add tenancy OCID requirement

backend/src/services/identity-oci-auth/identity-oci-auth-service.ts

@@ -70,6 +70,12 @@ export const identityOciAuthServiceFactory = ({
       headers
     });
 
+    if (data.compartmentId !== identityOciAuth.tenancyOcid) {
+      throw new UnauthorizedError({
+        message: "Access denied: OCI account isn't part of tenancy."
+      });
+    }
+
     if (identityOciAuth.allowedUsernames) {
       const isAccountAllowed = identityOciAuth.allowedUsernames.split(",").some((name) => name.trim() === data.name);
 
@@ -121,6 +127,7 @@ export const identityOciAuthServiceFactory = ({
 
   const attachOciAuth = async ({
     identityId,
+    tenancyOcid,
     allowedUsernames,
     accessTokenTTL,
     accessTokenMaxTTL,
@@ -179,6 +186,7 @@ export const identityOciAuthServiceFactory = ({
         {
           identityId: identityMembershipOrg.identityId,
           type: "iam",
+          tenancyOcid,
           allowedUsernames,
           accessTokenMaxTTL,
           accessTokenTTL,
@@ -194,6 +202,7 @@ export const identityOciAuthServiceFactory = ({
 
   const updateOciAuth = async ({
     identityId,
+    tenancyOcid,
     allowedUsernames,
     accessTokenTTL,
     accessTokenMaxTTL,
@@ -250,6 +259,7 @@ export const identityOciAuthServiceFactory = ({
     });
 
     const updatedOciAuth = await identityOciAuthDAL.updateById(identityOciAuth.id, {
+      tenancyOcid,
       allowedUsernames,
       accessTokenMaxTTL,
       accessTokenTTL,

backend/src/services/identity-oci-auth/identity-oci-auth-types.ts

@@ -12,6 +12,7 @@ export type TLoginOciAuthDTO = {
 
 export type TAttachOciAuthDTO = {
   identityId: string;
+  tenancyOcid: string;
   allowedUsernames: string;
   accessTokenTTL: number;
   accessTokenMaxTTL: number;
@@ -22,6 +23,7 @@ export type TAttachOciAuthDTO = {
 
 export type TUpdateOciAuthDTO = {
   identityId: string;
+  tenancyOcid?: string;
   allowedUsernames?: string;
   accessTokenTTL?: number;
   accessTokenMaxTTL?: number;

backend/src/services/identity-oci-auth/identity-oci-auth-validators.ts

@@ -19,3 +19,12 @@ export const validateUsernames = z
     message: "One or more usernames are invalid"
   })
   .transform((arr) => arr.join(", "));
+
+export const validateTenancy = z
+  .string()
+  .trim()
+  .min(1, "Tenancy OCID cannot be empty.")
+  .refine(
+    (val) => new RE2("^ocid1\\.tenancy\\.oc1\\..+$").test(val),
+    "Invalid Tenancy OCID format. Must start with ocid1.tenancy.oc1."
+  );