Swap to a single service function with a callback

backend/src/keystore/keystore.ts

@@ -1,9 +1,10 @@
+import { Cluster, Redis } from "ioredis";
+
 import { buildRedisFromConfig, TRedisConfigKeys } from "@app/lib/config/redis";
 import { pgAdvisoryLockHashText } from "@app/lib/crypto/hashtext";
 import { applyJitter } from "@app/lib/dates";
 import { delay as delayMs } from "@app/lib/delay";
 import { ExecutionResult, Redlock, Settings } from "@app/lib/red-lock";
-import { Redis, Cluster } from "ioredis";
 
 export const PgSqlLock = {
   BootUpMigration: 2023,

backend/src/server/routes/v1/identity-ldap-auth-router.ts

@@ -8,7 +8,7 @@
 
 import { Authenticator } from "@fastify/passport";
 import fastifySession from "@fastify/session";
-import { FastifyRequest } from "fastify";
+import { FastifyReply, FastifyRequest } from "fastify";
 import { IncomingMessage } from "http";
 import LdapStrategy from "passport-ldapauth";
 import { z } from "zod";
@@ -136,40 +136,23 @@ export const registerIdentityLdapAuthRouter = async (server: FastifyZodProvider)
       }
     },
     preValidation: [
-      async (req, res) => {
+      (req, res) => {
-        const { lock } = await server.services.identityLdapAuth.checkLdapLockout({
+        const passportAuth = (request: FastifyRequest, reply: FastifyReply) =>
-          identityId: req.body.identityId,
+          (
-          username: req.body.username
-        });
-
-        try {
-          const passportRes = await (
             passport.authenticate("ldapauth", {
               failWithError: true,
               session: false
             }) as any
-          )(req, res);
+          )(request, reply);
 
-          await server.services.identityLdapAuth.resetLdapLockoutCounter({
+        const { identityId, username } = req.body;
-            identityId: req.body.identityId,
+        return server.services.identityLdapAuth.withLdapLockout(
-            username: req.body.username
+          {
-          });
+            identityId,
-
+            username
-          return passportRes;
+          },
-        } catch (error) {
+          () => passportAuth(req, res)
-          if ((error as any).status === 401) {
+        );
-            await server.services.identityLdapAuth.incrementLdapLockout({
-              identityId: req.body.identityId,
-              username: req.body.username
-            });
-
-            throw new UnauthorizedError({ message: "Invalid credentials" });
-          }
-
-          throw error;
-        } finally {
-          await lock.release();
-        }
       }
     ],
     handler: async (req) => {

backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts

@@ -43,9 +43,7 @@ import {
   TCheckLdapAuthLockoutDTO,
   TClearLdapAuthLockoutsDTO,
   TGetLdapAuthDTO,
-  TIncrementLdapAuthLockoutDTO,
   TLoginLdapAuthDTO,
-  TResetLdapAuthLockoutCounterDTO,
   TRevokeLdapAuthDTO,
   TUpdateLdapAuthDTO
 } from "./identity-ldap-auth-types";
@@ -653,7 +651,10 @@ export const identityLdapAuthServiceFactory = ({
     return revokedIdentityLdapAuth;
   };
 
-  const checkLdapLockout = async ({ identityId, username }: TCheckLdapAuthLockoutDTO) => {
+  const withLdapLockout = async <T>(
+    { identityId, username }: TCheckLdapAuthLockoutDTO,
+    authFn: () => Promise<T>
+  ): Promise<T> => {
     const LOCKOUT_KEY = `lockout:identity:${identityId}:${IdentityAuthMethod.LDAP_AUTH}:${username.trim().toLowerCase()}`;
 
     let lock: Awaited<ReturnType<typeof keyStore.acquireLock>>;
@@ -667,36 +668,34 @@ export const identityLdapAuthServiceFactory = ({
       logger.info(
         `identity login failed to acquire lock [identityId=${identityId}] [authMethod=${IdentityAuthMethod.LDAP_AUTH}]`
       );
-      throw new RateLimitError({ message: "Rate limit exceeded" });
+      throw new RateLimitError({ message: "Failed to acquire lock: rate limit exceeded" });
     }
 
+    try {
       const lockoutRaw = await keyStore.getItem(LOCKOUT_KEY);
-
       if (lockoutRaw) {
         const lockout = JSON.parse(lockoutRaw) as LockoutObject;
-
         if (lockout.lockedOut) {
-        await lock.release();
           throw new UnauthorizedError({
             message: "This identity auth method is temporarily locked, please try again later"
           });
         }
       }
 
-    return { lock };
+      const result = await authFn();
-  };
 
-  const incrementLdapLockout = async ({ identityId, username }: TIncrementLdapAuthLockoutDTO) => {
+      await keyStore.deleteItem(LOCKOUT_KEY);
+
+      return result;
+    } catch (error) {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-member-access
+      if ((error as any).status === 401) {
         const identityLdapAuth = await identityLdapAuthDAL.findOne({ identityId });
         if (!identityLdapAuth) {
-      throw new UnauthorizedError({
+          throw new UnauthorizedError({ message: "Invalid credentials" });
-        message: "Invalid credentials"
-      });
         }
 
         if (identityLdapAuth.lockoutEnabled) {
-      const LOCKOUT_KEY = `lockout:identity:${identityId}:${IdentityAuthMethod.LDAP_AUTH}:${username.trim().toLowerCase()}`;
-
           let lockout: LockoutObject = {
             lockedOut: false,
             failedAttempts: 0
@@ -718,12 +717,13 @@ export const identityLdapAuthServiceFactory = ({
             JSON.stringify(lockout)
           );
         }
-  };
 
-  const resetLdapLockoutCounter = async ({ identityId, username }: TResetLdapAuthLockoutCounterDTO) => {
+        throw new UnauthorizedError({ message: "Invalid credentials" });
-    await keyStore.deleteItem(
+      }
-      `lockout:identity:${identityId}:${IdentityAuthMethod.LDAP_AUTH}:${username.trim().toLowerCase()}`
+      throw error;
-    );
+    } finally {
+      await lock.release();
+    }
   };
 
   const clearLdapAuthLockouts = async ({
@@ -765,9 +765,7 @@ export const identityLdapAuthServiceFactory = ({
     login,
     revokeIdentityLdapAuth,
     getLdapAuth,
-    checkLdapLockout,
+    withLdapLockout,
-    incrementLdapLockout,
-    resetLdapLockoutCounter,
     clearLdapAuthLockouts
   };
 };

backend/src/services/identity-ldap-auth/identity-ldap-auth-types.ts

@@ -73,13 +73,3 @@ export type TCheckLdapAuthLockoutDTO = {
   identityId: string;
   username: string;
 };
-
-export type TIncrementLdapAuthLockoutDTO = {
-  identityId: string;
-  username: string;
-};
-
-export type TResetLdapAuthLockoutCounterDTO = {
-  identityId: string;
-  username: string;
-};