kanidm: 1.7.2 -> 1.7.3

import ./generic.nix {

  version = "1.7.2";

  hash = "sha256-ETaggYPWxgEx9Vo/8Xehpi3UqkjQO/NAoOsbZxi/DeY=";

  cargoHash = "sha256-BwrEvtujYlMWG1LNkaNvHlIbrqmEBgbr50xTz+V5KYQ=";

  version = "1.7.3";

  hash = "sha256-eptbxhbd3pUvYCncgKprh0qes9CjdvGUl3CsG/sHX7M=";

  cargoHash = "sha256-M0TXGvpMkV/4U0MRYVqiWQsA+9AHdeS89noLxE2Llt0=";

  patches = [

    # remove 1.7.4 - https://github.com/kanidm/kanidm/issues/3813

    ./a3bc718a8a0325a53e0857668b8a0134d371794d.patch

  ];

}

From a3bc718a8a0325a53e0857668b8a0134d371794d Mon Sep 17 00:00:00 2001

From: Firstyear <william@blackhats.net.au>

Date: Sat, 16 Aug 2025 13:46:23 +1000

Subject: [PATCH] Fix account recover-disable edge case (#3796)

---

 server/lib/src/idm/server.rs | 2 ++

 1 file changed, 2 insertions(+)

diff --git a/server/lib/src/idm/server.rs b/server/lib/src/idm/server.rs

index 0fc6d78787..51bfbf6705 100644

--- a/server/lib/src/idm/server.rs

+++ b/server/lib/src/idm/server.rs

@@ -1900,6 +1900,7 @@ impl IdmServerProxyWriteTransaction<'_> {

         let modlist = ModifyList::new_list(vec![

             // Ensure the account is valid from *now*, and that the expiry is unset.

             m_purge(Attribute::AccountExpire),

+            m_purge(Attribute::AccountValidFrom),

             Modify::Present(Attribute::AccountValidFrom, v_valid_from),

             // We need to remove other credentials too.

             m_purge(Attribute::PassKeys),

@@ -1934,6 +1935,7 @@ impl IdmServerProxyWriteTransaction<'_> {

         let modlist = ModifyList::new_list(vec![

             // Ensure that the account has no validity, and the expiry is now.

             m_purge(Attribute::AccountValidFrom),

+            m_purge(Attribute::AccountExpire),

             Modify::Present(Attribute::AccountExpire, v_expire),

         ]);

  cargoHash,

  unsupported ? false,

  eolDate ? null,

  patches ? [ ],

}:

{

  env.KANIDM_BUILD_PROFILE = "release_nixpkgs_${arch}";

  patches = lib.optionals enableSecretProvisioning [

  patches =

    patches

    ++ lib.optionals enableSecretProvisioning [

      (./. + "/provision-patches/${versionUnderscored finalAttrs}/oauth2-basic-secret-modify.patch")

      (./. + "/provision-patches/${versionUnderscored finalAttrs}/recover-account.patch")

    ];