From a4f6b828adad45d7f662557076b3debcc5dd5f7a Mon Sep 17 00:00:00 2001
From: Maidul Islam <maidul98@gmail.com>
Date: Wed, 6 Dec 2023 20:35:26 -0500
Subject: [PATCH] fix update machine params + default to no max ttl

---
 .../controllers/v1/machineIdentitiesController.ts  | 14 ++++++++++++--
 backend/src/validation/machineIdentity.ts          | 11 ++++-------
 .../src/hooks/api/machineIdentities/mutations.tsx  |  6 ++++--
 .../AddMachineIdentityModal.tsx                    |  4 ++--
 4 files changed, 22 insertions(+), 13 deletions(-)

diff --git a/backend/src/ee/controllers/v1/machineIdentitiesController.ts b/backend/src/ee/controllers/v1/machineIdentitiesController.ts
index a5673b12b..c0f54e3c2 100644
--- a/backend/src/ee/controllers/v1/machineIdentitiesController.ts
+++ b/backend/src/ee/controllers/v1/machineIdentitiesController.ts
@@ -557,6 +557,10 @@ export const createMachineIdentity = async (req: Request, res: Response) => {
         }
     } = await validateRequest(reqValidator.CreateMachineIdentityV1, req);
 
+    if (accessTokenMaxTTL > 0 && accessTokenTTL > accessTokenMaxTTL) {
+        throw BadRequestError({ message: "Access token TTL cannot be greater than max TTL" })
+    }
+
     const { permission } = await getAuthDataOrgPermissions({
         authData: req.authData,
         organizationId: new Types.ObjectId(organizationId)
@@ -676,10 +680,15 @@ export const updateMachineIdentity = async (req: Request, res: Response) => {
             clientSecretTrustedIps,
             accessTokenTrustedIps,
             accessTokenTTL,
-            accessTokenNumUsesLimit
+            accessTokenNumUsesLimit,
+            accessTokenMaxTTL
         }
     } = await validateRequest(reqValidator.UpdateMachineIdentityV1, req);
 
+    if (accessTokenTTL && accessTokenMaxTTL > 0 && accessTokenTTL > accessTokenMaxTTL) {
+        throw BadRequestError({ message: "Access token TTL cannot be greater than max TTL" })
+    }
+
     const machineMembershipOrg = await MachineMembershipOrg
         .findOne({
             machineIdentity: new Types.ObjectId(machineId)
@@ -779,7 +788,8 @@ export const updateMachineIdentity = async (req: Request, res: Response) => {
             clientSecretTrustedIps: reformattedClientSecretTrustedIps,
             accessTokenTrustedIps: reformattedAccessTokenTrustedIps,
             accessTokenTTL,
-            accessTokenNumUsesLimit
+            accessTokenNumUsesLimit,
+            accessTokenMaxTTL
         },
         {
             new: true
diff --git a/backend/src/validation/machineIdentity.ts b/backend/src/validation/machineIdentity.ts
index cecff3b4a..0f40cff6c 100644
--- a/backend/src/validation/machineIdentity.ts
+++ b/backend/src/validation/machineIdentity.ts
@@ -58,15 +58,11 @@ export const CreateMachineIdentityV1 = z.object({
       .min(1)
       .default([{ ipAddress: "0.0.0.0/0" }]),
     accessTokenTTL: z.number().int().min(0).default(7200),
-    accessTokenMaxTTL: z.number().int().min(0).default(7200),
+    accessTokenMaxTTL: z.number().int().min(0).default(0),
     accessTokenNumUsesLimit: z.number().int().min(0).default(0)
   })
-  .refine(data => data.accessTokenTTL <= data.accessTokenMaxTTL, {
-    message: "accessTokenTTL cannot be greater than accessTokenMaxTTL",
-    path: ["accessTokenTTL"],
-  })
 });
-  
+
 export const UpdateMachineIdentityV1 = z.object({
   params: z.object({
     machineId: z.string()
@@ -89,7 +85,8 @@ export const UpdateMachineIdentityV1 = z.object({
       .min(1)
       .optional(),
     accessTokenTTL: z.number().int().min(0).optional(),
-    accessTokenNumUsesLimit: z.number().int().min(0).optional()
+    accessTokenNumUsesLimit: z.number().int().min(0).optional(),
+    accessTokenMaxTTL: z.number().int().min(0).default(0),
   }),
 });
 
diff --git a/frontend/src/hooks/api/machineIdentities/mutations.tsx b/frontend/src/hooks/api/machineIdentities/mutations.tsx
index f47733f61..20508a5d7 100644
--- a/frontend/src/hooks/api/machineIdentities/mutations.tsx
+++ b/frontend/src/hooks/api/machineIdentities/mutations.tsx
@@ -81,7 +81,8 @@ export const useUpdateMachineIdentity = () => {
             clientSecretTrustedIps,
             accessTokenTrustedIps,
             accessTokenTTL,
-            accessTokenNumUsesLimit
+            accessTokenNumUsesLimit,
+            accessTokenMaxTTL
         }) => {
             
             const { data: { machineIdentity } } = await apiRequest.patch(`/api/v1/machine-identities/${machineId}`, {
@@ -90,7 +91,8 @@ export const useUpdateMachineIdentity = () => {
                 clientSecretTrustedIps,
                 accessTokenTrustedIps,
                 accessTokenTTL,
-                accessTokenNumUsesLimit
+                accessTokenNumUsesLimit,
+                accessTokenMaxTTL
             });
 
             return machineIdentity;
diff --git a/frontend/src/views/Org/MembersPage/components/OrgMachineIdentityTab/components/MachineIdentitySection/AddMachineIdentityModal.tsx b/frontend/src/views/Org/MembersPage/components/OrgMachineIdentityTab/components/MachineIdentitySection/AddMachineIdentityModal.tsx
index bb0c01728..782a4c59c 100644
--- a/frontend/src/views/Org/MembersPage/components/OrgMachineIdentityTab/components/MachineIdentitySection/AddMachineIdentityModal.tsx
+++ b/frontend/src/views/Org/MembersPage/components/OrgMachineIdentityTab/components/MachineIdentitySection/AddMachineIdentityModal.tsx
@@ -109,7 +109,7 @@ export const AddMachineIdentityModal = ({
         defaultValues: {
             name: "",
             accessTokenTTL: "7200",
-            accessTokenMaxTTL: "7200",
+            accessTokenMaxTTL: "0",
             accessTokenNumUsesLimit: "0",
             clientSecretTrustedIps: [{
                 ipAddress: "0.0.0.0/0"
@@ -177,7 +177,7 @@ export const AddMachineIdentityModal = ({
             reset({
                 name: "",
                 accessTokenTTL: "7200",
-                accessTokenMaxTTL: "7200",
+                accessTokenMaxTTL: "0",
                 accessTokenNumUsesLimit: "0",
                 role: roles[0].slug,
                 clientSecretTrustedIps: [{