Fix issue with negative counts

Author: phrocker

api/src/main/java/io/sentrius/sso/controllers/api/ZeroTrustATApiController.java

@@ -452,18 +452,21 @@ List<ZtatDTO> decorateTats(List<ZtatDTO> tats, User operatingUser){
         if (canApprove || canDeny) {
             for (var tat : tats) {
 
-                if (tat.getUserName().equals(operatingUser.getUsername())) {
-                    tat.setCurrentUser(true);
-                    if (systemOptions.getCanApproveOwnZtat()) {
-                        tat.setCanApprove(canApprove);
+                    if (tat.getUserName().equals(operatingUser.getUsername())) {
+                        tat.setCurrentUser(true);
+                        if (systemOptions.getCanApproveOwnZtat()) {
+                            if (tat.getUsesRemaining() > 0) {
+                                tat.setCanApprove(canApprove);
+                            }
+                            tat.setCanDeny(canDeny);
+                        }
+                    }
+                    else {
+                        if (tat.getUsesRemaining() > 0) {
+                            tat.setCanApprove(canApprove);
+                        }
                         tat.setCanDeny(canDeny);
                     }
-                }
-                else {
-                    tat.setCanApprove(canApprove);
-                    tat.setCanDeny(canDeny);
-                }
-
             }
         }
         return tats;

dataplane/src/main/java/io/sentrius/sso/core/services/security/ZeroTrustRequestService.java

@@ -388,7 +388,8 @@ private Integer getUsesRemaining(ZeroTrustAccessTokenRequest request) {
             List<ZeroTrustAccessTokenApproval> approval = request.getApprovals();
             if (!approval.isEmpty()) {
                 var uses = ztatUseRepository.getUses(approval.get(0));
-                return systemOptions.maxJitUses - uses.size();
+                var usesRemaining = systemOptions.maxJitUses - uses.size();
+                return Math.max(usesRemaining, 0);
             }
 
         return systemOptions.maxJitUses; // Update as needed based on your logic