SECRET_EXPIRY acts as a maximum limit instead of a default value

[tholeb]

When setting the SECRET_EXPIRY environment variable, the UI filters out all expiration choices that are strictly greater than the value provided.

It appears that SECRET_EXPIRY is being treated as a hard limit rather than a default

Steps :

1. Configure expiryChoices with multiple values:

expiryChoices: [2592000, 1209600, 604800, 518400, 432000, 345600, 259200, 172800, 86400, 43200, 14400, 3600]

2. Set the environment variable SECRET_EXPIRY="86400" (1 day).
3. Open the "Secret Expiration" dropdown menu in the UI.

Expected Behavior:
The dropdown should have 1 day as default value, but all other options (up to 30 days) should still be available for the user to select.

Without SECRET_EXPIRY (Correct list):

With SECRET_EXPIRY="86400" (Truncated list):

Is there a specific configuration to set a default value without restricting the maximum duration allowed for a secret?

[Luzifer]

It appears that SECRET_EXPIRY is being treated as a hard limit rather than a default

# ./ots --help |& grep exp
      --secret-expiry int     Maximum expiry of the stored secrets in seconds

Correct, --secret-expiry or SECRET_EXPIRY (which sets this flag) acts as the maximum storage time and also as the default in case the "Expiuration par défaut" is selected or the secret is created via API without passing an expiry.

Is there a specific configuration to set a default value without restricting the maximum duration allowed for a secret?

Not at the moment. The default is the maximum; the user can limit the expiration.

[tholeb]

I see. I'll remove the SECRET_EXPIRY flag then.

Is there any plan on adding a "default" flag ? Could be a great addition.

Thank your for your answers.

[skillpoint-dev]

@Luzifer would probably be good to have a point in the "How does this work?" explaining what the "default expiration" is/how it works? I will give it a try to formulate something if you aren't faster and open a PR in the next few days... (This would also be at least a starting point for all the other issues, about the default, clarifying what the default actually does)

[Luzifer]

@skillpoint-dev yeah… …the expiry-stuff causes a lot of confusion. I plan to collect all the improvements and explanations together and try to improve the system. Including a breaking change for better configurability… …but, needs time…