From 48f17f4d8db4768c44551401244336257361cbe1 Mon Sep 17 00:00:00 2001
From: x032205 <x032205@gmail.com>
Date: Mon, 8 Sep 2025 20:31:15 -0400
Subject: [PATCH] feat(ua-login): improve lock error message & disable lock
 when lockout is disabled

---
 .../identity-ua/identity-ua-service.ts        | 28 ++++++++++---------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/backend/src/services/identity-ua/identity-ua-service.ts b/backend/src/services/identity-ua/identity-ua-service.ts
index 597747683..8aec16371 100644
--- a/backend/src/services/identity-ua/identity-ua-service.ts
+++ b/backend/src/services/identity-ua/identity-ua-service.ts
@@ -84,18 +84,20 @@ export const identityUaServiceFactory = ({
 
     const LOCKOUT_KEY = `lockout:identity:${identityUa.identityId}:${IdentityAuthMethod.UNIVERSAL_AUTH}:${clientId}`;
 
-    let lock: Awaited<ReturnType<typeof keyStore.acquireLock>>;
-    try {
-      lock = await keyStore.acquireLock([KeyStorePrefixes.IdentityLockoutLock(LOCKOUT_KEY)], 500, {
-        retryCount: 3,
-        retryDelay: 300,
-        retryJitter: 100
-      });
-    } catch (e) {
-      logger.info(
-        `identity login failed to acquire lock [identityId=${identityUa.identityId}] [authMethod=${IdentityAuthMethod.UNIVERSAL_AUTH}]`
-      );
-      throw new RateLimitError({ message: "Rate limit exceeded" });
+    let lock: Awaited<ReturnType<typeof keyStore.acquireLock>> | undefined;
+    if (identityUa.lockoutEnabled) {
+      try {
+        lock = await keyStore.acquireLock([KeyStorePrefixes.IdentityLockoutLock(LOCKOUT_KEY)], 500, {
+          retryCount: 3,
+          retryDelay: 300,
+          retryJitter: 100
+        });
+      } catch (e) {
+        logger.info(
+          `identity login failed to acquire lock [identityId=${identityUa.identityId}] [authMethod=${IdentityAuthMethod.UNIVERSAL_AUTH}]`
+        );
+        throw new RateLimitError({ message: "Failed to acquire lock: rate limit exceeded" });
+      }
     }
 
     try {
@@ -257,7 +259,7 @@ export const identityUaServiceFactory = ({
         ...accessTokenTTLParams
       };
     } finally {
-      await lock.release();
+      if (lock) await lock.release();
     }
   };