git a/frontend/src/pages/organization/SettingsPage/components/OrgSecurityTab/OrgSecretShareLimitSection.tsx b/frontend/src/pages/organization/SettingsPage/components/OrgSecurityTab/OrgSecretShareLimitSection.tsx
index cb5c99daa..e0d88a082 100644
--- a/frontend/src/pages/organization/SettingsPage/components/OrgSecurityTab/OrgSecretShareLimitSection.tsx
+++ b/frontend/src/pages/organization/SettingsPage/components/OrgSecurityTab/OrgSecretShareLimitSection.tsx
@@ -10,6 +10,7 @@ import { OrgPermissionActions, OrgPermissionSubjects, useOrganization } from "@a
 import { useUpdateOrg } from "@app/hooks/api";
 
 const MAX_SHARED_SECRET_LIFETIME_SECONDS = 30 * 24 * 60 * 60; // 30 days in seconds
+const MIN_SHARED_SECRET_LIFETIME_SECONDS = 5 * 60; // 5 minutes in seconds
 
 // Helper function to convert duration to seconds
 const durationToSeconds = (value: number, unit: "m" | "h" | "d"): number => {
@@ -77,6 +78,7 @@ const formSchema = z
 
     const durationInSeconds = durationToSeconds(maxLifetimeValue, maxLifetimeUnit);
 
+    // Check max limit
     if (durationInSeconds > MAX_SHARED_SECRET_LIFETIME_SECONDS) {
       let message = "Duration exceeds maximum allowed limit";
 
@@ -94,6 +96,17 @@ const formSchema = z
         path: ["maxLifetimeValue"]
       });
     }
+
+    // Check min limit
+    if (durationInSeconds < MIN_SHARED_SECRET_LIFETIME_SECONDS) {
+      const message = `Duration must be at least ${MIN_SHARED_SECRET_LIFETIME_SECONDS / 60} minutes`; // 5 minutes
+
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message,
+        path: ["maxLifetimeValue"]
+      });
+    }
   });
 
 type TForm = z.infer<typeof formSchema>;
@@ -187,6 +200,7 @@ export const OrgSecretShareLimitSection = () => {
                   <FormControl
                     isError={Boolean(error)}
                     errorText={error?.message}
+                    tooltipText="The max amount of time that can be set before the secret share link expires."
                     label="Max Lifetime"
                     className="w-full"
                   >