Merge pull request #3029 from akhilmhdh/feat/min-ttl

Resolved ttl and max ttl to be zero

backend/src/server/routes/v1/identity-aws-iam-auth-router.ts

@@ -79,7 +79,8 @@ export const registerIdentityAwsAuthRouter = async (server: FastifyZodProvider)
       params: z.object({
         identityId: z.string().trim().describe(AWS_AUTH.ATTACH.identityId)
       }),
-      body: z.object({
+      body: z
+        .object({
           stsEndpoint: z
             .string()
             .trim()
@@ -99,24 +100,23 @@ export const registerIdentityAwsAuthRouter = async (server: FastifyZodProvider)
           accessTokenTTL: z
             .number()
             .int()
-          .min(1)
+            .min(0)
             .max(315360000)
-          .refine((value) => value !== 0, {
-            message: "accessTokenTTL must have a non zero number"
-          })
             .default(2592000)
             .describe(AWS_AUTH.ATTACH.accessTokenTTL),
           accessTokenMaxTTL: z
             .number()
             .int()
+            .min(1)
             .max(315360000)
-          .refine((value) => value !== 0, {
-            message: "accessTokenMaxTTL must have a non zero number"
-          })
             .default(2592000)
             .describe(AWS_AUTH.ATTACH.accessTokenMaxTTL),
           accessTokenNumUsesLimit: z.number().int().min(0).default(0).describe(AWS_AUTH.ATTACH.accessTokenNumUsesLimit)
-      }),
+        })
+        .refine(
+          (val) => val.accessTokenTTL <= val.accessTokenMaxTTL,
+          "Access Token TTL cannot be greater than Access Token Max TTL."
+        ),
       response: {
         200: z.object({
           identityAwsAuth: IdentityAwsAuthsSchema
@@ -172,7 +172,8 @@ export const registerIdentityAwsAuthRouter = async (server: FastifyZodProvider)
       params: z.object({
         identityId: z.string().describe(AWS_AUTH.UPDATE.identityId)
       }),
-      body: z.object({
+      body: z
+        .object({
           stsEndpoint: z.string().trim().min(1).optional().describe(AWS_AUTH.UPDATE.stsEndpoint),
           allowedPrincipalArns: validatePrincipalArns.describe(AWS_AUTH.UPDATE.allowedPrincipalArns),
           allowedAccountIds: validateAccountIds.describe(AWS_AUTH.UPDATE.allowedAccountIds),
@@ -190,12 +191,14 @@ export const registerIdentityAwsAuthRouter = async (server: FastifyZodProvider)
             .number()
             .int()
             .max(315360000)
-          .refine((value) => value !== 0, {
+            .min(0)
-            message: "accessTokenMaxTTL must have a non zero number"
-          })
             .optional()
             .describe(AWS_AUTH.UPDATE.accessTokenMaxTTL)
-      }),
+        })
+        .refine(
+          (val) => (val.accessTokenMaxTTL && val.accessTokenTTL ? val.accessTokenTTL <= val.accessTokenMaxTTL : true),
+          "Access Token TTL cannot be greater than Access Token Max TTL."
+        ),
       response: {
         200: z.object({
           identityAwsAuth: IdentityAwsAuthsSchema

backend/src/server/routes/v1/identity-azure-auth-router.ts

@@ -76,7 +76,8 @@ export const registerIdentityAzureAuthRouter = async (server: FastifyZodProvider
       params: z.object({
         identityId: z.string().trim().describe(AZURE_AUTH.LOGIN.identityId)
       }),
-      body: z.object({
+      body: z
+        .object({
           tenantId: z.string().trim().describe(AZURE_AUTH.ATTACH.tenantId),
           resource: z.string().trim().describe(AZURE_AUTH.ATTACH.resource),
           allowedServicePrincipalIds: validateAzureAuthField.describe(AZURE_AUTH.ATTACH.allowedServicePrincipalIds),
@@ -91,24 +92,28 @@ export const registerIdentityAzureAuthRouter = async (server: FastifyZodProvider
           accessTokenTTL: z
             .number()
             .int()
-          .min(1)
+            .min(0)
             .max(315360000)
-          .refine((value) => value !== 0, {
-            message: "accessTokenTTL must have a non zero number"
-          })
             .default(2592000)
             .describe(AZURE_AUTH.ATTACH.accessTokenTTL),
           accessTokenMaxTTL: z
             .number()
             .int()
+            .min(0)
             .max(315360000)
-          .refine((value) => value !== 0, {
-            message: "accessTokenMaxTTL must have a non zero number"
-          })
             .default(2592000)
             .describe(AZURE_AUTH.ATTACH.accessTokenMaxTTL),
-        accessTokenNumUsesLimit: z.number().int().min(0).default(0).describe(AZURE_AUTH.ATTACH.accessTokenNumUsesLimit)
+          accessTokenNumUsesLimit: z
-      }),
+            .number()
+            .int()
+            .min(0)
+            .default(0)
+            .describe(AZURE_AUTH.ATTACH.accessTokenNumUsesLimit)
+        })
+        .refine(
+          (val) => val.accessTokenTTL <= val.accessTokenMaxTTL,
+          "Access Token TTL cannot be greater than Access Token Max TTL."
+        ),
       response: {
         200: z.object({
           identityAzureAuth: IdentityAzureAuthsSchema
@@ -163,7 +168,8 @@ export const registerIdentityAzureAuthRouter = async (server: FastifyZodProvider
       params: z.object({
         identityId: z.string().trim().describe(AZURE_AUTH.UPDATE.identityId)
       }),
-      body: z.object({
+      body: z
+        .object({
           tenantId: z.string().trim().optional().describe(AZURE_AUTH.UPDATE.tenantId),
           resource: z.string().trim().optional().describe(AZURE_AUTH.UPDATE.resource),
           allowedServicePrincipalIds: validateAzureAuthField
@@ -178,17 +184,24 @@ export const registerIdentityAzureAuthRouter = async (server: FastifyZodProvider
             .optional()
             .describe(AZURE_AUTH.UPDATE.accessTokenTrustedIps),
           accessTokenTTL: z.number().int().min(0).max(315360000).optional().describe(AZURE_AUTH.UPDATE.accessTokenTTL),
-        accessTokenNumUsesLimit: z.number().int().min(0).optional().describe(AZURE_AUTH.UPDATE.accessTokenNumUsesLimit),
+          accessTokenNumUsesLimit: z
+            .number()
+            .int()
+            .min(0)
+            .optional()
+            .describe(AZURE_AUTH.UPDATE.accessTokenNumUsesLimit),
           accessTokenMaxTTL: z
             .number()
             .int()
             .max(315360000)
-          .refine((value) => value !== 0, {
+            .min(0)
-            message: "accessTokenMaxTTL must have a non zero number"
-          })
             .optional()
             .describe(AZURE_AUTH.UPDATE.accessTokenMaxTTL)
-      }),
+        })
+        .refine(
+          (val) => (val.accessTokenMaxTTL && val.accessTokenTTL ? val.accessTokenTTL <= val.accessTokenMaxTTL : true),
+          "Access Token TTL cannot be greater than Access Token Max TTL."
+        ),
       response: {
         200: z.object({
           identityAzureAuth: IdentityAzureAuthsSchema

backend/src/server/routes/v1/identity-gcp-auth-router.ts

@@ -74,7 +74,8 @@ export const registerIdentityGcpAuthRouter = async (server: FastifyZodProvider)
       params: z.object({
         identityId: z.string().trim().describe(GCP_AUTH.ATTACH.identityId)
       }),
-      body: z.object({
+      body: z
+        .object({
           type: z.enum(["iam", "gce"]),
           allowedServiceAccounts: validateGcpAuthField.describe(GCP_AUTH.ATTACH.allowedServiceAccounts),
           allowedProjects: validateGcpAuthField.describe(GCP_AUTH.ATTACH.allowedProjects),
@@ -90,24 +91,23 @@ export const registerIdentityGcpAuthRouter = async (server: FastifyZodProvider)
           accessTokenTTL: z
             .number()
             .int()
-          .min(1)
+            .min(0)
             .max(315360000)
-          .refine((value) => value !== 0, {
-            message: "accessTokenTTL must have a non zero number"
-          })
             .default(2592000)
             .describe(GCP_AUTH.ATTACH.accessTokenTTL),
           accessTokenMaxTTL: z
             .number()
             .int()
+            .min(0)
             .max(315360000)
-          .refine((value) => value !== 0, {
-            message: "accessTokenMaxTTL must have a non zero number"
-          })
             .default(2592000)
             .describe(GCP_AUTH.ATTACH.accessTokenMaxTTL),
           accessTokenNumUsesLimit: z.number().int().min(0).default(0).describe(GCP_AUTH.ATTACH.accessTokenNumUsesLimit)
-      }),
+        })
+        .refine(
+          (val) => val.accessTokenTTL <= val.accessTokenMaxTTL,
+          "Access Token TTL cannot be greater than Access Token Max TTL."
+        ),
       response: {
         200: z.object({
           identityGcpAuth: IdentityGcpAuthsSchema
@@ -164,7 +164,8 @@ export const registerIdentityGcpAuthRouter = async (server: FastifyZodProvider)
       params: z.object({
         identityId: z.string().trim().describe(GCP_AUTH.UPDATE.identityId)
       }),
-      body: z.object({
+      body: z
+        .object({
           type: z.enum(["iam", "gce"]).optional(),
           allowedServiceAccounts: validateGcpAuthField.optional().describe(GCP_AUTH.UPDATE.allowedServiceAccounts),
           allowedProjects: validateGcpAuthField.optional().describe(GCP_AUTH.UPDATE.allowedProjects),
@@ -182,13 +183,15 @@ export const registerIdentityGcpAuthRouter = async (server: FastifyZodProvider)
           accessTokenMaxTTL: z
             .number()
             .int()
+            .min(0)
             .max(315360000)
-          .refine((value) => value !== 0, {
-            message: "accessTokenMaxTTL must have a non zero number"
-          })
             .optional()
             .describe(GCP_AUTH.UPDATE.accessTokenMaxTTL)
-      }),
+        })
+        .refine(
+          (val) => (val.accessTokenMaxTTL && val.accessTokenTTL ? val.accessTokenTTL <= val.accessTokenMaxTTL : true),
+          "Access Token TTL cannot be greater than Access Token Max TTL."
+        ),
       response: {
         200: z.object({
           identityGcpAuth: IdentityGcpAuthsSchema

backend/src/server/routes/v1/identity-jwt-auth-router.ts

@@ -34,23 +34,12 @@ const CreateBaseSchema = z.object({
     .min(1)
     .default([{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }])
     .describe(JWT_AUTH.ATTACH.accessTokenTrustedIps),
-  accessTokenTTL: z
+  accessTokenTTL: z.number().int().min(0).max(315360000).default(2592000).describe(JWT_AUTH.ATTACH.accessTokenTTL),
-    .number()
-    .int()
-    .min(1)
-    .max(315360000)
-    .refine((value) => value !== 0, {
-      message: "accessTokenTTL must have a non zero number"
-    })
-    .default(2592000)
-    .describe(JWT_AUTH.ATTACH.accessTokenTTL),
   accessTokenMaxTTL: z
     .number()
     .int()
+    .min(0)
     .max(315360000)
-    .refine((value) => value !== 0, {
-      message: "accessTokenMaxTTL must have a non zero number"
-    })
     .default(2592000)
     .describe(JWT_AUTH.ATTACH.accessTokenMaxTTL),
   accessTokenNumUsesLimit: z.number().int().min(0).default(0).describe(JWT_AUTH.ATTACH.accessTokenNumUsesLimit)
@@ -70,23 +59,12 @@ const UpdateBaseSchema = z
       .min(1)
       .default([{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }])
       .describe(JWT_AUTH.UPDATE.accessTokenTrustedIps),
-    accessTokenTTL: z
+    accessTokenTTL: z.number().int().min(0).max(315360000).default(2592000).describe(JWT_AUTH.UPDATE.accessTokenTTL),
-      .number()
-      .int()
-      .min(1)
-      .max(315360000)
-      .refine((value) => value !== 0, {
-        message: "accessTokenTTL must have a non zero number"
-      })
-      .default(2592000)
-      .describe(JWT_AUTH.UPDATE.accessTokenTTL),
     accessTokenMaxTTL: z
       .number()
       .int()
+      .min(0)
       .max(315360000)
-      .refine((value) => value !== 0, {
-        message: "accessTokenMaxTTL must have a non zero number"
-      })
       .default(2592000)
       .describe(JWT_AUTH.UPDATE.accessTokenMaxTTL),
     accessTokenNumUsesLimit: z.number().int().min(0).default(0).describe(JWT_AUTH.UPDATE.accessTokenNumUsesLimit)

backend/src/server/routes/v1/identity-kubernetes-auth-router.ts

@@ -87,7 +87,8 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide
       params: z.object({
         identityId: z.string().trim().describe(KUBERNETES_AUTH.ATTACH.identityId)
       }),
-      body: z.object({
+      body: z
+        .object({
           kubernetesHost: z.string().trim().min(1).describe(KUBERNETES_AUTH.ATTACH.kubernetesHost),
           caCert: z.string().trim().default("").describe(KUBERNETES_AUTH.ATTACH.caCert),
           tokenReviewerJwt: z.string().trim().min(1).describe(KUBERNETES_AUTH.ATTACH.tokenReviewerJwt),
@@ -105,20 +106,15 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide
           accessTokenTTL: z
             .number()
             .int()
-          .min(1)
+            .min(0)
             .max(315360000)
-          .refine((value) => value !== 0, {
-            message: "accessTokenTTL must have a non zero number"
-          })
             .default(2592000)
             .describe(KUBERNETES_AUTH.ATTACH.accessTokenTTL),
           accessTokenMaxTTL: z
             .number()
             .int()
+            .min(0)
             .max(315360000)
-          .refine((value) => value !== 0, {
-            message: "accessTokenMaxTTL must have a non zero number"
-          })
             .default(2592000)
             .describe(KUBERNETES_AUTH.ATTACH.accessTokenMaxTTL),
           accessTokenNumUsesLimit: z
@@ -127,7 +123,11 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide
             .min(0)
             .default(0)
             .describe(KUBERNETES_AUTH.ATTACH.accessTokenNumUsesLimit)
-      }),
+        })
+        .refine(
+          (val) => val.accessTokenTTL <= val.accessTokenMaxTTL,
+          "Access Token TTL cannot be greater than Access Token Max TTL."
+        ),
       response: {
         200: z.object({
           identityKubernetesAuth: IdentityKubernetesAuthResponseSchema
@@ -183,7 +183,8 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide
       params: z.object({
         identityId: z.string().describe(KUBERNETES_AUTH.UPDATE.identityId)
       }),
-      body: z.object({
+      body: z
+        .object({
           kubernetesHost: z.string().trim().min(1).optional().describe(KUBERNETES_AUTH.UPDATE.kubernetesHost),
           caCert: z.string().trim().optional().describe(KUBERNETES_AUTH.UPDATE.caCert),
           tokenReviewerJwt: z.string().trim().min(1).optional().describe(KUBERNETES_AUTH.UPDATE.tokenReviewerJwt),
@@ -214,13 +215,15 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide
           accessTokenMaxTTL: z
             .number()
             .int()
+            .min(0)
             .max(315360000)
-          .refine((value) => value !== 0, {
-            message: "accessTokenMaxTTL must have a non zero number"
-          })
             .optional()
             .describe(KUBERNETES_AUTH.UPDATE.accessTokenMaxTTL)
-      }),
+        })
+        .refine(
+          (val) => (val.accessTokenMaxTTL && val.accessTokenTTL ? val.accessTokenTTL <= val.accessTokenMaxTTL : true),
+          "Access Token TTL cannot be greater than Access Token Max TTL."
+        ),
       response: {
         200: z.object({
           identityKubernetesAuth: IdentityKubernetesAuthResponseSchema

backend/src/server/routes/v1/identity-oidc-auth-router.ts

@@ -87,7 +87,8 @@ export const registerIdentityOidcAuthRouter = async (server: FastifyZodProvider)
       params: z.object({
         identityId: z.string().trim().describe(OIDC_AUTH.ATTACH.identityId)
       }),
-      body: z.object({
+      body: z
+        .object({
           oidcDiscoveryUrl: z.string().url().min(1).describe(OIDC_AUTH.ATTACH.oidcDiscoveryUrl),
           caCert: z.string().trim().default("").describe(OIDC_AUTH.ATTACH.caCert),
           boundIssuer: z.string().min(1).describe(OIDC_AUTH.ATTACH.boundIssuer),
@@ -105,24 +106,23 @@ export const registerIdentityOidcAuthRouter = async (server: FastifyZodProvider)
           accessTokenTTL: z
             .number()
             .int()
-          .min(1)
+            .min(0)
             .max(315360000)
-          .refine((value) => value !== 0, {
-            message: "accessTokenTTL must have a non zero number"
-          })
             .default(2592000)
             .describe(OIDC_AUTH.ATTACH.accessTokenTTL),
           accessTokenMaxTTL: z
             .number()
             .int()
+            .min(0)
             .max(315360000)
-          .refine((value) => value !== 0, {
-            message: "accessTokenMaxTTL must have a non zero number"
-          })
             .default(2592000)
             .describe(OIDC_AUTH.ATTACH.accessTokenMaxTTL),
           accessTokenNumUsesLimit: z.number().int().min(0).default(0).describe(OIDC_AUTH.ATTACH.accessTokenNumUsesLimit)
-      }),
+        })
+        .refine(
+          (val) => val.accessTokenTTL <= val.accessTokenMaxTTL,
+          "Access Token TTL cannot be greater than Access Token Max TTL."
+        ),
       response: {
         200: z.object({
           identityOidcAuth: IdentityOidcAuthResponseSchema
@@ -202,26 +202,24 @@ export const registerIdentityOidcAuthRouter = async (server: FastifyZodProvider)
           accessTokenTTL: z
             .number()
             .int()
-            .min(1)
+            .min(0)
             .max(315360000)
-            .refine((value) => value !== 0, {
-              message: "accessTokenTTL must have a non zero number"
-            })
             .default(2592000)
             .describe(OIDC_AUTH.UPDATE.accessTokenTTL),
           accessTokenMaxTTL: z
             .number()
             .int()
+            .min(0)
             .max(315360000)
-            .refine((value) => value !== 0, {
-              message: "accessTokenMaxTTL must have a non zero number"
-            })
             .default(2592000)
             .describe(OIDC_AUTH.UPDATE.accessTokenMaxTTL),
-
           accessTokenNumUsesLimit: z.number().int().min(0).default(0).describe(OIDC_AUTH.UPDATE.accessTokenNumUsesLimit)
         })
-        .partial(),
+        .partial()
+        .refine(
+          (val) => (val.accessTokenMaxTTL && val.accessTokenTTL ? val.accessTokenTTL <= val.accessTokenMaxTTL : true),
+          "Access Token TTL cannot be greater than Access Token Max TTL."
+        ),
       response: {
         200: z.object({
           identityOidcAuth: IdentityOidcAuthResponseSchema

backend/src/server/routes/v1/identity-token-auth-router.ts

@@ -26,7 +26,8 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider
       params: z.object({
         identityId: z.string().trim().describe(TOKEN_AUTH.ATTACH.identityId)
       }),
-      body: z.object({
+      body: z
+        .object({
           accessTokenTrustedIps: z
             .object({
               ipAddress: z.string().trim()
@@ -38,24 +39,28 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider
           accessTokenTTL: z
             .number()
             .int()
-          .min(1)
+            .min(0)
             .max(315360000)
-          .refine((value) => value !== 0, {
-            message: "accessTokenTTL must have a non zero number"
-          })
             .default(2592000)
             .describe(TOKEN_AUTH.ATTACH.accessTokenTTL),
           accessTokenMaxTTL: z
             .number()
             .int()
+            .min(0)
             .max(315360000)
-          .refine((value) => value !== 0, {
-            message: "accessTokenMaxTTL must have a non zero number"
-          })
             .default(2592000)
             .describe(TOKEN_AUTH.ATTACH.accessTokenMaxTTL),
-        accessTokenNumUsesLimit: z.number().int().min(0).default(0).describe(TOKEN_AUTH.ATTACH.accessTokenNumUsesLimit)
+          accessTokenNumUsesLimit: z
-      }),
+            .number()
+            .int()
+            .min(0)
+            .default(0)
+            .describe(TOKEN_AUTH.ATTACH.accessTokenNumUsesLimit)
+        })
+        .refine(
+          (val) => val.accessTokenTTL <= val.accessTokenMaxTTL,
+          "Access Token TTL cannot be greater than Access Token Max TTL."
+        ),
       response: {
         200: z.object({
           identityTokenAuth: IdentityTokenAuthsSchema
@@ -110,7 +115,8 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider
       params: z.object({
         identityId: z.string().trim().describe(TOKEN_AUTH.UPDATE.identityId)
       }),
-      body: z.object({
+      body: z
+        .object({
           accessTokenTrustedIps: z
             .object({
               ipAddress: z.string().trim()
@@ -120,17 +126,24 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider
             .optional()
             .describe(TOKEN_AUTH.UPDATE.accessTokenTrustedIps),
           accessTokenTTL: z.number().int().min(0).max(315360000).optional().describe(TOKEN_AUTH.UPDATE.accessTokenTTL),
-        accessTokenNumUsesLimit: z.number().int().min(0).optional().describe(TOKEN_AUTH.UPDATE.accessTokenNumUsesLimit),
+          accessTokenNumUsesLimit: z
+            .number()
+            .int()
+            .min(0)
+            .optional()
+            .describe(TOKEN_AUTH.UPDATE.accessTokenNumUsesLimit),
           accessTokenMaxTTL: z
             .number()
             .int()
+            .min(0)
             .max(315360000)
-          .refine((value) => value !== 0, {
-            message: "accessTokenMaxTTL must have a non zero number"
-          })
             .optional()
             .describe(TOKEN_AUTH.UPDATE.accessTokenMaxTTL)
-      }),
+        })
+        .refine(
+          (val) => (val.accessTokenMaxTTL && val.accessTokenTTL ? val.accessTokenTTL <= val.accessTokenMaxTTL : true),
+          "Access Token TTL cannot be greater than Access Token Max TTL."
+        ),
       response: {
         200: z.object({
           identityTokenAuth: IdentityTokenAuthsSchema

backend/src/server/routes/v1/identity-universal-auth-router.ts

@@ -86,7 +86,8 @@ export const registerIdentityUaRouter = async (server: FastifyZodProvider) => {
       params: z.object({
         identityId: z.string().trim().describe(UNIVERSAL_AUTH.ATTACH.identityId)
       }),
-      body: z.object({
+      body: z
+        .object({
           clientSecretTrustedIps: z
             .object({
               ipAddress: z.string().trim()
@@ -106,20 +107,15 @@ export const registerIdentityUaRouter = async (server: FastifyZodProvider) => {
           accessTokenTTL: z
             .number()
             .int()
-          .min(1)
+            .min(0)
             .max(315360000)
-          .refine((value) => value !== 0, {
-            message: "accessTokenTTL must have a non zero number"
-          })
             .default(2592000)
             .describe(UNIVERSAL_AUTH.ATTACH.accessTokenTTL), // 30 days
           accessTokenMaxTTL: z
             .number()
             .int()
+            .min(0)
             .max(315360000)
-          .refine((value) => value !== 0, {
-            message: "accessTokenMaxTTL must have a non zero number"
-          })
             .default(2592000)
             .describe(UNIVERSAL_AUTH.ATTACH.accessTokenMaxTTL), // 30 days
           accessTokenNumUsesLimit: z
@@ -128,7 +124,11 @@ export const registerIdentityUaRouter = async (server: FastifyZodProvider) => {
             .min(0)
             .default(0)
             .describe(UNIVERSAL_AUTH.ATTACH.accessTokenNumUsesLimit)
-      }),
+        })
+        .refine(
+          (val) => val.accessTokenTTL <= val.accessTokenMaxTTL,
+          "Access Token TTL cannot be greater than Access Token Max TTL."
+        ),
       response: {
         200: z.object({
           identityUniversalAuth: IdentityUniversalAuthsSchema
@@ -181,7 +181,8 @@ export const registerIdentityUaRouter = async (server: FastifyZodProvider) => {
       params: z.object({
         identityId: z.string().describe(UNIVERSAL_AUTH.UPDATE.identityId)
       }),
-      body: z.object({
+      body: z
+        .object({
           clientSecretTrustedIps: z
             .object({
               ipAddress: z.string().trim()
@@ -214,13 +215,15 @@ export const registerIdentityUaRouter = async (server: FastifyZodProvider) => {
           accessTokenMaxTTL: z
             .number()
             .int()
+            .min(0)
             .max(315360000)
-          .refine((value) => value !== 0, {
-            message: "accessTokenMaxTTL must have a non zero number"
-          })
             .optional()
             .describe(UNIVERSAL_AUTH.UPDATE.accessTokenMaxTTL)
-      }),
+        })
+        .refine(
+          (val) => (val.accessTokenMaxTTL && val.accessTokenTTL ? val.accessTokenTTL <= val.accessTokenMaxTTL : true),
+          "Access Token TTL cannot be greater than Access Token Max TTL."
+        ),
       response: {
         200: z.object({
           identityUniversalAuth: IdentityUniversalAuthsSchema

backend/src/services/identity-aws-auth/identity-aws-auth-service.ts

@@ -126,11 +126,11 @@ export const identityAwsAuthServiceFactory = ({
         authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
       } as TIdentityAccessTokenJwtPayload,
       appCfg.AUTH_SECRET,
-      {
+      // akhilmhdh: for non-expiry tokens you should not even set the value, including undefined. Even for undefined jsonwebtoken throws error
-        expiresIn:
+      Number(identityAccessToken.accessTokenTTL) === 0
-          Number(identityAccessToken.accessTokenMaxTTL) === 0
         ? undefined
-            : Number(identityAccessToken.accessTokenMaxTTL)
+        : {
+            expiresIn: Number(identityAccessToken.accessTokenTTL)
           }
     );
 

backend/src/services/identity-azure-auth/identity-azure-auth-service.ts

@@ -99,11 +99,11 @@ export const identityAzureAuthServiceFactory = ({
         authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
       } as TIdentityAccessTokenJwtPayload,
       appCfg.AUTH_SECRET,
-      {
+      // akhilmhdh: for non-expiry tokens you should not even set the value, including undefined. Even for undefined jsonwebtoken throws error
-        expiresIn:
+      Number(identityAccessToken.accessTokenTTL) === 0
-          Number(identityAccessToken.accessTokenMaxTTL) === 0
         ? undefined
-            : Number(identityAccessToken.accessTokenMaxTTL)
+        : {
+            expiresIn: Number(identityAccessToken.accessTokenTTL)
           }
     );
 

backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts

@@ -138,11 +138,11 @@ export const identityGcpAuthServiceFactory = ({
         authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
       } as TIdentityAccessTokenJwtPayload,
       appCfg.AUTH_SECRET,
-      {
+      // akhilmhdh: for non-expiry tokens you should not even set the value, including undefined. Even for undefined jsonwebtoken throws error
-        expiresIn:
+      Number(identityAccessToken.accessTokenTTL) === 0
-          Number(identityAccessToken.accessTokenMaxTTL) === 0
         ? undefined
-            : Number(identityAccessToken.accessTokenMaxTTL)
+        : {
+            expiresIn: Number(identityAccessToken.accessTokenTTL)
           }
     );
 

backend/src/services/identity-jwt-auth/identity-jwt-auth-service.ts

@@ -212,11 +212,11 @@ export const identityJwtAuthServiceFactory = ({
         authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
       } as TIdentityAccessTokenJwtPayload,
       appCfg.AUTH_SECRET,
-      {
+      // akhilmhdh: for non-expiry tokens you should not even set the value, including undefined. Even for undefined jsonwebtoken throws error
-        expiresIn:
+      Number(identityAccessToken.accessTokenTTL) === 0
-          Number(identityAccessToken.accessTokenMaxTTL) === 0
         ? undefined
-            : Number(identityAccessToken.accessTokenMaxTTL)
+        : {
+            expiresIn: Number(identityAccessToken.accessTokenTTL)
           }
     );
 

backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts

@@ -229,11 +229,11 @@ export const identityKubernetesAuthServiceFactory = ({
         authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
       } as TIdentityAccessTokenJwtPayload,
       appCfg.AUTH_SECRET,
-      {
+      // akhilmhdh: for non-expiry tokens you should not even set the value, including undefined. Even for undefined jsonwebtoken throws error
-        expiresIn:
+      Number(identityAccessToken.accessTokenTTL) === 0
-          Number(identityAccessToken.accessTokenMaxTTL) === 0
         ? undefined
-            : Number(identityAccessToken.accessTokenMaxTTL)
+        : {
+            expiresIn: Number(identityAccessToken.accessTokenTTL)
           }
     );
 

backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts

@@ -194,11 +194,11 @@ export const identityOidcAuthServiceFactory = ({
         authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
       } as TIdentityAccessTokenJwtPayload,
       appCfg.AUTH_SECRET,
-      {
+      // akhilmhdh: for non-expiry tokens you should not even set the value, including undefined. Even for undefined jsonwebtoken throws error
-        expiresIn:
+      Number(identityAccessToken.accessTokenTTL) === 0
-          Number(identityAccessToken.accessTokenMaxTTL) === 0
         ? undefined
-            : Number(identityAccessToken.accessTokenMaxTTL)
+        : {
+            expiresIn: Number(identityAccessToken.accessTokenTTL)
           }
     );
 

backend/src/services/identity-token-auth/identity-token-auth-service.ts

@@ -328,11 +328,11 @@ export const identityTokenAuthServiceFactory = ({
         authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
       } as TIdentityAccessTokenJwtPayload,
       appCfg.AUTH_SECRET,
-      {
+      // akhilmhdh: for non-expiry tokens you should not even set the value, including undefined. Even for undefined jsonwebtoken throws error
-        expiresIn:
+      Number(identityAccessToken.accessTokenTTL) === 0
-          Number(identityAccessToken.accessTokenMaxTTL) === 0
         ? undefined
-            : Number(identityAccessToken.accessTokenMaxTTL)
+        : {
+            expiresIn: Number(identityAccessToken.accessTokenTTL)
           }
     );
 

backend/src/services/identity-ua/identity-ua-service.ts

@@ -129,11 +129,11 @@ export const identityUaServiceFactory = ({
         authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
       } as TIdentityAccessTokenJwtPayload,
       appCfg.AUTH_SECRET,
-      {
+      // akhilmhdh: for non-expiry tokens you should not even set the value, including undefined. Even for undefined jsonwebtoken throws error
-        expiresIn:
+      Number(identityAccessToken.accessTokenTTL) === 0
-          Number(identityAccessToken.accessTokenMaxTTL) === 0
         ? undefined
-            : Number(identityAccessToken.accessTokenMaxTTL)
+        : {
+            expiresIn: Number(identityAccessToken.accessTokenTTL)
           }
     );
 

frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityAwsAuthForm.tsx

@@ -259,7 +259,7 @@ export const IdentityAwsAuthForm = ({
                 isError={Boolean(error)}
                 errorText={error?.message}
               >
-                <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+                <Input {...field} placeholder="2592000" type="number" min="0" step="1" />
               </FormControl>
             )}
           />
@@ -273,7 +273,7 @@ export const IdentityAwsAuthForm = ({
                 isError={Boolean(error)}
                 errorText={error?.message}
               >
-                <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+                <Input {...field} placeholder="2592000" type="number" min="0" step="1" />
               </FormControl>
             )}
           />

frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityAzureAuthForm.tsx

@@ -255,7 +255,7 @@ export const IdentityAzureAuthForm = ({
                 isError={Boolean(error)}
                 errorText={error?.message}
               >
-                <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+                <Input {...field} placeholder="2592000" type="number" min="0" step="1" />
               </FormControl>
             )}
           />
@@ -269,7 +269,7 @@ export const IdentityAzureAuthForm = ({
                 isError={Boolean(error)}
                 errorText={error?.message}
               >
-                <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+                <Input {...field} placeholder="2592000" type="number" min="0" step="1" />
               </FormControl>
             )}
           />

frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityGcpAuthForm.tsx

@@ -294,7 +294,7 @@ export const IdentityGcpAuthForm = ({
                 isError={Boolean(error)}
                 errorText={error?.message}
               >
-                <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+                <Input {...field} placeholder="2592000" type="number" min="0" step="1" />
               </FormControl>
             )}
           />
@@ -308,7 +308,7 @@ export const IdentityGcpAuthForm = ({
                 isError={Boolean(error)}
                 errorText={error?.message}
               >
-                <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+                <Input {...field} placeholder="2592000" type="number" min="0" step="1" />
               </FormControl>
             )}
           />

frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityJwtAuthForm.tsx

@@ -563,7 +563,7 @@ export const IdentityJwtAuthForm = ({
                 isError={Boolean(error)}
                 errorText={error?.message}
               >
-                <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+                <Input {...field} placeholder="2592000" type="number" min="0" step="1" />
               </FormControl>
             )}
           />
@@ -577,7 +577,7 @@ export const IdentityJwtAuthForm = ({
                 isError={Boolean(error)}
                 errorText={error?.message}
               >
-                <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+                <Input {...field} placeholder="2592000" type="number" min="0" step="1" />
               </FormControl>
             )}
           />

frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityKubernetesAuthForm.tsx

@@ -305,7 +305,7 @@ export const IdentityKubernetesAuthForm = ({
                 isError={Boolean(error)}
                 errorText={error?.message}
               >
-                <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+                <Input {...field} placeholder="2592000" type="number" min="0" step="1" />
               </FormControl>
             )}
           />
@@ -320,7 +320,7 @@ export const IdentityKubernetesAuthForm = ({
                 errorText={error?.message}
                 tooltipText="The maximum lifetime for an access token in seconds. This value will be referenced at renewal time."
               >
-                <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+                <Input {...field} placeholder="2592000" type="number" min="0" step="1" />
               </FormControl>
             )}
           />

frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityOidcAuthForm.tsx

@@ -323,7 +323,7 @@ export const IdentityOidcAuthForm = ({
                 isError={Boolean(error)}
                 errorText={error?.message}
               >
-                <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+                <Input {...field} placeholder="2592000" type="number" min="0" step="1" />
               </FormControl>
             )}
           />
@@ -337,7 +337,7 @@ export const IdentityOidcAuthForm = ({
                 isError={Boolean(error)}
                 errorText={error?.message}
               >
-                <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+                <Input {...field} placeholder="2592000" type="number" min="0" step="1" />
               </FormControl>
             )}
           />

frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityTokenAuthForm.tsx

@@ -192,7 +192,7 @@ export const IdentityTokenAuthForm = ({
                 isError={Boolean(error)}
                 errorText={error?.message}
               >
-                <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+                <Input {...field} placeholder="2592000" type="number" min="0" step="1" />
               </FormControl>
             )}
           />
@@ -206,7 +206,7 @@ export const IdentityTokenAuthForm = ({
                 isError={Boolean(error)}
                 errorText={error?.message}
               >
-                <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+                <Input {...field} placeholder="2592000" type="number" min="0" step="1" />
               </FormControl>
             )}
           />

frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityUniversalAuthForm.tsx

@@ -224,7 +224,7 @@ export const IdentityUniversalAuthForm = ({
                 isError={Boolean(error)}
                 errorText={error?.message}
               >
-                <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+                <Input {...field} placeholder="2592000" type="number" min="0" step="1" />
               </FormControl>
             )}
           />