review fixes

backend/src/services/identity-oci-auth/identity-oci-auth-service.ts

@@ -1,6 +1,7 @@
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
 import { ForbiddenError } from "@casl/ability";
 import jwt from "jsonwebtoken";
+import RE2 from "re2";
 
 import { IdentityAuthMethod } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
@@ -58,6 +59,13 @@ export const identityOciAuthServiceFactory = ({
 
     await blockLocalAndPrivateIpAddresses(headers.host);
 
+    // Validate OCI host format
+    if (!headers.host || !new RE2("^identity\\.[a-zA-Z0-9-]+\\.oraclecloud\\.com$").test(headers.host)) {
+      throw new BadRequestError({
+        message: "Invalid OCI host format. Expected format: identity.<region>.oraclecloud.com"
+      });
+    }
+
     const { data } = await request.get<TOciGetUserResponse>(`https://${headers.host}/20160918/users/${userOcid}`, {
       headers
     });
@@ -209,7 +217,7 @@ export const identityOciAuthServiceFactory = ({
 
     if (
       (accessTokenMaxTTL || identityOciAuth.accessTokenMaxTTL) > 0 &&
-      (accessTokenTTL || identityOciAuth.accessTokenMaxTTL) > (accessTokenMaxTTL || identityOciAuth.accessTokenMaxTTL)
+      (accessTokenTTL || identityOciAuth.accessTokenTTL) > (accessTokenMaxTTL || identityOciAuth.accessTokenMaxTTL)
     ) {
       throw new BadRequestError({ message: "Access token TTL cannot be greater than max TTL" });
     }

backend/src/services/identity-oci-auth/identity-oci-auth-validators.ts

@@ -1,13 +1,14 @@
+import RE2 from "re2";
 import { z } from "zod";
 
 const usernameSchema = z
   .string()
   .min(1, "Username cannot be empty")
-  .regex(/^[a-zA-Z0-9._@-]+$/, "Invalid OCI username format");
-
+  .refine((val) => new RE2("^[a-zA-Z0-9._@-]+$").test(val), "Invalid OCI username format");
 export const validateUsernames = z
   .string()
   .trim()
+  .max(500, "Input exceeds the maximum limit of 500 characters")
   .transform((val) =>
     val
       .split(",")

docs/api-reference/overview/authentication.mdx

@@ -13,17 +13,17 @@ To interact with the Infisical API, you will need to obtain an access token. Fol
 <AccordionGroup>
 <Accordion title="Why can I not create, read, update, or delete an identity?">
   There are a few reasons for why this might happen:
-  
+
   - You have insufficient organization permissions to create, read, update, delete identities.
   - The identity you are trying to read, update, or delete is more privileged than yourself.
   - The role you are trying to create an identity for or update an identity to is more privileged than yours.
 </Accordion>
 <Accordion title="Why is the Infisical API rejecting my identity credentials?">
   There are a few reasons for why this might happen:
-  
+
   - The client secret or access token has expired.
-  - The identity is insufficently permissioned to interact with the resources you wish to access.
+  - The identity is insufficiently permissioned to interact with the resources you wish to access.
   - You are attempting to access a `/raw` secrets endpoint that requires your project to disable E2EE.
   - The client secret/access token is being used from an untrusted IP.
 </Accordion>
-</AccordionGroup>
+</AccordionGroup>

docs/documentation/platform/identities/kubernetes-auth.mdx

@@ -280,7 +280,7 @@ In the following steps, we explore how to create and use identities for your app
   There are a few reasons for why this might happen:
 
 - The access token has expired.
-- The identity is insufficently permissioned to interact with the resources you wish to access.
+- The identity is insufficiently permissioned to interact with the resources you wish to access.
 - The client access token is being used from an untrusted IP.
 
 </Accordion>

docs/documentation/platform/identities/oci-auth.mdx

@@ -143,7 +143,7 @@ const requestAsJson = {
   headers: Object.fromEntries(request.headers.entries()),
 };
 
-const res = await fetch("https://tunnel.util.lol/api/v1/auth/oci-auth/login", {
+const res = await fetch("https://app.infisical.com/api/v1/auth/oci-auth/login", {
   method: "POST",
   headers: {
     "Content-Type": "application/json",

docs/documentation/platform/identities/token-auth.mdx

@@ -123,7 +123,7 @@ using the Token Auth authentication method.
   There are a few reasons for why this might happen:
 
   - The access token has expired. If this is the case, you should obtain a new access token or consider extending the token's TTL.
-  - The identity is insufficently permissioned to interact with the resources you wish to access.
+  - The identity is insufficiently permissioned to interact with the resources you wish to access.
   - The access token is being used from an untrusted IP.
 </Accordion>
 <Accordion title="What is access token renewal and TTL/Max TTL?">

docs/documentation/platform/identities/universal-auth.mdx

@@ -161,7 +161,7 @@ using the Universal Auth authentication method.
   There are a few reasons for why this might happen:
 
   - The client secret or access token has expired.
-  - The identity is insufficently permissioned to interact with the resources you wish to access.
+  - The identity is insufficiently permissioned to interact with the resources you wish to access.
   - The client secret/access token is being used from an untrusted IP.
 </Accordion>
 <Accordion title="What is access token renewal and TTL/Max TTL?">

docs/documentation/platform/secret-rotation/aws-iam-user-secret.mdx

@@ -182,10 +182,10 @@ In the following steps, we explore the end-to-end workflow for setting up this s
 
 <AccordionGroup>
   <Accordion title="Why are my AWS IAM credentials not rotating?">
-    There are a few reasons for why this might happen: 
+    There are a few reasons for why this might happen:
 	- The strategy configuration is invalid (e.g. the managing IAM user's credentials are incorrect, the target AWS region is incorrect, etc.)
-	- The managing IAM user is insufficently permissioned to rotate the credentials of the target IAM user. For instance, you may have setup
+	- The managing IAM user is insufficiently permissioned to rotate the credentials of the target IAM user. For instance, you may have setup
 	[paths](https://aws.amazon.com/blogs/security/optimize-aws-administration-with-iam-paths/) for the managing IAM user and the policy does not have the necessary
-    permissions to rotate the credentials. 
+    permissions to rotate the credentials.
   </Accordion>
 </AccordionGroup>