Review fixes

backend/src/db/migrations/20250815022242_identity-lockouts.ts

@@ -6,8 +6,11 @@ export async function up(knex: Knex): Promise<void> {
   if (await knex.schema.hasTable(TableName.IdentityUniversalAuth)) {
     const hasLockoutEnabled = await knex.schema.hasColumn(TableName.IdentityUniversalAuth, "lockoutEnabled");
     const hasLockoutThreshold = await knex.schema.hasColumn(TableName.IdentityUniversalAuth, "lockoutThreshold");
-    const hasLockoutDuration = await knex.schema.hasColumn(TableName.IdentityUniversalAuth, "lockoutDuration");
+    const hasLockoutDuration = await knex.schema.hasColumn(TableName.IdentityUniversalAuth, "lockoutDurationSeconds");
-    const hasLockoutCounterReset = await knex.schema.hasColumn(TableName.IdentityUniversalAuth, "lockoutCounterReset");
+    const hasLockoutCounterReset = await knex.schema.hasColumn(
+      TableName.IdentityUniversalAuth,
+      "lockoutCounterResetSeconds"
+    );
 
     await knex.schema.alterTable(TableName.IdentityUniversalAuth, async (t) => {
       if (!hasLockoutEnabled) {
@@ -17,10 +20,10 @@ export async function up(knex: Knex): Promise<void> {
         t.integer("lockoutThreshold").notNullable().defaultTo(3);
       }
       if (!hasLockoutDuration) {
-        t.integer("lockoutDuration").notNullable().defaultTo(300); // 5 minutes (in seconds)
+        t.integer("lockoutDurationSeconds").notNullable().defaultTo(300); // 5 minutes
       }
       if (!hasLockoutCounterReset) {
-        t.integer("lockoutCounterReset").notNullable().defaultTo(30); // 30 seconds
+        t.integer("lockoutCounterResetSeconds").notNullable().defaultTo(30); // 30 seconds
       }
     });
   }
@@ -30,8 +33,11 @@ export async function down(knex: Knex): Promise<void> {
   if (await knex.schema.hasTable(TableName.IdentityUniversalAuth)) {
     const hasLockoutEnabled = await knex.schema.hasColumn(TableName.IdentityUniversalAuth, "lockoutEnabled");
     const hasLockoutThreshold = await knex.schema.hasColumn(TableName.IdentityUniversalAuth, "lockoutThreshold");
-    const hasLockoutDuration = await knex.schema.hasColumn(TableName.IdentityUniversalAuth, "lockoutDuration");
+    const hasLockoutDuration = await knex.schema.hasColumn(TableName.IdentityUniversalAuth, "lockoutDurationSeconds");
-    const hasLockoutCounterReset = await knex.schema.hasColumn(TableName.IdentityUniversalAuth, "lockoutCounterReset");
+    const hasLockoutCounterReset = await knex.schema.hasColumn(
+      TableName.IdentityUniversalAuth,
+      "lockoutCounterResetSeconds"
+    );
 
     await knex.schema.alterTable(TableName.IdentityUniversalAuth, (t) => {
       if (hasLockoutEnabled) {
@@ -41,10 +47,10 @@ export async function down(knex: Knex): Promise<void> {
         t.dropColumn("lockoutThreshold");
       }
       if (hasLockoutDuration) {
-        t.dropColumn("lockoutDuration");
+        t.dropColumn("lockoutDurationSeconds");
       }
       if (hasLockoutCounterReset) {
-        t.dropColumn("lockoutCounterReset");
+        t.dropColumn("lockoutCounterResetSeconds");
       }
     });
   }

backend/src/db/schemas/identity-universal-auths.ts

@@ -21,8 +21,8 @@ export const IdentityUniversalAuthsSchema = z.object({
   accessTokenPeriod: z.coerce.number().default(0),
   lockoutEnabled: z.boolean().default(true),
   lockoutThreshold: z.number().default(3),
-  lockoutDuration: z.number().default(300),
+  lockoutDurationSeconds: z.number().default(300),
-  lockoutCounterReset: z.number().default(30)
+  lockoutCounterResetSeconds: z.number().default(30)
 });
 
 export type TIdentityUniversalAuths = z.infer<typeof IdentityUniversalAuthsSchema>;

backend/src/ee/services/audit-log/audit-log-types.ts

@@ -869,8 +869,8 @@ interface AddIdentityUniversalAuthEvent {
     accessTokenTrustedIps: Array<TIdentityTrustedIp>;
     lockoutEnabled: boolean;
     lockoutThreshold: number;
-    lockoutDuration: number;
+    lockoutDurationSeconds: number;
-    lockoutCounterReset: number;
+    lockoutCounterResetSeconds: number;
   };
 }
 
@@ -885,8 +885,8 @@ interface UpdateIdentityUniversalAuthEvent {
     accessTokenTrustedIps?: Array<TIdentityTrustedIp>;
     lockoutEnabled?: boolean;
     lockoutThreshold?: number;
-    lockoutDuration?: number;
+    lockoutDurationSeconds?: number;
-    lockoutCounterReset?: number;
+    lockoutCounterResetSeconds?: number;
   };
 }
 

backend/src/lib/api-docs/constants.ts

@@ -169,8 +169,9 @@ export const UNIVERSAL_AUTH = {
       "The period for an access token in seconds. This value will be referenced at renewal time. Default value is 0.",
     lockoutEnabled: "Whether the lockout feature is enabled.",
     lockoutThreshold: "The amount of times login must fail before locking the identity auth method.",
-    lockoutDuration: "How long an identity auth method lockout lasts.",
+    lockoutDurationSeconds: "How long an identity auth method lockout lasts.",
-    lockoutCounterReset: "How long to wait from the most recent failed login until resetting the lockout counter."
+    lockoutCounterResetSeconds:
+      "How long to wait from the most recent failed login until resetting the lockout counter."
   },
   RETRIEVE: {
     identityId: "The ID of the identity to retrieve the auth method for."
@@ -188,8 +189,9 @@ export const UNIVERSAL_AUTH = {
     accessTokenPeriod: "The new period for an access token in seconds.",
     lockoutEnabled: "Whether the lockout feature is enabled.",
     lockoutThreshold: "The amount of times login must fail before locking the identity auth method.",
-    lockoutDuration: "How long an identity auth method lockout lasts.",
+    lockoutDurationSeconds: "How long an identity auth method lockout lasts.",
-    lockoutCounterReset: "How long to wait from the most recent failed login until resetting the lockout counter."
+    lockoutCounterResetSeconds:
+      "How long to wait from the most recent failed login until resetting the lockout counter."
   },
   CREATE_CLIENT_SECRET: {
     identityId: "The ID of the identity to create a client secret for.",

backend/src/server/routes/v1/identity-universal-auth-router.ts

@@ -140,13 +140,18 @@ export const registerIdentityUaRouter = async (server: FastifyZodProvider) => {
           accessTokenPeriod: z.number().int().min(0).default(0).describe(UNIVERSAL_AUTH.ATTACH.accessTokenPeriod),
           lockoutEnabled: z.boolean().default(true).describe(UNIVERSAL_AUTH.ATTACH.lockoutEnabled),
           lockoutThreshold: z.number().min(1).max(30).default(3).describe(UNIVERSAL_AUTH.ATTACH.lockoutThreshold),
-          lockoutDuration: z.number().min(30).max(86400).default(300).describe(UNIVERSAL_AUTH.ATTACH.lockoutDuration),
+          lockoutDurationSeconds: z
-          lockoutCounterReset: z
+            .number()
+            .min(30)
+            .max(86400)
+            .default(300)
+            .describe(UNIVERSAL_AUTH.ATTACH.lockoutDurationSeconds),
+          lockoutCounterResetSeconds: z
             .number()
             .min(5)
             .max(3600)
             .default(30)
-            .describe(UNIVERSAL_AUTH.ATTACH.lockoutCounterReset)
+            .describe(UNIVERSAL_AUTH.ATTACH.lockoutCounterResetSeconds)
         })
         .refine(
           (val) => val.accessTokenTTL <= val.accessTokenMaxTTL,
@@ -183,8 +188,8 @@ export const registerIdentityUaRouter = async (server: FastifyZodProvider) => {
             accessTokenNumUsesLimit: identityUniversalAuth.accessTokenNumUsesLimit,
             lockoutEnabled: identityUniversalAuth.lockoutEnabled,
             lockoutThreshold: identityUniversalAuth.lockoutThreshold,
-            lockoutDuration: identityUniversalAuth.lockoutDuration,
+            lockoutDurationSeconds: identityUniversalAuth.lockoutDurationSeconds,
-            lockoutCounterReset: identityUniversalAuth.lockoutCounterReset
+            lockoutCounterResetSeconds: identityUniversalAuth.lockoutCounterResetSeconds
           }
         }
       });
@@ -259,13 +264,18 @@ export const registerIdentityUaRouter = async (server: FastifyZodProvider) => {
             .describe(UNIVERSAL_AUTH.UPDATE.accessTokenPeriod),
           lockoutEnabled: z.boolean().optional().describe(UNIVERSAL_AUTH.UPDATE.lockoutEnabled),
           lockoutThreshold: z.number().min(1).max(30).optional().describe(UNIVERSAL_AUTH.UPDATE.lockoutThreshold),
-          lockoutDuration: z.number().min(30).max(86400).optional().describe(UNIVERSAL_AUTH.UPDATE.lockoutDuration),
+          lockoutDurationSeconds: z
-          lockoutCounterReset: z
+            .number()
+            .min(30)
+            .max(86400)
+            .optional()
+            .describe(UNIVERSAL_AUTH.UPDATE.lockoutDurationSeconds),
+          lockoutCounterResetSeconds: z
             .number()
             .min(5)
             .max(3600)
             .optional()
-            .describe(UNIVERSAL_AUTH.UPDATE.lockoutCounterReset)
+            .describe(UNIVERSAL_AUTH.UPDATE.lockoutCounterResetSeconds)
         })
         .refine(
           (val) => (val.accessTokenMaxTTL && val.accessTokenTTL ? val.accessTokenTTL <= val.accessTokenMaxTTL : true),
@@ -301,8 +311,8 @@ export const registerIdentityUaRouter = async (server: FastifyZodProvider) => {
             accessTokenNumUsesLimit: identityUniversalAuth.accessTokenNumUsesLimit,
             lockoutEnabled: identityUniversalAuth.lockoutEnabled,
             lockoutThreshold: identityUniversalAuth.lockoutThreshold,
-            lockoutDuration: identityUniversalAuth.lockoutDuration,
+            lockoutDurationSeconds: identityUniversalAuth.lockoutDurationSeconds,
-            lockoutCounterReset: identityUniversalAuth.lockoutCounterReset
+            lockoutCounterResetSeconds: identityUniversalAuth.lockoutCounterResetSeconds
           }
         }
       });

backend/src/services/identity-ua/identity-ua-service.ts

@@ -131,7 +131,7 @@ export const identityUaServiceFactory = ({
 
           await keyStore.setItemWithExpiry(
             LOCKOUT_KEY,
-            lockout.lockedOut ? identityUa.lockoutDuration : identityUa.lockoutCounterReset,
+            lockout.lockedOut ? identityUa.lockoutDurationSeconds : identityUa.lockoutCounterResetSeconds,
             JSON.stringify(lockout)
           );
         }
@@ -251,8 +251,8 @@ export const identityUaServiceFactory = ({
     accessTokenPeriod,
     lockoutEnabled,
     lockoutThreshold,
-    lockoutDuration,
+    lockoutDurationSeconds,
-    lockoutCounterReset
+    lockoutCounterResetSeconds
   }: TAttachUaDTO) => {
     await validateIdentityUpdateForSuperAdminPrivileges(identityId, isActorSuperAdmin);
 
@@ -325,8 +325,8 @@ export const identityUaServiceFactory = ({
           accessTokenPeriod,
           lockoutEnabled,
           lockoutThreshold,
-          lockoutDuration,
+          lockoutDurationSeconds,
-          lockoutCounterReset
+          lockoutCounterResetSeconds
         },
         tx
       );
@@ -349,8 +349,8 @@ export const identityUaServiceFactory = ({
     actorOrgId,
     lockoutEnabled,
     lockoutThreshold,
-    lockoutDuration,
+    lockoutDurationSeconds,
-    lockoutCounterReset
+    lockoutCounterResetSeconds
   }: TUpdateUaDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
@@ -429,8 +429,8 @@ export const identityUaServiceFactory = ({
         : undefined,
       lockoutEnabled,
       lockoutThreshold,
-      lockoutDuration,
+      lockoutDurationSeconds,
-      lockoutCounterReset
+      lockoutCounterResetSeconds
     });
     return { ...updatedUaAuth, orgId: identityMembershipOrg.orgId };
   };

backend/src/services/identity-ua/identity-ua-types.ts

@@ -11,8 +11,8 @@ export type TAttachUaDTO = {
   isActorSuperAdmin?: boolean;
   lockoutEnabled: boolean;
   lockoutThreshold: number;
-  lockoutDuration: number;
+  lockoutDurationSeconds: number;
-  lockoutCounterReset: number;
+  lockoutCounterResetSeconds: number;
 } & Omit<TProjectPermission, "projectId">;
 
 export type TUpdateUaDTO = {
@@ -25,8 +25,8 @@ export type TUpdateUaDTO = {
   accessTokenTrustedIps?: { ipAddress: string }[];
   lockoutEnabled?: boolean;
   lockoutThreshold?: number;
-  lockoutDuration?: number;
+  lockoutDurationSeconds?: number;
-  lockoutCounterReset?: number;
+  lockoutCounterResetSeconds?: number;
 } & Omit<TProjectPermission, "projectId">;
 
 export type TGetUaDTO = {

frontend/src/hooks/api/identities/mutations.tsx

@@ -152,8 +152,8 @@ export const useAddIdentityUniversalAuth = () => {
       accessTokenTrustedIps,
       lockoutEnabled,
       lockoutThreshold,
-      lockoutDuration,
+      lockoutDurationSeconds,
-      lockoutCounterReset
+      lockoutCounterResetSeconds
     }) => {
       const {
         data: { identityUniversalAuth }
@@ -165,8 +165,8 @@ export const useAddIdentityUniversalAuth = () => {
         accessTokenTrustedIps,
         lockoutEnabled,
         lockoutThreshold,
-        lockoutDuration,
+        lockoutDurationSeconds,
-        lockoutCounterReset
+        lockoutCounterResetSeconds
       });
       return identityUniversalAuth;
     },
@@ -195,8 +195,8 @@ export const useUpdateIdentityUniversalAuth = () => {
       accessTokenPeriod,
       lockoutEnabled,
       lockoutThreshold,
-      lockoutDuration,
+      lockoutDurationSeconds,
-      lockoutCounterReset
+      lockoutCounterResetSeconds
     }) => {
       const {
         data: { identityUniversalAuth }
@@ -209,8 +209,8 @@ export const useUpdateIdentityUniversalAuth = () => {
         accessTokenPeriod,
         lockoutEnabled,
         lockoutThreshold,
-        lockoutDuration,
+        lockoutDurationSeconds,
-        lockoutCounterReset
+        lockoutCounterResetSeconds
       });
       return identityUniversalAuth;
     },

frontend/src/hooks/api/identities/types.ts

@@ -116,8 +116,8 @@ export type IdentityUniversalAuth = {
   accessTokenPeriod: number;
   lockoutEnabled: boolean;
   lockoutThreshold: number;
-  lockoutDuration: number;
+  lockoutDurationSeconds: number;
-  lockoutCounterReset: number;
+  lockoutCounterResetSeconds: number;
 };
 
 export type AddIdentityUniversalAuthDTO = {
@@ -135,8 +135,8 @@ export type AddIdentityUniversalAuthDTO = {
   }[];
   lockoutEnabled: boolean;
   lockoutThreshold: number;
-  lockoutDuration: number;
+  lockoutDurationSeconds: number;
-  lockoutCounterReset: number;
+  lockoutCounterResetSeconds: number;
 };
 
 export type UpdateIdentityUniversalAuthDTO = {
@@ -154,8 +154,8 @@ export type UpdateIdentityUniversalAuthDTO = {
   }[];
   lockoutEnabled?: boolean;
   lockoutThreshold?: number;
-  lockoutDuration?: number;
+  lockoutDurationSeconds?: number;
-  lockoutCounterReset?: number;
+  lockoutCounterResetSeconds?: number;
 };
 
 export type DeleteIdentityUniversalAuthDTO = {

frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityModal.tsx

@@ -151,8 +151,8 @@ export const IdentityModal = ({ popUp, handlePopUpToggle }: Props) => {
           accessTokenPeriod: 0,
           lockoutEnabled: true,
           lockoutThreshold: 3,
-          lockoutDuration: 300,
+          lockoutDurationSeconds: 300,
-          lockoutCounterReset: 30
+          lockoutCounterResetSeconds: 30
         });
 
         handlePopUpToggle("identity", false);

frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityUniversalAuthForm.tsx

@@ -215,8 +215,8 @@ export const IdentityUniversalAuthForm = ({
 
   useEffect(() => {
     if (data) {
-      const lockoutDurationObj = getObjectFromSeconds(data.lockoutDuration);
+      const lockoutDurationObj = getObjectFromSeconds(data.lockoutDurationSeconds);
-      const lockoutCounterResetObj = getObjectFromSeconds(data.lockoutCounterReset);
+      const lockoutCounterResetObj = getObjectFromSeconds(data.lockoutCounterResetSeconds);
 
       reset({
         accessTokenTTL: String(data.accessTokenTTL),
@@ -279,8 +279,11 @@ export const IdentityUniversalAuthForm = ({
     try {
       if (!identityId) return;
 
-      const lockoutDuration = durationToSeconds(Number(lockoutDurationValue), lockoutDurationUnit);
+      const lockoutDurationSeconds = durationToSeconds(
-      const lockoutCounterReset = durationToSeconds(
+        Number(lockoutDurationValue),
+        lockoutDurationUnit
+      );
+      const lockoutCounterResetSeconds = durationToSeconds(
         Number(lockoutCounterResetValue),
         lockoutCounterResetUnit
       );
@@ -298,8 +301,8 @@ export const IdentityUniversalAuthForm = ({
           accessTokenPeriod: Number(accessTokenPeriod),
           lockoutEnabled,
           lockoutThreshold: Number(lockoutThreshold),
-          lockoutDuration,
+          lockoutDurationSeconds,
-          lockoutCounterReset
+          lockoutCounterResetSeconds
         });
       } else {
         // create new universal auth configuration
@@ -315,8 +318,8 @@ export const IdentityUniversalAuthForm = ({
           accessTokenPeriod: Number(accessTokenPeriod),
           lockoutEnabled,
           lockoutThreshold: Number(lockoutThreshold),
-          lockoutDuration: Number(lockoutDuration),
+          lockoutDurationSeconds: Number(lockoutDurationSeconds),
-          lockoutCounterReset: Number(lockoutCounterReset)
+          lockoutCounterResetSeconds: Number(lockoutCounterResetSeconds)
         });
       }
 

frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityUniversalAuthContent.tsx

@@ -1,6 +1,7 @@
 import { useState } from "react";
 import { faBan, faCheck, faCopy } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import ms from "ms";
 
 import { createNotification } from "@app/components/notifications";
 import { OrgPermissionCan } from "@app/components/permissions";
@@ -135,10 +136,10 @@ export const ViewIdentityUniversalAuthContent = ({
         {data.lockoutThreshold}
       </IdentityAuthFieldDisplay>
       <IdentityAuthFieldDisplay label="Lockout Duration">
-        {data.lockoutDuration} seconds
+        {ms(data.lockoutDurationSeconds * 1000, { long: true })}
       </IdentityAuthFieldDisplay>
       <IdentityAuthFieldDisplay label="Lockout Counter Reset">
-        {data.lockoutCounterReset} seconds
+        {ms(data.lockoutCounterResetSeconds * 1000, { long: true })}
       </IdentityAuthFieldDisplay>
       <div className="col-span-2 my-3">
         <div className="mb-3 border-b border-mineshaft-500 pb-2">