Add deny api/get envs api

.dockerignore

@@ -1,10 +0,0 @@
-backend/node_modules
-frontend/node_modules
-backend/frontend-build
-**/node_modules
-**/.next
-.dockerignore
-.git
-README.md
-.dockerignore
-**/Dockerfile

.env.example

@@ -1,6 +1,5 @@
 # Keys
 # Required key for platform encryption/decryption ops
-# THIS IS A SAMPLE ENCRYPTION KEY AND SHOULD NOT BE USED FOR PRODUCTION
 ENCRYPTION_KEY=6c1fe4e407b8911c104518103505b218
 
 # JWT
@@ -9,8 +8,6 @@ JWT_SIGNUP_SECRET=3679e04ca949f914c03332aaaeba805a
 JWT_REFRESH_SECRET=5f2f3c8f0159068dc2bbb3a652a716ff
 JWT_AUTH_SECRET=4be6ba5602e0fa0ac6ac05c3cd4d247f
 JWT_SERVICE_SECRET=f32f716d70a42c5703f4656015e76200
-JWT_SERVICE_TOKEN_SECRET=f32f716d70a42c5703f4656015e76200
-JWT_PROVIDER_AUTH_SECRET=f32f716d70a42c5703f4656015e76201
 
 # JWT lifetime
 # Optional lifetimes for JWT tokens expressed in seconds or a string 
@@ -18,7 +15,9 @@ JWT_PROVIDER_AUTH_SECRET=f32f716d70a42c5703f4656015e76201
 JWT_AUTH_LIFETIME=
 JWT_REFRESH_LIFETIME=
 JWT_SIGNUP_LIFETIME=
-JWT_PROVIDER_AUTH_LIFETIME=
+
+# Optional lifetimes for OTP expressed in seconds
+EMAIL_TOKEN_LIFETIME=
 
 # MongoDB
 # Backend will connect to the MongoDB instance at connection string MONGO_URL which can either be a ref
@@ -26,9 +25,6 @@ JWT_PROVIDER_AUTH_LIFETIME=
 # Required
 MONGO_URL=mongodb://root:example@mongo:27017/?authSource=admin
 
-# Redis
-REDIS_URL=redis://redis:6379
-
 # Optional credentials for MongoDB container instance and Mongo-Express
 MONGO_USERNAME=root
 MONGO_PASSWORD=example
@@ -37,12 +33,14 @@ MONGO_PASSWORD=example
 # Required
 SITE_URL=http://localhost:8080
 
-# Mail/SMTP 
-SMTP_HOST=
-SMTP_PORT=
-SMTP_NAME=
-SMTP_USERNAME=
-SMTP_PASSWORD=
+# Mail/SMTP
+SMTP_HOST= # required
+SMTP_USERNAME= # required
+SMTP_PASSWORD= # required
+SMTP_PORT=587
+SMTP_SECURE=false
+SMTP_FROM_ADDRESS= # required
+SMTP_FROM_NAME=Infisical
 
 # Integration
 # Optional only if integration is used
@@ -50,14 +48,10 @@ CLIENT_ID_HEROKU=
 CLIENT_ID_VERCEL=
 CLIENT_ID_NETLIFY=
 CLIENT_ID_GITHUB=
-CLIENT_ID_GITLAB=
-CLIENT_ID_BITBUCKET=
 CLIENT_SECRET_HEROKU=
 CLIENT_SECRET_VERCEL=
 CLIENT_SECRET_NETLIFY=
 CLIENT_SECRET_GITHUB=
-CLIENT_SECRET_GITLAB=
-CLIENT_SECRET_BITBUCKET=
 CLIENT_SLUG_VERCEL=
 
 # Sentry (optional) for monitoring errors
@@ -67,6 +61,10 @@ SENTRY_DSN=
 # Ignore - Not applicable for self-hosted version
 POSTHOG_HOST=
 POSTHOG_PROJECT_API_KEY=
-
-CLIENT_ID_GOOGLE=
-CLIENT_SECRET_GOOGLE=
+STRIPE_SECRET_KEY=
+STRIPE_PUBLISHABLE_KEY=
+STRIPE_WEBHOOK_SECRET=
+STRIPE_PRODUCT_CARD_AUTH=
+STRIPE_PRODUCT_PRO=
+STRIPE_PRODUCT_STARTER=
+NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=

.github/ISSUE_TEMPLATE/feature_request.md

@@ -8,7 +8,7 @@ assignees: ''
 ---
 
 ### Feature description
-A clear and concise description of what the feature should be.
+A clear and concise description of what the the feature should be.
 
 ### Why would it be useful?
 Why would this feature be useful for Infisical users? 

.github/pull_request_template.md

@@ -1,22 +0,0 @@
-# Description 📣
-
-<!-- Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change. -->
-
-## Type ✨
-
-- [ ] Bug fix
-- [ ] New feature
-- [ ] Breaking change
-- [ ] Documentation
-
-# Tests 🛠️
-
-<!-- Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration. You may want to add screenshots when relevant and possible -->
-
-```sh
-# Here's some code block to paste some code snippets
-```
-
----
-
-- [ ] I have read the [contributing guide](https://infisical.com/docs/contributing/overview), agreed and acknowledged the [code of conduct](https://infisical.com/docs/contributing/code-of-conduct). 📝

.github/resources/docker-compose.be-test.yml

@@ -6,14 +6,13 @@ services:
     restart: unless-stopped
     depends_on:
       - mongo
-    image: infisical/infisical:test
+    image: infisical/backend:test
     command: npm run start
     environment:
       - NODE_ENV=production
       - MONGO_URL=mongodb://test:example@mongo:27017/?authSource=admin
       - MONGO_USERNAME=test
       - MONGO_PASSWORD=example
-      - ENCRYPTION_KEY=a984ecdf82ec779e55dbcc21303a900f
     networks:
       - infisical-test
 

.github/values.yaml

@@ -1,49 +1,36 @@
-backend:
-  enabled: true
-  name: backend
-  podAnnotations: {}
-  deploymentAnnotations:
-    secrets.infisical.com/auto-reload: "true"
-  replicaCount: 2
+frontend:
+  replicaCount: 1
   image:
-    repository: infisical/staging_infisical
-    tag: "latest"
+    repository: 
     pullPolicy: Always
+    tag: "latest"
+  kubeSecretRef: managed-secret-frontend
+
+backend:
+  replicaCount: 1
+  image:
+    repository: 
+    pullPolicy: Always
+    tag: "latest"
   kubeSecretRef: managed-backend-secret
-  service:
-    annotations: {}
-    type: ClusterIP
-    nodePort: ""
-  resources:
-    limits:
-      memory: 300Mi
-
-backendEnvironmentVariables: null
-
-## Mongo DB persistence
-mongodb:
-  enabled: false
-  persistence:
-    enabled: false
-
-## By default the backend will be connected to a Mongo instance within the cluster
-## However, it is recommended to add a managed document DB connection string for production-use (DBaaS)
-## Learn about connection string type here https://www.mongodb.com/docs/manual/reference/connection-string/
-## e.g. "mongodb://<user>:<pass>@<host>:<port>/<database-name>"
-mongodbConnection:
-  externalMongoDBConnectionString: ""
 
 ingress:
   enabled: true
-  # annotations:
-  #   kubernetes.io/ingress.class: "nginx"
-  # cert-manager.io/issuer: letsencrypt-nginx
-  hostName: gamma.infisical.com ## <- Replace with your own domain
+  annotations:
+    kubernetes.io/ingress.class: "nginx"
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+  hostName: gamma.infisical.com
+  frontend: 
+    path: /
+    pathType: Prefix
+  backend:
+    path: /api
+    pathType: Prefix
   tls:
-    []
-    # - secretName: letsencrypt-nginx
-    #   hosts:
-    #     - infisical.local
+    - secretName: echo-tls
+      hosts:
+        - gamma.infisical.com
 
-mailhog:
-  enabled: false
+backendEnvironmentVariables:
+
+frontendEnvironmentVariables:

.github/workflows/build-staging-img.yml

@@ -1,99 +0,0 @@
-name: Build, Publish and Deploy to Gamma
-on: [workflow_dispatch]
-
-jobs:
-  infisical-image:
-    name: Build backend image
-    runs-on: ubuntu-latest
-    steps:
-      - name: ☁️ Checkout source
-        uses: actions/checkout@v3
-      - name: 📦 Install dependencies to test all dependencies
-        run: npm ci --only-production
-        working-directory: backend
-      # - name: 🧪 Run tests
-      #   run: npm run test:ci
-      #   working-directory: backend
-      - name: Save commit hashes for tag
-        id: commit
-        uses: pr-mpt/actions-commit-hash@v2
-      - name: 🔧 Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-      - name: 🐋 Login to Docker Hub
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Set up Depot CLI
-        uses: depot/setup-action@v1
-      - name: 📦 Build backend and export to Docker
-        uses: depot/build-push-action@v1
-        with:
-          project: 64mmf0n610
-          token: ${{ secrets.DEPOT_PROJECT_TOKEN }}
-          load: true
-          context: .
-          file: Dockerfile.standalone-infisical
-          tags: infisical/infisical:test
-      - name: ⏻ Spawn backend container and dependencies
-        run: |
-          docker compose -f .github/resources/docker-compose.be-test.yml up --wait --quiet-pull
-      - name: 🧪 Test backend image
-        run: |
-          ./.github/resources/healthcheck.sh infisical-backend-test
-      - name: ⏻ Shut down backend container and dependencies
-        run: |
-          docker compose -f .github/resources/docker-compose.be-test.yml down
-      - name: 🏗️ Build backend and push
-        uses: depot/build-push-action@v1
-        with:
-          project: 64mmf0n610
-          token: ${{ secrets.DEPOT_PROJECT_TOKEN }}
-          push: true
-          context: .
-          file: Dockerfile.standalone-infisical
-          tags: |
-            infisical/staging_infisical:${{ steps.commit.outputs.short }}
-            infisical/staging_infisical:latest
-          platforms: linux/amd64,linux/arm64
-          build-args: |
-            POSTHOG_API_KEY=${{ secrets.PUBLIC_POSTHOG_API_KEY }}
-            INFISICAL_PLATFORM_VERSION=${{ steps.extract_version.outputs.version }}
-
-  gamma-deployment:
-    name: Deploy to gamma
-    runs-on: ubuntu-latest
-    needs: [infisical-image]
-    steps:
-      - name: ☁️ Checkout source
-        uses: actions/checkout@v3
-      - name: Install Helm
-        uses: azure/setup-helm@v3
-        with:
-          version: v3.10.0
-      - name: Install infisical helm chart
-        run: |
-          helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/'
-          helm repo update
-      - name: Install kubectl
-        uses: azure/setup-kubectl@v3
-      - name: Install doctl
-        uses: digitalocean/action-doctl@v2
-        with:
-          token: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}
-      - name: Save DigitalOcean kubeconfig with short-lived credentials
-        run: doctl kubernetes cluster kubeconfig save --expiry-seconds 600 k8s-1-25-4-do-0-nyc1-1670645170179
-      - name: switch to gamma namespace
-        run: kubectl config set-context --current --namespace=gamma
-      - name: test kubectl
-        run: kubectl get ingress
-      - name: Download helm values to file and upgrade gamma deploy
-        run: |
-          wget https://raw.githubusercontent.com/Infisical/infisical/main/.github/values.yaml
-          helm upgrade infisical infisical-helm-charts/infisical  --values values.yaml --wait --install
-          if [[ $(helm status infisical) == *"FAILED"* ]]; then
-            echo "Helm upgrade failed"
-            exit 1
-          else
-            echo "Helm upgrade was successful"
-          fi

.github/workflows/check-be-pull-request.yml

@@ -13,7 +13,6 @@ jobs:
   check-be-pr:
     name: Check
     runs-on: ubuntu-latest
-    timeout-minutes: 15
 
     steps:
       - name: ☁️ Checkout source
@@ -27,17 +26,17 @@ jobs:
       - name: 📦 Install dependencies
         run: npm ci --only-production
         working-directory: backend
-      # - name: 🧪 Run tests
-      #   run: npm run test:ci
-      #   working-directory: backend
-      # - name: 📁 Upload test results
-      #   uses: actions/upload-artifact@v3
-      #   if: always()
-      #   with:
-      #     name: be-test-results
-      #     path: |
-      #       ./backend/reports
-      #       ./backend/coverage
+      - name: 🧪 Run tests
+        run: npm run test:ci
+        working-directory: backend
+      - name: 📁 Upload test results
+        uses: actions/upload-artifact@v3
+        if: always()
+        with:
+          name: be-test-results
+          path: |
+            ./backend/reports
+            ./backend/coverage
       - name: 🏗️ Run build
         run: npm run build
         working-directory: backend

.github/workflows/check-fe-pull-request.yml

@@ -2,35 +2,40 @@ name: Check Frontend Pull Request
 
 on:
   pull_request:
-    types: [opened, synchronize]
+    types: [ opened, synchronize ]
     paths:
-      - "frontend/**"
-      - "!frontend/README.md"
-      - "!frontend/.*"
-      - "frontend/.eslintrc.js"
+      - 'frontend/**'
+      - '!frontend/README.md'
+      - '!frontend/.*'
+      - 'frontend/.eslintrc.js'
+
 
 jobs:
+
   check-fe-pr:
     name: Check
     runs-on: ubuntu-latest
-    timeout-minutes: 15
 
     steps:
-      - name: ☁️ Checkout source
+      -
+        name: ☁️ Checkout source
         uses: actions/checkout@v3
-      - name: 🔧 Setup Node 16
+      -
+        name: 🔧 Setup Node 16
         uses: actions/setup-node@v3
         with:
-          node-version: "16"
-          cache: "npm"
+          node-version: '16'
+          cache: 'npm'
           cache-dependency-path: frontend/package-lock.json
-      - name: 📦 Install dependencies
+      -
+        name: 📦 Install dependencies
         run: npm ci --only-production --ignore-scripts
         working-directory: frontend
       # -
       #   name: 🧪 Run tests
       #   run: npm run test:ci
       #   working-directory: frontend
-      - name: 🏗️ Run build
+      -
+        name: 🏗️ Run build
         run: npm run build
         working-directory: frontend

.github/workflows/docker-image.yml

@@ -1,25 +1,14 @@
-name: Release production images (frontend, backend)
-on:
-  push:
-    tags:
-      - "infisical/v*.*.*"
+name: Build, Publish and Deploy to Gamma
+on: [workflow_dispatch]
 
 jobs:
   backend-image:
     name: Build backend image
     runs-on: ubuntu-latest
+
     steps:
-      - name: Extract version from tag
-        id: extract_version
-        run: echo "::set-output name=version::${GITHUB_REF_NAME#infisical/}"
       - name: ☁️ Checkout source
         uses: actions/checkout@v3
-      - name: 📦 Install dependencies to test all dependencies
-        run: npm ci --only-production
-        working-directory: backend
-      # - name: 🧪 Run tests
-      #   run: npm run test:ci
-      #   working-directory: backend
       - name: Save commit hashes for tag
         id: commit
         uses: pr-mpt/actions-commit-hash@v2
@@ -39,7 +28,7 @@ jobs:
           token: ${{ secrets.DEPOT_PROJECT_TOKEN }}
           load: true
           context: backend
-          tags: infisical/infisical:test
+          tags: infisical/backend:test
       - name: ⏻ Spawn backend container and dependencies
         run: |
           docker compose -f .github/resources/docker-compose.be-test.yml up --wait --quiet-pull
@@ -56,19 +45,15 @@ jobs:
           token: ${{ secrets.DEPOT_PROJECT_TOKEN }}
           push: true
           context: backend
-          tags: |
-            infisical/backend:${{ steps.commit.outputs.short }}
-            infisical/backend:latest
-            infisical/backend:${{ steps.extract_version.outputs.version }}
+          tags: infisical/backend:${{ steps.commit.outputs.short }}, 
+                infisical/backend:latest
           platforms: linux/amd64,linux/arm64
 
   frontend-image:
     name: Build frontend image
     runs-on: ubuntu-latest
+
     steps:
-      - name: Extract version from tag
-        id: extract_version
-        run: echo "::set-output name=version::${GITHUB_REF_NAME#infisical/}"
       - name: ☁️ Checkout source
         uses: actions/checkout@v3
       - name: Save commit hashes for tag
@@ -93,7 +78,6 @@ jobs:
           tags: infisical/frontend:test
           build-args: |
             POSTHOG_API_KEY=${{ secrets.PUBLIC_POSTHOG_API_KEY }}
-            NEXT_INFISICAL_PLATFORM_VERSION=${{ steps.extract_version.outputs.version }}
       - name: ⏻ Spawn frontend container
         run: |
           docker run -d --rm --name infisical-frontend-test infisical/frontend:test
@@ -110,11 +94,45 @@ jobs:
           push: true
           token: ${{ secrets.DEPOT_PROJECT_TOKEN }}
           context: frontend
-          tags: |
-            infisical/frontend:${{ steps.commit.outputs.short }}
-            infisical/frontend:latest
-            infisical/frontend:${{ steps.extract_version.outputs.version }}
+          tags: infisical/frontend:${{ steps.commit.outputs.short }}, 
+                infisical/frontend:latest
           platforms: linux/amd64,linux/arm64
           build-args: |
             POSTHOG_API_KEY=${{ secrets.PUBLIC_POSTHOG_API_KEY }}
-            NEXT_INFISICAL_PLATFORM_VERSION=${{ steps.extract_version.outputs.version }}
+  gamma-deployment:
+    name: Deploy to gamma
+    runs-on: ubuntu-latest
+    needs: [frontend-image, backend-image]
+    steps:
+      - name: ☁️ Checkout source
+        uses: actions/checkout@v3
+      - name: Install Helm
+        uses: azure/setup-helm@v3
+        with:
+          version: v3.10.0
+      - name: Install infisical helm chart
+        run: |
+          helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/'
+          helm repo update
+      - name: Install kubectl
+        uses: azure/setup-kubectl@v3
+      - name: Install doctl
+        uses: digitalocean/action-doctl@v2
+        with:
+          token: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}
+      - name: Save DigitalOcean kubeconfig with short-lived credentials
+        run: doctl kubernetes cluster kubeconfig save --expiry-seconds 600 k8s-1-25-4-do-0-nyc1-1670645170179
+      - name: switch to gamma namespace 
+        run: kubectl config set-context --current --namespace=gamma
+      - name: test kubectl
+        run: kubectl get ingress
+      - name: Download helm values to file and upgrade gamma deploy
+        run: |
+          wget https://raw.githubusercontent.com/Infisical/infisical/main/.github/values.yaml
+          helm upgrade infisical infisical-helm-charts/infisical  --values values.yaml --recreate-pods
+          if [[ $(helm status infisical) == *"FAILED"* ]]; then
+            echo "Helm upgrade failed"
+            exit 1
+          else
+            echo "Helm upgrade was successful"
+          fi

.github/workflows/release-standalone-docker-img.yml

@@ -1,78 +0,0 @@
-name: Release standalone docker image
-on:
-  push:
-    tags:
-      - "infisical/v*.*.*"
-
-jobs:
-  infisical-standalone:
-    name: Build infisical standalone image
-    runs-on: ubuntu-latest
-    steps:
-      - name: Extract version from tag
-        id: extract_version
-        run: echo "::set-output name=version::${GITHUB_REF_NAME#infisical/}"
-      - name: ☁️ Checkout source
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-      - name: 📦 Install dependencies to test all dependencies
-        run: npm ci --only-production
-        working-directory: backend
-      - uses: paulhatch/semantic-version@v5.0.2
-        id: version
-        with:
-          # The prefix to use to identify tags
-          tag_prefix: "infisical-standalone/v"
-          # A string which, if present in a git commit, indicates that a change represents a
-          # major (breaking) change, supports regular expressions wrapped with '/'
-          major_pattern: "(MAJOR)"
-          # Same as above except indicating a minor change, supports regular expressions wrapped with '/'
-          minor_pattern: "(MINOR)"
-          # A string to determine the format of the version output
-          version_format: "${major}.${minor}.${patch}-prerelease${increment}"
-          # Optional path to check for changes. If any changes are detected in the path the
-          # 'changed' output will true. Enter multiple paths separated by spaces.
-          change_path: "backend,frontend"
-          # Prevents pre-v1.0.0 version from automatically incrementing the major version.
-          # If enabled, when the major version is 0, major releases will be treated as minor and minor as patch. Note that the version_type output is unchanged.
-          enable_prerelease_mode: true
-      # - name: 🧪 Run tests
-      #   run: npm run test:ci
-      #   working-directory: backend
-      - name: version output
-        run: |
-          echo "Output Value: ${{ steps.version.outputs.major }}"
-          echo "Output Value: ${{ steps.version.outputs.minor }}"
-          echo "Output Value: ${{ steps.version.outputs.patch }}"
-          echo "Output Value: ${{ steps.version.outputs.version }}"
-          echo "Output Value: ${{ steps.version.outputs.version_type }}"
-          echo "Output Value: ${{ steps.version.outputs.increment }}"
-      - name: Save commit hashes for tag
-        id: commit
-        uses: pr-mpt/actions-commit-hash@v2
-      - name: 🔧 Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-      - name: 🐋 Login to Docker Hub
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Set up Depot CLI
-        uses: depot/setup-action@v1
-      - name: 📦 Build backend and export to Docker
-        uses: depot/build-push-action@v1
-        with:
-          project: 64mmf0n610
-          token: ${{ secrets.DEPOT_PROJECT_TOKEN }}
-          push: true
-          context: .
-          tags: |
-            infisical/infisical:latest
-            infisical/infisical:${{ steps.commit.outputs.short }}
-            infisical/infisical:${{ steps.extract_version.outputs.version }}
-          platforms: linux/amd64,linux/arm64
-          file: Dockerfile.standalone-infisical
-          build-args: |
-            POSTHOG_API_KEY=${{ secrets.PUBLIC_POSTHOG_API_KEY }}
-            INFISICAL_PLATFORM_VERSION=${{ steps.extract_version.outputs.version }}

.github/workflows/release_build.yml

@@ -4,7 +4,7 @@ on:
   push:
     # run only against tags
     tags:
-      - "infisical-cli/v*.*.*"
+      - 'v*'
 
 permissions:
   contents: write
@@ -18,16 +18,10 @@ jobs:
       - uses: actions/checkout@v3
         with:
           fetch-depth: 0
-      - name: 🐋 Login to Docker Hub
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
       - run: git fetch --force --tags
-      - run: echo "Ref name ${{github.ref_name}}"
       - uses: actions/setup-go@v3
         with:
-          go-version: ">=1.19.3"
+          go-version: '>=1.19.3'
           cache: true
           cache-dependency-path: cli/go.sum
       - name: libssl1.1 => libssl1.0-dev for OSXCross
@@ -39,20 +33,19 @@ jobs:
         run: |
           mkdir ../../osxcross
           git clone https://github.com/plentico/osxcross-target.git ../../osxcross/target
-      - uses: goreleaser/goreleaser-action@v4
+      - uses: goreleaser/goreleaser-action@v2
         with:
-          distribution: goreleaser-pro
+          distribution: goreleaser
           version: latest
-          args: release --clean
+          args: release --rm-dist
         env:
           GITHUB_TOKEN: ${{ secrets.GO_RELEASER_GITHUB_TOKEN }}
-          POSTHOG_API_KEY_FOR_CLI: ${{ secrets.POSTHOG_API_KEY_FOR_CLI }}
           FURY_TOKEN: ${{ secrets.FURYPUSHTOKEN }}
           AUR_KEY: ${{ secrets.AUR_KEY }}
-          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
       - uses: actions/setup-python@v4
       - run: pip install --upgrade cloudsmith-cli
-      - name: Publish to CloudSmith
+      - name: Publish to CloudSmith 
         run: sh cli/upload_to_cloudsmith.sh
         env:
           CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}
+      

.github/workflows/release_docker_k8_operator.yaml

@@ -1,16 +1,10 @@
-name: Release Docker image for K8 operator
-on:
-  push:
-    tags:
-      - "infisical-k8-operator/v*.*.*"
+name: Release Docker image for K8 operator 
+on: [workflow_dispatch]
 
 jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - name: Extract version from tag
-        id: extract_version
-        run: echo "::set-output name=version::${GITHUB_REF_NAME#infisical-k8-operator/}"
       - uses: actions/checkout@v2
 
       - name: 🔧 Set up QEMU
@@ -32,6 +26,4 @@ jobs:
           context: k8-operator
           push: true
           platforms: linux/amd64,linux/arm64
-          tags: |
-            infisical/kubernetes-operator:latest
-            infisical/kubernetes-operator:${{ steps.extract_version.outputs.version }}
+          tags: infisical/kubernetes-operator:latest

.gitignore

@@ -2,7 +2,6 @@
 node_modules
 .env
 .env.dev
-.env.gamma
 .env.prod
 .env.infisical
 
@@ -33,7 +32,7 @@ reports
 junit.xml
 
 # next.js
-.next/
+/.next/
 /out/
 
 # production
@@ -57,8 +56,3 @@ yarn-error.log*
 
 # Infisical init
 .infisical.json
-
-# Editor specific
-.vscode/*
-
-frontend-build

.goreleaser.yaml

@@ -11,18 +11,9 @@ before:
     - ./cli/scripts/completions.sh
     - ./cli/scripts/manpages.sh
 
-monorepo:
-  tag_prefix: infisical-cli/
-  dir: cli
-
 builds:
   - id: darwin-build
     binary: infisical
-    ldflags:
-      - -X github.com/Infisical/infisical-merge/packages/util.CLI_VERSION={{ .Version }}
-      - -X github.com/Infisical/infisical-merge/packages/telemetry.POSTHOG_API_KEY_FOR_CLI={{ .Env.POSTHOG_API_KEY_FOR_CLI }}
-    flags:
-      - -trimpath
     env:
       - CGO_ENABLED=1
       - CC=/home/runner/work/osxcross/target/bin/o64-clang
@@ -33,16 +24,10 @@ builds:
       - goos: darwin
         goarch: "386"
     dir: ./cli
-
   - id: all-other-builds
     env:
       - CGO_ENABLED=0
     binary: infisical
-    ldflags:
-      - -X github.com/Infisical/infisical-merge/packages/util.CLI_VERSION={{ .Version }}
-      - -X github.com/Infisical/infisical-merge/packages/telemetry.POSTHOG_API_KEY_FOR_CLI={{ .Env.POSTHOG_API_KEY_FOR_CLI }}
-    flags:
-      - -trimpath
     goos:
       - freebsd
       - linux
@@ -69,20 +54,25 @@ archives:
       - goos: windows
         format: zip
     files:
-      - ../README*
-      - ../LICENSE*
-      - ../manpages/*
-      - ../completions/*
+      - README*
+      - LICENSE*
+      - manpages/*
+      - completions/*
 
 release:
   replace_existing_draft: true
-  mode: "replace"
+  mode: 'replace'
 
 checksum:
-  name_template: "checksums.txt"
-
+  name_template: 'checksums.txt'
 snapshot:
-  name_template: "{{ .Version }}-devel"
+  name_template: "{{ incpatch .Version }}"
+changelog:
+  sort: asc
+  filters:
+    exclude:
+      - '^docs:'
+      - '^test:'
 
 # publishers:
 #   - name: fury.io
@@ -90,7 +80,6 @@ snapshot:
 #       - infisical
 #     dir: "{{ dir .ArtifactPath }}"
 #     cmd: curl -F package=@{{ .ArtifactName }} https://{{ .Env.FURY_TOKEN }}@push.fury.io/infisical/
-
 brews:
   - name: infisical
     tap:
@@ -102,55 +91,31 @@ brews:
     folder: Formula
     homepage: "https://infisical.com"
     description: "The official Infisical CLI"
-    install: |-
-      bin.install "infisical"
-      bash_completion.install "completions/infisical.bash" => "infisical"
-      zsh_completion.install "completions/infisical.zsh" => "_infisical"
-      fish_completion.install "completions/infisical.fish"
-      man1.install "manpages/infisical.1.gz"
-  - name: 'infisical@{{.Version}}'
-    tap:
-      owner: Infisical
-      name: homebrew-get-cli
-    commit_author:
-      name: "Infisical"
-      email: ai@infisical.com
-    folder: Formula
-    homepage: "https://infisical.com"
-    description: "The official Infisical CLI"
-    install: |-
-      bin.install "infisical"
-      bash_completion.install "completions/infisical.bash" => "infisical"
-      zsh_completion.install "completions/infisical.zsh" => "_infisical"
-      fish_completion.install "completions/infisical.fish"
-      man1.install "manpages/infisical.1.gz"
-
 nfpms:
-  - id: infisical
-    package_name: infisical
-    builds:
-      - all-other-builds
-    vendor: Infisical, Inc
-    homepage: https://infisical.com/
-    maintainer: Infisical, Inc
-    description: The offical Infisical CLI
-    license: MIT
-    formats:
-      - rpm
-      - deb
-      - apk
-      - archlinux
-    bindir: /usr/bin
-    contents:
-      - src: ./completions/infisical.bash
-        dst: /etc/bash_completion.d/infisical
-      - src: ./completions/infisical.fish
-        dst: /usr/share/fish/vendor_completions.d/infisical.fish
-      - src: ./completions/infisical.zsh
-        dst: /usr/share/zsh/site-functions/_infisical
-      - src: ./manpages/infisical.1.gz
-        dst: /usr/share/man/man1/infisical.1.gz
-
+- id: infisical
+  package_name: infisical
+  builds:
+    - all-other-builds
+  vendor: Infisical, Inc
+  homepage: https://infisical.com/
+  maintainer: Infisical, Inc
+  description: The offical Infisical CLI
+  license: MIT
+  formats:
+  - rpm
+  - deb
+  - apk
+  - archlinux
+  bindir: /usr/bin
+  contents:
+    - src: ./completions/infisical.bash
+      dst: /etc/bash_completion.d/infisical
+    - src: ./completions/infisical.fish
+      dst: /usr/share/fish/vendor_completions.d/infisical.fish
+    - src: ./completions/infisical.zsh
+      dst: /usr/share/zsh/site-functions/_infisical
+    - src: ./manpages/infisical.1.gz
+      dst: /usr/share/man/man1/infisical.1.gz
 scoop:
   bucket:
     owner: Infisical
@@ -161,16 +126,16 @@ scoop:
   homepage: "https://infisical.com"
   description: "The official Infisical CLI"
   license: MIT
-
 aurs:
-  - name: infisical-bin
+  -
+    name: infisical-bin
     homepage: "https://infisical.com"
     description: "The official Infisical CLI"
     maintainers:
       - Infisical, Inc <support@infisical.com>
     license: MIT
-    private_key: "{{ .Env.AUR_KEY }}"
-    git_url: "ssh://aur@aur.archlinux.org/infisical-bin.git"
+    private_key: '{{ .Env.AUR_KEY }}'
+    git_url: 'ssh://aur@aur.archlinux.org/infisical-bin.git'
     package: |-
       # bin
       install -Dm755 "./infisical" "${pkgdir}/usr/bin/infisical"
@@ -181,17 +146,23 @@ aurs:
       mkdir -p "${pkgdir}/usr/share/zsh/site-functions/"
       mkdir -p "${pkgdir}/usr/share/fish/vendor_completions.d/"
       install -Dm644 "./completions/infisical.bash" "${pkgdir}/usr/share/bash-completion/completions/infisical"
-      install -Dm644 "./completions/infisical.zsh" "${pkgdir}/usr/share/zsh/site-functions/_infisical"
+      install -Dm644 "./completions/infisical.zsh" "${pkgdir}/usr/share/zsh/site-functions/infisical"
       install -Dm644 "./completions/infisical.fish" "${pkgdir}/usr/share/fish/vendor_completions.d/infisical.fish"
       # man pages
       install -Dm644 "./manpages/infisical.1.gz" "${pkgdir}/usr/share/man/man1/infisical.1.gz"
-
 # dockers:
-#   - dockerfile: cli/docker/Dockerfile
+#   - dockerfile: goreleaser.dockerfile
 #     goos: linux
 #     goarch: amd64
 #     ids:
 #       - infisical
 #     image_templates:
-#       - "infisical/cli:{{ .Version }}"
+#       - "infisical/cli:{{ .Version }}"             
+#       - "infisical/cli:{{ .Major }}.{{ .Minor }}"  
+#       - "infisical/cli:{{ .Major }}"               
 #       - "infisical/cli:latest"
+#     build_flag_templates:
+#       - "--label=org.label-schema.schema-version=1.0"
+#       - "--label=org.label-schema.version={{.Version}}"
+#       - "--label=org.label-schema.name={{.ProjectName}}"
+#       - "--platform=linux/amd64"

.husky/pre-commit

@@ -1,6 +1,5 @@
+
 #!/usr/bin/env sh
 . "$(dirname -- "$0")/_/husky.sh"
 
 npx lint-staged
-
-infisical scan git-changes --staged -v

.infisicalignore

@@ -1 +0,0 @@
-.github/resources/docker-compose.be-test.yml:generic-api-key:16

Dockerfile.standalone-infisical

@@ -1,128 +0,0 @@
-ARG POSTHOG_HOST=https://app.posthog.com
-ARG POSTHOG_API_KEY=posthog-api-key
-ARG INTERCOM_ID=intercom-id
-
-FROM  node:16-alpine AS base
-
-FROM base AS frontend-dependencies
-
-# Check https://github.com/nodejs/docker-node/tree/b4117f9333da4138b03a546ec926ef50a31506c3#nodealpine to understand why libc6-compat might be needed.
-RUN apk add --no-cache libc6-compat
-
-WORKDIR /app
-
-COPY frontend/package.json frontend/package-lock.json frontend/next.config.js ./
-
-# Install dependencies
-RUN npm ci --only-production --ignore-scripts
-
-# Rebuild the source code only when needed
-FROM base AS frontend-builder
-WORKDIR /app
-
-# Copy dependencies
-COPY --from=frontend-dependencies /app/node_modules ./node_modules
-# Copy all files 
-COPY /frontend .
-
-ENV NODE_ENV production
-ENV NEXT_PUBLIC_ENV production
-ARG POSTHOG_HOST
-ENV NEXT_PUBLIC_POSTHOG_HOST $POSTHOG_HOST
-ARG POSTHOG_API_KEY
-ENV NEXT_PUBLIC_POSTHOG_API_KEY $POSTHOG_API_KEY
-ARG INTERCOM_ID
-ENV NEXT_PUBLIC_INTERCOM_ID $INTERCOM_ID
-ARG INFISICAL_PLATFORM_VERSION
-ENV NEXT_PUBLIC_INFISICAL_PLATFORM_VERSION $INFISICAL_PLATFORM_VERSION
-
-# Build
-RUN npm run build
-
-# Production image
-FROM base AS frontend-runner
-WORKDIR /app
-
-RUN addgroup --system --gid 1001 nodejs
-RUN adduser --system --uid 1001 non-root-user
-
-RUN mkdir -p /app/.next/cache/images && chown non-root-user:nodejs /app/.next/cache/images
-VOLUME /app/.next/cache/images
-
-COPY --chown=non-root-user:nodejs --chmod=555 frontend/scripts ./scripts
-COPY --from=frontend-builder /app/public ./public
-RUN chown non-root-user:nodejs ./public/data
-COPY --from=frontend-builder --chown=non-root-user:nodejs /app/.next/standalone ./
-COPY --from=frontend-builder --chown=non-root-user:nodejs /app/.next/static ./.next/static
-
-USER non-root-user
-
-ENV NEXT_TELEMETRY_DISABLED 1
-
-##
-## BACKEND
-##
-FROM base AS backend-build
-RUN addgroup --system --gid 1001 nodejs \
-  && adduser --system --uid 1001 non-root-user
-
-WORKDIR /app
-
-COPY backend/package*.json ./
-RUN npm ci --only-production
-
-COPY /backend .
-COPY --chown=non-root-user:nodejs standalone-entrypoint.sh standalone-entrypoint.sh
-RUN npm run build
-
-# Production stage
-FROM base AS backend-runner
-
-WORKDIR /app
-
-COPY backend/package*.json ./
-RUN npm ci --only-production
-
-COPY --from=backend-build /app .
-
-RUN mkdir frontend-build
-
-# Production stage
-FROM base AS production
-RUN addgroup --system --gid 1001 nodejs \
-  && adduser --system --uid 1001 non-root-user
-
-## set pre baked keys
-ARG POSTHOG_API_KEY
-ENV NEXT_PUBLIC_POSTHOG_API_KEY=$POSTHOG_API_KEY \
-  BAKED_NEXT_PUBLIC_POSTHOG_API_KEY=$POSTHOG_API_KEY
-ARG INTERCOM_ID=intercom-id
-ENV NEXT_PUBLIC_INTERCOM_ID=$INTERCOM_ID \
-  BAKED_NEXT_PUBLIC_INTERCOM_ID=$INTERCOM_ID
-
-WORKDIR / 
-
-COPY --from=backend-runner /app /backend
-
-COPY --from=frontend-runner /app ./backend/frontend-build
-
-ENV PORT 8080
-ENV HTTPS_ENABLED false 
-ENV NODE_ENV production
-ENV STANDALONE_BUILD true 
-
-WORKDIR /backend
-
-ENV TELEMETRY_ENABLED true
-
-HEALTHCHECK --interval=10s --timeout=3s --start-period=10s \  
-  CMD node healthcheck.js
-
-EXPOSE 8080
-
-USER non-root-user
-
-CMD ["./standalone-entrypoint.sh"]
-
-
-

SECURITY.md

@@ -1,13 +1,9 @@
 # Security Policy
 
-## Supported versions
+## Supported Versions
 
 We always recommend using the latest version of Infisical to ensure you get all security updates.
 
-## Reporting vulnerabilities
+## Reporting a Vulnerability
 
-Please do not file GitHub issues or post on our public forum for security vulnerabilities, as they are public!
-
-Infisical takes security issues very seriously. If you have any concerns about Infisical or believe you have uncovered a vulnerability, please get in touch via the e-mail address security@infisical.com. In the message, try to provide a description of the issue and ideally a way of reproducing it. The security team will get back to you as soon as possible.
-
-Note that this security address should be used only for undisclosed vulnerabilities. Please report any security problems to us before disclosing it publicly.
+Please report security vulnerabilities or concerns to team@infisical.com.

backend/.eslintrc

@@ -1,41 +1,12 @@
 {
   "parser": "@typescript-eslint/parser",
-  "plugins": [
-    "@typescript-eslint",
-    "unused-imports"
-  ],
+  "plugins": ["@typescript-eslint"],
   "extends": [
     "eslint:recommended",
     "plugin:@typescript-eslint/eslint-recommended",
     "plugin:@typescript-eslint/recommended"
   ],
   "rules": {
-    "no-empty-function": "off",
-    "@typescript-eslint/no-empty-function": "off",
-    "no-console": 2,
-    "quotes": [
-      "error",
-      "double",
-      {
-        "avoidEscape": true
-      }
-    ],
-    "comma-dangle": [
-      "error",
-      "only-multiline"
-    ],
-    "@typescript-eslint/no-unused-vars": "off",
-    "unused-imports/no-unused-imports": "error",
-    "@typescript-eslint/no-extra-semi": "off", // added to be able to push
-    "unused-imports/no-unused-vars": [
-      "warn",
-      {
-        "vars": "all",
-        "varsIgnorePattern": "^_",
-        "args": "after-used",
-        "argsIgnorePattern": "^_"
-      }
-    ],
-    "sort-imports": 1
+    "no-console": 2
   }
-}
+}

backend/.prettierrc

@@ -1,7 +0,0 @@
-{
-  "singleQuote": false,
-  "printWidth": 100,
-  "trailingComma": "none",
-  "tabWidth": 2,
-  "semi": true
-}

backend/Dockerfile

@@ -1,33 +1,18 @@
-# Build stage
-FROM node:16-alpine AS build
+FROM node:16-bullseye-slim
 
 WORKDIR /app
 
-COPY package*.json ./
+COPY package.json package-lock.json ./
+
+# RUN npm ci --only-production --ignore-scripts
+# "prepare": "cd .. && npm install"
+
 RUN npm ci --only-production
 
 COPY . .
-RUN npm run build
-
-# Production stage
-FROM node:16-alpine
-
-WORKDIR /app
-
-ENV npm_config_cache /home/node/.npm
-
-COPY package*.json ./
-RUN npm ci --only-production && npm cache clean --force
-
-COPY --from=build /app .
-
-RUN apk add --no-cache bash curl && curl -1sLf \
-  'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.alpine.sh' | bash \
-  && apk add infisical=0.8.1 && apk add --no-cache git
 
 HEALTHCHECK --interval=10s --timeout=3s --start-period=10s \  
   CMD node healthcheck.js
 
-EXPOSE 4000
 
-CMD ["node", "build/index.js"]
+CMD ["npm", "run", "start"]

backend/__tests__/healthcheck.test.ts

@@ -0,0 +1,19 @@
+import { server } from '../src/app';
+import { describe, expect, it, beforeAll, afterAll } from '@jest/globals';
+import supertest from 'supertest';
+import { setUpHealthEndpoint } from '../src/services/health';
+
+const requestWithSupertest = supertest(server);
+describe('Healthcheck endpoint', () => {
+  beforeAll(async () => {
+    setUpHealthEndpoint(server);
+  });
+  afterAll(async () => {
+    server.close();
+  });
+
+  it('GET /healthcheck should return OK', async () => {
+    const res = await requestWithSupertest.get('/healthcheck');
+    expect(res.status).toEqual(200);
+  });
+});

backend/environment.d.ts

@@ -3,9 +3,8 @@ export {};
 declare global {
   namespace NodeJS {
     interface ProcessEnv {
-      PORT: string;
+      EMAIL_TOKEN_LIFETIME: string;
       ENCRYPTION_KEY: string;
-      SALT_ROUNDS: string;
       JWT_AUTH_LIFETIME: string;
       JWT_AUTH_SECRET: string;
       JWT_REFRESH_LIFETIME: string;
@@ -14,33 +13,29 @@ declare global {
 			JWT_SIGNUP_LIFETIME: string;
 			JWT_SIGNUP_SECRET: string;
       MONGO_URL: string;
-      NODE_ENV: "development" | "staging" | "testing" | "production";
+      NODE_ENV: 'development' | 'staging' | 'testing' | 'production';
       VERBOSE_ERROR_OUTPUT: string;
       LOKI_HOST: string;
       CLIENT_ID_HEROKU: string;
       CLIENT_ID_VERCEL: string;
       CLIENT_ID_NETLIFY: string;
-      CLIENT_ID_GITHUB: string;
-      CLIENT_ID_GITLAB: string;
       CLIENT_SECRET_HEROKU: string;
       CLIENT_SECRET_VERCEL: string;
       CLIENT_SECRET_NETLIFY: string;
-      CLIENT_SECRET_GITHUB: string;
-      CLIENT_SECRET_GITLAB: string;
-      CLIENT_SLUG_VERCEL: string;
 			POSTHOG_HOST: string;
 			POSTHOG_PROJECT_API_KEY: string;
       SENTRY_DSN: string;
       SITE_URL: string;
       SMTP_HOST: string;
-      SMTP_SECURE: string;
-      SMTP_PORT: string;
-      SMTP_USERNAME: string;
+      SMTP_NAME: string;
       SMTP_PASSWORD: string;
-      SMTP_FROM_ADDRESS: string;
-      SMTP_FROM_NAME: string;
-      TELEMETRY_ENABLED: string;
-      LICENSE_KEY: string;
+      SMTP_USERNAME: string;
+      STRIPE_PRODUCT_CARD_AUTH: string;
+      STRIPE_PRODUCT_PRO: string;
+      STRIPE_PRODUCT_STARTER: string;
+      STRIPE_PUBLISHABLE_KEY: string;
+      STRIPE_SECRET_KEY: string;
+      STRIPE_WEBHOOK_SECRET: string;
     }
   }
 }

backend/jest.config.ts

@@ -1,9 +0,0 @@
-export default {
-  preset: "ts-jest",
-  testEnvironment: "node",
-  collectCoverageFrom: ["src/*.{js,ts}", "!**/node_modules/**"],
-  modulePaths: ["<rootDir>/src"],
-  testMatch: ["<rootDir>/tests/**/*.test.ts"],
-  setupFiles: ["<rootDir>/test-resources/env-vars.js"],
-  setupFilesAfterEnv: ["<rootDir>/tests/setupTests.ts"],
-};

backend/package.json

@@ -1,75 +1,17 @@
 {
-  "dependencies": {
-    "@aws-sdk/client-secrets-manager": "^3.319.0",
-    "@casl/ability": "^6.5.0",
-    "@casl/mongoose": "^7.2.1",
-    "@godaddy/terminus": "^4.12.0",
-    "@node-saml/passport-saml": "^4.0.4",
-    "@octokit/rest": "^19.0.5",
-    "@sentry/node": "^7.49.0",
-    "@sentry/tracing": "^7.48.0",
-    "@types/crypto-js": "^4.1.1",
-    "@types/libsodium-wrappers": "^0.7.10",
-    "@ucast/mongo2js": "^1.3.4",
-    "argon2": "^0.30.3",
-    "aws-sdk": "^2.1364.0",
-    "axios": "^1.3.5",
-    "axios-retry": "^3.4.0",
-    "bcrypt": "^5.1.0",
-    "bigint-conversion": "^2.4.0",
-    "cookie-parser": "^1.4.6",
-    "cors": "^2.8.5",
-    "crypto-js": "^4.1.1",
-    "dotenv": "^16.0.1",
-    "express": "^4.18.1",
-    "express-async-errors": "^3.1.1",
-    "express-rate-limit": "^6.7.0",
-    "express-validator": "^6.14.2",
-    "handlebars": "^4.7.7",
-    "helmet": "^5.1.1",
-    "infisical-node": "^1.2.1",
-    "ioredis": "^5.3.2",
-    "js-yaml": "^4.1.0",
-    "jsonwebtoken": "^9.0.0",
-    "jsrp": "^0.2.4",
-    "libsodium-wrappers": "^0.7.10",
-    "lodash": "^4.17.21",
-    "mongodb": "^5.7.0",
-    "mongoose": "^7.4.1",
-    "nanoid": "^3.3.6",
-    "node-cache": "^5.1.2",
-    "nodemailer": "^6.8.0",
-    "passport": "^0.6.0",
-    "passport-github": "^1.1.0",
-    "passport-gitlab2": "^5.0.0",
-    "passport-google-oauth20": "^2.0.0",
-    "posthog-node": "^2.6.0",
-    "probot": "^12.3.1",
-    "query-string": "^7.1.3",
-    "rate-limit-mongo": "^2.3.2",
-    "rimraf": "^3.0.2",
-    "swagger-ui-express": "^4.6.2",
-    "tweetnacl": "^1.0.3",
-    "tweetnacl-util": "^0.15.1",
-    "typescript": "^4.9.3",
-    "utility-types": "^3.10.0",
-    "winston": "^3.8.2",
-    "winston-loki": "^6.0.6",
-    "zod": "^3.22.3"
-  },
   "name": "infisical-api",
   "version": "1.0.0",
   "main": "src/index.js",
   "scripts": {
-    "start": "node build/index.js",
+    "start": "npm run build && node build/index.js",
     "dev": "nodemon",
     "swagger-autogen": "node ./swagger/index.ts",
-    "build": "rimraf ./build && tsc && cp -R ./src/templates ./build && cp -R ./src/data ./build",
+    "build": "rimraf ./build && tsc && cp -R ./src/templates ./build",
     "lint": "eslint . --ext .ts",
     "lint-and-fix": "eslint . --ext .ts --fix",
     "lint-staged": "lint-staged",
     "pretest": "docker compose -f test-resources/docker-compose.test.yml up -d",
-    "test": "cross-env NODE_ENV=test jest --verbose --testTimeout=10000 --detectOpenHandles; npm run posttest",
+    "test": "cross-env NODE_ENV=test jest --testTimeout=10000 --detectOpenHandles",
     "test:ci": "npm test -- --watchAll=false --ci --reporters=default --reporters=jest-junit --reporters=github-actions --coverage --testLocationInResults --json --outputFile=coverage/report.json",
     "posttest": "docker compose -f test-resources/docker-compose.test.yml down"
   },
@@ -89,36 +31,41 @@
     "@posthog/plugin-scaffold": "^1.3.4",
     "@types/bcrypt": "^5.0.0",
     "@types/bcryptjs": "^2.4.2",
-    "@types/bull": "^4.10.0",
     "@types/cookie-parser": "^1.4.3",
     "@types/cors": "^2.8.12",
     "@types/express": "^4.17.14",
-    "@types/jest": "^29.5.0",
+    "@types/jest": "^29.2.4",
     "@types/jsonwebtoken": "^8.5.9",
     "@types/lodash": "^4.14.191",
     "@types/node": "^18.11.3",
     "@types/nodemailer": "^6.4.6",
-    "@types/passport": "^1.0.12",
-    "@types/picomatch": "^2.3.0",
     "@types/supertest": "^2.0.12",
     "@types/swagger-jsdoc": "^6.0.1",
     "@types/swagger-ui-express": "^4.1.3",
-    "@typescript-eslint/eslint-plugin": "^5.54.0",
+    "@typescript-eslint/eslint-plugin": "^5.40.1",
     "@typescript-eslint/parser": "^5.40.1",
     "cross-env": "^7.0.3",
     "eslint": "^8.26.0",
-    "eslint-plugin-unused-imports": "^2.0.0",
     "install": "^0.13.0",
     "jest": "^29.3.1",
     "jest-junit": "^15.0.0",
     "nodemon": "^2.0.19",
     "npm": "^8.19.3",
-    "smee-client": "^1.2.3",
     "supertest": "^6.3.3",
-    "swagger-autogen": "^2.23.5",
     "ts-jest": "^29.0.3",
     "ts-node": "^10.9.1"
   },
+  "jest": {
+    "preset": "ts-jest",
+    "testEnvironment": "node",
+    "collectCoverageFrom": [
+      "src/*.{js,ts}",
+      "!**/node_modules/**"
+    ],
+    "setupFiles": [
+      "<rootDir>/test-resources/env-vars.js"
+    ]
+  },
   "jest-junit": {
     "outputDirectory": "reports",
     "outputName": "jest-junit.xml",
@@ -127,5 +74,47 @@
     "suiteNameTemplate": "{filepath}",
     "classNameTemplate": "{classname}",
     "titleTemplate": "{title}"
+  },
+  "dependencies": {
+    "@godaddy/terminus": "^4.11.2",
+    "@octokit/rest": "^19.0.5",
+    "@sentry/node": "^7.14.0",
+    "@sentry/tracing": "^7.19.0",
+    "@types/crypto-js": "^4.1.1",
+    "@types/libsodium-wrappers": "^0.7.10",
+    "await-to-js": "^3.0.0",
+    "axios": "^1.1.3",
+    "bcrypt": "^5.1.0",
+    "bigint-conversion": "^2.2.2",
+    "builder-pattern": "^2.2.0",
+    "cookie-parser": "^1.4.6",
+    "cors": "^2.8.5",
+    "crypto-js": "^4.1.1",
+    "dotenv": "^16.0.1",
+    "express": "^4.18.1",
+    "express-rate-limit": "^6.7.0",
+    "express-validator": "^6.14.2",
+    "handlebars": "^4.7.7",
+    "helmet": "^5.1.1",
+    "js-yaml": "^4.1.0",
+    "jsonwebtoken": "^9.0.0",
+    "jsrp": "^0.2.4",
+    "libsodium-wrappers": "^0.7.10",
+    "lodash": "^4.17.21",
+    "mongoose": "^6.7.2",
+    "nodemailer": "^6.8.0",
+    "posthog-node": "^2.2.2",
+    "query-string": "^7.1.3",
+    "request-ip": "^3.3.0",
+    "rimraf": "^3.0.2",
+    "stripe": "^10.7.0",
+    "swagger-autogen": "^2.22.0",
+    "swagger-ui-express": "^4.6.0",
+    "tweetnacl": "^1.0.3",
+    "tweetnacl-util": "^0.15.1",
+    "typescript": "^4.9.3",
+    "utility-types": "^3.10.0",
+    "winston": "^3.8.2",
+    "winston-loki": "^6.0.6"
   }
 }

backend/src/app.ts

@@ -0,0 +1,138 @@
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const { patchRouterParam } = require('./utils/patchAsyncRoutes');
+
+import express, { Request, Response } from 'express';
+import helmet from 'helmet';
+import cors from 'cors';
+import cookieParser from 'cookie-parser';
+import dotenv from 'dotenv';
+import swaggerUi = require('swagger-ui-express');
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const swaggerFile = require('../spec.json');
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const requestIp = require('request-ip');
+
+dotenv.config();
+import { PORT, NODE_ENV, SITE_URL } from './config';
+import { apiLimiter } from './helpers/rateLimiter';
+
+import {
+  workspace as eeWorkspaceRouter,
+  secret as eeSecretRouter,
+  secretSnapshot as eeSecretSnapshotRouter,
+  action as eeActionRouter
+} from './ee/routes/v1';
+import {
+  signup as v1SignupRouter,
+  auth as v1AuthRouter,
+  bot as v1BotRouter,
+  organization as v1OrganizationRouter,
+  workspace as v1WorkspaceRouter,
+  membershipOrg as v1MembershipOrgRouter,
+  membership as v1MembershipRouter,
+  key as v1KeyRouter,
+  inviteOrg as v1InviteOrgRouter,
+  user as v1UserRouter,
+  userAction as v1UserActionRouter,
+  secret as v1SecretRouter,
+  serviceToken as v1ServiceTokenRouter,
+  password as v1PasswordRouter,
+  stripe as v1StripeRouter,
+  integration as v1IntegrationRouter,
+  integrationAuth as v1IntegrationAuthRouter
+} from './routes/v1';
+import {
+  users as v2UsersRouter,
+  organizations as v2OrganizationsRouter,
+  workspace as v2WorkspaceRouter,
+  secret as v2SecretRouter, // begin to phase out
+  secrets as v2SecretsRouter,
+  serviceTokenData as v2ServiceTokenDataRouter,
+  apiKeyData as v2APIKeyDataRouter,
+  environment as v2EnvironmentRouter,
+} from './routes/v2';
+
+import { healthCheck } from './routes/status';
+
+import { getLogger } from './utils/logger';
+import { RouteNotFoundError } from './utils/errors';
+import { requestErrorHandler } from './middleware/requestErrorHandler';
+
+// patch async route params to handle Promise Rejections
+patchRouterParam();
+
+export const app = express();
+
+app.enable('trust proxy');
+app.use(express.json());
+app.use(cookieParser());
+app.use(
+  cors({
+    credentials: true,
+    origin: SITE_URL
+  })
+);
+
+app.use(requestIp.mw())
+
+if (NODE_ENV === 'production') {
+  // enable app-wide rate-limiting + helmet security
+  // in production
+  app.disable('x-powered-by');
+  app.use(apiLimiter);
+  app.use(helmet());
+}
+
+// (EE) routes
+app.use('/api/v1/secret', eeSecretRouter);
+app.use('/api/v1/secret-snapshot', eeSecretSnapshotRouter);
+app.use('/api/v1/workspace', eeWorkspaceRouter);
+app.use('/api/v1/action', eeActionRouter);
+
+// v1 routes
+app.use('/api/v1/signup', v1SignupRouter);
+app.use('/api/v1/auth', v1AuthRouter);
+app.use('/api/v1/bot', v1BotRouter);
+app.use('/api/v1/user', v1UserRouter);
+app.use('/api/v1/user-action', v1UserActionRouter);
+app.use('/api/v1/organization', v1OrganizationRouter);
+app.use('/api/v1/workspace', v1WorkspaceRouter);
+app.use('/api/v1/membership-org', v1MembershipOrgRouter);
+app.use('/api/v1/membership', v1MembershipRouter);
+app.use('/api/v1/key', v1KeyRouter);
+app.use('/api/v1/invite-org', v1InviteOrgRouter);
+app.use('/api/v1/secret', v1SecretRouter);
+app.use('/api/v1/service-token', v1ServiceTokenRouter); // deprecated
+app.use('/api/v1/password', v1PasswordRouter);
+app.use('/api/v1/stripe', v1StripeRouter);
+app.use('/api/v1/integration', v1IntegrationRouter);
+app.use('/api/v1/integration-auth', v1IntegrationAuthRouter);
+
+// v2 routes
+app.use('/api/v2/users', v2UsersRouter);
+app.use('/api/v2/organizations', v2OrganizationsRouter);
+app.use('/api/v2/workspace', v2EnvironmentRouter);
+app.use('/api/v2/workspace', v2WorkspaceRouter);
+app.use('/api/v2/secret', v2SecretRouter); // deprecated
+app.use('/api/v2/secrets', v2SecretsRouter);
+app.use('/api/v2/service-token', v2ServiceTokenDataRouter); // TODO: turn into plural route
+app.use('/api/v2/api-key', v2APIKeyDataRouter);
+
+// api docs 
+app.use('/api-docs', swaggerUi.serve, swaggerUi.setup(swaggerFile))
+
+// Server status
+app.use('/api', healthCheck)
+
+//* Handle unrouted requests and respond with proper error message as well as status code
+app.use((req, res, next) => {
+  if (res.headersSent) return next();
+  next(RouteNotFoundError({ message: `The requested source '(${req.method})${req.url}' was not found` }))
+})
+
+//* Error Handling Middleware (must be after all routing logic)
+app.use(requestErrorHandler)
+
+export const server = app.listen(PORT, () => {
+  getLogger("backend-main").info(`Server started listening at port ${PORT}`)
+});

backend/src/config/index.ts

@@ -1,106 +1,91 @@
-import { GITLAB_URL } from "../variables";
+const PORT = process.env.PORT || 4000;
+const EMAIL_TOKEN_LIFETIME = process.env.EMAIL_TOKEN_LIFETIME! || '86400';
+const ENCRYPTION_KEY = process.env.ENCRYPTION_KEY!;
+const SALT_ROUNDS = parseInt(process.env.SALT_ROUNDS!) || 10;
+const JWT_AUTH_LIFETIME = process.env.JWT_AUTH_LIFETIME! || '10d';
+const JWT_AUTH_SECRET = process.env.JWT_AUTH_SECRET!;
+const JWT_REFRESH_LIFETIME = process.env.JWT_REFRESH_LIFETIME! || '90d';
+const JWT_REFRESH_SECRET = process.env.JWT_REFRESH_SECRET!;
+const JWT_SERVICE_SECRET = process.env.JWT_SERVICE_SECRET!;
+const JWT_SIGNUP_LIFETIME = process.env.JWT_SIGNUP_LIFETIME! || '15m';
+const JWT_SIGNUP_SECRET = process.env.JWT_SIGNUP_SECRET!;
+const MONGO_URL = process.env.MONGO_URL!;
+const NODE_ENV = process.env.NODE_ENV! || 'production';
+const VERBOSE_ERROR_OUTPUT = process.env.VERBOSE_ERROR_OUTPUT! === 'true' && true;
+const LOKI_HOST = process.env.LOKI_HOST || undefined;
+const CLIENT_SECRET_HEROKU = process.env.CLIENT_SECRET_HEROKU!;
+const CLIENT_ID_HEROKU = process.env.CLIENT_ID_HEROKU!;
+const CLIENT_ID_VERCEL = process.env.CLIENT_ID_VERCEL!;
+const CLIENT_ID_NETLIFY = process.env.CLIENT_ID_NETLIFY!;
+const CLIENT_ID_GITHUB = process.env.CLIENT_ID_GITHUB!;
+const CLIENT_SECRET_VERCEL = process.env.CLIENT_SECRET_VERCEL!;
+const CLIENT_SECRET_NETLIFY = process.env.CLIENT_SECRET_NETLIFY!;
+const CLIENT_SECRET_GITHUB = process.env.CLIENT_SECRET_GITHUB!;
+const CLIENT_SLUG_VERCEL= process.env.CLIENT_SLUG_VERCEL!;
+const POSTHOG_HOST = process.env.POSTHOG_HOST! || 'https://app.posthog.com';
+const POSTHOG_PROJECT_API_KEY =
+  process.env.POSTHOG_PROJECT_API_KEY! ||
+  'phc_nSin8j5q2zdhpFDI1ETmFNUIuTG4DwKVyIigrY10XiE';
+const SENTRY_DSN = process.env.SENTRY_DSN!;
+const SITE_URL = process.env.SITE_URL!;
+const SMTP_HOST = process.env.SMTP_HOST!;
+const SMTP_SECURE = process.env.SMTP_SECURE! === 'true' || false;
+const SMTP_PORT = parseInt(process.env.SMTP_PORT!) || 587;
+const SMTP_USERNAME = process.env.SMTP_USERNAME!;
+const SMTP_PASSWORD = process.env.SMTP_PASSWORD!;
+const SMTP_FROM_ADDRESS = process.env.SMTP_FROM_ADDRESS!;
+const SMTP_FROM_NAME = process.env.SMTP_FROM_NAME! || 'Infisical';
+const STRIPE_PRODUCT_CARD_AUTH = process.env.STRIPE_PRODUCT_CARD_AUTH!;
+const STRIPE_PRODUCT_PRO = process.env.STRIPE_PRODUCT_PRO!;
+const STRIPE_PRODUCT_STARTER = process.env.STRIPE_PRODUCT_STARTER!;
+const STRIPE_PUBLISHABLE_KEY = process.env.STRIPE_PUBLISHABLE_KEY!;
+const STRIPE_SECRET_KEY = process.env.STRIPE_SECRET_KEY!;
+const STRIPE_WEBHOOK_SECRET = process.env.STRIPE_WEBHOOK_SECRET!;
+const TELEMETRY_ENABLED = process.env.TELEMETRY_ENABLED! !== 'false' && true;
+const LICENSE_KEY = process.env.LICENSE_KEY!;
 
-import InfisicalClient from "infisical-node";
-
-export const client = new InfisicalClient({
-  token: process.env.INFISICAL_TOKEN!,
-});
-
-export const getPort = async () => (await client.getSecret("PORT")).secretValue || 4000;
-export const getEncryptionKey = async () => {
-  const secretValue = (await client.getSecret("ENCRYPTION_KEY")).secretValue;
-  return secretValue === "" ? undefined : secretValue;
-}
-export const getRootEncryptionKey = async () => {
-  const secretValue = (await client.getSecret("ROOT_ENCRYPTION_KEY")).secretValue;
-  return secretValue === "" ? undefined : secretValue;
-}
-export const getInviteOnlySignup = async () => (await client.getSecret("INVITE_ONLY_SIGNUP")).secretValue === "true"
-export const getSaltRounds = async () => parseInt((await client.getSecret("SALT_ROUNDS")).secretValue) || 10;
-export const getJwtAuthLifetime = async () => (await client.getSecret("JWT_AUTH_LIFETIME")).secretValue || "10d";
-export const getJwtAuthSecret = async () => (await client.getSecret("JWT_AUTH_SECRET")).secretValue;
-export const getJwtMfaLifetime = async () => (await client.getSecret("JWT_MFA_LIFETIME")).secretValue || "5m";
-export const getJwtMfaSecret = async () => (await client.getSecret("JWT_MFA_LIFETIME")).secretValue || "5m";
-export const getJwtRefreshLifetime = async () => (await client.getSecret("JWT_REFRESH_LIFETIME")).secretValue || "90d";
-export const getJwtRefreshSecret = async () => (await client.getSecret("JWT_REFRESH_SECRET")).secretValue;
-export const getJwtServiceSecret = async () => (await client.getSecret("JWT_SERVICE_SECRET")).secretValue;
-export const getJwtSignupLifetime = async () => (await client.getSecret("JWT_SIGNUP_LIFETIME")).secretValue || "15m";
-export const getJwtProviderAuthSecret = async () => (await client.getSecret("JWT_PROVIDER_AUTH_SECRET")).secretValue;
-export const getJwtProviderAuthLifetime = async () => (await client.getSecret("JWT_PROVIDER_AUTH_LIFETIME")).secretValue || "15m";
-export const getJwtSignupSecret = async () => (await client.getSecret("JWT_SIGNUP_SECRET")).secretValue;
-export const getJwtServiceTokenSecret = async () => (await client.getSecret("JWT_SERVICE_TOKEN_SECRET")).secretValue;
-export const getMongoURL = async () => (await client.getSecret("MONGO_URL")).secretValue;
-export const getNodeEnv = async () => (await client.getSecret("NODE_ENV")).secretValue || "production";
-export const getVerboseErrorOutput = async () => (await client.getSecret("VERBOSE_ERROR_OUTPUT")).secretValue === "true" && true;
-export const getLokiHost = async () => (await client.getSecret("LOKI_HOST")).secretValue;
-export const getClientIdAzure = async () => (await client.getSecret("CLIENT_ID_AZURE")).secretValue;
-export const getClientIdHeroku = async () => (await client.getSecret("CLIENT_ID_HEROKU")).secretValue;
-export const getClientIdVercel = async () => (await client.getSecret("CLIENT_ID_VERCEL")).secretValue;
-export const getClientIdNetlify = async () => (await client.getSecret("CLIENT_ID_NETLIFY")).secretValue;
-export const getClientIdGitHub = async () => (await client.getSecret("CLIENT_ID_GITHUB")).secretValue;
-export const getClientIdGitLab = async () => (await client.getSecret("CLIENT_ID_GITLAB")).secretValue;
-export const getClientIdBitBucket = async () => (await client.getSecret("CLIENT_ID_BITBUCKET")).secretValue;
-export const getClientIdGCPSecretManager = async () => (await client.getSecret("CLIENT_ID_GCP_SECRET_MANAGER")).secretValue;
-export const getClientSecretAzure = async () => (await client.getSecret("CLIENT_SECRET_AZURE")).secretValue;
-export const getClientSecretHeroku = async () => (await client.getSecret("CLIENT_SECRET_HEROKU")).secretValue;
-export const getClientSecretVercel = async () => (await client.getSecret("CLIENT_SECRET_VERCEL")).secretValue;
-export const getClientSecretNetlify = async () => (await client.getSecret("CLIENT_SECRET_NETLIFY")).secretValue;
-export const getClientSecretGitHub = async () => (await client.getSecret("CLIENT_SECRET_GITHUB")).secretValue;
-export const getClientSecretGitLab = async () => (await client.getSecret("CLIENT_SECRET_GITLAB")).secretValue;
-export const getClientSecretBitBucket = async () => (await client.getSecret("CLIENT_SECRET_BITBUCKET")).secretValue;
-export const getClientSecretGCPSecretManager = async () => (await client.getSecret("CLIENT_SECRET_GCP_SECRET_MANAGER")).secretValue;
-export const getClientSlugVercel = async () => (await client.getSecret("CLIENT_SLUG_VERCEL")).secretValue;
-
-export const getClientIdGoogleLogin = async () => (await client.getSecret("CLIENT_ID_GOOGLE_LOGIN")).secretValue;
-export const getClientSecretGoogleLogin = async () => (await client.getSecret("CLIENT_SECRET_GOOGLE_LOGIN")).secretValue;
-export const getClientIdGitHubLogin = async () => (await client.getSecret("CLIENT_ID_GITHUB_LOGIN")).secretValue;
-export const getClientSecretGitHubLogin = async () => (await client.getSecret("CLIENT_SECRET_GITHUB_LOGIN")).secretValue;
-export const getClientIdGitLabLogin = async () => (await client.getSecret("CLIENT_ID_GITLAB_LOGIN")).secretValue;
-export const getClientSecretGitLabLogin = async () => (await client.getSecret("CLIENT_SECRET_GITLAB_LOGIN")).secretValue;
-export const getUrlGitLabLogin = async () => (await client.getSecret("URL_GITLAB_LOGIN")).secretValue || GITLAB_URL;
-
-export const getPostHogHost = async () => (await client.getSecret("POSTHOG_HOST")).secretValue || "https://app.posthog.com";
-export const getPostHogProjectApiKey = async () => (await client.getSecret("POSTHOG_PROJECT_API_KEY")).secretValue || "phc_nSin8j5q2zdhpFDI1ETmFNUIuTG4DwKVyIigrY10XiE";
-export const getSentryDSN = async () => (await client.getSecret("SENTRY_DSN")).secretValue;
-export const getSiteURL = async () => (await client.getSecret("SITE_URL")).secretValue;
-export const getSmtpHost = async () => (await client.getSecret("SMTP_HOST")).secretValue;
-export const getSmtpSecure = async () => (await client.getSecret("SMTP_SECURE")).secretValue === "true" || false;
-export const getSmtpPort = async () => parseInt((await client.getSecret("SMTP_PORT")).secretValue) || 587;
-export const getSmtpUsername = async () => (await client.getSecret("SMTP_USERNAME")).secretValue;
-export const getSmtpPassword = async () => (await client.getSecret("SMTP_PASSWORD")).secretValue;
-export const getSmtpFromAddress = async () => (await client.getSecret("SMTP_FROM_ADDRESS")).secretValue;
-export const getSmtpFromName = async () => (await client.getSecret("SMTP_FROM_NAME")).secretValue || "Infisical";
-
-export const getSecretScanningWebhookProxy = async () => (await client.getSecret("SECRET_SCANNING_WEBHOOK_PROXY")).secretValue;
-export const getSecretScanningWebhookSecret = async () => (await client.getSecret("SECRET_SCANNING_WEBHOOK_SECRET")).secretValue;
-export const getSecretScanningGitAppId = async () => (await client.getSecret("SECRET_SCANNING_GIT_APP_ID")).secretValue;
-export const getSecretScanningPrivateKey = async () => (await client.getSecret("SECRET_SCANNING_PRIVATE_KEY")).secretValue;
-
-export const getRedisUrl = async () => (await client.getSecret("REDIS_URL")).secretValue;
-
-export const getLicenseKey = async () => {
-  const secretValue = (await client.getSecret("LICENSE_KEY")).secretValue;
-  return secretValue === "" ? undefined : secretValue;
-}
-export const getLicenseServerKey = async () => {
-  const secretValue = (await client.getSecret("LICENSE_SERVER_KEY")).secretValue;
-  return secretValue === "" ? undefined : secretValue;
-}
-export const getLicenseServerUrl = async () => (await client.getSecret("LICENSE_SERVER_URL")).secretValue || "https://portal.infisical.com";
-
-export const getTelemetryEnabled = async () => (await client.getSecret("TELEMETRY_ENABLED")).secretValue !== "false" && true;
-export const getLoopsApiKey = async () => (await client.getSecret("LOOPS_API_KEY")).secretValue;
-export const getSmtpConfigured = async () => (await client.getSecret("SMTP_HOST")).secretValue == "" || (await client.getSecret("SMTP_HOST")).secretValue == undefined ? false : true
-export const getHttpsEnabled = async () => {
-  if ((await getNodeEnv()) != "production") {
-    // no https for anything other than prod
-    return false
-  }
-
-  if ((await client.getSecret("HTTPS_ENABLED")).secretValue == undefined || (await client.getSecret("HTTPS_ENABLED")).secretValue == "") {
-    // default when no value present
-    return true
-  }
-
-  return (await client.getSecret("HTTPS_ENABLED")).secretValue === "true" && true
-}
+export {
+  PORT,
+  EMAIL_TOKEN_LIFETIME,
+  ENCRYPTION_KEY,
+  SALT_ROUNDS,
+  JWT_AUTH_LIFETIME,
+  JWT_AUTH_SECRET,
+  JWT_REFRESH_LIFETIME,
+  JWT_REFRESH_SECRET,
+  JWT_SERVICE_SECRET,
+  JWT_SIGNUP_LIFETIME,
+  JWT_SIGNUP_SECRET,
+  MONGO_URL,
+  NODE_ENV,
+  VERBOSE_ERROR_OUTPUT,
+  LOKI_HOST,
+  CLIENT_ID_HEROKU,
+  CLIENT_ID_VERCEL,
+  CLIENT_ID_NETLIFY,
+  CLIENT_ID_GITHUB,
+  CLIENT_SECRET_HEROKU,
+  CLIENT_SECRET_VERCEL,
+  CLIENT_SECRET_NETLIFY,
+  CLIENT_SECRET_GITHUB,
+  CLIENT_SLUG_VERCEL,
+  POSTHOG_HOST,
+  POSTHOG_PROJECT_API_KEY,
+  SENTRY_DSN,
+  SITE_URL,
+  SMTP_HOST,
+  SMTP_PORT,
+  SMTP_SECURE,
+  SMTP_USERNAME,
+  SMTP_PASSWORD,
+  SMTP_FROM_ADDRESS,
+  SMTP_FROM_NAME,
+  STRIPE_PRODUCT_CARD_AUTH,
+  STRIPE_PRODUCT_PRO,
+  STRIPE_PRODUCT_STARTER,
+  STRIPE_PUBLISHABLE_KEY,
+  STRIPE_SECRET_KEY,
+  STRIPE_WEBHOOK_SECRET,
+  TELEMETRY_ENABLED,
+  LICENSE_KEY
+};

backend/src/config/request.ts

@@ -1,124 +0,0 @@
-import axios from "axios";
-import axiosRetry from "axios-retry";
-import {
-  getLicenseKeyAuthToken,
-  getLicenseServerKeyAuthToken,
-  setLicenseKeyAuthToken,
-  setLicenseServerKeyAuthToken,
-} from "./storage";
-import {
-  getLicenseKey,
-  getLicenseServerKey, 
-  getLicenseServerUrl,
-} from "./index";
-
-// should have JWT to interact with the license server
-export const licenseServerKeyRequest = axios.create();
-export const licenseKeyRequest = axios.create();
-export const standardRequest = axios.create();
-
-// add retry functionality to the axios instance
-axiosRetry(standardRequest, {
-  retries: 3,
-  retryDelay: axiosRetry.exponentialDelay, // exponential back-off delay between retries
-  retryCondition: (error) => {
-    // only retry if the error is a network error or a 5xx server error
-    return axiosRetry.isNetworkError(error) || axiosRetry.isRetryableError(error);
-  },
-});
-
-export const refreshLicenseServerKeyToken = async () => {
-  const licenseServerKey = await getLicenseServerKey();
-  const licenseServerUrl = await getLicenseServerUrl();
-
-  const { data: { token } } = await standardRequest.post(
-    `${licenseServerUrl}/api/auth/v1/license-server-login`, {},
-    {
-      headers: {
-        "X-API-KEY": licenseServerKey,
-      },
-    }
-  );
-
-  setLicenseServerKeyAuthToken(token);
-
-  return token;
-}
-
-export const refreshLicenseKeyToken = async () => {
-  const licenseKey = await getLicenseKey();
-  const licenseServerUrl = await getLicenseServerUrl();
-
-  const { data: { token } } = await standardRequest.post(
-    `${licenseServerUrl}/api/auth/v1/license-login`, {},
-    {
-      headers: {
-        "X-API-KEY": licenseKey,
-      },
-    }
-  );
-
-  setLicenseKeyAuthToken(token);
-
-  return token;
-}
-
-licenseServerKeyRequest.interceptors.request.use((config) => {
-  const token = getLicenseServerKeyAuthToken();
-
-  if (token && config.headers) {
-      // eslint-disable-next-line no-param-reassign
-      config.headers.Authorization = `Bearer ${token}`;
-  }
-  return config;
-}, (err) => {
-  return Promise.reject(err);
-});
-
-licenseServerKeyRequest.interceptors.response.use((response) => {
-  return response
-}, async function (err) {
-  const originalRequest = err.config;
-  
-  if (err.response.status === 401 && !originalRequest._retry) {
-    originalRequest._retry = true;
-    
-    // refresh
-    const token = await refreshLicenseServerKeyToken();            
-    
-    axios.defaults.headers.common["Authorization"] = "Bearer " + token;
-    return licenseServerKeyRequest(originalRequest);
-  }
-
-  return Promise.reject(err);
-});
-
-licenseKeyRequest.interceptors.request.use((config) => {
-  const token = getLicenseKeyAuthToken();
-
-  if (token && config.headers) {
-      // eslint-disable-next-line no-param-reassign
-      config.headers.Authorization = `Bearer ${token}`;
-  }
-  return config;
-}, (err) => {
-  return Promise.reject(err);
-});
-
-licenseKeyRequest.interceptors.response.use((response) => {
-  return response
-}, async function (err) {
-  const originalRequest = err.config;
-  
-  if (err.response.status === 401 && !originalRequest._retry) {
-    originalRequest._retry = true;
-    
-    // refresh
-    const token = await refreshLicenseKeyToken();            
-    
-    axios.defaults.headers.common["Authorization"] = "Bearer " + token;
-    return licenseKeyRequest(originalRequest);
-  }
-
-  return Promise.reject(err);
-});

backend/src/config/storage.ts

@@ -1,30 +0,0 @@
-const MemoryLicenseServerKeyTokenStorage = () => {
-    let authToken: string;
-  
-    return {
-      setToken: (token: string) => {
-        authToken = token;
-      },
-      getToken: () => authToken,
-    };
-};
-
-const MemoryLicenseKeyTokenStorage = () => {
-    let authToken: string;
-  
-    return {
-      setToken: (token: string) => {
-        authToken = token;
-      },
-      getToken: () => authToken,
-    };
-};
-
-const licenseServerTokenStorage = MemoryLicenseServerKeyTokenStorage();
-const licenseTokenStorage = MemoryLicenseKeyTokenStorage();
-
-export const getLicenseServerKeyAuthToken = licenseServerTokenStorage.getToken;
-export const setLicenseServerKeyAuthToken = licenseServerTokenStorage.setToken;
-
-export const getLicenseKeyAuthToken = licenseTokenStorage.getToken;
-export const setLicenseKeyAuthToken = licenseTokenStorage.setToken;

backend/src/controllers/v1/authController.ts

@@ -1,32 +1,26 @@
-import { Request, Response } from "express";
-import jwt from "jsonwebtoken";
-import * as bigintConversion from "bigint-conversion";
-// eslint-disable-next-line @typescript-eslint/no-var-requires
-const jsrp = require("jsrp");
-import { LoginSRPDetail, TokenVersion, User } from "../../models";
-import { clearTokens, createToken, issueAuthTokens } from "../../helpers/auth";
-import { checkUserDevice } from "../../helpers/user";
-import { ACTION_LOGIN, ACTION_LOGOUT } from "../../variables";
-import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
-import { EELogService } from "../../ee/services";
-import { getUserAgentType } from "../../utils/posthog";
+/* eslint-disable @typescript-eslint/no-var-requires */
+import { Request, Response } from 'express';
+import jwt from 'jsonwebtoken';
+import * as Sentry from '@sentry/node';
+import * as bigintConversion from 'bigint-conversion';
+const jsrp = require('jsrp');
+import { User } from '../../models';
+import { createToken, issueTokens, clearTokens } from '../../helpers/auth';
 import {
-  getHttpsEnabled,
-  getJwtAuthLifetime,
-  getJwtAuthSecret,
-  getJwtRefreshSecret
-} from "../../config";
-import { ActorType } from "../../ee/models";
-import { validateRequest } from "../../helpers/validation";
-import * as reqValidator from "../../validation/auth";
+  NODE_ENV,
+  JWT_AUTH_LIFETIME,
+  JWT_AUTH_SECRET,
+  JWT_REFRESH_SECRET
+} from '../../config';
 
-declare module "jsonwebtoken" {
+declare module 'jsonwebtoken' {
   export interface UserIDJwtPayload extends jwt.JwtPayload {
     userId: string;
-    refreshVersion?: number;
   }
 }
 
+const clientPublicKeys: any = {};
+
 /**
  * Log in user step 1: Return [salt] and [serverPublicKey] as part of step 1 of SRP protocol
  * @param req
@@ -34,42 +28,45 @@ declare module "jsonwebtoken" {
  * @returns
  */
 export const login1 = async (req: Request, res: Response) => {
-  const {
-    body: { email, clientPublicKey }
-  } = await validateRequest(reqValidator.Login1V1, req);
+  try {
+    const {
+      email,
+      clientPublicKey
+    }: { email: string; clientPublicKey: string } = req.body;
 
-  const user = await User.findOne({
-    email
-  }).select("+salt +verifier");
+    const user = await User.findOne({
+      email
+    }).select('+salt +verifier');
 
-  if (!user) throw new Error("Failed to find user");
+    if (!user) throw new Error('Failed to find user');
 
-  const server = new jsrp.server();
-  server.init(
-    {
-      salt: user.salt,
-      verifier: user.verifier
-    },
-    async () => {
-      // generate server-side public key
-      const serverPublicKey = server.getPublicKey();
-
-      await LoginSRPDetail.findOneAndReplace(
-        { email: email },
-        {
-          email: email,
-          clientPublicKey: clientPublicKey,
+    const server = new jsrp.server();
+    server.init(
+      {
+        salt: user.salt,
+        verifier: user.verifier
+      },
+      () => {
+        // generate server-side public key
+        const serverPublicKey = server.getPublicKey();
+        clientPublicKeys[email] = {
+          clientPublicKey,
           serverBInt: bigintConversion.bigintToBuf(server.bInt)
-        },
-        { upsert: true, returnNewDocument: false }
-      );
+        };
 
-      return res.status(200).send({
-        serverPublicKey,
-        salt: user.salt
-      });
-    }
-  );
+        return res.status(200).send({
+          serverPublicKey,
+          salt: user.salt
+        });
+      }
+    );
+  } catch (err) {
+    Sentry.setUser(null);
+    Sentry.captureException(err);
+    return res.status(400).send({
+      message: 'Failed to start authentication process'
+    });
+  }
 };
 
 /**
@@ -80,88 +77,59 @@ export const login1 = async (req: Request, res: Response) => {
  * @returns
  */
 export const login2 = async (req: Request, res: Response) => {
-  const {
-    body: { email, clientProof }
-  } = await validateRequest(reqValidator.Login2V1, req);
+  try {
+    const { email, clientProof } = req.body;
+    const user = await User.findOne({
+      email
+    }).select('+salt +verifier +publicKey +encryptedPrivateKey +iv +tag');
 
-  const user = await User.findOne({
-    email
-  }).select("+salt +verifier +publicKey +encryptedPrivateKey +iv +tag");
+    if (!user) throw new Error('Failed to find user');
 
-  if (!user) throw new Error("Failed to find user");
+    const server = new jsrp.server();
+    server.init(
+      {
+        salt: user.salt,
+        verifier: user.verifier,
+        b: clientPublicKeys[email].serverBInt
+      },
+      async () => {
+        server.setClientPublicKey(clientPublicKeys[email].clientPublicKey);
 
-  const loginSRPDetailFromDB = await LoginSRPDetail.findOneAndDelete({ email: email });
+        // compare server and client shared keys
+        if (server.checkClientProof(clientProof)) {
+          // issue tokens
+          const tokens = await issueTokens({ userId: user._id.toString() });
 
-  if (!loginSRPDetailFromDB) {
-    return BadRequestError(
-      Error(
-        "It looks like some details from the first login are not found. Please try login one again"
-      )
-    );
-  }
+          // store (refresh) token in httpOnly cookie
+          res.cookie('jid', tokens.refreshToken, {
+            httpOnly: true,
+            path: '/',
+            sameSite: 'strict',
+            secure: NODE_ENV === 'production' ? true : false
+          });
 
-  const server = new jsrp.server();
-  server.init(
-    {
-      salt: user.salt,
-      verifier: user.verifier,
-      b: loginSRPDetailFromDB.serverBInt
-    },
-    async () => {
-      server.setClientPublicKey(loginSRPDetailFromDB.clientPublicKey);
+          // return (access) token in response
+          return res.status(200).send({
+            token: tokens.token,
+            publicKey: user.publicKey,
+            encryptedPrivateKey: user.encryptedPrivateKey,
+            iv: user.iv,
+            tag: user.tag
+          });
+        }
 
-      // compare server and client shared keys
-      if (server.checkClientProof(clientProof)) {
-        // issue tokens
-
-        await checkUserDevice({
-          user,
-          ip: req.realIP,
-          userAgent: req.headers["user-agent"] ?? ""
-        });
-
-        const tokens = await issueAuthTokens({
-          userId: user._id,
-          ip: req.realIP,
-          userAgent: req.headers["user-agent"] ?? ""
-        });
-
-        // store (refresh) token in httpOnly cookie
-        res.cookie("jid", tokens.refreshToken, {
-          httpOnly: true,
-          path: "/",
-          sameSite: "strict",
-          secure: await getHttpsEnabled()
-        });
-
-        const loginAction = await EELogService.createAction({
-          name: ACTION_LOGIN,
-          userId: user._id
-        });
-
-        loginAction &&
-          (await EELogService.createLog({
-            userId: user._id,
-            actions: [loginAction],
-            channel: getUserAgentType(req.headers["user-agent"]),
-            ipAddress: req.realIP
-          }));
-
-        // return (access) token in response
-        return res.status(200).send({
-          token: tokens.token,
-          publicKey: user.publicKey,
-          encryptedPrivateKey: user.encryptedPrivateKey,
-          iv: user.iv,
-          tag: user.tag
+        return res.status(400).send({
+          message: 'Failed to authenticate. Try again?'
         });
       }
-
-      return res.status(400).send({
-        message: "Failed to authenticate. Try again?"
-      });
-    }
-  );
+    );
+  } catch (err) {
+    Sentry.setUser(null);
+    Sentry.captureException(err);
+    return res.status(400).send({
+      message: 'Failed to authenticate. Try again?'
+    });
+  }
 };
 
 /**
@@ -171,51 +139,28 @@ export const login2 = async (req: Request, res: Response) => {
  * @returns
  */
 export const logout = async (req: Request, res: Response) => {
-  if (req.authData.actor.type === ActorType.USER && req.authData.tokenVersionId) {
-    await clearTokens(req.authData.tokenVersionId);
+  try {
+    await clearTokens({
+      userId: req.user._id.toString()
+    });
+
+    // clear httpOnly cookie
+    res.cookie('jid', '', {
+      httpOnly: true,
+      path: '/',
+      sameSite: 'strict',
+      secure: NODE_ENV === 'production' ? true : false
+    });
+  } catch (err) {
+    Sentry.setUser({ email: req.user.email });
+    Sentry.captureException(err);
+    return res.status(400).send({
+      message: 'Failed to logout'
+    });
   }
 
-  // clear httpOnly cookie
-  res.cookie("jid", "", {
-    httpOnly: true,
-    path: "/",
-    sameSite: "strict",
-    secure: (await getHttpsEnabled()) as boolean
-  });
-
-  const logoutAction = await EELogService.createAction({
-    name: ACTION_LOGOUT,
-    userId: req.user._id
-  });
-
-  logoutAction &&
-    (await EELogService.createLog({
-      userId: req.user._id,
-      actions: [logoutAction],
-      channel: getUserAgentType(req.headers["user-agent"]),
-      ipAddress: req.realIP
-    }));
-
   return res.status(200).send({
-    message: "Successfully logged out."
-  });
-};
-
-export const revokeAllSessions = async (req: Request, res: Response) => {
-  await TokenVersion.updateMany(
-    {
-      user: req.user._id
-    },
-    {
-      $inc: {
-        refreshVersion: 1,
-        accessVersion: 1
-      }
-    }
-  );
-
-  return res.status(200).send({
-    message: "Successfully revoked all sessions."
+    message: 'Successfully logged out.'
   });
 };
 
@@ -227,60 +172,52 @@ export const revokeAllSessions = async (req: Request, res: Response) => {
  */
 export const checkAuth = async (req: Request, res: Response) => {
   return res.status(200).send({
-    message: "Authenticated"
+    message: 'Authenticated'
   });
-};
+}
 
 /**
- * Return new JWT access token by first validating the refresh token
+ * Return new token by redeeming refresh token
  * @param req
  * @param res
  * @returns
  */
 export const getNewToken = async (req: Request, res: Response) => {
-  const refreshToken = req.cookies.jid;
+  try {
+    const refreshToken = req.cookies.jid;
 
-  if (!refreshToken)
-    throw BadRequestError({
-      message: "Failed to find refresh token in request cookies"
+    if (!refreshToken) {
+      throw new Error('Failed to find token in request cookies');
+    }
+
+    const decodedToken = <jwt.UserIDJwtPayload>(
+      jwt.verify(refreshToken, JWT_REFRESH_SECRET)
+    );
+
+    const user = await User.findOne({
+      _id: decodedToken.userId
+    }).select('+publicKey');
+
+    if (!user) throw new Error('Failed to authenticate unfound user');
+    if (!user?.publicKey)
+      throw new Error('Failed to authenticate not fully set up account');
+
+    const token = createToken({
+      payload: {
+        userId: decodedToken.userId
+      },
+      expiresIn: JWT_AUTH_LIFETIME,
+      secret: JWT_AUTH_SECRET
     });
 
-  const decodedToken = <jwt.UserIDJwtPayload>jwt.verify(refreshToken, await getJwtRefreshSecret());
-
-  const user = await User.findOne({
-    _id: decodedToken.userId
-  }).select("+publicKey +refreshVersion +accessVersion");
-
-  if (!user) throw new Error("Failed to authenticate unfound user");
-  if (!user?.publicKey) throw new Error("Failed to authenticate not fully set up account");
-
-  const tokenVersion = await TokenVersion.findById(decodedToken.tokenVersionId);
-
-  if (!tokenVersion)
-    throw UnauthorizedRequestError({
-      message: "Failed to validate refresh token"
+    return res.status(200).send({
+      token
     });
-
-  if (decodedToken.refreshVersion !== tokenVersion.refreshVersion)
-    throw BadRequestError({
-      message: "Failed to validate refresh token"
+  } catch (err) {
+    Sentry.setUser(null);
+    Sentry.captureException(err);
+    return res.status(400).send({
+      message: 'Invalid request'
     });
-
-  const token = createToken({
-    payload: {
-      userId: decodedToken.userId,
-      tokenVersionId: tokenVersion._id.toString(),
-      accessVersion: tokenVersion.refreshVersion
-    },
-    expiresIn: await getJwtAuthLifetime(),
-    secret: await getJwtAuthSecret()
-  });
-
-  return res.status(200).send({
-    token
-  });
-};
-
-export const handleAuthProviderCallback = (req: Request, res: Response) => {
-  res.redirect(`/login/provider/success?token=${encodeURIComponent(req.providerAuthToken)}`);
+  }
 };

backend/src/controllers/v1/botController.ts

@@ -1,20 +1,11 @@
-import { Request, Response } from "express";
-import { Types } from "mongoose";
-import { Bot, BotKey } from "../../models";
-import { createBot } from "../../helpers/bot";
-import { validateRequest } from "../../helpers/validation";
-import * as reqValidator from "../../validation/bot";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSub,
-  getUserProjectPermissions
-} from "../../ee/services/ProjectRoleService";
-import { ForbiddenError } from "@casl/ability";
-import { BadRequestError } from "../../utils/errors";
+import { Request, Response } from 'express';
+import * as Sentry from '@sentry/node';
+import { Bot, BotKey } from '../../models';
+import { createBot } from '../../helpers/bot';
 
 interface BotKey {
-  encryptedKey: string;
-  nonce: string;
+    encryptedKey: string;
+    nonce: string;
 }
 
 /**
@@ -25,31 +16,33 @@ interface BotKey {
  * @returns
  */
 export const getBotByWorkspaceId = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId }
-  } = await validateRequest(reqValidator.GetBotByWorkspaceIdV1, req);
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Read,
-    ProjectPermissionSub.Integrations
-  );
+    let bot;
+	try {
+        const { workspaceId } = req.params;
 
-  let bot = await Bot.findOne({
-    workspace: workspaceId
-  });
-
-  if (!bot) {
-    // case: bot doesn't exist for workspace with id [workspaceId]
-    // -> create a new bot and return it
-    bot = await createBot({
-      name: "Infisical Bot",
-      workspaceId: new Types.ObjectId(workspaceId)
+        bot = await Bot.findOne({
+            workspace: workspaceId
+        });
+        
+        if (!bot) {
+            // case: bot doesn't exist for workspace with id [workspaceId]
+            // -> create a new bot and return it
+            bot = await createBot({
+                name: 'Infisical Bot',
+                workspaceId
+            });
+        }
+	} catch (err) {
+        Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+        return res.status(400).send({
+			message: 'Failed to get bot for workspace'
+		});
+	}
+    
+    return res.status(200).send({
+        bot
     });
-  }
-
-  return res.status(200).send({
-    bot
-  });
 };
 
 /**
@@ -59,69 +52,56 @@ export const getBotByWorkspaceId = async (req: Request, res: Response) => {
  * @returns
  */
 export const setBotActiveState = async (req: Request, res: Response) => {
-  const {
-    body: { botKey, isActive },
-    params: { botId }
-  } = await validateRequest(reqValidator.SetBotActiveStateV1, req);
+    let bot;
+	try {
+        const { isActive, botKey }: { isActive: boolean, botKey: BotKey } = req.body;
+        
+        if (isActive) {
+            // bot state set to active -> share workspace key with bot
+            if (!botKey?.encryptedKey || !botKey?.nonce) {
+                return res.status(400).send({
+                    message: 'Failed to set bot state to active - missing bot key'
+                });
+            }
+            
+            await BotKey.findOneAndUpdate({
+                workspace: req.bot.workspace
+            }, {
+                encryptedKey: botKey.encryptedKey,
+                nonce: botKey.nonce,
+                sender: req.user._id,
+                bot: req.bot._id,
+                workspace: req.bot.workspace
+            }, {
+                upsert: true,
+                new: true
+            });
+        } else {
+            // case: bot state set to inactive -> delete bot's workspace key
+            await BotKey.deleteOne({
+                bot: req.bot._id
+            });
+        }
 
-  const bot = await Bot.findById(botId);
-  if (!bot) {
-    throw BadRequestError({ message: "Bot not found" });
-  }
-  const userId = req.user._id;
-
-  const { permission } = await getUserProjectPermissions(userId, bot.workspace.toString());
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Edit,
-    ProjectPermissionSub.Integrations
-  );
-
-  if (isActive) {
-    // bot state set to active -> share workspace key with bot
-    if (!botKey?.encryptedKey || !botKey?.nonce) {
-      return res.status(400).send({
-        message: "Failed to set bot state to active - missing bot key"
-      });
-    }
-
-    await BotKey.findOneAndUpdate(
-      {
-        workspace: bot.workspace
-      },
-      {
-        encryptedKey: botKey.encryptedKey,
-        nonce: botKey.nonce,
-        sender: userId,
-        bot: bot._id,
-        workspace: bot.workspace
-      },
-      {
-        upsert: true,
-        new: true
-      }
-    );
-  } else {
-    // case: bot state set to inactive -> delete bot's workspace key
-    await BotKey.deleteOne({
-      bot: bot._id
+        bot = await Bot.findOneAndUpdate({
+            _id: req.bot._id
+        }, {
+            isActive
+        }, {
+            new: true
+        });
+        
+        if (!bot) throw new Error('Failed to update bot active state');
+        
+	} catch (err) {
+        Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+        return res.status(400).send({
+			message: 'Failed to update bot active state'
+		});
+	}
+    
+    return res.status(200).send({
+        bot
     });
-  }
-
-  const updatedBot = await Bot.findOneAndUpdate(
-    {
-      _id: bot._id
-    },
-    {
-      isActive
-    },
-    {
-      new: true
-    }
-  );
-
-  if (!updatedBot) throw new Error("Failed to update bot active state");
-
-  return res.status(200).send({
-    bot
-  });
 };

backend/src/controllers/v1/index.ts

@@ -1,38 +1,35 @@
-import * as authController from "./authController";
-import * as botController from "./botController";
-import * as integrationAuthController from "./integrationAuthController";
-import * as integrationController from "./integrationController";
-import * as keyController from "./keyController";
-import * as membershipController from "./membershipController";
-import * as membershipOrgController from "./membershipOrgController";
-import * as organizationController from "./organizationController";
-import * as passwordController from "./passwordController";
-import * as secretController from "./secretController";
-import * as serviceTokenController from "./serviceTokenController";
-import * as signupController from "./signupController";
-import * as userActionController from "./userActionController";
-import * as userController from "./userController";
-import * as workspaceController from "./workspaceController";
-import * as secretScanningController from "./secretScanningController";
-import * as webhookController from "./webhookController";
-import * as secretImpsController from "./secretImpsController";
+import * as authController from './authController';
+import * as botController from './botController';
+import * as integrationAuthController from './integrationAuthController';
+import * as integrationController from './integrationController';
+import * as keyController from './keyController';
+import * as membershipController from './membershipController';
+import * as membershipOrgController from './membershipOrgController';
+import * as organizationController from './organizationController';
+import * as passwordController from './passwordController';
+import * as secretController from './secretController';
+import * as serviceTokenController from './serviceTokenController';
+import * as signupController from './signupController';
+import * as stripeController from './stripeController';
+import * as userActionController from './userActionController';
+import * as userController from './userController';
+import * as workspaceController from './workspaceController';
+
 export {
-  authController,
-  botController,
-  integrationAuthController,
-  integrationController,
-  keyController,
-  membershipController,
-  membershipOrgController,
-  organizationController,
-  passwordController,
-  secretController,
-  serviceTokenController,
-  signupController,
-  userActionController,
-  userController,
-  workspaceController,
-  secretScanningController,
-  webhookController,
-  secretImpsController
+	authController,
+	botController,
+	integrationAuthController,
+	integrationController,
+	keyController,
+	membershipController,
+	membershipOrgController,
+	organizationController,
+	passwordController,
+	secretController,
+	serviceTokenController,
+	signupController,
+	stripeController,
+	userActionController,
+	userController,
+	workspaceController
 };

backend/src/controllers/v1/integrationController.ts

@@ -1,142 +1,44 @@
-import { Request, Response } from "express";
-import { Types } from "mongoose";
-import { Folder, IWorkspace, Integration, IntegrationAuth } from "../../models";
-import { EventService } from "../../services";
-import { eventStartIntegration } from "../../events";
-import { getFolderByPath } from "../../services/FolderService";
-import { BadRequestError } from "../../utils/errors";
-import { EEAuditLogService } from "../../ee/services";
-import { EventType } from "../../ee/models";
-import { syncSecretsToActiveIntegrationsQueue } from "../../queues/integrations/syncSecretsToThirdPartyServices";
-import { validateRequest } from "../../helpers/validation";
-import * as reqValidator from "../../validation/integration";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSub,
-  getUserProjectPermissions
-} from "../../ee/services/ProjectRoleService";
-import { ForbiddenError } from "@casl/ability";
+import { Request, Response } from 'express';
+import * as Sentry from '@sentry/node';
+import { 
+	Integration, 
+	Workspace,
+	Bot, 
+	BotKey 
+} from '../../models';
+import { EventService } from '../../services';
+import { eventPushSecrets } from '../../events';
 
 /**
  * Create/initialize an (empty) integration for integration authorization
- * @param req
- * @param res
- * @returns
+ * @param req 
+ * @param res 
+ * @returns 
  */
 export const createIntegration = async (req: Request, res: Response) => {
-  const {
-    body: {
-      isActive,
-      sourceEnvironment,
-      secretPath,
-      app,
-      path,
-      appId,
-      owner,
-      region,
-      scope,
-      targetService,
-      targetServiceId,
-      integrationAuthId,
-      targetEnvironment,
-      targetEnvironmentId,
-      metadata
-    }
-  } = await validateRequest(reqValidator.CreateIntegrationV1, req);
-  
-  const integrationAuth = await IntegrationAuth.findById(integrationAuthId)
-    .populate<{ workspace: IWorkspace }>("workspace")
-    .select(
-      "+refreshCiphertext +refreshIV +refreshTag +accessCiphertext +accessIV +accessTag +accessExpiresAt"
-    );
+	let integration;
+	try {
+		// initialize new integration after saving integration access token
+        integration = await new Integration({
+            workspace: req.integrationAuth.workspace._id,
+            isActive: false,
+            app: null,
+            environment: req.integrationAuth.workspace?.environments[0].slug,
+            integration: req.integrationAuth.integration,
+            integrationAuth: req.integrationAuth._id
+        }).save();
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to create integration'
+		});
+	}
 
-  if (!integrationAuth) throw BadRequestError({ message: "Integration auth not found" });
-
-  const { permission } = await getUserProjectPermissions(
-    req.user._id,
-    integrationAuth.workspace._id.toString()
-  );
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Create,
-    ProjectPermissionSub.Integrations
-  );
-
-  const folders = await Folder.findOne({
-    workspace: integrationAuth.workspace._id,
-    environment: sourceEnvironment
-  });
-
-  if (folders) {
-    const folder = getFolderByPath(folders.nodes, secretPath);
-    if (!folder) {
-      throw BadRequestError({
-        message: "Folder path doesn't exist"
-      });
-    }
-  }
-
-  // TODO: validate [sourceEnvironment] and [targetEnvironment]
-
-  // initialize new integration after saving integration access token
-  const integration = await new Integration({
-    workspace: integrationAuth.workspace._id,
-    environment: sourceEnvironment,
-    isActive,
-    app,
-    appId,
-    targetEnvironment,
-    targetEnvironmentId,
-    targetService,
-    targetServiceId,
-    owner,
-    path,
-    region,
-    scope,
-    secretPath,
-    integration: integrationAuth.integration,
-    integrationAuth: new Types.ObjectId(integrationAuthId),
-    metadata
-  }).save();
-
-  if (integration) {
-    // trigger event - push secrets
-    EventService.handleEvent({
-      event: eventStartIntegration({
-        workspaceId: integration.workspace,
-        environment: sourceEnvironment
-      })
-    });
-  }
-
-  await EEAuditLogService.createAuditLog(
-    req.authData,
-    {
-      type: EventType.CREATE_INTEGRATION,
-      metadata: {
-        integrationId: integration._id.toString(),
-        integration: integration.integration,
-        environment: integration.environment,
-        secretPath,
-        url: integration.url,
-        app: integration.app,
-        appId: integration.appId,
-        targetEnvironment: integration.targetEnvironment,
-        targetEnvironmentId: integration.targetEnvironmentId,
-        targetService: integration.targetService,
-        targetServiceId: integration.targetServiceId,
-        path: integration.path,
-        region: integration.region
-      }
-    },
-    {
-      workspaceId: integration.workspace
-    }
-  );
-
-  return res.status(200).send({
-    integration
-  });
-};
+	return res.status(200).send({
+		integration
+	});
+}
 
 /**
  * Change environment or name of integration with id [integrationId]
@@ -145,156 +47,85 @@ export const createIntegration = async (req: Request, res: Response) => {
  * @returns
  */
 export const updateIntegration = async (req: Request, res: Response) => {
-  // TODO: add integration-specific validation to ensure that each
-  // integration has the correct fields populated in [Integration]
+	let integration;
+	
+	// TODO: add integration-specific validation to ensure that each
+	// integration has the correct fields populated in [Integration]
+	
+	try {
+		const { 
+			environment, 
+			isActive, 
+			app, 
+			appId,
+			targetEnvironment,
+			owner, // github-specific integration param
+		} = req.body;
+		
+		integration = await Integration.findOneAndUpdate(
+			{
+				_id: req.integration._id
+			},
+			{
+				environment,
+				isActive,
+				app,
+				appId,
+				targetEnvironment,
+				owner
+			},
+			{
+				new: true
+			}
+		);
+		
+		if (integration) {
+			// trigger event - push secrets
+			EventService.handleEvent({
+				event: eventPushSecrets({
+					workspaceId: integration.workspace.toString()
+				})
+			});
+		}
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to update integration'
+		});
+	}
 
-  const {
-    body: {
-      environment,
-      isActive,
-      app,
-      appId,
-      targetEnvironment,
-      owner, // github-specific integration param
-      secretPath
-    },
-    params: { integrationId }
-  } = await validateRequest(reqValidator.UpdateIntegrationV1, req);
-
-  const integration = await Integration.findById(integrationId);
-  if (!integration) throw BadRequestError({ message: "Integration not found" });
-
-  const { permission } = await getUserProjectPermissions(
-    req.user._id,
-    integration.workspace.toString()
-  );
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Edit,
-    ProjectPermissionSub.Integrations
-  );
-
-  const folders = await Folder.findOne({
-    workspace: integration.workspace,
-    environment
-  });
-
-  if (folders) {
-    const folder = getFolderByPath(folders.nodes, secretPath);
-    if (!folder) {
-      throw BadRequestError({
-        message: "Path for service token does not exist"
-      });
-    }
-  }
-
-  const updatedIntegration = await Integration.findOneAndUpdate(
-    {
-      _id: integration._id
-    },
-    {
-      environment,
-      isActive,
-      app,
-      appId,
-      targetEnvironment,
-      owner,
-      secretPath
-    },
-    {
-      new: true
-    }
-  );
-
-  if (updatedIntegration) {
-    // trigger event - push secrets
-    EventService.handleEvent({
-      event: eventStartIntegration({
-        workspaceId: updatedIntegration.workspace,
-        environment
-      })
-    });
-  }
-
-  return res.status(200).send({
-    integration: updatedIntegration
-  });
+	return res.status(200).send({
+		integration
+	});
 };
 
 /**
- * Delete integration with id [integrationId]
+ * Delete integration with id [integrationId] and deactivate bot if there are
+ * no integrations left
  * @param req
  * @param res
  * @returns
  */
 export const deleteIntegration = async (req: Request, res: Response) => {
-  const {
-    params: { integrationId }
-  } = await validateRequest(reqValidator.DeleteIntegrationV1, req);
+	let integration;
+	try {
+		const { integrationId } = req.params;
 
-  const integration = await Integration.findById(integrationId);
-  if (!integration) throw BadRequestError({ message: "Integration not found" });
-
-  const { permission } = await getUserProjectPermissions(
-    req.user._id,
-    integration.workspace.toString()
-  );
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Delete,
-    ProjectPermissionSub.Integrations
-  );
-
-  const deletedIntegration = await Integration.findOneAndDelete({
-    _id: integrationId
-  });
-
-  if (!deletedIntegration) throw new Error("Failed to find integration");
-
-  await EEAuditLogService.createAuditLog(
-    req.authData,
-    {
-      type: EventType.DELETE_INTEGRATION,
-      metadata: {
-        integrationId: integration._id.toString(),
-        integration: integration.integration,
-        environment: integration.environment,
-        secretPath: integration.secretPath,
-        url: integration.url,
-        app: integration.app,
-        appId: integration.appId,
-        targetEnvironment: integration.targetEnvironment,
-        targetEnvironmentId: integration.targetEnvironmentId,
-        targetService: integration.targetService,
-        targetServiceId: integration.targetServiceId,
-        path: integration.path,
-        region: integration.region
-      }
-    },
-    {
-      workspaceId: integration.workspace
-    }
-  );
-
-  return res.status(200).send({
-    integration
-  });
-};
-
-// Will trigger sync for all integrations within the given env and workspace id
-export const manualSync = async (req: Request, res: Response) => {
-  const {
-    body: { workspaceId, environment }
-  } = await validateRequest(reqValidator.ManualSyncV1, req);
-
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Edit,
-    ProjectPermissionSub.Integrations
-  );
-
-  syncSecretsToActiveIntegrationsQueue({
-    workspaceId,
-    environment
-  });
-
-  res.status(200).send();
+		integration = await Integration.findOneAndDelete({
+			_id: integrationId
+		});
+		
+		if (!integration) throw new Error('Failed to find integration');
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to delete integration'
+		});
+	}
+	
+	return res.status(200).send({
+		integration
+	});
 };

backend/src/controllers/v1/keyController.ts

@@ -1,17 +1,7 @@
-import { Types } from "mongoose";
-import { Request, Response } from "express";
-import { Key } from "../../models";
-import { findMembership } from "../../helpers/membership";
-import { EventType } from "../../ee/models";
-import { EEAuditLogService } from "../../ee/services";
-import { validateRequest } from "../../helpers/validation";
-import * as reqValidator from "../../validation/key";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSub,
-  getUserProjectPermissions
-} from "../../ee/services/ProjectRoleService";
-import { ForbiddenError } from "@casl/ability";
+import { Request, Response } from 'express';
+import * as Sentry from '@sentry/node';
+import { Key } from '../../models';
+import { findMembership } from '../../helpers/membership';
 
 /**
  * Add (encrypted) copy of workspace key for workspace with id [workspaceId] for user with
@@ -21,38 +11,38 @@ import { ForbiddenError } from "@casl/ability";
  * @returns
  */
 export const uploadKey = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId },
-    body: { key }
-  } = await validateRequest(reqValidator.UploadKeyV1, req);
+	try {
+		const { workspaceId } = req.params;
+		const { key } = req.body;
 
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Edit,
-    ProjectPermissionSub.Member
-  );
+		// validate membership of receiver
+		const receiverMembership = await findMembership({
+			user: key.userId,
+			workspace: workspaceId
+		});
 
-  // validate membership of receiver
-  const receiverMembership = await findMembership({
-    user: key.userId,
-    workspace: workspaceId
-  });
+		if (!receiverMembership) {
+			throw new Error('Failed receiver membership validation for workspace');
+		}
 
-  if (!receiverMembership) {
-    throw new Error("Failed receiver membership validation for workspace");
-  }
+		await new Key({
+			encryptedKey: key.encryptedKey,
+			nonce: key.nonce,
+			sender: req.user._id,
+			receiver: key.userId,
+			workspace: workspaceId
+		}).save();
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to upload key to workspace'
+		});
+	}
 
-  await new Key({
-    encryptedKey: key.encryptedKey,
-    nonce: key.nonce,
-    sender: req.user._id,
-    receiver: key.userId,
-    workspace: workspaceId
-  }).save();
-
-  return res.status(200).send({
-    message: "Successfully uploaded key to workspace"
-  });
+	return res.status(200).send({
+		message: 'Successfully uploaded key to workspace'
+	});
 };
 
 /**
@@ -62,36 +52,31 @@ export const uploadKey = async (req: Request, res: Response) => {
  * @returns
  */
 export const getLatestKey = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId }
-  } = await validateRequest(reqValidator.GetLatestKeyV1, req);
+	let latestKey;
+	try {
+		const { workspaceId } = req.params;
 
-  // get latest key
-  const latestKey = await Key.find({
-    workspace: workspaceId,
-    receiver: req.user._id
-  })
-    .sort({ createdAt: -1 })
-    .limit(1)
-    .populate("sender", "+publicKey");
+		// get latest key
+		latestKey = await Key.find({
+			workspace: workspaceId,
+			receiver: req.user._id
+		})
+			.sort({ createdAt: -1 })
+			.limit(1)
+			.populate('sender', '+publicKey');
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get latest key'
+		});
+	}
 
-  const resObj: any = {};
+	const resObj: any = {};
 
-  if (latestKey.length > 0) {
-    resObj["latestKey"] = latestKey[0];
-    await EEAuditLogService.createAuditLog(
-      req.authData,
-      {
-        type: EventType.GET_WORKSPACE_KEY,
-        metadata: {
-          keyId: latestKey[0]._id.toString()
-        }
-      },
-      {
-        workspaceId: new Types.ObjectId(workspaceId)
-      }
-    );
-  }
+	if (latestKey.length > 0) {
+		resObj['latestKey'] = latestKey[0];
+	}
 
-  return res.status(200).send(resObj);
-};
+	return res.status(200).send(resObj);
+};

backend/src/controllers/v1/membershipController.ts

@@ -1,22 +1,13 @@
-import { Request, Response } from "express";
-import { Types } from "mongoose";
-import { IUser, Key, Membership, MembershipOrg, User, Workspace } from "../../models";
-import { EventType, Role } from "../../ee/models";
-import { deleteMembership as deleteMember, findMembership } from "../../helpers/membership";
-import { sendMail } from "../../helpers/nodemailer";
-import { ACCEPTED, ADMIN, CUSTOM, MEMBER, VIEWER } from "../../variables";
-import { getSiteURL } from "../../config";
-import { EEAuditLogService } from "../../ee/services";
-import { validateRequest } from "../../helpers/validation";
-import * as reqValidator from "../../validation/membership";
+import { Request, Response } from 'express';
+import * as Sentry from '@sentry/node';
+import { Membership, MembershipOrg, User, Key, IMembership, Workspace } from '../../models';
 import {
-  ProjectPermissionActions,
-  ProjectPermissionSub,
-  getUserProjectPermissions
-} from "../../ee/services/ProjectRoleService";
-import { ForbiddenError } from "@casl/ability";
-import { BadRequestError } from "../../utils/errors";
-import { InviteUserToWorkspaceV1 } from "../../validation/workspace";
+	findMembership,
+	deleteMembership as deleteMember
+} from '../../helpers/membership';
+import { sendMail } from '../../helpers/nodemailer';
+import { SITE_URL } from '../../config';
+import { ADMIN, MEMBER, ACCEPTED } from '../../variables';
 
 /**
  * Check that user is a member of workspace with id [workspaceId]
@@ -25,23 +16,29 @@ import { InviteUserToWorkspaceV1 } from "../../validation/workspace";
  * @returns
  */
 export const validateMembership = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId }
-  } = await validateRequest(reqValidator.ValidateMembershipV1, req);
+	try {
+		const { workspaceId } = req.params;
 
-  // validate membership
-  const membership = await findMembership({
-    user: req.user._id,
-    workspace: workspaceId
-  });
+		// validate membership
+		const membership = await findMembership({
+			user: req.user._id,
+			workspace: workspaceId
+		});
 
-  if (!membership) {
-    throw new Error("Failed to validate membership");
-  }
+		if (!membership) {
+			throw new Error('Failed to validate membership');
+		}
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed workspace connection check'
+		});
+	}
 
-  return res.status(200).send({
-    message: "Workspace membership confirmed"
-  });
+	return res.status(200).send({
+		message: 'Workspace membership confirmed'
+	});
 };
 
 /**
@@ -51,50 +48,52 @@ export const validateMembership = async (req: Request, res: Response) => {
  * @returns
  */
 export const deleteMembership = async (req: Request, res: Response) => {
-  const {
-    params: { membershipId }
-  } = await validateRequest(reqValidator.DeleteMembershipV1, req);
+	let deletedMembership;
+	try {
+		const { membershipId } = req.params;
 
-  // check if membership to delete exists
-  const membershipToDelete = await Membership.findOne({
-    _id: membershipId
-  }).populate<{ user: IUser }>("user");
+		// check if membership to delete exists
+		const membershipToDelete = await Membership.findOne({
+			_id: membershipId
+		}).populate('user');
 
-  if (!membershipToDelete) {
-    throw new Error("Failed to delete workspace membership that doesn't exist");
-  }
+		if (!membershipToDelete) {
+			throw new Error(
+				"Failed to delete workspace membership that doesn't exist"
+			);
+		}
 
-  const { permission } = await getUserProjectPermissions(
-    req.user._id,
-    membershipToDelete.workspace.toString()
-  );
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Delete,
-    ProjectPermissionSub.Member
-  );
+		// check if user is a member and admin of the workspace
+		// whose membership we wish to delete
+		const membership = await Membership.findOne({
+			user: req.user._id,
+			workspace: membershipToDelete.workspace
+		});
 
-  // delete workspace membership
-  const deletedMembership = await deleteMember({
-    membershipId: membershipToDelete._id.toString()
-  });
+		if (!membership) {
+			throw new Error('Failed to validate workspace membership');
+		}
 
-  await EEAuditLogService.createAuditLog(
-    req.authData,
-    {
-      type: EventType.REMOVE_WORKSPACE_MEMBER,
-      metadata: {
-        userId: membershipToDelete.user._id.toString(),
-        email: membershipToDelete.user.email
-      }
-    },
-    {
-      workspaceId: membershipToDelete.workspace
-    }
-  );
+		if (membership.role !== ADMIN) {
+			// user is not an admin member of the workspace
+			throw new Error('Insufficient role for deleting workspace membership');
+		}
 
-  return res.status(200).send({
-    deletedMembership
-  });
+		// delete workspace membership
+		deletedMembership = await deleteMember({
+			membershipId: membershipToDelete._id.toString()
+		});
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to delete membership'
+		});
+	}
+
+	return res.status(200).send({
+		deletedMembership
+	});
 };
 
 /**
@@ -104,80 +103,53 @@ export const deleteMembership = async (req: Request, res: Response) => {
  * @returns
  */
 export const changeMembershipRole = async (req: Request, res: Response) => {
-  const {
-    body: { role },
-    params: { membershipId }
-  } = await validateRequest(reqValidator.ChangeMembershipRoleV1, req);
+	let membershipToChangeRole;
+	try {
+		const { membershipId } = req.params;
+		const { role } = req.body;
 
-  // validate target membership
-  const membershipToChangeRole = await Membership.findById(membershipId).populate<{ user: IUser }>(
-    "user"
-  );
+		if (![ADMIN, MEMBER].includes(role)) {
+			throw new Error('Failed to validate role');
+		}
 
-  if (!membershipToChangeRole) {
-    throw new Error("Failed to find membership to change role");
-  }
+		// validate target membership
+		membershipToChangeRole = await findMembership({
+			_id: membershipId
+		});
 
-  const { permission } = await getUserProjectPermissions(
-    req.user._id,
-    membershipToChangeRole.workspace.toString()
-  );
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Edit,
-    ProjectPermissionSub.Member
-  );
+		if (!membershipToChangeRole) {
+			throw new Error('Failed to find membership to change role');
+		}
 
-  const isCustomRole = ![ADMIN, MEMBER, VIEWER].includes(role);
-  if (isCustomRole) {
-    const wsRole = await Role.findOne({
-      slug: role,
-      isOrgRole: false,
-      workspace: membershipToChangeRole.workspace
-    });
-    if (!wsRole) throw BadRequestError({ message: "Role not found" });
-    const membership = await Membership.findByIdAndUpdate(membershipId, {
-      role: CUSTOM,
-      customRole: wsRole
-    });
-    return res.status(200).send({
-      membership
-    });
-  }
+		// check if user is a member and admin of target membership's
+		// workspace
+		const membership = await findMembership({
+			user: req.user._id,
+			workspace: membershipToChangeRole.workspace
+		});
 
-  const membership = await Membership.findByIdAndUpdate(
-    membershipId,
-    {
-      $set: {
-        role
-      },
-      $unset: {
-        customRole: 1
-      }
-    },
-    {
-      new: true
-    }
-  );
+		if (!membership) {
+			throw new Error('Failed to validate membership');
+		}
 
-  await EEAuditLogService.createAuditLog(
-    req.authData,
-    {
-      type: EventType.UPDATE_USER_WORKSPACE_ROLE,
-      metadata: {
-        userId: membershipToChangeRole.user._id.toString(),
-        email: membershipToChangeRole.user.email,
-        oldRole: membershipToChangeRole.role,
-        newRole: role
-      }
-    },
-    {
-      workspaceId: membershipToChangeRole.workspace
-    }
-  );
+		if (membership.role !== ADMIN) {
+			// user is not an admin member of the workspace
+			throw new Error('Insufficient role for changing member roles');
+		}
 
-  return res.status(200).send({
-    membership
-  });
+		membershipToChangeRole.role = role;
+		await membershipToChangeRole.save();
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to change membership role'
+		});
+	}
+
+	return res.status(200).send({
+		membership: membershipToChangeRole
+	});
 };
 
 /**
@@ -187,86 +159,75 @@ export const changeMembershipRole = async (req: Request, res: Response) => {
  * @returns
  */
 export const inviteUserToWorkspace = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId },
-    body: { email }
-  } = await validateRequest(InviteUserToWorkspaceV1, req);
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Create,
-    ProjectPermissionSub.Member
-  );
+	let invitee, latestKey;
+	try {
+		const { workspaceId } = req.params;
+		const { email }: { email: string } = req.body;
 
-  const invitee = await User.findOne({
-    email
-  }).select("+publicKey");
+		invitee = await User.findOne({
+			email
+		}).select('+publicKey');
 
-  if (!invitee || !invitee?.publicKey) throw new Error("Failed to validate invitee");
+		if (!invitee || !invitee?.publicKey)
+			throw new Error('Failed to validate invitee');
 
-  // validate invitee's workspace membership - ensure member isn't
-  // already a member of the workspace
-  const inviteeMembership = await Membership.findOne({
-    user: invitee._id,
-    workspace: workspaceId
-  }).populate<{ user: IUser }>("user");
+		// validate invitee's workspace membership - ensure member isn't
+		// already a member of the workspace
+		const inviteeMembership = await Membership.findOne({
+			user: invitee._id,
+			workspace: workspaceId
+		});
 
-  if (inviteeMembership) throw new Error("Failed to add existing member of workspace");
+		if (inviteeMembership)
+			throw new Error('Failed to add existing member of workspace');
 
-  const workspace = await Workspace.findById(workspaceId);
-  if (!workspace) throw new Error("Failed to find workspace");
-  // validate invitee's organization membership - ensure that only
-  // (accepted) organization members can be added to the workspace
-  const membershipOrg = await MembershipOrg.findOne({
-    user: invitee._id,
-    organization: workspace.organization,
-    status: ACCEPTED
-  });
+		// validate invitee's organization membership - ensure that only
+		// (accepted) organization members can be added to the workspace
+		const membershipOrg = await MembershipOrg.findOne({
+			user: invitee._id,
+			organization: req.membership.workspace.organization,
+			status: ACCEPTED
+		});
 
-  if (!membershipOrg) throw new Error("Failed to validate invitee's organization membership");
+		if (!membershipOrg)
+			throw new Error("Failed to validate invitee's organization membership");
 
-  // get latest key
-  const latestKey = await Key.findOne({
-    workspace: workspaceId,
-    receiver: req.user._id
-  })
-    .sort({ createdAt: -1 })
-    .populate("sender", "+publicKey");
+		// get latest key
+		latestKey = await Key.findOne({
+			workspace: workspaceId,
+			receiver: req.user._id
+		})
+			.sort({ createdAt: -1 })
+			.populate('sender', '+publicKey');
 
-  // create new workspace membership
-  await new Membership({
-    user: invitee._id,
-    workspace: workspaceId,
-    role: MEMBER
-  }).save();
+		// create new workspace membership
+		const m = await new Membership({
+			user: invitee._id,
+			workspace: workspaceId,
+			role: MEMBER
+		}).save();
 
-  await sendMail({
-    template: "workspaceInvitation.handlebars",
-    subjectLine: "Infisical workspace invitation",
-    recipients: [invitee.email],
-    substitutions: {
-      inviterFirstName: req.user.firstName,
-      inviterEmail: req.user.email,
-      workspaceName: workspace.name,
-      callback_url: (await getSiteURL()) + "/login"
-    }
-  });
+		await sendMail({
+			template: 'workspaceInvitation.handlebars',
+			subjectLine: 'Infisical workspace invitation',
+			recipients: [invitee.email],
+			substitutions: {
+				inviterFirstName: req.user.firstName,
+				inviterEmail: req.user.email,
+				workspaceName: req.membership.workspace.name,
+				callback_url: SITE_URL + '/login'
+			}
+		});
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to invite user to workspace'
+		});
+	}
 
-  await EEAuditLogService.createAuditLog(
-    req.authData,
-    {
-      type: EventType.ADD_WORKSPACE_MEMBER,
-      metadata: {
-        userId: invitee._id.toString(),
-        email: invitee.email
-      }
-    },
-    {
-      workspaceId: new Types.ObjectId(workspaceId)
-    }
-  );
-
-  return res.status(200).send({
-    invitee,
-    latestKey
-  });
-};
+	return res.status(200).send({
+		invitee,
+		latestKey
+	});
+};

backend/src/controllers/v1/membershipOrgController.ts

@@ -1,29 +1,14 @@
-import { Types } from "mongoose";
-import { Request, Response } from "express";
-import { MembershipOrg, Organization, User } from "../../models";
-import { SSOConfig } from "../../ee/models";
-import { deleteMembershipOrg as deleteMemberFromOrg } from "../../helpers/membershipOrg";
-import { createToken } from "../../helpers/auth";
-import { updateSubscriptionOrgQuantity } from "../../helpers/organization";
-import { sendMail } from "../../helpers/nodemailer";
-import { TokenService } from "../../services";
-import { EELicenseService } from "../../ee/services";
-import { ACCEPTED, INVITED, MEMBER, TOKEN_EMAIL_ORG_INVITATION } from "../../variables";
-import * as reqValidator from "../../validation/membershipOrg";
-import {
-  getJwtSignupLifetime,
-  getJwtSignupSecret,
-  getSiteURL,
-  getSmtpConfigured
-} from "../../config";
-import { validateUserEmail } from "../../validation";
-import { validateRequest } from "../../helpers/validation";
-import {
-  OrgPermissionActions,
-  OrgPermissionSubjects,
-  getUserOrgPermissions
-} from "../../ee/services/RoleService";
-import { ForbiddenError } from "@casl/ability";
+import { Request, Response } from 'express';
+import * as Sentry from '@sentry/node';
+import crypto from 'crypto';
+import { SITE_URL, JWT_SIGNUP_LIFETIME, JWT_SIGNUP_SECRET } from '../../config';
+import { MembershipOrg, Organization, User, Token } from '../../models';
+import { deleteMembershipOrg as deleteMemberFromOrg } from '../../helpers/membershipOrg';
+import { checkEmailVerification } from '../../helpers/signup';
+import { createToken } from '../../helpers/auth';
+import { updateSubscriptionOrgQuantity } from '../../helpers/organization';
+import { sendMail } from '../../helpers/nodemailer';
+import { OWNER, ADMIN, MEMBER, ACCEPTED, INVITED } from '../../variables';
 
 /**
  * Delete organization membership with id [membershipOrgId] from organization
@@ -31,39 +16,55 @@ import { ForbiddenError } from "@casl/ability";
  * @param res
  * @returns
  */
-export const deleteMembershipOrg = async (req: Request, _res: Response) => {
-  const {
-    params: { membershipOrgId }
-  } = await validateRequest(reqValidator.DelOrgMembershipv1, req);
+export const deleteMembershipOrg = async (req: Request, res: Response) => {
+	let membershipOrgToDelete;
+	try {
+		const { membershipOrgId } = req.params;
 
-  // check if organization membership to delete exists
-  const membershipOrgToDelete = await MembershipOrg.findOne({
-    _id: membershipOrgId
-  }).populate("user");
+		// check if organization membership to delete exists
+		membershipOrgToDelete = await MembershipOrg.findOne({
+			_id: membershipOrgId
+		}).populate('user');
 
-  if (!membershipOrgToDelete) {
-    throw new Error("Failed to delete organization membership that doesn't exist");
-  }
+		if (!membershipOrgToDelete) {
+			throw new Error(
+				"Failed to delete organization membership that doesn't exist"
+			);
+		}
 
-  const { permission, membership: membershipOrg } = await getUserOrgPermissions(
-    req.user._id,
-    membershipOrgToDelete.organization.toString()
-  );
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Delete,
-    OrgPermissionSubjects.Member
-  );
+		// check if user is a member and admin of the organization
+		// whose membership we wish to delete
+		const membershipOrg = await MembershipOrg.findOne({
+			user: req.user._id,
+			organization: membershipOrgToDelete.organization
+		});
 
-  // delete organization membership
-  await deleteMemberFromOrg({
-    membershipOrgId: membershipOrgToDelete._id.toString()
-  });
+		if (!membershipOrg) {
+			throw new Error('Failed to validate organization membership');
+		}
 
-  await updateSubscriptionOrgQuantity({
-    organizationId: membershipOrg.organization.toString()
-  });
+		if (membershipOrg.role !== OWNER && membershipOrg.role !== ADMIN) {
+			// user is not an admin member of the organization
+			throw new Error('Insufficient role for deleting organization membership');
+		}
 
-  return membershipOrgToDelete;
+		// delete organization membership
+		const deletedMembershipOrg = await deleteMemberFromOrg({
+			membershipOrgId: membershipOrgToDelete._id.toString()
+		});
+
+		await updateSubscriptionOrgQuantity({
+			organizationId: membershipOrg.organization.toString()
+		});
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to delete organization membership'
+		});
+	}
+
+	return membershipOrgToDelete;
 };
 
 /**
@@ -73,14 +74,24 @@ export const deleteMembershipOrg = async (req: Request, _res: Response) => {
  * @returns
  */
 export const changeMembershipOrgRole = async (req: Request, res: Response) => {
-  // change role for (target) organization membership with id
-  // [membershipOrgId]
+	// change role for (target) organization membership with id
+	// [membershipOrgId]
 
-  let membershipToChangeRole;
+	// TODO
 
-  return res.status(200).send({
-    membershipOrg: membershipToChangeRole
-  });
+	let membershipToChangeRole;
+	// try {
+	// } catch (err) {
+	// 	Sentry.setUser({ email: req.user.email });
+	// 	Sentry.captureException(err);
+	// 	return res.status(400).send({
+	// 		message: 'Failed to change organization membership role'
+	// 	});
+	// }
+
+	return res.status(200).send({
+		membershipOrg: membershipToChangeRole
+	});
 };
 
 /**
@@ -91,128 +102,108 @@ export const changeMembershipOrgRole = async (req: Request, res: Response) => {
  * @returns
  */
 export const inviteUserToOrganization = async (req: Request, res: Response) => {
-  let inviteeMembershipOrg, completeInviteLink;
-  const {
-    body: { inviteeEmail, organizationId }
-  } = await validateRequest(reqValidator.InviteUserToOrgv1, req);
+	let invitee, inviteeMembershipOrg;
+	try {
+		const { organizationId, inviteeEmail } = req.body;
 
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Create,
-    OrgPermissionSubjects.Member
-  );
+		// validate membership
+		const membershipOrg = await MembershipOrg.findOne({
+			user: req.user._id,
+			organization: organizationId
+		});
 
-  const host = req.headers.host;
-  const siteUrl = `${req.protocol}://${host}`;
-  const plan = await EELicenseService.getPlan(new Types.ObjectId(organizationId));
+		if (!membershipOrg) {
+			throw new Error('Failed to validate organization membership');
+		}
+		
+		invitee = await User.findOne({
+			email: inviteeEmail
+		}).select('+publicKey');
 
-  const ssoConfig = await SSOConfig.findOne({
-    organization: new Types.ObjectId(organizationId)
-  });
+		if (invitee) {
+			// case: invitee is an existing user
+			
+			inviteeMembershipOrg = await MembershipOrg.findOne({
+				user: invitee._id,
+				organization: organizationId
+			});
 
-  if (ssoConfig && ssoConfig.isActive) {
-    // case: SAML SSO is enabled for the organization
-    return res.status(400).send({
-      message: "Failed to invite member due to SAML SSO configured for organization"
-    });
-  }
+			if (inviteeMembershipOrg && inviteeMembershipOrg.status === ACCEPTED) {
+				throw new Error(
+					'Failed to invite an existing member of the organization'
+				);
+			}
 
-  if (plan.memberLimit !== null) {
-    // case: limit imposed on number of members allowed
+			if (!inviteeMembershipOrg) {
+				await new MembershipOrg({
+					user: invitee,
+					inviteEmail: inviteeEmail,
+					organization: organizationId,
+					role: MEMBER,
+					status: invitee?.publicKey ? ACCEPTED : INVITED
+				}).save();
+			}
+		} else {
+			// check if invitee has been invited before
+			inviteeMembershipOrg = await MembershipOrg.findOne({
+				inviteEmail: inviteeEmail,
+				organization: organizationId
+			});
 
-    if (plan.membersUsed >= plan.memberLimit) {
-      // case: number of members used exceeds the number of members allowed
-      return res.status(400).send({
-        message:
-          "Failed to invite member due to member limit reached. Upgrade plan to invite more members."
-      });
-    }
-  }
+			if (!inviteeMembershipOrg) {
+				// case: invitee has never been invited before
 
-  const invitee = await User.findOne({
-    email: inviteeEmail
-  }).select("+publicKey");
+				await new MembershipOrg({
+					inviteEmail: inviteeEmail,
+					organization: organizationId,
+					role: MEMBER,
+					status: INVITED
+				}).save();
+			}
+		}
 
-  if (invitee) {
-    // case: invitee is an existing user
+		const organization = await Organization.findOne({ _id: organizationId });
 
-    inviteeMembershipOrg = await MembershipOrg.findOne({
-      user: invitee._id,
-      organization: organizationId
-    });
+		if (organization) {
+			const token = crypto.randomBytes(16).toString('hex');
 
-    if (inviteeMembershipOrg && inviteeMembershipOrg.status === ACCEPTED) {
-      throw new Error("Failed to invite an existing member of the organization");
-    }
+			await Token.findOneAndUpdate(
+				{ email: inviteeEmail },
+				{
+					email: inviteeEmail,
+					token,
+					createdAt: new Date()
+				},
+				{ upsert: true, new: true }
+			);
 
-    if (!inviteeMembershipOrg) {
-      await new MembershipOrg({
-        user: invitee,
-        inviteEmail: inviteeEmail,
-        organization: organizationId,
-        role: MEMBER,
-        status: INVITED
-      }).save();
-    }
-  } else {
-    // check if invitee has been invited before
-    inviteeMembershipOrg = await MembershipOrg.findOne({
-      inviteEmail: inviteeEmail,
-      organization: organizationId
-    });
+			await sendMail({
+				template: 'organizationInvitation.handlebars',
+				subjectLine: 'Infisical organization invitation',
+				recipients: [inviteeEmail],
+				substitutions: {
+					inviterFirstName: req.user.firstName,
+					inviterEmail: req.user.email,
+					organizationName: organization.name,
+					email: inviteeEmail,
+					token,
+					callback_url: SITE_URL + '/signupinvite'
+				}
+			});
+		}
 
-    if (!inviteeMembershipOrg) {
-      // case: invitee has never been invited before
+		await updateSubscriptionOrgQuantity({ organizationId });
+	} catch (err) {
+		Sentry.setUser(null);
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to send organization invite'
+		});
+	}
 
-      // validate that email is not disposable
-      validateUserEmail(inviteeEmail);
-
-      await new MembershipOrg({
-        inviteEmail: inviteeEmail,
-        organization: organizationId,
-        role: MEMBER,
-        status: INVITED
-      }).save();
-    }
-  }
-
-  const organization = await Organization.findOne({ _id: organizationId });
-
-  if (organization) {
-    const token = await TokenService.createToken({
-      type: TOKEN_EMAIL_ORG_INVITATION,
-      email: inviteeEmail,
-      organizationId: organization._id
-    });
-
-    await sendMail({
-      template: "organizationInvitation.handlebars",
-      subjectLine: "Infisical organization invitation",
-      recipients: [inviteeEmail],
-      substitutions: {
-        inviterFirstName: req.user.firstName,
-        inviterEmail: req.user.email,
-        organizationName: organization.name,
-        email: inviteeEmail,
-        organizationId: organization._id.toString(),
-        token,
-        callback_url: (await getSiteURL()) + "/signupinvite"
-      }
-    });
-
-    if (!(await getSmtpConfigured())) {
-      completeInviteLink = `${
-        siteUrl + "/signupinvite"
-      }?token=${token}&to=${inviteeEmail}&organization_id=${organization._id}`;
-    }
-  }
-
-  await updateSubscriptionOrgQuantity({ organizationId });
-
-  return res.status(200).send({
-    message: `Sent an invite link to ${req.body.inviteeEmail}`,
-    completeInviteLink
-  });
+	return res.status(200).send({
+		message: `Sent an invite link to ${req.body.inviteeEmail}`
+	});
 };
 
 /**
@@ -223,64 +214,63 @@ export const inviteUserToOrganization = async (req: Request, res: Response) => {
  * @returns
  */
 export const verifyUserToOrganization = async (req: Request, res: Response) => {
-  let user;
+	let user, token;
+	try {
+		const { email, code } = req.body;
 
-  const {
-    body: { organizationId, email, code }
-  } = await validateRequest(reqValidator.VerifyUserToOrgv1, req);
+		user = await User.findOne({ email }).select('+publicKey');
 
-  user = await User.findOne({ email }).select("+publicKey");
+		const membershipOrg = await MembershipOrg.findOne({
+			inviteEmail: email,
+			status: INVITED
+		});
 
-  const membershipOrg = await MembershipOrg.findOne({
-    inviteEmail: email,
-    status: INVITED,
-    organization: new Types.ObjectId(organizationId)
-  });
+		if (!membershipOrg)
+			throw new Error('Failed to find any invitations for email');
 
-  if (!membershipOrg) throw new Error("Failed to find any invitations for email");
+		await checkEmailVerification({
+			email,
+			code
+		});
 
-  await TokenService.validateToken({
-    type: TOKEN_EMAIL_ORG_INVITATION,
-    email,
-    organizationId: membershipOrg.organization,
-    token: code
-  });
+		if (user && user?.publicKey) {
+			// case: user has already completed account
+			// membership can be approved and redirected to login/dashboard
+			membershipOrg.status = ACCEPTED;
+			await membershipOrg.save();
 
-  if (user && user?.publicKey) {
-    // case: user has already completed account
-    // membership can be approved and redirected to login/dashboard
-    membershipOrg.status = ACCEPTED;
-    await membershipOrg.save();
+			return res.status(200).send({
+				message: 'Successfully verified email',
+				user,
+			});
+        }
 
-    await updateSubscriptionOrgQuantity({
-      organizationId
-    });
+		if (!user) {
+			// initialize user account
+			user = await new User({
+				email
+			}).save();
+		}
 
-    return res.status(200).send({
-      message: "Successfully verified email",
-      user
-    });
-  }
+		// generate temporary signup token
+		token = createToken({
+			payload: {
+				userId: user._id.toString()
+			},
+			expiresIn: JWT_SIGNUP_LIFETIME,
+			secret: JWT_SIGNUP_SECRET
+		});
+	} catch (err) {
+		Sentry.setUser(null);
+		Sentry.captureException(err);
+		return res.status(400).send({
+			error: 'Failed email magic link verification for organization invitation'
+		});
+	}
 
-  if (!user) {
-    // initialize user account
-    user = await new User({
-      email
-    }).save();
-  }
-
-  // generate temporary signup token
-  const token = createToken({
-    payload: {
-      userId: user._id.toString()
-    },
-    expiresIn: await getJwtSignupLifetime(),
-    secret: await getJwtSignupSecret()
-  });
-
-  return res.status(200).send({
-    message: "Successfully verified email",
-    user,
-    token
-  });
+	return res.status(200).send({
+		message: 'Successfully verified email',
+		user,
+		token
+	});
 };

backend/src/controllers/v1/organizationController.ts

@@ -1,35 +1,94 @@
-import { Request, Response } from "express";
+import { Request, Response } from 'express';
+import * as Sentry from '@sentry/node';
 import {
-  IncidentContactOrg,
-  Membership,
-  MembershipOrg,
-  Organization,
-  Workspace
-} from "../../models";
-import { getLicenseServerUrl, getSiteURL } from "../../config";
-import { licenseServerKeyRequest } from "../../config/request";
-import { validateRequest } from "../../helpers/validation";
-import * as reqValidator from "../../validation/organization";
-import { ACCEPTED } from "../../variables";
+	SITE_URL,
+	STRIPE_SECRET_KEY,
+	STRIPE_PRODUCT_STARTER,
+	STRIPE_PRODUCT_PRO,
+	STRIPE_PRODUCT_CARD_AUTH
+} from '../../config';
+import Stripe from 'stripe';
+
+const stripe = new Stripe(STRIPE_SECRET_KEY, {
+	apiVersion: '2022-08-01'
+});
 import {
-  OrgPermissionActions,
-  OrgPermissionSubjects,
-  getUserOrgPermissions
-} from "../../ee/services/RoleService";
-import { OrganizationNotFoundError } from "../../utils/errors";
-import { ForbiddenError } from "@casl/ability";
+	Membership,
+	MembershipOrg,
+	Organization,
+	Workspace,
+	IncidentContactOrg
+} from '../../models';
+import { createOrganization as create } from '../../helpers/organization';
+import { addMembershipsOrg } from '../../helpers/membershipOrg';
+import { OWNER, ACCEPTED } from '../../variables';
+
+const productToPriceMap = {
+	starter: STRIPE_PRODUCT_STARTER,
+	pro: STRIPE_PRODUCT_PRO,
+	cardAuth: STRIPE_PRODUCT_CARD_AUTH
+};
 
 export const getOrganizations = async (req: Request, res: Response) => {
-  const organizations = (
-    await MembershipOrg.find({
-      user: req.user._id,
-      status: ACCEPTED
-    }).populate("organization")
-  ).map((m) => m.organization);
+	let organizations;
+	try {
+		organizations = (
+			await MembershipOrg.find({
+				user: req.user._id
+			}).populate('organization')
+		).map((m) => m.organization);
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get organizations'
+		});
+	}
 
-  return res.status(200).send({
-    organizations
-  });
+	return res.status(200).send({
+		organizations
+	});
+};
+
+/**
+ * Create new organization named [organizationName]
+ * and add user as owner
+ * @param req
+ * @param res
+ * @returns
+ */
+export const createOrganization = async (req: Request, res: Response) => {
+	let organization;
+	try {
+		const { organizationName } = req.body;
+
+		if (organizationName.length < 1) {
+			throw new Error('Organization names must be at least 1-character long');
+		}
+
+		// create organization and add user as member
+		organization = await create({
+			email: req.user.email,
+			name: organizationName
+		});
+
+		await addMembershipsOrg({
+			userIds: [req.user._id.toString()],
+			organizationId: organization._id.toString(),
+			roles: [OWNER],
+			statuses: [ACCEPTED]
+		});
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to create organization'
+		});
+	}
+
+	return res.status(200).send({
+		organization
+	});
 };
 
 /**
@@ -39,23 +98,20 @@ export const getOrganizations = async (req: Request, res: Response) => {
  * @returns
  */
 export const getOrganization = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId }
-  } = await validateRequest(reqValidator.GetOrgv1, req);
+	let organization;
+	try {
+		organization = req.membershipOrg.organization;
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to find organization'
+		});
+	}
 
-  // ensure user has membership
-  await getUserOrgPermissions(req.user._id, organizationId);
-
-  const organization = await Organization.findById(organizationId);
-  if (!organization) {
-    throw OrganizationNotFoundError({
-      message: "Failed to find organization"
-    });
-  }
-
-  return res.status(200).send({
-    organization
-  });
+	return res.status(200).send({
+		organization
+	});
 };
 
 /**
@@ -65,23 +121,24 @@ export const getOrganization = async (req: Request, res: Response) => {
  * @returns
  */
 export const getOrganizationMembers = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId }
-  } = await validateRequest(reqValidator.GetOrgMembersv1, req);
+	let users;
+	try {
+		const { organizationId } = req.params;
 
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Read,
-    OrgPermissionSubjects.Member
-  );
+		users = await MembershipOrg.find({
+			organization: organizationId
+		}).populate('user', '+publicKey');
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get organization members'
+		});
+	}
 
-  const users = await MembershipOrg.find({
-    organization: organizationId
-  }).populate("user", "+publicKey");
-
-  return res.status(200).send({
-    users
-  });
+	return res.status(200).send({
+		users
+	});
 };
 
 /**
@@ -90,39 +147,43 @@ export const getOrganizationMembers = async (req: Request, res: Response) => {
  * @param res
  * @returns
  */
-export const getOrganizationWorkspaces = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId }
-  } = await validateRequest(reqValidator.GetOrgWorkspacesv1, req);
+export const getOrganizationWorkspaces = async (
+	req: Request,
+	res: Response
+) => {
+	let workspaces;
+	try {
+		const { organizationId } = req.params;
 
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Read,
-    OrgPermissionSubjects.Workspace
-  );
+		const workspacesSet = new Set(
+			(
+				await Workspace.find(
+					{
+						organization: organizationId
+					},
+					'_id'
+				)
+			).map((w) => w._id.toString())
+		);
 
-  const workspacesSet = new Set(
-    (
-      await Workspace.find(
-        {
-          organization: organizationId
-        },
-        "_id"
-      )
-    ).map((w) => w._id.toString())
-  );
+		workspaces = (
+			await Membership.find({
+				user: req.user._id
+			}).populate('workspace')
+		)
+			.filter((m) => workspacesSet.has(m.workspace._id.toString()))
+			.map((m) => m.workspace);
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get my workspaces'
+		});
+	}
 
-  const workspaces = (
-    await Membership.find({
-      user: req.user._id
-    }).populate("workspace")
-  )
-    .filter((m) => workspacesSet.has(m.workspace._id.toString()))
-    .map((m) => m.workspace);
-
-  return res.status(200).send({
-    workspaces
-  });
+	return res.status(200).send({
+		workspaces
+	});
 };
 
 /**
@@ -132,33 +193,34 @@ export const getOrganizationWorkspaces = async (req: Request, res: Response) =>
  * @returns
  */
 export const changeOrganizationName = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId },
-    body: { name }
-  } = await validateRequest(reqValidator.ChangeOrgNamev1, req);
+	let organization;
+	try {
+		const { organizationId } = req.params;
+		const { name } = req.body;
 
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Edit,
-    OrgPermissionSubjects.Settings
-  );
+		organization = await Organization.findOneAndUpdate(
+			{
+				_id: organizationId
+			},
+			{
+				name
+			},
+			{
+				new: true
+			}
+		);
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to change organization name'
+		});
+	}
 
-  const organization = await Organization.findOneAndUpdate(
-    {
-      _id: organizationId
-    },
-    {
-      name
-    },
-    {
-      new: true
-    }
-  );
-
-  return res.status(200).send({
-    message: "Successfully changed organization name",
-    organization
-  });
+	return res.status(200).send({
+		message: 'Successfully changed organization name',
+		organization
+	});
 };
 
 /**
@@ -167,24 +229,28 @@ export const changeOrganizationName = async (req: Request, res: Response) => {
  * @param res
  * @returns
  */
-export const getOrganizationIncidentContacts = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId }
-  } = await validateRequest(reqValidator.GetOrgIncidentContactv1, req);
+export const getOrganizationIncidentContacts = async (
+	req: Request,
+	res: Response
+) => {
+	let incidentContactsOrg;
+	try {
+		const { organizationId } = req.params;
 
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Read,
-    OrgPermissionSubjects.IncidentAccount
-  );
+		incidentContactsOrg = await IncidentContactOrg.find({
+			organization: organizationId
+		});
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get organization incident contacts'
+		});
+	}
 
-  const incidentContactsOrg = await IncidentContactOrg.find({
-    organization: organizationId
-  });
-
-  return res.status(200).send({
-    incidentContactsOrg
-  });
+	return res.status(200).send({
+		incidentContactsOrg
+	});
 };
 
 /**
@@ -193,27 +259,31 @@ export const getOrganizationIncidentContacts = async (req: Request, res: Respons
  * @param res
  * @returns
  */
-export const addOrganizationIncidentContact = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId },
-    body: { email }
-  } = await validateRequest(reqValidator.CreateOrgIncideContact, req);
+export const addOrganizationIncidentContact = async (
+	req: Request,
+	res: Response
+) => {
+	let incidentContactOrg;
+	try {
+		const { organizationId } = req.params;
+		const { email } = req.body;
 
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Create,
-    OrgPermissionSubjects.IncidentAccount
-  );
+		incidentContactOrg = await IncidentContactOrg.findOneAndUpdate(
+			{ email, organization: organizationId },
+			{ email, organization: organizationId },
+			{ upsert: true, new: true }
+		);
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to add incident contact for organization'
+		});
+	}
 
-  const incidentContactOrg = await IncidentContactOrg.findOneAndUpdate(
-    { email, organization: organizationId },
-    { email, organization: organizationId },
-    { upsert: true, new: true }
-  );
-
-  return res.status(200).send({
-    incidentContactOrg
-  });
+	return res.status(200).send({
+		incidentContactOrg
+	});
 };
 
 /**
@@ -222,137 +292,103 @@ export const addOrganizationIncidentContact = async (req: Request, res: Response
  * @param res
  * @returns
  */
-export const deleteOrganizationIncidentContact = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId },
-    body: { email }
-  } = await validateRequest(reqValidator.DelOrgIncideContact, req);
+export const deleteOrganizationIncidentContact = async (
+	req: Request,
+	res: Response
+) => {
+	let incidentContactOrg;
+	try {
+		const { organizationId } = req.params;
+		const { email } = req.body;
 
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Delete,
-    OrgPermissionSubjects.IncidentAccount
-  );
+		incidentContactOrg = await IncidentContactOrg.findOneAndDelete({
+			email,
+			organization: organizationId
+		});
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to delete organization incident contact'
+		});
+	}
 
-  const incidentContactOrg = await IncidentContactOrg.findOneAndDelete({
-    email,
-    organization: organizationId
-  });
-
-  return res.status(200).send({
-    message: "Successfully deleted organization incident contact",
-    incidentContactOrg
-  });
+	return res.status(200).send({
+		message: 'Successfully deleted organization incident contact',
+		incidentContactOrg
+	});
 };
 
 /**
- * Redirect user to billing portal or add card page depending on
+ * Redirect user to (stripe) billing portal or add card page depending on
  * if there is a card on file
  * @param req
  * @param res
  * @returns
  */
-export const createOrganizationPortalSession = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId }
-  } = await validateRequest(reqValidator.GetOrgPlanBillingInfov1, req);
+export const createOrganizationPortalSession = async (
+	req: Request,
+	res: Response
+) => {
+	let session;
+	try {
+		// check if there is a payment method on file
+		const paymentMethods = await stripe.paymentMethods.list({
+			customer: req.membershipOrg.organization.customerId,
+			type: 'card'
+		});
 
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Edit,
-    OrgPermissionSubjects.Billing
-  );
+		if (paymentMethods.data.length < 1) {
+			// case: no payment method on file
+			productToPriceMap['cardAuth'];
+			session = await stripe.checkout.sessions.create({
+				customer: req.membershipOrg.organization.customerId,
+				mode: 'setup',
+				payment_method_types: ['card'],
+				success_url: SITE_URL + '/dashboard',
+				cancel_url: SITE_URL + '/dashboard'
+			});
+		} else {
+			session = await stripe.billingPortal.sessions.create({
+				customer: req.membershipOrg.organization.customerId,
+				return_url: SITE_URL + '/dashboard'
+			});
+		}
 
-  const organization = await Organization.findById(organizationId);
-  if (!organization) {
-    throw OrganizationNotFoundError({
-      message: "Failed to find organization"
-    });
-  }
-
-  const {
-    data: { pmtMethods }
-  } = await licenseServerKeyRequest.get(
-    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
-      organization.customerId
-    }/billing-details/payment-methods`
-  );
-
-  if (pmtMethods.length < 1) {
-    // case: organization has no payment method on file
-    // -> redirect to add payment method portal
-    const {
-      data: { url }
-    } = await licenseServerKeyRequest.post(
-      `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
-        organization.customerId
-      }/billing-details/payment-methods`,
-      {
-        success_url: (await getSiteURL()) + "/dashboard",
-        cancel_url: (await getSiteURL()) + "/dashboard"
-      }
-    );
-    return res.status(200).send({ url });
-  } else {
-    // case: organization has payment method on file
-    // -> redirect to billing portal
-    const {
-      data: { url }
-    } = await licenseServerKeyRequest.post(
-      `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
-        organization.customerId
-      }/billing-details/billing-portal`,
-      {
-        return_url: (await getSiteURL()) + "/dashboard"
-      }
-    );
-    return res.status(200).send({ url });
-  }
+		return res.status(200).send({ url: session.url });
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to redirect to organization billing portal'
+		});
+	}
 };
 
 /**
- * Given a org id, return the projects each member of the org belongs to
+ * Return organization subscriptions
  * @param req
  * @param res
  * @returns
  */
-export const getOrganizationMembersAndTheirWorkspaces = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId }
-  } = await validateRequest(reqValidator.GetOrgMembersv1, req);
+export const getOrganizationSubscriptions = async (
+	req: Request,
+	res: Response
+) => {
+	let subscriptions;
+	try {
+		subscriptions = await stripe.subscriptions.list({
+			customer: req.membershipOrg.organization.customerId
+		});
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get organization subscriptions'
+		});
+	}
 
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Read,
-    OrgPermissionSubjects.Member
-  );
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Read,
-    OrgPermissionSubjects.Workspace
-  );
-
-  const workspacesSet = (
-    await Workspace.find(
-      {
-        organization: organizationId
-      },
-      "_id"
-    )
-  ).map((w) => w._id.toString());
-
-  const memberships = await Membership.find({
-    workspace: { $in: workspacesSet }
-  }).populate("workspace");
-  const userToWorkspaceIds: any = {};
-
-  memberships.forEach((membership) => {
-    const user = membership.user.toString();
-    if (userToWorkspaceIds[user]) {
-      userToWorkspaceIds[user].push(membership.workspace);
-    } else {
-      userToWorkspaceIds[user] = [membership.workspace];
-    }
-  });
-
-  return res.json(userToWorkspaceIds);
+	return res.status(200).send({
+		subscriptions
+	});
 };

backend/src/controllers/v1/passwordController.ts

@@ -1,105 +1,121 @@
-import { Request, Response } from "express";
+import { Request, Response } from 'express';
+import * as Sentry from '@sentry/node';
+import crypto from 'crypto';
 // eslint-disable-next-line @typescript-eslint/no-var-requires
-const jsrp = require("jsrp");
-import * as bigintConversion from "bigint-conversion";
-import { BackupPrivateKey, LoginSRPDetail, User } from "../../models";
-import { clearTokens, createToken, sendMail } from "../../helpers";
-import { TokenService } from "../../services";
-import { TOKEN_EMAIL_PASSWORD_RESET } from "../../variables";
-import { BadRequestError } from "../../utils/errors";
-import {
-  getHttpsEnabled,
-  getJwtSignupLifetime,
-  getJwtSignupSecret,
-  getSiteURL
-} from "../../config";
-import { ActorType } from "../../ee/models";
-import { validateRequest } from "../../helpers/validation";
-import * as reqValidator from "../../validation/auth";
+const jsrp = require('jsrp');
+import * as bigintConversion from 'bigint-conversion';
+import { User, Token, BackupPrivateKey } from '../../models';
+import { checkEmailVerification } from '../../helpers/signup';
+import { createToken } from '../../helpers/auth';
+import { sendMail } from '../../helpers/nodemailer';
+import { JWT_SIGNUP_LIFETIME, JWT_SIGNUP_SECRET, SITE_URL } from '../../config';
+
+const clientPublicKeys: any = {};
 
 /**
- * Password reset step 1: Send email verification link to email [email]
+ * Password reset step 1: Send email verification link to email [email] 
  * for account recovery.
  * @param req
  * @param res
  * @returns
  */
 export const emailPasswordReset = async (req: Request, res: Response) => {
-  const {
-    body: { email }
-  } = await validateRequest(reqValidator.EmailPasswordResetV1, req);
+	let email: string;
+	try {
+		email = req.body.email;
 
-  const user = await User.findOne({ email }).select("+publicKey");
-  if (!user || !user?.publicKey) {
-    // case: user has already completed account
+		const user = await User.findOne({ email }).select('+publicKey');
+		if (!user || !user?.publicKey) {
+			// case: user has already completed account
 
-    return res.status(200).send({
-      message: "If an account exists with this email, a password reset link has been sent"
-    });
-  }
+			return res.status(403).send({
+				error: 'Failed to send email verification for password reset'
+			});
+		}
+		
+		const token = crypto.randomBytes(16).toString('hex');
 
-  const token = await TokenService.createToken({
-    type: TOKEN_EMAIL_PASSWORD_RESET,
-    email
-  });
-
-  await sendMail({
-    template: "passwordReset.handlebars",
-    subjectLine: "Infisical password reset",
-    recipients: [email],
-    substitutions: {
-      email,
-      token,
-      callback_url: (await getSiteURL()) + "/password-reset"
-    }
-  });
-
-  return res.status(200).send({
-    message: "If an account exists with this email, a password reset link has been sent"
-  });
-};
+		await Token.findOneAndUpdate(
+			{ email },
+			{
+				email,
+				token,
+				createdAt: new Date()
+			},
+			{ upsert: true, new: true }
+		);
+		
+		await sendMail({
+			template: 'passwordReset.handlebars',
+			subjectLine: 'Infisical password reset',
+			recipients: [email],
+			substitutions: {
+				email,
+				token,
+				callback_url: SITE_URL + '/password-reset'
+			}
+		});
+		
+	} catch (err) {
+		Sentry.setUser(null);
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to send email for account recovery'
+		});	
+	}
+	
+	return res.status(200).send({
+		message: `Sent an email for account recovery to ${email}`
+	});
+}
 
 /**
  * Password reset step 2: Verify email verification link sent to email [email]
- * @param req
- * @param res
- * @returns
+ * @param req 
+ * @param res 
+ * @returns 
  */
 export const emailPasswordResetVerify = async (req: Request, res: Response) => {
-  const {
-    body: { email, code }
-  } = await validateRequest(reqValidator.EmailPasswordResetVerifyV1, req);
+	let user, token;
+	try {
+		const { email, code } = req.body;
+		
+		user = await User.findOne({ email }).select('+publicKey');
+		if (!user || !user?.publicKey) {
+			// case: user doesn't exist with email [email] or 
+			// hasn't even completed their account
+			return res.status(403).send({
+				error: 'Failed email verification for password reset'
+			});
+		}
 
-  const user = await User.findOne({ email }).select("+publicKey");
-  if (!user || !user?.publicKey) {
-    // case: user doesn't exist with email [email] or
-    // hasn't even completed their account
-    return res.status(403).send({
-      error: "Failed email verification for password reset"
-    });
-  }
+		await checkEmailVerification({
+			email,
+			code
+		});
+		
+		// generate temporary password-reset token
+		token = createToken({
+			payload: {
+				userId: user._id.toString()
+			},
+			expiresIn: JWT_SIGNUP_LIFETIME,
+			secret: JWT_SIGNUP_SECRET
+		});
+	} catch (err) {
+		Sentry.setUser(null);
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed email verification for password reset'
+		});	
+	}
 
-  await TokenService.validateToken({
-    type: TOKEN_EMAIL_PASSWORD_RESET,
-    email,
-    token: code
-  });
-
-  // generate temporary password-reset token
-  const token = createToken({
-    payload: {
-      userId: user._id.toString()
-    },
-    expiresIn: await getJwtSignupLifetime(),
-    secret: await getJwtSignupSecret()
-  });
-
-  return res.status(200).send({
-    message: "Successfully verified email",
-    user,
-    token
-  });
-};
+	return res.status(200).send({
+		message: 'Successfully verified email',
+		user,
+		token
+	});
+}
 
 /**
  * Return [salt] and [serverPublicKey] as part of step 1 of SRP protocol
@@ -108,43 +124,42 @@ export const emailPasswordResetVerify = async (req: Request, res: Response) => {
  * @returns
  */
 export const srp1 = async (req: Request, res: Response) => {
-  // return salt, serverPublicKey as part of first step of SRP protocol
-  const {
-    body: { clientPublicKey }
-  } = await validateRequest(reqValidator.Srp1V1, req);
+	// return salt, serverPublicKey as part of first step of SRP protocol
+	try {
+		const { clientPublicKey } = req.body;
+		const user = await User.findOne({
+			email: req.user.email
+		}).select('+salt +verifier');
+		
+		if (!user) throw new Error('Failed to find user');
 
-  const user = await User.findOne({
-    email: req.user.email
-  }).select("+salt +verifier");
+		const server = new jsrp.server();
+		server.init(
+			{
+				salt: user.salt,
+				verifier: user.verifier
+			},
+			() => {
+				// generate server-side public key
+				const serverPublicKey = server.getPublicKey();
+				clientPublicKeys[req.user.email] = {
+					clientPublicKey,
+					serverBInt: bigintConversion.bigintToBuf(server.bInt)
+				};
 
-  if (!user) throw new Error("Failed to find user");
-
-  const server = new jsrp.server();
-  server.init(
-    {
-      salt: user.salt,
-      verifier: user.verifier
-    },
-    async () => {
-      // generate server-side public key
-      const serverPublicKey = server.getPublicKey();
-
-      await LoginSRPDetail.findOneAndReplace(
-        { email: req.user.email },
-        {
-          email: req.user.email,
-          clientPublicKey: clientPublicKey,
-          serverBInt: bigintConversion.bigintToBuf(server.bInt)
-        },
-        { upsert: true, returnNewDocument: false }
-      );
-
-      return res.status(200).send({
-        serverPublicKey,
-        salt: user.salt
-      });
-    }
-  );
+				return res.status(200).send({
+					serverPublicKey,
+					salt: user.salt
+				});
+			}
+		);
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			error: 'Failed to start change password process'
+		});
+	}
 };
 
 /**
@@ -156,91 +171,62 @@ export const srp1 = async (req: Request, res: Response) => {
  * @returns
  */
 export const changePassword = async (req: Request, res: Response) => {
-  const {
-    body: {
-      clientProof,
-      protectedKey,
-      protectedKeyIV,
-      protectedKeyTag,
-      encryptedPrivateKey,
-      encryptedPrivateKeyIV,
-      encryptedPrivateKeyTag,
-      salt,
-      verifier
-    }
-  } = await validateRequest(reqValidator.ChangePasswordV1, req);
+	try {
+		const { clientProof, encryptedPrivateKey, iv, tag, salt, verifier } =
+			req.body;
+		const user = await User.findOne({
+			email: req.user.email
+		}).select('+salt +verifier');
 
-  const user = await User.findOne({
-    email: req.user.email
-  }).select("+salt +verifier");
+		if (!user) throw new Error('Failed to find user');
 
-  if (!user) throw new Error("Failed to find user");
+		const server = new jsrp.server();
+		server.init(
+			{
+				salt: user.salt,
+				verifier: user.verifier,
+				b: clientPublicKeys[req.user.email].serverBInt
+			},
+			async () => {
+				server.setClientPublicKey(
+					clientPublicKeys[req.user.email].clientPublicKey
+				);
 
-  const loginSRPDetailFromDB = await LoginSRPDetail.findOneAndDelete({ email: req.user.email });
+				// compare server and client shared keys
+				if (server.checkClientProof(clientProof)) {
+					// change password
 
-  if (!loginSRPDetailFromDB) {
-    return BadRequestError(
-      Error(
-        "It looks like some details from the first login are not found. Please try login one again"
-      )
-    );
-  }
+					await User.findByIdAndUpdate(
+						req.user._id.toString(),
+						{
+							encryptedPrivateKey,
+							iv,
+							tag,
+							salt,
+							verifier
+						},
+						{
+							new: true
+						}
+					);
 
-  const server = new jsrp.server();
-  server.init(
-    {
-      salt: user.salt,
-      verifier: user.verifier,
-      b: loginSRPDetailFromDB.serverBInt
-    },
-    async () => {
-      server.setClientPublicKey(loginSRPDetailFromDB.clientPublicKey);
+					return res.status(200).send({
+						message: 'Successfully changed password'
+					});
+				}
 
-      // compare server and client shared keys
-      if (server.checkClientProof(clientProof)) {
-        // change password
-
-        await User.findByIdAndUpdate(
-          req.user._id.toString(),
-          {
-            encryptionVersion: 2,
-            protectedKey,
-            protectedKeyIV,
-            protectedKeyTag,
-            encryptedPrivateKey,
-            iv: encryptedPrivateKeyIV,
-            tag: encryptedPrivateKeyTag,
-            salt,
-            verifier
-          },
-          {
-            new: true
-          }
-        );
-
-        if (req.authData.actor.type === ActorType.USER && req.authData.tokenVersionId) {
-          await clearTokens(req.authData.tokenVersionId);
-        }
-
-        // clear httpOnly cookie
-
-        res.cookie("jid", "", {
-          httpOnly: true,
-          path: "/",
-          sameSite: "strict",
-          secure: (await getHttpsEnabled()) as boolean
-        });
-
-        return res.status(200).send({
-          message: "Successfully changed password"
-        });
-      }
-
-      return res.status(400).send({
-        error: "Failed to change password. Try again?"
-      });
-    }
-  );
+				return res.status(400).send({
+					error: 'Failed to change password. Try again?'
+				});
+			}
+		);
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			error: 'Failed to change password. Try again?'
+		});
+	}
 };
 
 /**
@@ -250,120 +236,128 @@ export const changePassword = async (req: Request, res: Response) => {
  * @returns
  */
 export const createBackupPrivateKey = async (req: Request, res: Response) => {
-  // create/change backup private key
-  // requires verifying [clientProof] as part of second step of SRP protocol
-  // as initiated in /srp1
-  const {
-    body: { clientProof, encryptedPrivateKey, salt, verifier, iv, tag }
-  } = await validateRequest(reqValidator.CreateBackupPrivateKeyV1, req);
-  const user = await User.findOne({
-    email: req.user.email
-  }).select("+salt +verifier");
+	// create/change backup private key
+	// requires verifying [clientProof] as part of second step of SRP protocol
+	// as initiated in /srp1
 
-  if (!user) throw new Error("Failed to find user");
+	try {
+		const { clientProof, encryptedPrivateKey, iv, tag, salt, verifier } =
+			req.body;
+		const user = await User.findOne({
+			email: req.user.email
+		}).select('+salt +verifier');
 
-  const loginSRPDetailFromDB = await LoginSRPDetail.findOneAndDelete({ email: req.user.email });
+		if (!user) throw new Error('Failed to find user');
 
-  if (!loginSRPDetailFromDB) {
-    return BadRequestError(
-      Error(
-        "It looks like some details from the first login are not found. Please try login one again"
-      )
-    );
-  }
+		const server = new jsrp.server();
+		server.init(
+			{
+				salt: user.salt,
+				verifier: user.verifier,
+				b: clientPublicKeys[req.user.email].serverBInt
+			},
+			async () => {
+				server.setClientPublicKey(
+					clientPublicKeys[req.user.email].clientPublicKey
+				);
 
-  const server = new jsrp.server();
-  server.init(
-    {
-      salt: user.salt,
-      verifier: user.verifier,
-      b: loginSRPDetailFromDB.serverBInt
-    },
-    async () => {
-      server.setClientPublicKey(loginSRPDetailFromDB.clientPublicKey);
+				// compare server and client shared keys
+				if (server.checkClientProof(clientProof)) {
+					// create new or replace backup private key
 
-      // compare server and client shared keys
-      if (server.checkClientProof(clientProof)) {
-        // create new or replace backup private key
+					const backupPrivateKey = await BackupPrivateKey.findOneAndUpdate(
+						{ user: req.user._id },
+						{
+							user: req.user._id,
+							encryptedPrivateKey,
+							iv,
+							tag,
+							salt,
+							verifier
+						},
+						{ upsert: true, new: true }
+					).select('+user, encryptedPrivateKey');
 
-        const backupPrivateKey = await BackupPrivateKey.findOneAndUpdate(
-          { user: req.user._id },
-          {
-            user: req.user._id,
-            encryptedPrivateKey,
-            iv,
-            tag,
-            salt,
-            verifier
-          },
-          { upsert: true, new: true }
-        ).select("+user, encryptedPrivateKey");
+					// issue tokens
+					return res.status(200).send({
+						message: 'Successfully updated backup private key',
+						backupPrivateKey
+					});
+				}
 
-        // issue tokens
-        return res.status(200).send({
-          message: "Successfully updated backup private key",
-          backupPrivateKey
-        });
-      }
-
-      return res.status(400).send({
-        message: "Failed to update backup private key"
-      });
-    }
-  );
+				return res.status(400).send({
+					message: 'Failed to update backup private key'
+				});
+			}
+		);
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to update backup private key'
+		});
+	}
 };
 
 /**
  * Return backup private key for user
- * @param req
- * @param res
- * @returns
+ * @param req 
+ * @param res 
+ * @returns 
  */
 export const getBackupPrivateKey = async (req: Request, res: Response) => {
-  const backupPrivateKey = await BackupPrivateKey.findOne({
-    user: req.user._id
-  }).select("+encryptedPrivateKey +iv +tag");
-
-  if (!backupPrivateKey) throw new Error("Failed to find backup private key");
-
-  return res.status(200).send({
-    backupPrivateKey
-  });
-};
+	let backupPrivateKey;
+	try {
+		backupPrivateKey = await BackupPrivateKey.findOne({
+			user: req.user._id
+		}).select('+encryptedPrivateKey +iv +tag');
+		
+		if (!backupPrivateKey) throw new Error('Failed to find backup private key');
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email});
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get backup private key'
+		});
+	}
+	
+	return res.status(200).send({
+		backupPrivateKey
+	});
+}
 
 export const resetPassword = async (req: Request, res: Response) => {
-  const {
-    body: {
-      encryptedPrivateKey,
-      protectedKeyTag,
-      protectedKey,
-      protectedKeyIV,
-      salt,
-      verifier,
-      encryptedPrivateKeyIV,
-      encryptedPrivateKeyTag
-    }
-  } = await validateRequest(reqValidator.ResetPasswordV1, req);
+	try {
+		const {
+			encryptedPrivateKey,
+			iv,
+			tag,
+			salt,
+			verifier,
+		} = req.body;
 
-  await User.findByIdAndUpdate(
-    req.user._id.toString(),
-    {
-      encryptionVersion: 2,
-      protectedKey,
-      protectedKeyIV,
-      protectedKeyTag,
-      encryptedPrivateKey,
-      iv: encryptedPrivateKeyIV,
-      tag: encryptedPrivateKeyTag,
-      salt,
-      verifier
-    },
-    {
-      new: true
-    }
-  );
-
-  return res.status(200).send({
-    message: "Successfully reset password"
-  });
-};
+		await User.findByIdAndUpdate(
+			req.user._id.toString(),
+			{
+				encryptedPrivateKey,
+				iv,
+				tag,
+				salt,
+				verifier
+			},
+			{
+				new: true
+			}
+		);	
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email});
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get backup private key'
+		});	
+	}
+	
+	return res.status(200).send({
+		message: 'Successfully reset password'
+	});
+}

backend/src/controllers/v1/secretController.ts

@@ -1,30 +1,30 @@
-import { Request, Response } from "express";
-import { Types } from "mongoose";
-import { Key } from "../../models";
+import { Request, Response } from 'express';
+import * as Sentry from '@sentry/node';
+import { Key, Secret } from '../../models';
 import {
-  pullSecrets as pull,
-  v1PushSecrets as push,
-  reformatPullSecrets
-} from "../../helpers/secret";
-import { pushKeys } from "../../helpers/key";
-import { eventPushSecrets } from "../../events";
-import { EventService } from "../../services";
-import { TelemetryService } from "../../services";
+	v1PushSecrets as push,
+	pullSecrets as pull,
+	reformatPullSecrets
+} from '../../helpers/secret';
+import { pushKeys } from '../../helpers/key';
+import { eventPushSecrets } from '../../events';
+import { EventService } from '../../services';
+import { postHogClient } from '../../services';
 
 interface PushSecret {
-  ciphertextKey: string;
-  ivKey: string;
-  tagKey: string;
-  hashKey: string;
-  ciphertextValue: string;
-  ivValue: string;
-  tagValue: string;
-  hashValue: string;
-  ciphertextComment: string;
-  ivComment: string;
-  tagComment: string;
-  hashComment: string;
-  type: "shared" | "personal";
+	ciphertextKey: string;
+	ivKey: string;
+	tagKey: string;
+	hashKey: string;
+	ciphertextValue: string;
+	ivValue: string;
+	tagValue: string;
+	hashValue: string;
+	ciphertextComment: string;
+	ivComment: string;
+	tagComment: string;
+	hashComment: string;
+	type: 'shared' | 'personal';
 }
 
 /**
@@ -35,59 +35,69 @@ interface PushSecret {
  * @returns
  */
 export const pushSecrets = async (req: Request, res: Response) => {
-  // upload (encrypted) secrets to workspace with id [workspaceId]
-  const postHogClient = await TelemetryService.getPostHogClient();
-  let { secrets }: { secrets: PushSecret[] } = req.body;
-  const { keys, environment, channel } = req.body;
-  const { workspaceId } = req.params;
+	// upload (encrypted) secrets to workspace with id [workspaceId]
 
-  // validate environment
-  const workspaceEnvs = req.membership.workspace.environments;
-  if (!workspaceEnvs.find(({ slug }: { slug: string }) => slug === environment)) {
-    throw new Error("Failed to validate environment");
-  }
+	try {
+		let { secrets }: { secrets: PushSecret[] } = req.body;
+		const { keys, environment, channel } = req.body;
+		const { workspaceId } = req.params;
 
-  // sanitize secrets
-  secrets = secrets.filter((s: PushSecret) => s.ciphertextKey !== "" && s.ciphertextValue !== "");
+		// validate environment
+		const workspaceEnvs = req.membership.workspace.environments;
+		if (!workspaceEnvs.find(({ slug }: { slug: string }) => slug === environment)) {
+			throw new Error('Failed to validate environment');
+		}
 
-  await push({
-    userId: req.user._id,
-    workspaceId,
-    environment,
-    secrets
-  });
+		// sanitize secrets
+		secrets = secrets.filter(
+			(s: PushSecret) => s.ciphertextKey !== '' && s.ciphertextValue !== ''
+		);
 
-  await pushKeys({
-    userId: req.user._id,
-    workspaceId,
-    keys
-  });
+		await push({
+			userId: req.user._id,
+			workspaceId,
+			environment,
+			secrets
+		});
 
-  if (postHogClient) {
-    postHogClient.capture({
-      event: "secrets pushed",
-      distinctId: req.user.email,
-      properties: {
-        numberOfSecrets: secrets.length,
-        environment,
-        workspaceId,
-        channel: channel ? channel : "cli"
-      }
-    });
-  }
+		await pushKeys({
+			userId: req.user._id,
+			workspaceId,
+			keys
+		});
+		
+		
+		if (postHogClient) {
+			postHogClient.capture({
+				event: 'secrets pushed',
+				distinctId: req.user.email,
+				properties: {
+					numberOfSecrets: secrets.length,
+					environment,
+					workspaceId,
+					channel: channel ? channel : 'cli'
+				}
+			});
+		}
 
-  // trigger event - push secrets
-  EventService.handleEvent({
-    event: eventPushSecrets({
-      workspaceId: new Types.ObjectId(workspaceId),
-      environment,
-      secretPath: "/"
-    })
-  });
+		// trigger event - push secrets
+		EventService.handleEvent({
+			event: eventPushSecrets({
+				workspaceId
+			})
+		});
 
-  return res.status(200).send({
-    message: "Successfully uploaded workspace secrets"
-  });
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to upload workspace secrets'
+		});
+	}
+
+	return res.status(200).send({
+		message: 'Successfully uploaded workspace secrets'
+	});
 };
 
 /**
@@ -98,56 +108,63 @@ export const pushSecrets = async (req: Request, res: Response) => {
  * @returns
  */
 export const pullSecrets = async (req: Request, res: Response) => {
-  let secrets;
+	let secrets;
+	let key;
+	try {
+		const environment: string = req.query.environment as string;
+		const channel: string = req.query.channel as string;
+		const { workspaceId } = req.params;
 
-  const postHogClient = await TelemetryService.getPostHogClient();
-  const environment: string = req.query.environment as string;
-  const channel: string = req.query.channel as string;
-  const { workspaceId } = req.params;
+		// validate environment
+		const workspaceEnvs = req.membership.workspace.environments;
+		if (!workspaceEnvs.find(({ slug }: { slug: string }) => slug === environment)) {
+			throw new Error('Failed to validate environment');
+		}
 
-  // validate environment
-  const workspaceEnvs = req.membership.workspace.environments;
-  if (!workspaceEnvs.find(({ slug }: { slug: string }) => slug === environment)) {
-    throw new Error("Failed to validate environment");
-  }
+		secrets = await pull({
+			userId: req.user._id.toString(),
+			workspaceId,
+			environment,
+			channel: channel ? channel : 'cli',
+			ipAddress: req.ip
+		});
 
-  secrets = await pull({
-    userId: req.user._id.toString(),
-    workspaceId,
-    environment,
-    channel: channel ? channel : "cli",
-    ipAddress: req.realIP
-  });
+		key = await Key.findOne({
+			workspace: workspaceId,
+			receiver: req.user._id
+		})
+			.sort({ createdAt: -1 })
+			.populate('sender', '+publicKey');
+		
+		if (channel !== 'cli') {
+			secrets = reformatPullSecrets({ secrets });
+		}
 
-  const key = await Key.findOne({
-    workspace: workspaceId,
-    receiver: req.user._id
-  })
-    .sort({ createdAt: -1 })
-    .populate("sender", "+publicKey");
+		if (postHogClient) {
+			// capture secrets pushed event in production
+			postHogClient.capture({
+				distinctId: req.user.email,
+				event: 'secrets pulled',
+				properties: {
+					numberOfSecrets: secrets.length,
+					environment,
+					workspaceId,
+					channel: channel ? channel : 'cli'
+				}
+			});
+		}
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to pull workspace secrets'
+		});
+	}
 
-  if (channel !== "cli") {
-    secrets = reformatPullSecrets({ secrets });
-  }
-
-  if (postHogClient) {
-    // capture secrets pushed event in production
-    postHogClient.capture({
-      distinctId: req.user.email,
-      event: "secrets pulled",
-      properties: {
-        numberOfSecrets: secrets.length,
-        environment,
-        workspaceId,
-        channel: channel ? channel : "cli"
-      }
-    });
-  }
-
-  return res.status(200).send({
-    secrets,
-    key
-  });
+	return res.status(200).send({
+		secrets,
+		key
+	});
 };
 
 /**
@@ -159,51 +176,60 @@ export const pullSecrets = async (req: Request, res: Response) => {
  * @returns
  */
 export const pullSecretsServiceToken = async (req: Request, res: Response) => {
-  const postHogClient = await TelemetryService.getPostHogClient();
-  const environment: string = req.query.environment as string;
-  const channel: string = req.query.channel as string;
-  const { workspaceId } = req.params;
+	let secrets;
+	let key;
+	try {
+		const environment: string = req.query.environment as string;
+		const channel: string = req.query.channel as string;
+		const { workspaceId } = req.params;
 
-  // validate environment
-  const workspaceEnvs = req.membership.workspace.environments;
-  if (!workspaceEnvs.find(({ slug }: { slug: string }) => slug === environment)) {
-    throw new Error("Failed to validate environment");
-  }
+		// validate environment
+		const workspaceEnvs = req.membership.workspace.environments;
+		if (!workspaceEnvs.find(({ slug }: { slug: string }) => slug === environment)) {
+			throw new Error('Failed to validate environment');
+		}
 
-  const secrets = await pull({
-    userId: req.serviceToken.user._id.toString(),
-    workspaceId,
-    environment,
-    channel: "cli",
-    ipAddress: req.realIP
-  });
+		secrets = await pull({
+			userId: req.serviceToken.user._id.toString(),
+			workspaceId,
+			environment,
+			channel: 'cli',
+			ipAddress: req.ip
+		});
 
-  const key = {
-    encryptedKey: req.serviceToken.encryptedKey,
-    nonce: req.serviceToken.nonce,
-    sender: {
-      publicKey: req.serviceToken.publicKey
-    },
-    receiver: req.serviceToken.user,
-    workspace: req.serviceToken.workspace
-  };
+		key = {
+			encryptedKey: req.serviceToken.encryptedKey,
+			nonce: req.serviceToken.nonce,
+			sender: {
+				publicKey: req.serviceToken.publicKey
+			},
+			receiver: req.serviceToken.user,
+			workspace: req.serviceToken.workspace
+		};
 
-  if (postHogClient) {
-    // capture secrets pulled event in production
-    postHogClient.capture({
-      distinctId: req.serviceToken.user.email,
-      event: "secrets pulled",
-      properties: {
-        numberOfSecrets: secrets.length,
-        environment,
-        workspaceId,
-        channel: channel ? channel : "cli"
-      }
-    });
-  }
+		if (postHogClient) {
+			// capture secrets pulled event in production
+			postHogClient.capture({
+				distinctId: req.serviceToken.user.email,
+				event: 'secrets pulled',
+				properties: {
+					numberOfSecrets: secrets.length,
+					environment,
+					workspaceId,
+					channel: channel ? channel : 'cli'
+				}
+			});
+		}
+	} catch (err) {
+		Sentry.setUser({ email: req.serviceToken.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to pull workspace secrets'
+		});
+	}
 
-  return res.status(200).send({
-    secrets: reformatPullSecrets({ secrets }),
-    key
-  });
-};
+	return res.status(200).send({
+		secrets: reformatPullSecrets({ secrets }),
+		key
+	});
+};

backend/src/controllers/v1/secretImpsController.ts

@@ -1,705 +0,0 @@
-import { Request, Response } from "express";
-import { isValidScope } from "../../helpers";
-import { Folder, IServiceTokenData, SecretImport, ServiceTokenData } from "../../models";
-import { getAllImportedSecrets } from "../../services/SecretImportService";
-import { getFolderByPath, getFolderWithPathFromId } from "../../services/FolderService";
-import {
-  BadRequestError,
-  ResourceNotFoundError,
-  UnauthorizedRequestError
-} from "../../utils/errors";
-import { EEAuditLogService } from "../../ee/services";
-import { EventType } from "../../ee/models";
-import { validateRequest } from "../../helpers/validation";
-import * as reqValidator from "../../validation/secretImports";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSub,
-  getUserProjectPermissions
-} from "../../ee/services/ProjectRoleService";
-import { ForbiddenError, subject } from "@casl/ability";
-
-export const createSecretImp = async (req: Request, res: Response) => {
-  /* 
-    #swagger.summary = 'Create secret import'
-    #swagger.description = 'Create a new secret import for a specified workspace and environment'
-
-    #swagger.requestBody = {
-        content: {
-            "application/json": {
-                "schema": {
-                    "type": "object",
-                    "properties": {
-                        "workspaceId": {
-                            "type": "string",
-                            "description": "ID of the workspace where the secret import will be created",
-                            "example": "someWorkspaceId"
-                        },
-                        "environment": {
-                            "type": "string",
-                            "description": "Environment to import to",
-                            "example": "production"
-                        },
-                        "folderId": {
-                            "type": "string",
-                            "description": "Folder ID. Use root for the root folder.",
-                            "example": "my_folder"
-                        },
-                        "secretImport": {
-                            "type": "object",
-                            "properties": {
-                              "environment": {
-                                "type": "string",
-                                "description": "Import from environment",
-                                "example": "development"
-                              },
-                              "secretPath": {
-                                "type": "string",
-                                "description": "Import from secret path",
-                                "example": "/user/oauth"
-                              }
-                            }
-                        }
-                    },
-                    "required": ["workspaceId", "environment", "folderName"]
-                }
-            }
-        }
-    }
-
-    #swagger.responses[200] = {
-        content: {
-            "application/json": {
-                "schema": {
-                    "type": "object",
-                    "properties": {
-                        "message": {
-                            "type": "string",
-                            "example": "successfully created secret import"
-                        }
-                    },
-                    "description": "Confirmation of secret import creation"
-                }
-            }
-        }
-    }
-    #swagger.responses[400] = {
-        description: "Bad Request. For example, 'Secret import already exist'"
-    }
-    #swagger.responses[401] = {
-        description: "Unauthorized request. For example, 'Folder Permission Denied'"
-    }
-    #swagger.responses[404] = {
-        description: "Resource Not Found. For example, 'Failed to find folder'"
-    }   
-  */
-
-  const {
-    body: { workspaceId, environment, directory, secretImport }
-  } = await validateRequest(reqValidator.CreateSecretImportV1, req);
-
-  if (req.authData.authPayload instanceof ServiceTokenData) {
-    // root check
-    const isValidScopeAccess = isValidScope(req.authData.authPayload, environment, directory);
-    if (!isValidScopeAccess) {
-      throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
-    }
-  } else {
-    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Create,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath: directory })
-    );
-  }
-
-  const folders = await Folder.findOne({
-    workspace: workspaceId,
-    environment
-  }).lean();
-
-  if (!folders && directory !== "/")
-    throw ResourceNotFoundError({ message: "Failed to find folder" });
-
-  let folderId = "root";
-  if (folders) {
-    const folder = getFolderByPath(folders.nodes, directory);
-    if (!folder) throw BadRequestError({ message: "Folder not found" });
-    folderId = folder.id;
-  }
-
-  const importSecDoc = await SecretImport.findOne({
-    workspace: workspaceId,
-    environment,
-    folderId
-  });
-
-  if (!importSecDoc) {
-    const doc = new SecretImport({
-      workspace: workspaceId,
-      environment,
-      folderId,
-      imports: [{ environment: secretImport.environment, secretPath: secretImport.secretPath }]
-    });
-
-    await doc.save();
-    await EEAuditLogService.createAuditLog(
-      req.authData,
-      {
-        type: EventType.CREATE_SECRET_IMPORT,
-        metadata: {
-          secretImportId: doc._id.toString(),
-          folderId: doc.folderId.toString(),
-          importFromEnvironment: secretImport.environment,
-          importFromSecretPath: secretImport.secretPath,
-          importToEnvironment: environment,
-          importToSecretPath: directory
-        }
-      },
-      {
-        workspaceId: doc.workspace
-      }
-    );
-    return res.status(200).json({ message: "successfully created secret import" });
-  }
-
-  const doesImportExist = importSecDoc.imports.find(
-    (el) => el.environment === secretImport.environment && el.secretPath === secretImport.secretPath
-  );
-  if (doesImportExist) {
-    throw BadRequestError({ message: "Secret import already exist" });
-  }
-
-  importSecDoc.imports.push({
-    environment: secretImport.environment,
-    secretPath: secretImport.secretPath
-  });
-  await importSecDoc.save();
-
-  await EEAuditLogService.createAuditLog(
-    req.authData,
-    {
-      type: EventType.CREATE_SECRET_IMPORT,
-      metadata: {
-        secretImportId: importSecDoc._id.toString(),
-        folderId: importSecDoc.folderId.toString(),
-        importFromEnvironment: secretImport.environment,
-        importFromSecretPath: secretImport.secretPath,
-        importToEnvironment: environment,
-        importToSecretPath: directory
-      }
-    },
-    {
-      workspaceId: importSecDoc.workspace
-    }
-  );
-  return res.status(200).json({ message: "successfully created secret import" });
-};
-
-// to keep the ordering, you must pass all the imports in here not the only updated one
-// this is because the order decide which import gets overriden
-
-/**
- * Update secret import
- * @param req
- * @param res
- * @returns
- */
-export const updateSecretImport = async (req: Request, res: Response) => {
-  /*
-    #swagger.summary = 'Update a secret import'
-    #swagger.description = 'Updates an existing secret import based on the provided ID and new import details'
-
-    #swagger.parameters['id'] = {
-        in: 'path',
-        description: 'ID of the secret import to be updated',
-        required: true,
-        type: 'string',
-        example: 'import12345'
-    }
-
-    #swagger.requestBody = {
-        content: {
-            "application/json": {
-                "schema": {
-                    "type": "object",
-                    "properties": {
-                        "secretImports": {
-                            "type": "array",
-                            "description": "List of new secret imports",
-                            "items": {
-                                "type": "object",
-                                "properties": {
-                                    "environment": {
-                                        "type": "string",
-                                        "description": "Environment of the secret import",
-                                        "example": "production"
-                                    },
-                                    "secretPath": {
-                                        "type": "string",
-                                        "description": "Path of the secret import",
-                                        "example": "/path/to/secret"
-                                    }
-                                },
-                                "required": ["environment", "secretPath"]
-                            }
-                        }
-                    },
-                    "required": ["secretImports"]
-                }
-            }
-        }
-    }
-
-    #swagger.responses[200] = {
-        description: 'Successfully updated the secret import',
-        content: {
-            "application/json": {
-                "schema": {
-                    "type": "object",
-                    "properties": {
-                        "message": {
-                            "type": "string",
-                            "example": "successfully updated secret import"
-                        }
-                    }
-                }
-            }
-        }
-    }
-
-    #swagger.responses[400] = {
-        description: 'Bad Request - Import not found',
-    }
-
-    #swagger.responses[403] = {
-        description: 'Forbidden access due to insufficient permissions',
-    }
-
-    #swagger.responses[401] = {
-        description: 'Unauthorized access due to invalid token or scope',
-    }
-  */
-  const {
-    body: { secretImports },
-    params: { id }
-  } = await validateRequest(reqValidator.UpdateSecretImportV1, req);
-
-  const importSecDoc = await SecretImport.findById(id);
-  if (!importSecDoc) {
-    throw BadRequestError({ message: "Import not found" });
-  }
-
-  // check for service token validity
-  const folders = await Folder.findOne({
-    workspace: importSecDoc.workspace,
-    environment: importSecDoc.environment
-  }).lean();
-
-  let secretPath = "/";
-  if (folders) {
-    const { folderPath } = getFolderWithPathFromId(folders.nodes, importSecDoc.folderId);
-    secretPath = folderPath;
-  }
-
-  if (req.authData.authPayload instanceof ServiceTokenData) {
-    // token permission check
-    const isValidScopeAccess = isValidScope(
-      req.authData.authPayload,
-      importSecDoc.environment,
-      secretPath
-    );
-    if (!isValidScopeAccess) {
-      throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
-    }
-  } else {
-    // non token entry check
-    const { permission } = await getUserProjectPermissions(
-      req.user._id,
-      importSecDoc.workspace.toString()
-    );
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Edit,
-      subject(ProjectPermissionSub.Secrets, {
-        environment: importSecDoc.environment,
-        secretPath
-      })
-    );
-  }
-
-  const orderBefore = importSecDoc.imports;
-  importSecDoc.imports = secretImports;
-
-  await importSecDoc.save();
-
-  await EEAuditLogService.createAuditLog(
-    req.authData,
-    {
-      type: EventType.UPDATE_SECRET_IMPORT,
-      metadata: {
-        importToEnvironment: importSecDoc.environment,
-        importToSecretPath: secretPath,
-        secretImportId: importSecDoc._id.toString(),
-        folderId: importSecDoc.folderId.toString(),
-        orderBefore,
-        orderAfter: secretImports
-      }
-    },
-    {
-      workspaceId: importSecDoc.workspace
-    }
-  );
-  return res.status(200).json({ message: "successfully updated secret import" });
-};
-
-/**
- * Delete secret import
- * @param req
- * @param res
- * @returns
- */
-export const deleteSecretImport = async (req: Request, res: Response) => {
-  /* 
-    #swagger.summary = 'Delete secret import'
-    #swagger.description = 'Delete secret import'
-
-    #swagger.parameters['id'] = {
-        in: 'path',
-        description: 'ID of the secret import',
-        required: true,
-        type: 'string',
-        example: '12345abcde'
-    }
-
-    #swagger.requestBody = {
-        content: {
-            "application/json": {
-                "schema": {
-                    "type": "object",
-                    "properties": {
-                        "secretImportEnv": {
-                            "type": "string",
-                            "description": "Import from environment",
-                            "example": "someWorkspaceId"
-                        },
-                        "secretImportPath": {
-                            "type": "string",
-                            "description": "Import from secret path",
-                            "example": "production"
-                        }
-                    },
-                    "required": ["id", "secretImportEnv", "secretImportPath"]
-                }
-            }
-        }
-    }
-
-    #swagger.responses[200] = {
-        content: {
-            "application/json": {
-                "schema": {
-                    "type": "object",
-                    "properties": {
-                        "message": {
-                            "type": "string",
-                            "example": "successfully delete secret import"
-                        }
-                    },
-                    "description": "Confirmation of secret import deletion"
-                }
-            }
-        }
-    }
-  */
-  const {
-    params: { id },
-    body: { secretImportEnv, secretImportPath }
-  } = await validateRequest(reqValidator.DeleteSecretImportV1, req);
-
-  const importSecDoc = await SecretImport.findById(id);
-  if (!importSecDoc) {
-    throw BadRequestError({ message: "Import not found" });
-  }
-
-  // check for service token validity
-  const folders = await Folder.findOne({
-    workspace: importSecDoc.workspace,
-    environment: importSecDoc.environment
-  }).lean();
-
-  let secretPath = "/";
-  if (folders) {
-    const { folderPath } = getFolderWithPathFromId(folders.nodes, importSecDoc.folderId);
-    secretPath = folderPath;
-  }
-
-  if (req.authData.authPayload instanceof ServiceTokenData) {
-    const isValidScopeAccess = isValidScope(
-      req.authData.authPayload,
-      importSecDoc.environment,
-      secretPath
-    );
-    if (!isValidScopeAccess) {
-      throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
-    }
-  } else {
-    const { permission } = await getUserProjectPermissions(
-      req.user._id,
-      importSecDoc.workspace.toString()
-    );
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Delete,
-      subject(ProjectPermissionSub.Secrets, {
-        environment: importSecDoc.environment,
-        secretPath
-      })
-    );
-  }
-  importSecDoc.imports = importSecDoc.imports.filter(
-    ({ environment, secretPath }) =>
-      !(environment === secretImportEnv && secretPath === secretImportPath)
-  );
-  await importSecDoc.save();
-
-  await EEAuditLogService.createAuditLog(
-    req.authData,
-    {
-      type: EventType.DELETE_SECRET_IMPORT,
-      metadata: {
-        secretImportId: importSecDoc._id.toString(),
-        folderId: importSecDoc.folderId.toString(),
-        importFromEnvironment: secretImportEnv,
-        importFromSecretPath: secretImportPath,
-        importToEnvironment: importSecDoc.environment,
-        importToSecretPath: secretPath
-      }
-    },
-    {
-      workspaceId: importSecDoc.workspace
-    }
-  );
-
-  return res.status(200).json({ message: "successfully delete secret import" });
-};
-
-/**
- * Get secret imports
- * @param req
- * @param res
- * @returns
- */
-export const getSecretImports = async (req: Request, res: Response) => {
-  /*
-    #swagger.summary = 'Retrieve secret imports'
-    #swagger.description = 'Fetches the secret imports based on the workspaceId, environment, and folderId'
-
-    #swagger.parameters['workspaceId'] = {
-        in: 'query',
-        description: 'ID of the workspace of secret imports to get',
-        required: true,
-        type: 'string',
-        example: 'workspace12345'
-    }
-
-    #swagger.parameters['environment'] = {
-        in: 'query',
-        description: 'Environment of secret imports to get',
-        required: true,
-        type: 'string',
-        example: 'production'
-    }
-
-    #swagger.parameters['folderId'] = {
-        in: 'query',
-        description: 'ID of the folder containing the secret imports. Default: root',
-        required: false,
-        type: 'string',
-        example: 'folder12345'
-    }
-
-    #swagger.responses[200] = {
-        description: 'Successfully retrieved secret import',
-        content: {
-            "application/json": {
-                "schema": {
-                    "type": "object",
-                    "properties": {
-                        "secretImport": {
-                            "type": "object",
-                            "description": "Details of a secret import"
-                        }
-                    }
-                }
-            }
-        }
-    }
-
-    #swagger.responses[403] = {
-        description: 'Forbidden access due to insufficient permissions',
-    }
-
-    #swagger.responses[401] = {
-        description: 'Unauthorized access due to invalid token or scope',
-    }
-  */
-  const {
-    query: { workspaceId, environment, directory }
-  } = await validateRequest(reqValidator.GetSecretImportsV1, req);
-
-  if (req.authData.authPayload instanceof ServiceTokenData) {
-    const isValidScopeAccess = isValidScope(req.authData.authPayload, environment, directory);
-    if (!isValidScopeAccess) {
-      throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
-    }
-  } else {
-    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, {
-        environment,
-        secretPath: directory
-      })
-    );
-  }
-
-  const folders = await Folder.findOne({
-    workspace: workspaceId,
-    environment
-  }).lean();
-  if (!folders && directory !== "/") throw BadRequestError({ message: "Folder not found" });
-
-  let folderId = "root";
-  if (folders) {
-    const folder = getFolderByPath(folders.nodes, directory);
-    if (!folder) throw BadRequestError({ message: "Folder not found" });
-    folderId = folder.id;
-  }
-
-  const importSecDoc = await SecretImport.findOne({
-    workspace: workspaceId,
-    environment,
-    folderId
-  });
-
-  if (!importSecDoc) {
-    return res.status(200).json({ secretImport: {} });
-  }
-
-  return res.status(200).json({ secretImport: importSecDoc });
-};
-
-/**
- * Get all secret imports
- * @param req
- * @param res
- * @returns
- */
-export const getAllSecretsFromImport = async (req: Request, res: Response) => {
-  const {
-    query: { workspaceId, environment, directory }
-  } = await validateRequest(reqValidator.GetAllSecretsFromImportV1, req);
-
-  if (req.authData.authPayload instanceof ServiceTokenData) {
-    // check for service token validity
-    const isValidScopeAccess = isValidScope(req.authData.authPayload, environment, directory);
-    if (!isValidScopeAccess) {
-      throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
-    }
-  } else {
-    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, {
-        environment,
-        secretPath: directory
-      })
-    );
-  }
-
-  const folders = await Folder.findOne({
-    workspace: workspaceId,
-    environment
-  }).lean();
-  if (!folders && directory !== "/") throw BadRequestError({ message: "Folder not found" });
-
-  let folderId = "root";
-  if (folders) {
-    const folder = getFolderByPath(folders.nodes, directory);
-    if (!folder) throw BadRequestError({ message: "Folder not found" });
-    folderId = folder.id;
-  }
-
-  const importSecDoc = await SecretImport.findOne({
-    workspace: workspaceId,
-    environment,
-    folderId
-  });
-
-  if (!importSecDoc) {
-    return res.status(200).json({ secrets: [] });
-  }
-
-  let secretPath = "/";
-  if (folders) {
-    const { folderPath } = getFolderWithPathFromId(folders.nodes, importSecDoc.folderId);
-    secretPath = folderPath;
-  }
-
-  let permissionCheckFn: (env: string, secPath: string) => boolean; // used to pass as callback function to import secret
-  if (req.authData.authPayload instanceof ServiceTokenData) {
-    // check for service token validity
-    const isValidScopeAccess = isValidScope(
-      req.authData.authPayload,
-      importSecDoc.environment,
-      secretPath
-    );
-    if (!isValidScopeAccess) {
-      throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
-    }
-    permissionCheckFn = (env: string, secPath: string) =>
-      isValidScope(req.authData.authPayload as IServiceTokenData, env, secPath);
-  } else {
-    const { permission } = await getUserProjectPermissions(
-      req.user._id,
-      importSecDoc.workspace.toString()
-    );
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, {
-        environment: importSecDoc.environment,
-        secretPath
-      })
-    );
-    permissionCheckFn = (env: string, secPath: string) =>
-      permission.can(
-        ProjectPermissionActions.Read,
-        subject(ProjectPermissionSub.Secrets, {
-          environment: env,
-          secretPath: secPath
-        })
-      );
-  }
-
-  await EEAuditLogService.createAuditLog(
-    req.authData,
-    {
-      type: EventType.GET_SECRET_IMPORTS,
-      metadata: {
-        environment,
-        secretImportId: importSecDoc._id.toString(),
-        folderId,
-        numberOfImports: importSecDoc.imports.length
-      }
-    },
-    {
-      workspaceId: importSecDoc.workspace
-    }
-  );
-
-  const secrets = await getAllImportedSecrets(
-    workspaceId,
-    environment,
-    folderId,
-    permissionCheckFn
-  );
-  return res.status(200).json({ secrets });
-};

backend/src/controllers/v1/secretScanningController.ts

@@ -1,183 +0,0 @@
-import { Request, Response } from "express";
-import {
-  GitAppInstallationSession,
-  GitAppOrganizationInstallation,
-  GitRisks
-} from "../../ee/models";
-import crypto from "crypto";
-import { Types } from "mongoose";
-import { OrganizationNotFoundError, UnauthorizedRequestError } from "../../utils/errors";
-import { scanGithubFullRepoForSecretLeaks } from "../../queues/secret-scanning/githubScanFullRepository";
-import { getSecretScanningGitAppId, getSecretScanningPrivateKey } from "../../config";
-import {
-  STATUS_RESOLVED_FALSE_POSITIVE,
-  STATUS_RESOLVED_NOT_REVOKED,
-  STATUS_RESOLVED_REVOKED
-} from "../../ee/models/gitRisks";
-import { ProbotOctokit } from "probot";
-import { Organization } from "../../models";
-import { validateRequest } from "../../helpers/validation";
-import * as reqValidator from "../../validation/secretScanning";
-import {
-  OrgPermissionActions,
-  OrgPermissionSubjects,
-  getUserOrgPermissions
-} from "../../ee/services/RoleService";
-import { ForbiddenError } from "@casl/ability";
-
-export const createInstallationSession = async (req: Request, res: Response) => {
-  const sessionId = crypto.randomBytes(16).toString("hex");
-  const {
-    params: { organizationId }
-  } = await validateRequest(reqValidator.CreateInstalLSessionv1, req);
-
-  const organization = await Organization.findById(organizationId);
-  if (!organization) {
-    throw OrganizationNotFoundError({
-      message: "Failed to find organization"
-    });
-  }
-
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Create,
-    OrgPermissionSubjects.SecretScanning
-  );
-
-  await GitAppInstallationSession.findByIdAndUpdate(
-    organization,
-    {
-      organization: organization.id,
-      sessionId: sessionId,
-      user: new Types.ObjectId(req.user._id)
-    },
-    { upsert: true }
-  ).lean();
-
-  res.send({
-    sessionId: sessionId
-  });
-};
-
-export const linkInstallationToOrganization = async (req: Request, res: Response) => {
-  const {
-    body: { sessionId, installationId }
-  } = await validateRequest(reqValidator.LinkInstallationToOrgv1, req);
-
-  const installationSession = await GitAppInstallationSession.findOneAndDelete({
-    sessionId: sessionId
-  });
-  if (!installationSession) {
-    throw UnauthorizedRequestError();
-  }
-
-  const { permission } = await getUserOrgPermissions(
-    req.user._id,
-    installationSession.organization.toString()
-  );
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Edit,
-    OrgPermissionSubjects.SecretScanning
-  );
-
-  const installationLink = await GitAppOrganizationInstallation.findOneAndUpdate(
-    {
-      organizationId: installationSession.organization
-    },
-    {
-      installationId: installationId,
-      organizationId: installationSession.organization,
-      user: installationSession.user
-    },
-    {
-      upsert: true
-    }
-  ).lean();
-
-  const octokit = new ProbotOctokit({
-    auth: {
-      appId: await getSecretScanningGitAppId(),
-      privateKey: await getSecretScanningPrivateKey(),
-      installationId: installationId.toString()
-    }
-  });
-
-  const {
-    data: { repositories }
-  } = await octokit.apps.listReposAccessibleToInstallation();
-  for (const repository of repositories) {
-    scanGithubFullRepoForSecretLeaks({
-      organizationId: installationSession.organization.toString(),
-      installationId,
-      repository: { id: repository.id, fullName: repository.full_name }
-    });
-  }
-  res.json(installationLink);
-};
-
-export const getCurrentOrganizationInstallationStatus = async (req: Request, res: Response) => {
-  const { organizationId } = req.params;
-  try {
-    const appInstallation = await GitAppOrganizationInstallation.findOne({
-      organizationId: organizationId
-    }).lean();
-    if (!appInstallation) {
-      res.json({
-        appInstallationComplete: false
-      });
-    }
-
-    res.json({
-      appInstallationComplete: true
-    });
-  } catch {
-    res.json({
-      appInstallationComplete: false
-    });
-  }
-};
-
-export const getRisksForOrganization = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId }
-  } = await validateRequest(reqValidator.GetOrgRisksv1, req);
-
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Read,
-    OrgPermissionSubjects.SecretScanning
-  );
-
-  const risks = await GitRisks.find({ organization: organizationId })
-    .sort({ createdAt: -1 })
-    .lean();
-  res.json({
-    risks: risks
-  });
-};
-
-export const updateRisksStatus = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId, riskId },
-    body: { status }
-  } = await validateRequest(reqValidator.UpdateRiskStatusv1, req);
-
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Edit,
-    OrgPermissionSubjects.SecretScanning
-  );
-
-  const isRiskResolved =
-    status == STATUS_RESOLVED_FALSE_POSITIVE ||
-    status == STATUS_RESOLVED_REVOKED ||
-    status == STATUS_RESOLVED_NOT_REVOKED
-      ? true
-      : false;
-  const risk = await GitRisks.findByIdAndUpdate(riskId, {
-    status: status,
-    isResolved: isRiskResolved
-  }).lean();
-
-  res.json(risk);
-};

backend/src/controllers/v1/secretsFolderController.ts

@@ -1,663 +0,0 @@
-import { ForbiddenError, subject } from "@casl/ability";
-import { Request, Response } from "express";
-import { Types } from "mongoose";
-import { EventType, FolderVersion } from "../../ee/models";
-import { EEAuditLogService, EESecretService } from "../../ee/services";
-import { isValidScope } from "../../helpers/secrets";
-import { validateRequest } from "../../helpers/validation";
-import { Secret, ServiceTokenData } from "../../models";
-import { Folder } from "../../models/folder";
-import {
-  appendFolder,
-  getAllFolderIds,
-  getFolderByPath,
-  getFolderWithPathFromId,
-  validateFolderName
-} from "../../services/FolderService";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSub,
-  getUserProjectPermissions
-} from "../../ee/services/ProjectRoleService";
-import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
-import * as reqValidator from "../../validation/folders";
-
-const ERR_FOLDER_NOT_FOUND = BadRequestError({ message: "The folder doesn't exist" });
-
-// verify workspace id/environment
-export const createFolder = async (req: Request, res: Response) => {
-  /* 
-    #swagger.summary = 'Create a folder'
-    #swagger.description = 'Create a new folder in a specified workspace and environment'
-    
-    #swagger.security = [{
-        "apiKeyAuth": []
-    }]
-
-    #swagger.requestBody = {
-        content: {
-            "application/json": {
-                "schema": {
-                    "type": "object",
-                    "properties": {
-                        "workspaceId": {
-                            "type": "string",
-                            "description": "ID of the workspace where the folder will be created",
-                            "example": "someWorkspaceId"
-                        },
-                        "environment": {
-                            "type": "string",
-                            "description": "Environment where the folder will reside",
-                            "example": "production"
-                        },
-                        "folderName": {
-                            "type": "string",
-                            "description": "Name of the folder to be created",
-                            "example": "my_folder"
-                        },
-                        "parentFolderId": {
-                            "type": "string",
-                            "description": "ID of the parent folder under which this folder will be created. If not specified, it will be created at the root level.",
-                            "example": "someParentFolderId"
-                        }
-                    },
-                    "required": ["workspaceId", "environment", "folderName"]
-                }
-            }
-        }
-    }
-
-    #swagger.responses[200] = {
-        content: {
-            "application/json": {
-                "schema": {
-                    "type": "object",
-                    "properties": {
-                        "folder": {
-                            "type": "object",
-                            "properties": {
-                                "id": {
-                                    "type": "string",
-                                    "example": "someFolderId"
-                                },
-                                "name": {
-                                    "type": "string",
-                                    "example": "my_folder"
-                                }
-                            },
-                            "description": "Details of the created folder"
-                        }
-                    }
-                }
-            }
-        }
-    }
-    #swagger.responses[400] = {
-        description: "Bad Request. For example, 'Folder name cannot contain spaces. Only underscore and dashes'"
-    }
-    #swagger.responses[401] = {
-        description: "Unauthorized request. For example, 'Folder Permission Denied'"
-    }
-  */
-  const {
-    body: { workspaceId, environment, folderName, directory }
-  } = await validateRequest(reqValidator.CreateFolderV1, req);
-
-  if (!validateFolderName(folderName)) {
-    throw BadRequestError({
-      message: "Folder name cannot contain spaces. Only underscore and dashes"
-    });
-  }
-
-  if (req.authData.authPayload instanceof ServiceTokenData) {
-    // token check
-    const isValidScopeAccess = isValidScope(req.authData.authPayload, environment, directory);
-    if (!isValidScopeAccess) {
-      throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
-    }
-  } else {
-    // user check
-    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Create,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath: directory })
-    );
-  }
-
-  const folders = await Folder.findOne({
-    workspace: workspaceId,
-    environment
-  }).lean();
-
-  // space has no folders initialized
-  if (!folders) {
-    const folder = new Folder({
-      workspace: workspaceId,
-      environment,
-      nodes: {
-        id: "root",
-        name: "root",
-        version: 1,
-        children: []
-      }
-    });
-    const { parent, child } = appendFolder(folder.nodes, { folderName, directory });
-    await folder.save();
-    const folderVersion = new FolderVersion({
-      workspace: workspaceId,
-      environment,
-      nodes: parent
-    });
-    await folderVersion.save();
-    await EESecretService.takeSecretSnapshot({
-      workspaceId: new Types.ObjectId(workspaceId),
-      environment
-    });
-
-    await EEAuditLogService.createAuditLog(
-      req.authData,
-      {
-        type: EventType.CREATE_FOLDER,
-        metadata: {
-          environment,
-          folderId: child.id,
-          folderName,
-          folderPath: directory
-        }
-      },
-      {
-        workspaceId: new Types.ObjectId(workspaceId)
-      }
-    );
-
-    return res.json({ folder: { id: child.id, name: folderName } });
-  }
-
-  const { parent, child, hasCreated } = appendFolder(folders.nodes, { folderName, directory });
-
-  if (!hasCreated) return res.json({ folder: child });
-
-  await Folder.findByIdAndUpdate(folders._id, folders);
-
-  const folderVersion = new FolderVersion({
-    workspace: workspaceId,
-    environment,
-    nodes: parent
-  });
-  await folderVersion.save();
-
-  await EESecretService.takeSecretSnapshot({
-    workspaceId: new Types.ObjectId(workspaceId),
-    environment,
-    folderId: child.id
-  });
-
-  await EEAuditLogService.createAuditLog(
-    req.authData,
-    {
-      type: EventType.CREATE_FOLDER,
-      metadata: {
-        environment,
-        folderId: child.id,
-        folderName,
-        folderPath: directory
-      }
-    },
-    {
-      workspaceId: new Types.ObjectId(workspaceId)
-    }
-  );
-
-  return res.json({ folder: child });
-};
-
-/**
- * Update folder with id [folderId]
- * @param req
- * @param res
- * @returns
- */
-export const updateFolderById = async (req: Request, res: Response) => {
-  /* 
-    #swagger.summary = 'Update a folder by ID'
-    #swagger.description = 'Update the name of a folder in a specified workspace and environment by its ID'
-    
-    #swagger.security = [{
-        "apiKeyAuth": []
-    }]
-
-    #swagger.parameters['folderId'] = {
-        "description": "ID of the folder to be updated",
-        "required": true,
-        "type": "string",
-        "in": "path"
-    }
-
-    #swagger.requestBody = {
-        content: {
-            "application/json": {
-                "schema": {
-                    "type": "object",
-                    "properties": {
-                        "workspaceId": {
-                            "type": "string",
-                            "description": "ID of the workspace where the folder is located",
-                            "example": "someWorkspaceId"
-                        },
-                        "environment": {
-                            "type": "string",
-                            "description": "Environment where the folder is located",
-                            "example": "production"
-                        },
-                        "name": {
-                            "type": "string",
-                            "description": "New name for the folder",
-                            "example": "updated_folder_name"
-                        }
-                    },
-                    "required": ["workspaceId", "environment", "name"]
-                }
-            }
-        }
-    }
-
-    #swagger.responses[200] = {
-        content: {
-            "application/json": {
-                "schema": {
-                    "type": "object",
-                    "properties": {
-                        "message": {
-                            "type": "string",
-                            "example": "Successfully updated folder"
-                        },
-                        "folder": {
-                            "type": "object",
-                            "properties": {
-                                "name": {
-                                    "type": "string",
-                                    "example": "updated_folder_name"
-                                },
-                                "id": {
-                                    "type": "string",
-                                    "example": "someFolderId"
-                                }
-                            },
-                            "description": "Details of the updated folder"
-                        }
-                    }
-                }
-            }
-        }
-    }
-
-    #swagger.responses[400] = {
-        description: "Bad Request. Reasons can include 'The folder doesn't exist' or 'Folder name cannot contain spaces. Only underscore and dashes'"
-    }
-
-    #swagger.responses[401] = {
-        description: "Unauthorized request. For example, 'Folder Permission Denied'"
-    }
-  */
-  const {
-    body: { workspaceId, environment, name, directory },
-    params: { folderName }
-  } = await validateRequest(reqValidator.UpdateFolderV1, req);
-
-  if (!validateFolderName(name)) {
-    throw BadRequestError({
-      message: "Folder name cannot contain spaces. Only underscore and dashes"
-    });
-  }
-
-  if (req.authData.authPayload instanceof ServiceTokenData) {
-    const isValidScopeAccess = isValidScope(req.authData.authPayload, environment, directory);
-    if (!isValidScopeAccess) {
-      throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
-    }
-  } else {
-    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Edit,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath: directory })
-    );
-  }
-
-  const folders = await Folder.findOne({ workspace: workspaceId, environment });
-  if (!folders) {
-    throw BadRequestError({ message: "The folder doesn't exist" });
-  }
-
-  const parentFolder = getFolderByPath(folders.nodes, directory);
-  if (!parentFolder) {
-    throw BadRequestError({ message: "The folder doesn't exist" });
-  }
-
-  const folder = parentFolder.children.find(({ name }) => name === folderName);
-  if (!folder) throw ERR_FOLDER_NOT_FOUND;
-
-  const oldFolderName = folder.name;
-  parentFolder.version += 1;
-  folder.name = name;
-
-  await Folder.findByIdAndUpdate(folders._id, folders);
-  const folderVersion = new FolderVersion({
-    workspace: workspaceId,
-    environment,
-    nodes: parentFolder
-  });
-  await folderVersion.save();
-
-  await EESecretService.takeSecretSnapshot({
-    workspaceId: new Types.ObjectId(workspaceId),
-    environment,
-    folderId: parentFolder.id
-  });
-
-  const { folderPath } = getFolderWithPathFromId(folders.nodes, folder.id);
-
-  await EEAuditLogService.createAuditLog(
-    req.authData,
-    {
-      type: EventType.UPDATE_FOLDER,
-      metadata: {
-        environment,
-        folderId: folder.id,
-        oldFolderName,
-        newFolderName: name,
-        folderPath
-      }
-    },
-    {
-      workspaceId: new Types.ObjectId(workspaceId)
-    }
-  );
-
-  return res.json({
-    message: "Successfully updated folder",
-    folder: { name: folder.name, id: folder.id }
-  });
-};
-
-/**
- * Delete folder with id [folderId]
- * @param req
- * @param res
- * @returns
- */
-export const deleteFolder = async (req: Request, res: Response) => {
-  /* 
-    #swagger.summary = 'Delete a folder by ID'
-    #swagger.description = 'Delete the specified folder from a specified workspace and environment using its ID'
-    
-    #swagger.security = [{
-        "apiKeyAuth": []
-    }]
-
-    #swagger.parameters['folderId'] = {
-        "description": "ID of the folder to be deleted",
-        "required": true,
-        "type": "string",
-        "in": "path"
-    }
-
-    #swagger.requestBody = {
-        content: {
-            "application/json": {
-                "schema": {
-                    "type": "object",
-                    "properties": {
-                        "workspaceId": {
-                            "type": "string",
-                            "description": "ID of the workspace where the folder is located",
-                            "example": "someWorkspaceId"
-                        },
-                        "environment": {
-                            "type": "string",
-                            "description": "Environment where the folder is located",
-                            "example": "production"
-                        }
-                    },
-                    "required": ["workspaceId", "environment"]
-                }
-            }
-        }
-    }
-
-    #swagger.responses[200] = {
-        content: {
-            "application/json": {
-                "schema": {
-                    "type": "object",
-                    "properties": {
-                        "message": {
-                            "type": "string",
-                            "example": "successfully deleted folders"
-                        },
-                        "folders": {
-                            "type": "array",
-                            "items": {
-                                "type": "object",
-                                "properties": {
-                                    "id": {
-                                        "type": "string",
-                                        "example": "someFolderId"
-                                    },
-                                    "name": {
-                                        "type": "string",
-                                        "example": "someFolderName"
-                                    }
-                                }
-                            },
-                            "description": "List of IDs and names of the deleted folders"
-                        }
-                    }
-                }
-            }
-        }
-    }
-
-    #swagger.responses[400] = {
-        description: "Bad Request. Reasons can include 'The folder doesn't exist'"
-    }
-
-    #swagger.responses[401] = {
-        description: "Unauthorized request. For example, 'Folder Permission Denied'"
-    }
-  */
-  const {
-    params: { folderName },
-    body: { environment, workspaceId, directory }
-  } = await validateRequest(reqValidator.DeleteFolderV1, req);
-
-  if (req.authData.authPayload instanceof ServiceTokenData) {
-    const isValidScopeAccess = isValidScope(req.authData.authPayload, environment, directory);
-    if (!isValidScopeAccess) {
-      throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
-    }
-  } else {
-    // check that user is a member of the workspace
-    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Delete,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath: directory })
-    );
-  }
-
-  const folders = await Folder.findOne({ workspace: workspaceId, environment });
-  if (!folders) throw ERR_FOLDER_NOT_FOUND;
-
-  const parentFolder = getFolderByPath(folders.nodes, directory);
-  if (!parentFolder) throw ERR_FOLDER_NOT_FOUND;
-
-  const index = parentFolder.children.findIndex(({ name }) => name === folderName);
-  if (index === -1) throw ERR_FOLDER_NOT_FOUND;
-
-  const deletedFolder = parentFolder.children.splice(index, 1)[0];
-
-  parentFolder.version += 1;
-  const delFolderIds = getAllFolderIds(deletedFolder);
-
-  await Folder.findByIdAndUpdate(folders._id, folders);
-  const folderVersion = new FolderVersion({
-    workspace: workspaceId,
-    environment,
-    nodes: parentFolder
-  });
-  await folderVersion.save();
-  if (delFolderIds.length) {
-    await Secret.deleteMany({
-      folder: { $in: delFolderIds.map(({ id }) => id) },
-      workspace: workspaceId,
-      environment
-    });
-  }
-
-  await EESecretService.takeSecretSnapshot({
-    workspaceId: new Types.ObjectId(workspaceId),
-    environment,
-    folderId: parentFolder.id
-  });
-
-  await EEAuditLogService.createAuditLog(
-    req.authData,
-    {
-      type: EventType.DELETE_FOLDER,
-      metadata: {
-        environment,
-        folderId: deletedFolder.id,
-        folderName: deletedFolder.name,
-        folderPath: directory
-      }
-    },
-    {
-      workspaceId: new Types.ObjectId(workspaceId)
-    }
-  );
-
-  return res.send({ message: "successfully deleted folders", folders: delFolderIds });
-};
-
-/**
- * Get folders for workspace with id [workspaceId] and environment [environment]
- * considering [parentFolderId] and [parentFolderPath]
- * @param req
- * @param res
- * @returns
- */
-export const getFolders = async (req: Request, res: Response) => {
-  /*
-    #swagger.summary = 'Retrieve folders based on specific conditions'
-    #swagger.description = 'Fetches folders from the specified workspace and environment, optionally providing either a parentFolderId or a parentFolderPath to narrow down results'
-    
-    #swagger.security = [{
-        "apiKeyAuth": []
-    }]
-
-    #swagger.parameters['workspaceId'] = {
-        "description": "ID of the workspace from which the folders are to be fetched",
-        "required": true,
-        "type": "string",
-        "in": "query"
-    }
-
-    #swagger.parameters['environment'] = {
-        "description": "Environment where the folder is located",
-        "required": true,
-        "type": "string",
-        "in": "query"
-    }
-
-    #swagger.parameters['parentFolderId'] = {
-        "description": "ID of the parent folder",
-        "required": false,
-        "type": "string",
-        "in": "query"
-    }
-
-    #swagger.parameters['parentFolderPath'] = {
-        "description": "Path of the parent folder, like /folder1/folder2",
-        "required": false,
-        "type": "string",
-        "in": "query"
-    }
-
-    #swagger.responses[200] = {
-        content: {
-            "application/json": {
-                "schema": {
-                    "type": "object",
-                    "properties": {
-                        "folders": {
-                            "type": "array",
-                            "items": {
-                                "type": "object",
-                                "properties": {
-                                    "id": {
-                                        "type": "string",
-                                        "example": "someFolderId"
-                                    },
-                                    "name": {
-                                        "type": "string",
-                                        "example": "someFolderName"
-                                    }
-                                }
-                            },
-                            "description": "List of folders"
-                        },
-                        "dir": {
-                            "type": "array",
-                            "items": {
-                                "type": "object",
-                                "properties": {
-                                    "name": {
-                                        "type": "string",
-                                        "example": "parentFolderName"
-                                    },
-                                    "id": {
-                                        "type": "string",
-                                        "example": "parentFolderId"
-                                    }
-                                }
-                            },
-                            "description": "List of directories"
-                        }
-                    }
-                }
-            }
-        }
-    }
-
-    #swagger.responses[400] = {
-        description: "Bad Request. For instance, 'The folder doesn't exist'"
-    }
-
-    #swagger.responses[401] = {
-        description: "Unauthorized request. For example, 'Folder Permission Denied'"
-    }
-  */
-  const {
-    query: { workspaceId, environment, directory }
-  } = await validateRequest(reqValidator.GetFoldersV1, req);
-
-  if (req.authData.authPayload instanceof ServiceTokenData) {
-    const isValidScopeAccess = isValidScope(req.authData.authPayload, environment, directory);
-    if (!isValidScopeAccess) {
-      throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
-    }
-  } else {
-    // check that user is a member of the workspace
-    await getUserProjectPermissions(req.user._id, workspaceId);
-  }
-
-  const folders = await Folder.findOne({ workspace: workspaceId, environment });
-  if (!folders) {
-    return res.send({ folders: [], dir: [] });
-  }
-
-  const folder = getFolderByPath(folders.nodes, directory);
-
-  return res.send({
-    folders: folder?.children?.map(({ id, name }) => ({ id, name })) || []
-  });
-};

backend/src/controllers/v1/serviceTokenController.ts

@@ -1,7 +1,7 @@
-import { Request, Response } from "express";
-import { ServiceToken } from "../../models";
-import { createToken } from "../../helpers/auth";
-import { getJwtServiceSecret } from "../../config";
+import { Request, Response } from 'express';
+import { ServiceToken } from '../../models';
+import { createToken } from '../../helpers/auth';
+import { JWT_SERVICE_SECRET } from '../../config';
 
 /**
  * Return service token on request
@@ -11,7 +11,7 @@ import { getJwtServiceSecret } from "../../config";
  */
 export const getServiceToken = async (req: Request, res: Response) => {
 	return res.status(200).send({
-		serviceToken: req.serviceToken,
+		serviceToken: req.serviceToken
 	});
 };
 
@@ -31,13 +31,13 @@ export const createServiceToken = async (req: Request, res: Response) => {
 			expiresIn,
 			publicKey,
 			encryptedKey,
-			nonce,
+			nonce
 		} = req.body;
 
 		// validate environment
 		const workspaceEnvs = req.membership.workspace.environments;
 		if (!workspaceEnvs.find(({ slug }: { slug: string }) => slug === environment)) {
-			throw new Error("Failed to validate environment");
+			throw new Error('Failed to validate environment');
 		}
 
 		// compute access token expiration date
@@ -52,24 +52,24 @@ export const createServiceToken = async (req: Request, res: Response) => {
 			expiresAt,
 			publicKey,
 			encryptedKey,
-			nonce,
+			nonce
 		}).save();
 
 		token = createToken({
 			payload: {
 				serviceTokenId: serviceToken._id.toString(),
-				workspaceId,
+				workspaceId
 			},
 			expiresIn: expiresIn,
-			secret: await getJwtServiceSecret(),
+			secret: JWT_SERVICE_SECRET
 		});
 	} catch (err) {
 		return res.status(400).send({
-			message: "Failed to create service token",
+			message: 'Failed to create service token'
 		});
 	}
 
 	return res.status(200).send({
-		token,
+		token
 	});
 };

backend/src/controllers/v1/signupController.ts

@@ -1,17 +1,16 @@
-import { Request, Response } from "express";
-import { AuthMethod, User } from "../../models";
-import { checkEmailVerification, sendEmailVerification } from "../../helpers/signup";
-import { createToken } from "../../helpers/auth";
-import { BadRequestError } from "../../utils/errors";
+import { Request, Response } from 'express';
+import * as Sentry from '@sentry/node';
+import { NODE_ENV, JWT_SIGNUP_LIFETIME, JWT_SIGNUP_SECRET } from '../../config';
+import { User, MembershipOrg } from '../../models';
+import { completeAccount } from '../../helpers/user';
 import {
-  getInviteOnlySignup,
-  getJwtSignupLifetime,
-  getJwtSignupSecret,
-  getSmtpConfigured
-} from "../../config";
-import { validateUserEmail } from "../../validation";
-import { validateRequest } from "../../helpers/validation";
-import * as reqValidator from "../../validation/auth";
+	sendEmailVerification,
+	checkEmailVerification,
+	initializeDefaultOrg
+} from '../../helpers/signup';
+import { issueTokens, createToken } from '../../helpers/auth';
+import { INVITED, ACCEPTED } from '../../variables';
+import axios from 'axios';
 
 /**
  * Signup step 1: Initialize account for user under email [email] and send a verification code
@@ -21,28 +20,32 @@ import * as reqValidator from "../../validation/auth";
  * @returns
  */
 export const beginEmailSignup = async (req: Request, res: Response) => {
-  const {
-    body: { email }
-  } = await validateRequest(reqValidator.BeginEmailSignUpV1, req);
+	let email: string;
+	try {
+		email = req.body.email;
 
-  // validate that email is not disposable
-  validateUserEmail(email);
+		const user = await User.findOne({ email }).select('+publicKey');
+		if (user && user?.publicKey) {
+			// case: user has already completed account
 
-  const user = await User.findOne({ email }).select("+publicKey");
-  if (user && user?.publicKey) {
-    // case: user has already completed account
+			return res.status(403).send({
+				error: 'Failed to send email verification code for complete account'
+			});
+		}
 
-    return res.status(403).send({
-      error: "Failed to send email verification code for complete account"
-    });
-  }
+		// send send verification email
+		await sendEmailVerification({ email });
+	} catch (err) {
+		Sentry.setUser(null);
+		Sentry.captureException(err);
+		return res.status(400).send({
+			error: 'Failed to send email verification code'
+		});
+	}
 
-  // send send verification email
-  await sendEmailVerification({ email });
-
-  return res.status(200).send({
-    message: `Sent an email verification code to ${email}`
-  });
+	return res.status(200).send({
+		message: `Sent an email verification code to ${email}`
+	});
 };
 
 /**
@@ -53,57 +56,248 @@ export const beginEmailSignup = async (req: Request, res: Response) => {
  * @returns
  */
 export const verifyEmailSignup = async (req: Request, res: Response) => {
-  let user;
-  const {
-    body: { email, code }
-  } = await validateRequest(reqValidator.VerifyEmailSignUpV1, req);
+	let user, token;
+	try {
+		const { email, code } = req.body;
 
-  // initialize user account
-  user = await User.findOne({ email }).select("+publicKey");
-  if (user && user?.publicKey) {
-    // case: user has already completed account
-    return res.status(403).send({
-      error: "Failed email verification for complete user"
-    });
-  }
+		// initialize user account
+		user = await User.findOne({ email });
+		if (user && user?.publicKey) {
+			// case: user has already completed account
+			return res.status(403).send({
+				error: 'Failed email verification for complete user'
+			});
+		}
 
-  if (await getInviteOnlySignup()) {
-    // Only one user can create an account without being invited. The rest need to be invited in order to make an account
-    const userCount = await User.countDocuments({});
-    if (userCount != 0) {
-      throw BadRequestError({
-        message: "New user sign ups are not allowed at this time. You must be invited to sign up."
-      });
-    }
-  }
+		// verify email
+		await checkEmailVerification({
+			email,
+			code
+		});
 
-  // verify email
-  if (await getSmtpConfigured()) {
-    await checkEmailVerification({
-      email,
-      code
-    });
-  }
+		if (!user) {
+			user = await new User({
+				email
+			}).save();
+		}
 
-  if (!user) {
-    user = await new User({
-      email,
-      authMethods: [AuthMethod.EMAIL]
-    }).save();
-  }
+		// generate temporary signup token
+		token = createToken({
+			payload: {
+				userId: user._id.toString()
+			},
+			expiresIn: JWT_SIGNUP_LIFETIME,
+			secret: JWT_SIGNUP_SECRET
+		});
+	} catch (err) {
+		Sentry.setUser(null);
+		Sentry.captureException(err);
+		return res.status(400).send({
+			error: 'Failed email verification'
+		});
+	}
 
-  // generate temporary signup token
-  const token = createToken({
-    payload: {
-      userId: user._id.toString()
-    },
-    expiresIn: await getJwtSignupLifetime(),
-    secret: await getJwtSignupSecret()
-  });
-
-  return res.status(200).send({
-    message: "Successfuly verified email",
-    user,
-    token
-  });
+	return res.status(200).send({
+		message: 'Successfuly verified email',
+		user,
+		token
+	});
+};
+
+/**
+ * Complete setting up user by adding their personal and auth information as part of the
+ * signup flow
+ * @param req
+ * @param res
+ * @returns
+ */
+export const completeAccountSignup = async (req: Request, res: Response) => {
+	let user, token, refreshToken;
+	try {
+		const {
+			email,
+			firstName,
+			lastName,
+			publicKey,
+			encryptedPrivateKey,
+			iv,
+			tag,
+			salt,
+			verifier,
+			organizationName
+		} = req.body;
+
+		// get user
+		user = await User.findOne({ email });
+		
+		if (!user || (user && user?.publicKey)) {
+			// case 1: user doesn't exist.
+			// case 2: user has already completed account
+			return res.status(403).send({
+				error: 'Failed to complete account for complete user'
+			});
+		}
+
+		// complete setting up user's account
+		user = await completeAccount({
+			userId: user._id.toString(),
+			firstName,
+			lastName,
+			publicKey,
+			encryptedPrivateKey,
+			iv,
+			tag,
+			salt,
+			verifier
+		});
+
+		if (!user)
+			throw new Error('Failed to complete account for non-existent user'); // ensure user is non-null
+
+		// initialize default organization and workspace
+		await initializeDefaultOrg({
+			organizationName,
+			user
+		});
+
+		// update organization membership statuses that are
+		// invited to completed with user attached
+		await MembershipOrg.updateMany(
+			{
+				inviteEmail: email,
+				status: INVITED
+			},
+			{
+				user,
+				status: ACCEPTED
+			}
+		);
+
+		// issue tokens
+		const tokens = await issueTokens({
+			userId: user._id.toString()
+		});
+
+		token = tokens.token;
+		refreshToken = tokens.refreshToken;
+
+		// sending a welcome email to new users
+		if (process.env.LOOPS_API_KEY) {
+			await axios.post("https://app.loops.so/api/v1/events/send", {
+				"email": email,
+				"eventName": "Sign Up",
+				"firstName": firstName,
+				"lastName": lastName
+			}, {
+				headers: {
+					"Accept": "application/json",
+					"Authorization": "Bearer " + process.env.LOOPS_API_KEY
+				},
+			});
+		}
+	} catch (err) {
+		Sentry.setUser(null);
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to complete account setup'
+		});
+	}
+
+	return res.status(200).send({
+		message: 'Successfully set up account',
+		user,
+		token,
+		refreshToken
+	});
+};
+/**
+ * Complete setting up user by adding their personal and auth information as part of the
+ * invite flow
+ * @param req
+ * @param res
+ * @returns
+ */
+export const completeAccountInvite = async (req: Request, res: Response) => {
+	let user, token, refreshToken;
+	try {
+		const {
+			email,
+			firstName,
+			lastName,
+			publicKey,
+			encryptedPrivateKey,
+			iv,
+			tag,
+			salt,
+			verifier
+		} = req.body;
+
+		// get user
+		user = await User.findOne({ email });
+
+		if (!user || (user && user?.publicKey)) {
+			// case 1: user doesn't exist.
+			// case 2: user has already completed account
+			return res.status(403).send({
+				error: 'Failed to complete account for complete user'
+			});
+		}
+
+		const membershipOrg = await MembershipOrg.findOne({
+			inviteEmail: email,
+			status: INVITED
+		});
+
+		if (!membershipOrg) throw new Error('Failed to find invitations for email');
+
+		// complete setting up user's account
+		user = await completeAccount({
+			userId: user._id.toString(),
+			firstName,
+			lastName,
+			publicKey,
+			encryptedPrivateKey,
+			iv,
+			tag,
+			salt,
+			verifier
+		});
+
+		if (!user)
+			throw new Error('Failed to complete account for non-existent user');
+
+		// update organization membership statuses that are
+		// invited to completed with user attached
+		await MembershipOrg.updateMany(
+			{
+				inviteEmail: email,
+				status: INVITED
+			},
+			{
+				user,
+				status: ACCEPTED
+			}
+		);
+
+		// issue tokens
+		const tokens = await issueTokens({
+			userId: user._id.toString()
+		});
+
+		token = tokens.token;
+		refreshToken = tokens.refreshToken;
+	} catch (err) {
+		Sentry.setUser(null);
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to complete account setup'
+		});
+	}
+
+	return res.status(200).send({
+		message: 'Successfully set up account',
+		user,
+		token,
+		refreshToken
+	});
 };

backend/src/controllers/v1/stripeController.ts

@@ -0,0 +1,40 @@
+import { Request, Response } from 'express';
+import * as Sentry from '@sentry/node';
+import Stripe from 'stripe';
+import { STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET } from '../../config';
+const stripe = new Stripe(STRIPE_SECRET_KEY, {
+	apiVersion: '2022-08-01'
+});
+
+/**
+ * Handle service provisioning/un-provisioning via Stripe
+ * @param req
+ * @param res
+ * @returns
+ */
+export const handleWebhook = async (req: Request, res: Response) => {
+	let event;
+	try {
+		// check request for valid stripe signature
+		const sig = req.headers['stripe-signature'] as string;
+		event = stripe.webhooks.constructEvent(
+			req.body,
+			sig,
+			STRIPE_WEBHOOK_SECRET // ?
+		);
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			error: 'Failed to process webhook'
+		});
+	}
+
+	switch (event.type) {
+		case '':
+			break;
+		default:
+	}
+
+	return res.json({ received: true });
+};

backend/src/controllers/v1/userActionController.ts

@@ -1,7 +1,6 @@
-import { Request, Response } from "express";
-import { validateRequest } from "../../helpers/validation";
-import { UserAction } from "../../models";
-import * as reqValidator from "../../validation/action";
+import { Request, Response } from 'express';
+import * as Sentry from '@sentry/node';
+import { UserAction } from '../../models';
 
 /**
  * Add user action [action]
@@ -10,27 +9,35 @@ import * as reqValidator from "../../validation/action";
  * @returns
  */
 export const addUserAction = async (req: Request, res: Response) => {
-  // add/record new action [action] for user with id [req.user._id]
-  const {
-    body: { action }
-  } = await validateRequest(reqValidator.AddUserActionV1, req);
+	// add/record new action [action] for user with id [req.user._id]
 
-  const userAction = await UserAction.findOneAndUpdate(
-    {
-      user: req.user._id,
-      action
-    },
-    { user: req.user._id, action },
-    {
-      new: true,
-      upsert: true
-    }
-  );
+	let userAction;
+	try {
+		const { action } = req.body;
 
-  return res.status(200).send({
-    message: "Successfully recorded user action",
-    userAction
-  });
+		userAction = await UserAction.findOneAndUpdate(
+			{
+				user: req.user._id,
+				action
+			},
+			{ user: req.user._id, action },
+			{
+				new: true,
+				upsert: true
+			}
+		);
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to record user action'
+		});
+	}
+
+	return res.status(200).send({
+		message: 'Successfully recorded user action',
+		userAction
+	});
 };
 
 /**
@@ -40,17 +47,24 @@ export const addUserAction = async (req: Request, res: Response) => {
  * @returns
  */
 export const getUserAction = async (req: Request, res: Response) => {
-  // get user action [action] for user with id [req.user._id]
-  const {
-    query: { action }
-  } = await validateRequest(reqValidator.GetUserActionV1, req);
+	// get user action [action] for user with id [req.user._id]
+	let userAction;
+	try {
+		const action: string = req.query.action as string;
 
-  const userAction = await UserAction.findOne({
-    user: req.user._id,
-    action
-  });
+		userAction = await UserAction.findOne({
+			user: req.user._id,
+			action
+		});
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get user action'
+		});
+	}
 
-  return res.status(200).send({
-    userAction
-  });
+	return res.status(200).send({
+		userAction
+	});
 };

backend/src/controllers/v1/userController.ts

@@ -1,4 +1,4 @@
-import { Request, Response } from "express";
+import { Request, Response } from 'express';
 
 /**
  * Return user on request
@@ -8,6 +8,6 @@ import { Request, Response } from "express";
  */
 export const getUser = async (req: Request, res: Response) => {
 	return res.status(200).send({
-		user: req.user,
+		user: req.user
 	});
 };

backend/src/controllers/v1/webhookController.ts

@@ -1,239 +0,0 @@
-import { Request, Response } from "express";
-import { Types } from "mongoose";
-import { client, getRootEncryptionKey } from "../../config";
-import { Webhook } from "../../models";
-import { getWebhookPayload, triggerWebhookRequest } from "../../services/WebhookService";
-import { BadRequestError, ResourceNotFoundError } from "../../utils/errors";
-import { EEAuditLogService } from "../../ee/services";
-import { EventType } from "../../ee/models";
-import { ALGORITHM_AES_256_GCM, ENCODING_SCHEME_BASE64 } from "../../variables";
-import { validateRequest } from "../../helpers/validation";
-import * as reqValidator from "../../validation/webhooks";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSub,
-  getUserProjectPermissions
-} from "../../ee/services/ProjectRoleService";
-import { ForbiddenError } from "@casl/ability";
-
-export const createWebhook = async (req: Request, res: Response) => {
-  const {
-    body: { webhookUrl, webhookSecretKey, environment, workspaceId, secretPath }
-  } = await validateRequest(reqValidator.CreateWebhookV1, req);
-
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Create,
-    ProjectPermissionSub.Webhooks
-  );
-
-  const webhook = new Webhook({
-    workspace: workspaceId,
-    environment,
-    secretPath,
-    url: webhookUrl,
-    algorithm: ALGORITHM_AES_256_GCM,
-    keyEncoding: ENCODING_SCHEME_BASE64
-  });
-
-  if (webhookSecretKey) {
-    const rootEncryptionKey = await getRootEncryptionKey();
-    const { ciphertext, iv, tag } = client.encryptSymmetric(webhookSecretKey, rootEncryptionKey);
-    webhook.iv = iv;
-    webhook.tag = tag;
-    webhook.encryptedSecretKey = ciphertext;
-  }
-
-  await webhook.save();
-
-  await EEAuditLogService.createAuditLog(
-    req.authData,
-    {
-      type: EventType.CREATE_WEBHOOK,
-      metadata: {
-        webhookId: webhook._id.toString(),
-        environment,
-        secretPath,
-        webhookUrl,
-        isDisabled: false
-      }
-    },
-    {
-      workspaceId: new Types.ObjectId(workspaceId)
-    }
-  );
-
-  return res.status(200).send({
-    webhook,
-    message: "successfully created webhook"
-  });
-};
-
-export const updateWebhook = async (req: Request, res: Response) => {
-  const {
-    body: { isDisabled },
-    params: { webhookId }
-  } = await validateRequest(reqValidator.UpdateWebhookV1, req);
-
-  const webhook = await Webhook.findById(webhookId);
-  if (!webhook) {
-    throw BadRequestError({ message: "Webhook not found!!" });
-  }
-
-  const { permission } = await getUserProjectPermissions(
-    req.user._id,
-    webhook.workspace.toString()
-  );
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Edit,
-    ProjectPermissionSub.Webhooks
-  );
-
-  if (typeof isDisabled !== undefined) {
-    webhook.isDisabled = isDisabled;
-  }
-  await webhook.save();
-
-  await EEAuditLogService.createAuditLog(
-    req.authData,
-    {
-      type: EventType.UPDATE_WEBHOOK_STATUS,
-      metadata: {
-        webhookId: webhook._id.toString(),
-        environment: webhook.environment,
-        secretPath: webhook.secretPath,
-        webhookUrl: webhook.url,
-        isDisabled
-      }
-    },
-    {
-      workspaceId: webhook.workspace
-    }
-  );
-
-  return res.status(200).send({
-    webhook,
-    message: "successfully updated webhook"
-  });
-};
-
-export const deleteWebhook = async (req: Request, res: Response) => {
-  const {
-    params: { webhookId }
-  } = await validateRequest(reqValidator.DeleteWebhookV1, req);
-  let webhook = await Webhook.findById(webhookId);
-
-  if (!webhook) {
-    throw ResourceNotFoundError({ message: "Webhook not found!!" });
-  }
-
-  const { permission } = await getUserProjectPermissions(
-    req.user._id,
-    webhook.workspace.toString()
-  );
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Delete,
-    ProjectPermissionSub.Webhooks
-  );
-
-  webhook = await Webhook.findByIdAndDelete(webhookId);
-
-  if (!webhook) {
-    throw ResourceNotFoundError({ message: "Webhook not found!!" });
-  }
-
-  await EEAuditLogService.createAuditLog(
-    req.authData,
-    {
-      type: EventType.DELETE_WEBHOOK,
-      metadata: {
-        webhookId: webhook._id.toString(),
-        environment: webhook.environment,
-        secretPath: webhook.secretPath,
-        webhookUrl: webhook.url,
-        isDisabled: webhook.isDisabled
-      }
-    },
-    {
-      workspaceId: webhook.workspace
-    }
-  );
-
-  return res.status(200).send({
-    message: "successfully removed webhook"
-  });
-};
-
-export const testWebhook = async (req: Request, res: Response) => {
-  const {
-    params: { webhookId }
-  } = await validateRequest(reqValidator.TestWebhookV1, req);
-
-  const webhook = await Webhook.findById(webhookId);
-  if (!webhook) {
-    throw BadRequestError({ message: "Webhook not found!!" });
-  }
-
-  const { permission } = await getUserProjectPermissions(
-    req.user._id,
-    webhook.workspace.toString()
-  );
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Read,
-    ProjectPermissionSub.Webhooks
-  );
-
-  try {
-    await triggerWebhookRequest(
-      webhook,
-      getWebhookPayload(
-        "test",
-        webhook.workspace.toString(),
-        webhook.environment,
-        webhook.secretPath
-      )
-    );
-    await Webhook.findByIdAndUpdate(webhookId, {
-      lastStatus: "success",
-      lastRunErrorMessage: null
-    });
-  } catch (err) {
-    await Webhook.findByIdAndUpdate(webhookId, {
-      lastStatus: "failed",
-      lastRunErrorMessage: (err as Error).message
-    });
-    return res.status(400).send({
-      message: "Failed to receive response",
-      error: (err as Error).message
-    });
-  }
-
-  return res.status(200).send({
-    message: "Successfully received response"
-  });
-};
-
-export const listWebhooks = async (req: Request, res: Response) => {
-  const {
-    query: { environment, workspaceId, secretPath }
-  } = await validateRequest(reqValidator.ListWebhooksV1, req);
-
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Read,
-    ProjectPermissionSub.Webhooks
-  );
-
-  const optionalFilters: Record<string, string> = {};
-  if (environment) optionalFilters.environment = environment as string;
-  if (secretPath) optionalFilters.secretPath = secretPath as string;
-
-  const webhooks = await Webhook.find({
-    workspace: new Types.ObjectId(workspaceId as string),
-    ...optionalFilters
-  });
-
-  return res.status(200).send({
-    webhooks
-  });
-};

backend/src/controllers/v1/workspaceController.ts

@@ -1,32 +1,21 @@
-import { Types } from "mongoose";
-import { Request, Response } from "express";
+import { Request, Response } from 'express';
+import * as Sentry from '@sentry/node';
 import {
-  IUser,
-  Integration,
-  IntegrationAuth,
-  Membership,
-  Organization,
-  ServiceToken,
-  Workspace
-} from "../../models";
-import { createWorkspace as create, deleteWorkspace as deleteWork } from "../../helpers/workspace";
-import { EELicenseService } from "../../ee/services";
-import { addMemberships } from "../../helpers/membership";
-import { ADMIN } from "../../variables";
-import { OrganizationNotFoundError } from "../../utils/errors";
+	Workspace,
+	Membership,
+	MembershipOrg,
+	Integration,
+	IntegrationAuth,
+	IUser,
+	ServiceToken,
+	ServiceTokenData
+} from '../../models';
 import {
-  OrgPermissionActions,
-  OrgPermissionSubjects,
-  getUserOrgPermissions
-} from "../../ee/services/RoleService";
-import { ForbiddenError } from "@casl/ability";
-import { validateRequest } from "../../helpers/validation";
-import * as reqValidator from "../../validation";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSub,
-  getUserProjectPermissions
-} from "../../ee/services/ProjectRoleService";
+	createWorkspace as create,
+	deleteWorkspace as deleteWork
+} from '../../helpers/workspace';
+import { addMemberships } from '../../helpers/membership';
+import { ADMIN } from '../../variables';
 
 /**
  * Return public keys of members of workspace with id [workspaceId]
@@ -35,30 +24,32 @@ import {
  * @returns
  */
 export const getWorkspacePublicKeys = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId }
-  } = await validateRequest(reqValidator.GetWorkspacePublicKeysV1, req);
+	let publicKeys;
+	try {
+		const { workspaceId } = req.params;
 
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Read,
-    ProjectPermissionSub.Member
-  );
+		publicKeys = (
+			await Membership.find({
+				workspace: workspaceId
+			}).populate<{ user: IUser }>('user', 'publicKey')
+		)
+		.map((member) => {
+			return {
+				publicKey: member.user.publicKey,
+				userId: member.user._id
+			};
+		});
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get workspace member public keys'
+		});
+	}
 
-  const publicKeys = (
-    await Membership.find({
-      workspace: workspaceId
-    }).populate<{ user: IUser }>("user", "publicKey")
-  ).map((member) => {
-    return {
-      publicKey: member.user.publicKey,
-      userId: member.user._id
-    };
-  });
-
-  return res.status(200).send({
-    publicKeys
-  });
+	return res.status(200).send({
+		publicKeys
+	});
 };
 
 /**
@@ -68,23 +59,24 @@ export const getWorkspacePublicKeys = async (req: Request, res: Response) => {
  * @returns
  */
 export const getWorkspaceMemberships = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId }
-  } = await validateRequest(reqValidator.GetWorkspaceMembershipsV1, req);
+	let users;
+	try {
+		const { workspaceId } = req.params;
 
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Read,
-    ProjectPermissionSub.Member
-  );
+		users = await Membership.find({
+			workspace: workspaceId
+		}).populate('user', '+publicKey');
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get workspace members'
+		});
+	}
 
-  const users = await Membership.find({
-    workspace: workspaceId
-  }).populate("user", "+publicKey");
-
-  return res.status(200).send({
-    users
-  });
+	return res.status(200).send({
+		users
+	});
 };
 
 /**
@@ -94,15 +86,24 @@ export const getWorkspaceMemberships = async (req: Request, res: Response) => {
  * @returns
  */
 export const getWorkspaces = async (req: Request, res: Response) => {
-  const workspaces = (
-    await Membership.find({
-      user: req.user._id
-    }).populate("workspace")
-  ).map((m) => m.workspace);
+	let workspaces;
+	try {
+		workspaces = (
+			await Membership.find({
+				user: req.user._id
+			}).populate('workspace')
+		).map((m) => m.workspace);
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get workspaces'
+		});
+	}
 
-  return res.status(200).send({
-    workspaces
-  });
+	return res.status(200).send({
+		workspaces
+	});
 };
 
 /**
@@ -112,17 +113,24 @@ export const getWorkspaces = async (req: Request, res: Response) => {
  * @returns
  */
 export const getWorkspace = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId }
-  } = await validateRequest(reqValidator.GetWorkspaceV1, req);
+	let workspace;
+	try {
+		const { workspaceId } = req.params;
 
-  const workspace = await Workspace.findOne({
-    _id: workspaceId
-  });
+		workspace = await Workspace.findOne({
+			_id: workspaceId
+		});
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get workspace'
+		});
+	}
 
-  return res.status(200).send({
-    workspace
-  });
+	return res.status(200).send({
+		workspace
+	});
 };
 
 /**
@@ -133,55 +141,46 @@ export const getWorkspace = async (req: Request, res: Response) => {
  * @returns
  */
 export const createWorkspace = async (req: Request, res: Response) => {
-  const {
-    body: { organizationId, workspaceName }
-  } = await validateRequest(reqValidator.CreateWorkspaceV1, req);
+	let workspace;
+	try {
+		const { workspaceName, organizationId } = req.body;
 
-  const organization = await Organization.findById(organizationId);
-  if (!organization) {
-    throw OrganizationNotFoundError({
-      message: "Failed to find organization"
-    });
-  }
+		// validate organization membership
+		const membershipOrg = await MembershipOrg.findOne({
+			user: req.user._id,
+			organization: organizationId
+		});
 
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Create,
-    OrgPermissionSubjects.Workspace
-  );
+		if (!membershipOrg) {
+			throw new Error('Failed to validate organization membership');
+		}
 
-  const plan = await EELicenseService.getPlan(new Types.ObjectId(organizationId));
+		if (workspaceName.length < 1) {
+			throw new Error('Workspace names must be at least 1-character long');
+		}
 
-  if (plan.workspaceLimit !== null) {
-    // case: limit imposed on number of workspaces allowed
-    if (plan.workspacesUsed >= plan.workspaceLimit) {
-      // case: number of workspaces used exceeds the number of workspaces allowed
-      return res.status(400).send({
-        message:
-          "Failed to create workspace due to plan limit reached. Upgrade plan to add more workspaces."
-      });
-    }
-  }
+		// create workspace and add user as member
+		workspace = await create({
+			name: workspaceName,
+			organizationId
+		});
 
-  if (workspaceName.length < 1) {
-    throw new Error("Workspace names must be at least 1-character long");
-  }
+		await addMemberships({
+			userIds: [req.user._id],
+			workspaceId: workspace._id.toString(),
+			roles: [ADMIN]
+		});
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to create workspace'
+		});
+	}
 
-  // create workspace and add user as member
-  const workspace = await create({
-    name: workspaceName,
-    organizationId: new Types.ObjectId(organizationId)
-  });
-
-  await addMemberships({
-    userIds: [req.user._id],
-    workspaceId: workspace._id.toString(),
-    roles: [ADMIN]
-  });
-
-  return res.status(200).send({
-    workspace
-  });
+	return res.status(200).send({
+		workspace
+	});
 };
 
 /**
@@ -191,24 +190,24 @@ export const createWorkspace = async (req: Request, res: Response) => {
  * @returns
  */
 export const deleteWorkspace = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId }
-  } = await validateRequest(reqValidator.DeleteWorkspaceV1, req);
+	try {
+		const { workspaceId } = req.params;
 
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Delete,
-    ProjectPermissionSub.Workspace
-  );
+		// delete workspace
+		await deleteWork({
+			id: workspaceId
+		});
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to delete workspace'
+		});
+	}
 
-  // delete workspace
-  const workspace = await deleteWork({
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
-  return res.status(200).send({
-    workspace
-  });
+	return res.status(200).send({
+		message: 'Successfully deleted workspace'
+	});
 };
 
 /**
@@ -218,33 +217,34 @@ export const deleteWorkspace = async (req: Request, res: Response) => {
  * @returns
  */
 export const changeWorkspaceName = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId },
-    body: { name }
-  } = await validateRequest(reqValidator.ChangeWorkspaceNameV1, req);
+	let workspace;
+	try {
+		const { workspaceId } = req.params;
+		const { name } = req.body;
 
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Edit,
-    ProjectPermissionSub.Workspace
-  );
+		workspace = await Workspace.findOneAndUpdate(
+			{
+				_id: workspaceId
+			},
+			{
+				name
+			},
+			{
+				new: true
+			}
+		);
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to change workspace name'
+		});
+	}
 
-  const workspace = await Workspace.findOneAndUpdate(
-    {
-      _id: workspaceId
-    },
-    {
-      name
-    },
-    {
-      new: true
-    }
-  );
-
-  return res.status(200).send({
-    message: "Successfully changed workspace name",
-    workspace
-  });
+	return res.status(200).send({
+		message: 'Successfully changed workspace name',
+		workspace
+	});
 };
 
 /**
@@ -254,22 +254,24 @@ export const changeWorkspaceName = async (req: Request, res: Response) => {
  * @returns
  */
 export const getWorkspaceIntegrations = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId }
-  } = await validateRequest(reqValidator.GetWorkspaceIntegrationsV1, req);
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Read,
-    ProjectPermissionSub.Integrations
-  );
+	let integrations;
+	try {
+		const { workspaceId } = req.params;
 
-  const integrations = await Integration.find({
-    workspace: workspaceId
-  });
+		integrations = await Integration.find({
+			workspace: workspaceId
+		});
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get workspace integrations'
+		});
+	}
 
-  return res.status(200).send({
-    integrations
-  });
+	return res.status(200).send({
+		integrations
+	});
 };
 
 /**
@@ -278,50 +280,57 @@ export const getWorkspaceIntegrations = async (req: Request, res: Response) => {
  * @param res
  * @returns
  */
-export const getWorkspaceIntegrationAuthorizations = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId }
-  } = await validateRequest(reqValidator.GetWorkspaceIntegrationAuthorizationsV1, req);
+export const getWorkspaceIntegrationAuthorizations = async (
+	req: Request,
+	res: Response
+) => {
+	let authorizations;
+	try {
+		const { workspaceId } = req.params;
 
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Read,
-    ProjectPermissionSub.Integrations
-  );
+		authorizations = await IntegrationAuth.find({
+			workspace: workspaceId
+		});
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get workspace integration authorizations'
+		});
+	}
 
-  const authorizations = await IntegrationAuth.find({
-    workspace: workspaceId
-  });
-
-  return res.status(200).send({
-    authorizations
-  });
+	return res.status(200).send({
+		authorizations
+	});
 };
 
 /**
  * Return service service tokens for workspace [workspaceId] belonging to user
- * @param req
- * @param res
- * @returns
+ * @param req 
+ * @param res 
+ * @returns 
  */
-export const getWorkspaceServiceTokens = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId }
-  } = await validateRequest(reqValidator.GetWorkspaceServiceTokensV1, req);
-
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Read,
-    ProjectPermissionSub.ServiceTokens
-  );
-
-  // ?? FIX.
-  const serviceTokens = await ServiceToken.find({
-    user: req.user._id,
-    workspace: workspaceId
-  });
-
-  return res.status(200).send({
-    serviceTokens
-  });
-};
+export const getWorkspaceServiceTokens = async (
+	req: Request,
+	res: Response
+) => {
+	let serviceTokens;
+	try {
+		const { workspaceId } = req.params;
+		// ?? FIX.
+		serviceTokens = await ServiceToken.find({
+			user: req.user._id,
+			workspace: workspaceId
+		});
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get workspace service tokens'
+		});
+	}
+	
+	return res.status(200).send({
+		serviceTokens
+	});
+}

backend/src/controllers/v2/apiKeyDataController.ts

@@ -0,0 +1,105 @@
+import { Request, Response } from 'express';
+import * as Sentry from '@sentry/node';
+import crypto from 'crypto';
+import bcrypt from 'bcrypt';
+import {
+    APIKeyData
+} from '../../models';
+import {
+    SALT_ROUNDS
+} from '../../config';
+
+/**
+ * Return API key data for user with id [req.user_id]
+ * @param req
+ * @param res 
+ * @returns 
+ */
+export const getAPIKeyData = async (req: Request, res: Response) => {
+    let apiKeyData;
+    try {
+        apiKeyData = await APIKeyData.find({
+            user: req.user._id
+        });
+    } catch (err) {
+        Sentry.setUser({ email: req.user.email });
+        Sentry.captureException(err);
+        return res.status(400).send({
+            message: 'Failed to get API key data'
+        });
+    }
+    
+    return res.status(200).send({
+        apiKeyData
+    });
+}
+
+/**
+ * Create new API key data for user with id [req.user._id]
+ * @param req 
+ * @param res 
+ */
+export const createAPIKeyData = async (req: Request, res: Response) => {
+    let apiKey, apiKeyData;
+    try {
+        const { name, expiresIn } = req.body;
+        
+        const secret = crypto.randomBytes(16).toString('hex');
+        const secretHash = await bcrypt.hash(secret, SALT_ROUNDS);
+        
+		const expiresAt = new Date();
+		expiresAt.setSeconds(expiresAt.getSeconds() + expiresIn);
+        
+        apiKeyData = await new APIKeyData({
+            name,
+            expiresAt,
+            user: req.user._id,
+            secretHash
+        }).save();
+        
+        // return api key data without sensitive data
+        apiKeyData = await APIKeyData.findById(apiKeyData._id);
+        
+        if (!apiKeyData) throw new Error('Failed to find API key data');
+        
+        apiKey = `ak.${apiKeyData._id.toString()}.${secret}`;
+            
+    } catch (err) {
+        Sentry.setUser({ email: req.user.email });
+        Sentry.captureException(err);
+        return res.status(400).send({
+            message: 'Failed to API key data'
+        });
+    }
+    
+    return res.status(200).send({
+        apiKey,
+        apiKeyData
+    });
+}
+
+/**
+ * Delete API key data with id [apiKeyDataId].
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const deleteAPIKeyData = async (req: Request, res: Response) => {
+    let apiKeyData;
+    try {
+        const { apiKeyDataId } = req.params;
+
+        apiKeyData = await APIKeyData.findByIdAndDelete(apiKeyDataId);
+        
+    } catch (err) {
+        Sentry.setUser({ email: req.user.email });
+        Sentry.captureException(err);
+        return res.status(400).send({
+            message: 'Failed to delete API key data'
+        });
+    }
+    
+    return res.status(200).send({
+        apiKeyData
+    });
+}

backend/src/controllers/v2/authController.ts

@@ -1,346 +0,0 @@
-/* eslint-disable @typescript-eslint/no-var-requires */
-import { Request, Response } from "express";
-import jwt from "jsonwebtoken";
-import * as bigintConversion from "bigint-conversion";
-const jsrp = require("jsrp");
-import { LoginSRPDetail, User } from "../../models";
-import { createToken, issueAuthTokens } from "../../helpers/auth";
-import { checkUserDevice } from "../../helpers/user";
-import { sendMail } from "../../helpers/nodemailer";
-import { TokenService } from "../../services";
-import { EELogService } from "../../ee/services";
-import { BadRequestError, InternalServerError } from "../../utils/errors";
-import { ACTION_LOGIN, TOKEN_EMAIL_MFA } from "../../variables";
-import { getUserAgentType } from "../../utils/posthog"; // TODO: move this
-import { getHttpsEnabled, getJwtMfaLifetime, getJwtMfaSecret } from "../../config";
-import { validateRequest } from "../../helpers/validation";
-import * as reqValidator from "../../validation/auth";
-
-declare module "jsonwebtoken" {
-  export interface UserIDJwtPayload extends jwt.JwtPayload {
-    userId: string;
-  }
-}
-
-/**
- * Log in user step 1: Return [salt] and [serverPublicKey] as part of step 1 of SRP protocol
- * @param req
- * @param res
- * @returns
- */
-export const login1 = async (req: Request, res: Response) => {
-  const { email, clientPublicKey }: { email: string; clientPublicKey: string } = req.body;
-
-  const user = await User.findOne({
-    email
-  }).select("+salt +verifier");
-
-  if (!user) throw new Error("Failed to find user");
-
-  const server = new jsrp.server();
-  server.init(
-    {
-      salt: user.salt,
-      verifier: user.verifier
-    },
-    async () => {
-      // generate server-side public key
-      const serverPublicKey = server.getPublicKey();
-
-      await LoginSRPDetail.findOneAndReplace(
-        { email: email },
-        {
-          email: email,
-          clientPublicKey: clientPublicKey,
-          serverBInt: bigintConversion.bigintToBuf(server.bInt)
-        },
-        { upsert: true, returnNewDocument: false }
-      );
-
-      return res.status(200).send({
-        serverPublicKey,
-        salt: user.salt
-      });
-    }
-  );
-};
-
-/**
- * Log in user step 2: complete step 2 of SRP protocol and return token and their (encrypted)
- * private key
- * @param req
- * @param res
- * @returns
- */
-export const login2 = async (req: Request, res: Response) => {
-  if (!req.headers["user-agent"])
-    throw InternalServerError({ message: "User-Agent header is required" });
-
-  const { email, clientProof } = req.body;
-  const user = await User.findOne({
-    email
-  }).select(
-    "+salt +verifier +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag +publicKey +encryptedPrivateKey +iv +tag +devices"
-  );
-
-  if (!user) throw new Error("Failed to find user");
-
-  const loginSRPDetail = await LoginSRPDetail.findOneAndDelete({ email: email });
-
-  if (!loginSRPDetail) {
-    return BadRequestError(Error("Failed to find login details for SRP"));
-  }
-
-  const server = new jsrp.server();
-  server.init(
-    {
-      salt: user.salt,
-      verifier: user.verifier,
-      b: loginSRPDetail.serverBInt
-    },
-    async () => {
-      server.setClientPublicKey(loginSRPDetail.clientPublicKey);
-
-      // compare server and client shared keys
-      if (server.checkClientProof(clientProof)) {
-        if (user.isMfaEnabled) {
-          // case: user has MFA enabled
-
-          // generate temporary MFA token
-          const token = createToken({
-            payload: {
-              userId: user._id.toString()
-            },
-            expiresIn: await getJwtMfaLifetime(),
-            secret: await getJwtMfaSecret()
-          });
-
-          const code = await TokenService.createToken({
-            type: TOKEN_EMAIL_MFA,
-            email
-          });
-
-          // send MFA code [code] to [email]
-          await sendMail({
-            template: "emailMfa.handlebars",
-            subjectLine: "Infisical MFA code",
-            recipients: [email],
-            substitutions: {
-              code
-            }
-          });
-
-          return res.status(200).send({
-            mfaEnabled: true,
-            token
-          });
-        }
-
-        await checkUserDevice({
-          user,
-          ip: req.realIP,
-          userAgent: req.headers["user-agent"] ?? ""
-        });
-
-        // issue tokens
-        const tokens = await issueAuthTokens({
-          userId: user._id,
-          ip: req.realIP,
-          userAgent: req.headers["user-agent"] ?? ""
-        });
-
-        // store (refresh) token in httpOnly cookie
-        res.cookie("jid", tokens.refreshToken, {
-          httpOnly: true,
-          path: "/",
-          sameSite: "strict",
-          secure: await getHttpsEnabled()
-        });
-
-        // case: user does not have MFA enabled
-        // return (access) token in response
-
-        interface ResponseData {
-          mfaEnabled: boolean;
-          encryptionVersion: any;
-          protectedKey?: string;
-          protectedKeyIV?: string;
-          protectedKeyTag?: string;
-          token: string;
-          publicKey?: string;
-          encryptedPrivateKey?: string;
-          iv?: string;
-          tag?: string;
-        }
-
-        const response: ResponseData = {
-          mfaEnabled: false,
-          encryptionVersion: user.encryptionVersion,
-          token: tokens.token,
-          publicKey: user.publicKey,
-          encryptedPrivateKey: user.encryptedPrivateKey,
-          iv: user.iv,
-          tag: user.tag
-        };
-
-        if (user?.protectedKey && user?.protectedKeyIV && user?.protectedKeyTag) {
-          response.protectedKey = user.protectedKey;
-          response.protectedKeyIV = user.protectedKeyIV;
-          response.protectedKeyTag = user.protectedKeyTag;
-        }
-
-        const loginAction = await EELogService.createAction({
-          name: ACTION_LOGIN,
-          userId: user._id
-        });
-
-        loginAction &&
-          (await EELogService.createLog({
-            userId: user._id,
-            actions: [loginAction],
-            channel: getUserAgentType(req.headers["user-agent"]),
-            ipAddress: req.ip
-          }));
-
-        return res.status(200).send(response);
-      }
-
-      return res.status(400).send({
-        message: "Failed to authenticate. Try again?"
-      });
-    }
-  );
-};
-
-/**
- * Send MFA token to email [email]
- * @param req
- * @param res
- */
-export const sendMfaToken = async (req: Request, res: Response) => {
-  const {
-    body: { email }
-  } = await validateRequest(reqValidator.SendMfaTokenV2, req);
-
-  const code = await TokenService.createToken({
-    type: TOKEN_EMAIL_MFA,
-    email
-  });
-
-  // send MFA code [code] to [email]
-  await sendMail({
-    template: "emailMfa.handlebars",
-    subjectLine: "Infisical MFA code",
-    recipients: [email],
-    substitutions: {
-      code
-    }
-  });
-
-  return res.status(200).send({
-    message: "Successfully sent new MFA code"
-  });
-};
-
-/**
- * Verify MFA token [mfaToken] and issue JWT and refresh tokens if the
- * MFA token [mfaToken] is valid
- * @param req
- * @param res
- */
-export const verifyMfaToken = async (req: Request, res: Response) => {
-  const {
-    body: { email, mfaToken }
-  } = await validateRequest(reqValidator.VerifyMfaTokenV2, req);
-
-  await TokenService.validateToken({
-    type: TOKEN_EMAIL_MFA,
-    email,
-    token: mfaToken
-  });
-
-  const user = await User.findOne({
-    email
-  }).select(
-    "+salt +verifier +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag +publicKey +encryptedPrivateKey +iv +tag +devices"
-  );
-
-  if (!user) throw new Error("Failed to find user");
-
-  await LoginSRPDetail.deleteOne({ userId: user.id });
-
-  await checkUserDevice({
-    user,
-    ip: req.realIP,
-    userAgent: req.headers["user-agent"] ?? ""
-  });
-
-  // issue tokens
-  const tokens = await issueAuthTokens({
-    userId: user._id,
-    ip: req.realIP,
-    userAgent: req.headers["user-agent"] ?? ""
-  });
-
-  // store (refresh) token in httpOnly cookie
-  res.cookie("jid", tokens.refreshToken, {
-    httpOnly: true,
-    path: "/",
-    sameSite: "strict",
-    secure: await getHttpsEnabled()
-  });
-
-  interface VerifyMfaTokenRes {
-    encryptionVersion: number;
-    protectedKey?: string;
-    protectedKeyIV?: string;
-    protectedKeyTag?: string;
-    token: string;
-    publicKey: string;
-    encryptedPrivateKey: string;
-    iv: string;
-    tag: string;
-  }
-
-  interface VerifyMfaTokenRes {
-    encryptionVersion: number;
-    protectedKey?: string;
-    protectedKeyIV?: string;
-    protectedKeyTag?: string;
-    token: string;
-    publicKey: string;
-    encryptedPrivateKey: string;
-    iv: string;
-    tag: string;
-  }
-
-  const resObj: VerifyMfaTokenRes = {
-    encryptionVersion: user.encryptionVersion,
-    token: tokens.token,
-    publicKey: user.publicKey as string,
-    encryptedPrivateKey: user.encryptedPrivateKey as string,
-    iv: user.iv as string,
-    tag: user.tag as string
-  };
-
-  if (user?.protectedKey && user?.protectedKeyIV && user?.protectedKeyTag) {
-    resObj.protectedKey = user.protectedKey;
-    resObj.protectedKeyIV = user.protectedKeyIV;
-    resObj.protectedKeyTag = user.protectedKeyTag;
-  }
-
-  const loginAction = await EELogService.createAction({
-    name: ACTION_LOGIN,
-    userId: user._id
-  });
-
-  loginAction &&
-    (await EELogService.createLog({
-      userId: user._id,
-      actions: [loginAction],
-      channel: getUserAgentType(req.headers["user-agent"]),
-      ipAddress: req.realIP
-    }));
-
-  return res.status(200).send(resObj);
-};

backend/src/controllers/v2/environmentController.ts

@@ -1,240 +1,61 @@
-import { Request, Response } from "express";
-import { Types } from "mongoose";
+import { Request, Response } from 'express';
+import * as Sentry from '@sentry/node';
 import {
-  Folder,
-  Integration,
-  Membership,
   Secret,
   ServiceToken,
+  Workspace,
+  Integration,
   ServiceTokenData,
-  Workspace
-} from "../../models";
-import { EventType, SecretVersion } from "../../ee/models";
-import { EEAuditLogService, EELicenseService } from "../../ee/services";
-import { BadRequestError, WorkspaceNotFoundError } from "../../utils/errors";
-import _ from "lodash";
-import { PERMISSION_READ_SECRETS, PERMISSION_WRITE_SECRETS } from "../../variables";
-import { validateRequest } from "../../helpers/validation";
-import * as reqValidator from "../../validation/environments";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSub,
-  getUserProjectPermissions
-} from "../../ee/services/ProjectRoleService";
-import { ForbiddenError } from "@casl/ability";
-import { SecretImport } from "../../models";
-import { ServiceAccountWorkspacePermission } from "../../models";
-import { Webhook } from "../../models";
+  Membership,
+} from '../../models';
+import { SecretVersion } from '../../ee/models';
+import { BadRequestError } from '../../utils/errors';
+import _ from 'lodash';
+import { ABILITY_READ } from '../../variables/organization';
 
 /**
- * Create new workspace environment named [environmentName]
- * with slug [environmentSlug] under workspace with id
+ * Create new workspace environment named [environmentName] under workspace with id
  * @param req
  * @param res
  * @returns
  */
-export const createWorkspaceEnvironment = async (req: Request, res: Response) => {
-  /*
-    #swagger.summary = 'Create environment'
-    #swagger.description = 'Create environment'
-
-    #swagger.security = [{
-        "apiKeyAuth": []
-    }]
-
-	#swagger.parameters['workspaceId'] = {
-		"description": "ID of project",
-		"required": true,
-		"type": "string"
-	}
-
-  /*
-    #swagger.summary = 'Create environment'
-    #swagger.description = 'Create environment'
-
-    #swagger.security = [{
-        "apiKeyAuth": []
-    }]
-
-	#swagger.parameters['workspaceId'] = {
-		"description": "ID of project",
-		"required": true,
-		"type": "string"
-	}
-
-  #swagger.requestBody = {
-      content: {
-          "application/json": {
-              "schema": {
-                  "type": "object",
-                  "properties": {
-                      "environmentName": {
-                          "type": "string",
-                          "description": "Name of the environment",
-                          "example": "development"
-                      },
-                      "environmentSlug": {
-                          "type": "string",
-                          "description": "Slug of the environment",
-                          "example": "dev-environment"
-                      }
-                  },
-                  "required": ["environmentName", "environmentSlug"]
-              }
-          }
-      }
-  }
-
-  #swagger.responses[200] = {
-      content: {
-          "application/json": {
-              "schema": {
-                  "type": "object",
-                  "properties": {
-                      "message": {
-                          "type": "string",
-                          "example": "Successfully created new environment"
-                      },
-                      "workspace": {
-                          "type": "string",
-                          "example": "someWorkspaceId"
-                      },
-                      "environment": {
-                          "type": "object",
-                          "properties": {
-                              "name": {
-                                  "type": "string",
-                                  "example": "someEnvironmentName"
-                              },
-                              "slug": {
-                                  "type": "string",
-                                  "example": "someEnvironmentSlug"
-                              }
-                          }
-                      }
-                  },
-                  "description": "Response after creating a new environment"
-              }
-          }
-      }
-  }
-  */
-  const {
-    params: { workspaceId },
-    body: { environmentName, environmentSlug }
-  } = await validateRequest(reqValidator.CreateWorkspaceEnvironmentV2, req);
-
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Create,
-    ProjectPermissionSub.Environments
-  );
-
-  const workspace = await Workspace.findById(workspaceId).exec();
-
-  if (!workspace) throw WorkspaceNotFoundError();
-
-  const plan = await EELicenseService.getPlan(workspace.organization);
-
-  if (plan.environmentLimit !== null) {
-    // case: limit imposed on number of environments allowed
-    if (workspace.environments.length >= plan.environmentLimit) {
-      // case: number of environments used exceeds the number of environments allowed
-
-      return res.status(400).send({
-        message:
-          "Failed to create environment due to environment limit reached. Upgrade plan to create more environments."
-      });
+export const createWorkspaceEnvironment = async (
+  req: Request,
+  res: Response
+) => {
+  const { workspaceId } = req.params;
+  const { environmentName, environmentSlug } = req.body;
+  try {
+    const workspace = await Workspace.findById(workspaceId).exec();
+    if (
+      !workspace ||
+      workspace?.environments.find(
+        ({ name, slug }) => slug === environmentSlug || environmentName === name
+      )
+    ) {
+      throw new Error('Failed to create workspace environment');
     }
+
+    workspace?.environments.push({
+      name: environmentName,
+      slug: environmentSlug.toLowerCase(),
+    });
+    await workspace.save();
+  } catch (err) {
+    Sentry.setUser({ email: req.user.email });
+    Sentry.captureException(err);
+    return res.status(400).send({
+      message: 'Failed to create new workspace environment',
+    });
   }
 
-  if (
-    !workspace ||
-    workspace?.environments.find(
-      ({ name, slug }) => slug === environmentSlug || environmentName === name
-    )
-  ) {
-    throw new Error("Failed to create workspace environment");
-  }
-
-  workspace?.environments.push({
-    name: environmentName,
-    slug: environmentSlug.toLowerCase()
-  });
-  await workspace.save();
-
-  await EELicenseService.refreshPlan(workspace.organization, new Types.ObjectId(workspaceId));
-
-  await EEAuditLogService.createAuditLog(
-    req.authData,
-    {
-      type: EventType.CREATE_ENVIRONMENT,
-      metadata: {
-        name: environmentName,
-        slug: environmentSlug
-      }
-    },
-    {
-      workspaceId: workspace._id
-    }
-  );
-
   return res.status(200).send({
-    message: "Successfully created new environment",
+    message: 'Successfully created new environment',
     workspace: workspaceId,
     environment: {
       name: environmentName,
-      slug: environmentSlug
-    }
-  });
-};
-
-/**
- * Swaps the ordering of two environments in the database. This is purely for aesthetic purposes.
- * @param req
- * @param res
- * @returns
- */
-export const reorderWorkspaceEnvironments = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId },
-    body: { environmentName, environmentSlug, otherEnvironmentSlug, otherEnvironmentName }
-  } = await validateRequest(reqValidator.ReorderWorkspaceEnvironmentsV2, req);
-
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Edit,
-    ProjectPermissionSub.Environments
-  );
-
-  // atomic update the env to avoid conflict
-  const workspace = await Workspace.findById(workspaceId).exec();
-  if (!workspace) {
-    throw BadRequestError({ message: "Couldn't load workspace" });
-  }
-
-  const environmentIndex = workspace.environments.findIndex(
-    (env) => env.name === environmentName && env.slug === environmentSlug
-  );
-  const otherEnvironmentIndex = workspace.environments.findIndex(
-    (env) => env.name === otherEnvironmentName && env.slug === otherEnvironmentSlug
-  );
-
-  if (environmentIndex === -1 || otherEnvironmentIndex === -1) {
-    throw BadRequestError({ message: "environment or otherEnvironment couldn't be found" });
-  }
-
-  // swap the order of the environments
-  [workspace.environments[environmentIndex], workspace.environments[otherEnvironmentIndex]] = [
-    workspace.environments[otherEnvironmentIndex],
-    workspace.environments[environmentIndex]
-  ];
-
-  await workspace.save();
-
-  return res.status(200).send({
-    message: "Successfully reordered environments",
-    workspace: workspaceId
+      slug: environmentSlug,
+    },
   });
 };
 
@@ -245,203 +66,88 @@ export const reorderWorkspaceEnvironments = async (req: Request, res: Response)
  * @param res
  * @returns
  */
-export const renameWorkspaceEnvironment = async (req: Request, res: Response) => {
-  /*
-    #swagger.summary = 'Rename workspace environment'
-    #swagger.description = 'Rename a specific environment within a workspace'
-
-    #swagger.parameters['workspaceId'] = {
-    "description": "ID of the workspace",
-    "required": true,
-    "type": "string",
-        "in": "path"
-  }
-
-    #swagger.requestBody = {
-        content: {
-            "application/json": {
-                "schema": {
-                    "type": "object",
-                    "properties": {
-                        "environmentName": {
-                            "type": "string",
-                            "description": "New name for the environment",
-                            "example": "Staging-Renamed"
-                        },
-                        "environmentSlug": {
-                            "type": "string",
-                            "description": "New slug for the environment",
-                            "example": "staging-renamed"
-                        },
-                        "oldEnvironmentSlug": {
-                            "type": "string",
-                            "description": "Current slug of the environment to rename",
-                            "example": "staging-old"
-                        }
-                    },
-                    "required": ["environmentName", "environmentSlug", "oldEnvironmentSlug"]
-                }
-            }
-        }
+export const renameWorkspaceEnvironment = async (
+  req: Request,
+  res: Response
+) => {
+  const { workspaceId } = req.params;
+  const { environmentName, environmentSlug, oldEnvironmentSlug } = req.body;
+  try {
+    // user should pass both new slug and env name
+    if (!environmentSlug || !environmentName) {
+      throw new Error('Invalid environment given.');
     }
 
-    #swagger.responses[200] = {
-        content: {
-            "application/json": {
-                "schema": {
-                    "type": "object",
-                    "properties": {
-                        "message": {
-                            "type": "string",
-                            "example": "Successfully update environment"
-                        },
-                        "workspace": {
-                            "type": "string",
-                            "example": "someWorkspaceId"
-                        },
-                        "environment": {
-                            "type": "object",
-                            "properties": {
-                                "name": {
-                                    "type": "string",
-                                    "example": "Staging-Renamed"
-                                },
-                                "slug": {
-                                    "type": "string",
-                                    "example": "staging-renamed"
-                                }
-                            }
-                        }
-                    },
-                    "description": "Details of the renamed environment"
-                }
-            }
-        }
+    // atomic update the env to avoid conflict
+    const workspace = await Workspace.findById(workspaceId).exec();
+    if (!workspace) {
+      throw new Error('Failed to create workspace environment');
     }
-  */
-  const {
-    params: { workspaceId },
-    body: { environmentName, environmentSlug, oldEnvironmentSlug }
-  } = await validateRequest(reqValidator.UpdateWorkspaceEnvironmentV2, req);
 
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Edit,
-    ProjectPermissionSub.Environments
-  );
-
-  // user should pass both new slug and env name
-  if (!environmentSlug || !environmentName) {
-    throw new Error("Invalid environment given.");
-  }
-
-  // atomic update the env to avoid conflict
-  const workspace = await Workspace.findById(workspaceId).exec();
-  if (!workspace) {
-    throw new Error("Failed to create workspace environment");
-  }
-
-  const isEnvExist = workspace.environments.some(
-    ({ name, slug }) =>
-      slug !== oldEnvironmentSlug && (name === environmentName || slug === environmentSlug)
-  );
-  if (isEnvExist) {
-    throw new Error("Invalid environment given");
-  }
-
-  const envIndex = workspace?.environments.findIndex(({ slug }) => slug === oldEnvironmentSlug);
-  if (envIndex === -1) {
-    throw new Error("Invalid environment given");
-  }
-
-  const oldEnvironment = workspace.environments[envIndex];
-
-  workspace.environments[envIndex].name = environmentName;
-  workspace.environments[envIndex].slug = environmentSlug.toLowerCase();
-
-  await workspace.save();
-  await Secret.updateMany(
-    { workspace: workspaceId, environment: oldEnvironmentSlug },
-    { environment: environmentSlug }
-  );
-  await SecretVersion.updateMany(
-    { workspace: workspaceId, environment: oldEnvironmentSlug },
-    { environment: environmentSlug }
-  );
-  await ServiceToken.updateMany(
-    { workspace: workspaceId, environment: oldEnvironmentSlug },
-    { environment: environmentSlug }
-  );
-  await ServiceTokenData.updateMany(
-    {
-      workspace: workspaceId,
-      "scopes.environment": oldEnvironmentSlug
-    },
-    { $set: { "scopes.$[element].environment": environmentSlug } },
-    { arrayFilters: [{ "element.environment": oldEnvironmentSlug }] }
-  );
-  await Integration.updateMany(
-    { workspace: workspaceId, environment: oldEnvironmentSlug },
-    { environment: environmentSlug }
-  );
-
-  await Folder.updateMany(
-    { workspace: workspaceId, environment: oldEnvironmentSlug },
-    { environment: environmentSlug }
-  );
-
-  await SecretImport.updateMany(
-    { workspace: workspaceId, environment: oldEnvironmentSlug },
-    { environment: environmentSlug }
-  );
-  await SecretImport.updateMany(
-    { workspace: workspaceId, "imports.environment": oldEnvironmentSlug },
-    { $set: { "imports.$[element].environment": environmentSlug } },
-    { arrayFilters: [{ "element.environment": oldEnvironmentSlug }] },
-  );
-
-  await ServiceAccountWorkspacePermission.updateMany(
-    { workspace: workspaceId, environment: oldEnvironmentSlug },
-    { environment: environmentSlug }
-  );
-
-  await Webhook.updateMany(
-    { workspace: workspaceId, environment: oldEnvironmentSlug },
-    { environment: environmentSlug }
-  );
-
-  await Membership.updateMany(
-    {
-      workspace: workspaceId,
-      "deniedPermissions.environmentSlug": oldEnvironmentSlug
-    },
-    { $set: { "deniedPermissions.$[element].environmentSlug": environmentSlug } },
-    { arrayFilters: [{ "element.environmentSlug": oldEnvironmentSlug }] }
-  );
-
-  await EEAuditLogService.createAuditLog(
-    req.authData,
-    {
-      type: EventType.UPDATE_ENVIRONMENT,
-      metadata: {
-        oldName: oldEnvironment.name,
-        newName: environmentName,
-        oldSlug: oldEnvironment.slug,
-        newSlug: environmentSlug.toLowerCase()
-      }
-    },
-    {
-      workspaceId: workspace._id
+    const isEnvExist = workspace.environments.some(
+      ({ name, slug }) =>
+        slug !== oldEnvironmentSlug &&
+        (name === environmentName || slug === environmentSlug)
+    );
+    if (isEnvExist) {
+      throw new Error('Invalid environment given');
     }
-  );
+
+    const envIndex = workspace?.environments.findIndex(
+      ({ slug }) => slug === oldEnvironmentSlug
+    );
+    if (envIndex === -1) {
+      throw new Error('Invalid environment given');
+    }
+
+    workspace.environments[envIndex].name = environmentName;
+    workspace.environments[envIndex].slug = environmentSlug.toLowerCase();
+
+    await workspace.save();
+    await Secret.updateMany(
+      { workspace: workspaceId, environment: oldEnvironmentSlug },
+      { environment: environmentSlug }
+    );
+    await SecretVersion.updateMany(
+      { workspace: workspaceId, environment: oldEnvironmentSlug },
+      { environment: environmentSlug }
+    );
+    await ServiceToken.updateMany(
+      { workspace: workspaceId, environment: oldEnvironmentSlug },
+      { environment: environmentSlug }
+    );
+    await ServiceTokenData.updateMany(
+      { workspace: workspaceId, environment: oldEnvironmentSlug },
+      { environment: environmentSlug }
+    );
+    await Integration.updateMany(
+      { workspace: workspaceId, environment: oldEnvironmentSlug },
+      { environment: environmentSlug }
+    );
+    await Membership.updateMany(
+      {
+        workspace: workspaceId,
+        "deniedPermissions.environmentSlug": oldEnvironmentSlug
+      },
+      { $set: { "deniedPermissions.$[element].environmentSlug": environmentSlug } },
+      { arrayFilters: [{ "element.environmentSlug": oldEnvironmentSlug }] }
+    )
+
+  } catch (err) {
+    Sentry.setUser({ email: req.user.email });
+    Sentry.captureException(err);
+    return res.status(400).send({
+      message: 'Failed to update workspace environment',
+    });
+  }
 
   return res.status(200).send({
-    message: "Successfully update environment",
+    message: 'Successfully update environment',
     workspace: workspaceId,
     environment: {
       name: environmentName,
-      slug: environmentSlug
-    }
+      slug: environmentSlug,
+    },
   });
 };
 
@@ -451,238 +157,101 @@ export const renameWorkspaceEnvironment = async (req: Request, res: Response) =>
  * @param res
  * @returns
  */
-export const deleteWorkspaceEnvironment = async (req: Request, res: Response) => {
-  /*
-    #swagger.summary = 'Delete workspace environment'
-    #swagger.description = 'Delete a specific environment from a workspace'
-
-    #swagger.security = [{
-        "apiKeyAuth": []
-    }]
-
-    #swagger.parameters['workspaceId'] = {
-		"description": "ID of the workspace",
-		"required": true,
-		"type": "string",
-        "in": "path"
-	}
-
-    #swagger.requestBody = {
-        content: {
-            "application/json": {
-                "schema": {
-                    "type": "object",
-                    "properties": {
-                        "environmentSlug": {
-                            "type": "string",
-                            "description": "Slug of the environment to delete",
-                            "example": "dev-environment"
-                        }
-                    },
-                    "required": ["environmentSlug"]
-                }
-            }
-        }
+export const deleteWorkspaceEnvironment = async (
+  req: Request,
+  res: Response
+) => {
+  const { workspaceId } = req.params;
+  const { environmentSlug } = req.body;
+  try {
+    // atomic update the env to avoid conflict
+    const workspace = await Workspace.findById(workspaceId).exec();
+    if (!workspace) {
+      throw new Error('Failed to create workspace environment');
     }
 
-    #swagger.responses[200] = {
-        content: {
-            "application/json": {
-                "schema": {
-                    "type": "object",
-                    "properties": {
-                        "message": {
-                            "type": "string",
-                            "example": "Successfully deleted environment"
-                        },
-                        "workspace": {
-                            "type": "string",
-                            "example": "someWorkspaceId"
-                        },
-                        "environment": {
-                            "type": "string",
-                            "example": "dev-environment"
-                        }
-                    },
-                    "description": "Response after deleting an environment from a workspace"
-                }
-            }
-        }
+    const envIndex = workspace?.environments.findIndex(
+      ({ slug }) => slug === environmentSlug
+    );
+    if (envIndex === -1) {
+      throw new Error('Invalid environment given');
     }
-*/
-  const {
-    params: { workspaceId },
-    body: { environmentSlug }
-  } = await validateRequest(reqValidator.DeleteWorkspaceEnvironmentV2, req);
 
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Delete,
-    ProjectPermissionSub.Environments
-  );
+    workspace.environments.splice(envIndex, 1);
+    await workspace.save();
 
-  // atomic update the env to avoid conflict
-  const workspace = await Workspace.findById(workspaceId).exec();
-  if (!workspace) {
-    throw new Error("Failed to create workspace environment");
+    // clean up
+    await Secret.deleteMany({
+      workspace: workspaceId,
+      environment: environmentSlug,
+    });
+    await SecretVersion.deleteMany({
+      workspace: workspaceId,
+      environment: environmentSlug,
+    });
+    await ServiceToken.deleteMany({
+      workspace: workspaceId,
+      environment: environmentSlug,
+    });
+    await ServiceTokenData.deleteMany({
+      workspace: workspaceId,
+      environment: environmentSlug,
+    });
+    await Integration.deleteMany({
+      workspace: workspaceId,
+      environment: environmentSlug,
+    });
+    await Membership.updateMany(
+      { workspace: workspaceId },
+      { $pull: { deniedPermissions: { environmentSlug: environmentSlug } } }
+    )
+
+  } catch (err) {
+    Sentry.setUser({ email: req.user.email });
+    Sentry.captureException(err);
+    return res.status(400).send({
+      message: 'Failed to delete workspace environment',
+    });
   }
 
-  const envIndex = workspace?.environments.findIndex(({ slug }) => slug === environmentSlug);
-  if (envIndex === -1) {
-    throw new Error("Invalid environment given");
-  }
-
-  const oldEnvironment = workspace.environments[envIndex];
-
-  workspace.environments.splice(envIndex, 1);
-  await workspace.save();
-
-  // clean up
-  await Secret.deleteMany({
-    workspace: workspaceId,
-    environment: environmentSlug
-  });
-  await SecretVersion.deleteMany({
-    workspace: workspaceId,
-    environment: environmentSlug
-  });
-
-  // await ServiceToken.deleteMany({
-  //   workspace: workspaceId,
-  //   environment: environmentSlug,
-  // });
-
-  const result = await ServiceTokenData.updateMany(
-    { workspace: workspaceId },
-    { $pull: { scopes: { environment: environmentSlug } } }
-  );
-
-  if (result.modifiedCount > 0) {
-    await ServiceTokenData.deleteMany({ workspace: workspaceId, scopes: { $size: 0 } });
-  }
-
-  await Integration.deleteMany({
-    workspace: workspaceId,
-    environment: environmentSlug
-  });
-  await Membership.updateMany(
-    { workspace: workspaceId },
-    { $pull: { deniedPermissions: { environmentSlug: environmentSlug } } }
-  );
-
-  await EELicenseService.refreshPlan(workspace.organization, new Types.ObjectId(workspaceId));
-
-  await EEAuditLogService.createAuditLog(
-    req.authData,
-    {
-      type: EventType.DELETE_ENVIRONMENT,
-      metadata: {
-        name: oldEnvironment.name,
-        slug: oldEnvironment.slug
-      }
-    },
-    {
-      workspaceId: workspace._id
-    }
-  );
-
   return res.status(200).send({
-    message: "Successfully deleted environment",
+    message: 'Successfully deleted environment',
     workspace: workspaceId,
-    environment: environmentSlug
+    environment: environmentSlug,
   });
 };
 
-// TODO(akhilmhdh) after rbac this can be completely removed
-export const getAllAccessibleEnvironmentsOfWorkspace = async (req: Request, res: Response) => {
-  /*
-    #swagger.summary = 'Get all accessible environments of a workspace'
-    #swagger.description = 'Fetch all environments that the user has access to in a specified workspace'
 
-    #swagger.security = [{
-        "apiKeyAuth": []
-    }]
+export const getAllAccessibleEnvironmentsOfWorkspace = async (
+  req: Request,
+  res: Response
+) => {
+  const { workspaceId } = req.params;
+  const workspacesUserIsMemberOf = await Membership.findOne({
+    workspace: workspaceId,
+    user: req.user
+  })
 
-    #swagger.parameters['workspaceId'] = {
-		"description": "ID of the workspace",
-		"required": true,
-		"type": "string",
-        "in": "path"
-	}
-
-    #swagger.responses[200] = {
-        content: {
-            "application/json": {
-                "schema": {
-                    "type": "object",
-                    "properties": {
-                        "accessibleEnvironments": {
-                            "type": "array",
-                            "items": {
-                                "type": "object",
-                                "properties": {
-                                    "name": {
-                                        "type": "string",
-                                        "example": "Development"
-                                    },
-                                    "slug": {
-                                        "type": "string",
-                                        "example": "development"
-                                    },
-                                    "isWriteDenied": {
-                                        "type": "boolean",
-                                        "example": false
-                                    },
-                                    "isReadDenied": {
-                                        "type": "boolean",
-                                        "example": false
-                                    }
-                                }
-                            }
-                        }
-                    },
-                    "description": "List of environments the user has access to in the specified workspace"
-                }
-            }
-        }
-    }
-  */
-  const {
-    params: { workspaceId }
-  } = await validateRequest(reqValidator.GetAllAccessibileEnvironmentsOfWorkspaceV2, req);
-
-  const { membership: workspacesUserIsMemberOf } = await getUserProjectPermissions(
-    req.user._id,
-    workspaceId
-  );
-
-  const accessibleEnvironments: any = [];
-  const deniedPermission = workspacesUserIsMemberOf.deniedPermissions;
-
-  const relatedWorkspace = await Workspace.findById(workspaceId);
-  if (!relatedWorkspace) {
-    throw BadRequestError();
+  if (!workspacesUserIsMemberOf) {
+    throw BadRequestError()
   }
-  relatedWorkspace.environments.forEach((environment) => {
-    const isReadBlocked = _.some(deniedPermission, {
-      environmentSlug: environment.slug,
-      ability: PERMISSION_READ_SECRETS
-    });
-    const isWriteBlocked = _.some(deniedPermission, {
-      environmentSlug: environment.slug,
-      ability: PERMISSION_WRITE_SECRETS
-    });
-    if (isReadBlocked && isWriteBlocked) {
-      return;
-    } else {
-      accessibleEnvironments.push({
-        name: environment.name,
-        slug: environment.slug,
-        isWriteDenied: isWriteBlocked,
-        isReadDenied: isReadBlocked
-      });
-    }
-  });
 
-  res.json({ accessibleEnvironments });
+  const accessibleEnvironments: { name: string; slug: string; }[] = []
+  const deniedPermission = workspacesUserIsMemberOf.deniedPermissions
+
+  const relatedWorkspace = await Workspace.findById(workspaceId)
+  if (!relatedWorkspace) {
+    throw BadRequestError()
+  }
+  relatedWorkspace.environments.forEach(environment => {
+    const isReadBlocked = _.some(deniedPermission, { environmentSlug: environment.slug, ability: ABILITY_READ })
+    // const isWriteBlocked = _.some(deniedPermission, { environmentSlug: environment.slug, ability: ABILITY_WRITE })
+    if (isReadBlocked) {
+      return
+    } else {
+      accessibleEnvironments.push(environment)
+    }
+  })
+
+  res.json({ accessibleEnvironments })
 };

backend/src/controllers/v2/index.ts

@@ -1,25 +1,19 @@
-import * as authController from "./authController";
-import * as signupController from "./signupController";
-import * as usersController from "./usersController";
-import * as organizationsController from "./organizationsController";
-import * as workspaceController from "./workspaceController";
-import * as serviceTokenDataController from "./serviceTokenDataController";
-import * as secretController from "./secretController";
-import * as secretsController from "./secretsController";
-import * as serviceAccountsController from "./serviceAccountsController";
-import * as environmentController from "./environmentController";
-import * as tagController from "./tagController";
+import * as usersController from './usersController';
+import * as organizationsController from './organizationsController';
+import * as workspaceController from './workspaceController';
+import * as serviceTokenDataController from './serviceTokenDataController';
+import * as apiKeyDataController from './apiKeyDataController';
+import * as secretController from './secretController';
+import * as secretsController from './secretsController';
+import * as environmentController from './environmentController';
 
 export {
-    authController,
-    signupController,
     usersController,
     organizationsController,
     workspaceController,
     serviceTokenDataController,
+    apiKeyDataController,
     secretController,
     secretsController,
-    serviceAccountsController,
-    environmentController,
-    tagController,
+    environmentController
 }

backend/src/controllers/v2/organizationsController.ts

@@ -1,41 +1,20 @@
-import { Request, Response } from "express";
-import { Types } from "mongoose";
+import { Request, Response } from 'express';
+import * as Sentry from '@sentry/node';
 import { 
-  Membership, 
-  MembershipOrg, 
-  ServiceAccount, 
-  Workspace 
-} from "../../models";
-import { Role } from "../../ee/models";
-import { deleteMembershipOrg } from "../../helpers/membershipOrg";
-import { 
-  createOrganization as create,
-  deleteOrganization,
-  updateSubscriptionOrgQuantity
-} from "../../helpers/organization";
-import { addMembershipsOrg } from "../../helpers/membershipOrg";
-import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
-import {
-  ACCEPTED,
-  ADMIN,
-  CUSTOM 
-} from "../../variables";
-import * as reqValidator from "../../validation/organization";
-import { validateRequest } from "../../helpers/validation";
-import {
-  OrgPermissionActions,
-  OrgPermissionSubjects,
-  getUserOrgPermissions
-} from "../../ee/services/RoleService";
-import { ForbiddenError } from "@casl/ability";
+    MembershipOrg,
+    Membership,
+    Workspace
+} from '../../models';
+import { deleteMembershipOrg } from '../../helpers/membershipOrg';
+import { updateSubscriptionOrgQuantity } from '../../helpers/organization';
 
 /**
  * Return memberships for organization with id [organizationId]
- * @param req
- * @param res
+ * @param req 
+ * @param res 
  */
 export const getOrganizationMemberships = async (req: Request, res: Response) => {
-  /* 
+    /* 
     #swagger.summary = 'Return organization memberships'
     #swagger.description = 'Return organization memberships'
     
@@ -68,32 +47,33 @@ export const getOrganizationMemberships = async (req: Request, res: Response) =>
         }
     }   
     */
-  const {
-    params: { organizationId }
-  } = await validateRequest(reqValidator.GetOrgMembersv2, req);
+    let memberships;
+    try {
+        const { organizationId } = req.params;
 
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Read,
-    OrgPermissionSubjects.Member
-  );
-
-  const memberships = await MembershipOrg.find({
-    organization: organizationId
-  }).populate("user", "+publicKey");
-
-  return res.status(200).send({
-    memberships
-  });
-};
+		memberships = await MembershipOrg.find({
+			organization: organizationId
+		}).populate('user', '+publicKey');
+    } catch (err) {
+        Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get organization memberships'
+		});
+    }
+    
+    return res.status(200).send({
+        memberships
+    });
+}
 
 /**
  * Update role of membership with id [membershipId] to role [role]
- * @param req
- * @param res
+ * @param req 
+ * @param res 
  */
 export const updateOrganizationMembership = async (req: Request, res: Response) => {
-  /* 
+    /* 
     #swagger.summary = 'Update organization membership'
     #swagger.description = 'Update organization membership'
     
@@ -146,58 +126,40 @@ export const updateOrganizationMembership = async (req: Request, res: Response)
         }
     }   
     */
-  const {
-    params: { organizationId, membershipId },
-    body: { role }
-  } = await validateRequest(reqValidator.UpdateOrgMemberv2, req);
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Edit,
-    OrgPermissionSubjects.Member
-  );
-
-  const isCustomRole = !["admin", "member", "owner"].includes(role);
-  if (isCustomRole) {
-    const orgRole = await Role.findOne({ slug: role, isOrgRole: true });
-    if (!orgRole) throw BadRequestError({ message: "Role not found" });
-
-    const membership = await MembershipOrg.findByIdAndUpdate(membershipId, {
-      role: CUSTOM,
-      customRole: orgRole
-    });
-    return res.status(200).send({
-      membership
-    });
-  }
-
-  const membership = await MembershipOrg.findByIdAndUpdate(
-    membershipId,
-    {
-      $set: {
-        role
-      },
-      $unset: {
-        customRole: 1
-      }
-    },
-    {
-      new: true
+    let membership;
+    try {
+        const { membershipId } = req.params;
+        const { role } = req.body;
+        
+        membership = await MembershipOrg.findByIdAndUpdate(
+            membershipId,
+            {
+                role
+            }, {
+                new: true
+            }
+        );
+    } catch (err) {
+        Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to update organization membership'
+		});
     }
-  );
-
-  return res.status(200).send({
-    membership
-  });
-};
+    
+    return res.status(200).send({
+        membership
+    });
+}
 
 /**
  * Delete organization membership with id [membershipId]
- * @param req
- * @param res
- * @returns
+ * @param req 
+ * @param res 
+ * @returns 
  */
 export const deleteOrganizationMembership = async (req: Request, res: Response) => {
-  /* 
+    /* 
     #swagger.summary = 'Delete organization membership'
     #swagger.description = 'Delete organization membership'
     
@@ -233,37 +195,39 @@ export const deleteOrganizationMembership = async (req: Request, res: Response)
         }
     }   
     */
-  const {
-    params: { organizationId, membershipId }
-  } = await validateRequest(reqValidator.DeleteOrgMemberv2, req);
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Delete,
-    OrgPermissionSubjects.Member
-  );
+    let membership;
+    try {
+        const { membershipId } = req.params;
+        
+        // delete organization membership
+        membership = await deleteMembershipOrg({
+            membershipOrgId: membershipId
+        });
 
-  // delete organization membership
-  const membership = await deleteMembershipOrg({
-    membershipOrgId: membershipId
-  });
+        await updateSubscriptionOrgQuantity({
+			organizationId: membership.organization.toString()
+		});
+    } catch (err) {
+        Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to delete organization membership'
+		});	
+    }
 
-  await updateSubscriptionOrgQuantity({
-    organizationId: membership.organization.toString()
-  });
-
-  return res.status(200).send({
-    membership
-  });
-};
+    return res.status(200).send({
+        membership
+    });
+}
 
 /**
  * Return workspaces for organization with id [organizationId] that user has
  * access to
- * @param req
- * @param res
+ * @param req 
+ * @param res 
  */
 export const getOrganizationWorkspaces = async (req: Request, res: Response) => {
-  /* 
+    /* 
     #swagger.summary = 'Return projects in organization that user is part of'
     #swagger.description = 'Return projects in organization that user is part of'
     
@@ -296,110 +260,37 @@ export const getOrganizationWorkspaces = async (req: Request, res: Response) =>
         }
     }   
     */
-  const {
-    params: { organizationId }
-  } = await validateRequest(reqValidator.GetOrgWorkspacesv2, req);
+    let workspaces;
+    try {
+        const { organizationId } = req.params;
 
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Read,
-    OrgPermissionSubjects.Workspace
-  );
+		const workspacesSet = new Set(
+			(
+				await Workspace.find(
+					{
+						organization: organizationId
+					},
+					'_id'
+				)
+			).map((w) => w._id.toString())
+		);
 
-  const workspacesSet = new Set(
-    (
-      await Workspace.find(
-        {
-          organization: organizationId
-        },
-        "_id"
-      )
-    ).map((w) => w._id.toString())
-  );
-
-  const workspaces = (
-    await Membership.find({
-      user: req.user._id
-    }).populate("workspace")
-  )
-    .filter((m) => workspacesSet.has(m.workspace._id.toString()))
-    .map((m) => m.workspace);
-
-  return res.status(200).send({
-    workspaces
-  });
-};
-
-/**
- * Return service accounts for organization with id [organizationId]
- * @param req
- * @param res
- */
-export const getOrganizationServiceAccounts = async (req: Request, res: Response) => {
-  const { organizationId } = req.params;
-
-  const serviceAccounts = await ServiceAccount.find({
-    organization: new Types.ObjectId(organizationId)
-  });
-
-  return res.status(200).send({
-    serviceAccounts
-  });
-};
-
-/**
- * Create new organization named [organizationName]
- * and add user as owner
- * @param req
- * @param res
- * @returns
- */
- export const createOrganization = async (req: Request, res: Response) => {
-  const {
-    body: { name }
-  } = await validateRequest(reqValidator.CreateOrgv2, req);
-
-  // create organization and add user as member
-  const organization = await create({
-    email: req.user.email,
-    name
-  });
-
-  await addMembershipsOrg({
-    userIds: [req.user._id.toString()],
-    organizationId: organization._id.toString(),
-    roles: [ADMIN],
-    statuses: [ACCEPTED]
-  });
-
-  return res.status(200).send({
-    organization
-  });
-};
-
-/**
- * Delete organization with id [organizationId]
- * @param req 
- * @param res 
- */
-export const deleteOrganizationById = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId }
-  } = await validateRequest(reqValidator.DeleteOrgv2, req);
-  
-  const membershipOrg = await MembershipOrg.findOne({
-    user: req.user._id,
-    organization: new Types.ObjectId(organizationId),
-    role: ADMIN
-  });
-  
-  if (!membershipOrg) throw UnauthorizedRequestError();
-  
-  const organization = await deleteOrganization({
-    organizationId: new Types.ObjectId(organizationId)
-  });
-  
-  return res.status(200).send({
-    organization
-  });
+		workspaces = (
+			await Membership.find({
+				user: req.user._id
+			}).populate('workspace')
+		)
+			.filter((m) => workspacesSet.has(m.workspace._id.toString()))
+			.map((m) => m.workspace);
+    } catch (err) {
+        Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get organization workspaces'
+		});	
+    }
+    
+    return res.status(200).send({
+        workspaces
+    });
 }

backend/src/controllers/v2/secretController.ts

@@ -1,36 +1,22 @@
+import to from "await-to-js";
 import { Request, Response } from "express";
 import mongoose, { Types } from "mongoose";
-import {
-  CreateSecretRequestBody,
-  ModifySecretRequestBody,
-  SanitizedSecretForCreate,
-  SanitizedSecretModify
-} from "../../types/secret";
+import Secret, { ISecret } from "../../models/secret";
+import { CreateSecretRequestBody, ModifySecretRequestBody, SanitizedSecretForCreate, SanitizedSecretModify } from "../../types/secret";
 const { ValidationError } = mongoose.Error;
-import {
-  ValidationError as RouteValidationError,
-  UnauthorizedRequestError
-} from "../../utils/errors";
-import { AnyBulkWriteOperation } from "mongodb";
-import {
-  ALGORITHM_AES_256_GCM,
-  ENCODING_SCHEME_UTF8,
-  SECRET_PERSONAL,
-  SECRET_SHARED
-} from "../../variables";
-import { TelemetryService } from "../../services";
-import { ISecret, Secret, User } from "../../models";
-import { AccountNotFoundError } from "../../utils/errors";
+import { BadRequestError, InternalServerError, UnauthorizedRequestError, ValidationError as RouteValidationError } from '../../utils/errors';
+import { AnyBulkWriteOperation } from 'mongodb';
+import { SECRET_PERSONAL, SECRET_SHARED } from "../../variables";
+import { postHogClient } from '../../services';
 
 /**
  * Create secret for workspace with id [workspaceId] and environment [environment]
- * @param req
- * @param res
+ * @param req 
+ * @param res 
  */
 export const createSecret = async (req: Request, res: Response) => {
-  const postHogClient = await TelemetryService.getPostHogClient();
   const secretToCreate: CreateSecretRequestBody = req.body.secret;
-  const { workspaceId, environment } = req.params;
+  const { workspaceId, environment } = req.params
   const sanitizedSecret: SanitizedSecretForCreate = {
     secretKeyCiphertext: secretToCreate.secretKeyCiphertext,
     secretKeyIV: secretToCreate.secretKeyIV,
@@ -47,44 +33,45 @@ export const createSecret = async (req: Request, res: Response) => {
     workspace: new Types.ObjectId(workspaceId),
     environment,
     type: secretToCreate.type,
-    user: new Types.ObjectId(req.user._id),
-    algorithm: ALGORITHM_AES_256_GCM,
-    keyEncoding: ENCODING_SCHEME_UTF8
-  };
+    user: new Types.ObjectId(req.user._id)
+  }
 
-  const secret = await new Secret(sanitizedSecret).save();
+
+  const [error, secret] = await to(Secret.create(sanitizedSecret).then())
+  if (error instanceof ValidationError) {
+    throw RouteValidationError({ message: error.message, stack: error.stack })
+  }
 
   if (postHogClient) {
     postHogClient.capture({
-      event: "secrets added",
+      event: 'secrets added',
       distinctId: req.user.email,
       properties: {
         numberOfSecrets: 1,
         workspaceId,
         environment,
-        channel: req.headers?.["user-agent"]?.toLowerCase().includes("mozilla") ? "web" : "cli",
-        userAgent: req.headers?.["user-agent"]
+        channel: req.headers?.['user-agent']?.toLowerCase().includes('mozilla') ? 'web' : 'cli',
+        userAgent: req.headers?.['user-agent']
       }
     });
   }
 
   res.status(200).send({
     secret
-  });
-};
+  })
+}
 
 /**
- * Create many secrets for workspace with id [workspaceId] and environment [environment]
- * @param req
- * @param res
+ * Create many secrets for workspace wiht id [workspaceId] and environment [environment]
+ * @param req 
+ * @param res 
  */
 export const createSecrets = async (req: Request, res: Response) => {
-  const postHogClient = await TelemetryService.getPostHogClient();
   const secretsToCreate: CreateSecretRequestBody[] = req.body.secrets;
-  const { workspaceId, environment } = req.params;
-  const sanitizedSecretesToCreate: SanitizedSecretForCreate[] = [];
+  const { workspaceId, environment } = req.params
+  const sanitizedSecretesToCreate: SanitizedSecretForCreate[] = []
 
-  secretsToCreate.forEach((rawSecret) => {
+  secretsToCreate.forEach(rawSecret => {
     const safeUpdateFields: SanitizedSecretForCreate = {
       secretKeyCiphertext: rawSecret.secretKeyCiphertext,
       secretKeyIV: rawSecret.secretKeyIV,
@@ -101,132 +88,138 @@ export const createSecrets = async (req: Request, res: Response) => {
       workspace: new Types.ObjectId(workspaceId),
       environment,
       type: rawSecret.type,
-      user: new Types.ObjectId(req.user._id),
-      algorithm: ALGORITHM_AES_256_GCM,
-      keyEncoding: ENCODING_SCHEME_UTF8
-    };
+      user: new Types.ObjectId(req.user._id)
+    }
 
-    sanitizedSecretesToCreate.push(safeUpdateFields);
-  });
+    sanitizedSecretesToCreate.push(safeUpdateFields)
+  })
 
-  const secrets = await Secret.insertMany(sanitizedSecretesToCreate);
+  const [bulkCreateError, secrets] = await to(Secret.insertMany(sanitizedSecretesToCreate).then())
+  if (bulkCreateError) {
+    if (bulkCreateError instanceof ValidationError) {
+      throw RouteValidationError({ message: bulkCreateError.message, stack: bulkCreateError.stack })
+    }
+
+    throw InternalServerError({ message: "Unable to process your batch create request. Please try again", stack: bulkCreateError.stack })
+  }
 
   if (postHogClient) {
     postHogClient.capture({
-      event: "secrets added",
+      event: 'secrets added',
       distinctId: req.user.email,
       properties: {
         numberOfSecrets: (secretsToCreate ?? []).length,
         workspaceId,
         environment,
-        channel: req.headers?.["user-agent"]?.toLowerCase().includes("mozilla") ? "web" : "cli",
-        userAgent: req.headers?.["user-agent"]
+        channel: req.headers?.['user-agent']?.toLowerCase().includes('mozilla') ? 'web' : 'cli',
+        userAgent: req.headers?.['user-agent']
       }
     });
   }
 
   res.status(200).send({
     secrets
-  });
-};
+  })
+}
 
 /**
  * Delete secrets in workspace with id [workspaceId] and environment [environment]
- * @param req
- * @param res
+ * @param req 
+ * @param res 
  */
 export const deleteSecrets = async (req: Request, res: Response) => {
-  const postHogClient = await TelemetryService.getPostHogClient();
-  const { workspaceId, environmentName } = req.params;
-  const secretIdsToDelete: string[] = req.body.secretIds;
+  const { workspaceId, environmentName } = req.params
+  const secretIdsToDelete: string[] = req.body.secretIds
 
-  const secretIdsUserCanDelete = await Secret.find({ workspace: workspaceId, environment: environmentName }, { _id: 1 });
+  const [secretIdsUserCanDeleteError, secretIdsUserCanDelete] = await to(Secret.find({ workspace: workspaceId, environment: environmentName }, { _id: 1 }).then())
+  if (secretIdsUserCanDeleteError) {
+    throw InternalServerError({ message: `Unable to fetch secrets you own: [error=${secretIdsUserCanDeleteError.message}]` })
+  }
 
-  const secretsUserCanDeleteSet: Set<string> = new Set(
-    secretIdsUserCanDelete.map((objectId) => objectId._id.toString())
-  );
-  const deleteOperationsToPerform: AnyBulkWriteOperation<ISecret>[] = [];
+  const secretsUserCanDeleteSet: Set<string> = new Set(secretIdsUserCanDelete.map(objectId => objectId._id.toString()));
+  const deleteOperationsToPerform: AnyBulkWriteOperation<ISecret>[] = []
 
   let numSecretsDeleted = 0;
-  secretIdsToDelete.forEach((secretIdToDelete) => {
+  secretIdsToDelete.forEach(secretIdToDelete => {
     if (secretsUserCanDeleteSet.has(secretIdToDelete)) {
-      const deleteOperation = {
-        deleteOne: { filter: { _id: new Types.ObjectId(secretIdToDelete) } }
-      };
-      deleteOperationsToPerform.push(deleteOperation);
+      const deleteOperation = { deleteOne: { filter: { _id: new Types.ObjectId(secretIdToDelete) } } }
+      deleteOperationsToPerform.push(deleteOperation)
       numSecretsDeleted++;
     } else {
-      throw RouteValidationError({
-        message: "You cannot delete secrets that you do not have access to"
-      });
+      throw RouteValidationError({ message: "You cannot delete secrets that you do not have access to" })
     }
-  });
+  })
 
-  await Secret.bulkWrite(deleteOperationsToPerform);
+  const [bulkDeleteError, bulkDelete] = await to(Secret.bulkWrite(deleteOperationsToPerform).then())
+  if (bulkDeleteError) {
+    if (bulkDeleteError instanceof ValidationError) {
+      throw RouteValidationError({ message: "Unable to apply modifications, please try again", stack: bulkDeleteError.stack })
+    }
+    throw InternalServerError()
+  }
 
   if (postHogClient) {
     postHogClient.capture({
-      event: "secrets deleted",
+      event: 'secrets deleted',
       distinctId: req.user.email,
       properties: {
         numberOfSecrets: numSecretsDeleted,
         environment: environmentName,
         workspaceId,
-        channel: req.headers?.["user-agent"]?.toLowerCase().includes("mozilla") ? "web" : "cli",
-        userAgent: req.headers?.["user-agent"]
+        channel: req.headers?.['user-agent']?.toLowerCase().includes('mozilla') ? 'web' : 'cli',
+        userAgent: req.headers?.['user-agent']
       }
     });
   }
 
-  res.status(200).send();
-};
+  res.status(200).send()
+}
 
 /**
  * Delete secret with id [secretId]
- * @param req
+ * @param req 
  * @param res
  */
 export const deleteSecret = async (req: Request, res: Response) => {
-  const postHogClient = await TelemetryService.getPostHogClient();
-  await Secret.findByIdAndDelete(req._secret._id);
+  await Secret.findByIdAndDelete(req._secret._id)
 
   if (postHogClient) {
     postHogClient.capture({
-      event: "secrets deleted",
+      event: 'secrets deleted',
       distinctId: req.user.email,
       properties: {
         numberOfSecrets: 1,
         workspaceId: req._secret.workspace.toString(),
         environment: req._secret.environment,
-        channel: req.headers?.["user-agent"]?.toLowerCase().includes("mozilla") ? "web" : "cli",
-        userAgent: req.headers?.["user-agent"]
+        channel: req.headers?.['user-agent']?.toLowerCase().includes('mozilla') ? 'web' : 'cli',
+        userAgent: req.headers?.['user-agent']
       }
     });
   }
 
   res.status(200).send({
     secret: req._secret
-  });
-};
+  })
+}
 
 /**
  * Update secrets for workspace with id [workspaceId] and environment [environment]
- * @param req
- * @param res
- * @returns
+ * @param req 
+ * @param res 
+ * @returns 
  */
 export const updateSecrets = async (req: Request, res: Response) => {
-  const postHogClient = await TelemetryService.getPostHogClient();
-  const { workspaceId, environmentName } = req.params;
+  const { workspaceId, environmentName } = req.params
   const secretsModificationsRequested: ModifySecretRequestBody[] = req.body.secrets;
-  const secretIdsUserCanModify = await Secret.find({ workspace: workspaceId, environment: environmentName }, { _id: 1 });
+  const [secretIdsUserCanModifyError, secretIdsUserCanModify] = await to(Secret.find({ workspace: workspaceId, environment: environmentName }, { _id: 1 }).then())
+  if (secretIdsUserCanModifyError) {
+    throw InternalServerError({ message: "Unable to fetch secrets you own" })
+  }
 
-  const secretsUserCanModifySet: Set<string> = new Set(
-    secretIdsUserCanModify.map((objectId) => objectId._id.toString())
-  );
-  const updateOperationsToPerform: any = [];
+  const secretsUserCanModifySet: Set<string> = new Set(secretIdsUserCanModify.map(objectId => objectId._id.toString()));
+  const updateOperationsToPerform: any = []
 
-  secretsModificationsRequested.forEach((userModifiedSecret) => {
+  secretsModificationsRequested.forEach(userModifiedSecret => {
     if (secretsUserCanModifySet.has(userModifiedSecret._id.toString())) {
       const sanitizedSecret: SanitizedSecretModify = {
         secretKeyCiphertext: userModifiedSecret.secretKeyCiphertext,
@@ -240,54 +233,56 @@ export const updateSecrets = async (req: Request, res: Response) => {
         secretCommentCiphertext: userModifiedSecret.secretCommentCiphertext,
         secretCommentIV: userModifiedSecret.secretCommentIV,
         secretCommentTag: userModifiedSecret.secretCommentTag,
-        secretCommentHash: userModifiedSecret.secretCommentHash
-      };
+        secretCommentHash: userModifiedSecret.secretCommentHash,
+      }
 
-      const updateOperation = {
-        updateOne: {
-          filter: { _id: userModifiedSecret._id, workspace: workspaceId },
-          update: { $inc: { version: 1 }, $set: sanitizedSecret }
-        }
-      };
-      updateOperationsToPerform.push(updateOperation);
+      const updateOperation = { updateOne: { filter: { _id: userModifiedSecret._id, workspace: workspaceId }, update: { $inc: { version: 1 }, $set: sanitizedSecret } } }
+      updateOperationsToPerform.push(updateOperation)
     } else {
-      throw UnauthorizedRequestError({
-        message: "You do not have permission to modify one or more of the requested secrets"
-      });
+      throw UnauthorizedRequestError({ message: "You do not have permission to modify one or more of the requested secrets" })
     }
-  });
+  })
 
-  await Secret.bulkWrite(updateOperationsToPerform);
+  const [bulkModificationInfoError, bulkModificationInfo] = await to(Secret.bulkWrite(updateOperationsToPerform).then())
+  if (bulkModificationInfoError) {
+    if (bulkModificationInfoError instanceof ValidationError) {
+      throw RouteValidationError({ message: "Unable to apply modifications, please try again", stack: bulkModificationInfoError.stack })
+    }
+
+    throw InternalServerError()
+  }
 
   if (postHogClient) {
     postHogClient.capture({
-      event: "secrets modified",
+      event: 'secrets modified',
       distinctId: req.user.email,
       properties: {
         numberOfSecrets: (secretsModificationsRequested ?? []).length,
         environment: environmentName,
         workspaceId,
-        channel: req.headers?.["user-agent"]?.toLowerCase().includes("mozilla") ? "web" : "cli",
-        userAgent: req.headers?.["user-agent"]
+        channel: req.headers?.['user-agent']?.toLowerCase().includes('mozilla') ? 'web' : 'cli',
+        userAgent: req.headers?.['user-agent']
       }
     });
   }
 
-  return res.status(200).send();
-};
+  return res.status(200).send()
+}
 
 /**
  * Update a secret within workspace with id [workspaceId] and environment [environment]
- * @param req
- * @param res
- * @returns
+ * @param req 
+ * @param res 
+ * @returns 
  */
 export const updateSecret = async (req: Request, res: Response) => {
-  const postHogClient = await TelemetryService.getPostHogClient();
-  const { workspaceId, environmentName } = req.params;
+  const { workspaceId, environmentName } = req.params
   const secretModificationsRequested: ModifySecretRequestBody = req.body.secret;
 
-  await Secret.findOne({ workspace: workspaceId, environment: environmentName }, { _id: 1 });
+  const [secretIdUserCanModifyError, secretIdUserCanModify] = await to(Secret.findOne({ workspace: workspaceId, environment: environmentName }, { _id: 1 }).then())
+  if (secretIdUserCanModifyError && !secretIdUserCanModify) {
+    throw BadRequestError()
+  }
 
   const sanitizedSecret: SanitizedSecretModify = {
     secretKeyCiphertext: secretModificationsRequested.secretKeyCiphertext,
@@ -301,103 +296,89 @@ export const updateSecret = async (req: Request, res: Response) => {
     secretCommentCiphertext: secretModificationsRequested.secretCommentCiphertext,
     secretCommentIV: secretModificationsRequested.secretCommentIV,
     secretCommentTag: secretModificationsRequested.secretCommentTag,
-    secretCommentHash: secretModificationsRequested.secretCommentHash
-  };
+    secretCommentHash: secretModificationsRequested.secretCommentHash,
+  }
 
-  const singleModificationUpdate = await Secret.updateOne(
-    { _id: secretModificationsRequested._id, workspace: workspaceId },
-    { $inc: { version: 1 }, $set: sanitizedSecret }
-  )
-    .catch((error) => {
-      if (error instanceof ValidationError) {
-        throw RouteValidationError({
-          message: "Unable to apply modifications, please try again",
-          stack: error.stack
-        });
-      }
-
-      throw error;
-    });
+  const [error, singleModificationUpdate] = await to(Secret.updateOne({ _id: secretModificationsRequested._id, workspace: workspaceId }, { $inc: { version: 1 }, $set: sanitizedSecret }).then())
+  if (error instanceof ValidationError) {
+    throw RouteValidationError({ message: "Unable to apply modifications, please try again", stack: error.stack })
+  }
 
   if (postHogClient) {
     postHogClient.capture({
-      event: "secrets modified",
+      event: 'secrets modified',
       distinctId: req.user.email,
       properties: {
         numberOfSecrets: 1,
         environment: environmentName,
         workspaceId,
-        channel: req.headers?.["user-agent"]?.toLowerCase().includes("mozilla") ? "web" : "cli",
-        userAgent: req.headers?.["user-agent"]
+        channel: req.headers?.['user-agent']?.toLowerCase().includes('mozilla') ? 'web' : 'cli',
+        userAgent: req.headers?.['user-agent']
       }
     });
   }
 
-  return res.status(200).send(singleModificationUpdate);
-};
+  return res.status(200).send(singleModificationUpdate)
+}
 
 /**
  * Return secrets for workspace with id [workspaceId], environment [environment] and user
  * with id [req.user._id]
- * @param req
- * @param res
- * @returns
+ * @param req 
+ * @param res 
+ * @returns 
  */
 export const getSecrets = async (req: Request, res: Response) => {
-  const postHogClient = await TelemetryService.getPostHogClient();
   const { environment } = req.query;
   const { workspaceId } = req.params;
 
-  let userId: Types.ObjectId | undefined = undefined; // used for getting personal secrets for user
-  let userEmail: string | undefined = undefined; // used for posthog
+  let userId: Types.ObjectId | undefined = undefined // used for getting personal secrets for user
+  let userEmail: Types.ObjectId | undefined = undefined // used for posthog 
   if (req.user) {
     userId = req.user._id;
     userEmail = req.user.email;
   }
 
   if (req.serviceTokenData) {
-    userId = req.serviceTokenData.user;
-
-    const user = await User.findById(req.serviceTokenData.user, "email");
-    if (!user) throw AccountNotFoundError();
-    userEmail = user.email;
+    userId = req.serviceTokenData.user._id
+    userEmail = req.serviceTokenData.user.email;
   }
 
-  const secrets = await Secret.find({
-    workspace: workspaceId,
-    environment,
-    $or: [{ user: userId }, { user: { $exists: false } }],
-    type: { $in: [SECRET_SHARED, SECRET_PERSONAL] }
-  })
-    .catch((err) => {
-      throw RouteValidationError({
-        message: "Failed to get secrets, please try again",
-        stack: err.stack
-      });
-    })
+  const [err, secrets] = await to(Secret.find(
+    {
+      workspace: workspaceId,
+      environment,
+      $or: [{ user: userId }, { user: { $exists: false } }],
+      type: { $in: [SECRET_SHARED, SECRET_PERSONAL] }
+    }
+  ).then())
+
+  if (err) {
+    throw RouteValidationError({ message: "Failed to get secrets, please try again", stack: err.stack })
+  }
 
   if (postHogClient) {
     postHogClient.capture({
-      event: "secrets pulled",
+      event: 'secrets pulled',
       distinctId: userEmail,
       properties: {
         numberOfSecrets: (secrets ?? []).length,
         environment,
         workspaceId,
-        channel: req.headers?.["user-agent"]?.toLowerCase().includes("mozilla") ? "web" : "cli",
-        userAgent: req.headers?.["user-agent"]
+        channel: req.headers?.['user-agent']?.toLowerCase().includes('mozilla') ? 'web' : 'cli',
+        userAgent: req.headers?.['user-agent']
       }
     });
   }
 
-  return res.json(secrets);
-};
+  return res.json(secrets)
+}
 
 /**
  * Return secret with id [secretId]
- * @param req
- * @param res
- * @returns
+ * @param req 
+ * @param res 
+ * @returns 
  */
 export const getSecret = async (req: Request, res: Response) => {
   // if (postHogClient) {
@@ -417,4 +398,4 @@ export const getSecret = async (req: Request, res: Response) => {
   return res.status(200).send({
     secret: req._secret
   });
-};
+}

backend/src/controllers/v2/serviceAccountsController.ts

@@ -1,306 +0,0 @@
-import { Request, Response } from "express";
-import { Types } from "mongoose";
-import crypto from "crypto";
-import bcrypt from "bcrypt";
-import {
-    ServiceAccount,
-    ServiceAccountKey,
-    ServiceAccountOrganizationPermission,
-    ServiceAccountWorkspacePermission,
-} from "../../models";
-import {
-    CreateServiceAccountDto,
-} from "../../interfaces/serviceAccounts/dto";
-import { BadRequestError, ServiceAccountNotFoundError } from "../../utils/errors";
-import { getSaltRounds } from "../../config";
-
-/**
- * Return service account tied to the request (service account) client
- * @param req
- * @param res
- */
-export const getCurrentServiceAccount = async (req: Request, res: Response) => {
-    const serviceAccount = await ServiceAccount.findById(req.serviceAccount._id);
-
-    if (!serviceAccount) {
-        throw ServiceAccountNotFoundError({ message: "Failed to find service account" });
-    }
-
-    return res.status(200).send({
-        serviceAccount,
-    });
-}
-
-/**
- * Return service account with id [serviceAccountId]
- * @param req 
- * @param res 
- */
-export const getServiceAccountById = async (req: Request, res: Response) => {
-    const { serviceAccountId } = req.params;
-
-    const serviceAccount = await ServiceAccount.findById(serviceAccountId);
-
-    if (!serviceAccount) {
-        throw ServiceAccountNotFoundError({ message: "Failed to find service account" });
-    }
-
-    return res.status(200).send({
-        serviceAccount,
-    });
-}
-
-/**
- * Create a new service account under organization with id [organizationId]
- * that has access to workspaces [workspaces]
- * @param req 
- * @param res 
- * @returns
- */
-export const createServiceAccount = async (req: Request, res: Response) => {
-    const {
-        name,
-        organizationId,
-        publicKey,
-        expiresIn,
-    }: CreateServiceAccountDto = req.body;
-
-    let expiresAt;
-    if (expiresIn) {
-        expiresAt = new Date();
-        expiresAt.setSeconds(expiresAt.getSeconds() + expiresIn);
-    }
-
-    const secret = crypto.randomBytes(16).toString("base64");
-    const secretHash = await bcrypt.hash(secret, await getSaltRounds());
-
-    // create service account
-    const serviceAccount = await new ServiceAccount({
-        name,
-        organization: new Types.ObjectId(organizationId),
-        user: req.user,
-        publicKey,
-        lastUsed: new Date(),
-        expiresAt,
-        secretHash,
-    }).save()
-
-    const serviceAccountObj = serviceAccount.toObject();
-
-    delete (serviceAccountObj as any).secretHash;
-
-    // provision default org-level permission for service account
-    await new ServiceAccountOrganizationPermission({
-        serviceAccount: serviceAccount._id,
-    }).save();
-
-    const secretId = Buffer.from(serviceAccount._id.toString(), "hex").toString("base64");
-
-    return res.status(200).send({
-        serviceAccountAccessKey: `sa.${secretId}.${secret}`,
-        serviceAccount: serviceAccountObj,
-    });
-}
-
-/**
- * Change name of service account with id [serviceAccountId] to [name]
- * @param req 
- * @param res 
- * @returns 
- */
-export const changeServiceAccountName = async (req: Request, res: Response) => {
-    const { serviceAccountId } = req.params;
-    const { name } = req.body;
-
-    const serviceAccount = await ServiceAccount.findOneAndUpdate(
-        {
-            _id: new Types.ObjectId(serviceAccountId),
-        },
-        {
-            name,
-        },
-        {
-            new: true,
-        }
-    );
-
-    return res.status(200).send({
-        serviceAccount,
-    });
-}
-
-/**
- * Add a service account key to service account with id [serviceAccountId]
- * for workspace with id [workspaceId]
- * @param req 
- * @param res 
- * @returns 
- */
-export const addServiceAccountKey = async (req: Request, res: Response) => {
-    const {
-        workspaceId,
-        encryptedKey,
-        nonce,
-    } = req.body;
-
-    const serviceAccountKey = await new ServiceAccountKey({
-        encryptedKey,
-        nonce,
-        sender: req.user._id,
-        serviceAccount: req.serviceAccount._d,
-        workspace: new Types.ObjectId(workspaceId),
-    }).save();
-
-    return serviceAccountKey;
-}
-
-/**
- * Return workspace-level permission for service account with id [serviceAccountId]
- * @param req 
- * @param res 
- */
-export const getServiceAccountWorkspacePermissions = async (req: Request, res: Response) => {
-    const serviceAccountWorkspacePermissions = await ServiceAccountWorkspacePermission.find({
-        serviceAccount: req.serviceAccount._id,
-    }).populate("workspace");
-
-    return res.status(200).send({
-        serviceAccountWorkspacePermissions,
-    });
-}
-
-/**
- * Add a workspace permission to service account with id [serviceAccountId]
- * @param req 
- * @param res 
- */
-export const addServiceAccountWorkspacePermission = async (req: Request, res: Response) => {
-    const { serviceAccountId } = req.params;
-    const {
-        environment,
-        workspaceId,
-        read = false,
-        write = false,
-        encryptedKey,
-        nonce,
-    } = req.body;
-
-    if (!req.membership.workspace.environments.some((e: { name: string; slug: string }) => e.slug === environment)) {
-        return res.status(400).send({
-            message: "Failed to validate workspace environment",
-        });
-    }
-
-    const existingPermission = await ServiceAccountWorkspacePermission.findOne({
-        serviceAccount: new Types.ObjectId(serviceAccountId),
-        workspace: new Types.ObjectId(workspaceId),
-        environment,
-    });
-
-    if (existingPermission) throw BadRequestError({ message: "Failed to add workspace permission to service account due to already-existing " });
-
-    const serviceAccountWorkspacePermission = await new ServiceAccountWorkspacePermission({
-        serviceAccount: new Types.ObjectId(serviceAccountId),
-        workspace: new Types.ObjectId(workspaceId),
-        environment,
-        read,
-        write,
-    }).save();
-
-    const existingServiceAccountKey = await ServiceAccountKey.findOne({
-        serviceAccount: new Types.ObjectId(serviceAccountId),
-        workspace: new Types.ObjectId(workspaceId),
-    });
-
-    if (!existingServiceAccountKey) {
-        await new ServiceAccountKey({
-            encryptedKey,
-            nonce,
-            sender: req.user._id,
-            serviceAccount: new Types.ObjectId(serviceAccountId),
-            workspace: new Types.ObjectId(workspaceId),
-        }).save();
-    }
-
-    return res.status(200).send({
-        serviceAccountWorkspacePermission,
-    });
-}
-
-/**
- * Delete workspace permission from service account with id [serviceAccountId]
- * @param req 
- * @param res 
- */
-export const deleteServiceAccountWorkspacePermission = async (req: Request, res: Response) => {
-    const { serviceAccountWorkspacePermissionId } = req.params;
-    const serviceAccountWorkspacePermission = await ServiceAccountWorkspacePermission.findByIdAndDelete(serviceAccountWorkspacePermissionId);
-
-    if (serviceAccountWorkspacePermission) {
-        const { serviceAccount, workspace } = serviceAccountWorkspacePermission;
-        const count = await ServiceAccountWorkspacePermission.countDocuments({
-            serviceAccount,
-            workspace,
-        });
-
-        if (count === 0) {
-            await ServiceAccountKey.findOneAndDelete({
-                serviceAccount,
-                workspace,
-            });
-        }
-    }
-
-    return res.status(200).send({
-        serviceAccountWorkspacePermission,
-    });
-}
-
-/**
- * Delete service account with id [serviceAccountId]
- * @param req 
- * @param res 
- * @returns 
- */
-export const deleteServiceAccount = async (req: Request, res: Response) => {
-    const { serviceAccountId } = req.params;
-
-    const serviceAccount = await ServiceAccount.findByIdAndDelete(serviceAccountId);
-
-    if (serviceAccount) {
-        await ServiceAccountKey.deleteMany({
-            serviceAccount: serviceAccount._id,
-        });
-
-        await ServiceAccountOrganizationPermission.deleteMany({
-            serviceAccount: new Types.ObjectId(serviceAccountId),
-        });
-
-        await ServiceAccountWorkspacePermission.deleteMany({
-            serviceAccount: new Types.ObjectId(serviceAccountId),
-        });
-    }
-
-    return res.status(200).send({
-        serviceAccount,
-    });
-}
-
-/**
- * Return service account keys for service account with id [serviceAccountId]
- * @param req 
- * @param res 
- * @returns 
- */
-export const getServiceAccountKeys = async (req: Request, res: Response) => {
-    const workspaceId = req.query.workspaceId as string;
-
-    const serviceAccountKeys = await ServiceAccountKey.find({
-        serviceAccount: req.serviceAccount._id,
-        ...(workspaceId ? { workspace: new Types.ObjectId(workspaceId) } : {}),
-    });
-
-    return res.status(200).send({
-        serviceAccountKeys,
-    });
-}

backend/src/controllers/v2/serviceTokenDataController.ts

@@ -1,187 +1,103 @@
-import { Request, Response } from "express";
-import crypto from "crypto";
-import bcrypt from "bcrypt";
-import { ServiceTokenData } from "../../models";
-import { getSaltRounds } from "../../config";
-import { BadRequestError } from "../../utils/errors";
-import { ActorType, EventType } from "../../ee/models";
-import { EEAuditLogService } from "../../ee/services";
-import { validateRequest } from "../../helpers/validation";
-import * as reqValidator from "../../validation/serviceTokenData";
+import { Request, Response } from 'express';
+import * as Sentry from '@sentry/node';
+import crypto from 'crypto';
+import bcrypt from 'bcrypt';
 import {
-  ProjectPermissionActions,
-  ProjectPermissionSub,
-  getUserProjectPermissions
-} from "../../ee/services/ProjectRoleService";
-import { ForbiddenError } from "@casl/ability";
-import { Types } from "mongoose";
+    ServiceTokenData
+} from '../../models';
+import {
+    SALT_ROUNDS
+} from '../../config';
 
 /**
  * Return service token data associated with service token on request
- * @param req
- * @param res
- * @returns
+ * @param req 
+ * @param res 
+ * @returns 
  */
-export const getServiceTokenData = async (req: Request, res: Response) => {
-  /* 
-    #swagger.summary = 'Return Infisical Token data'
-    #swagger.description = 'Return Infisical Token data'
-    
-    #swagger.security = [{
-        "bearerAuth": []
-    }]
-
-    #swagger.responses[200] = {
-        content: {
-            "application/json": {
-                "schema": { 
-                    "type": "object",
-          "properties": {
-                        "serviceTokenData": {
-                            "type": "object",
-                            $ref: "#/components/schemas/ServiceTokenData",
-                            "description": "Details of service token"
-                        }
-          }
-                }
-            }           
-        }
-    }   
-    */
-
-  if (!(req.authData.authPayload instanceof ServiceTokenData))
-    throw BadRequestError({
-      message: "Failed accepted client validation for service token data"
-    });
-
-  const serviceTokenData = await ServiceTokenData.findById(req.authData.authPayload._id)
-    .select("+encryptedKey +iv +tag")
-    .populate("user")
-    .lean();
-
-  return res.status(200).json(serviceTokenData);
-};
+export const getServiceTokenData = async (req: Request, res: Response) => res.status(200).json(req.serviceTokenData);
 
 /**
  * Create new service token data for workspace with id [workspaceId] and
  * environment [environment].
- * @param req
- * @param res
- * @returns
+ * @param req 
+ * @param res 
+ * @returns 
  */
 export const createServiceTokenData = async (req: Request, res: Response) => {
-  let serviceTokenData;
+    let serviceToken, serviceTokenData;
+    try {
+        const {
+            name,
+            workspaceId,
+            environment,
+            encryptedKey,
+            iv,
+            tag,
+            expiresIn
+        } = req.body;
 
-  const {
-    body: { workspaceId, permissions, tag, encryptedKey, scopes, name, expiresIn, iv }
-  } = await validateRequest(reqValidator.CreateServiceTokenV2, req);
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Create,
-    ProjectPermissionSub.ServiceTokens
-  );
+        const secret = crypto.randomBytes(16).toString('hex');
+        const secretHash = await bcrypt.hash(secret, SALT_ROUNDS);
 
-  const secret = crypto.randomBytes(16).toString("hex");
-  const secretHash = await bcrypt.hash(secret, await getSaltRounds());
+        const expiresAt = new Date();
+        expiresAt.setSeconds(expiresAt.getSeconds() + expiresIn);
 
-  let expiresAt;
-  if (expiresIn) {
-    expiresAt = new Date();
-    expiresAt.setSeconds(expiresAt.getSeconds() + expiresIn);
-  }
+        serviceTokenData = await new ServiceTokenData({
+            name,
+            workspace: workspaceId,
+            environment,
+            user: req.user._id,
+            expiresAt,
+            secretHash,
+            encryptedKey,
+            iv,
+            tag
+        }).save();
 
-  let user;
+        // return service token data without sensitive data
+        serviceTokenData = await ServiceTokenData.findById(serviceTokenData._id);
 
-  if (req.authData.actor.type === ActorType.USER) {
-    user = req.authData.authPayload._id;
-  }
+        if (!serviceTokenData) throw new Error('Failed to find service token data');
 
-  serviceTokenData = await new ServiceTokenData({
-    name,
-    workspace: workspaceId,
-    user,
-    scopes,
-    lastUsed: new Date(),
-    expiresAt,
-    secretHash,
-    encryptedKey,
-    iv,
-    tag,
-    permissions
-  }).save();
+        serviceToken = `st.${serviceTokenData._id.toString()}.${secret}`;
 
-  // return service token data without sensitive data
-  serviceTokenData = await ServiceTokenData.findById(serviceTokenData._id);
-
-  if (!serviceTokenData) throw new Error("Failed to find service token data");
-
-  const serviceToken = `st.${serviceTokenData._id.toString()}.${secret}`;
-
-  await EEAuditLogService.createAuditLog(
-    req.authData,
-    {
-      type: EventType.CREATE_SERVICE_TOKEN,
-      metadata: {
-        name,
-        scopes
-      }
-    },
-    {
-      workspaceId: new Types.ObjectId(workspaceId)
+    } catch (err) {
+        Sentry.setUser({ email: req.user.email });
+        Sentry.captureException(err);
+        return res.status(400).send({
+            message: 'Failed to create service token data'
+        });
     }
-  );
 
-  return res.status(200).send({
-    serviceToken,
-    serviceTokenData
-  });
-};
+    return res.status(200).send({
+        serviceToken,
+        serviceTokenData
+    });
+}
 
 /**
  * Delete service token data with id [serviceTokenDataId].
- * @param req
- * @param res
- * @returns
+ * @param req 
+ * @param res 
+ * @returns 
  */
 export const deleteServiceTokenData = async (req: Request, res: Response) => {
-  const {
-    params: { serviceTokenDataId }
-  } = await validateRequest(reqValidator.DeleteServiceTokenV2, req);
+    let serviceTokenData;
+    try {
+        const { serviceTokenDataId } = req.params;
 
-  let serviceTokenData = await ServiceTokenData.findById(serviceTokenDataId);
-  if (!serviceTokenData) throw BadRequestError({ message: "Service token not found" });
+        serviceTokenData = await ServiceTokenData.findByIdAndDelete(serviceTokenDataId);
 
-  const { permission } = await getUserProjectPermissions(
-    req.user._id,
-    serviceTokenData.workspace.toString()
-  );
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Delete,
-    ProjectPermissionSub.ServiceTokens
-  );
-
-  serviceTokenData = await ServiceTokenData.findByIdAndDelete(serviceTokenDataId);
-
-  if (!serviceTokenData)
-    return res.status(200).send({
-      message: "Failed to delete service token"
-    });
-
-  await EEAuditLogService.createAuditLog(
-    req.authData,
-    {
-      type: EventType.DELETE_SERVICE_TOKEN,
-      metadata: {
-        name: serviceTokenData.name,
-        scopes: serviceTokenData?.scopes
-      }
-    },
-    {
-      workspaceId: serviceTokenData.workspace
+    } catch (err) {
+        Sentry.setUser({ email: req.user.email });
+        Sentry.captureException(err);
+        return res.status(400).send({
+            message: 'Failed to delete service token data'
+        });
     }
-  );
 
-  return res.status(200).send({
-    serviceTokenData
-  });
-};
+    return res.status(200).send({
+        serviceTokenData
+    });
+}

backend/src/controllers/v2/signupController.ts

@@ -1,262 +0,0 @@
-import { Request, Response } from "express";
-import { MembershipOrg, User } from "../../models";
-import { completeAccount } from "../../helpers/user";
-import {
-	initializeDefaultOrg,
-} from "../../helpers/signup";
-import { issueAuthTokens } from "../../helpers/auth";
-import { ACCEPTED, INVITED } from "../../variables";
-import { standardRequest } from "../../config/request";
-import { getHttpsEnabled, getLoopsApiKey } from "../../config";
-import { updateSubscriptionOrgQuantity } from "../../helpers/organization";
-
-/**
- * Complete setting up user by adding their personal and auth information as part of the
- * signup flow
- * @param req
- * @param res
- * @returns
- */
-export const completeAccountSignup = async (req: Request, res: Response) => {
-	let user;
-  const {
-    email,
-    firstName,
-    lastName,
-    protectedKey,
-    protectedKeyIV,
-    protectedKeyTag,
-    publicKey,
-    encryptedPrivateKey,
-    encryptedPrivateKeyIV,
-    encryptedPrivateKeyTag,
-    salt,
-    verifier,
-    organizationName,
-  }: {
-    email: string;
-    firstName: string;
-    lastName: string;
-    protectedKey: string;
-    protectedKeyIV: string;
-    protectedKeyTag: string;
-    publicKey: string;
-    encryptedPrivateKey: string;
-    encryptedPrivateKeyIV: string;
-    encryptedPrivateKeyTag: string;
-    salt: string;
-    verifier: string;
-    organizationName: string;
-  } = req.body;
-
-  // get user
-  user = await User.findOne({ email });
-
-  if (!user || (user && user?.publicKey)) {
-    // case 1: user doesn't exist.
-    // case 2: user has already completed account
-    return res.status(403).send({
-      error: "Failed to complete account for complete user",
-    });
-  }
-
-  // complete setting up user's account
-  user = await completeAccount({
-    userId: user._id.toString(),
-    firstName,
-    lastName,
-    encryptionVersion: 2,
-    protectedKey,
-    protectedKeyIV,
-    protectedKeyTag,
-    publicKey,
-    encryptedPrivateKey,
-    encryptedPrivateKeyIV,
-    encryptedPrivateKeyTag,
-    salt,
-    verifier,
-  });
-
-  if (!user)
-    throw new Error("Failed to complete account for non-existent user"); // ensure user is non-null
-
-  // initialize default organization and workspace
-  await initializeDefaultOrg({
-    organizationName,
-    user,
-  });
-
-  // update organization membership statuses that are
-  // invited to completed with user attached
-  const membershipsToUpdate = await MembershipOrg.find({
-    inviteEmail: email,
-    status: INVITED,
-  });
-  
-  membershipsToUpdate.forEach(async (membership) => {
-    await updateSubscriptionOrgQuantity({
-      organizationId: membership.organization.toString(),
-    });
-  });
-
-  // update organization membership statuses that are
-  // invited to completed with user attached
-  await MembershipOrg.updateMany(
-    {
-      inviteEmail: email,
-      status: INVITED,
-    },
-    {
-      user,
-      status: ACCEPTED,
-    }
-  );
-
-  // issue tokens
-  const tokens = await issueAuthTokens({
-    userId: user._id,
-    ip: req.realIP,
-    userAgent: req.headers["user-agent"] ?? "",
-  });
-
-  const token = tokens.token;
-
-  // sending a welcome email to new users
-  if (await getLoopsApiKey()) {
-    await standardRequest.post("https://app.loops.so/api/v1/events/send", {
-      "email": email,
-      "eventName": "Sign Up",
-      "firstName": firstName,
-      "lastName": lastName,
-    }, {
-      headers: {
-        "Accept": "application/json",
-        "Authorization": "Bearer " + (await getLoopsApiKey()),
-      },
-    });
-  }
-
-  // store (refresh) token in httpOnly cookie
-  res.cookie("jid", tokens.refreshToken, {
-    httpOnly: true,
-    path: "/",
-    sameSite: "strict",
-    secure: await getHttpsEnabled(),
-  });
-
-	return res.status(200).send({
-		message: "Successfully set up account",
-		user,
-		token,
-	});
-};
-
-/**
- * Complete setting up user by adding their personal and auth information as part of the
- * invite flow
- * @param req
- * @param res
- * @returns
- */
-export const completeAccountInvite = async (req: Request, res: Response) => {
-	let user;
-  const {
-    email,
-    firstName,
-    lastName,
-    protectedKey,
-    protectedKeyIV,
-    protectedKeyTag,
-    publicKey,
-    encryptedPrivateKey,
-    encryptedPrivateKeyIV,
-    encryptedPrivateKeyTag,
-    salt,
-    verifier,
-  } = req.body;
-
-  // get user
-  user = await User.findOne({ email });
-
-  if (!user || (user && user?.publicKey)) {
-    // case 1: user doesn't exist.
-    // case 2: user has already completed account
-    return res.status(403).send({
-      error: "Failed to complete account for complete user",
-    });
-  }
-
-  const membershipOrg = await MembershipOrg.findOne({
-    inviteEmail: email,
-    status: INVITED,
-  });
-
-  if (!membershipOrg) throw new Error("Failed to find invitations for email");
-
-  // complete setting up user's account
-  user = await completeAccount({
-    userId: user._id.toString(),
-    firstName,
-    lastName,
-    encryptionVersion: 2,
-    protectedKey,
-    protectedKeyIV,
-    protectedKeyTag,
-    publicKey,
-    encryptedPrivateKey,
-    encryptedPrivateKeyIV,
-    encryptedPrivateKeyTag,
-    salt,
-    verifier,
-  });
-
-  if (!user)
-    throw new Error("Failed to complete account for non-existent user");
-  
-  // update organization membership statuses that are
-  // invited to completed with user attached
-  const membershipsToUpdate = await MembershipOrg.find({
-    inviteEmail: email,
-    status: INVITED,
-  });
-  
-  membershipsToUpdate.forEach(async (membership) => {
-    await updateSubscriptionOrgQuantity({
-      organizationId: membership.organization.toString(),
-    });
-  });
-
-  await MembershipOrg.updateMany(
-    {
-      inviteEmail: email,
-      status: INVITED,
-    },
-    {
-      user,
-      status: ACCEPTED,
-    }
-  );
-
-  // issue tokens
-  const tokens = await issueAuthTokens({
-    userId: user._id,
-    ip: req.realIP,
-    userAgent: req.headers["user-agent"] ?? "",
-  });
-
-  const token = tokens.token;
-
-  // store (refresh) token in httpOnly cookie
-  res.cookie("jid", tokens.refreshToken, {
-    httpOnly: true,
-    path: "/",
-    sameSite: "strict",
-    secure: await getHttpsEnabled(),
-  });
-
-	return res.status(200).send({
-		message: "Successfully set up account",
-		user,
-		token,
-	});
-};

backend/src/controllers/v2/tagController.ts

@@ -1,82 +0,0 @@
-import { ForbiddenError } from "@casl/ability";
-import { Request, Response } from "express";
-import { Types } from "mongoose";
-import { Secret, Tag } from "../../models";
-import { BadRequestError } from "../../utils/errors";
-import { validateRequest } from "../../helpers/validation";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSub,
-  getUserProjectPermissions
-} from "../../ee/services/ProjectRoleService";
-import * as reqValidator from "../../validation/tags";
-
-export const createWorkspaceTag = async (req: Request, res: Response) => {
-  const {
-    body: { name, slug },
-    params: { workspaceId }
-  } = await validateRequest(reqValidator.CreateWorkspaceTagsV2, req);
-
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Create,
-    ProjectPermissionSub.Tags
-  );
-
-  const tagToCreate = {
-    name,
-    workspace: new Types.ObjectId(workspaceId),
-    slug,
-    user: new Types.ObjectId(req.user._id)
-  };
-
-  const createdTag = await new Tag(tagToCreate).save();
-
-  res.json(createdTag);
-};
-
-export const deleteWorkspaceTag = async (req: Request, res: Response) => {
-  const {
-    params: { tagId }
-  } = await validateRequest(reqValidator.DeleteWorkspaceTagsV2, req);
-
-  const tagFromDB = await Tag.findById(tagId);
-  if (!tagFromDB) {
-    throw BadRequestError();
-  }
-
-  const { permission } = await getUserProjectPermissions(
-    req.user._id,
-    tagFromDB.workspace.toString()
-  );
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Delete,
-    ProjectPermissionSub.Tags
-  );
-
-  const result = await Tag.findByIdAndDelete(tagId);
-
-  // remove the tag from secrets
-  await Secret.updateMany({ tags: { $in: [tagId] } }, { $pull: { tags: tagId } });
-
-  res.json(result);
-};
-
-export const getWorkspaceTags = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId }
-  } = await validateRequest(reqValidator.GetWorkspaceTagsV2, req);
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Read,
-    ProjectPermissionSub.Tags
-  );
-
-  const workspaceTags = await Tag.find({
-    workspace: new Types.ObjectId(workspaceId)
-  });
-
-  return res.json({
-    workspaceTags
-  });
-};

backend/src/controllers/v2/usersController.ts

@@ -1,115 +1,67 @@
-import { Request, Response } from "express";
-import { Types } from "mongoose";
-import crypto from "crypto";
-import bcrypt from "bcrypt";
-import { APIKeyData, AuthMethod, MembershipOrg, TokenVersion, User } from "../../models";
-import { getSaltRounds } from "../../config";
-import { validateRequest } from "../../helpers/validation";
-import { deleteUser } from "../../helpers/user";
-import * as reqValidator from "../../validation";
+import { Request, Response } from 'express';
+import * as Sentry from '@sentry/node';
+import {
+    User,
+    MembershipOrg
+} from '../../models';
 
 /**
- * Update the current user's MFA-enabled status [isMfaEnabled].
- * Note: Infisical currently only supports email-based 2FA only; this will expand to
- * include SMS and authenticator app modes of authentication in the future.
- * @param req
- * @param res
- * @returns
+ * Return the current user.
+ * @param req 
+ * @param res 
+ * @returns 
  */
-export const updateMyMfaEnabled = async (req: Request, res: Response) => {
-  const {
-    body: { isMfaEnabled }
-  } = await validateRequest(reqValidator.UpdateMyMfaEnabledV2, req);
+export const getMe = async (req: Request, res: Response) => {
+    /* 
+    #swagger.summary = "Retrieve the current user on the request"
+    #swagger.description = "Retrieve the current user on the request"
+    
+    #swagger.security = [{
+        "apiKeyAuth": []
+    }]
 
-  req.user.isMfaEnabled = isMfaEnabled;
-
-  if (isMfaEnabled) {
-    // TODO: adapt this route/controller
-    // to work for different forms of MFA
-    req.user.mfaMethods = ["email"];
-  } else {
-    req.user.mfaMethods = [];
-  }
-
-  await req.user.save();
-
-  const user = req.user;
-
-  return res.status(200).send({
-    user
-  });
-};
-
-/**
- * Update name of the current user to [firstName, lastName].
- * @param req
- * @param res
- * @returns
- */
-export const updateName = async (req: Request, res: Response) => {
-  const {
-    body: { lastName, firstName }
-  } = await validateRequest(reqValidator.UpdateNameV2, req);
-
-  const user = await User.findByIdAndUpdate(
-    req.user._id.toString(),
-    {
-      firstName,
-      lastName: lastName ?? ""
-    },
-    {
-      new: true
+    #swagger.responses[200] = {
+        content: {
+            "application/json": {
+                "schema": { 
+                    "type": "object",
+                    "properties": {
+                        "user": {
+                            "type": "object",
+                            $ref: "#/components/schemas/CurrentUser",
+                            "description": "Current user on request"
+                        }
+                    }
+                }
+            }           
+        }
+    }   
+    */
+    let user;
+    try {
+        user = await User
+            .findById(req.user._id)
+            .select('+publicKey +encryptedPrivateKey +iv +tag');
+    } catch (err) {
+        Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get current user'
+		});
     }
-  );
-
-  return res.status(200).send({
-    user
-  });
-};
-
-/**
- * Update auth method of the current user to [authMethods]
- * @param req
- * @param res
- * @returns
- */
-export const updateAuthMethods = async (req: Request, res: Response) => {
-  const {
-    body: { authMethods }
-  } = await validateRequest(reqValidator.UpdateAuthMethodsV2, req);
-
-  const hasSamlEnabled = req.user.authMethods.some((authMethod: AuthMethod) =>
-    [AuthMethod.OKTA_SAML, AuthMethod.AZURE_SAML, AuthMethod.JUMPCLOUD_SAML].includes(authMethod)
-  );
-
-  if (hasSamlEnabled) {
-    return res.status(400).send({
-      message: "Failed to update user authentication method because SAML SSO is enforced"
+    
+    return res.status(200).send({
+        user
     });
-  }
-
-  const user = await User.findByIdAndUpdate(
-    req.user._id.toString(),
-    {
-      authMethods
-    },
-    {
-      new: true
-    }
-  );
-
-  return res.status(200).send({
-    user
-  });
-};
+}
 
 /**
  * Return organizations that the current user is part of.
- * @param req
- * @param res
+ * @param req 
+ * @param res 
  */
 export const getMyOrganizations = async (req: Request, res: Response) => {
-  /* 
+    /* 
     #swagger.summary = 'Return organizations that current user is part of'
     #swagger.description = 'Return organizations that current user is part of'
     
@@ -136,179 +88,22 @@ export const getMyOrganizations = async (req: Request, res: Response) => {
         }
     }   
     */
-  const organizations = (
-    await MembershipOrg.find({
-      user: req.user._id
-    }).populate("organization")
-  ).map((m) => m.organization);
+	let organizations;
+	try {
+		organizations = (
+			await MembershipOrg.find({
+				user: req.user._id
+			}).populate('organization')
+		).map((m) => m.organization);
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: "Failed to get current user's organizations"
+		});
+	}
 
-  return res.status(200).send({
-    organizations
-  });
-};
-
-/**
- * Return API keys belonging to current user.
- * @param req
- * @param res
- * @returns
- */
-export const getMyAPIKeys = async (req: Request, res: Response) => {
-  const apiKeyData = await APIKeyData.find({
-    user: req.user._id
-  });
-
-  return res.status(200).send(apiKeyData);
-};
-
-/**
- * Create new API key for current user.
- * @param req
- * @param res
- * @returns
- */
-export const createAPIKey = async (req: Request, res: Response) => {
-  const {
-    body: { name, expiresIn }
-  } = await validateRequest(reqValidator.CreateApiKeyV2, req);
-
-  const secret = crypto.randomBytes(16).toString("hex");
-  const secretHash = await bcrypt.hash(secret, await getSaltRounds());
-
-  const expiresAt = new Date();
-  expiresAt.setSeconds(expiresAt.getSeconds() + expiresIn);
-
-  let apiKeyData = await new APIKeyData({
-    name,
-    lastUsed: new Date(),
-    expiresAt,
-    user: req.user._id,
-    secretHash
-  }).save();
-
-  // return api key data without sensitive data
-  apiKeyData = (await APIKeyData.findById(apiKeyData._id)) as any;
-
-  if (!apiKeyData) throw new Error("Failed to find API key data");
-
-  const apiKey = `ak.${apiKeyData._id.toString()}.${secret}`;
-
-  return res.status(200).send({
-    apiKey,
-    apiKeyData
-  });
-};
-
-/**
- * Delete API key with id [apiKeyDataId] belonging to current user
- * @param req
- * @param res
- */
-export const deleteAPIKey = async (req: Request, res: Response) => {
-  const {
-    params: { apiKeyDataId }
-  } = await validateRequest(reqValidator.DeleteApiKeyV2, req);
-
-  const apiKeyData = await APIKeyData.findOneAndDelete({
-    _id: new Types.ObjectId(apiKeyDataId),
-    user: req.user._id
-  });
-
-  return res.status(200).send({
-    apiKeyData
-  });
-};
-
-/**
- * Return active sessions (TokenVersion) belonging to user
- * @param req
- * @param res
- * @returns
- */
-export const getMySessions = async (req: Request, res: Response) => {
-  const tokenVersions = await TokenVersion.find({
-    user: req.user._id
-  });
-
-  return res.status(200).send(tokenVersions);
-};
-
-/**
- * Revoke all active sessions belong to user
- * @param req
- * @param res
- * @returns
- */
-export const deleteMySessions = async (req: Request, res: Response) => {
-  await TokenVersion.updateMany(
-    {
-      user: req.user._id
-    },
-    {
-      $inc: {
-        refreshVersion: 1,
-        accessVersion: 1
-      }
-    }
-  );
-
-  return res.status(200).send({
-    message: "Successfully revoked all sessions"
-  });
-};
-
-/**
- * Return the current user.
- * @param req
- * @param res
- * @returns
- */
- export const getMe = async (req: Request, res: Response) => {
-  /* 
-    #swagger.summary = "Retrieve the current user on the request"
-    #swagger.description = "Retrieve the current user on the request"
-    
-    #swagger.security = [{
-        "apiKeyAuth": []
-    }]
-
-    #swagger.responses[200] = {
-        content: {
-            "application/json": {
-                "schema": { 
-                    "type": "object",
-                    "properties": {
-                        "user": {
-                            "type": "object",
-                            $ref: "#/components/schemas/CurrentUser",
-                            "description": "Current user on request"
-                        }
-                    }
-                }
-            }           
-        }
-    }   
-    */
-  const user = await User.findById(req.user._id).select(
-    "+salt +publicKey +encryptedPrivateKey +iv +tag +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag"
-  );
-
-  return res.status(200).send({
-    user
-  });
-};
-
-/**
- * Delete the current user.
- * @param req 
- * @param res 
- */
-export const deleteMe = async (req: Request, res: Response) => {
-  const user = await deleteUser({
-    userId: req.user._id
-  });
-
-  return res.status(200).send({
-    user
-  });
+	return res.status(200).send({
+		organizations
+	});
 }

backend/src/controllers/v2/workspaceController.ts

@@ -1,39 +1,41 @@
-import { Request, Response } from "express";
-import { Types } from "mongoose";
-import { Key, Membership, ServiceTokenData, Workspace } from "../../models";
+import { Request, Response } from 'express';
+import * as Sentry from '@sentry/node';
+import { Types } from 'mongoose';
 import {
-  pullSecrets as pull,
-  v2PushSecrets as push,
-  reformatPullSecrets
-} from "../../helpers/secret";
-import { pushKeys } from "../../helpers/key";
-import { EventService, TelemetryService } from "../../services";
-import { eventPushSecrets } from "../../events";
-import { EEAuditLogService } from "../../ee/services";
-import { EventType } from "../../ee/models";
-import { validateRequest } from "../../helpers/validation";
-import * as reqValidator from "../../validation";
+	Workspace,
+	Secret,
+	Membership,
+	MembershipOrg,
+	Integration,
+	IntegrationAuth,
+	Key,
+	IUser,
+	ServiceToken,
+	ServiceTokenData
+} from '../../models';
 import {
-  ProjectPermissionActions,
-  ProjectPermissionSub,
-  getUserProjectPermissions
-} from "../../ee/services/ProjectRoleService";
-import { ForbiddenError } from "@casl/ability";
+	v2PushSecrets as push,
+	pullSecrets as pull,
+	reformatPullSecrets
+} from '../../helpers/secret';
+import { pushKeys } from '../../helpers/key';
+import { postHogClient, EventService } from '../../services';
+import { eventPushSecrets } from '../../events';
 
 interface V2PushSecret {
-  type: string; // personal or shared
-  secretKeyCiphertext: string;
-  secretKeyIV: string;
-  secretKeyTag: string;
-  secretKeyHash: string;
-  secretValueCiphertext: string;
-  secretValueIV: string;
-  secretValueTag: string;
-  secretValueHash: string;
-  secretCommentCiphertext?: string;
-  secretCommentIV?: string;
-  secretCommentTag?: string;
-  secretCommentHash?: string;
+	type: string; // personal or shared
+	secretKeyCiphertext: string;
+	secretKeyIV: string;
+	secretKeyTag: string;
+	secretKeyHash: string;
+	secretValueCiphertext: string;
+	secretValueIV: string;
+	secretValueTag: string;
+	secretValueHash: string;
+	secretCommentCiphertext?: string;
+	secretCommentIV?: string;
+	secretCommentTag?: string;
+	secretCommentHash?: string;
 }
 
 /**
@@ -44,63 +46,69 @@ interface V2PushSecret {
  * @returns
  */
 export const pushWorkspaceSecrets = async (req: Request, res: Response) => {
-  // upload (encrypted) secrets to workspace with id [workspaceId]
-  const postHogClient = await TelemetryService.getPostHogClient();
-  let { secrets }: { secrets: V2PushSecret[] } = req.body;
-  const { keys, environment, channel } = req.body;
-  const { workspaceId } = req.params;
+	// upload (encrypted) secrets to workspace with id [workspaceId]
+	try {
+		let { secrets }: { secrets: V2PushSecret[] } = req.body;
+		const { keys, environment, channel } = req.body;
+		const { workspaceId } = req.params;
 
-  // validate environment
-  const workspaceEnvs = req.membership.workspace.environments;
-  if (!workspaceEnvs.find(({ slug }: { slug: string }) => slug === environment)) {
-    throw new Error("Failed to validate environment");
-  }
+		// validate environment
+		const workspaceEnvs = req.membership.workspace.environments;
+		if (!workspaceEnvs.find(({ slug }: { slug: string }) => slug === environment)) {
+			throw new Error('Failed to validate environment');
+		}
 
-  // sanitize secrets
-  secrets = secrets.filter(
-    (s: V2PushSecret) => s.secretKeyCiphertext !== "" && s.secretValueCiphertext !== ""
-  );
+		// sanitize secrets
+		secrets = secrets.filter(
+			(s: V2PushSecret) => s.secretKeyCiphertext !== '' && s.secretValueCiphertext !== ''
+		);
 
-  await push({
-    userId: req.user._id,
-    workspaceId,
-    environment,
-    secrets,
-    channel: channel ? channel : "cli",
-    ipAddress: req.realIP
-  });
+		await push({
+			userId: req.user._id,
+			workspaceId,
+			environment,
+			secrets,
+			channel: channel ? channel : 'cli',
+			ipAddress: req.ip
+		});
 
-  await pushKeys({
-    userId: req.user._id,
-    workspaceId,
-    keys
-  });
+		await pushKeys({
+			userId: req.user._id,
+			workspaceId,
+			keys
+		});
 
-  if (postHogClient) {
-    postHogClient.capture({
-      event: "secrets pushed",
-      distinctId: req.user.email,
-      properties: {
-        numberOfSecrets: secrets.length,
-        environment,
-        workspaceId,
-        channel: channel ? channel : "cli"
-      }
-    });
-  }
+		if (postHogClient) {
+			postHogClient.capture({
+				event: 'secrets pushed',
+				distinctId: req.user.email,
+				properties: {
+					numberOfSecrets: secrets.length,
+					environment,
+					workspaceId,
+					channel: channel ? channel : 'cli'
+				}
+			});
+		}
 
-  // trigger event - push secrets
-  EventService.handleEvent({
-    event: eventPushSecrets({
-      workspaceId: new Types.ObjectId(workspaceId),
-      environment,
-      secretPath: "/"
-    })
-  });
+		// trigger event - push secrets
+		EventService.handleEvent({
+			event: eventPushSecrets({
+				workspaceId
+			})
+		});
 
-  return res.status(200).send({
-    message: "Successfully uploaded workspace secrets"
-  });
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to upload workspace secrets'
+		});
+	}
+
+	return res.status(200).send({
+		message: 'Successfully uploaded workspace secrets'
+	});
 };
 
 /**
@@ -111,57 +119,64 @@ export const pushWorkspaceSecrets = async (req: Request, res: Response) => {
  * @returns
  */
 export const pullSecrets = async (req: Request, res: Response) => {
-  let secrets;
-  const postHogClient = await TelemetryService.getPostHogClient();
-  const environment: string = req.query.environment as string;
-  const channel: string = req.query.channel as string;
-  const { workspaceId } = req.params;
+	let secrets;
+	try {
+		const environment: string = req.query.environment as string;
+		const channel: string = req.query.channel as string;
+		const { workspaceId } = req.params;
 
-  let userId;
-  if (req.user) {
-    userId = req.user._id.toString();
-  } else if (req.serviceTokenData) {
-    userId = req.serviceTokenData.user.toString();
-  }
-  // validate environment
-  const workspaceEnvs = req.membership.workspace.environments;
-  if (!workspaceEnvs.find(({ slug }: { slug: string }) => slug === environment)) {
-    throw new Error("Failed to validate environment");
-  }
+		let userId;
+		if (req.user) {
+			userId = req.user._id.toString();
+		} else if (req.serviceTokenData) {
+			userId = req.serviceTokenData.user._id
+		}
+		// validate environment
+		const workspaceEnvs = req.membership.workspace.environments;
+		if (!workspaceEnvs.find(({ slug }: { slug: string }) => slug === environment)) {
+			throw new Error('Failed to validate environment');
+		}
 
-  secrets = await pull({
-    userId,
-    workspaceId,
-    environment,
-    channel: channel ? channel : "cli",
-    ipAddress: req.realIP
-  });
+		secrets = await pull({
+			userId,
+			workspaceId,
+			environment,
+			channel: channel ? channel : 'cli',
+			ipAddress: req.ip
+		});
 
-  if (channel !== "cli") {
-    secrets = reformatPullSecrets({ secrets });
-  }
+		if (channel !== 'cli') {
+			secrets = reformatPullSecrets({ secrets });
+		}
 
-  if (postHogClient) {
-    // capture secrets pushed event in production
-    postHogClient.capture({
-      distinctId: req.user.email,
-      event: "secrets pulled",
-      properties: {
-        numberOfSecrets: secrets.length,
-        environment,
-        workspaceId,
-        channel: channel ? channel : "cli"
-      }
-    });
-  }
+		if (postHogClient) {
+			// capture secrets pushed event in production
+			postHogClient.capture({
+				distinctId: req.user.email,
+				event: 'secrets pulled',
+				properties: {
+					numberOfSecrets: secrets.length,
+					environment,
+					workspaceId,
+					channel: channel ? channel : 'cli'
+				}
+			});
+		}
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to pull workspace secrets'
+		});
+	}
 
-  return res.status(200).send({
-    secrets
-  });
+	return res.status(200).send({
+		secrets
+	});
 };
 
 export const getWorkspaceKey = async (req: Request, res: Response) => {
-  /* 
+	/* 
     #swagger.summary = 'Return encrypted project key'
     #swagger.description = 'Return encrypted project key'
     
@@ -189,53 +204,61 @@ export const getWorkspaceKey = async (req: Request, res: Response) => {
         }
     }   
     */
-  const {
-    params: { workspaceId }
-  } = await validateRequest(reqValidator.GetWorkspaceKeyV2, req);
+	let key;
+	try {
+		const { workspaceId } = req.params;
 
-  const key = await Key.findOne({
-    workspace: workspaceId,
-    receiver: req.user._id
-  }).populate("sender", "+publicKey");
+		key = await Key.findOne({
+			workspace: workspaceId,
+			receiver: req.user._id
+		}).populate('sender', '+publicKey');
 
-  if (!key) throw new Error("Failed to find workspace key");
+		if (!key) throw new Error('Failed to find workspace key');
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get workspace key'
+		});
+	}
 
-  await EEAuditLogService.createAuditLog(
-    req.authData,
-    {
-      type: EventType.GET_WORKSPACE_KEY,
-      metadata: {
-        keyId: key._id.toString()
-      }
-    },
-    {
-      workspaceId: new Types.ObjectId(workspaceId)
-    }
-  );
+	return res.status(200).json(key);
+}
+export const getWorkspaceServiceTokenData = async (
+	req: Request,
+	res: Response
+) => {
+	let serviceTokenData;
+	try {
+		const { workspaceId } = req.params;
 
-  return res.status(200).json(key);
-};
+		serviceTokenData = await ServiceTokenData
+			.find({
+				workspace: workspaceId
+			})
+			.select('+encryptedKey +iv +tag');
 
-export const getWorkspaceServiceTokenData = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get workspace service token data'
+		});
+	}
 
-  const serviceTokenData = await ServiceTokenData.find({
-    workspace: workspaceId
-  }).select("+encryptedKey +iv +tag");
-
-  return res.status(200).send({
-    serviceTokenData
-  });
-};
+	return res.status(200).send({
+		serviceTokenData
+	});
+}
 
 /**
  * Return memberships for workspace with id [workspaceId]
- * @param req
- * @param res
- * @returns
+ * @param req 
+ * @param res 
+ * @returns 
  */
 export const getWorkspaceMemberships = async (req: Request, res: Response) => {
-  /* 
+	/* 
     #swagger.summary = 'Return project memberships'
     #swagger.description = 'Return project memberships'
     
@@ -268,33 +291,34 @@ export const getWorkspaceMemberships = async (req: Request, res: Response) => {
         }
     }   
     */
-  const {
-    params: { workspaceId }
-  } = await validateRequest(reqValidator.GetWorkspaceMembershipsV2, req);
+	let memberships;
+	try {
+		const { workspaceId } = req.params;
 
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Read,
-    ProjectPermissionSub.Member
-  );
+		memberships = await Membership.find({
+			workspace: workspaceId
+		}).populate('user', '+publicKey');
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get workspace memberships'
+		});
+	}
 
-  const memberships = await Membership.find({
-    workspace: workspaceId
-  }).populate("user", "+publicKey");
-
-  return res.status(200).send({
-    memberships
-  });
-};
+	return res.status(200).send({
+		memberships
+	});
+}
 
 /**
  * Update role of membership with id [membershipId] to role [role]
- * @param req
- * @param res
- * @returns
+ * @param req 
+ * @param res 
+ * @returns 
  */
 export const updateWorkspaceMembership = async (req: Request, res: Response) => {
-  /* 
+	/* 
     #swagger.summary = 'Update project membership'
     #swagger.description = 'Update project membership'
     
@@ -347,40 +371,42 @@ export const updateWorkspaceMembership = async (req: Request, res: Response) =>
         }
     }   
     */
-  const {
-    params: { workspaceId, membershipId },
-    body: { role }
-  } = await validateRequest(reqValidator.UpdateWorkspaceMembershipsV2, req);
-
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Edit,
-    ProjectPermissionSub.Member
-  );
-
-  const membership = await Membership.findByIdAndUpdate(
-    membershipId,
-    {
-      role
-    },
-    {
-      new: true
-    }
-  );
-
-  return res.status(200).send({
-    membership
-  });
-};
+	let membership;
+	try {
+		const {
+			membershipId
+		} = req.params;
+		const { role } = req.body;
+		
+		membership = await Membership.findByIdAndUpdate(
+			membershipId,
+			{
+				role
+			}, {
+				new: true
+			}
+		);
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to update workspace membership'
+		});
+	}
+	
+	return res.status(200).send({
+		membership
+	}); 
+}
 
 /**
  * Delete workspace membership with id [membershipId]
- * @param req
- * @param res
- * @returns
+ * @param req 
+ * @param res 
+ * @returns 
  */
 export const deleteWorkspaceMembership = async (req: Request, res: Response) => {
-  /* 
+	/* 
     #swagger.summary = 'Delete project membership'
     #swagger.description = 'Delete project membership'
     
@@ -416,62 +442,29 @@ export const deleteWorkspaceMembership = async (req: Request, res: Response) =>
         }
     }   
     */
-  const {
-    params: { workspaceId, membershipId }
-  } = await validateRequest(reqValidator.DeleteWorkspaceMembershipsV2, req);
-
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Delete,
-    ProjectPermissionSub.Member
-  );
-
-  const membership = await Membership.findByIdAndDelete(membershipId);
-
-  if (!membership) throw new Error("Failed to delete workspace membership");
-
-  await Key.deleteMany({
-    receiver: membership.user,
-    workspace: membership.workspace
-  });
-
-  return res.status(200).send({
-    membership
-  });
-};
-
-/**
- * Change autoCapitilzation Rule of workspace
- * @param req
- * @param res
- * @returns
- */
-export const toggleAutoCapitalization = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId },
-    body: { autoCapitalization }
-  } = await validateRequest(reqValidator.ToggleAutoCapitalizationV2, req);
-
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Edit,
-    ProjectPermissionSub.Settings
-  );
-
-  const workspace = await Workspace.findOneAndUpdate(
-    {
-      _id: workspaceId
-    },
-    {
-      autoCapitalization
-    },
-    {
-      new: true
-    }
-  );
-
-  return res.status(200).send({
-    message: "Successfully changed autoCapitalization setting",
-    workspace
-  });
-};
+	let membership;
+	try {
+		const { 
+			membershipId
+		} = req.params;
+		
+		membership = await Membership.findByIdAndDelete(membershipId);
+		
+		if (!membership) throw new Error('Failed to delete workspace membership');
+		
+		await Key.deleteMany({
+			receiver: membership.user,
+			workspace: membership.workspace
+		});
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to delete workspace membership'
+		});	
+	}
+	
+	return res.status(200).send({
+		membership
+	});
+}

backend/src/controllers/v3/authController.ts

@@ -1,238 +0,0 @@
-/* eslint-disable @typescript-eslint/no-var-requires */
-import { Request, Response } from "express";
-import jwt from "jsonwebtoken";
-import * as bigintConversion from "bigint-conversion";
-const jsrp = require("jsrp");
-import { LoginSRPDetail, User } from "../../models";
-import { createToken, issueAuthTokens, validateProviderAuthToken } from "../../helpers/auth";
-import { checkUserDevice } from "../../helpers/user";
-import { sendMail } from "../../helpers/nodemailer";
-import { TokenService } from "../../services";
-import { EELogService } from "../../ee/services";
-import { BadRequestError, InternalServerError } from "../../utils/errors";
-import { ACTION_LOGIN, TOKEN_EMAIL_MFA } from "../../variables";
-import { getUserAgentType } from "../../utils/posthog"; // TODO: move this
-import { getHttpsEnabled, getJwtMfaLifetime, getJwtMfaSecret } from "../../config";
-import { AuthMethod } from "../../models/user";
-import { validateRequest } from "../../helpers/validation";
-import * as reqValidator from "../../validation/auth";
-
-declare module "jsonwebtoken" {
-  export interface ProviderAuthJwtPayload extends jwt.JwtPayload {
-    userId: string;
-    email: string;
-    authProvider: AuthMethod;
-    isUserCompleted: boolean;
-  }
-}
-
-/**
- * Log in user step 1: Return [salt] and [serverPublicKey] as part of step 1 of SRP protocol
- * @param req
- * @param res
- * @returns
- */
-export const login1 = async (req: Request, res: Response) => {
-  const {
-    body: { email, clientPublicKey, providerAuthToken }
-  } = await validateRequest(reqValidator.Login1V3, req);
-
-  const user = await User.findOne({
-    email
-  }).select("+salt +verifier");
-
-  if (!user) throw new Error("Failed to find user");
-
-  if (!user.authMethods.includes(AuthMethod.EMAIL)) {
-    await validateProviderAuthToken({
-      email,
-      providerAuthToken
-    });
-  }
-
-  const server = new jsrp.server();
-  server.init(
-    {
-      salt: user.salt,
-      verifier: user.verifier
-    },
-    async () => {
-      // generate server-side public key
-      const serverPublicKey = server.getPublicKey();
-      await LoginSRPDetail.findOneAndReplace(
-        {
-          email: email
-        },
-        {
-          email,
-          userId: user.id,
-          clientPublicKey: clientPublicKey,
-          serverBInt: bigintConversion.bigintToBuf(server.bInt)
-        },
-        { upsert: true, returnNewDocument: false }
-      );
-
-      return res.status(200).send({
-        serverPublicKey,
-        salt: user.salt
-      });
-    }
-  );
-};
-
-/**
- * Log in user step 2: complete step 2 of SRP protocol and return token and their (encrypted)
- * private key
- * @param req
- * @param res
- * @returns
- */
-export const login2 = async (req: Request, res: Response) => {
-  if (!req.headers["user-agent"])
-    throw InternalServerError({ message: "User-Agent header is required" });
-
-  const {
-    body: { email, providerAuthToken, clientProof }
-  } = await validateRequest(reqValidator.Login2V3, req);
-
-  const user = await User.findOne({
-    email
-  }).select(
-    "+salt +verifier +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag +publicKey +encryptedPrivateKey +iv +tag +devices"
-  );
-
-  if (!user) throw new Error("Failed to find user");
-
-  if (!user.authMethods.includes(AuthMethod.EMAIL)) {
-    await validateProviderAuthToken({
-      email,
-      providerAuthToken
-    });
-  }
-
-  const loginSRPDetail = await LoginSRPDetail.findOneAndDelete({ email: email });
-
-  if (!loginSRPDetail) {
-    return BadRequestError(Error("Failed to find login details for SRP"));
-  }
-
-  const server = new jsrp.server();
-  server.init(
-    {
-      salt: user.salt,
-      verifier: user.verifier,
-      b: loginSRPDetail.serverBInt
-    },
-    async () => {
-      server.setClientPublicKey(loginSRPDetail.clientPublicKey);
-
-      // compare server and client shared keys
-      if (server.checkClientProof(clientProof)) {
-        if (user.isMfaEnabled) {
-          // case: user has MFA enabled
-
-          // generate temporary MFA token
-          const token = createToken({
-            payload: {
-              userId: user._id.toString()
-            },
-            expiresIn: await getJwtMfaLifetime(),
-            secret: await getJwtMfaSecret()
-          });
-
-          const code = await TokenService.createToken({
-            type: TOKEN_EMAIL_MFA,
-            email
-          });
-
-          // send MFA code [code] to [email]
-          await sendMail({
-            template: "emailMfa.handlebars",
-            subjectLine: "Infisical MFA code",
-            recipients: [user.email],
-            substitutions: {
-              code
-            }
-          });
-
-          return res.status(200).send({
-            mfaEnabled: true,
-            token
-          });
-        }
-
-        await checkUserDevice({
-          user,
-          ip: req.realIP,
-          userAgent: req.headers["user-agent"] ?? ""
-        });
-
-        // issue tokens
-        const tokens = await issueAuthTokens({
-          userId: user._id,
-          ip: req.realIP,
-          userAgent: req.headers["user-agent"] ?? ""
-        });
-
-        // store (refresh) token in httpOnly cookie
-        res.cookie("jid", tokens.refreshToken, {
-          httpOnly: true,
-          path: "/",
-          sameSite: "strict",
-          secure: await getHttpsEnabled()
-        });
-
-        // case: user does not have MFA enablgged
-        // return (access) token in response
-
-        interface ResponseData {
-          mfaEnabled: boolean;
-          encryptionVersion: any;
-          protectedKey?: string;
-          protectedKeyIV?: string;
-          protectedKeyTag?: string;
-          token: string;
-          publicKey?: string;
-          encryptedPrivateKey?: string;
-          iv?: string;
-          tag?: string;
-        }
-
-        const response: ResponseData = {
-          mfaEnabled: false,
-          encryptionVersion: user.encryptionVersion,
-          token: tokens.token,
-          publicKey: user.publicKey,
-          encryptedPrivateKey: user.encryptedPrivateKey,
-          iv: user.iv,
-          tag: user.tag
-        };
-
-        if (user?.protectedKey && user?.protectedKeyIV && user?.protectedKeyTag) {
-          response.protectedKey = user.protectedKey;
-          response.protectedKeyIV = user.protectedKeyIV;
-          response.protectedKeyTag = user.protectedKeyTag;
-        }
-
-        const loginAction = await EELogService.createAction({
-          name: ACTION_LOGIN,
-          userId: user._id
-        });
-
-        loginAction &&
-          (await EELogService.createLog({
-            userId: user._id,
-            actions: [loginAction],
-            channel: getUserAgentType(req.headers["user-agent"]),
-            ipAddress: req.realIP
-          }));
-
-        return res.status(200).send(response);
-      }
-
-      return res.status(400).send({
-        message: "Failed to authenticate. Try again?"
-      });
-    }
-  );
-};

backend/src/controllers/v3/index.ts

@@ -1,11 +0,0 @@
-import * as secretsController from "./secretsController";
-import * as workspacesController from "./workspacesController";
-import * as authController from "./authController";
-import * as signupController from "./signupController";
-
-export {
-    authController,
-    secretsController,
-    signupController,
-    workspacesController
-}

backend/src/controllers/v3/secretsController.ts

@@ -1,969 +0,0 @@
-import { Request, Response } from "express";
-import { Types } from "mongoose";
-import { EventService, SecretService } from "../../services";
-import { eventPushSecrets } from "../../events";
-import { BotService } from "../../services";
-import { containsGlobPatterns, isValidScopeV3, repackageSecretToRaw } from "../../helpers/secrets";
-import { encryptSymmetric128BitHexKeyUTF8 } from "../../utils/crypto";
-import { getAllImportedSecrets } from "../../services/SecretImportService";
-import { Folder, IMembership, IServiceTokenData, IServiceTokenDataV3 } from "../../models";
-import { Permission } from "../../models/serviceTokenDataV3";
-import { getFolderByPath, getFolderWithPathFromId } from "../../services/FolderService";
-import { BadRequestError } from "../../utils/errors";
-import { validateRequest } from "../../helpers/validation";
-import * as reqValidator from "../../validation/secrets";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSub,
-  getUserProjectPermissions
-} from "../../ee/services/ProjectRoleService";
-import { ForbiddenError, subject } from "@casl/ability";
-import {
-  validateServiceTokenDataClientForWorkspace,
-  validateServiceTokenDataV3ClientForWorkspace
-} from "../../validation";
-import { PERMISSION_READ_SECRETS, PERMISSION_WRITE_SECRETS } from "../../variables";
-import { ActorType } from "../../ee/models";
-import { UnauthorizedRequestError } from "../../utils/errors";
-import { AuthData } from "../../interfaces/middleware";
-import {
-  generateSecretApprovalRequest,
-  getSecretPolicyOfBoard
-} from "../../ee/services/SecretApprovalService";
-import { CommitType } from "../../ee/models/secretApprovalRequest";
-import { IRole } from "../../ee/models/role";
-
-const checkSecretsPermission = async ({
-  authData,
-  workspaceId,
-  environment,
-  secretPath,
-  secretAction
-}: {
-  authData: AuthData;
-  workspaceId: string;
-  environment: string;
-  secretPath: string;
-  secretAction: ProjectPermissionActions; // CRUD
-}): Promise<{
-  authVerifier: (env: string, secPath: string) => boolean;
-  membership?: Omit<IMembership, "customRole"> & { customRole: IRole };
-}> => {
-  let STV2RequiredPermissions = [];
-  let STV3RequiredPermissions: Permission[] = [];
-
-  switch (secretAction) {
-    case ProjectPermissionActions.Create:
-      STV2RequiredPermissions = [PERMISSION_WRITE_SECRETS];
-      STV3RequiredPermissions = [Permission.WRITE];
-      break;
-    case ProjectPermissionActions.Read:
-      STV2RequiredPermissions = [PERMISSION_READ_SECRETS];
-      STV3RequiredPermissions = [Permission.READ];
-      break;
-    case ProjectPermissionActions.Edit:
-      STV2RequiredPermissions = [PERMISSION_WRITE_SECRETS];
-      STV3RequiredPermissions = [Permission.WRITE];
-      break;
-    case ProjectPermissionActions.Delete:
-      STV2RequiredPermissions = [PERMISSION_WRITE_SECRETS];
-      STV3RequiredPermissions = [Permission.WRITE];
-      break;
-  }
-
-  switch (authData.actor.type) {
-    case ActorType.USER: {
-      const { permission, membership } = await getUserProjectPermissions(
-        authData.actor.metadata.userId,
-        workspaceId
-      );
-      ForbiddenError.from(permission).throwUnlessCan(
-        secretAction,
-        subject(ProjectPermissionSub.Secrets, { environment, secretPath })
-      );
-      return {
-        authVerifier: (env: string, secPath: string) =>
-          permission.can(
-            secretAction,
-            subject(ProjectPermissionSub.Secrets, {
-              environment: env,
-              secretPath: secPath
-            })
-          ),
-        membership
-      };
-    }
-    case ActorType.SERVICE: {
-      await validateServiceTokenDataClientForWorkspace({
-        serviceTokenData: authData.authPayload as IServiceTokenData,
-        workspaceId: new Types.ObjectId(workspaceId),
-        environment,
-        secretPath,
-        requiredPermissions: STV2RequiredPermissions
-      });
-      return { authVerifier: () => true };
-    }
-    case ActorType.SERVICE_V3: {
-      await validateServiceTokenDataV3ClientForWorkspace({
-        authData,
-        serviceTokenData: authData.authPayload as IServiceTokenDataV3,
-        workspaceId: new Types.ObjectId(workspaceId),
-        environment,
-        secretPath,
-        requiredPermissions: STV3RequiredPermissions
-      });
-      return {
-        authVerifier: (env: string, secPath: string) =>
-          isValidScopeV3({
-            authPayload: authData.authPayload as IServiceTokenDataV3,
-            environment: env,
-            secretPath: secPath,
-            requiredPermissions: STV3RequiredPermissions
-          })
-      };
-    }
-    default: {
-      throw UnauthorizedRequestError();
-    }
-  }
-};
-
-/**
- * Return secrets for workspace with id [workspaceId] and environment
- * [environment] in plaintext
- * @param req
- * @param res
- */
-export const getSecretsRaw = async (req: Request, res: Response) => {
-  const validatedData = await validateRequest(reqValidator.GetSecretsRawV3, req);
-  let {
-    query: { secretPath, environment, workspaceId }
-  } = validatedData;
-  const {
-    query: { folderId, include_imports: includeImports }
-  } = validatedData;
-
-  // if the service token has single scope, it will get all secrets for that scope by default
-  const serviceTokenDetails: IServiceTokenData = req?.serviceTokenData;
-  if (
-    serviceTokenDetails &&
-    serviceTokenDetails.scopes.length == 1 &&
-    !containsGlobPatterns(serviceTokenDetails.scopes[0].secretPath)
-  ) {
-    const scope = serviceTokenDetails.scopes[0];
-    secretPath = scope.secretPath;
-    environment = scope.environment;
-    workspaceId = serviceTokenDetails.workspace.toString();
-  }
-
-  if (folderId && folderId !== "root") {
-    const folder = await Folder.findOne({ workspace: workspaceId, environment });
-    if (!folder) throw BadRequestError({ message: "Folder not found" });
-
-    secretPath = getFolderWithPathFromId(folder.nodes, folderId).folderPath;
-  }
-
-  if (!environment || !workspaceId)
-    throw BadRequestError({ message: "Missing environment or workspace id" });
-
-  const { authVerifier: permissionCheckFn } = await checkSecretsPermission({
-    authData: req.authData,
-    workspaceId,
-    environment,
-    secretPath,
-    secretAction: ProjectPermissionActions.Read
-  });
-
-  const secrets = await SecretService.getSecrets({
-    workspaceId: new Types.ObjectId(workspaceId),
-    environment,
-    folderId,
-    secretPath,
-    authData: req.authData
-  });
-
-  const key = await BotService.getWorkspaceKeyWithBot({
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
-  if (includeImports) {
-    const folders = await Folder.findOne({ workspace: workspaceId, environment });
-    let folderId = "root";
-    // if folder exist get it and replace folderid with new one
-    if (folders) {
-      const folder = getFolderByPath(folders.nodes, secretPath as string);
-      if (!folder) {
-        throw BadRequestError({ message: "Folder not found" });
-      }
-      folderId = folder.id;
-    }
-    const importedSecrets = await getAllImportedSecrets(
-      workspaceId,
-      environment,
-      folderId,
-      permissionCheckFn
-    );
-    return res.status(200).send({
-      secrets: secrets.map((secret) =>
-        repackageSecretToRaw({
-          secret,
-          key
-        })
-      ),
-      imports: importedSecrets.map((el) => ({
-        ...el,
-        secrets: el.secrets.map((secret) => repackageSecretToRaw({ secret, key }))
-      }))
-    });
-  }
-
-  return res.status(200).send({
-    secrets: secrets.map((secret) => {
-      const rep = repackageSecretToRaw({
-        secret,
-        key
-      });
-      return rep;
-    })
-  });
-};
-
-/**
- * Return secret with name [secretName] in plaintext
- * @param req
- * @param res
- */
-export const getSecretByNameRaw = async (req: Request, res: Response) => {
-  const {
-    query: { secretPath, environment, workspaceId, type, include_imports },
-    params: { secretName }
-  } = await validateRequest(reqValidator.GetSecretByNameRawV3, req);
-
-  await checkSecretsPermission({
-    authData: req.authData,
-    workspaceId,
-    environment,
-    secretPath,
-    secretAction: ProjectPermissionActions.Read
-  });
-
-  const secret = await SecretService.getSecret({
-    secretName,
-    workspaceId: new Types.ObjectId(workspaceId),
-    environment,
-    type,
-    secretPath,
-    authData: req.authData,
-    include_imports
-  });
-
-  const key = await BotService.getWorkspaceKeyWithBot({
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
-  return res.status(200).send({
-    secret: repackageSecretToRaw({
-      secret,
-      key
-    })
-  });
-};
-
-/**
- * Create secret with name [secretName] in plaintext
- * @param req
- * @param res
- */
-export const createSecretRaw = async (req: Request, res: Response) => {
-  const {
-    params: { secretName },
-    body: {
-      secretPath,
-      environment,
-      workspaceId,
-      type,
-      secretValue,
-      secretComment,
-      skipMultilineEncoding
-    }
-  } = await validateRequest(reqValidator.CreateSecretRawV3, req);
-
-  await checkSecretsPermission({
-    authData: req.authData,
-    workspaceId,
-    environment,
-    secretPath,
-    secretAction: ProjectPermissionActions.Create
-  });
-
-  const key = await BotService.getWorkspaceKeyWithBot({
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
-  const secretKeyEncrypted = encryptSymmetric128BitHexKeyUTF8({
-    plaintext: secretName,
-    key
-  });
-
-  const secretValueEncrypted = encryptSymmetric128BitHexKeyUTF8({
-    plaintext: secretValue,
-    key
-  });
-
-  const secretCommentEncrypted = encryptSymmetric128BitHexKeyUTF8({
-    plaintext: secretComment,
-    key
-  });
-
-  const secret = await SecretService.createSecret({
-    secretName,
-    workspaceId: new Types.ObjectId(workspaceId),
-    environment,
-    type,
-    authData: req.authData,
-    secretKeyCiphertext: secretKeyEncrypted.ciphertext,
-    secretKeyIV: secretKeyEncrypted.iv,
-    secretKeyTag: secretKeyEncrypted.tag,
-    secretValueCiphertext: secretValueEncrypted.ciphertext,
-    secretValueIV: secretValueEncrypted.iv,
-    secretValueTag: secretValueEncrypted.tag,
-    secretPath,
-    secretCommentCiphertext: secretCommentEncrypted.ciphertext,
-    secretCommentIV: secretCommentEncrypted.iv,
-    secretCommentTag: secretCommentEncrypted.tag,
-    skipMultilineEncoding
-  });
-
-  await EventService.handleEvent({
-    event: eventPushSecrets({
-      workspaceId: new Types.ObjectId(workspaceId),
-      environment,
-      secretPath
-    })
-  });
-
-  const secretWithoutBlindIndex = secret.toObject();
-  delete secretWithoutBlindIndex.secretBlindIndex;
-
-  return res.status(200).send({
-    secret: repackageSecretToRaw({
-      secret: secretWithoutBlindIndex,
-      key
-    })
-  });
-};
-
-/**
- * Update secret with name [secretName]
- * @param req
- * @param res
- */
-export const updateSecretByNameRaw = async (req: Request, res: Response) => {
-  const {
-    params: { secretName },
-    body: { secretValue, environment, secretPath, type, workspaceId, skipMultilineEncoding }
-  } = await validateRequest(reqValidator.UpdateSecretByNameRawV3, req);
-
-  await checkSecretsPermission({
-    authData: req.authData,
-    workspaceId,
-    environment,
-    secretPath,
-    secretAction: ProjectPermissionActions.Edit
-  });
-
-  const key = await BotService.getWorkspaceKeyWithBot({
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
-  const secretValueEncrypted = encryptSymmetric128BitHexKeyUTF8({
-    plaintext: secretValue,
-    key
-  });
-
-  const secret = await SecretService.updateSecret({
-    secretName,
-    workspaceId: new Types.ObjectId(workspaceId),
-    environment,
-    type,
-    authData: req.authData,
-    secretValueCiphertext: secretValueEncrypted.ciphertext,
-    secretValueIV: secretValueEncrypted.iv,
-    secretValueTag: secretValueEncrypted.tag,
-    secretPath,
-    skipMultilineEncoding
-  });
-
-  await EventService.handleEvent({
-    event: eventPushSecrets({
-      workspaceId: new Types.ObjectId(workspaceId),
-      environment,
-      secretPath
-    })
-  });
-
-  return res.status(200).send({
-    secret: repackageSecretToRaw({
-      secret,
-      key
-    })
-  });
-};
-
-/**
- * Delete secret with name [secretName]
- * @param req
- * @param res
- */
-export const deleteSecretByNameRaw = async (req: Request, res: Response) => {
-  const {
-    params: { secretName },
-    body: { environment, secretPath, type, workspaceId }
-  } = await validateRequest(reqValidator.DeleteSecretByNameRawV3, req);
-
-  await checkSecretsPermission({
-    authData: req.authData,
-    workspaceId,
-    environment,
-    secretPath,
-    secretAction: ProjectPermissionActions.Delete
-  });
-
-  const { secret } = await SecretService.deleteSecret({
-    secretName,
-    workspaceId: new Types.ObjectId(workspaceId),
-    environment,
-    type,
-    authData: req.authData,
-    secretPath
-  });
-
-  await EventService.handleEvent({
-    event: eventPushSecrets({
-      workspaceId: new Types.ObjectId(workspaceId),
-      environment,
-      secretPath
-    })
-  });
-
-  const key = await BotService.getWorkspaceKeyWithBot({
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
-  return res.status(200).send({
-    secret: repackageSecretToRaw({
-      secret,
-      key
-    })
-  });
-};
-
-/**
- * Get secrets for workspace with id [workspaceId] and environment
- * [environment]
- * @param req
- * @param res
- */
-export const getSecrets = async (req: Request, res: Response) => {
-  const validatedData = await validateRequest(reqValidator.GetSecretsV3, req);
-  const {
-    query: { environment, workspaceId, include_imports: includeImports, folderId }
-  } = validatedData;
-
-  let {
-    query: { secretPath }
-  } = validatedData;
-
-  if (folderId && folderId !== "root") {
-    const folder = await Folder.findOne({ workspace: workspaceId, environment });
-    if (!folder) return res.send({ secrets: [] });
-
-    secretPath = getFolderWithPathFromId(folder.nodes, folderId).folderPath;
-  }
-
-  const { authVerifier: permissionCheckFn } = await checkSecretsPermission({
-    authData: req.authData,
-    workspaceId,
-    environment,
-    secretPath,
-    secretAction: ProjectPermissionActions.Read
-  });
-
-  const secrets = await SecretService.getSecrets({
-    workspaceId: new Types.ObjectId(workspaceId),
-    environment,
-    folderId,
-    secretPath,
-    authData: req.authData
-  });
-
-  if (includeImports) {
-    const folders = await Folder.findOne({ workspace: workspaceId, environment });
-    let folderId = "root";
-    // if folder exist get it and replace folderid with new one
-    if (folders) {
-      const folder = getFolderByPath(folders.nodes, secretPath as string);
-      if (!folder) {
-        throw BadRequestError({ message: "Folder not found" });
-      }
-      folderId = folder.id;
-    }
-    const importedSecrets = await getAllImportedSecrets(
-      workspaceId,
-      environment,
-      folderId,
-      permissionCheckFn
-    );
-    return res.status(200).send({
-      secrets,
-      imports: importedSecrets
-    });
-  }
-
-  return res.status(200).send({
-    secrets
-  });
-};
-
-/**
- * Return secret with name [secretName]
- * @param req
- * @param res
- */
-export const getSecretByName = async (req: Request, res: Response) => {
-  const {
-    query: { secretPath, environment, workspaceId, type, include_imports },
-    params: { secretName }
-  } = await validateRequest(reqValidator.GetSecretByNameV3, req);
-
-  await checkSecretsPermission({
-    authData: req.authData,
-    workspaceId,
-    environment,
-    secretPath,
-    secretAction: ProjectPermissionActions.Read
-  });
-
-  const secret = await SecretService.getSecret({
-    secretName,
-    workspaceId: new Types.ObjectId(workspaceId),
-    environment,
-    type,
-    secretPath,
-    authData: req.authData,
-    include_imports
-  });
-
-  return res.status(200).send({
-    secret
-  });
-};
-
-/**
- * Create secret with name [secretName]
- * @param req
- * @param res
- */
-export const createSecret = async (req: Request, res: Response) => {
-  const {
-    body: {
-      workspaceId,
-      secretPath,
-      environment,
-      metadata,
-      type,
-      secretKeyIV,
-      secretKeyTag,
-      secretValueIV,
-      secretValueTag,
-      secretCommentIV,
-      secretCommentTag,
-      secretKeyCiphertext,
-      secretValueCiphertext,
-      secretCommentCiphertext,
-      skipMultilineEncoding
-    },
-    params: { secretName }
-  } = await validateRequest(reqValidator.CreateSecretV3, req);
-
-  const { membership } = await checkSecretsPermission({
-    authData: req.authData,
-    workspaceId,
-    environment,
-    secretPath,
-    secretAction: ProjectPermissionActions.Create
-  });
-
-  if (membership && type !== "personal") {
-    const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
-    if (secretApprovalPolicy) {
-      const secretApprovalRequest = await generateSecretApprovalRequest({
-        workspaceId,
-        environment,
-        secretPath,
-        policy: secretApprovalPolicy,
-        commiterMembershipId: membership._id.toString(),
-        authData: req.authData,
-        data: {
-          [CommitType.CREATE]: [
-            {
-              secretName,
-              secretValueCiphertext,
-              secretValueIV,
-              secretValueTag,
-              secretCommentIV,
-              secretCommentTag,
-              secretCommentCiphertext,
-              skipMultilineEncoding,
-              secretKeyTag,
-              secretKeyCiphertext,
-              secretKeyIV
-            }
-          ]
-        }
-      });
-      return res.send({ approval: secretApprovalRequest });
-    }
-  }
-
-  const secret = await SecretService.createSecret({
-    secretName,
-    workspaceId: new Types.ObjectId(workspaceId),
-    environment,
-    type,
-    authData: req.authData,
-    secretKeyCiphertext,
-    secretKeyIV,
-    secretKeyTag,
-    secretValueCiphertext,
-    secretValueIV,
-    secretValueTag,
-    secretPath,
-    secretCommentCiphertext,
-    secretCommentIV,
-    secretCommentTag,
-    metadata,
-    skipMultilineEncoding
-  });
-
-  await EventService.handleEvent({
-    event: eventPushSecrets({
-      workspaceId: new Types.ObjectId(workspaceId),
-      environment,
-      secretPath
-    })
-  });
-
-  const secretWithoutBlindIndex = secret.toObject();
-  delete secretWithoutBlindIndex.secretBlindIndex;
-
-  return res.status(200).send({
-    secret: secretWithoutBlindIndex
-  });
-};
-
-/**
- * Update secret with name [secretName]
- * @param req
- * @param res
- */
-export const updateSecretByName = async (req: Request, res: Response) => {
-  const {
-    body: {
-      secretValueCiphertext,
-      secretValueTag,
-      secretValueIV,
-      secretId,
-      type,
-      environment,
-      secretPath,
-      workspaceId,
-      tags,
-      secretCommentIV,
-      secretCommentTag,
-      secretCommentCiphertext,
-      secretName: newSecretName,
-      secretKeyIV,
-      secretKeyTag,
-      secretKeyCiphertext,
-      skipMultilineEncoding
-    },
-    params: { secretName }
-  } = await validateRequest(reqValidator.UpdateSecretByNameV3, req);
-
-  if (newSecretName && (!secretKeyIV || !secretKeyTag || !secretKeyCiphertext)) {
-    throw BadRequestError({ message: "Missing encrypted key" });
-  }
-
-  const { membership } = await checkSecretsPermission({
-    authData: req.authData,
-    workspaceId,
-    environment,
-    secretPath,
-    secretAction: ProjectPermissionActions.Edit
-  });
-
-  if (membership && type !== "personal") {
-    const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
-    if (secretApprovalPolicy) {
-      const secretApprovalRequest = await generateSecretApprovalRequest({
-        workspaceId,
-        environment,
-        secretPath,
-        policy: secretApprovalPolicy,
-        commiterMembershipId: membership._id.toString(),
-        authData: req.authData,
-        data: {
-          [CommitType.UPDATE]: [
-            {
-              secretName,
-              newSecretName,
-              secretValueCiphertext,
-              secretValueIV,
-              secretValueTag,
-              tags,
-              secretCommentIV,
-              secretCommentTag,
-              secretCommentCiphertext,
-              skipMultilineEncoding,
-              secretKeyTag,
-              secretKeyCiphertext,
-              secretKeyIV
-            }
-          ]
-        }
-      });
-      return res.send({ approval: secretApprovalRequest });
-    }
-  }
-
-  const secret = await SecretService.updateSecret({
-    secretName,
-    workspaceId: new Types.ObjectId(workspaceId),
-    environment,
-    type,
-    secretId,
-    authData: req.authData,
-    newSecretName,
-    secretValueCiphertext,
-    secretValueIV,
-    secretValueTag,
-    secretPath,
-    tags,
-    secretCommentIV,
-    secretCommentTag,
-    secretCommentCiphertext,
-    skipMultilineEncoding,
-    secretKeyTag,
-    secretKeyCiphertext,
-    secretKeyIV
-  });
-
-  await EventService.handleEvent({
-    event: eventPushSecrets({
-      workspaceId: new Types.ObjectId(workspaceId),
-      environment,
-      secretPath
-    })
-  });
-
-  return res.status(200).send({
-    secret
-  });
-};
-
-/**
- * Delete secret with name [secretName]
- * @param req
- * @param res
- */
-export const deleteSecretByName = async (req: Request, res: Response) => {
-  const {
-    body: { type, environment, secretPath, workspaceId, secretId },
-    params: { secretName }
-  } = await validateRequest(reqValidator.DeleteSecretByNameV3, req);
-
-  const { membership } = await checkSecretsPermission({
-    authData: req.authData,
-    workspaceId,
-    environment,
-    secretPath,
-    secretAction: ProjectPermissionActions.Delete
-  });
-
-  if (membership && type !== "personal") {
-    const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
-    if (secretApprovalPolicy) {
-      const secretApprovalRequest = await generateSecretApprovalRequest({
-        workspaceId,
-        environment,
-        secretPath,
-        authData: req.authData,
-        policy: secretApprovalPolicy,
-        commiterMembershipId: membership._id.toString(),
-        data: {
-          [CommitType.DELETE]: [
-            {
-              secretName
-            }
-          ]
-        }
-      });
-      return res.send({ approval: secretApprovalRequest });
-    }
-  }
-
-  const { secret } = await SecretService.deleteSecret({
-    secretName,
-    secretId,
-    workspaceId: new Types.ObjectId(workspaceId),
-    environment,
-    type,
-    authData: req.authData,
-    secretPath
-  });
-
-  await EventService.handleEvent({
-    event: eventPushSecrets({
-      workspaceId: new Types.ObjectId(workspaceId),
-      environment,
-      secretPath
-    })
-  });
-
-  return res.status(200).send({
-    secret
-  });
-};
-
-export const createSecretByNameBatch = async (req: Request, res: Response) => {
-  const {
-    body: { secrets, secretPath, environment, workspaceId }
-  } = await validateRequest(reqValidator.CreateSecretByNameBatchV3, req);
-
-  const { membership } = await checkSecretsPermission({
-    authData: req.authData,
-    workspaceId,
-    environment,
-    secretPath,
-    secretAction: ProjectPermissionActions.Create
-  });
-
-  if (membership) {
-    const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
-    if (secretApprovalPolicy) {
-      const secretApprovalRequest = await generateSecretApprovalRequest({
-        workspaceId,
-        environment,
-        secretPath,
-        authData: req.authData,
-        policy: secretApprovalPolicy,
-        commiterMembershipId: membership._id.toString(),
-        data: {
-          [CommitType.CREATE]: secrets.filter(({ type }) => type === "shared")
-        }
-      });
-      return res.send({ approval: secretApprovalRequest });
-    }
-  }
-
-  const createdSecrets = await SecretService.createSecretBatch({
-    secretPath,
-    environment,
-    workspaceId: new Types.ObjectId(workspaceId),
-    secrets,
-    authData: req.authData
-  });
-
-  return res.status(200).send({
-    secrets: createdSecrets
-  });
-};
-
-export const updateSecretByNameBatch = async (req: Request, res: Response) => {
-  const {
-    body: { secrets, secretPath, environment, workspaceId }
-  } = await validateRequest(reqValidator.UpdateSecretByNameBatchV3, req);
-
-  const { membership } = await checkSecretsPermission({
-    authData: req.authData,
-    workspaceId,
-    environment,
-    secretPath,
-    secretAction: ProjectPermissionActions.Edit
-  });
-
-  if (membership) {
-    const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
-    if (secretApprovalPolicy) {
-      const secretApprovalRequest = await generateSecretApprovalRequest({
-        workspaceId,
-        environment,
-        secretPath,
-        policy: secretApprovalPolicy,
-        commiterMembershipId: membership._id.toString(),
-        data: {
-          [CommitType.UPDATE]: secrets.filter(({ type }) => type === "shared")
-        },
-        authData: req.authData
-      });
-      return res.send({ approval: secretApprovalRequest });
-    }
-  }
-
-  const updatedSecrets = await SecretService.updateSecretBatch({
-    secretPath,
-    environment,
-    workspaceId: new Types.ObjectId(workspaceId),
-    secrets,
-    authData: req.authData
-  });
-
-  return res.status(200).send({
-    secrets: updatedSecrets
-  });
-};
-
-export const deleteSecretByNameBatch = async (req: Request, res: Response) => {
-  const {
-    body: { secrets, secretPath, environment, workspaceId }
-  } = await validateRequest(reqValidator.DeleteSecretByNameBatchV3, req);
-
-  const { membership } = await checkSecretsPermission({
-    authData: req.authData,
-    workspaceId,
-    environment,
-    secretPath,
-    secretAction: ProjectPermissionActions.Delete
-  });
-
-  if (membership) {
-    const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
-    if (secretApprovalPolicy) {
-      const secretApprovalRequest = await generateSecretApprovalRequest({
-        workspaceId,
-        environment,
-        secretPath,
-        policy: secretApprovalPolicy,
-        commiterMembershipId: membership._id.toString(),
-        data: {
-          [CommitType.DELETE]: secrets.filter(({ type }) => type === "shared")
-        },
-        authData: req.authData
-      });
-      return res.send({ approval: secretApprovalRequest });
-    }
-  }
-
-  const deletedSecrets = await SecretService.deleteSecretBatch({
-    secretPath,
-    environment,
-    workspaceId: new Types.ObjectId(workspaceId),
-    secrets,
-    authData: req.authData
-  });
-
-  return res.status(200).send({
-    secrets: deletedSecrets
-  });
-};

backend/src/controllers/v3/signupController.ts

@@ -1,194 +0,0 @@
-import jwt from "jsonwebtoken";
-import { Request, Response } from "express";
-import * as Sentry from "@sentry/node";
-import { MembershipOrg, User } from "../../models";
-import { completeAccount } from "../../helpers/user";
-import { initializeDefaultOrg } from "../../helpers/signup";
-import { issueAuthTokens, validateProviderAuthToken } from "../../helpers/auth";
-import { ACCEPTED, INVITED } from "../../variables";
-import { standardRequest } from "../../config/request";
-import { getHttpsEnabled, getJwtSignupSecret, getLoopsApiKey } from "../../config";
-import { BadRequestError } from "../../utils/errors";
-import { TelemetryService } from "../../services";
-import { AuthMethod } from "../../models";
-import { validateRequest } from "../../helpers/validation";
-import * as reqValidator from "../../validation/auth";
-
-/**
- * Complete setting up user by adding their personal and auth information as part of the
- * signup flow
- * @param req
- * @param res
- * @returns
- */
-export const completeAccountSignup = async (req: Request, res: Response) => {
-  let user, token;
-  try {
-    const {
-      body: {
-        email,
-        publicKey,
-        salt,
-        lastName,
-        verifier,
-        firstName,
-        protectedKey,
-        protectedKeyIV,
-        protectedKeyTag,
-        organizationName,
-        providerAuthToken,
-        attributionSource,
-        encryptedPrivateKey,
-        encryptedPrivateKeyIV,
-        encryptedPrivateKeyTag
-      }
-    } = await validateRequest(reqValidator.CompletedAccountSignupV3, req);
-
-    user = await User.findOne({ email });
-
-    if (!user || (user && user?.publicKey)) {
-      // case 1: user doesn't exist.
-      // case 2: user has already completed account
-      return res.status(403).send({
-        error: "Failed to complete account for complete user"
-      });
-    }
-
-    if (providerAuthToken) {
-      await validateProviderAuthToken({
-        email,
-        providerAuthToken
-      });
-    } else {
-      const [AUTH_TOKEN_TYPE, AUTH_TOKEN_VALUE] = <[string, string]>(
-        req.headers["authorization"]?.split(" ", 2)
-      ) ?? [null, null];
-      if (AUTH_TOKEN_TYPE === null) {
-        throw BadRequestError({ message: "Missing Authorization Header in the request header." });
-      }
-      if (AUTH_TOKEN_TYPE.toLowerCase() !== "bearer") {
-        throw BadRequestError({
-          message: `The provided authentication type '${AUTH_TOKEN_TYPE}' is not supported.`
-        });
-      }
-      if (AUTH_TOKEN_VALUE === null) {
-        throw BadRequestError({
-          message: "Missing Authorization Body in the request header"
-        });
-      }
-
-      const decodedToken = <jwt.UserIDJwtPayload>(
-        jwt.verify(AUTH_TOKEN_VALUE, await getJwtSignupSecret())
-      );
-
-      if (decodedToken.userId !== user.id) {
-        throw BadRequestError();
-      }
-    }
-
-    // complete setting up user's account
-    user = await completeAccount({
-      userId: user._id.toString(),
-      firstName,
-      lastName,
-      encryptionVersion: 2,
-      protectedKey,
-      protectedKeyIV,
-      protectedKeyTag,
-      publicKey,
-      encryptedPrivateKey,
-      encryptedPrivateKeyIV,
-      encryptedPrivateKeyTag,
-      salt,
-      verifier
-    });
-
-    if (!user) throw new Error("Failed to complete account for non-existent user"); // ensure user is non-null
-
-    const hasSamlEnabled = user.authMethods.some((authMethod: AuthMethod) =>
-      [AuthMethod.OKTA_SAML, AuthMethod.AZURE_SAML, AuthMethod.JUMPCLOUD_SAML].includes(authMethod)
-    );
-
-    if (!hasSamlEnabled) {
-      // TODO: modify this part
-      // initialize default organization and workspace
-      await initializeDefaultOrg({
-        organizationName,
-        user
-      });
-    }
-
-    // update organization membership statuses that are
-    // invited to completed with user attached
-    await MembershipOrg.updateMany(
-      {
-        inviteEmail: email,
-        status: INVITED
-      },
-      {
-        user,
-        status: ACCEPTED
-      }
-    );
-
-    // issue tokens
-    const tokens = await issueAuthTokens({
-      userId: user._id,
-      ip: req.realIP,
-      userAgent: req.headers["user-agent"] ?? ""
-    });
-
-    token = tokens.token;
-
-    // sending a welcome email to new users
-    if (await getLoopsApiKey()) {
-      await standardRequest.post(
-        "https://app.loops.so/api/v1/events/send",
-        {
-          email: email,
-          eventName: "Sign Up",
-          firstName: firstName,
-          lastName: lastName
-        },
-        {
-          headers: {
-            Accept: "application/json",
-            Authorization: "Bearer " + (await getLoopsApiKey())
-          }
-        }
-      );
-    }
-
-    // store (refresh) token in httpOnly cookie
-    res.cookie("jid", tokens.refreshToken, {
-      httpOnly: true,
-      path: "/",
-      sameSite: "strict",
-      secure: await getHttpsEnabled()
-    });
-
-    const postHogClient = await TelemetryService.getPostHogClient();
-    if (postHogClient) {
-      postHogClient.capture({
-        event: "User Signed Up",
-        distinctId: email,
-        properties: {
-          email,
-          ...(attributionSource ? { attributionSource } : {})
-        }
-      });
-    }
-  } catch (err) {
-    Sentry.setUser(null);
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: "Failed to complete account setup"
-    });
-  }
-
-  return res.status(200).send({
-    message: "Successfully set up account",
-    user,
-    token
-  });
-};

backend/src/controllers/v3/workspacesController.ts

@@ -1,117 +0,0 @@
-import { Request, Response } from "express";
-import { Types } from "mongoose";
-import { validateRequest } from "../../helpers/validation";
-import { Secret, ServiceTokenDataV3 } from "../../models";
-import { SecretService } from "../../services";
-import { getUserProjectPermissions } from "../../ee/services/ProjectRoleService";
-import { UnauthorizedRequestError } from "../../utils/errors";
-import * as reqValidator from "../../validation/workspace";
-
-/**
- * Return whether or not all secrets in workspace with id [workspaceId]
- * are blind-indexed
- * @param req
- * @param res
- * @returns
- */
-export const getWorkspaceBlindIndexStatus = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId }
-  } = await validateRequest(reqValidator.GetWorkspaceBlinkIndexStatusV3, req);
-
-  const { membership } = await getUserProjectPermissions(req.user._id, workspaceId);
-  if (membership.role !== "admin")
-    throw UnauthorizedRequestError({ message: "User must be an admin" });
-
-  const secretsWithoutBlindIndex = await Secret.countDocuments({
-    workspace: new Types.ObjectId(workspaceId),
-    secretBlindIndex: {
-      $exists: false
-    }
-  });
-
-  return res.status(200).send(secretsWithoutBlindIndex === 0);
-};
-
-/**
- * Get all secrets for workspace with id [workspaceId]
- */
-export const getWorkspaceSecrets = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId }
-  } = await validateRequest(reqValidator.GetWorkspaceSecretsV3, req);
-
-  const { membership } = await getUserProjectPermissions(req.user._id, workspaceId);
-  if (membership.role !== "admin")
-    throw UnauthorizedRequestError({ message: "User must be an admin" });
-
-  const secrets = await Secret.find({
-    workspace: new Types.ObjectId(workspaceId)
-  });
-
-  return res.status(200).send({
-    secrets
-  });
-};
-
-/**
- * Update blind indices for secrets in workspace with id [workspaceId]
- * @param req
- * @param res
- */
-export const nameWorkspaceSecrets = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId },
-    body: { secretsToUpdate }
-  } = await validateRequest(reqValidator.NameWorkspaceSecretsV3, req);
-
-  const { membership } = await getUserProjectPermissions(req.user._id, workspaceId);
-  if (membership.role !== "admin")
-    throw UnauthorizedRequestError({ message: "User must be an admin" });
-
-  // get secret blind index salt
-  const salt = await SecretService.getSecretBlindIndexSalt({
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
-  // update secret blind indices
-  const operations = await Promise.all(
-    secretsToUpdate.map(async (secretToUpdate) => {
-      const secretBlindIndex = await SecretService.generateSecretBlindIndexWithSalt({
-        secretName: secretToUpdate.secretName,
-        salt
-      });
-
-      return {
-        updateOne: {
-          filter: {
-            _id: new Types.ObjectId(secretToUpdate._id)
-          },
-          update: {
-            secretBlindIndex
-          }
-        }
-      };
-    })
-  );
-
-  await Secret.bulkWrite(operations);
-
-  return res.status(200).send({
-    message: "Successfully named workspace secrets"
-  });
-};
-
-export const getWorkspaceServiceTokenData = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId }
-  } = await validateRequest(reqValidator.GetWorkspaceServiceTokenDataV3, req);
-  
-  const serviceTokenData = await ServiceTokenDataV3.find({
-    workspace: new Types.ObjectId(workspaceId)
-  });
-  
-  return res.status(200).send({
-    serviceTokenData
-  });
-}

backend/src/ee/controllers/v1/actionController.ts

@@ -1,32 +1,31 @@
-import { Request, Response } from "express";
-import { Action } from "../../models";
-import { ActionNotFoundError } from "../../../utils/errors";
-import { validateRequest } from "../../../helpers/validation";
-import * as reqValidator from "../../../validation/action";
+import { Request, Response } from 'express';
+import * as Sentry from '@sentry/node';
+import { Action, SecretVersion } from '../../models';
+import { ActionNotFoundError } from '../../../utils/errors';
 
 export const getAction = async (req: Request, res: Response) => {
-  let action;
-  try {
-    const {
-      params: { actionId }
-    } = await validateRequest(reqValidator.GetActionV1, req);
+    let action;
+    try {
+        const { actionId } = req.params;
+        
+        action = await Action
+            .findById(actionId)
+            .populate([
+                'payload.secretVersions.oldSecretVersion',
+                'payload.secretVersions.newSecretVersion'
+            ]);
+        
+        if (!action) throw ActionNotFoundError({
+            message: 'Failed to find action'
+        });
 
-    action = await Action.findById(actionId).populate([
-      "payload.secretVersions.oldSecretVersion",
-      "payload.secretVersions.newSecretVersion"
-    ]);
-
-    if (!action)
-      throw ActionNotFoundError({
-        message: "Failed to find action"
-      });
-  } catch (err) {
-    throw ActionNotFoundError({
-      message: "Failed to find action"
+    } catch (err) {
+        throw ActionNotFoundError({
+            message: 'Failed to find action'
+        });
+    }
+    
+    return res.status(200).send({
+        action
     });
-  }
-
-  return res.status(200).send({
-    action
-  });
-};
+}

backend/src/ee/controllers/v1/cloudProductsController.ts

@@ -1,32 +0,0 @@
-import { Request, Response } from "express";
-import { EELicenseService } from "../../services";
-import { getLicenseServerUrl } from "../../../config";
-import { licenseServerKeyRequest } from "../../../config/request";
-import { validateRequest } from "../../../helpers/validation";
-import * as reqValidator from "../../../validation/cloudProducts";
-
-/**
- * Return available cloud product information.
- * Note: Nicely formatted to easily construct a table from
- * @param req
- * @param res
- * @returns
- */
-export const getCloudProducts = async (req: Request, res: Response) => {
-  const {
-    query: { "billing-cycle": billingCycle }
-  } = await validateRequest(reqValidator.GetCloudProductsV1, req);
-
-  if (EELicenseService.instanceType === "cloud") {
-    const { data } = await licenseServerKeyRequest.get(
-      `${await getLicenseServerUrl()}/api/license-server/v1/cloud-products?billing-cycle=${billingCycle}`
-    );
-
-    return res.status(200).send(data);
-  }
-
-  return res.status(200).send({
-    head: [],
-    rows: []
-  });
-};

backend/src/ee/controllers/v1/index.ts

@@ -1,27 +1,15 @@
-import * as secretController from "./secretController";
-import * as secretSnapshotController from "./secretSnapshotController";
-import * as organizationsController from "./organizationsController";
-import * as ssoController from "./ssoController";
-import * as usersController from "./usersController";
-import * as workspaceController from "./workspaceController";
-import * as actionController from "./actionController";
-import * as membershipController from "./membershipController";
-import * as cloudProductsController from "./cloudProductsController";
-import * as roleController from "./roleController";
-import * as secretApprovalPolicyController from "./secretApprovalPolicyController";
-import * as secretApprovalRequestController from "./secretApprovalRequestsController";
+import * as stripeController from './stripeController';
+import * as secretController from './secretController';
+import * as secretSnapshotController from './secretSnapshotController';
+import * as workspaceController from './workspaceController';
+import * as actionController from './actionController';
+import * as membershipController from './membershipController';
 
 export {
-  secretController,
-  secretSnapshotController,
-  organizationsController,
-  ssoController,
-  usersController,
-  workspaceController,
-  actionController,
-  membershipController,
-  cloudProductsController,
-  roleController,
-  secretApprovalPolicyController,
-  secretApprovalRequestController
-};
+    stripeController,
+    secretController,
+    secretSnapshotController,
+    workspaceController,
+    actionController,
+    membershipController
+}

backend/src/ee/controllers/v1/membershipController.ts

@@ -1,25 +1,23 @@
 import { Request, Response } from "express";
-import { IUser, Membership, Workspace } from "../../../models";
-import { EventType } from "../../../ee/models";
+import { Membership, Workspace } from "../../../models";
 import { IMembershipPermission } from "../../../models/membership";
 import { BadRequestError, UnauthorizedRequestError } from "../../../utils/errors";
-import { ADMIN, MEMBER } from "../../../variables/organization";
-import { PERMISSION_READ_SECRETS, PERMISSION_WRITE_SECRETS } from "../../../variables";
+import { ABILITY_READ, ABILITY_WRITE, ADMIN, MEMBER } from "../../../variables/organization";
+import { Builder } from "builder-pattern"
 import _ from "lodash";
-import { EEAuditLogService } from "../../services";
 
 export const denyMembershipPermissions = async (req: Request, res: Response) => {
   const { membershipId } = req.params;
   const { permissions } = req.body;
   const sanitizedMembershipPermissions: IMembershipPermission[] = permissions.map((permission: IMembershipPermission) => {
-    if (!permission.ability || !permission.environmentSlug || ![PERMISSION_READ_SECRETS, PERMISSION_WRITE_SECRETS].includes(permission.ability)) {
+    if (!permission.ability || !permission.environmentSlug || ![ABILITY_READ, ABILITY_WRITE].includes(permission.ability)) {
       throw BadRequestError({ message: "One or more required fields are missing from the request or have incorrect type" })
     }
 
-    return {
-      environmentSlug: permission.environmentSlug,
-      ability: permission.ability
-    }
+    return Builder<IMembershipPermission>()
+      .environmentSlug(permission.environmentSlug)
+      .ability(permission.ability)
+      .build();
   })
 
   const sanitizedMembershipPermissionsUnique = _.uniqWith(sanitizedMembershipPermissions, _.isEqual)
@@ -40,7 +38,7 @@ export const denyMembershipPermissions = async (req: Request, res: Response) =>
     throw BadRequestError({ message: "Something went wrong when locating the related workspace" })
   }
 
-  const uniqueEnvironmentSlugs = new Set(_.uniq(_.map(relatedWorkspace.environments, "slug")));
+  const uniqueEnvironmentSlugs = new Set(_.uniq(_.map(relatedWorkspace.environments, 'slug')));
 
   sanitizedMembershipPermissionsUnique.forEach(permission => {
     if (!uniqueEnvironmentSlugs.has(permission.environmentSlug)) {
@@ -53,34 +51,13 @@ export const denyMembershipPermissions = async (req: Request, res: Response) =>
     { _id: membershipToModify._id },
     { $set: { deniedPermissions: sanitizedMembershipPermissionsUnique } },
     { new: true }
-  ).populate<{ user: IUser }>("user");
+  )
 
   if (!updatedMembershipWithPermissions) {
     throw BadRequestError({ message: "The resource has been removed before it can be modified" })
   }
 
-  await EEAuditLogService.createAuditLog(
-    req.authData,
-    {
-      type: EventType.UPDATE_USER_WORKSPACE_DENIED_PERMISSIONS,
-      metadata: {
-        userId: updatedMembershipWithPermissions.user._id.toString(),
-        email: updatedMembershipWithPermissions.user.email,
-        deniedPermissions: updatedMembershipWithPermissions.deniedPermissions.map(({
-          environmentSlug,
-          ability
-        }) => ({
-          environmentSlug,
-          ability
-        }))
-      }
-    },
-    {
-      workspaceId: updatedMembershipWithPermissions.workspace
-    }
-  );
-
   res.send({
-    permissionsDenied: updatedMembershipWithPermissions.deniedPermissions,
+    permissionsDenied: updatedMembershipWithPermissions.deniedPermissions
   })
 }

backend/src/ee/controllers/v1/organizationsController.ts

@@ -1,505 +0,0 @@
-import { Types } from "mongoose";
-import { Request, Response } from "express";
-import { getLicenseServerUrl } from "../../../config";
-import { licenseServerKeyRequest } from "../../../config/request";
-import { EELicenseService } from "../../services";
-import { validateRequest } from "../../../helpers/validation";
-import * as reqValidator from "../../../validation/organization";
-import {
-  OrgPermissionActions,
-  OrgPermissionSubjects,
-  getUserOrgPermissions
-} from "../../services/RoleService";
-import { ForbiddenError } from "@casl/ability";
-import { Organization } from "../../../models";
-import { OrganizationNotFoundError } from "../../../utils/errors";
-
-export const getOrganizationPlansTable = async (req: Request, res: Response) => {
-  const {
-    query: { billingCycle },
-    params: { organizationId }
-  } = await validateRequest(reqValidator.GetOrgPlansTablev1, req);
-
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Read,
-    OrgPermissionSubjects.Billing
-  );
-
-  const { data } = await licenseServerKeyRequest.get(
-    `${await getLicenseServerUrl()}/api/license-server/v1/cloud-products?billing-cycle=${billingCycle}`
-  );
-
-  return res.status(200).send(data);
-};
-
-/**
- * Return the organization current plan's feature set
- */
-export const getOrganizationPlan = async (req: Request, res: Response) => {
-  const {
-    query: { workspaceId },
-    params: { organizationId }
-  } = await validateRequest(reqValidator.GetOrgPlanv1, req);
-
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Read,
-    OrgPermissionSubjects.Billing
-  );
-
-  const plan = await EELicenseService.getPlan(
-    new Types.ObjectId(organizationId),
-    new Types.ObjectId(workspaceId)
-  );
-
-  return res.status(200).send({
-    plan
-  });
-};
-
-/**
- * Return checkout url for pro trial
- * @param req
- * @param res
- * @returns
- */
-export const startOrganizationTrial = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId },
-    body: { success_url }
-  } = await validateRequest(reqValidator.StartOrgTrailv1, req);
-
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Create,
-    OrgPermissionSubjects.Billing
-  );
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Edit,
-    OrgPermissionSubjects.Billing
-  );
-
-  const organization = await Organization.findById(organizationId);
-  if (!organization) {
-    throw OrganizationNotFoundError({
-      message: "Failed to find organization"
-    });
-  }
-
-  const {
-    data: { url }
-  } = await licenseServerKeyRequest.post(
-    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
-      organization.customerId
-    }/session/trial`,
-    {
-      success_url
-    }
-  );
-
-  EELicenseService.delPlan(new Types.ObjectId(organizationId));
-
-  return res.status(200).send({
-    url
-  });
-};
-
-/**
- * Return the organization's current plan's billing info
- * @param req
- * @param res
- * @returns
- */
-export const getOrganizationPlanBillingInfo = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId }
-  } = await validateRequest(reqValidator.GetOrgPlanBillingInfov1, req);
-
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Read,
-    OrgPermissionSubjects.Billing
-  );
-
-  const organization = await Organization.findById(organizationId);
-  if (!organization) {
-    throw OrganizationNotFoundError({
-      message: "Failed to find organization"
-    });
-  }
-
-  const { data } = await licenseServerKeyRequest.get(
-    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
-      organization.customerId
-    }/cloud-plan/billing`
-  );
-
-  return res.status(200).send(data);
-};
-
-/**
- * Return the organization's current plan's feature table
- * @param req
- * @param res
- * @returns
- */
-export const getOrganizationPlanTable = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId }
-  } = await validateRequest(reqValidator.GetOrgPlanTablev1, req);
-
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Read,
-    OrgPermissionSubjects.Billing
-  );
-
-  const organization = await Organization.findById(organizationId);
-  if (!organization) {
-    throw OrganizationNotFoundError({
-      message: "Failed to find organization"
-    });
-  }
-
-  const { data } = await licenseServerKeyRequest.get(
-    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
-      organization.customerId
-    }/cloud-plan/table`
-  );
-
-  return res.status(200).send(data);
-};
-
-export const getOrganizationBillingDetails = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId }
-  } = await validateRequest(reqValidator.GetOrgBillingDetailsv1, req);
-
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Read,
-    OrgPermissionSubjects.Billing
-  );
-
-  const organization = await Organization.findById(organizationId);
-  if (!organization) {
-    throw OrganizationNotFoundError({
-      message: "Failed to find organization"
-    });
-  }
-
-  const { data } = await licenseServerKeyRequest.get(
-    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
-      organization.customerId
-    }/billing-details`
-  );
-
-  return res.status(200).send(data);
-};
-
-export const updateOrganizationBillingDetails = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId },
-    body: { name, email }
-  } = await validateRequest(reqValidator.UpdateOrgBillingDetailsv1, req);
-
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Edit,
-    OrgPermissionSubjects.Billing
-  );
-
-  const organization = await Organization.findById(organizationId);
-  if (!organization) {
-    throw OrganizationNotFoundError({
-      message: "Failed to find organization"
-    });
-  }
-
-  const { data } = await licenseServerKeyRequest.patch(
-    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
-      organization.customerId
-    }/billing-details`,
-    {
-      ...(name ? { name } : {}),
-      ...(email ? { email } : {})
-    }
-  );
-
-  return res.status(200).send(data);
-};
-
-/**
- * Return the organization's payment methods on file
- */
-export const getOrganizationPmtMethods = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId }
-  } = await validateRequest(reqValidator.GetOrgPmtMethodsv1, req);
-
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Read,
-    OrgPermissionSubjects.Billing
-  );
-
-  const organization = await Organization.findById(organizationId);
-  if (!organization) {
-    throw OrganizationNotFoundError({
-      message: "Failed to find organization"
-    });
-  }
-
-  const {
-    data: { pmtMethods }
-  } = await licenseServerKeyRequest.get(
-    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
-      organization.customerId
-    }/billing-details/payment-methods`
-  );
-
-  return res.status(200).send(pmtMethods);
-};
-
-/**
- * Return URL to add payment method for organization
- */
-export const addOrganizationPmtMethod = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId },
-    body: { success_url, cancel_url }
-  } = await validateRequest(reqValidator.CreateOrgPmtMethodv1, req);
-
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Create,
-    OrgPermissionSubjects.Billing
-  );
-
-  const organization = await Organization.findById(organizationId);
-  if (!organization) {
-    throw OrganizationNotFoundError({
-      message: "Failed to find organization"
-    });
-  }
-
-  const {
-    data: { url }
-  } = await licenseServerKeyRequest.post(
-    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
-      organization.customerId
-    }/billing-details/payment-methods`,
-    {
-      success_url,
-      cancel_url
-    }
-  );
-
-  return res.status(200).send({
-    url
-  });
-};
-
-/**
- * Delete payment method with id [pmtMethodId] for organization
- * @param req
- * @param res
- * @returns
- */
-export const deleteOrganizationPmtMethod = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId, pmtMethodId }
-  } = await validateRequest(reqValidator.DelOrgPmtMethodv1, req);
-
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Delete,
-    OrgPermissionSubjects.Billing
-  );
-
-  const organization = await Organization.findById(organizationId);
-  if (!organization) {
-    throw OrganizationNotFoundError({
-      message: "Failed to find organization"
-    });
-  }
-
-  const { data } = await licenseServerKeyRequest.delete(
-    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
-      organization.customerId
-    }/billing-details/payment-methods/${pmtMethodId}`
-  );
-
-  return res.status(200).send(data);
-};
-
-/**
- * Return the organization's tax ids on file
- */
-export const getOrganizationTaxIds = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId }
-  } = await validateRequest(reqValidator.GetOrgTaxIdsv1, req);
-
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Read,
-    OrgPermissionSubjects.Billing
-  );
-
-  const organization = await Organization.findById(organizationId);
-  if (!organization) {
-    throw OrganizationNotFoundError({
-      message: "Failed to find organization"
-    });
-  }
-
-  const {
-    data: { tax_ids }
-  } = await licenseServerKeyRequest.get(
-    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
-      organization.customerId
-    }/billing-details/tax-ids`
-  );
-
-  return res.status(200).send(tax_ids);
-};
-
-/**
- * Add tax id to organization
- */
-export const addOrganizationTaxId = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId },
-    body: { type, value }
-  } = await validateRequest(reqValidator.CreateOrgTaxId, req);
-
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Create,
-    OrgPermissionSubjects.Billing
-  );
-
-  const organization = await Organization.findById(organizationId);
-  if (!organization) {
-    throw OrganizationNotFoundError({
-      message: "Failed to find organization"
-    });
-  }
-
-  const { data } = await licenseServerKeyRequest.post(
-    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
-      organization.customerId
-    }/billing-details/tax-ids`,
-    {
-      type,
-      value
-    }
-  );
-
-  return res.status(200).send(data);
-};
-
-/**
- * Delete tax id with id [taxId] from organization tax ids on file
- * @param req
- * @param res
- * @returns
- */
-export const deleteOrganizationTaxId = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId, taxId }
-  } = await validateRequest(reqValidator.DelOrgTaxIdv1, req);
-
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Delete,
-    OrgPermissionSubjects.Billing
-  );
-
-  const organization = await Organization.findById(organizationId);
-  if (!organization) {
-    throw OrganizationNotFoundError({
-      message: "Failed to find organization"
-    });
-  }
-
-  const { data } = await licenseServerKeyRequest.delete(
-    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
-      organization.customerId
-    }/billing-details/tax-ids/${taxId}`
-  );
-
-  return res.status(200).send(data);
-};
-
-/**
- * Return organization's invoices on file
- * @param req
- * @param res
- * @returns
- */
-export const getOrganizationInvoices = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId }
-  } = await validateRequest(reqValidator.GetOrgInvoicesv1, req);
-
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Read,
-    OrgPermissionSubjects.Billing
-  );
-
-  const organization = await Organization.findById(organizationId);
-  if (!organization) {
-    throw OrganizationNotFoundError({
-      message: "Failed to find organization"
-    });
-  }
-
-  const {
-    data: { invoices }
-  } = await licenseServerKeyRequest.get(
-    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
-      organization.customerId
-    }/invoices`
-  );
-
-  return res.status(200).send(invoices);
-};
-
-/**
- * Return organization's licenses on file
- * @param req
- * @param res
- * @returns
- */
-export const getOrganizationLicenses = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId }
-  } = await validateRequest(reqValidator.GetOrgLicencesv1, req);
-
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Read,
-    OrgPermissionSubjects.Billing
-  );
-
-  const organization = await Organization.findById(organizationId);
-  if (!organization) {
-    throw OrganizationNotFoundError({
-      message: "Failed to find organization"
-    });
-  }
-
-  const {
-    data: { licenses }
-  } = await licenseServerKeyRequest.get(
-    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
-      organization.customerId
-    }/licenses`
-  );
-
-  return res.status(200).send(licenses);
-};

backend/src/ee/controllers/v1/roleController.ts

@@ -1,236 +0,0 @@
-import { Request, Response } from "express";
-import {
-  CreateRoleSchema,
-  DeleteRoleSchema,
-  GetRoleSchema,
-  GetUserPermission,
-  GetUserProjectPermission,
-  UpdateRoleSchema
-} from "../../validation/role";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSub,
-  adminProjectPermissions,
-  getUserProjectPermissions,
-  memberProjectPermissions,
-  viewerProjectPermission
-} from "../../services/ProjectRoleService";
-import {
-  OrgPermissionActions,
-  OrgPermissionSubjects,
-  adminPermissions,
-  getUserOrgPermissions,
-  memberPermissions
-} from "../../services/RoleService";
-import { BadRequestError } from "../../../utils/errors";
-import { Role } from "../../models";
-import { validateRequest } from "../../../helpers/validation";
-import { packRules } from "@casl/ability/extra";
-
-export const createRole = async (req: Request, res: Response) => {
-  const {
-    body: { workspaceId, name, description, slug, permissions, orgId }
-  } = await validateRequest(CreateRoleSchema, req);
-
-  const isOrgRole = !workspaceId; // if workspaceid is provided then its a workspace rule
-  if (isOrgRole) {
-    const { permission } = await getUserOrgPermissions(req.user.id, orgId);
-    if (permission.cannot(OrgPermissionActions.Create, OrgPermissionSubjects.Role)) {
-      throw BadRequestError({ message: "user doesn't have the permission." });
-    }
-  } else {
-    const { permission } = await getUserProjectPermissions(req.user.id, workspaceId);
-    if (permission.cannot(ProjectPermissionActions.Create, ProjectPermissionSub.Role)) {
-      throw BadRequestError({ message: "User doesn't have the permission." });
-    }
-  }
-
-  const existingRole = await Role.findOne({ organization: orgId, workspace: workspaceId, slug });
-  if (existingRole) {
-    throw BadRequestError({ message: "Role already exist" });
-  }
-
-  const role = new Role({
-    organization: orgId,
-    workspace: workspaceId,
-    isOrgRole,
-    name,
-    slug,
-    permissions,
-    description
-  });
-  await role.save();
-
-  res.status(200).json({
-    message: "Successfully created role",
-    data: {
-      role
-    }
-  });
-};
-
-export const updateRole = async (req: Request, res: Response) => {
-  const {
-    params: { id },
-    body: { name, description, slug, permissions, workspaceId, orgId }
-  } = await validateRequest(UpdateRoleSchema, req);
-  const isOrgRole = !workspaceId; // if workspaceid is provided then its a workspace rule
-
-  if (isOrgRole) {
-    const { permission } = await getUserOrgPermissions(req.user.id, orgId);
-    if (permission.cannot(OrgPermissionActions.Edit, OrgPermissionSubjects.Role)) {
-      throw BadRequestError({ message: "User doesn't have the org permission." });
-    }
-  } else {
-    const { permission } = await getUserProjectPermissions(req.user.id, workspaceId);
-    if (permission.cannot(ProjectPermissionActions.Edit, ProjectPermissionSub.Role)) {
-      throw BadRequestError({ message: "User doesn't have the workspace permission." });
-    }
-  }
-
-  if (slug) {
-    const existingRole = await Role.findOne({
-      organization: orgId,
-      slug,
-      isOrgRole,
-      workspace: workspaceId
-    });
-    if (existingRole && existingRole.id !== id) {
-      throw BadRequestError({ message: "Role already exist" });
-    }
-  }
-
-  const role = await Role.findByIdAndUpdate(
-    id,
-    { name, description, slug, permissions },
-    { returnDocument: "after" }
-  );
-
-  if (!role) {
-    throw BadRequestError({ message: "Role not found" });
-  }
-  res.status(200).json({
-    message: "Successfully updated role",
-    data: {
-      role
-    }
-  });
-};
-
-export const deleteRole = async (req: Request, res: Response) => {
-  const {
-    params: { id }
-  } = await validateRequest(DeleteRoleSchema, req);
-
-  const role = await Role.findById(id);
-  if (!role) {
-    throw BadRequestError({ message: "Role not found" });
-  }
-
-  const isOrgRole = !role.workspace;
-  if (isOrgRole) {
-    const { permission } = await getUserOrgPermissions(req.user.id, role.organization.toString());
-    if (permission.cannot(OrgPermissionActions.Delete, OrgPermissionSubjects.Role)) {
-      throw BadRequestError({ message: "User doesn't have the org permission." });
-    }
-  } else {
-    const { permission } = await getUserProjectPermissions(req.user.id, role.workspace.toString());
-    if (permission.cannot(ProjectPermissionActions.Delete, ProjectPermissionSub.Role)) {
-      throw BadRequestError({ message: "User doesn't have the workspace permission." });
-    }
-  }
-
-  await Role.findByIdAndDelete(role.id);
-
-  res.status(200).json({
-    message: "Successfully deleted role",
-    data: {
-      role
-    }
-  });
-};
-
-export const getRoles = async (req: Request, res: Response) => {
-  const {
-    query: { workspaceId, orgId }
-  } = await validateRequest(GetRoleSchema, req);
-
-  const isOrgRole = !workspaceId;
-  if (isOrgRole) {
-    const { permission } = await getUserOrgPermissions(req.user.id, orgId);
-    if (permission.cannot(OrgPermissionActions.Read, OrgPermissionSubjects.Role)) {
-      throw BadRequestError({ message: "User doesn't have the org permission." });
-    }
-  } else {
-    const { permission } = await getUserProjectPermissions(req.user.id, workspaceId);
-    if (permission.cannot(ProjectPermissionActions.Read, ProjectPermissionSub.Role)) {
-      throw BadRequestError({ message: "User doesn't have the workspace permission." });
-    }
-  }
-
-  const customRoles = await Role.find({ organization: orgId, isOrgRole, workspace: workspaceId });
-  // as this is shared between org and workspace switch the rule set based on it
-  const roles = [
-    {
-      _id: "admin",
-      name: "Admin",
-      slug: "admin",
-      description: "Complete administration access over the organization",
-      permissions: isOrgRole ? adminPermissions.rules : adminProjectPermissions.rules
-    },
-    {
-      _id: "member",
-      name: isOrgRole ? "Member" : "Developer",
-      slug: "member",
-      description: "Non-administrative role in an organization",
-      permissions: isOrgRole ? memberPermissions.rules : memberProjectPermissions.rules
-    },
-    // viewer role only for project level
-    ...(isOrgRole
-      ? []
-      : [
-          {
-            _id: "viewer",
-            name: "Viewer",
-            slug: "viewer",
-            description: "Non-administrative role in an organization",
-            permissions: viewerProjectPermission.rules
-          }
-        ]),
-    ...customRoles
-  ];
-
-  res.status(200).json({
-    message: "Successfully fetched role list",
-    data: {
-      roles
-    }
-  });
-};
-
-export const getUserPermissions = async (req: Request, res: Response) => {
-  const {
-    params: { orgId }
-  } = await validateRequest(GetUserPermission, req);
-  
-  const { permission } = await getUserOrgPermissions(req.user._id, orgId);
-
-  res.status(200).json({
-    data: {
-      permissions: packRules(permission.rules)
-    }
-  });
-};
-
-export const getUserWorkspacePermissions = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId }
-  } = await validateRequest(GetUserProjectPermission, req);
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-
-  res.status(200).json({
-    data: {
-      permissions: packRules(permission.rules)
-    }
-  });
-};

backend/src/ee/controllers/v1/secretApprovalPolicyController.ts

@@ -1,128 +0,0 @@
-import { ForbiddenError, subject } from "@casl/ability";
-import { Request, Response } from "express";
-import { nanoid } from "nanoid";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSub,
-  getUserProjectPermissions
-} from "../../services/ProjectRoleService";
-import { validateRequest } from "../../../helpers/validation";
-import { SecretApprovalPolicy } from "../../models/secretApprovalPolicy";
-import { getSecretPolicyOfBoard } from "../../services/SecretApprovalService";
-import { BadRequestError } from "../../../utils/errors";
-import * as reqValidator from "../../validation/secretApproval";
-
-const ERR_SECRET_APPROVAL_NOT_FOUND = BadRequestError({ message: "secret approval not found" });
-
-export const createSecretApprovalPolicy = async (req: Request, res: Response) => {
-  const {
-    body: { approvals, secretPath, approvers, environment, workspaceId, name }
-  } = await validateRequest(reqValidator.CreateSecretApprovalRule, req);
-
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Create,
-    ProjectPermissionSub.SecretApproval
-  );
-
-  const secretApproval = new SecretApprovalPolicy({
-    workspace: workspaceId,
-    name: name ?? `${environment}-${nanoid(3)}`,
-    secretPath,
-    environment,
-    approvals,
-    approvers
-  });
-  await secretApproval.save();
-
-  return res.send({
-    approval: secretApproval
-  });
-};
-
-export const updateSecretApprovalPolicy = async (req: Request, res: Response) => {
-  const {
-    body: { approvals, approvers, secretPath, name },
-    params: { id }
-  } = await validateRequest(reqValidator.UpdateSecretApprovalRule, req);
-
-  const secretApproval = await SecretApprovalPolicy.findById(id);
-  if (!secretApproval) throw ERR_SECRET_APPROVAL_NOT_FOUND;
-
-  const { permission } = await getUserProjectPermissions(
-    req.user._id,
-    secretApproval.workspace.toString()
-  );
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Edit,
-    ProjectPermissionSub.SecretApproval
-  );
-
-  const updatedDoc = await SecretApprovalPolicy.findByIdAndUpdate(id, {
-    approvals,
-    approvers,
-    name: (name || secretApproval?.name) ?? `${secretApproval.environment}-${nanoid(3)}`,
-    ...(secretPath === null ? { $unset: { secretPath: 1 } } : { secretPath })
-  });
-
-  return res.send({
-    approval: updatedDoc
-  });
-};
-
-export const deleteSecretApprovalPolicy = async (req: Request, res: Response) => {
-  const {
-    params: { id }
-  } = await validateRequest(reqValidator.DeleteSecretApprovalRule, req);
-
-  const secretApproval = await SecretApprovalPolicy.findById(id);
-  if (!secretApproval) throw ERR_SECRET_APPROVAL_NOT_FOUND;
-
-  const { permission } = await getUserProjectPermissions(
-    req.user._id,
-    secretApproval.workspace.toString()
-  );
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Delete,
-    ProjectPermissionSub.SecretApproval
-  );
-
-  const deletedDoc = await SecretApprovalPolicy.findByIdAndDelete(id);
-
-  return res.send({
-    approval: deletedDoc
-  });
-};
-
-export const getSecretApprovalPolicy = async (req: Request, res: Response) => {
-  const {
-    query: { workspaceId }
-  } = await validateRequest(reqValidator.GetSecretApprovalRuleList, req);
-
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Read,
-    ProjectPermissionSub.SecretApproval
-  );
-
-  const doc = await SecretApprovalPolicy.find({ workspace: workspaceId });
-
-  return res.send({
-    approvals: doc
-  });
-};
-
-export const getSecretApprovalPolicyOfBoard = async (req: Request, res: Response) => {
-  const {
-    query: { workspaceId, environment, secretPath }
-  } = await validateRequest(reqValidator.GetSecretApprovalPolicyOfABoard, req);
-
-  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Read,
-    subject(ProjectPermissionSub.Secrets, { secretPath, environment })
-  );
-
-  const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
-  return res.send({ policy: secretApprovalPolicy });
-};

backend/src/ee/controllers/v1/secretApprovalRequestsController.ts

@@ -1,333 +0,0 @@
-import { Request, Response } from "express";
-import { getUserProjectPermissions } from "../../services/ProjectRoleService";
-import { validateRequest } from "../../../helpers/validation";
-import { Folder } from "../../../models";
-import { ApprovalStatus, SecretApprovalRequest } from "../../models/secretApprovalRequest";
-import * as reqValidator from "../../validation/secretApprovalRequest";
-import { getFolderWithPathFromId } from "../../../services/FolderService";
-import { BadRequestError, UnauthorizedRequestError } from "../../../utils/errors";
-import { ISecretApprovalPolicy, SecretApprovalPolicy } from "../../models/secretApprovalPolicy";
-import { performSecretApprovalRequestMerge } from "../../services/SecretApprovalService";
-import { Types } from "mongoose";
-import { EEAuditLogService } from "../../services";
-import { EventType } from "../../models";
-
-export const getSecretApprovalRequestCount = async (req: Request, res: Response) => {
-  const {
-    query: { workspaceId }
-  } = await validateRequest(reqValidator.getSecretApprovalRequestCount, req);
-
-  const { membership } = await getUserProjectPermissions(req.user._id, workspaceId);
-  const approvalRequestCount = await SecretApprovalRequest.aggregate([
-    {
-      $match: {
-        workspace: new Types.ObjectId(workspaceId)
-      }
-    },
-    {
-      $lookup: {
-        from: SecretApprovalPolicy.collection.name,
-        localField: "policy",
-        foreignField: "_id",
-        as: "policy"
-      }
-    },
-    { $unwind: "$policy" },
-    ...(membership.role !== "admin"
-      ? [
-          {
-            $match: {
-              $or: [
-                { committer: new Types.ObjectId(membership.id) },
-                { "policy.approvers": new Types.ObjectId(membership.id) }
-              ]
-            }
-          }
-        ]
-      : []),
-    {
-      $group: {
-        _id: "$status",
-        count: { $sum: 1 }
-      }
-    }
-  ]);
-  const openRequests = approvalRequestCount.find(({ _id }) => _id === "open");
-  const closedRequests = approvalRequestCount.find(({ _id }) => _id === "close");
-
-  return res.send({
-    approvals: { open: openRequests?.count || 0, closed: closedRequests?.count || 0 }
-  });
-};
-
-export const getSecretApprovalRequests = async (req: Request, res: Response) => {
-  const {
-    query: { status, committer, workspaceId, environment, limit, offset }
-  } = await validateRequest(reqValidator.getSecretApprovalRequests, req);
-
-  const { membership } = await getUserProjectPermissions(req.user._id, workspaceId);
-
-  const query = {
-    workspace: new Types.ObjectId(workspaceId),
-    environment,
-    committer: committer ? new Types.ObjectId(committer) : undefined,
-    status
-  };
-  // to strip of undefined in query we use es6 spread to ignore those fields
-  Object.entries(query).forEach(
-    ([key, value]) => value === undefined && delete query[key as keyof typeof query]
-  );
-  const approvalRequests = await SecretApprovalRequest.aggregate([
-    {
-      $match: query
-    },
-    { $sort: { createdAt: -1 } },
-    {
-      $lookup: {
-        from: SecretApprovalPolicy.collection.name,
-        localField: "policy",
-        foreignField: "_id",
-        as: "policy"
-      }
-    },
-    { $unwind: "$policy" },
-    ...(membership.role !== "admin"
-      ? [
-          {
-            $match: {
-              $or: [
-                { committer: new Types.ObjectId(membership.id) },
-                { "policy.approvers": new Types.ObjectId(membership.id) }
-              ]
-            }
-          }
-        ]
-      : []),
-    { $skip: offset },
-    { $limit: limit }
-  ]);
-  if (!approvalRequests.length) return res.send({ approvals: [] });
-
-  const unqiueEnvs = environment ?? {
-    $in: [...new Set(approvalRequests.map(({ environment }) => environment))]
-  };
-  const approvalRootFolders = await Folder.find({
-    workspace: workspaceId,
-    environment: unqiueEnvs
-  }).lean();
-
-  const formatedApprovals = approvalRequests.map((el) => {
-    let secretPath = "/";
-    const folders = approvalRootFolders.find(({ environment }) => environment === el.environment);
-    if (folders) {
-      secretPath = getFolderWithPathFromId(folders?.nodes, el.folderId)?.folderPath || "/";
-    }
-    return { ...el, secretPath };
-  });
-
-  return res.send({
-    approvals: formatedApprovals
-  });
-};
-
-export const getSecretApprovalRequestDetails = async (req: Request, res: Response) => {
-  const {
-    params: { id }
-  } = await validateRequest(reqValidator.getSecretApprovalRequestDetails, req);
-  const secretApprovalRequest = await SecretApprovalRequest.findById(id)
-    .populate<{ policy: ISecretApprovalPolicy }>("policy")
-    .populate({
-      path: "commits.secretVersion",
-      populate: {
-        path: "tags"
-      }
-    })
-    .populate("commits.secret", "version")
-    .populate("commits.newVersion.tags")
-    .lean();
-  if (!secretApprovalRequest)
-    throw BadRequestError({ message: "Secret approval request not found" });
-
-  const { membership } = await getUserProjectPermissions(
-    req.user._id,
-    secretApprovalRequest.workspace.toString()
-  );
-  // allow to fetch only if its admin or is the committer or approver
-  if (
-    membership.role !== "admin" &&
-    secretApprovalRequest.committer !== membership.id &&
-    !secretApprovalRequest.policy.approvers.find(
-      (approverId) => approverId.toString() === membership._id.toString()
-    )
-  ) {
-    throw UnauthorizedRequestError({ message: "User has no access" });
-  }
-
-  let secretPath = "/";
-  const approvalRootFolders = await Folder.findOne({
-    workspace: secretApprovalRequest.workspace,
-    environment: secretApprovalRequest.environment
-  }).lean();
-  if (approvalRootFolders) {
-    secretPath =
-      getFolderWithPathFromId(approvalRootFolders?.nodes, secretApprovalRequest.folderId)
-        ?.folderPath || "/";
-  }
-
-  return res.send({
-    approval: { ...secretApprovalRequest, secretPath }
-  });
-};
-
-export const updateSecretApprovalReviewStatus = async (req: Request, res: Response) => {
-  const {
-    body: { status },
-    params: { id }
-  } = await validateRequest(reqValidator.updateSecretApprovalReviewStatus, req);
-  const secretApprovalRequest = await SecretApprovalRequest.findById(id).populate<{
-    policy: ISecretApprovalPolicy;
-  }>("policy");
-  if (!secretApprovalRequest)
-    throw BadRequestError({ message: "Secret approval request not found" });
-
-  const { membership } = await getUserProjectPermissions(
-    req.user._id,
-    secretApprovalRequest.workspace.toString()
-  );
-  if (
-    membership.role !== "admin" &&
-    secretApprovalRequest.committer !== membership.id &&
-    !secretApprovalRequest.policy.approvers.find((approverId) => approverId.equals(membership.id))
-  ) {
-    throw UnauthorizedRequestError({ message: "User has no access" });
-  }
-
-  const reviewerPos = secretApprovalRequest.reviewers.findIndex(
-    ({ member }) => member.toString() === membership._id.toString()
-  );
-  if (reviewerPos !== -1) {
-    secretApprovalRequest.reviewers[reviewerPos].status = status;
-  } else {
-    secretApprovalRequest.reviewers.push({ member: membership._id, status });
-  }
-  await secretApprovalRequest.save();
-
-  return res.send({ status });
-};
-
-export const mergeSecretApprovalRequest = async (req: Request, res: Response) => {
-  const {
-    params: { id }
-  } = await validateRequest(reqValidator.mergeSecretApprovalRequest, req);
-
-  const secretApprovalRequest = await SecretApprovalRequest.findById(id).populate<{
-    policy: ISecretApprovalPolicy;
-  }>("policy");
-
-  if (!secretApprovalRequest)
-    throw BadRequestError({ message: "Secret approval request not found" });
-
-  const { membership } = await getUserProjectPermissions(
-    req.user._id,
-    secretApprovalRequest.workspace.toString()
-  );
-  if (
-    membership.role !== "admin" &&
-    secretApprovalRequest.committer !== membership.id &&
-    !secretApprovalRequest.policy.approvers.find((approverId) => approverId.equals(membership.id))
-  ) {
-    throw UnauthorizedRequestError({ message: "User has no access" });
-  }
-
-  const reviewers = secretApprovalRequest.reviewers.reduce<Record<string, ApprovalStatus>>(
-    (prev, curr) => ({ ...prev, [curr.member.toString()]: curr.status }),
-    {}
-  );
-  const hasMinApproval =
-    secretApprovalRequest.policy.approvals <=
-    secretApprovalRequest.policy.approvers.filter(
-      (approverId) => reviewers[approverId.toString()] === ApprovalStatus.APPROVED
-    ).length;
-
-  if (!hasMinApproval) throw BadRequestError({ message: "Doesn't have minimum approvals needed" });
-
-  const approval = await performSecretApprovalRequestMerge(
-    id,
-    req.authData,
-    membership._id.toString()
-  );
-  return res.send({ approval });
-};
-
-export const updateSecretApprovalRequestStatus = async (req: Request, res: Response) => {
-  const {
-    body: { status },
-    params: { id }
-  } = await validateRequest(reqValidator.updateSecretApprovalRequestStatus, req);
-
-  const secretApprovalRequest = await SecretApprovalRequest.findById(id).populate<{
-    policy: ISecretApprovalPolicy;
-  }>("policy");
-
-  if (!secretApprovalRequest)
-    throw BadRequestError({ message: "Secret approval request not found" });
-
-  const { membership } = await getUserProjectPermissions(
-    req.user._id,
-    secretApprovalRequest.workspace.toString()
-  );
-
-  if (
-    membership.role !== "admin" &&
-    secretApprovalRequest.committer !== membership.id &&
-    !secretApprovalRequest.policy.approvers.find((approverId) => approverId.equals(membership._id))
-  ) {
-    throw UnauthorizedRequestError({ message: "User has no access" });
-  }
-
-  if (secretApprovalRequest.hasMerged)
-    throw BadRequestError({ message: "Approval request has been merged" });
-  if (secretApprovalRequest.status === "close" && status === "close")
-    throw BadRequestError({ message: "Approval request is already closed" });
-  if (secretApprovalRequest.status === "open" && status === "open")
-    throw BadRequestError({ message: "Approval request is already open" });
-
-  const updatedRequest = await SecretApprovalRequest.findByIdAndUpdate(
-    id,
-    { status, statusChangeBy: membership._id },
-    { new: true }
-  );
-
-  if (status === "close") {
-    await EEAuditLogService.createAuditLog(
-      req.authData,
-      {
-        type: EventType.SECRET_APPROVAL_CLOSED,
-        metadata: {
-          closedBy: membership._id.toString(),
-          secretApprovalRequestId: id,
-          secretApprovalRequestSlug: secretApprovalRequest.slug
-        }
-      },
-      {
-        workspaceId: secretApprovalRequest.workspace
-      }
-    );
-  } else {
-    await EEAuditLogService.createAuditLog(
-      req.authData,
-      {
-        type: EventType.SECRET_APPROVAL_REOPENED,
-        metadata: {
-          reopenedBy: membership._id.toString(),
-          secretApprovalRequestId: id,
-          secretApprovalRequestSlug: secretApprovalRequest.slug
-        }
-      },
-      {
-        workspaceId: secretApprovalRequest.workspace
-      }
-    );
-  }
-  return res.send({ approval: updatedRequest });
-};

backend/src/ee/controllers/v1/secretController.ts

@@ -1,25 +1,16 @@
-import { ForbiddenError, subject } from "@casl/ability";
-import { Request, Response } from "express";
-import { validateRequest } from "../../../helpers/validation";
-import { Folder, Secret } from "../../../models";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSub,
-  getUserProjectPermissions
-} from "../../services/ProjectRoleService";
-import { BadRequestError } from "../../../utils/errors";
-import * as reqValidator from "../../../validation";
-import { SecretVersion } from "../../models";
-import { EESecretService } from "../../services";
-import { getFolderWithPathFromId } from "../../../services/FolderService";
+import { Request, Response } from 'express';
+import * as Sentry from '@sentry/node';
+import { Secret } from '../../../models';
+import { SecretVersion } from '../../models';
+import { EESecretService } from '../../services';
 
 /**
  * Return secret versions for secret with id [secretId]
- * @param req
- * @param res
+ * @param req 
+ * @param res 
  */
-export const getSecretVersions = async (req: Request, res: Response) => {
-  /* 
+ export const getSecretVersions = async (req: Request, res: Response) => {
+	/* 
     #swagger.summary = 'Return secret versions'
     #swagger.description = 'Return secret versions'
     
@@ -64,42 +55,41 @@ export const getSecretVersions = async (req: Request, res: Response) => {
         }
     }   
     */
-  const {
-    params: { secretId },
-    query: { offset, limit }
-  } = await validateRequest(reqValidator.GetSecretVersionsV1, req);
+	let secretVersions;
+	try {
+		const { secretId } = req.params;
 
-  const secret = await Secret.findById(secretId);
-  if (!secret) {
-    throw BadRequestError({ message: "Failed to find secret" });
-  }
+		const offset: number = parseInt(req.query.offset as string);
+		const limit: number = parseInt(req.query.limit as string);
+		
+		secretVersions = await SecretVersion.find({
+			secret: secretId
+		})
+		.sort({ createdAt: -1 })
+		.skip(offset)
+		.limit(limit);
 
-  const { permission } = await getUserProjectPermissions(req.user._id, secret.workspace.toString());
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Read,
-    ProjectPermissionSub.SecretRollback
-  );
-
-  const secretVersions = await SecretVersion.find({
-    secret: secretId
-  })
-    .sort({ createdAt: -1 })
-    .skip(offset)
-    .limit(limit);
-
-  return res.status(200).send({
-    secretVersions
-  });
-};
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get secret versions'
+		});
+	}
+	
+	return res.status(200).send({
+		secretVersions
+	});
+}
 
 /**
  * Roll back secret with id [secretId] to version [version]
- * @param req
- * @param res
- * @returns
+ * @param req 
+ * @param res 
+ * @returns 
  */
 export const rollbackSecretVersion = async (req: Request, res: Response) => {
-  /* 
+	/* 
     #swagger.summary = 'Roll back secret to a version.'
     #swagger.description = 'Roll back secret to a version.'
     
@@ -147,117 +137,94 @@ export const rollbackSecretVersion = async (req: Request, res: Response) => {
         }
     }   
     */
+	let secret;
+	try {
+		const { secretId } = req.params;
+		const { version } = req.body;
+		
+		// validate secret version
+		const oldSecretVersion = await SecretVersion.findOne({
+			secret: secretId,
+			version
+		});
+		
+		if (!oldSecretVersion) throw new Error('Failed to find secret version');
+		
+		const {
+			workspace,
+			type,
+			user,
+			environment,
+			secretKeyCiphertext,
+			secretKeyIV,
+			secretKeyTag,
+			secretKeyHash,
+			secretValueCiphertext,
+			secretValueIV,
+			secretValueTag,
+			secretValueHash
+		} = oldSecretVersion;
+		
+		// update secret
+		secret = await Secret.findByIdAndUpdate(
+			secretId,
+			{
+				$inc: {
+					version: 1
+				},
+				workspace,
+				type,
+				user,
+				environment,
+				secretKeyCiphertext,
+				secretKeyIV,
+				secretKeyTag,
+				secretKeyHash,
+				secretValueCiphertext,
+				secretValueIV,
+				secretValueTag,
+				secretValueHash
+			},
+			{
+				new: true
+			}
+		);
+		
+		if (!secret) throw new Error('Failed to find and update secret');
 
-  const {
-    params: { secretId },
-    body: { version }
-  } = await validateRequest(reqValidator.RollbackSecretVersionV1, req);
-
-  const toBeUpdatedSec = await Secret.findById(secretId);
-  if (!toBeUpdatedSec) {
-    throw BadRequestError({ message: "Failed to find secret" });
-  }
-  const { permission } = await getUserProjectPermissions(
-    req.user._id,
-    toBeUpdatedSec.workspace.toString()
-  );
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Create,
-    ProjectPermissionSub.SecretRollback
-  );
-
-  // validate secret version
-  const oldSecretVersion = await SecretVersion.findOne({
-    secret: secretId,
-    version
-  }).select("+secretBlindIndex");
-
-  if (!oldSecretVersion) throw new Error("Failed to find secret version");
-
-  const {
-    workspace,
-    type,
-    user,
-    environment,
-    secretBlindIndex,
-    secretKeyCiphertext,
-    secretKeyIV,
-    secretKeyTag,
-    secretValueCiphertext,
-    secretValueIV,
-    secretValueTag,
-    algorithm,
-    folder,
-    keyEncoding
-  } = oldSecretVersion;
-
-  let secretPath = "/";
-  const folders = await Folder.findOne({ workspace, environment });
-  if (folders)
-    secretPath = getFolderWithPathFromId(folders.nodes, folder || "root")?.folderPath || "/";
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Edit,
-    subject(ProjectPermissionSub.Secrets, { environment: toBeUpdatedSec.environment, secretPath })
-  );
-
-  // update secret
-  const secret = await Secret.findByIdAndUpdate(
-    secretId,
-    {
-      $inc: {
-        version: 1
-      },
-      workspace,
-      type,
-      user,
-      environment,
-      ...(secretBlindIndex ? { secretBlindIndex } : {}),
-      secretKeyCiphertext,
-      secretKeyIV,
-      secretKeyTag,
-      secretValueCiphertext,
-      secretValueIV,
-      secretValueTag,
-      folderId: folder,
-      algorithm,
-      keyEncoding
-    },
-    {
-      new: true
-    }
-  );
-
-  if (!secret) throw new Error("Failed to find and update secret");
-
-  // add new secret version
-  await new SecretVersion({
-    secret: secretId,
-    version: secret.version,
-    workspace,
-    type,
-    user,
-    environment,
-    isDeleted: false,
-    ...(secretBlindIndex ? { secretBlindIndex } : {}),
-    secretKeyCiphertext,
-    secretKeyIV,
-    secretKeyTag,
-    secretValueCiphertext,
-    secretValueIV,
-    secretValueTag,
-    folder,
-    algorithm,
-    keyEncoding
-  }).save();
-
-  // take secret snapshot
-  await EESecretService.takeSecretSnapshot({
-    workspaceId: secret.workspace,
-    environment,
-    folderId: folder
-  });
-
-  return res.status(200).send({
-    secret
-  });
-};
+		// add new secret version
+		await new SecretVersion({
+			secret: secretId,
+			version: secret.version,
+			workspace,
+			type,
+			user,
+			environment,
+			isDeleted: false,
+			secretKeyCiphertext,
+			secretKeyIV,
+			secretKeyTag,
+			secretKeyHash,
+			secretValueCiphertext,
+			secretValueIV,
+			secretValueTag,
+			secretValueHash	
+		}).save();
+		
+		// take secret snapshot
+		await EESecretService.takeSecretSnapshot({
+			workspaceId: secret.workspace.toString()
+		});
+		
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to roll back secret version'
+		});
+	}
+	
+	return res.status(200).send({
+		secret
+	});
+}

backend/src/ee/controllers/v1/secretSnapshotController.ts

@@ -1,61 +1,33 @@
-import { ForbiddenError } from "@casl/ability";
-import { Request, Response } from "express";
-import { validateRequest } from "../../../helpers/validation";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSub,
-  getUserProjectPermissions
-} from "../../services/ProjectRoleService";
-import * as reqValidator from "../../../validation/secretSnapshot";
-import { ISecretVersion, SecretSnapshot, TFolderRootVersionSchema } from "../../models";
+import { Request, Response } from 'express';
+import * as Sentry from '@sentry/node';
+import { SecretSnapshot } from '../../models';
 
 /**
  * Return secret snapshot with id [secretSnapshotId]
- * @param req
- * @param res
- * @returns
+ * @param req 
+ * @param res 
+ * @returns 
  */
 export const getSecretSnapshot = async (req: Request, res: Response) => {
-  const {
-    params: { secretSnapshotId }
-  } = await validateRequest(reqValidator.GetSecretSnapshotV1, req);
+    let secretSnapshot;
+    try {
+        const { secretSnapshotId } = req.params;
 
-  const secretSnapshot = await SecretSnapshot.findById(secretSnapshotId)
-    .lean()
-    .populate<{ secretVersions: ISecretVersion[] }>({
-      path: "secretVersions",
-      populate: {
-        path: "tags",
-        model: "Tag"
-      }
-    })
-    .populate<{ folderVersion: TFolderRootVersionSchema }>("folderVersion");
-
-  if (!secretSnapshot) throw new Error("Failed to find secret snapshot");
-
-  const { permission } = await getUserProjectPermissions(
-    req.user._id,
-    secretSnapshot.workspace.toString()
-  );
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Read,
-    ProjectPermissionSub.SecretRollback
-  );
-
-  const folderId = secretSnapshot.folderId;
-  // to show only the folder required secrets
-  secretSnapshot.secretVersions = secretSnapshot.secretVersions.filter(
-    ({ folder }) => folder === folderId
-  );
-
-  secretSnapshot.folderVersion = secretSnapshot?.folderVersion?.nodes?.children?.map(
-    ({ id, name }) => ({
-      id,
-      name
-    })
-  ) as any;
-
-  return res.status(200).send({
-    secretSnapshot
-  });
-};
+        secretSnapshot = await SecretSnapshot
+            .findById(secretSnapshotId)
+            .populate('secretVersions');
+        
+        if (!secretSnapshot) throw new Error('Failed to find secret snapshot');
+        
+    } catch (err) {
+        Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get secret snapshot'
+		});
+    }
+    
+    return res.status(200).send({
+        secretSnapshot
+    });
+}

backend/src/ee/controllers/v1/ssoController.ts

@@ -1,259 +0,0 @@
-import { Request, Response } from "express";
-import { Types } from "mongoose";
-import { BotOrgService } from "../../../services";
-import { SSOConfig } from "../../models";
-import { AuthMethod, MembershipOrg, User } from "../../../models";
-import { getSSOConfigHelper } from "../../helpers/organizations";
-import { client } from "../../../config";
-import { ResourceNotFoundError } from "../../../utils/errors";
-import { getSiteURL } from "../../../config";
-import { EELicenseService } from "../../services";
-import * as reqValidator from "../../../validation/sso";
-import { validateRequest } from "../../../helpers/validation";
-import {
-  OrgPermissionActions,
-  OrgPermissionSubjects,
-  getUserOrgPermissions
-} from "../../services/RoleService";
-import { ForbiddenError } from "@casl/ability";
-
-/**
- * Redirect user to appropriate SSO endpoint after successful authentication
- * to finish inputting their master key for logging in or signing up
- * @param req
- * @param res
- * @returns
- */
-export const redirectSSO = async (req: Request, res: Response) => {
-  if (req.isUserCompleted) {
-    return res.redirect(
-      `${await getSiteURL()}/login/sso?token=${encodeURIComponent(req.providerAuthToken)}`
-    );
-  }
-
-  return res.redirect(
-    `${await getSiteURL()}/signup/sso?token=${encodeURIComponent(req.providerAuthToken)}`
-  );
-};
-
-/**
- * Return organization SAML SSO configuration
- * @param req
- * @param res
- * @returns
- */
-export const getSSOConfig = async (req: Request, res: Response) => {
-  const {
-    query: { organizationId }
-  } = await validateRequest(reqValidator.GetSsoConfigv1, req);
-
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Read,
-    OrgPermissionSubjects.Sso
-  );
-
-  const data = await getSSOConfigHelper({
-    organizationId: new Types.ObjectId(organizationId)
-  });
-
-  return res.status(200).send(data);
-};
-
-/**
- * Update organization SAML SSO configuration
- * @param req
- * @param res
- * @returns
- */
-export const updateSSOConfig = async (req: Request, res: Response) => {
-  const {
-    body: { organizationId, authProvider, isActive, entryPoint, issuer, cert }
-  } = await validateRequest(reqValidator.UpdateSsoConfigv1, req);
-
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Edit,
-    OrgPermissionSubjects.Sso
-  );
-
-  const plan = await EELicenseService.getPlan(new Types.ObjectId(organizationId));
-
-  if (!plan.samlSSO)
-    return res.status(400).send({
-      message:
-        "Failed to update SAML SSO configuration due to plan restriction. Upgrade plan to update SSO configuration."
-    });
-
-  interface PatchUpdate {
-    authProvider?: string;
-    isActive?: boolean;
-    encryptedEntryPoint?: string;
-    entryPointIV?: string;
-    entryPointTag?: string;
-    encryptedIssuer?: string;
-    issuerIV?: string;
-    issuerTag?: string;
-    encryptedCert?: string;
-    certIV?: string;
-    certTag?: string;
-  }
-
-  const update: PatchUpdate = {};
-
-  if (authProvider) {
-    update.authProvider = authProvider;
-  }
-
-  if (isActive !== undefined) {
-    update.isActive = isActive;
-  }
-
-  const key = await BotOrgService.getSymmetricKey(new Types.ObjectId(organizationId));
-
-  if (entryPoint) {
-    const {
-      ciphertext: encryptedEntryPoint,
-      iv: entryPointIV,
-      tag: entryPointTag
-    } = client.encryptSymmetric(entryPoint, key);
-
-    update.encryptedEntryPoint = encryptedEntryPoint;
-    update.entryPointIV = entryPointIV;
-    update.entryPointTag = entryPointTag;
-  }
-
-  if (issuer) {
-    const {
-      ciphertext: encryptedIssuer,
-      iv: issuerIV,
-      tag: issuerTag
-    } = client.encryptSymmetric(issuer, key);
-
-    update.encryptedIssuer = encryptedIssuer;
-    update.issuerIV = issuerIV;
-    update.issuerTag = issuerTag;
-  }
-
-  if (cert) {
-    const {
-      ciphertext: encryptedCert,
-      iv: certIV,
-      tag: certTag
-    } = client.encryptSymmetric(cert, key);
-
-    update.encryptedCert = encryptedCert;
-    update.certIV = certIV;
-    update.certTag = certTag;
-  }
-
-  const ssoConfig = await SSOConfig.findOneAndUpdate(
-    {
-      organization: new Types.ObjectId(organizationId)
-    },
-    update,
-    {
-      new: true
-    }
-  );
-
-  if (!ssoConfig)
-    throw ResourceNotFoundError({
-      message: "Failed to find SSO config to update"
-    });
-
-  if (update.isActive !== undefined) {
-    const membershipOrgs = await MembershipOrg.find({
-      organization: new Types.ObjectId(organizationId)
-    }).select("user");
-
-    if (update.isActive) {
-      await User.updateMany(
-        {
-          _id: {
-            $in: membershipOrgs.map((membershipOrg) => membershipOrg.user)
-          }
-        },
-        {
-          authMethods: [ssoConfig.authProvider]
-        }
-      );
-    } else {
-      await User.updateMany(
-        {
-          _id: {
-            $in: membershipOrgs.map((membershipOrg) => membershipOrg.user)
-          }
-        },
-        {
-          authMethods: [AuthMethod.EMAIL]
-        }
-      );
-    }
-  }
-
-  return res.status(200).send(ssoConfig);
-};
-
-/**
- * Create organization SAML SSO configuration
- * @param req
- * @param res
- * @returns
- */
-export const createSSOConfig = async (req: Request, res: Response) => {
-  const {
-    body: { organizationId, authProvider, isActive, entryPoint, issuer, cert }
-  } = await validateRequest(reqValidator.CreateSsoConfigv1, req);
-
-  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Create,
-    OrgPermissionSubjects.Sso
-  );
-
-  const plan = await EELicenseService.getPlan(new Types.ObjectId(organizationId));
-
-  if (!plan.samlSSO)
-    return res.status(400).send({
-      message:
-        "Failed to create SAML SSO configuration due to plan restriction. Upgrade plan to add SSO configuration."
-    });
-
-  const key = await BotOrgService.getSymmetricKey(new Types.ObjectId(organizationId));
-
-  const {
-    ciphertext: encryptedEntryPoint,
-    iv: entryPointIV,
-    tag: entryPointTag
-  } = client.encryptSymmetric(entryPoint, key);
-
-  const {
-    ciphertext: encryptedIssuer,
-    iv: issuerIV,
-    tag: issuerTag
-  } = client.encryptSymmetric(issuer, key);
-
-  const {
-    ciphertext: encryptedCert,
-    iv: certIV,
-    tag: certTag
-  } = client.encryptSymmetric(cert, key);
-
-  const ssoConfig = await new SSOConfig({
-    organization: new Types.ObjectId(organizationId),
-    authProvider,
-    isActive,
-    encryptedEntryPoint,
-    entryPointIV,
-    entryPointTag,
-    encryptedIssuer,
-    issuerIV,
-    issuerTag,
-    encryptedCert,
-    certIV,
-    certTag
-  }).save();
-
-  return res.status(200).send(ssoConfig);
-};

backend/src/ee/controllers/v1/stripeController.ts

@@ -0,0 +1,40 @@
+import { Request, Response } from 'express';
+import * as Sentry from '@sentry/node';
+import Stripe from 'stripe';
+import { STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET } from '../../../config';
+const stripe = new Stripe(STRIPE_SECRET_KEY, {
+	apiVersion: '2022-08-01'
+});
+
+/**
+ * Handle service provisioning/un-provisioning via Stripe
+ * @param req
+ * @param res
+ * @returns
+ */
+export const handleWebhook = async (req: Request, res: Response) => {
+	let event;
+	try {
+		// check request for valid stripe signature
+		const sig = req.headers['stripe-signature'] as string;
+		event = stripe.webhooks.constructEvent(
+			req.body,
+			sig,
+			STRIPE_WEBHOOK_SECRET // ?
+		);
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			error: 'Failed to process webhook'
+		});
+	}
+
+	switch (event.type) {
+		case '':
+			break;
+		default:
+	}
+
+	return res.json({ received: true });
+};

backend/src/ee/controllers/v1/usersController.ts

@@ -1,13 +0,0 @@
-import { Request, Response } from "express";
-
-/**
- * Return the ip address of the current user
- * @param req 
- * @param res 
- * @returns 
- */
-export const getMyIp = (req: Request, res: Response) => {
-    return res.status(200).send({
-        ip: req.authData.ipAddress
-    });
-}

backend/src/ee/controllers/v3/index.ts

@@ -1,5 +0,0 @@
-import * as serviceTokenDataController from "./serviceTokenDataController";
-
-export {
-    serviceTokenDataController 
-}

backend/src/ee/controllers/v3/serviceTokenDataController.ts

@@ -1,325 +0,0 @@
-import { Request, Response } from "express";
-import { Types } from "mongoose";
-import { 
-    IServiceTokenDataV3,
-    IUser,
-    ServiceTokenDataV3,
-    ServiceTokenDataV3Key,
-    Workspace
-} from "../../../models";
-import {
-    IServiceTokenV3Scope, 
-    IServiceTokenV3TrustedIp 
-} from "../../../models/serviceTokenDataV3";
-import {
-    ActorType,
-    EventType
-} from "../../models";
-import { validateRequest } from "../../../helpers/validation";
-import * as reqValidator from "../../../validation/serviceTokenDataV3";
-import { createToken } from "../../../helpers/auth";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSub,
-  getUserProjectPermissions
-} from "../../services/ProjectRoleService";
-import { ForbiddenError } from "@casl/ability"; 
-import { BadRequestError, ResourceNotFoundError } from "../../../utils/errors";
-import { extractIPDetails, isValidIpOrCidr } from "../../../utils/ip";
-import { EEAuditLogService, EELicenseService } from "../../services";
-import { getJwtServiceTokenSecret } from "../../../config";
-
-/**
- * Return project key for service token
- * @param req 
- * @param res 
- */
-export const getServiceTokenDataKey = async (req: Request, res: Response) => {
-    const key = await ServiceTokenDataV3Key.findOne({
-        serviceTokenData: (req.authData.authPayload as IServiceTokenDataV3)._id
-    }).populate<{ sender: IUser }>("sender", "publicKey");
-    
-    if (!key) throw ResourceNotFoundError({
-        message: "Failed to find project key for service token"
-    });
-    
-    const { _id, workspace, encryptedKey, nonce, sender: { publicKey } } = key;
-    
-    return res.status(200).send({
-        key: {
-            _id,
-            workspace,
-            encryptedKey,
-            publicKey,
-            nonce
-        }
-    });
-}
-
-/**
- * Create service token data
- * @param req 
- * @param res 
- * @returns 
- */
-export const createServiceTokenData = async (req: Request, res: Response) => {
-    const {
-        body: { 
-            name, 
-            workspaceId, 
-            publicKey, 
-            scopes,
-            trustedIps,
-            expiresIn, 
-            encryptedKey, // for ServiceTokenDataV3Key
-            nonce // for ServiceTokenDataV3Key
-        }
-    } = await validateRequest(reqValidator.CreateServiceTokenV3, req);
-    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-    ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Create,
-        ProjectPermissionSub.ServiceTokens
-    );
-    
-    const workspace = await Workspace.findById(workspaceId);
-    if (!workspace) throw BadRequestError({ message: "Workspace not found" });
-
-    const plan = await EELicenseService.getPlan(workspace.organization);
-    
-    // validate trusted ips
-    const reformattedTrustedIps = trustedIps.map((trustedIp) => {
-        if (!plan.ipAllowlisting && trustedIp.ipAddress !== "0.0.0.0/0") return res.status(400).send({
-            message: "Failed to add IP access range to service token due to plan restriction. Upgrade plan to add IP access range."
-        });
-
-        const isValidIPOrCidr = isValidIpOrCidr(trustedIp.ipAddress);
-        
-        if (!isValidIPOrCidr) return res.status(400).send({
-            message: "The IP is not a valid IPv4, IPv6, or CIDR block"
-        });
-        
-        return extractIPDetails(trustedIp.ipAddress);
-    });
-    
-    let expiresAt;
-    if (expiresIn) {
-        expiresAt = new Date();
-        expiresAt.setSeconds(expiresAt.getSeconds() + expiresIn);
-    }
-    
-    let user;
-    if (req.authData.actor.type === ActorType.USER) {
-        user = req.authData.authPayload._id;
-    }
-    
-    const isActive = true;
-    const serviceTokenData = await new ServiceTokenDataV3({
-        name,
-        user,
-        workspace: new Types.ObjectId(workspaceId),
-        publicKey,
-        usageCount: 0,
-        trustedIps: reformattedTrustedIps,
-        scopes,
-        isActive,
-        expiresAt
-    }).save();
-    
-    await new ServiceTokenDataV3Key({
-        encryptedKey,
-        nonce,
-        sender: req.user._id,
-        serviceTokenData: serviceTokenData._id,
-        workspace: new Types.ObjectId(workspaceId)
-    }).save();
-    
-    const token = createToken({
-        payload: {
-            _id: serviceTokenData._id.toString()
-        },
-        expiresIn,
-        secret: await getJwtServiceTokenSecret()
-    });
-    
-    await EEAuditLogService.createAuditLog(
-        req.authData,
-        {
-            type: EventType.CREATE_SERVICE_TOKEN_V3,
-            metadata: {
-                name,
-                isActive,
-                scopes: scopes as Array<IServiceTokenV3Scope>,
-                trustedIps: reformattedTrustedIps as Array<IServiceTokenV3TrustedIp>,
-                expiresAt
-            }
-        },
-        {
-            workspaceId: new Types.ObjectId(workspaceId)
-        }
-    );
-    
-    return res.status(200).send({
-        serviceTokenData,
-        serviceToken: `stv3.${token}`
-    });
-}
-
-/**
- * Update service token data with id [serviceTokenDataId]
- * @param req 
- * @param res 
- * @returns 
- */
-export const updateServiceTokenData = async (req: Request, res: Response) => {
-    const {
-        params: { serviceTokenDataId },
-        body: { 
-            name, 
-            isActive,
-            scopes,
-            trustedIps,
-            expiresIn
-        }
-    } = await validateRequest(reqValidator.UpdateServiceTokenV3, req);
-
-    let serviceTokenData = await ServiceTokenDataV3.findById(serviceTokenDataId);
-    if (!serviceTokenData) throw ResourceNotFoundError({ 
-        message: "Service token not found" 
-    });
-    
-    const { permission } = await getUserProjectPermissions(
-        req.user._id,
-        serviceTokenData.workspace.toString()
-    );
-    
-    ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Edit,
-        ProjectPermissionSub.ServiceTokens
-    );
-
-    const workspace = await Workspace.findById(serviceTokenData.workspace);
-    if (!workspace) throw BadRequestError({ message: "Workspace not found" });
-
-    const plan = await EELicenseService.getPlan(workspace.organization);
-
-    // validate trusted ips
-    let reformattedTrustedIps;
-    if (trustedIps) {
-        reformattedTrustedIps = trustedIps.map((trustedIp) => {
-            if (!plan.ipAllowlisting && trustedIp.ipAddress !== "0.0.0.0/0") return res.status(400).send({
-                message: "Failed to update IP access range to service token due to plan restriction. Upgrade plan to update IP access range."
-            });
-
-            const isValidIPOrCidr = isValidIpOrCidr(trustedIp.ipAddress);
-            
-            if (!isValidIPOrCidr) return res.status(400).send({
-                message: "The IP is not a valid IPv4, IPv6, or CIDR block"
-            });
-            
-            return extractIPDetails(trustedIp.ipAddress);
-        });
-    }
-
-    let expiresAt;
-    if (expiresIn) {
-        expiresAt = new Date();
-        expiresAt.setSeconds(expiresAt.getSeconds() + expiresIn);
-    }
-    
-    serviceTokenData = await ServiceTokenDataV3.findByIdAndUpdate(
-        serviceTokenDataId,
-        {
-            name,
-            isActive,
-            scopes,
-            trustedIps: reformattedTrustedIps,
-            expiresAt
-        },
-        {
-            new: true
-        }
-    );
-    
-    if (!serviceTokenData) throw BadRequestError({
-        message: "Failed to update service token"
-    });
-
-    await EEAuditLogService.createAuditLog(
-        req.authData,
-        {
-            type: EventType.UPDATE_SERVICE_TOKEN_V3,
-            metadata: {
-                name: serviceTokenData.name,
-                isActive,
-                scopes: scopes as Array<IServiceTokenV3Scope>,
-                trustedIps: reformattedTrustedIps as Array<IServiceTokenV3TrustedIp>,
-                expiresAt
-            }
-        },
-        {
-            workspaceId: serviceTokenData.workspace
-        }
-    );
-
-    return res.status(200).send({
-        serviceTokenData
-    }); 
-}
-
-/**
- * Delete service token data with id [serviceTokenDataId]
- * @param req 
- * @param res 
- * @returns 
- */
-export const deleteServiceTokenData = async (req: Request, res: Response) => {
-    const {
-        params: { serviceTokenDataId }
-    } = await validateRequest(reqValidator.DeleteServiceTokenV3, req);
-    
-    let serviceTokenData = await ServiceTokenDataV3.findById(serviceTokenDataId);
-    if (!serviceTokenData) throw ResourceNotFoundError({ 
-        message: "Service token not found" 
-    });
-    
-    const { permission } = await getUserProjectPermissions(
-        req.user._id,
-        serviceTokenData.workspace.toString()
-    );
-    
-    ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Delete,
-        ProjectPermissionSub.ServiceTokens
-    );
-    
-    serviceTokenData = await ServiceTokenDataV3.findByIdAndDelete(serviceTokenDataId);
-    
-    if (!serviceTokenData) throw BadRequestError({
-        message: "Failed to delete service token"
-    });
-    
-    await ServiceTokenDataV3Key.findOneAndDelete({
-        serviceTokenData: serviceTokenData._id
-    });
-    
-    await EEAuditLogService.createAuditLog(
-        req.authData,
-        {
-            type: EventType.DELETE_SERVICE_TOKEN_V3,
-            metadata: {
-                name: serviceTokenData.name,
-                isActive: serviceTokenData.isActive,
-                scopes: serviceTokenData.scopes as Array<IServiceTokenV3Scope>,
-                trustedIps: serviceTokenData.trustedIps as Array<IServiceTokenV3TrustedIp>,
-                expiresAt: serviceTokenData.expiresAt
-            }
-        },
-        {
-            workspaceId: serviceTokenData.workspace
-        }
-    );
-
-    return res.status(200).send({
-        serviceTokenData
-    }); 
-}

backend/src/ee/helpers/action.ts

@@ -1,195 +1,73 @@
-import { Types } from "mongoose";
-import { Action } from "../models";
+import * as Sentry from '@sentry/node';
+import { Types } from 'mongoose';
+import { SecretVersion, Action } from '../models';
 import { 
-    getLatestNSecretSecretVersionIds,
     getLatestSecretVersionIds,
-} from "../helpers/secretVersion";
-import { 
-    ACTION_ADD_SECRETS,
-    ACTION_DELETE_SECRETS,
-    ACTION_LOGIN,
-    ACTION_LOGOUT,
-    ACTION_READ_SECRETS,
-    ACTION_UPDATE_SECRETS,
-} from "../../variables";
+    getLatestNSecretSecretVersionIds
+} from '../helpers/secretVersion';
+import { ACTION_UPDATE_SECRETS } from '../../variables';
 
 /**
- * Create an (audit) action for updating secrets
+ * Create an (audit) action for secrets including
+ * add, delete, update, and read actions.
  * @param {Object} obj
  * @param {String} obj.name - name of action
- * @param {Types.ObjectId} obj.secretIds - ids of relevant secrets
+ * @param {ObjectId[]} obj.secretIds - ids of relevant secrets
  * @returns {Action} action - new action
  */
-const createActionUpdateSecret = async ({
+const createActionSecretHelper = async ({
     name,
     userId,
-    serviceAccountId,
-    serviceTokenDataId,
     workspaceId,
-    secretIds,
+    secretIds
 }: {
     name: string;
-    userId?: Types.ObjectId;
-    serviceAccountId?: Types.ObjectId;
-    serviceTokenDataId?: Types.ObjectId;
-    workspaceId: Types.ObjectId;
+    userId: string;
+    workspaceId: string;
     secretIds: Types.ObjectId[];
 }) => {
-    const latestSecretVersions = (await getLatestNSecretSecretVersionIds({
-            secretIds,
-            n: 2,
-        }))
-        .map((s) => ({
-            oldSecretVersion: s.versions[0]._id,
-            newSecretVersion: s.versions[1]._id,
-        }));
-    
-    const action = await new Action({
-        name,
-        user: userId,
-        serviceAccount: serviceAccountId,
-        serviceTokenData: serviceTokenDataId,
-        workspace: workspaceId,
-        payload: {
-            secretVersions: latestSecretVersions,
-        },
-    }).save();
-    
-    return action;
-}
 
-/**
- * Create an (audit) action for creating, reading, and deleting
- * secrets
- * @param {Object} obj
- * @param {String} obj.name - name of action
- * @param {Types.ObjectId} obj.secretIds - ids of relevant secrets
- * @returns {Action} action - new action
- */
-const createActionSecret = async ({
-    name,
-    userId,
-    serviceAccountId,
-    serviceTokenDataId,
-    workspaceId,
-    secretIds,
-}: {
-    name: string;
-    userId?: Types.ObjectId;
-    serviceAccountId?: Types.ObjectId;
-    serviceTokenDataId?: Types.ObjectId;
-    workspaceId: Types.ObjectId;
-    secretIds: Types.ObjectId[];
-}) => {
-    // case: action is adding, deleting, or reading secrets
-    // -> add new secret versions
-    const latestSecretVersions = (await getLatestSecretVersionIds({
-        secretIds,
-    }))
-    .map((s) => ({
-        newSecretVersion: s.versionId,
-    }));
-    
-   const action = await new Action({
-        name,
-        user: userId,
-        serviceAccount: serviceAccountId,
-        serviceTokenData: serviceTokenDataId,
-        workspace: workspaceId,
-        payload: {
-            secretVersions: latestSecretVersions,
-        },
-    }).save(); 
-    
-    return action;
-}
-
-/**
- * Create an (audit) action for client with id [userId],
- * [serviceAccountId], or [serviceTokenDataId]
- * @param {Object} obj 
- * @param {String} obj.name - name of action
- * @param {String} obj.userId - id of user associated with action
- * @returns 
- */
-const createActionClient = ({
-    name,
-    userId,
-    serviceAccountId,
-    serviceTokenDataId,
-}: {
-    name: string;
-    userId?: Types.ObjectId;
-    serviceAccountId?: Types.ObjectId;
-    serviceTokenDataId?: Types.ObjectId;
-}) => {
-    const action = new Action({
-        name,
-        user: userId,
-        serviceAccount: serviceAccountId,
-        serviceTokenData: serviceTokenDataId,
-    }).save();
-
-    return action; 
-}
-
-/**
- * Create an (audit) action. 
- * @param {Object} obj
- * @param {Object} obj.name - name of action
- * @param {Types.ObjectId} obj.userId - id of user associated with action
- * @param {Types.ObjectId} obj.workspaceId - id of workspace associated with action
- * @param {Types.ObjectId[]} obj.secretIds - ids of secrets associated with action
-*/
-const createActionHelper = async ({
-    name,
-    userId,
-    serviceAccountId,
-    serviceTokenDataId,
-    workspaceId,
-    secretIds,
-}: {
-    name: string;
-    userId?: Types.ObjectId;
-    serviceAccountId?: Types.ObjectId;
-    serviceTokenDataId?: Types.ObjectId;
-    workspaceId?: Types.ObjectId;
-    secretIds?: Types.ObjectId[];
-}) => {
     let action;
-    switch (name) {
-        case ACTION_LOGIN:
-        case ACTION_LOGOUT:
-            action = await createActionClient({
-                name,
-                userId,
-            });
-            break;
-        case ACTION_ADD_SECRETS:
-        case ACTION_READ_SECRETS:
-        case ACTION_DELETE_SECRETS:
-            if (!workspaceId || !secretIds) throw new Error("Missing required params workspace id or secret ids to create action secret");
-            action = await createActionSecret({
-                name,
-                userId,
-                workspaceId,
+    let latestSecretVersions;
+    try {
+        if (name === ACTION_UPDATE_SECRETS) {
+            // case: action is updating secrets
+            // -> add old and new secret versions
+            latestSecretVersions = (await getLatestNSecretSecretVersionIds({
                 secretIds,
-            });
-            break;
-        case ACTION_UPDATE_SECRETS:
-            if (!workspaceId || !secretIds) throw new Error("Missing required params workspace id or secret ids to create action secret");
-            action = await createActionUpdateSecret({
-                name,
-                userId,
-                workspaceId,
-                secretIds,
-            });
-            break;
+                n: 2
+            }))
+            .map((s) => ({
+                oldSecretVersion: s.versions[0]._id,
+                newSecretVersion: s.versions[1]._id
+            }));
+        } else {
+            // case: action is adding, deleting, or reading secrets
+            // -> add new secret versions
+            latestSecretVersions = (await getLatestSecretVersionIds({
+                secretIds
+            }))
+            .map((s) => ({
+                newSecretVersion: s.versionId
+            }));
+        }
+
+        action = await new Action({
+            name,
+            user: userId,
+            workspace: workspaceId,
+            payload: {
+                secretVersions: latestSecretVersions
+            }
+        }).save();
+
+    } catch (err) {
+		Sentry.setUser(null);
+		Sentry.captureException(err);
+        throw new Error('Failed to create action');
     }
     
     return action;
 }
 
-export { 
-    createActionHelper,
-};
+export { createActionSecretHelper };

backend/src/ee/helpers/checkMembershipPermissions.ts

@@ -1,9 +1,7 @@
-import { Types } from "mongoose";
 import _ from "lodash";
 import { Membership } from "../../models";
-import { PERMISSION_READ_SECRETS, PERMISSION_WRITE_SECRETS } from "../../variables";
 
-export const userHasWorkspaceAccess = async (userId: Types.ObjectId, workspaceId: Types.ObjectId, environment: string, action: any) => {
+export const userHasWorkspaceAccess = async (userId: any, workspaceId: any, environment: any, action: any) => {
   const membershipForWorkspace = await Membership.findOne({ workspace: workspaceId, user: userId })
   if (!membershipForWorkspace) {
     return false
@@ -17,39 +15,4 @@ export const userHasWorkspaceAccess = async (userId: Types.ObjectId, workspaceId
   }
 
   return true
-}
-
-export const userHasWriteOnlyAbility = async (userId: Types.ObjectId, workspaceId: Types.ObjectId, environment: string) => {
-  const membershipForWorkspace = await Membership.findOne({ workspace: workspaceId, user: userId })
-  if (!membershipForWorkspace) {
-    return false
-  }
-
-  const deniedMembershipPermissions = membershipForWorkspace.deniedPermissions;
-  const isWriteDisallowed = _.some(deniedMembershipPermissions, { environmentSlug: environment, ability: PERMISSION_WRITE_SECRETS });
-  const isReadDisallowed = _.some(deniedMembershipPermissions, { environmentSlug: environment, ability: PERMISSION_READ_SECRETS });
-
-  // case: you have write only if read is blocked and write is not
-  if (isReadDisallowed && !isWriteDisallowed) {
-    return true
-  }
-
-  return false
-}
-
-export const userHasNoAbility = async (userId: Types.ObjectId, workspaceId: Types.ObjectId, environment: string) => {
-  const membershipForWorkspace = await Membership.findOne({ workspace: workspaceId, user: userId })
-  if (!membershipForWorkspace) {
-    return true
-  }
-
-  const deniedMembershipPermissions = membershipForWorkspace.deniedPermissions;
-  const isWriteDisallowed = _.some(deniedMembershipPermissions, { environmentSlug: environment, ability: PERMISSION_WRITE_SECRETS });
-  const isReadBlocked = _.some(deniedMembershipPermissions, { environmentSlug: environment, ability: PERMISSION_READ_SECRETS });
-
-  if (isReadBlocked && isWriteDisallowed) {
-    return true
-  }
-
-  return false
 }

backend/src/ee/helpers/log.ts

@@ -1,50 +1,41 @@
-import { Types } from "mongoose";
+import * as Sentry from '@sentry/node';
 import { 
-    IAction,
     Log,
-} from "../models";
+    IAction
+} from '../models';
 
-/**
- * Create an (audit) log
- * @param {Object} obj
- * @param {Types.ObjectId} obj.userId - id of user associated with the log
- * @param {Types.ObjectId} obj.workspaceId - id of workspace associated with the log
- * @param {IAction[]} obj.actions - actions to include in log
- * @param {String} obj.channel - channel (web/cli/auto) associated with the log
- * @param {String} obj.ipAddress - ip address associated with the log
- * @returns {Log} log - new audit log
- */
 const createLogHelper = async ({
     userId,
-    serviceAccountId,
-    serviceTokenDataId,
     workspaceId,
     actions,
     channel,
-    ipAddress,
+    ipAddress
 }: {
-    userId?: Types.ObjectId;
-    serviceAccountId?: Types.ObjectId;
-    serviceTokenDataId?: Types.ObjectId;
-    workspaceId?: Types.ObjectId;
+    userId: string;
+    workspaceId: string;
     actions: IAction[];
     channel: string;
     ipAddress: string;
 }) => {
-    const log = await new Log({
-        user: userId,
-        serviceAccount: serviceAccountId,
-        serviceTokenData: serviceTokenDataId,
-        workspace: workspaceId ?? undefined,
-        actionNames: actions.map((a) => a.name),
-        actions,
-        channel,
-        ipAddress,
-    }).save();
+    let log;
+    try {
+        log = await new Log({
+            user: userId,
+            workspace: workspaceId,
+            actionNames: actions.map((a) => a.name),
+            actions,
+            channel,
+            ipAddress
+        }).save();
+    } catch (err) {
+        Sentry.setUser(null);
+		Sentry.captureException(err);
+		throw new Error('Failed to create log');
+    }
 
     return log;
 }
 
 export {
-    createLogHelper,
-}
+    createLogHelper
+}

backend/src/ee/helpers/organizations.ts

@@ -1,64 +0,0 @@
-import { Types } from "mongoose";
-import {
-    SSOConfig
-} from "../models";
-import {
-    BotOrgService
-} from "../../services";
-import { client } from "../../config";
-import { ValidationError } from "../../utils/errors";
-
-export const getSSOConfigHelper = async ({
-    organizationId,
-    ssoConfigId
-}: {
-    organizationId?: Types.ObjectId;
-    ssoConfigId?: Types.ObjectId;
-}) => {
-    
-    if (!organizationId && !ssoConfigId) throw ValidationError({
-        message: "Getting SSO data requires either id of organization or SSO data"
-    });
-    
-    const ssoConfig = await SSOConfig.findOne({
-        ...(organizationId ? { organization: organizationId } : {}),
-        ...(ssoConfigId ? { _id: ssoConfigId } : {})
-    });
-    
-    if (!ssoConfig) throw new Error("Failed to find organization SSO data");
-    
-    const key = await BotOrgService.getSymmetricKey(
-        ssoConfig.organization
-    );
-    
-    const entryPoint = client.decryptSymmetric(
-        ssoConfig.encryptedEntryPoint,
-        key,
-        ssoConfig.entryPointIV,
-        ssoConfig.entryPointTag
-    );
-
-    const issuer = client.decryptSymmetric(
-        ssoConfig.encryptedIssuer,
-        key,
-        ssoConfig.issuerIV,
-        ssoConfig.issuerTag
-    );
-
-    const cert = client.decryptSymmetric(
-        ssoConfig.encryptedCert,
-        key,
-        ssoConfig.certIV,
-        ssoConfig.certTag
-    );
-    
-    return ({
-        _id: ssoConfig._id,
-        organization: ssoConfig.organization,
-        authProvider: ssoConfig.authProvider,
-        isActive: ssoConfig.isActive,
-        entryPoint,
-        issuer,
-        cert
-    });
-}

backend/src/ee/helpers/secret.ts

@@ -1,11 +1,14 @@
-import { Types } from "mongoose";
-import { Secret } from "../../models";
+import { Types } from 'mongoose';
+import * as Sentry from '@sentry/node';
 import {
-  FolderVersion,
-  ISecretVersion,
-  SecretSnapshot,
-  SecretVersion,
-} from "../models";
+	Secret,
+	ISecret
+} from '../../models';
+import {
+	SecretSnapshot,
+	SecretVersion,
+	ISecretVersion
+} from '../models';
 
 /**
  * Save a secret snapshot that is a copy of the current state of secrets in workspace with id
@@ -16,70 +19,56 @@ import {
  * @returns {SecretSnapshot} secretSnapshot - new secret snapshot
  */
 const takeSecretSnapshotHelper = async ({
-  workspaceId,
-  environment,
-  folderId = "root",
+	workspaceId
 }: {
-  workspaceId: Types.ObjectId;
-  environment: string;
-  folderId?: string;
+	workspaceId: string;
 }) => {
-  // get all folder ids
-  const secretIds = (
-    await Secret.find(
-      {
-        workspace: workspaceId,
-        environment,
-        folder: folderId,
-      },
-      "_id"
-    ).lean()
-  ).map((s) => s._id);
 
-  const latestSecretVersions = (
-    await SecretVersion.aggregate([
-      {
-        $match: {
-          environment,
-          workspace: new Types.ObjectId(workspaceId),
-          secret: {
-            $in: secretIds,
-          },
-        },
-      },
-      {
-        $group: {
-          _id: "$secret",
-          version: { $max: "$version" },
-          versionId: { $max: "$_id" }, // secret version id
-        },
-      },
-      {
-        $sort: { version: -1 },
-      },
-    ]).exec()
-  ).map((s) => s.versionId);
-  const latestFolderVersion = await FolderVersion.findOne({
-    environment,
-    workspace: workspaceId,
-    "nodes.id": folderId,
-  }).sort({ "nodes.version": -1 });
+	let secretSnapshot;
+	try {
+		const secretIds = (await Secret.find({
+			workspace: workspaceId
+		}, '_id')).map((s) => s._id);
 
-  const latestSecretSnapshot = await SecretSnapshot.findOne({
-    workspace: workspaceId,
-  }).sort({ version: -1 });
+		const latestSecretVersions = (await SecretVersion.aggregate([
+			{
+				$match: {
+					secret: {
+						$in: secretIds
+					}
+				}
+			},
+			{
+				$group: {
+					_id: '$secret',
+					version: { $max: '$version' },
+					versionId: { $max: '$_id' } // secret version id
+				}
+			},
+			{
+				$sort: { version: -1 }
+			}
+		])
+			.exec())
+			.map((s) => s.versionId);
 
-  const secretSnapshot = await new SecretSnapshot({
-    workspace: workspaceId,
-    environment,
-    version: latestSecretSnapshot ? latestSecretSnapshot.version + 1 : 1,
-    secretVersions: latestSecretVersions,
-    folderId,
-    folderVersion: latestFolderVersion,
-  }).save();
+		const latestSecretSnapshot = await SecretSnapshot.findOne({
+			workspace: workspaceId
+		}).sort({ version: -1 });
 
-  return secretSnapshot;
-};
+		secretSnapshot = await new SecretSnapshot({
+			workspace: workspaceId,
+			version: latestSecretSnapshot ? latestSecretSnapshot.version + 1 : 1,
+			secretVersions: latestSecretVersions
+		}).save();
+	} catch (err) {
+		Sentry.setUser(null);
+		Sentry.captureException(err);
+		throw new Error('Failed to take a secret snapshot');
+	}
+
+	return secretSnapshot;
+}
 
 /**
  * Add secret versions [secretVersions] to the SecretVersion collection.
@@ -88,35 +77,93 @@ const takeSecretSnapshotHelper = async ({
  * @returns {SecretVersion[]} newSecretVersions - new secret versions
  */
 const addSecretVersionsHelper = async ({
-  secretVersions,
+	secretVersions
 }: {
-  secretVersions: ISecretVersion[];
+	secretVersions: ISecretVersion[]
 }) => {
-  const newSecretVersions = await SecretVersion.insertMany(secretVersions);
+	let newSecretVersions;
+	try {
+		newSecretVersions = await SecretVersion.insertMany(secretVersions);
+	} catch (err) {
+		Sentry.setUser(null);
+		Sentry.captureException(err);
+		throw new Error(`Failed to add secret versions [err=${err}]`);
+	}
 
-  return newSecretVersions;
-};
+	return newSecretVersions;
+}
 
 const markDeletedSecretVersionsHelper = async ({
-  secretIds,
+	secretIds
 }: {
-  secretIds: Types.ObjectId[];
+	secretIds: Types.ObjectId[];
 }) => {
-  await SecretVersion.updateMany(
-    {
-      secret: { $in: secretIds },
-    },
-    {
-      isDeleted: true,
-    },
-    {
-      new: true,
-    }
-  );
-};
+	try {
+		await SecretVersion.updateMany({
+			secret: { $in: secretIds }
+		}, {
+			isDeleted: true
+		}, {
+			new: true
+		});
+	} catch (err) {
+		Sentry.setUser(null);
+		Sentry.captureException(err);
+		throw new Error('Failed to mark secret versions as deleted');
+	}
+}
+
+/**
+ * Initialize secret versioning by setting previously unversioned
+ * secrets to version 1 and begin populating secret versions.
+ */
+const initSecretVersioningHelper = async () => {
+	try {
+
+		await Secret.updateMany(
+			{ version: { $exists: false } },
+			{ $set: { version: 1 } }
+		);
+
+		const unversionedSecrets: ISecret[] = await Secret.aggregate([
+			{
+				$lookup: {
+					from: 'secretversions',
+					localField: '_id',
+					foreignField: 'secret',
+					as: 'versions',
+				},
+			},
+			{
+				$match: {
+					versions: { $size: 0 },
+				},
+			},
+		]);
+
+		if (unversionedSecrets.length > 0) {
+			await addSecretVersionsHelper({
+				secretVersions: unversionedSecrets.map((s, idx) => ({
+					...s,
+					secret: s._id,
+					version: s.version ? s.version : 1,
+					isDeleted: false,
+					workspace: s.workspace,
+					environment: s.environment
+				}))
+			});
+		}
+
+	} catch (err) {
+		Sentry.setUser(null);
+		Sentry.captureException(err);
+		throw new Error('Failed to ensure that secrets are versioned');
+	}
+}
 
 export {
-  takeSecretSnapshotHelper,
-  addSecretVersionsHelper,
-  markDeletedSecretVersionsHelper,
-};
+	takeSecretSnapshotHelper,
+	addSecretVersionsHelper,
+	markDeletedSecretVersionsHelper,
+	initSecretVersioningHelper
+}

backend/src/ee/helpers/secretVersion.ts

@@ -1,82 +1,110 @@
-import { Types } from "mongoose";
-import { SecretVersion } from "../models";
+import * as Sentry from '@sentry/node';
+import { Types } from 'mongoose';
+import { SecretVersion } from '../models';
 
 /**
  * Return latest secret versions for secrets with ids [secretIds]
  * @param {Object} obj
  * @param {Object} obj.secretIds = ids of secrets to get latest versions for
- * @returns
+ * @returns 
  */
 const getLatestSecretVersionIds = async ({
-  secretIds,
+    secretIds
 }: {
-  secretIds: Types.ObjectId[];
+    secretIds: Types.ObjectId[];
 }) => {
-  const latestSecretVersionIds = await SecretVersion.aggregate([
-    {
-      $match: {
-        secret: {
-          $in: secretIds,
-        },
-      },
-    },
-    {
-      $group: {
-        _id: "$secret",
-        version: { $max: "$version" },
-        versionId: { $max: "$_id" }, // id of latest secret version
-      },
-    },
-    {
-      $sort: { version: -1 },
-    },
-  ]).exec();
-
-  return latestSecretVersionIds;
-};
+    
+    interface LatestSecretVersionId {
+        _id: Types.ObjectId;
+        version: number;
+        versionId: Types.ObjectId;
+    }
+    
+    let latestSecretVersionIds: LatestSecretVersionId[];
+    try {
+        latestSecretVersionIds = (await SecretVersion.aggregate([
+            {
+                $match: { 
+                    secret: { 
+                        $in: secretIds 
+                    } 
+                }
+            },
+            {
+                $group: {
+                    _id: '$secret',
+                    version: { $max: '$version' },
+                    versionId: { $max: '$_id' } // id of latest secret version
+                }
+            },
+            {
+                $sort: { version: -1 }
+            }
+            ])
+            .exec());
+            
+    } catch (err) {
+        Sentry.setUser(null);
+		Sentry.captureException(err);
+        throw new Error('Failed to get latest secret versions');
+    }
+    
+    return latestSecretVersionIds;
+}
 
 /**
  * Return latest [n] secret versions for secrets with ids [secretIds]
  * @param {Object} obj
  * @param {Object} obj.secretIds = ids of secrets to get latest versions for
  * @param {Number} obj.n - number of latest secret versions to return for each secret
- * @returns
+ * @returns 
  */
 const getLatestNSecretSecretVersionIds = async ({
-  secretIds,
-  n,
+    secretIds,
+    n
 }: {
-  secretIds: Types.ObjectId[];
-  n: number;
+    secretIds: Types.ObjectId[];
+    n: number;
 }) => {
-  // TODO: optimize query
-  const latestNSecretVersions = await SecretVersion.aggregate([
-    {
-      $match: {
-        secret: {
-          $in: secretIds,
-        },
-      },
-    },
-    {
-      $sort: { version: -1 },
-    },
-    {
-      $group: {
-        _id: "$secret",
-        versions: { $push: "$$ROOT" },
-      },
-    },
-    {
-      $project: {
-        _id: 0,
-        secret: "$_id",
-        versions: { $slice: ["$versions", n] },
-      },
-    },
-  ]);
+    
+    // TODO: optimize query
+    let latestNSecretVersions;
+    try {
+        latestNSecretVersions = (await SecretVersion.aggregate([
+            {
+                $match: {
+                secret: {
+                    $in: secretIds,
+                },
+                },
+            },
+            {
+                $sort: { version: -1 },
+            },
+            {
+                $group: {
+                _id: "$secret",
+                versions: { $push: "$$ROOT" },
+                },
+            },
+            {
+                $project: {
+                _id: 0,
+                secret: "$_id",
+                versions: { $slice: ["$versions", n] },
+                },
+            }
+        ]));
+    } catch (err) {
+        Sentry.setUser(null);
+		Sentry.captureException(err);
+        throw new Error('Failed to get latest n secret versions');
+    }
+    
+    return latestNSecretVersions;
+}
 
-  return latestNSecretVersions;
-};
-
-export { getLatestSecretVersionIds, getLatestNSecretSecretVersionIds };
+export {
+    getLatestSecretVersionIds,
+    getLatestNSecretSecretVersionIds
+}

backend/src/ee/middleware/index.ts

@@ -1,5 +1,7 @@
-import requireSecretSnapshotAuth from "./requireSecretSnapshotAuth";
+import requireLicenseAuth from './requireLicenseAuth';
+import requireSecretSnapshotAuth from './requireSecretSnapshotAuth';
 
 export {
-    requireSecretSnapshotAuth,
+    requireLicenseAuth,
+    requireSecretSnapshotAuth
 }