diff --git a/backend/src/server/routes/v1/identity-aws-iam-auth-router.ts b/backend/src/server/routes/v1/identity-aws-iam-auth-router.ts index 575a6aafd..9721e46c5 100644 --- a/backend/src/server/routes/v1/identity-aws-iam-auth-router.ts +++ b/backend/src/server/routes/v1/identity-aws-iam-auth-router.ts @@ -100,6 +100,7 @@ export const registerIdentityAwsAuthRouter = async (server: FastifyZodProvider) .number() .int() .min(1) + .max(315360000) .refine((value) => value !== 0, { message: "accessTokenTTL must have a non zero number" }) @@ -108,6 +109,7 @@ export const registerIdentityAwsAuthRouter = async (server: FastifyZodProvider) accessTokenMaxTTL: z .number() .int() + .max(315360000) .refine((value) => value !== 0, { message: "accessTokenMaxTTL must have a non zero number" }) @@ -182,11 +184,12 @@ export const registerIdentityAwsAuthRouter = async (server: FastifyZodProvider) .min(1) .optional() .describe(AWS_AUTH.UPDATE.accessTokenTrustedIps), - accessTokenTTL: z.number().int().min(0).optional().describe(AWS_AUTH.UPDATE.accessTokenTTL), + accessTokenTTL: z.number().int().min(0).max(315360000).optional().describe(AWS_AUTH.UPDATE.accessTokenTTL), accessTokenNumUsesLimit: z.number().int().min(0).optional().describe(AWS_AUTH.UPDATE.accessTokenNumUsesLimit), accessTokenMaxTTL: z .number() .int() + .max(315360000) .refine((value) => value !== 0, { message: "accessTokenMaxTTL must have a non zero number" }) diff --git a/backend/src/server/routes/v1/identity-azure-auth-router.ts b/backend/src/server/routes/v1/identity-azure-auth-router.ts index dbde2d9a7..589f9e92c 100644 --- a/backend/src/server/routes/v1/identity-azure-auth-router.ts +++ b/backend/src/server/routes/v1/identity-azure-auth-router.ts @@ -90,6 +90,7 @@ export const registerIdentityAzureAuthRouter = async (server: FastifyZodProvider .number() .int() .min(1) + .max(315360000) .refine((value) => value !== 0, { message: "accessTokenTTL must have a non zero number" }) @@ -98,6 +99,7 @@ export const registerIdentityAzureAuthRouter = async (server: FastifyZodProvider accessTokenMaxTTL: z .number() .int() + .max(315360000) .refine((value) => value !== 0, { message: "accessTokenMaxTTL must have a non zero number" }) @@ -173,11 +175,12 @@ export const registerIdentityAzureAuthRouter = async (server: FastifyZodProvider .min(1) .optional() .describe(AZURE_AUTH.UPDATE.accessTokenTrustedIps), - accessTokenTTL: z.number().int().min(0).optional().describe(AZURE_AUTH.UPDATE.accessTokenTTL), + accessTokenTTL: z.number().int().min(0).max(315360000).optional().describe(AZURE_AUTH.UPDATE.accessTokenTTL), accessTokenNumUsesLimit: z.number().int().min(0).optional().describe(AZURE_AUTH.UPDATE.accessTokenNumUsesLimit), accessTokenMaxTTL: z .number() .int() + .max(315360000) .refine((value) => value !== 0, { message: "accessTokenMaxTTL must have a non zero number" }) diff --git a/backend/src/server/routes/v1/identity-gcp-auth-router.ts b/backend/src/server/routes/v1/identity-gcp-auth-router.ts index 6f10ba9f5..2022aef58 100644 --- a/backend/src/server/routes/v1/identity-gcp-auth-router.ts +++ b/backend/src/server/routes/v1/identity-gcp-auth-router.ts @@ -91,6 +91,7 @@ export const registerIdentityGcpAuthRouter = async (server: FastifyZodProvider) .number() .int() .min(1) + .max(315360000) .refine((value) => value !== 0, { message: "accessTokenTTL must have a non zero number" }) @@ -99,6 +100,7 @@ export const registerIdentityGcpAuthRouter = async (server: FastifyZodProvider) accessTokenMaxTTL: z .number() .int() + .max(315360000) .refine((value) => value !== 0, { message: "accessTokenMaxTTL must have a non zero number" }) @@ -175,11 +177,12 @@ export const registerIdentityGcpAuthRouter = async (server: FastifyZodProvider) .min(1) .optional() .describe(GCP_AUTH.UPDATE.accessTokenTrustedIps), - accessTokenTTL: z.number().int().min(0).optional().describe(GCP_AUTH.UPDATE.accessTokenTTL), + accessTokenTTL: z.number().int().min(0).max(315360000).optional().describe(GCP_AUTH.UPDATE.accessTokenTTL), accessTokenNumUsesLimit: z.number().int().min(0).optional().describe(GCP_AUTH.UPDATE.accessTokenNumUsesLimit), accessTokenMaxTTL: z .number() .int() + .max(315360000) .refine((value) => value !== 0, { message: "accessTokenMaxTTL must have a non zero number" }) diff --git a/backend/src/server/routes/v1/identity-kubernetes-auth-router.ts b/backend/src/server/routes/v1/identity-kubernetes-auth-router.ts index d69f028a1..3a71ba7a2 100644 --- a/backend/src/server/routes/v1/identity-kubernetes-auth-router.ts +++ b/backend/src/server/routes/v1/identity-kubernetes-auth-router.ts @@ -106,6 +106,7 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide .number() .int() .min(1) + .max(315360000) .refine((value) => value !== 0, { message: "accessTokenTTL must have a non zero number" }) @@ -114,6 +115,7 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide accessTokenMaxTTL: z .number() .int() + .max(315360000) .refine((value) => value !== 0, { message: "accessTokenMaxTTL must have a non zero number" }) @@ -196,7 +198,13 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide .min(1) .optional() .describe(KUBERNETES_AUTH.UPDATE.accessTokenTrustedIps), - accessTokenTTL: z.number().int().min(0).optional().describe(KUBERNETES_AUTH.UPDATE.accessTokenTTL), + accessTokenTTL: z + .number() + .int() + .min(0) + .max(315360000) + .optional() + .describe(KUBERNETES_AUTH.UPDATE.accessTokenTTL), accessTokenNumUsesLimit: z .number() .int() @@ -206,6 +214,7 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide accessTokenMaxTTL: z .number() .int() + .max(315360000) .refine((value) => value !== 0, { message: "accessTokenMaxTTL must have a non zero number" }) diff --git a/backend/src/server/routes/v1/identity-oidc-auth-router.ts b/backend/src/server/routes/v1/identity-oidc-auth-router.ts index 417947ad7..280dbc5d5 100644 --- a/backend/src/server/routes/v1/identity-oidc-auth-router.ts +++ b/backend/src/server/routes/v1/identity-oidc-auth-router.ts @@ -106,6 +106,7 @@ export const registerIdentityOidcAuthRouter = async (server: FastifyZodProvider) .number() .int() .min(1) + .max(315360000) .refine((value) => value !== 0, { message: "accessTokenTTL must have a non zero number" }) @@ -114,6 +115,7 @@ export const registerIdentityOidcAuthRouter = async (server: FastifyZodProvider) accessTokenMaxTTL: z .number() .int() + .max(315360000) .refine((value) => value !== 0, { message: "accessTokenMaxTTL must have a non zero number" }) @@ -201,6 +203,7 @@ export const registerIdentityOidcAuthRouter = async (server: FastifyZodProvider) .number() .int() .min(1) + .max(315360000) .refine((value) => value !== 0, { message: "accessTokenTTL must have a non zero number" }) @@ -209,6 +212,7 @@ export const registerIdentityOidcAuthRouter = async (server: FastifyZodProvider) accessTokenMaxTTL: z .number() .int() + .max(315360000) .refine((value) => value !== 0, { message: "accessTokenMaxTTL must have a non zero number" }) diff --git a/backend/src/server/routes/v1/identity-token-auth-router.ts b/backend/src/server/routes/v1/identity-token-auth-router.ts index 752447538..f367e6033 100644 --- a/backend/src/server/routes/v1/identity-token-auth-router.ts +++ b/backend/src/server/routes/v1/identity-token-auth-router.ts @@ -39,6 +39,7 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider .number() .int() .min(1) + .max(315360000) .refine((value) => value !== 0, { message: "accessTokenTTL must have a non zero number" }) @@ -47,6 +48,7 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider accessTokenMaxTTL: z .number() .int() + .max(315360000) .refine((value) => value !== 0, { message: "accessTokenMaxTTL must have a non zero number" }) @@ -117,11 +119,12 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider .min(1) .optional() .describe(TOKEN_AUTH.UPDATE.accessTokenTrustedIps), - accessTokenTTL: z.number().int().min(0).optional().describe(TOKEN_AUTH.UPDATE.accessTokenTTL), + accessTokenTTL: z.number().int().min(0).max(315360000).optional().describe(TOKEN_AUTH.UPDATE.accessTokenTTL), accessTokenNumUsesLimit: z.number().int().min(0).optional().describe(TOKEN_AUTH.UPDATE.accessTokenNumUsesLimit), accessTokenMaxTTL: z .number() .int() + .max(315360000) .refine((value) => value !== 0, { message: "accessTokenMaxTTL must have a non zero number" }) diff --git a/backend/src/server/routes/v1/identity-universal-auth-router.ts b/backend/src/server/routes/v1/identity-universal-auth-router.ts index b5a63f0db..f103a39e0 100644 --- a/backend/src/server/routes/v1/identity-universal-auth-router.ts +++ b/backend/src/server/routes/v1/identity-universal-auth-router.ts @@ -107,6 +107,7 @@ export const registerIdentityUaRouter = async (server: FastifyZodProvider) => { .number() .int() .min(1) + .max(315360000) .refine((value) => value !== 0, { message: "accessTokenTTL must have a non zero number" }) @@ -115,6 +116,7 @@ export const registerIdentityUaRouter = async (server: FastifyZodProvider) => { accessTokenMaxTTL: z .number() .int() + .max(315360000) .refine((value) => value !== 0, { message: "accessTokenMaxTTL must have a non zero number" }) @@ -196,7 +198,13 @@ export const registerIdentityUaRouter = async (server: FastifyZodProvider) => { .min(1) .optional() .describe(UNIVERSAL_AUTH.UPDATE.accessTokenTrustedIps), - accessTokenTTL: z.number().int().min(0).optional().describe(UNIVERSAL_AUTH.UPDATE.accessTokenTTL), + accessTokenTTL: z + .number() + .int() + .min(0) + .max(315360000) + .optional() + .describe(UNIVERSAL_AUTH.UPDATE.accessTokenTTL), accessTokenNumUsesLimit: z .number() .int() @@ -206,6 +214,7 @@ export const registerIdentityUaRouter = async (server: FastifyZodProvider) => { accessTokenMaxTTL: z .number() .int() + .max(315360000) .refine((value) => value !== 0, { message: "accessTokenMaxTTL must have a non zero number" }) @@ -362,7 +371,7 @@ export const registerIdentityUaRouter = async (server: FastifyZodProvider) => { body: z.object({ description: z.string().trim().default("").describe(UNIVERSAL_AUTH.CREATE_CLIENT_SECRET.description), numUsesLimit: z.number().min(0).default(0).describe(UNIVERSAL_AUTH.CREATE_CLIENT_SECRET.numUsesLimit), - ttl: z.number().min(0).default(0).describe(UNIVERSAL_AUTH.CREATE_CLIENT_SECRET.ttl) + ttl: z.number().min(0).max(315360000).default(0).describe(UNIVERSAL_AUTH.CREATE_CLIENT_SECRET.ttl) }), response: { 200: z.object({ diff --git a/frontend/src/views/Org/IdentityPage/components/IdentityClientSecretModal.tsx b/frontend/src/views/Org/IdentityPage/components/IdentityClientSecretModal.tsx index 49c21587d..3f4de4fc1 100644 --- a/frontend/src/views/Org/IdentityPage/components/IdentityClientSecretModal.tsx +++ b/frontend/src/views/Org/IdentityPage/components/IdentityClientSecretModal.tsx @@ -22,7 +22,9 @@ import { UsePopUpState } from "@app/hooks/usePopUp"; const schema = z .object({ description: z.string(), - ttl: z.string(), + ttl: z.string().refine((val) => Number(val) <= 315360000, { + message: "TTL cannot be greater than 315360000" + }), numUsesLimit: z.string() }) .required(); diff --git a/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityAwsAuthForm.tsx b/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityAwsAuthForm.tsx index 9c81f308a..d56f4b738 100644 --- a/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityAwsAuthForm.tsx +++ b/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityAwsAuthForm.tsx @@ -22,8 +22,22 @@ const schema = yup stsEndpoint: yup.string(), allowedPrincipalArns: yup.string(), allowedAccountIds: yup.string(), - accessTokenTTL: yup.string().required("Access Token TTL is required"), - accessTokenMaxTTL: yup.string().required("Access Max Token TTL is required"), + accessTokenTTL: yup + .string() + .required("Access Token TTL is required") + .test( + "is-value-valid", + "Access Token TTL cannot be greater than 315360000", + (value) => Number(value) <= 315360000 + ), + accessTokenMaxTTL: yup + .string() + .required("Access Max Token TTL is required") + .test( + "is-value-valid", + "Access Token Max TTL cannot be greater than 315360000", + (value) => Number(value) <= 315360000 + ), accessTokenNumUsesLimit: yup.string().required("Access Token Max Number of Uses is required"), accessTokenTrustedIps: yup .array( diff --git a/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityAzureAuthForm.tsx b/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityAzureAuthForm.tsx index c0aaca2f6..a3902d120 100644 --- a/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityAzureAuthForm.tsx +++ b/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityAzureAuthForm.tsx @@ -22,8 +22,12 @@ const schema = z tenantId: z.string(), resource: z.string(), allowedServicePrincipalIds: z.string(), - accessTokenTTL: z.string(), - accessTokenMaxTTL: z.string(), + accessTokenTTL: z.string().refine((val) => Number(val) <= 315360000, { + message: "Access Token TTL cannot be greater than 315360000" + }), + accessTokenMaxTTL: z.string().refine((val) => Number(val) <= 315360000, { + message: "Access Token Max TTL cannot be greater than 315360000" + }), accessTokenNumUsesLimit: z.string(), accessTokenTrustedIps: z .array( diff --git a/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityGcpAuthForm.tsx b/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityGcpAuthForm.tsx index eb07c3c36..a0834b3ae 100644 --- a/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityGcpAuthForm.tsx +++ b/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityGcpAuthForm.tsx @@ -23,8 +23,12 @@ const schema = z allowedServiceAccounts: z.string(), allowedProjects: z.string(), allowedZones: z.string(), - accessTokenTTL: z.string(), - accessTokenMaxTTL: z.string(), + accessTokenTTL: z.string().refine((val) => Number(val) <= 315360000, { + message: "Access Token TTL cannot be greater than 315360000" + }), + accessTokenMaxTTL: z.string().refine((val) => Number(val) <= 315360000, { + message: "Access Token Max TTL cannot be greater than 315360000" + }), accessTokenNumUsesLimit: z.string(), accessTokenTrustedIps: z .array( diff --git a/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityKubernetesAuthForm.tsx b/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityKubernetesAuthForm.tsx index 6baa6a405..3724fc014 100644 --- a/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityKubernetesAuthForm.tsx +++ b/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityKubernetesAuthForm.tsx @@ -25,8 +25,12 @@ const schema = z allowedNamespaces: z.string(), allowedAudience: z.string(), caCert: z.string(), - accessTokenTTL: z.string(), - accessTokenMaxTTL: z.string(), + accessTokenTTL: z.string().refine((val) => Number(val) <= 315360000, { + message: "Access Token TTL cannot be greater than 315360000" + }), + accessTokenMaxTTL: z.string().refine((val) => Number(val) <= 315360000, { + message: "Access Token Max TTL cannot be greater than 315360000" + }), accessTokenNumUsesLimit: z.string(), accessTokenTrustedIps: z .array( diff --git a/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityOidcAuthForm.tsx b/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityOidcAuthForm.tsx index 763d2f22a..30663d470 100644 --- a/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityOidcAuthForm.tsx +++ b/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityOidcAuthForm.tsx @@ -22,8 +22,12 @@ const schema = z.object({ }) ) .min(1), - accessTokenTTL: z.string(), - accessTokenMaxTTL: z.string(), + accessTokenTTL: z.string().refine((val) => Number(val) <= 315360000, { + message: "Access Token TTL cannot be greater than 315360000" + }), + accessTokenMaxTTL: z.string().refine((val) => Number(val) <= 315360000, { + message: "Access Token Max TTL cannot be greater than 315360000" + }), accessTokenNumUsesLimit: z.string(), oidcDiscoveryUrl: z.string().url().min(1), caCert: z.string().trim().default(""), diff --git a/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityTokenAuthForm.tsx b/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityTokenAuthForm.tsx index b28af537f..4ce437fc1 100644 --- a/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityTokenAuthForm.tsx +++ b/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityTokenAuthForm.tsx @@ -17,8 +17,12 @@ import { UsePopUpState } from "@app/hooks/usePopUp"; const schema = z .object({ - accessTokenTTL: z.string(), - accessTokenMaxTTL: z.string(), + accessTokenTTL: z.string().refine((val) => Number(val) <= 315360000, { + message: "Access Token TTL cannot be greater than 315360000" + }), + accessTokenMaxTTL: z.string().refine((val) => Number(val) <= 315360000, { + message: "Access Token Max TTL cannot be greater than 315360000" + }), accessTokenNumUsesLimit: z.string(), accessTokenTrustedIps: z .array( diff --git a/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityUniversalAuthClientSecretModal.tsx b/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityUniversalAuthClientSecretModal.tsx index 226743739..04a5b47a8 100644 --- a/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityUniversalAuthClientSecretModal.tsx +++ b/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityUniversalAuthClientSecretModal.tsx @@ -36,7 +36,13 @@ import { UsePopUpState } from "@app/hooks/usePopUp"; const schema = yup.object({ description: yup.string(), - ttl: yup.string(), + ttl: yup + .string() + .test( + "is-value-valid", + "TTL cannot be greater than 315360000", + (value) => Number(value) <= 315360000 + ), numUsesLimit: yup.string() }); diff --git a/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityUniversalAuthForm.tsx b/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityUniversalAuthForm.tsx index 2e3df29f2..cb8c3f580 100644 --- a/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityUniversalAuthForm.tsx +++ b/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityUniversalAuthForm.tsx @@ -19,8 +19,22 @@ import { UsePopUpState } from "@app/hooks/usePopUp"; const schema = yup .object({ - accessTokenTTL: yup.string().required("Access Token TTL is required"), - accessTokenMaxTTL: yup.string().required("Access Max Token TTL is required"), + accessTokenTTL: yup + .string() + .required("Access Token TTL is required") + .test( + "is-value-valid", + "Access Token TTL cannot be greater than 315360000", + (value) => Number(value) <= 315360000 + ), + accessTokenMaxTTL: yup + .string() + .required("Access Max Token TTL is required") + .test( + "is-value-valid", + "Access Max Token TTL cannot be greater than 315360000", + (value) => Number(value) <= 315360000 + ), accessTokenNumUsesLimit: yup.string().required("Access Token Max Number of Uses is required"), clientSecretTrustedIps: yup .array(