Bring back try-catch for initGlobalFeatureSet

Fix issues/bugs

backend/package.json

@@ -20,6 +20,7 @@
     "crypto-js": "^4.1.1",
     "dotenv": "^16.0.1",
     "express": "^4.18.1",
+    "express-async-errors": "^3.1.1",
     "express-rate-limit": "^6.7.0",
     "express-validator": "^6.14.2",
     "handlebars": "^4.7.7",
@@ -31,15 +32,14 @@
     "libsodium-wrappers": "^0.7.10",
     "lodash": "^4.17.21",
     "mongoose": "^6.10.5",
-    "node-cache": "^5.1.2",
     "nanoid": "^3.3.6",
+    "node-cache": "^5.1.2",
     "nodemailer": "^6.8.0",
     "passport": "^0.6.0",
     "passport-google-oauth20": "^2.0.0",
     "posthog-node": "^2.6.0",
     "query-string": "^7.1.3",
     "rate-limit-mongo": "^2.3.2",
-    "request-ip": "^3.3.0",
     "rimraf": "^3.0.2",
     "stripe": "^10.7.0",
     "swagger-autogen": "^2.22.0",

backend/src/controllers/v1/authController.ts

@@ -1,19 +1,28 @@
-import * as Sentry from '@sentry/node';
 import { Request, Response } from 'express';
+import fs from 'fs';
+import path from 'path';
 import jwt from 'jsonwebtoken';
 import * as bigintConversion from 'bigint-conversion';
 // eslint-disable-next-line @typescript-eslint/no-var-requires
 const jsrp = require('jsrp');
-import { User, LoginSRPDetail } from '../../models';
+import { 
+  User, 
+  LoginSRPDetail,
+  TokenVersion
+} from '../../models';
 import { createToken, issueAuthTokens, clearTokens } from '../../helpers/auth';
 import { checkUserDevice } from '../../helpers/user';
 import {
   ACTION_LOGIN,
-  ACTION_LOGOUT
+  ACTION_LOGOUT,
+  AUTH_MODE_JWT
 } from '../../variables';
-import { BadRequestError } from '../../utils/errors';
+import { 
+  BadRequestError,
+  UnauthorizedRequestError
+} from '../../utils/errors';
 import { EELogService } from '../../ee/services';
-import { getChannelFromUserAgent } from '../../utils/posthog'; // TODO: move this
+import { getChannelFromUserAgent } from '../../utils/posthog';
 import {
   getJwtRefreshSecret,
   getJwtAuthLifetime,
@@ -24,6 +33,7 @@ import {
 declare module 'jsonwebtoken' {
   export interface UserIDJwtPayload extends jwt.JwtPayload {
     userId: string;
+    refreshVersion?: number;
   }
 }
 
@@ -34,47 +44,39 @@ declare module 'jsonwebtoken' {
  * @returns
  */
 export const login1 = async (req: Request, res: Response) => {
-  try {
-    const {
-      email,
-      clientPublicKey
-    }: { email: string; clientPublicKey: string } = req.body;
+  const {
+    email,
+    clientPublicKey
+  }: { email: string; clientPublicKey: string } = req.body;
 
-    const user = await User.findOne({
-      email
-    }).select('+salt +verifier');
+  const user = await User.findOne({
+    email
+  }).select('+salt +verifier');
 
-    if (!user) throw new Error('Failed to find user');
+  if (!user) throw new Error('Failed to find user');
 
-    const server = new jsrp.server();
-    server.init(
-      {
-        salt: user.salt,
-        verifier: user.verifier
-      },
-      async () => {
-        // generate server-side public key
-        const serverPublicKey = server.getPublicKey();
+  const server = new jsrp.server();
+  server.init(
+    {
+      salt: user.salt,
+      verifier: user.verifier
+    },
+    async () => {
+      // generate server-side public key
+      const serverPublicKey = server.getPublicKey();
 
-        await LoginSRPDetail.findOneAndReplace({ email: email }, {
-          email: email,
-          clientPublicKey: clientPublicKey,
-          serverBInt: bigintConversion.bigintToBuf(server.bInt),
-        }, { upsert: true, returnNewDocument: false })
+      await LoginSRPDetail.findOneAndReplace({ email: email }, {
+        email: email,
+        clientPublicKey: clientPublicKey,
+        serverBInt: bigintConversion.bigintToBuf(server.bInt),
+      }, { upsert: true, returnNewDocument: false })
 
-        return res.status(200).send({
-          serverPublicKey,
-          salt: user.salt
-        });
-      }
-    );
-  } catch (err) {
-    Sentry.setUser(null);
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: 'Failed to start authentication process'
-    });
-  }
+      return res.status(200).send({
+        serverPublicKey,
+        salt: user.salt
+      });
+    }
+  );
 };
 
 /**
@@ -85,84 +87,80 @@ export const login1 = async (req: Request, res: Response) => {
  * @returns
  */
 export const login2 = async (req: Request, res: Response) => {
-  try {
-    const { email, clientProof } = req.body;
-    const user = await User.findOne({
-      email
-    }).select('+salt +verifier +publicKey +encryptedPrivateKey +iv +tag');
+  const { email, clientProof } = req.body;
+  const user = await User.findOne({
+    email
+  }).select('+salt +verifier +publicKey +encryptedPrivateKey +iv +tag');
 
-    if (!user) throw new Error('Failed to find user');
+  if (!user) throw new Error('Failed to find user');
 
-    const loginSRPDetailFromDB = await LoginSRPDetail.findOneAndDelete({ email: email })
+  const loginSRPDetailFromDB = await LoginSRPDetail.findOneAndDelete({ email: email })
 
-    if (!loginSRPDetailFromDB) {
-      return BadRequestError(Error("It looks like some details from the first login are not found. Please try login one again"))
-    }
+  if (!loginSRPDetailFromDB) {
+    return BadRequestError(Error("It looks like some details from the first login are not found. Please try login one again"))
+  }
 
-    const server = new jsrp.server();
-    server.init(
-      {
-        salt: user.salt,
-        verifier: user.verifier,
-        b: loginSRPDetailFromDB.serverBInt
-      },
-      async () => {
-        server.setClientPublicKey(loginSRPDetailFromDB.clientPublicKey);
+  const server = new jsrp.server();
+  server.init(
+    {
+      salt: user.salt,
+      verifier: user.verifier,
+      b: loginSRPDetailFromDB.serverBInt
+    },
+    async () => {
+      server.setClientPublicKey(loginSRPDetailFromDB.clientPublicKey);
 
-        // compare server and client shared keys
-        if (server.checkClientProof(clientProof)) {
-          // issue tokens
+      // compare server and client shared keys
+      if (server.checkClientProof(clientProof)) {
+        // issue tokens
 
-          await checkUserDevice({
-            user,
-            ip: req.ip,
-            userAgent: req.headers['user-agent'] ?? ''
-          });
+        await checkUserDevice({
+          user,
+          ip: req.realIP,
+          userAgent: req.headers['user-agent'] ?? ''
+        });
 
-          const tokens = await issueAuthTokens({ userId: user._id.toString() });
+        const tokens = await issueAuthTokens({ 
+          userId: user._id,
+          ip: req.realIP,
+          userAgent: req.headers['user-agent'] ?? ''
+        });
 
-          // store (refresh) token in httpOnly cookie
-          res.cookie('jid', tokens.refreshToken, {
-            httpOnly: true,
-            path: '/',
-            sameSite: 'strict',
-            secure: await getHttpsEnabled()
-          });
+        // store (refresh) token in httpOnly cookie
+        res.cookie('jid', tokens.refreshToken, {
+          httpOnly: true,
+          path: '/',
+          sameSite: 'strict',
+          secure: await getHttpsEnabled()
+        });
 
-          const loginAction = await EELogService.createAction({
-            name: ACTION_LOGIN,
-            userId: user._id
-          });
+        const loginAction = await EELogService.createAction({
+          name: ACTION_LOGIN,
+          userId: user._id
+        });
 
-          loginAction && await EELogService.createLog({
-            userId: user._id,
-            actions: [loginAction],
-            channel: getChannelFromUserAgent(req.headers['user-agent']),
-            ipAddress: req.ip
-          });
+        loginAction && await EELogService.createLog({
+          userId: user._id,
+          actions: [loginAction],
+          channel: getChannelFromUserAgent(req.headers['user-agent']),
+          ipAddress: req.realIP
+        });
 
-          // return (access) token in response
-          return res.status(200).send({
-            token: tokens.token,
-            publicKey: user.publicKey,
-            encryptedPrivateKey: user.encryptedPrivateKey,
-            iv: user.iv,
-            tag: user.tag
-          });
-        }
-
-        return res.status(400).send({
-          message: 'Failed to authenticate. Try again?'
+        // return (access) token in response
+        return res.status(200).send({
+          token: tokens.token,
+          publicKey: user.publicKey,
+          encryptedPrivateKey: user.encryptedPrivateKey,
+          iv: user.iv,
+          tag: user.tag
         });
       }
-    );
-  } catch (err) {
-    Sentry.setUser(null);
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: 'Failed to authenticate. Try again?'
-    });
-  }
+
+      return res.status(400).send({
+        message: 'Failed to authenticate. Try again?'
+      });
+    }
+  );
 };
 
 /**
@@ -172,44 +170,59 @@ export const login2 = async (req: Request, res: Response) => {
  * @returns
  */
 export const logout = async (req: Request, res: Response) => {
-  try {
-    await clearTokens({
-      userId: req.user._id.toString()
-    });
-
-    // clear httpOnly cookie
-    res.cookie('jid', '', {
-      httpOnly: true,
-      path: '/',
-      sameSite: 'strict',
-      secure: (await getHttpsEnabled()) as boolean
-    });
-
-    const logoutAction = await EELogService.createAction({
-      name: ACTION_LOGOUT,
-      userId: req.user._id
-    });
-
-    logoutAction && await EELogService.createLog({
-      userId: req.user._id,
-      actions: [logoutAction],
-      channel: getChannelFromUserAgent(req.headers['user-agent']),
-      ipAddress: req.ip
-    });
-
-  } catch (err) {
-    Sentry.setUser({ email: req.user.email });
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: 'Failed to logout'
-    });
+  if (req.authData.authMode === AUTH_MODE_JWT && req.authData.authPayload instanceof User && req.authData.tokenVersionId) {
+    await clearTokens(req.authData.tokenVersionId)
   }
 
+  // clear httpOnly cookie
+  res.cookie('jid', '', {
+    httpOnly: true,
+    path: '/',
+    sameSite: 'strict',
+    secure: (await getHttpsEnabled()) as boolean
+  });
+
+  const logoutAction = await EELogService.createAction({
+    name: ACTION_LOGOUT,
+    userId: req.user._id
+  });
+
+  logoutAction && await EELogService.createLog({
+    userId: req.user._id,
+    actions: [logoutAction],
+    channel: getChannelFromUserAgent(req.headers['user-agent']),
+    ipAddress: req.realIP
+  });
+
   return res.status(200).send({
     message: 'Successfully logged out.'
   });
 };
 
+export const getCommonPasswords = async (req: Request, res: Response) => {
+  const commonPasswords = fs.readFileSync(
+		path.resolve(__dirname, '../../data/' + 'common_passwords.txt'),
+		'utf8'
+	).split('\n');	
+
+  return res.status(200).send(commonPasswords);
+}
+
+export const revokeAllSessions = async (req: Request, res: Response) => {
+  await TokenVersion.updateMany({
+    user: req.user._id
+  }, {
+    $inc: {
+      refreshVersion: 1,
+      accessVersion: 1
+    }
+  });
+
+  return res.status(200).send({
+    message: 'Successfully revoked all sessions.'
+  }); 
+}
+
 /**
  * Return user is authenticated
  * @param req
@@ -223,49 +236,53 @@ export const checkAuth = async (req: Request, res: Response) => {
 }
 
 /**
- * Return new token by redeeming refresh token
+ * Return new JWT access token by first validating the refresh token
  * @param req
  * @param res
  * @returns
  */
 export const getNewToken = async (req: Request, res: Response) => {
-  try {
-    const refreshToken = req.cookies.jid;
+  const refreshToken = req.cookies.jid;
 
-    if (!refreshToken) {
-      throw new Error('Failed to find token in request cookies');
-    }
-
-    const decodedToken = <jwt.UserIDJwtPayload>(
-      jwt.verify(refreshToken, await getJwtRefreshSecret())
-    );
-
-    const user = await User.findOne({
-      _id: decodedToken.userId
-    }).select('+publicKey');
-
-    if (!user) throw new Error('Failed to authenticate unfound user');
-    if (!user?.publicKey)
-      throw new Error('Failed to authenticate not fully set up account');
-
-    const token = createToken({
-      payload: {
-        userId: decodedToken.userId
-      },
-      expiresIn: await getJwtAuthLifetime(),
-      secret: await getJwtAuthSecret()
-    });
-
-    return res.status(200).send({
-      token
-    });
-  } catch (err) {
-    Sentry.setUser(null);
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: 'Invalid request'
-    });
+  if (!refreshToken) {
+    throw new Error('Failed to find refresh token in request cookies');
   }
+
+  const decodedToken = <jwt.UserIDJwtPayload>(
+    jwt.verify(refreshToken, await getJwtRefreshSecret())
+  );
+
+  const user = await User.findOne({
+    _id: decodedToken.userId
+  }).select('+publicKey +refreshVersion +accessVersion');
+
+  if (!user) throw new Error('Failed to authenticate unfound user');
+  if (!user?.publicKey)
+    throw new Error('Failed to authenticate not fully set up account');
+  
+  const tokenVersion = await TokenVersion.findById(decodedToken.tokenVersionId);
+
+  if (!tokenVersion) throw UnauthorizedRequestError({
+    message: 'Failed to validate refresh token'
+  });
+
+  if (decodedToken.refreshVersion !== tokenVersion.refreshVersion) throw BadRequestError({
+    message: 'Failed to validate refresh token'
+  });
+
+  const token = createToken({
+    payload: {
+      userId: decodedToken.userId,
+      tokenVersionId: tokenVersion._id.toString(),
+      accessVersion: tokenVersion.refreshVersion
+    },
+    expiresIn: await getJwtAuthLifetime(),
+    secret: await getJwtAuthSecret()
+  });
+
+  return res.status(200).send({
+    token
+  });
 };
 
 export const handleAuthProviderCallback = (req: Request, res: Response) => {

backend/src/controllers/v1/botController.ts

@@ -1,6 +1,5 @@
 import { Request, Response } from 'express';
 import { Types } from 'mongoose';
-import * as Sentry from '@sentry/node';
 import { Bot, BotKey } from '../../models';
 import { createBot } from '../../helpers/bot';
 
@@ -17,33 +16,24 @@ interface BotKey {
  * @returns
  */
 export const getBotByWorkspaceId = async (req: Request, res: Response) => {
-    let bot;
-	try {
-        const { workspaceId } = req.params;
+  const { workspaceId } = req.params;
 
-        bot = await Bot.findOne({
-            workspace: workspaceId
-        });
-        
-        if (!bot) {
-            // case: bot doesn't exist for workspace with id [workspaceId]
-            // -> create a new bot and return it
-            bot = await createBot({
-                name: 'Infisical Bot',
-                workspaceId: new Types.ObjectId(workspaceId)
-            });
-        }
-	} catch (err) {
-        Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-        return res.status(400).send({
-			message: 'Failed to get bot for workspace'
-		});
-	}
+  let bot = await Bot.findOne({
+      workspace: workspaceId
+  });
+  
+  if (!bot) {
+      // case: bot doesn't exist for workspace with id [workspaceId]
+      // -> create a new bot and return it
+      bot = await createBot({
+          name: 'Infisical Bot',
+          workspaceId: new Types.ObjectId(workspaceId)
+      });
+  }
     
-    return res.status(200).send({
-        bot
-    });
+  return res.status(200).send({
+      bot
+  });
 };
 
 /**
@@ -53,54 +43,44 @@ export const getBotByWorkspaceId = async (req: Request, res: Response) => {
  * @returns
  */
 export const setBotActiveState = async (req: Request, res: Response) => {
-    let bot;
-	try {
-        const { isActive, botKey }: { isActive: boolean, botKey: BotKey } = req.body;
-        
-        if (isActive) {
-            // bot state set to active -> share workspace key with bot
-            if (!botKey?.encryptedKey || !botKey?.nonce) {
-                return res.status(400).send({
-                    message: 'Failed to set bot state to active - missing bot key'
-                });
-            }
-            
-            await BotKey.findOneAndUpdate({
-                workspace: req.bot.workspace
-            }, {
-                encryptedKey: botKey.encryptedKey,
-                nonce: botKey.nonce,
-                sender: req.user._id,
-                bot: req.bot._id,
-                workspace: req.bot.workspace
-            }, {
-                upsert: true,
-                new: true
-            });
-        } else {
-            // case: bot state set to inactive -> delete bot's workspace key
-            await BotKey.deleteOne({
-                bot: req.bot._id
+    const { isActive, botKey }: { isActive: boolean, botKey: BotKey } = req.body;
+    
+    if (isActive) {
+        // bot state set to active -> share workspace key with bot
+        if (!botKey?.encryptedKey || !botKey?.nonce) {
+            return res.status(400).send({
+                message: 'Failed to set bot state to active - missing bot key'
             });
         }
-
-        bot = await Bot.findOneAndUpdate({
-            _id: req.bot._id
+        
+        await BotKey.findOneAndUpdate({
+            workspace: req.bot.workspace
         }, {
-            isActive
+            encryptedKey: botKey.encryptedKey,
+            nonce: botKey.nonce,
+            sender: req.user._id,
+            bot: req.bot._id,
+            workspace: req.bot.workspace
         }, {
+            upsert: true,
             new: true
         });
-        
-        if (!bot) throw new Error('Failed to update bot active state');
-        
-	} catch (err) {
-        Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-        return res.status(400).send({
-			message: 'Failed to update bot active state'
-		});
-	}
+    } else {
+        // case: bot state set to inactive -> delete bot's workspace key
+        await BotKey.deleteOne({
+            bot: req.bot._id
+        });
+    }
+
+    let bot = await Bot.findOneAndUpdate({
+        _id: req.bot._id
+    }, {
+        isActive
+    }, {
+        new: true
+    });
+    
+    if (!bot) throw new Error('Failed to update bot active state');
     
     return res.status(200).send({
         bot

backend/src/controllers/v1/integrationAuthController.ts

@@ -1,6 +1,5 @@
 import { Request, Response } from 'express';
 import { Types } from 'mongoose';
-import * as Sentry from '@sentry/node';
 import {
 	IntegrationAuth,
 	Bot 
@@ -22,22 +21,13 @@ import { standardRequest } from '../../config/request';
  * Return integration authorization with id [integrationAuthId]
  */
 export const getIntegrationAuth = async (req: Request, res: Response) => {
-	let integrationAuth;
-	try {
-		const { integrationAuthId } = req.params;
-		integrationAuth = await IntegrationAuth.findById(integrationAuthId);
-		
-		if (!integrationAuth) return res.status(400).send({
-			message: 'Failed to find integration authorization'
-		});
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get integration authorization'
-		});	
-	}
-	
+  const { integrationAuthId } = req.params;
+  const integrationAuth = await IntegrationAuth.findById(integrationAuthId);
+  
+  if (!integrationAuth) return res.status(400).send({
+    message: 'Failed to find integration authorization'
+  });
+
 	return res.status(200).send({
 		integrationAuth
 	});
@@ -61,33 +51,25 @@ export const oAuthExchange = async (
 	req: Request,
 	res: Response
 ) => {
-	try {
-		const { workspaceId, code, integration } = req.body;
-		if (!INTEGRATION_SET.has(integration))
-			throw new Error('Failed to validate integration');
-		
-		const environments = req.membership.workspace?.environments || [];
-		if(environments.length === 0){
-			throw new Error("Failed to get environments")
-		}
-	
-		const integrationAuth = await IntegrationService.handleOAuthExchange({
-			workspaceId,
-			integration,
-			code,
-			environment: environments[0].slug,
-		});
-		
-		return res.status(200).send({
-			integrationAuth
-		});
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get OAuth2 code-token exchange'
-		});
-	}
+  const { workspaceId, code, integration } = req.body;
+  if (!INTEGRATION_SET.has(integration))
+    throw new Error('Failed to validate integration');
+  
+  const environments = req.membership.workspace?.environments || [];
+  if(environments.length === 0){
+    throw new Error("Failed to get environments")
+  }
+
+  const integrationAuth = await IntegrationService.handleOAuthExchange({
+    workspaceId,
+    integration,
+    code,
+    environment: environments[0].slug,
+  });
+  
+  return res.status(200).send({
+    integrationAuth
+  });
 };
 
 /**
@@ -104,55 +86,47 @@ export const saveIntegrationAccessToken = async (
 	// TODO: check if access token is valid for each integration
 
 	let integrationAuth;
-	try {
-		const {
-			workspaceId,
-			accessId,
-			accessToken,
-			integration
-		}: {
-			workspaceId: string;
-			accessId: string | null;
-			accessToken: string;
-			integration: string;
-		} = req.body;
+  const {
+    workspaceId,
+    accessId,
+    accessToken,
+    integration
+  }: {
+    workspaceId: string;
+    accessId: string | null;
+    accessToken: string;
+    integration: string;
+  } = req.body;
 
-		const bot = await Bot.findOne({
-            workspace: new Types.ObjectId(workspaceId),
-            isActive: true
-        });
-        
-        if (!bot) throw new Error('Bot must be enabled to save integration access token');
+  const bot = await Bot.findOne({
+          workspace: new Types.ObjectId(workspaceId),
+          isActive: true
+      });
+      
+      if (!bot) throw new Error('Bot must be enabled to save integration access token');
 
-		integrationAuth = await IntegrationAuth.findOneAndUpdate({
-            workspace: new Types.ObjectId(workspaceId),
-            integration
-        }, {
-            workspace: new Types.ObjectId(workspaceId),
-            integration,
-			algorithm: ALGORITHM_AES_256_GCM,
-			keyEncoding: ENCODING_SCHEME_UTF8
-		}, {
-            new: true,
-            upsert: true
-        });
-		
-		// encrypt and save integration access details
-		integrationAuth = await IntegrationService.setIntegrationAuthAccess({
-			integrationAuthId: integrationAuth._id.toString(),
-			accessId,
-			accessToken,
-			accessExpiresAt: undefined
-		});
-		
-		if (!integrationAuth) throw new Error('Failed to save integration access token');
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to save access token for integration'
-		});
-	}
+  integrationAuth = await IntegrationAuth.findOneAndUpdate({
+          workspace: new Types.ObjectId(workspaceId),
+          integration
+      }, {
+          workspace: new Types.ObjectId(workspaceId),
+          integration,
+    algorithm: ALGORITHM_AES_256_GCM,
+    keyEncoding: ENCODING_SCHEME_UTF8
+  }, {
+          new: true,
+          upsert: true
+      });
+  
+  // encrypt and save integration access details
+  integrationAuth = await IntegrationService.setIntegrationAuthAccess({
+    integrationAuthId: integrationAuth._id.toString(),
+    accessId,
+    accessToken,
+    accessExpiresAt: undefined
+  });
+  
+  if (!integrationAuth) throw new Error('Failed to save integration access token');
 	
 	return res.status(200).send({
 		integrationAuth
@@ -166,22 +140,13 @@ export const saveIntegrationAccessToken = async (
  * @returns
  */
 export const getIntegrationAuthApps = async (req: Request, res: Response) => {
-	let apps;
-	try {
-		const teamId = req.query.teamId as string;
-		
-		apps = await getApps({
-			integrationAuth: req.integrationAuth,
-			accessToken: req.accessToken,
-			...teamId && { teamId }
-		});
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: "Failed to get integration authorization applications",
-		});
-	}
+  const teamId = req.query.teamId as string;
+  
+  const apps = await getApps({
+    integrationAuth: req.integrationAuth,
+    accessToken: req.accessToken,
+    ...teamId && { teamId }
+  });
 
 	return res.status(200).send({
 		apps
@@ -402,19 +367,10 @@ export const getIntegrationAuthRailwayServices = async (req: Request, res: Respo
  * @returns
  */
 export const deleteIntegrationAuth = async (req: Request, res: Response) => {
-  let integrationAuth;
-  try {
-    integrationAuth = await revokeAccess({
-      integrationAuth: req.integrationAuth,
-      accessToken: req.accessToken,
-    });
-  } catch (err) {
-    Sentry.setUser({ email: req.user.email });
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: "Failed to delete integration authorization",
-    });
-  }
+  const integrationAuth = await revokeAccess({
+    integrationAuth: req.integrationAuth,
+    accessToken: req.accessToken,
+  });
 
   return res.status(200).send({
     integrationAuth,

backend/src/controllers/v1/integrationController.ts

@@ -1,6 +1,5 @@
 import { Request, Response } from 'express';
 import { Types } from 'mongoose';
-import * as Sentry from '@sentry/node';
 import { 
 	Integration
 } from '../../models';
@@ -14,62 +13,50 @@ import { eventPushSecrets } from '../../events';
  * @returns
  */
 export const createIntegration = async (req: Request, res: Response) => {
-	let integration;
-
-	try {
-		const {
-			integrationAuthId,
-			app,
-			appId,
-			isActive,
-			sourceEnvironment,
-			targetEnvironment,
-			targetEnvironmentId,
-      targetService,
-      targetServiceId,
-			owner,
-			path,
-			region
-		} = req.body;
-		
-		// TODO: validate [sourceEnvironment] and [targetEnvironment]
-
-		// initialize new integration after saving integration access token
-    integration = await new Integration({
-      workspace: req.integrationAuth.workspace._id,
-      environment: sourceEnvironment,
-      isActive,
-      app,
-			appId,
-			targetEnvironment,
-			targetEnvironmentId,
-      targetService,
-      targetServiceId,
-			owner,
-			path,
-			region,
-      integration: req.integrationAuth.integration,
-      integrationAuth: new Types.ObjectId(integrationAuthId)
-    }).save();
-		
-		if (integration) {
-			// trigger event - push secrets
-			EventService.handleEvent({
-				event: eventPushSecrets({
-					workspaceId: integration.workspace,
-          environment: sourceEnvironment
-				})
-			});
-		}
-
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to create integration'
-		});
-	}
+  const {
+    integrationAuthId,
+    app,
+    appId,
+    isActive,
+    sourceEnvironment,
+    targetEnvironment,
+    targetEnvironmentId,
+    targetService,
+    targetServiceId,
+    owner,
+    path,
+    region
+  } = req.body;
+  
+  // TODO: validate [sourceEnvironment] and [targetEnvironment]
 
+  // initialize new integration after saving integration access token
+  const integration = await new Integration({
+    workspace: req.integrationAuth.workspace._id,
+    environment: sourceEnvironment,
+    isActive,
+    app,
+    appId,
+    targetEnvironment,
+    targetEnvironmentId,
+    targetService,
+    targetServiceId,
+    owner,
+    path,
+    region,
+    integration: req.integrationAuth.integration,
+    integrationAuth: new Types.ObjectId(integrationAuthId)
+  }).save();
+  
+  if (integration) {
+    // trigger event - push secrets
+    EventService.handleEvent({
+      event: eventPushSecrets({
+        workspaceId: integration.workspace,
+        environment: sourceEnvironment
+      })
+    });
+  }
   return res.status(200).send({
     integration,
   });
@@ -82,52 +69,43 @@ export const createIntegration = async (req: Request, res: Response) => {
  * @returns
  */
 export const updateIntegration = async (req: Request, res: Response) => {
-  let integration;
 
   // TODO: add integration-specific validation to ensure that each
   // integration has the correct fields populated in [Integration]
 
-  try {
-    const {
+  const {
+    environment,
+    isActive,
+    app,
+    appId,
+    targetEnvironment,
+    owner, // github-specific integration param
+  } = req.body;
+
+  const integration = await Integration.findOneAndUpdate(
+    {
+      _id: req.integration._id,
+    },
+    {
       environment,
       isActive,
       app,
       appId,
       targetEnvironment,
-      owner, // github-specific integration param
-    } = req.body;
-
-    integration = await Integration.findOneAndUpdate(
-      {
-        _id: req.integration._id,
-      },
-      {
-        environment,
-        isActive,
-        app,
-        appId,
-        targetEnvironment,
-        owner,
-      },
-      {
-        new: true,
-      }
-    );
-
-    if (integration) {
-      // trigger event - push secrets
-      EventService.handleEvent({
-        event: eventPushSecrets({
-          workspaceId: integration.workspace,
-          environment
-        }),
-      });
+      owner,
+    },
+    {
+      new: true,
     }
-  } catch (err) {
-    Sentry.setUser({ email: req.user.email });
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: "Failed to update integration",
+  );
+
+  if (integration) {
+    // trigger event - push secrets
+    EventService.handleEvent({
+      event: eventPushSecrets({
+        workspaceId: integration.workspace,
+        environment
+      }),
     });
   }
 
@@ -144,22 +122,13 @@ export const updateIntegration = async (req: Request, res: Response) => {
  * @returns
  */
 export const deleteIntegration = async (req: Request, res: Response) => {
-  let integration;
-  try {
-    const { integrationId } = req.params;
+  const { integrationId } = req.params;
 
-    integration = await Integration.findOneAndDelete({
-      _id: integrationId,
-    });
+  const integration = await Integration.findOneAndDelete({
+    _id: integrationId,
+  });
 
-    if (!integration) throw new Error("Failed to find integration");
-  } catch (err) {
-    Sentry.setUser({ email: req.user.email });
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: "Failed to delete integration",
-    });
-  }
+  if (!integration) throw new Error("Failed to find integration");
 
   return res.status(200).send({
     integration,

backend/src/controllers/v1/keyController.ts

@@ -1,5 +1,4 @@
 import { Request, Response } from 'express';
-import * as Sentry from '@sentry/node';
 import { Key } from '../../models';
 import { findMembership } from '../../helpers/membership';
 
@@ -11,34 +10,26 @@ import { findMembership } from '../../helpers/membership';
  * @returns
  */
 export const uploadKey = async (req: Request, res: Response) => {
-	try {
-		const { workspaceId } = req.params;
-		const { key } = req.body;
+  const { workspaceId } = req.params;
+  const { key } = req.body;
 
-		// validate membership of receiver
-		const receiverMembership = await findMembership({
-			user: key.userId,
-			workspace: workspaceId
-		});
+  // validate membership of receiver
+  const receiverMembership = await findMembership({
+    user: key.userId,
+    workspace: workspaceId
+  });
 
-		if (!receiverMembership) {
-			throw new Error('Failed receiver membership validation for workspace');
-		}
+  if (!receiverMembership) {
+    throw new Error('Failed receiver membership validation for workspace');
+  }
 
-		await new Key({
-			encryptedKey: key.encryptedKey,
-			nonce: key.nonce,
-			sender: req.user._id,
-			receiver: key.userId,
-			workspace: workspaceId
-		}).save();
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to upload key to workspace'
-		});
-	}
+  await new Key({
+    encryptedKey: key.encryptedKey,
+    nonce: key.nonce,
+    sender: req.user._id,
+    receiver: key.userId,
+    workspace: workspaceId
+  }).save();
 
 	return res.status(200).send({
 		message: 'Successfully uploaded key to workspace'
@@ -52,25 +43,16 @@ export const uploadKey = async (req: Request, res: Response) => {
  * @returns
  */
 export const getLatestKey = async (req: Request, res: Response) => {
-	let latestKey;
-	try {
-		const { workspaceId } = req.params;
+  const { workspaceId } = req.params;
 
-		// get latest key
-		latestKey = await Key.find({
-			workspace: workspaceId,
-			receiver: req.user._id
-		})
-			.sort({ createdAt: -1 })
-			.limit(1)
-			.populate('sender', '+publicKey');
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get latest key'
-		});
-	}
+  // get latest key
+  const latestKey = await Key.find({
+    workspace: workspaceId,
+    receiver: req.user._id
+  })
+    .sort({ createdAt: -1 })
+    .limit(1)
+    .populate('sender', '+publicKey');
 
 	const resObj: any = {};
 
@@ -79,4 +61,4 @@ export const getLatestKey = async (req: Request, res: Response) => {
 	}
 
 	return res.status(200).send(resObj);
-};
+};

backend/src/controllers/v1/membershipController.ts

@@ -1,4 +1,3 @@
-import * as Sentry from '@sentry/node';
 import { Request, Response } from 'express';
 import { Membership, MembershipOrg, User, Key } from '../../models';
 import {
@@ -16,25 +15,16 @@ import { getSiteURL } from '../../config';
  * @returns
  */
 export const validateMembership = async (req: Request, res: Response) => {
-	try {
-		const { workspaceId } = req.params;
+  const { workspaceId } = req.params;
+  // validate membership
+  const membership = await findMembership({
+    user: req.user._id,
+    workspace: workspaceId
+  });
 
-		// validate membership
-		const membership = await findMembership({
-			user: req.user._id,
-			workspace: workspaceId
-		});
-
-		if (!membership) {
-			throw new Error('Failed to validate membership');
-		}
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed workspace connection check'
-		});
-	}
+  if (!membership) {
+    throw new Error('Failed to validate membership');
+  }
 
 	return res.status(200).send({
 		message: 'Workspace membership confirmed'
@@ -48,48 +38,39 @@ export const validateMembership = async (req: Request, res: Response) => {
  * @returns
  */
 export const deleteMembership = async (req: Request, res: Response) => {
-	let deletedMembership;
-	try {
-		const { membershipId } = req.params;
+  const { membershipId } = req.params;
 
-		// check if membership to delete exists
-		const membershipToDelete = await Membership.findOne({
-			_id: membershipId
-		}).populate('user');
+  // check if membership to delete exists
+  const membershipToDelete = await Membership.findOne({
+    _id: membershipId
+  }).populate('user');
 
-		if (!membershipToDelete) {
-			throw new Error(
-				"Failed to delete workspace membership that doesn't exist"
-			);
-		}
+  if (!membershipToDelete) {
+    throw new Error(
+      "Failed to delete workspace membership that doesn't exist"
+    );
+  }
 
-		// check if user is a member and admin of the workspace
-		// whose membership we wish to delete
-		const membership = await Membership.findOne({
-			user: req.user._id,
-			workspace: membershipToDelete.workspace
-		});
+  // check if user is a member and admin of the workspace
+  // whose membership we wish to delete
+  const membership = await Membership.findOne({
+    user: req.user._id,
+    workspace: membershipToDelete.workspace
+  });
 
-		if (!membership) {
-			throw new Error('Failed to validate workspace membership');
-		}
+  if (!membership) {
+    throw new Error('Failed to validate workspace membership');
+  }
 
-		if (membership.role !== ADMIN) {
-			// user is not an admin member of the workspace
-			throw new Error('Insufficient role for deleting workspace membership');
-		}
+  if (membership.role !== ADMIN) {
+    // user is not an admin member of the workspace
+    throw new Error('Insufficient role for deleting workspace membership');
+  }
 
-		// delete workspace membership
-		deletedMembership = await deleteMember({
-			membershipId: membershipToDelete._id.toString()
-		});
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to delete membership'
-		});
-	}
+  // delete workspace membership
+  const deletedMembership = await deleteMember({
+    membershipId: membershipToDelete._id.toString()
+  });
 
 	return res.status(200).send({
 		deletedMembership
@@ -103,49 +84,40 @@ export const deleteMembership = async (req: Request, res: Response) => {
  * @returns
  */
 export const changeMembershipRole = async (req: Request, res: Response) => {
-	let membershipToChangeRole;
-	try {
-		const { membershipId } = req.params;
-		const { role } = req.body;
+  const { membershipId } = req.params;
+  const { role } = req.body;
 
-		if (![ADMIN, MEMBER].includes(role)) {
-			throw new Error('Failed to validate role');
-		}
+  if (![ADMIN, MEMBER].includes(role)) {
+    throw new Error('Failed to validate role');
+  }
 
-		// validate target membership
-		membershipToChangeRole = await findMembership({
-			_id: membershipId
-		});
+  // validate target membership
+  const membershipToChangeRole = await findMembership({
+    _id: membershipId
+  });
 
-		if (!membershipToChangeRole) {
-			throw new Error('Failed to find membership to change role');
-		}
+  if (!membershipToChangeRole) {
+    throw new Error('Failed to find membership to change role');
+  }
 
-		// check if user is a member and admin of target membership's
-		// workspace
-		const membership = await findMembership({
-			user: req.user._id,
-			workspace: membershipToChangeRole.workspace
-		});
+  // check if user is a member and admin of target membership's
+  // workspace
+  const membership = await findMembership({
+    user: req.user._id,
+    workspace: membershipToChangeRole.workspace
+  });
 
-		if (!membership) {
-			throw new Error('Failed to validate membership');
-		}
+  if (!membership) {
+    throw new Error('Failed to validate membership');
+  }
 
-		if (membership.role !== ADMIN) {
-			// user is not an admin member of the workspace
-			throw new Error('Insufficient role for changing member roles');
-		}
+  if (membership.role !== ADMIN) {
+    // user is not an admin member of the workspace
+    throw new Error('Insufficient role for changing member roles');
+  }
 
-		membershipToChangeRole.role = role;
-		await membershipToChangeRole.save();
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to change membership role'
-		});
-	}
+  membershipToChangeRole.role = role;
+  await membershipToChangeRole.save();
 
 	return res.status(200).send({
 		membership: membershipToChangeRole
@@ -159,75 +131,66 @@ export const changeMembershipRole = async (req: Request, res: Response) => {
  * @returns
  */
 export const inviteUserToWorkspace = async (req: Request, res: Response) => {
-	let invitee, latestKey;
-	try {
-		const { workspaceId } = req.params;
-		const { email }: { email: string } = req.body;
+  const { workspaceId } = req.params;
+  const { email }: { email: string } = req.body;
 
-		invitee = await User.findOne({
-			email
-		}).select('+publicKey');
+  const invitee = await User.findOne({
+    email
+  }).select('+publicKey');
 
-		if (!invitee || !invitee?.publicKey)
-			throw new Error('Failed to validate invitee');
+  if (!invitee || !invitee?.publicKey)
+    throw new Error('Failed to validate invitee');
 
-		// validate invitee's workspace membership - ensure member isn't
-		// already a member of the workspace
-		const inviteeMembership = await Membership.findOne({
-			user: invitee._id,
-			workspace: workspaceId
-		});
+  // validate invitee's workspace membership - ensure member isn't
+  // already a member of the workspace
+  const inviteeMembership = await Membership.findOne({
+    user: invitee._id,
+    workspace: workspaceId
+  });
 
-		if (inviteeMembership)
-			throw new Error('Failed to add existing member of workspace');
+  if (inviteeMembership)
+    throw new Error('Failed to add existing member of workspace');
 
-		// validate invitee's organization membership - ensure that only
-		// (accepted) organization members can be added to the workspace
-		const membershipOrg = await MembershipOrg.findOne({
-			user: invitee._id,
-			organization: req.membership.workspace.organization,
-			status: ACCEPTED
-		});
+  // validate invitee's organization membership - ensure that only
+  // (accepted) organization members can be added to the workspace
+  const membershipOrg = await MembershipOrg.findOne({
+    user: invitee._id,
+    organization: req.membership.workspace.organization,
+    status: ACCEPTED
+  });
 
-		if (!membershipOrg)
-			throw new Error("Failed to validate invitee's organization membership");
+  if (!membershipOrg)
+    throw new Error("Failed to validate invitee's organization membership");
 
-		// get latest key
-		latestKey = await Key.findOne({
-			workspace: workspaceId,
-			receiver: req.user._id
-		})
-			.sort({ createdAt: -1 })
-			.populate('sender', '+publicKey');
+  // get latest key
+  const latestKey = await Key.findOne({
+    workspace: workspaceId,
+    receiver: req.user._id
+  })
+    .sort({ createdAt: -1 })
+    .populate('sender', '+publicKey');
 
-		// create new workspace membership
-		const m = await new Membership({
-			user: invitee._id,
-			workspace: workspaceId,
-			role: MEMBER
-		}).save();
+  // create new workspace membership
+  const m = await new Membership({
+    user: invitee._id,
+    workspace: workspaceId,
+    role: MEMBER
+  }).save();
 
-		await sendMail({
-			template: 'workspaceInvitation.handlebars',
-			subjectLine: 'Infisical workspace invitation',
-			recipients: [invitee.email],
-			substitutions: {
-				inviterFirstName: req.user.firstName,
-				inviterEmail: req.user.email,
-				workspaceName: req.membership.workspace.name,
-				callback_url: (await getSiteURL()) + '/login'
-			}
-		});
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to invite user to workspace'
-		});
-	}
+  await sendMail({
+    template: 'workspaceInvitation.handlebars',
+    subjectLine: 'Infisical workspace invitation',
+    recipients: [invitee.email],
+    substitutions: {
+      inviterFirstName: req.user.firstName,
+      inviterEmail: req.user.email,
+      workspaceName: req.membership.workspace.name,
+      callback_url: (await getSiteURL()) + '/login'
+    }
+  });
 
 	return res.status(200).send({
 		invitee,
 		latestKey
 	});
-};
+};

backend/src/controllers/v1/membershipOrgController.ts

@@ -1,14 +1,15 @@
 import { Types } from 'mongoose';
 import { Request, Response } from 'express';
-import * as Sentry from '@sentry/node';
 import { MembershipOrg, Organization, User } from '../../models';
 import { deleteMembershipOrg as deleteMemberFromOrg } from '../../helpers/membershipOrg';
 import { createToken } from '../../helpers/auth';
 import { updateSubscriptionOrgQuantity } from '../../helpers/organization';
 import { sendMail } from '../../helpers/nodemailer';
 import { TokenService } from '../../services';
+import { EELicenseService } from '../../ee/services';
 import { OWNER, ADMIN, MEMBER, ACCEPTED, INVITED, TOKEN_EMAIL_ORG_INVITATION } from '../../variables';
 import { getSiteURL, getJwtSignupLifetime, getJwtSignupSecret, getSmtpConfigured } from '../../config';
+import { validateUserEmail } from '../../validation';
 
 /**
  * Delete organization membership with id [membershipOrgId] from organization
@@ -17,52 +18,43 @@ import { getSiteURL, getJwtSignupLifetime, getJwtSignupSecret, getSmtpConfigured
  * @returns
  */
 export const deleteMembershipOrg = async (req: Request, res: Response) => {
-	let membershipOrgToDelete;
-	try {
-		const { membershipOrgId } = req.params;
+  const { membershipOrgId } = req.params;
 
-		// check if organization membership to delete exists
-		membershipOrgToDelete = await MembershipOrg.findOne({
-			_id: membershipOrgId
-		}).populate('user');
+  // check if organization membership to delete exists
+  const membershipOrgToDelete = await MembershipOrg.findOne({
+    _id: membershipOrgId
+  }).populate('user');
 
-		if (!membershipOrgToDelete) {
-			throw new Error(
-				"Failed to delete organization membership that doesn't exist"
-			);
-		}
+  if (!membershipOrgToDelete) {
+    throw new Error(
+      "Failed to delete organization membership that doesn't exist"
+    );
+  }
 
-		// check if user is a member and admin of the organization
-		// whose membership we wish to delete
-		const membershipOrg = await MembershipOrg.findOne({
-			user: req.user._id,
-			organization: membershipOrgToDelete.organization
-		});
+  // check if user is a member and admin of the organization
+  // whose membership we wish to delete
+  const membershipOrg = await MembershipOrg.findOne({
+    user: req.user._id,
+    organization: membershipOrgToDelete.organization
+  });
 
-		if (!membershipOrg) {
-			throw new Error('Failed to validate organization membership');
-		}
+  if (!membershipOrg) {
+    throw new Error('Failed to validate organization membership');
+  }
 
-		if (membershipOrg.role !== OWNER && membershipOrg.role !== ADMIN) {
-			// user is not an admin member of the organization
-			throw new Error('Insufficient role for deleting organization membership');
-		}
+  if (membershipOrg.role !== OWNER && membershipOrg.role !== ADMIN) {
+    // user is not an admin member of the organization
+    throw new Error('Insufficient role for deleting organization membership');
+  }
 
-		// delete organization membership
-		const deletedMembershipOrg = await deleteMemberFromOrg({
-			membershipOrgId: membershipOrgToDelete._id.toString()
-		});
+  // delete organization membership
+  const deletedMembershipOrg = await deleteMemberFromOrg({
+    membershipOrgId: membershipOrgToDelete._id.toString()
+  });
 
-		await updateSubscriptionOrgQuantity({
-			organizationId: membershipOrg.organization.toString()
-		});
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to delete organization membership'
-		});
-	}
+  await updateSubscriptionOrgQuantity({
+    organizationId: membershipOrg.organization.toString()
+  });
 
 	return membershipOrgToDelete;
 };
@@ -78,14 +70,6 @@ export const changeMembershipOrgRole = async (req: Request, res: Response) => {
 	// [membershipOrgId]
 
 	let membershipToChangeRole;
-	// try {
-	// } catch (err) {
-	// 	Sentry.setUser({ email: req.user.email });
-	// 	Sentry.captureException(err);
-	// 	return res.status(400).send({
-	// 		message: 'Failed to change organization membership role'
-	// 	});
-	// }
 
 	return res.status(200).send({
 		membershipOrg: membershipToChangeRole
@@ -101,106 +85,114 @@ export const changeMembershipOrgRole = async (req: Request, res: Response) => {
  */
 export const inviteUserToOrganization = async (req: Request, res: Response) => {
 	let invitee, inviteeMembershipOrg, completeInviteLink;
-	try {
-		const { organizationId, inviteeEmail } = req.body;
-		const host = req.headers.host;
-		const siteUrl = `${req.protocol}://${host}`;
+  const { organizationId, inviteeEmail } = req.body;
+  const host = req.headers.host;
+  const siteUrl = `${req.protocol}://${host}`;
 
-		// validate membership
-		const membershipOrg = await MembershipOrg.findOne({
-			user: req.user._id,
-			organization: organizationId
-		});
+  // validate membership
+  const membershipOrg = await MembershipOrg.findOne({
+    user: req.user._id,
+    organization: organizationId
+  });
 
-		if (!membershipOrg) {
-			throw new Error('Failed to validate organization membership');
-		}
+  if (!membershipOrg) {
+    throw new Error('Failed to validate organization membership');
+  }
+  
+  const plan = await EELicenseService.getOrganizationPlan(organizationId);
+  
+  if (plan.memberLimit !== null) {
+    // case: limit imposed on number of members allowed
+    
+    if (plan.membersUsed >= plan.memberLimit) {
+      // case: number of members used exceeds the number of members allowed
+      return res.status(400).send({
+        message: 'Failed to invite member due to member limit reached. Upgrade plan to invite more members.'
+      });
+    }
+  }
 
-		invitee = await User.findOne({
-			email: inviteeEmail
-		}).select('+publicKey');
+  invitee = await User.findOne({
+    email: inviteeEmail
+  }).select('+publicKey');
 
-		if (invitee) {
-			// case: invitee is an existing user
+  if (invitee) {
+    // case: invitee is an existing user
 
-			inviteeMembershipOrg = await MembershipOrg.findOne({
-				user: invitee._id,
-				organization: organizationId
-			});
+    inviteeMembershipOrg = await MembershipOrg.findOne({
+      user: invitee._id,
+      organization: organizationId
+    });
 
-			if (inviteeMembershipOrg && inviteeMembershipOrg.status === ACCEPTED) {
-				throw new Error(
-					'Failed to invite an existing member of the organization'
-				);
-			}
+    if (inviteeMembershipOrg && inviteeMembershipOrg.status === ACCEPTED) {
+      throw new Error(
+        'Failed to invite an existing member of the organization'
+      );
+    }
 
-			if (!inviteeMembershipOrg) {
-				
-				await new MembershipOrg({
-					user: invitee,
-					inviteEmail: inviteeEmail,
-					organization: organizationId,
-					role: MEMBER,
-					status: INVITED
-				}).save();
-			}
-		} else {
-			// check if invitee has been invited before
-			inviteeMembershipOrg = await MembershipOrg.findOne({
-				inviteEmail: inviteeEmail,
-				organization: organizationId
-			});
+    if (!inviteeMembershipOrg) {
+      
+      await new MembershipOrg({
+        user: invitee,
+        inviteEmail: inviteeEmail,
+        organization: organizationId,
+        role: MEMBER,
+        status: INVITED
+      }).save();
+    }
+  } else {
+    // check if invitee has been invited before
+    inviteeMembershipOrg = await MembershipOrg.findOne({
+      inviteEmail: inviteeEmail,
+      organization: organizationId
+    });
 
-			if (!inviteeMembershipOrg) {
-				// case: invitee has never been invited before
+    if (!inviteeMembershipOrg) {
+      // case: invitee has never been invited before
+      
+      // validate that email is not disposable
+      validateUserEmail(inviteeEmail);
 
-				await new MembershipOrg({
-					inviteEmail: inviteeEmail,
-					organization: organizationId,
-					role: MEMBER,
-					status: INVITED
-				}).save();
-			}
-		}
+      await new MembershipOrg({
+        inviteEmail: inviteeEmail,
+        organization: organizationId,
+        role: MEMBER,
+        status: INVITED
+      }).save();
+    }
+  }
 
-		const organization = await Organization.findOne({ _id: organizationId });
+  const organization = await Organization.findOne({ _id: organizationId });
 
-		if (organization) {
+  if (organization) {
 
-			const token = await TokenService.createToken({
-				type: TOKEN_EMAIL_ORG_INVITATION,
-				email: inviteeEmail,
-				organizationId: organization._id
-			});
+    const token = await TokenService.createToken({
+      type: TOKEN_EMAIL_ORG_INVITATION,
+      email: inviteeEmail,
+      organizationId: organization._id
+    });
 
-			await sendMail({
-				template: 'organizationInvitation.handlebars',
-				subjectLine: 'Infisical organization invitation',
-				recipients: [inviteeEmail],
-				substitutions: {
-					inviterFirstName: req.user.firstName,
-					inviterEmail: req.user.email,
-					organizationName: organization.name,
-					email: inviteeEmail,
-					organizationId: organization._id.toString(),
-					token,
-					callback_url: (await getSiteURL()) + '/signupinvite'
-				}
-			});
+    await sendMail({
+      template: 'organizationInvitation.handlebars',
+      subjectLine: 'Infisical organization invitation',
+      recipients: [inviteeEmail],
+      substitutions: {
+        inviterFirstName: req.user.firstName,
+        inviterEmail: req.user.email,
+        organizationName: organization.name,
+        email: inviteeEmail,
+        organizationId: organization._id.toString(),
+        token,
+        callback_url: (await getSiteURL()) + '/signupinvite'
+      }
+    });
 
-			if (!(await getSmtpConfigured())) {
-				completeInviteLink = `${siteUrl + '/signupinvite'}?token=${token}&to=${inviteeEmail}&organization_id=${organization._id}`
-			}
-		}
+    if (!(await getSmtpConfigured())) {
+      completeInviteLink = `${siteUrl + '/signupinvite'}?token=${token}&to=${inviteeEmail}&organization_id=${organization._id}`
+    }
+  }
 
-		await updateSubscriptionOrgQuantity({ organizationId });
-	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to send organization invite'
-		});
-	}
+  await updateSubscriptionOrgQuantity({ organizationId });
 
 	return res.status(200).send({
 		message: `Sent an invite link to ${req.body.inviteeEmail}`,
@@ -216,70 +208,62 @@ export const inviteUserToOrganization = async (req: Request, res: Response) => {
  * @returns
  */
 export const verifyUserToOrganization = async (req: Request, res: Response) => {
-	let user, token;
-	try {
-		const {
-			email,
-			organizationId,
-			code
-		} = req.body;
+	let user;
+  const {
+    email,
+    organizationId,
+    code
+  } = req.body;
 
-		user = await User.findOne({ email }).select('+publicKey');
+  user = await User.findOne({ email }).select('+publicKey');
 
-		const membershipOrg = await MembershipOrg.findOne({
-			inviteEmail: email,
-			status: INVITED,
-			organization: new Types.ObjectId(organizationId)
-		});
+  const membershipOrg = await MembershipOrg.findOne({
+    inviteEmail: email,
+    status: INVITED,
+    organization: new Types.ObjectId(organizationId)
+  });
 
-		if (!membershipOrg)
-			throw new Error('Failed to find any invitations for email');
+  if (!membershipOrg)
+    throw new Error('Failed to find any invitations for email');
 
-		await TokenService.validateToken({
-			type: TOKEN_EMAIL_ORG_INVITATION,
-			email,
-			organizationId: membershipOrg.organization,
-			token: code
-		});
+  await TokenService.validateToken({
+    type: TOKEN_EMAIL_ORG_INVITATION,
+    email,
+    organizationId: membershipOrg.organization,
+    token: code
+  });
 
-		if (user && user?.publicKey) {
-			// case: user has already completed account
-			// membership can be approved and redirected to login/dashboard
-			membershipOrg.status = ACCEPTED;
-			await membershipOrg.save();
-			
-			await updateSubscriptionOrgQuantity({
-				organizationId
-			});
+  if (user && user?.publicKey) {
+    // case: user has already completed account
+    // membership can be approved and redirected to login/dashboard
+    membershipOrg.status = ACCEPTED;
+    await membershipOrg.save();
+    
+    await updateSubscriptionOrgQuantity({
+      organizationId
+    });
 
-			return res.status(200).send({
-				message: 'Successfully verified email',
-				user,
-			});
-		}
+    return res.status(200).send({
+      message: 'Successfully verified email',
+      user,
+    });
+  }
 
-		if (!user) {
-			// initialize user account
-			user = await new User({
-				email
-			}).save();
-		}
+  if (!user) {
+    // initialize user account
+    user = await new User({
+      email
+    }).save();
+  }
 
-		// generate temporary signup token
-		token = createToken({
-			payload: {
-				userId: user._id.toString()
-			},
-			expiresIn: await getJwtSignupLifetime(),
-			secret: await getJwtSignupSecret()
-		});
-	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-		return res.status(400).send({
-			error: 'Failed email magic link verification for organization invitation'
-		});
-	}
+  // generate temporary signup token
+  const token = createToken({
+    payload: {
+      userId: user._id.toString()
+    },
+    expiresIn: await getJwtSignupLifetime(),
+    secret: await getJwtSignupSecret()
+  });
 
 	return res.status(200).send({
 		message: 'Successfully verified email',

backend/src/controllers/v1/organizationController.ts

@@ -1,4 +1,3 @@
-import * as Sentry from '@sentry/node';
 import { Request, Response } from 'express';
 import Stripe from 'stripe';
 import {
@@ -15,21 +14,12 @@ import _ from 'lodash';
 import { getStripeSecretKey, getSiteURL } from '../../config';
 
 export const getOrganizations = async (req: Request, res: Response) => {
-	let organizations;
-	try {
-		organizations = (
-			await MembershipOrg.find({
-				user: req.user._id,
-				status: ACCEPTED
-			}).populate('organization')
-		).map((m) => m.organization);
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get organizations'
-		});
-	}
+  const organizations = (
+    await MembershipOrg.find({
+      user: req.user._id,
+      status: ACCEPTED
+    }).populate('organization')
+  ).map((m) => m.organization);
 
 	return res.status(200).send({
 		organizations
@@ -44,33 +34,24 @@ export const getOrganizations = async (req: Request, res: Response) => {
  * @returns
  */
 export const createOrganization = async (req: Request, res: Response) => {
-	let organization;
-	try {
-		const { organizationName } = req.body;
+  const { organizationName } = req.body;
 
-		if (organizationName.length < 1) {
-			throw new Error('Organization names must be at least 1-character long');
-		}
+  if (organizationName.length < 1) {
+    throw new Error('Organization names must be at least 1-character long');
+  }
 
-		// create organization and add user as member
-		organization = await create({
-			email: req.user.email,
-			name: organizationName
-		});
+  // create organization and add user as member
+  const organization = await create({
+    email: req.user.email,
+    name: organizationName
+  });
 
-		await addMembershipsOrg({
-			userIds: [req.user._id.toString()],
-			organizationId: organization._id.toString(),
-			roles: [OWNER],
-			statuses: [ACCEPTED]
-		});
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to create organization'
-		});
-	}
+  await addMembershipsOrg({
+    userIds: [req.user._id.toString()],
+    organizationId: organization._id.toString(),
+    roles: [OWNER],
+    statuses: [ACCEPTED]
+  });
 
 	return res.status(200).send({
 		organization
@@ -84,17 +65,7 @@ export const createOrganization = async (req: Request, res: Response) => {
  * @returns
  */
 export const getOrganization = async (req: Request, res: Response) => {
-	let organization;
-	try {
-		organization = req.organization
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to find organization'
-		});
-	}
-
+	const organization = req.organization
 	return res.status(200).send({
 		organization
 	});
@@ -107,20 +78,11 @@ export const getOrganization = async (req: Request, res: Response) => {
  * @returns
  */
 export const getOrganizationMembers = async (req: Request, res: Response) => {
-	let users;
-	try {
-		const { organizationId } = req.params;
+  const { organizationId } = req.params;
 
-		users = await MembershipOrg.find({
-			organization: organizationId
-		}).populate('user', '+publicKey');
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get organization members'
-		});
-	}
+  const users = await MembershipOrg.find({
+    organization: organizationId
+  }).populate('user', '+publicKey');
 
 	return res.status(200).send({
 		users
@@ -137,35 +99,26 @@ export const getOrganizationWorkspaces = async (
 	req: Request,
 	res: Response
 ) => {
-	let workspaces;
-	try {
-		const { organizationId } = req.params;
+  const { organizationId } = req.params;
 
-		const workspacesSet = new Set(
-			(
-				await Workspace.find(
-					{
-						organization: organizationId
-					},
-					'_id'
-				)
-			).map((w) => w._id.toString())
-		);
+  const workspacesSet = new Set(
+    (
+      await Workspace.find(
+        {
+          organization: organizationId
+        },
+        '_id'
+      )
+    ).map((w) => w._id.toString())
+  );
 
-		workspaces = (
-			await Membership.find({
-				user: req.user._id
-			}).populate('workspace')
-		)
-			.filter((m) => workspacesSet.has(m.workspace._id.toString()))
-			.map((m) => m.workspace);
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get my workspaces'
-		});
-	}
+  const workspaces = (
+    await Membership.find({
+      user: req.user._id
+    }).populate('workspace')
+  )
+    .filter((m) => workspacesSet.has(m.workspace._id.toString()))
+    .map((m) => m.workspace);
 
 	return res.status(200).send({
 		workspaces
@@ -179,29 +132,20 @@ export const getOrganizationWorkspaces = async (
  * @returns
  */
 export const changeOrganizationName = async (req: Request, res: Response) => {
-	let organization;
-	try {
-		const { organizationId } = req.params;
-		const { name } = req.body;
+  const { organizationId } = req.params;
+  const { name } = req.body;
 
-		organization = await Organization.findOneAndUpdate(
-			{
-				_id: organizationId
-			},
-			{
-				name
-			},
-			{
-				new: true
-			}
-		);
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to change organization name'
-		});
-	}
+  const organization = await Organization.findOneAndUpdate(
+    {
+      _id: organizationId
+    },
+    {
+      name
+    },
+    {
+      new: true
+    }
+  );
 
 	return res.status(200).send({
 		message: 'Successfully changed organization name',
@@ -219,20 +163,11 @@ export const getOrganizationIncidentContacts = async (
 	req: Request,
 	res: Response
 ) => {
-	let incidentContactsOrg;
-	try {
-		const { organizationId } = req.params;
+  const { organizationId } = req.params;
 
-		incidentContactsOrg = await IncidentContactOrg.find({
-			organization: organizationId
-		});
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get organization incident contacts'
-		});
-	}
+  const incidentContactsOrg = await IncidentContactOrg.find({
+    organization: organizationId
+  });
 
 	return res.status(200).send({
 		incidentContactsOrg
@@ -249,23 +184,14 @@ export const addOrganizationIncidentContact = async (
 	req: Request,
 	res: Response
 ) => {
-	let incidentContactOrg;
-	try {
-		const { organizationId } = req.params;
-		const { email } = req.body;
+  const { organizationId } = req.params;
+  const { email } = req.body;
 
-		incidentContactOrg = await IncidentContactOrg.findOneAndUpdate(
-			{ email, organization: organizationId },
-			{ email, organization: organizationId },
-			{ upsert: true, new: true }
-		);
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to add incident contact for organization'
-		});
-	}
+  const incidentContactOrg = await IncidentContactOrg.findOneAndUpdate(
+    { email, organization: organizationId },
+    { email, organization: organizationId },
+    { upsert: true, new: true }
+  );
 
 	return res.status(200).send({
 		incidentContactOrg
@@ -282,22 +208,13 @@ export const deleteOrganizationIncidentContact = async (
 	req: Request,
 	res: Response
 ) => {
-	let incidentContactOrg;
-	try {
-		const { organizationId } = req.params;
-		const { email } = req.body;
+  const { organizationId } = req.params;
+  const { email } = req.body;
 
-		incidentContactOrg = await IncidentContactOrg.findOneAndDelete({
-			email,
-			organization: organizationId
-		});
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to delete organization incident contact'
-		});
-	}
+  const incidentContactOrg = await IncidentContactOrg.findOneAndDelete({
+    email,
+    organization: organizationId
+  });
 
 	return res.status(200).send({
 		message: 'Successfully deleted organization incident contact',
@@ -317,41 +234,33 @@ export const createOrganizationPortalSession = async (
 	res: Response
 ) => {
 	let session;
-	try {
-		const stripe = new Stripe(await getStripeSecretKey(), {
-			apiVersion: '2022-08-01'
-		});
+  const stripe = new Stripe(await getStripeSecretKey(), {
+    apiVersion: '2022-08-01'
+  });
 
-		// check if there is a payment method on file
-		const paymentMethods = await stripe.paymentMethods.list({
-			customer: req.organization.customerId,
-			type: 'card'
-		});
-		
-		if (paymentMethods.data.length < 1) {
-			// case: no payment method on file
-			session = await stripe.checkout.sessions.create({
-				customer: req.organization.customerId,
-				mode: 'setup',
-				payment_method_types: ['card'],
-				success_url: (await getSiteURL()) + '/dashboard',
-				cancel_url: (await getSiteURL()) + '/dashboard'
-			});
-		} else {
-			session = await stripe.billingPortal.sessions.create({
-				customer: req.organization.customerId,
-				return_url: (await getSiteURL()) + '/dashboard'
-			});
-		}
+  // check if there is a payment method on file
+  const paymentMethods = await stripe.paymentMethods.list({
+    customer: req.organization.customerId,
+    type: 'card'
+  });
+  
+  if (paymentMethods.data.length < 1) {
+    // case: no payment method on file
+    session = await stripe.checkout.sessions.create({
+      customer: req.organization.customerId,
+      mode: 'setup',
+      payment_method_types: ['card'],
+      success_url: (await getSiteURL()) + '/dashboard',
+      cancel_url: (await getSiteURL()) + '/dashboard'
+    });
+  } else {
+    session = await stripe.billingPortal.sessions.create({
+      customer: req.organization.customerId,
+      return_url: (await getSiteURL()) + '/dashboard'
+    });
+  }
 
-		return res.status(200).send({ url: session.url });
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to redirect to organization billing portal'
-		});
-	}
+  return res.status(200).send({ url: session.url });
 };
 
 /**
@@ -364,22 +273,13 @@ export const getOrganizationSubscriptions = async (
 	req: Request,
 	res: Response
 ) => {
-	let subscriptions;
-	try {
-		const stripe = new Stripe(await getStripeSecretKey(), {
-			apiVersion: '2022-08-01'
-		});
-		
-		subscriptions = await stripe.subscriptions.list({
-			customer: req.organization.customerId
-		});
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get organization subscriptions'
-		});
-	}
+  const stripe = new Stripe(await getStripeSecretKey(), {
+    apiVersion: '2022-08-01'
+  });
+  
+  const subscriptions = await stripe.subscriptions.list({
+    customer: req.organization.customerId
+  });
 
 	return res.status(200).send({
 		subscriptions
@@ -425,4 +325,4 @@ export const getOrganizationMembersAndTheirWorkspaces = async (
 	});
 
 	return res.json(userToWorkspaceIds);
-};
+};

backend/src/controllers/v1/passwordController.ts

@@ -1,15 +1,25 @@
 import { Request, Response } from 'express';
-import * as Sentry from '@sentry/node';
 // eslint-disable-next-line @typescript-eslint/no-var-requires
 const jsrp = require('jsrp');
 import * as bigintConversion from 'bigint-conversion';
 import { User, BackupPrivateKey, LoginSRPDetail } from '../../models';
-import { createToken } from '../../helpers/auth';
-import { sendMail } from '../../helpers/nodemailer';
+import {
+	createToken,
+	sendMail,
+	clearTokens
+} from '../../helpers';
 import { TokenService } from '../../services';
-import { TOKEN_EMAIL_PASSWORD_RESET } from '../../variables';
+import { 
+	TOKEN_EMAIL_PASSWORD_RESET,
+	AUTH_MODE_JWT
+} from '../../variables';
 import { BadRequestError } from '../../utils/errors';
-import { getSiteURL, getJwtSignupLifetime, getJwtSignupSecret } from '../../config';
+import { 
+	getSiteURL, 
+	getJwtSignupLifetime, 
+	getJwtSignupSecret,
+	getHttpsEnabled
+} from '../../config';
 
 /**
  * Password reset step 1: Send email verification link to email [email] 
@@ -20,43 +30,35 @@ import { getSiteURL, getJwtSignupLifetime, getJwtSignupSecret } from '../../conf
  */
 export const emailPasswordReset = async (req: Request, res: Response) => {
 	let email: string;
-	try {
-		email = req.body.email;
+  email = req.body.email;
 
-		const user = await User.findOne({ email }).select('+publicKey');
-		if (!user || !user?.publicKey) {
-			// case: user has already completed account
+  const user = await User.findOne({ email }).select('+publicKey');
+  if (!user || !user?.publicKey) {
+    // case: user has already completed account
 
-			return res.status(403).send({
-				error: 'Failed to send email verification for password reset'
-			});
-		}
-		
-		const token = await TokenService.createToken({
-			type: TOKEN_EMAIL_PASSWORD_RESET,
-			email
-		});
-		
-		await sendMail({
-			template: 'passwordReset.handlebars',
-			subjectLine: 'Infisical password reset',
-			recipients: [email],
-			substitutions: {
-				email,
-				token,
-				callback_url: (await getSiteURL()) + '/password-reset'
-			}
-		});
-	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to send email for account recovery'
-		});
-	}
+    return res.status(403).send({
+      message: "If an account exists with this email, a password reset link has been sent"
+    });
+  }
+  
+  const token = await TokenService.createToken({
+    type: TOKEN_EMAIL_PASSWORD_RESET,
+    email
+  });
+  
+  await sendMail({
+    template: 'passwordReset.handlebars',
+    subjectLine: 'Infisical password reset',
+    recipients: [email],
+    substitutions: {
+      email,
+      token,
+      callback_url: (await getSiteURL()) + '/password-reset'
+    }
+  });
 
 	return res.status(200).send({
-		message: `Sent an email for account recovery to ${email}`
+		message:"If an account exists with this email, a password reset link has been sent" 
 	});
 }
 
@@ -67,40 +69,31 @@ export const emailPasswordReset = async (req: Request, res: Response) => {
  * @returns 
  */
 export const emailPasswordResetVerify = async (req: Request, res: Response) => {
-	let user, token;
-	try {
-		const { email, code } = req.body;
+  const { email, code } = req.body;
 
-		user = await User.findOne({ email }).select('+publicKey');
-		if (!user || !user?.publicKey) {
-			// case: user doesn't exist with email [email] or 
-			// hasn't even completed their account
-			return res.status(403).send({
-				error: 'Failed email verification for password reset'
-			});
-		}
-		
-		await TokenService.validateToken({
-			type: TOKEN_EMAIL_PASSWORD_RESET,
-			email,
-			token: code
-		});
+  const user = await User.findOne({ email }).select('+publicKey');
+  if (!user || !user?.publicKey) {
+    // case: user doesn't exist with email [email] or 
+    // hasn't even completed their account
+    return res.status(403).send({
+      error: 'Failed email verification for password reset'
+    });
+  }
+  
+  await TokenService.validateToken({
+    type: TOKEN_EMAIL_PASSWORD_RESET,
+    email,
+    token: code
+  });
 
-		// generate temporary password-reset token
-		token = createToken({
-			payload: {
-				userId: user._id.toString()
-			},
-			expiresIn: await getJwtSignupLifetime(),
-			secret: await getJwtSignupSecret()
-		});
-	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed email verification for password reset'
-		});
-	}
+  // generate temporary password-reset token
+  const token = createToken({
+    payload: {
+      userId: user._id.toString()
+    },
+    expiresIn: await getJwtSignupLifetime(),
+    secret: await getJwtSignupSecret()
+  });
 
 	return res.status(200).send({
 		message: 'Successfully verified email',
@@ -117,44 +110,38 @@ export const emailPasswordResetVerify = async (req: Request, res: Response) => {
  */
 export const srp1 = async (req: Request, res: Response) => {
 	// return salt, serverPublicKey as part of first step of SRP protocol
-	try {
-		const { clientPublicKey } = req.body;
-		const user = await User.findOne({
-			email: req.user.email
-		}).select('+salt +verifier');
+	
+  const { clientPublicKey } = req.body;
+  const user = await User.findOne({
+    email: req.user.email
+  }).select('+salt +verifier');
 
-		if (!user) throw new Error('Failed to find user');
+  if (!user) throw new Error('Failed to find user');
 
-		const server = new jsrp.server();
-		server.init(
-			{
-				salt: user.salt,
-				verifier: user.verifier
-			},
-			async () => {
-				// generate server-side public key
-				const serverPublicKey = server.getPublicKey();
+  const server = new jsrp.server();
+  server.init(
+    {
+      salt: user.salt,
+      verifier: user.verifier
+    },
+    async () => {
+      // generate server-side public key
+      const serverPublicKey = server.getPublicKey();
 
-				await LoginSRPDetail.findOneAndReplace({ email: req.user.email }, {
-					email: req.user.email,
-					clientPublicKey: clientPublicKey,
-					serverBInt: bigintConversion.bigintToBuf(server.bInt),
-				}, { upsert: true, returnNewDocument: false })
+      await LoginSRPDetail.findOneAndReplace({ email: req.user.email }, {
+        email: req.user.email,
+        clientPublicKey: clientPublicKey,
+        serverBInt: bigintConversion.bigintToBuf(server.bInt),
+      }, { upsert: true, returnNewDocument: false })
+
+      return res.status(200).send({
+        serverPublicKey,
+        salt: user.salt
+      });
+    }
+  );
+}
 
-				return res.status(200).send({
-					serverPublicKey,
-					salt: user.salt
-				});
-			}
-		);
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			error: 'Failed to start change password process'
-		});
-	}
-};
 
 /**
  * Change account SRP authentication information for user
@@ -165,80 +152,85 @@ export const srp1 = async (req: Request, res: Response) => {
  * @returns
  */
 export const changePassword = async (req: Request, res: Response) => {
-	try {
-		const { 
-			clientProof, 
-			protectedKey,
-			protectedKeyIV,
-			protectedKeyTag,
-			encryptedPrivateKey,
-			encryptedPrivateKeyIV,
-			encryptedPrivateKeyTag,
-			salt,
-			verifier
-		} = req.body;
+  const { 
+    clientProof, 
+    protectedKey,
+    protectedKeyIV,
+    protectedKeyTag,
+    encryptedPrivateKey,
+    encryptedPrivateKeyIV,
+    encryptedPrivateKeyTag,
+    salt,
+    verifier
+  } = req.body;
 
-		const user = await User.findOne({
-			email: req.user.email
-		}).select('+salt +verifier');
+  const user = await User.findOne({
+    email: req.user.email
+  }).select('+salt +verifier');
 
-		if (!user) throw new Error('Failed to find user');
+  if (!user) throw new Error('Failed to find user');
 
-		const loginSRPDetailFromDB = await LoginSRPDetail.findOneAndDelete({ email: req.user.email })
+  const loginSRPDetailFromDB = await LoginSRPDetail.findOneAndDelete({ email: req.user.email })
 
-		if (!loginSRPDetailFromDB) {
-			return BadRequestError(Error("It looks like some details from the first login are not found. Please try login one again"))
-		}
+  if (!loginSRPDetailFromDB) {
+    return BadRequestError(Error("It looks like some details from the first login are not found. Please try login one again"))
+  }
 
-		const server = new jsrp.server();
-		server.init(
-			{
-				salt: user.salt,
-				verifier: user.verifier,
-				b: loginSRPDetailFromDB.serverBInt
-			},
-			async () => {
-				server.setClientPublicKey(loginSRPDetailFromDB.clientPublicKey);
+  const server = new jsrp.server();
+  server.init(
+    {
+      salt: user.salt,
+      verifier: user.verifier,
+      b: loginSRPDetailFromDB.serverBInt
+    },
+    async () => {
+      server.setClientPublicKey(loginSRPDetailFromDB.clientPublicKey);
 
-				// compare server and client shared keys
-				if (server.checkClientProof(clientProof)) {
-					// change password
+      // compare server and client shared keys
+      if (server.checkClientProof(clientProof)) {
+        // change password
 
-					await User.findByIdAndUpdate(
-						req.user._id.toString(),
-						{
-							encryptionVersion: 2,
-							protectedKey,
-							protectedKeyIV,
-							protectedKeyTag,
-							encryptedPrivateKey,
-							iv: encryptedPrivateKeyIV,
-							tag: encryptedPrivateKeyTag,
-							salt,
-							verifier
-						},
-						{
-							new: true
-						}
-					);
+        await User.findByIdAndUpdate(
+          req.user._id.toString(),
+          {
+            encryptionVersion: 2,
+            protectedKey,
+            protectedKeyIV,
+            protectedKeyTag,
+            encryptedPrivateKey,
+            iv: encryptedPrivateKeyIV,
+            tag: encryptedPrivateKeyTag,
+            salt,
+            verifier
+          },
+          {
+            new: true
+          }
+        );
+      
+        if (req.authData.authMode === AUTH_MODE_JWT && req.authData.authPayload instanceof User && req.authData.tokenVersionId) {
+          await clearTokens(req.authData.tokenVersionId)
+        }
 
-					return res.status(200).send({
-						message: 'Successfully changed password'
-					});
-				}
+        // clear httpOnly cookie
+        
+        res.cookie('jid', '', {
+          httpOnly: true,
+          path: '/',
+          sameSite: 'strict',
+          secure: (await getHttpsEnabled()) as boolean
+        });
 
-				return res.status(400).send({
-					error: 'Failed to change password. Try again?'
-				});
-			}
-		);
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			error: 'Failed to change password. Try again?'
-		});
-	}
+        return res.status(200).send({
+          message: 'Successfully changed password'
+        });
+      }
+
+      return res.status(400).send({
+        error: 'Failed to change password. Try again?'
+      });
+    }
+  );
 };
 
 /**
@@ -252,69 +244,61 @@ export const createBackupPrivateKey = async (req: Request, res: Response) => {
 	// requires verifying [clientProof] as part of second step of SRP protocol
 	// as initiated in /srp1
 
-	try {
-		const { clientProof, encryptedPrivateKey, iv, tag, salt, verifier } =
-			req.body;
-		const user = await User.findOne({
-			email: req.user.email
-		}).select('+salt +verifier');
+  const { clientProof, encryptedPrivateKey, iv, tag, salt, verifier } =
+    req.body;
+  const user = await User.findOne({
+    email: req.user.email
+  }).select('+salt +verifier');
 
-		if (!user) throw new Error('Failed to find user');
+  if (!user) throw new Error('Failed to find user');
 
-		const loginSRPDetailFromDB = await LoginSRPDetail.findOneAndDelete({ email: req.user.email })
+  const loginSRPDetailFromDB = await LoginSRPDetail.findOneAndDelete({ email: req.user.email })
 
-		if (!loginSRPDetailFromDB) {
-			return BadRequestError(Error("It looks like some details from the first login are not found. Please try login one again"))
-		}
+  if (!loginSRPDetailFromDB) {
+    return BadRequestError(Error("It looks like some details from the first login are not found. Please try login one again"))
+  }
 
-		const server = new jsrp.server();
-		server.init(
-			{
-				salt: user.salt,
-				verifier: user.verifier,
-				b: loginSRPDetailFromDB.serverBInt
-			},
-			async () => {
-				server.setClientPublicKey(
-					loginSRPDetailFromDB.clientPublicKey
-				);
+  const server = new jsrp.server();
+  server.init(
+    {
+      salt: user.salt,
+      verifier: user.verifier,
+      b: loginSRPDetailFromDB.serverBInt
+    },
+    async () => {
+      server.setClientPublicKey(
+        loginSRPDetailFromDB.clientPublicKey
+      );
 
-				// compare server and client shared keys
-				if (server.checkClientProof(clientProof)) {
-					// create new or replace backup private key
+      // compare server and client shared keys
+      if (server.checkClientProof(clientProof)) {
+        // create new or replace backup private key
 
-					const backupPrivateKey = await BackupPrivateKey.findOneAndUpdate(
-						{ user: req.user._id },
-						{
-							user: req.user._id,
-							encryptedPrivateKey,
-							iv,
-							tag,
-							salt,
-							verifier
-						},
-						{ upsert: true, new: true }
-					).select('+user, encryptedPrivateKey');
+        const backupPrivateKey = await BackupPrivateKey.findOneAndUpdate(
+          { user: req.user._id },
+          {
+            user: req.user._id,
+            encryptedPrivateKey,
+            iv,
+            tag,
+            salt,
+            verifier
+          },
+          { upsert: true, new: true }
+        ).select('+user, encryptedPrivateKey');
 
-					// issue tokens
-					return res.status(200).send({
-						message: 'Successfully updated backup private key',
-						backupPrivateKey
-					});
-				}
+        // issue tokens
+        return res.status(200).send({
+          message: 'Successfully updated backup private key',
+          backupPrivateKey
+        });
+      }
 
-				return res.status(400).send({
-					message: 'Failed to update backup private key'
-				});
-			}
-		);
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to update backup private key'
-		});
-	}
+      return res.status(400).send({
+        message: 'Failed to update backup private key'
+      });
+    }
+  );
 };
 
 /**
@@ -324,20 +308,11 @@ export const createBackupPrivateKey = async (req: Request, res: Response) => {
  * @returns 
  */
 export const getBackupPrivateKey = async (req: Request, res: Response) => {
-	let backupPrivateKey;
-	try {
-		backupPrivateKey = await BackupPrivateKey.findOne({
-			user: req.user._id
-		}).select('+encryptedPrivateKey +iv +tag');
+  const backupPrivateKey = await BackupPrivateKey.findOne({
+    user: req.user._id
+  }).select('+encryptedPrivateKey +iv +tag');
 
-		if (!backupPrivateKey) throw new Error('Failed to find backup private key');
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get backup private key'
-		});
-	}
+  if (!backupPrivateKey) throw new Error('Failed to find backup private key');
 
 	return res.status(200).send({
 		backupPrivateKey
@@ -345,44 +320,36 @@ export const getBackupPrivateKey = async (req: Request, res: Response) => {
 }
 
 export const resetPassword = async (req: Request, res: Response) => {
-	try {
-		const {
-			protectedKey,
-			protectedKeyIV,
-			protectedKeyTag,
-			encryptedPrivateKey,
-			encryptedPrivateKeyIV,
-			encryptedPrivateKeyTag,
-			salt,
-			verifier,
-		} = req.body;
+  const {
+    protectedKey,
+    protectedKeyIV,
+    protectedKeyTag,
+    encryptedPrivateKey,
+    encryptedPrivateKeyIV,
+    encryptedPrivateKeyTag,
+    salt,
+    verifier,
+  } = req.body;
 
-		await User.findByIdAndUpdate(
-			req.user._id.toString(),
-			{
-				encryptionVersion: 2,
-				protectedKey,
-				protectedKeyIV,
-				protectedKeyTag,	
-				encryptedPrivateKey,
-				iv: encryptedPrivateKeyIV,
-				tag: encryptedPrivateKeyTag,
-				salt,
-				verifier
-			},
-			{
-				new: true
-			}
-		);
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get backup private key'
-		});
-	}
+  await User.findByIdAndUpdate(
+    req.user._id.toString(),
+    {
+      encryptionVersion: 2,
+      protectedKey,
+      protectedKeyIV,
+      protectedKeyTag,	
+      encryptedPrivateKey,
+      iv: encryptedPrivateKeyIV,
+      tag: encryptedPrivateKeyTag,
+      salt,
+      verifier
+    },
+    {
+      new: true
+    }
+  );
 
 	return res.status(200).send({
 		message: 'Successfully reset password'
 	});
-}
+}

backend/src/controllers/v1/secretController.ts

@@ -1,5 +1,4 @@
 import { Request, Response } from 'express';
-import * as Sentry from '@sentry/node';
 import { Types } from 'mongoose';
 import { Key, Secret } from '../../models';
 import {
@@ -37,66 +36,56 @@ interface PushSecret {
  */
 export const pushSecrets = async (req: Request, res: Response) => {
 	// upload (encrypted) secrets to workspace with id [workspaceId]
+  const postHogClient = await TelemetryService.getPostHogClient();
+  let { secrets }: { secrets: PushSecret[] } = req.body;
+  const { keys, environment, channel } = req.body;
+  const { workspaceId } = req.params;
 
-	try {
-		const postHogClient = await TelemetryService.getPostHogClient();
-		let { secrets }: { secrets: PushSecret[] } = req.body;
-		const { keys, environment, channel } = req.body;
-		const { workspaceId } = req.params;
+  // validate environment
+  const workspaceEnvs = req.membership.workspace.environments;
+  if (!workspaceEnvs.find(({ slug }: { slug: string }) => slug === environment)) {
+    throw new Error('Failed to validate environment');
+  }
 
-		// validate environment
-		const workspaceEnvs = req.membership.workspace.environments;
-		if (!workspaceEnvs.find(({ slug }: { slug: string }) => slug === environment)) {
-			throw new Error('Failed to validate environment');
-		}
+  // sanitize secrets
+  secrets = secrets.filter(
+    (s: PushSecret) => s.ciphertextKey !== '' && s.ciphertextValue !== ''
+  );
 
-		// sanitize secrets
-		secrets = secrets.filter(
-			(s: PushSecret) => s.ciphertextKey !== '' && s.ciphertextValue !== ''
-		);
+  await push({
+    userId: req.user._id,
+    workspaceId,
+    environment,
+    secrets
+  });
 
-		await push({
-			userId: req.user._id,
-			workspaceId,
-			environment,
-			secrets
-		});
+  await pushKeys({
+    userId: req.user._id,
+    workspaceId,
+    keys
+  });
+  
+  
+  if (postHogClient) {
+    postHogClient.capture({
+      event: 'secrets pushed',
+      distinctId: req.user.email,
+      properties: {
+        numberOfSecrets: secrets.length,
+        environment,
+        workspaceId,
+        channel: channel ? channel : 'cli'
+      }
+    });
+  }
 
-		await pushKeys({
-			userId: req.user._id,
-			workspaceId,
-			keys
-		});
-		
-		
-		if (postHogClient) {
-			postHogClient.capture({
-				event: 'secrets pushed',
-				distinctId: req.user.email,
-				properties: {
-					numberOfSecrets: secrets.length,
-					environment,
-					workspaceId,
-					channel: channel ? channel : 'cli'
-				}
-			});
-		}
-
-		// trigger event - push secrets
-		EventService.handleEvent({
-			event: eventPushSecrets({
-				workspaceId: new Types.ObjectId(workspaceId),
-				environment
-			})
-		});
-
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to upload workspace secrets'
-		});
-	}
+  // trigger event - push secrets
+  EventService.handleEvent({
+    event: eventPushSecrets({
+      workspaceId: new Types.ObjectId(workspaceId),
+      environment
+    })
+  });
 
 	return res.status(200).send({
 		message: 'Successfully uploaded workspace secrets'
@@ -113,55 +102,48 @@ export const pushSecrets = async (req: Request, res: Response) => {
 export const pullSecrets = async (req: Request, res: Response) => {
 	let secrets;
 	let key;
-	try {
-		const postHogClient = await TelemetryService.getPostHogClient();
-		const environment: string = req.query.environment as string;
-		const channel: string = req.query.channel as string;
-		const { workspaceId } = req.params;
 
-		// validate environment
-		const workspaceEnvs = req.membership.workspace.environments;
-		if (!workspaceEnvs.find(({ slug }: { slug: string }) => slug === environment)) {
-			throw new Error('Failed to validate environment');
-		}
+	const postHogClient = await TelemetryService.getPostHogClient();
+	const environment: string = req.query.environment as string;
+	const channel: string = req.query.channel as string;
+	const { workspaceId } = req.params;
 
-		secrets = await pull({
-			userId: req.user._id.toString(),
-			workspaceId,
-			environment,
-			channel: channel ? channel : 'cli',
-			ipAddress: req.ip
-		});
+	// validate environment
+	const workspaceEnvs = req.membership.workspace.environments;
+	if (!workspaceEnvs.find(({ slug }: { slug: string }) => slug === environment)) {
+		throw new Error('Failed to validate environment');
+	}
 
-		key = await Key.findOne({
-			workspace: workspaceId,
-			receiver: req.user._id
-		})
-			.sort({ createdAt: -1 })
-			.populate('sender', '+publicKey');
-		
-		if (channel !== 'cli') {
-			secrets = reformatPullSecrets({ secrets });
-		}
+	secrets = await pull({
+		userId: req.user._id.toString(),
+		workspaceId,
+		environment,
+		channel: channel ? channel : 'cli',
+		ipAddress: req.realIP
+	});
 
-		if (postHogClient) {
-			// capture secrets pushed event in production
-			postHogClient.capture({
-				distinctId: req.user.email,
-				event: 'secrets pulled',
-				properties: {
-					numberOfSecrets: secrets.length,
-					environment,
-					workspaceId,
-					channel: channel ? channel : 'cli'
-				}
-			});
-		}
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to pull workspace secrets'
+	key = await Key.findOne({
+		workspace: workspaceId,
+		receiver: req.user._id
+	})
+		.sort({ createdAt: -1 })
+		.populate('sender', '+publicKey');
+	
+	if (channel !== 'cli') {
+		secrets = reformatPullSecrets({ secrets });
+	}
+
+	if (postHogClient) {
+		// capture secrets pushed event in production
+		postHogClient.capture({
+			distinctId: req.user.email,
+			event: 'secrets pulled',
+			properties: {
+				numberOfSecrets: secrets.length,
+				environment,
+				workspaceId,
+				channel: channel ? channel : 'cli'
+			}
 		});
 	}
 
@@ -182,54 +164,47 @@ export const pullSecrets = async (req: Request, res: Response) => {
 export const pullSecretsServiceToken = async (req: Request, res: Response) => {
 	let secrets;
 	let key;
-	try {
-		const postHogClient = await TelemetryService.getPostHogClient();
-		const environment: string = req.query.environment as string;
-		const channel: string = req.query.channel as string;
-		const { workspaceId } = req.params;
 
-		// validate environment
-		const workspaceEnvs = req.membership.workspace.environments;
-		if (!workspaceEnvs.find(({ slug }: { slug: string }) => slug === environment)) {
-			throw new Error('Failed to validate environment');
-		}
+	const postHogClient = await TelemetryService.getPostHogClient();
+	const environment: string = req.query.environment as string;
+	const channel: string = req.query.channel as string;
+	const { workspaceId } = req.params;
 
-		secrets = await pull({
-			userId: req.serviceToken.user._id.toString(),
-			workspaceId,
-			environment,
-			channel: 'cli',
-			ipAddress: req.ip
-		});
+	// validate environment
+	const workspaceEnvs = req.membership.workspace.environments;
+	if (!workspaceEnvs.find(({ slug }: { slug: string }) => slug === environment)) {
+		throw new Error('Failed to validate environment');
+	}
 
-		key = {
-			encryptedKey: req.serviceToken.encryptedKey,
-			nonce: req.serviceToken.nonce,
-			sender: {
-				publicKey: req.serviceToken.publicKey
-			},
-			receiver: req.serviceToken.user,
-			workspace: req.serviceToken.workspace
-		};
+	secrets = await pull({
+		userId: req.serviceToken.user._id.toString(),
+		workspaceId,
+		environment,
+		channel: 'cli',
+		ipAddress: req.realIP
+	});
 
-		if (postHogClient) {
-			// capture secrets pulled event in production
-			postHogClient.capture({
-				distinctId: req.serviceToken.user.email,
-				event: 'secrets pulled',
-				properties: {
-					numberOfSecrets: secrets.length,
-					environment,
-					workspaceId,
-					channel: channel ? channel : 'cli'
-				}
-			});
-		}
-	} catch (err) {
-		Sentry.setUser({ email: req.serviceToken.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to pull workspace secrets'
+	key = {
+		encryptedKey: req.serviceToken.encryptedKey,
+		nonce: req.serviceToken.nonce,
+		sender: {
+			publicKey: req.serviceToken.publicKey
+		},
+		receiver: req.serviceToken.user,
+		workspace: req.serviceToken.workspace
+	};
+
+	if (postHogClient) {
+		// capture secrets pulled event in production
+		postHogClient.capture({
+			distinctId: req.serviceToken.user.email,
+			event: 'secrets pulled',
+			properties: {
+				numberOfSecrets: secrets.length,
+				environment,
+				workspaceId,
+				channel: channel ? channel : 'cli'
+			}
 		});
 	}
 
@@ -237,4 +212,4 @@ export const pullSecretsServiceToken = async (req: Request, res: Response) => {
 		secrets: reformatPullSecrets({ secrets }),
 		key
 	});
-};
+};

backend/src/controllers/v1/signupController.ts

@@ -1,5 +1,4 @@
 import { Request, Response } from 'express';
-import * as Sentry from '@sentry/node';
 import { User } from '../../models';
 import {
 	sendEmailVerification,
@@ -8,6 +7,7 @@ import {
 import { createToken } from '../../helpers/auth';
 import { BadRequestError } from '../../utils/errors';
 import { getInviteOnlySignup, getJwtSignupLifetime, getJwtSignupSecret, getSmtpConfigured } from '../../config';
+import { validateUserEmail } from '../../validation';
 
 /**
  * Signup step 1: Initialize account for user under email [email] and send a verification code
@@ -18,28 +18,23 @@ import { getInviteOnlySignup, getJwtSignupLifetime, getJwtSignupSecret, getSmtpC
  */
 export const beginEmailSignup = async (req: Request, res: Response) => {
 	let email: string;
-	try {
-		email = req.body.email;
+  email = req.body.email;
+  
+  // validate that email is not disposable
+  validateUserEmail(email);
 
-		const user = await User.findOne({ email }).select('+publicKey');
-		if (user && user?.publicKey) {
-			// case: user has already completed account
+  const user = await User.findOne({ email }).select('+publicKey');
+  if (user && user?.publicKey) {
+    // case: user has already completed account
 
-			return res.status(403).send({
-				error: 'Failed to send email verification code for complete account'
-			});
-		}
+    return res.status(403).send({
+      error: 'Failed to send email verification code for complete account'
+    });
+  }
+
+  // send send verification email
+  await sendEmailVerification({ email });
 
-		// send send verification email
-		await sendEmailVerification({ email });
-	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-		return res.status(400).send({
-			error: 'Failed to send email verification code'
-		});
-	}
-	
 	return res.status(200).send({
 		message: `Sent an email verification code to ${email}`
 	});
@@ -54,55 +49,47 @@ export const beginEmailSignup = async (req: Request, res: Response) => {
  */
 export const verifyEmailSignup = async (req: Request, res: Response) => {
 	let user, token;
-	try {
-		const { email, code } = req.body;
+  const { email, code } = req.body;
 
-		// initialize user account
-		user = await User.findOne({ email }).select('+publicKey');
-		if (user && user?.publicKey) {
-			// case: user has already completed account
-			return res.status(403).send({
-				error: 'Failed email verification for complete user'
-			});
-		}
+  // initialize user account
+  user = await User.findOne({ email }).select('+publicKey');
+  if (user && user?.publicKey) {
+    // case: user has already completed account
+    return res.status(403).send({
+      error: 'Failed email verification for complete user'
+    });
+  }
 
-		if (await getInviteOnlySignup()) {
-			// Only one user can create an account without being invited. The rest need to be invited in order to make an account
-			const userCount = await User.countDocuments({})
-			if (userCount != 0) {
-				throw BadRequestError({ message: "New user sign ups are not allowed at this time. You must be invited to sign up." })
-			}
-		}
+  if (await getInviteOnlySignup()) {
+    // Only one user can create an account without being invited. The rest need to be invited in order to make an account
+    const userCount = await User.countDocuments({})
+    if (userCount != 0) {
+      throw BadRequestError({ message: "New user sign ups are not allowed at this time. You must be invited to sign up." })
+    }
+  }
 
-		// verify email
-		if (await getSmtpConfigured()) {
-			await checkEmailVerification({
-				email,
-				code
-			});
-		}
+  // verify email
+  if (await getSmtpConfigured()) {
+    await checkEmailVerification({
+      email,
+      code
+    });
+  }
 
-		if (!user) {
-			user = await new User({
-				email
-			}).save();
-		}
+  if (!user) {
+    user = await new User({
+      email
+    }).save();
+  }
 
-		// generate temporary signup token
-		token = createToken({
-			payload: {
-				userId: user._id.toString()
-			},
-			expiresIn: await getJwtSignupLifetime(),
-			secret: await getJwtSignupSecret()
-		});
-	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-		return res.status(400).send({
-			error: 'Failed email verification'
-		});
-	}
+  // generate temporary signup token
+  token = createToken({
+    payload: {
+      userId: user._id.toString()
+    },
+    expiresIn: await getJwtSignupLifetime(),
+    secret: await getJwtSignupSecret()
+  });
 
 	return res.status(200).send({
 		message: 'Successfuly verified email',

backend/src/controllers/v1/stripeController.ts

@@ -1,5 +1,4 @@
 import { Request, Response } from 'express';
-import * as Sentry from '@sentry/node';
 import Stripe from 'stripe';
 import { getStripeSecretKey, getStripeWebhookSecret } from '../../config';
 
@@ -10,26 +9,17 @@ import { getStripeSecretKey, getStripeWebhookSecret } from '../../config';
  * @returns
  */
 export const handleWebhook = async (req: Request, res: Response) => {
-	let event;
-	try {
-		// check request for valid stripe signature
-		const stripe = new Stripe(await getStripeSecretKey(), {
-			apiVersion: '2022-08-01'
-		});
+  // check request for valid stripe signature
+  const stripe = new Stripe(await getStripeSecretKey(), {
+    apiVersion: '2022-08-01'
+  });
 
-		const sig = req.headers['stripe-signature'] as string;
-		event = stripe.webhooks.constructEvent(
-			req.body,
-			sig,
-			await getStripeWebhookSecret()
-		);
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			error: 'Failed to process webhook'
-		});
-	}
+  const sig = req.headers['stripe-signature'] as string;
+  const event = stripe.webhooks.constructEvent(
+    req.body,
+    sig,
+    await getStripeWebhookSecret()
+  );
 
 	switch (event.type) {
 		case '':

backend/src/controllers/v1/userActionController.ts

@@ -1,5 +1,4 @@
 import { Request, Response } from 'express';
-import * as Sentry from '@sentry/node';
 import { UserAction } from '../../models';
 
 /**
@@ -11,28 +10,19 @@ import { UserAction } from '../../models';
 export const addUserAction = async (req: Request, res: Response) => {
 	// add/record new action [action] for user with id [req.user._id]
 
-	let userAction;
-	try {
-		const { action } = req.body;
+  const { action } = req.body;
 
-		userAction = await UserAction.findOneAndUpdate(
-			{
-				user: req.user._id,
-				action
-			},
-			{ user: req.user._id, action },
-			{
-				new: true,
-				upsert: true
-			}
-		);
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to record user action'
-		});
-	}
+  const userAction = await UserAction.findOneAndUpdate(
+    {
+      user: req.user._id,
+      action
+    },
+    { user: req.user._id, action },
+    {
+      new: true,
+      upsert: true
+    }
+  );
 
 	return res.status(200).send({
 		message: 'Successfully recorded user action',
@@ -48,21 +38,12 @@ export const addUserAction = async (req: Request, res: Response) => {
  */
 export const getUserAction = async (req: Request, res: Response) => {
 	// get user action [action] for user with id [req.user._id]
-	let userAction;
-	try {
-		const action: string = req.query.action as string;
+  const action: string = req.query.action as string;
 
-		userAction = await UserAction.findOne({
-			user: req.user._id,
-			action
-		});
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get user action'
-		});
-	}
+  const userAction = await UserAction.findOne({
+    user: req.user._id,
+    action
+  });
 
 	return res.status(200).send({
 		userAction

backend/src/controllers/v1/workspaceController.ts

@@ -1,5 +1,4 @@
 import { Request, Response } from "express";
-import * as Sentry from "@sentry/node";
 import {
   Workspace,
   Membership,
@@ -14,6 +13,7 @@ import {
   createWorkspace as create,
   deleteWorkspace as deleteWork,
 } from "../../helpers/workspace";
+import { EELicenseService } from '../../ee/services';
 import { addMemberships } from "../../helpers/membership";
 import { ADMIN } from "../../variables";
 
@@ -24,27 +24,18 @@ import { ADMIN } from "../../variables";
  * @returns
  */
 export const getWorkspacePublicKeys = async (req: Request, res: Response) => {
-  let publicKeys;
-  try {
-    const { workspaceId } = req.params;
+  const { workspaceId } = req.params;
 
-    publicKeys = (
-      await Membership.find({
-        workspace: workspaceId,
-      }).populate<{ user: IUser }>("user", "publicKey")
-    ).map((member) => {
-      return {
-        publicKey: member.user.publicKey,
-        userId: member.user._id,
-      };
-    });
-  } catch (err) {
-    Sentry.setUser({ email: req.user.email });
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: "Failed to get workspace member public keys",
-    });
-  }
+  const publicKeys = (
+    await Membership.find({
+      workspace: workspaceId,
+    }).populate<{ user: IUser }>("user", "publicKey")
+  ).map((member) => {
+    return {
+      publicKey: member.user.publicKey,
+      userId: member.user._id,
+    };
+  });
 
   return res.status(200).send({
     publicKeys,
@@ -58,20 +49,11 @@ export const getWorkspacePublicKeys = async (req: Request, res: Response) => {
  * @returns
  */
 export const getWorkspaceMemberships = async (req: Request, res: Response) => {
-  let users;
-  try {
-    const { workspaceId } = req.params;
+  const { workspaceId } = req.params;
 
-    users = await Membership.find({
-      workspace: workspaceId,
-    }).populate("user", "+publicKey");
-  } catch (err) {
-    Sentry.setUser({ email: req.user.email });
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: "Failed to get workspace members",
-    });
-  }
+  const users = await Membership.find({
+    workspace: workspaceId,
+  }).populate("user", "+publicKey");
 
   return res.status(200).send({
     users,
@@ -85,20 +67,11 @@ export const getWorkspaceMemberships = async (req: Request, res: Response) => {
  * @returns
  */
 export const getWorkspaces = async (req: Request, res: Response) => {
-  let workspaces;
-  try {
-    workspaces = (
-      await Membership.find({
-        user: req.user._id,
-      }).populate("workspace")
-    ).map((m) => m.workspace);
-  } catch (err) {
-    Sentry.setUser({ email: req.user.email });
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: "Failed to get workspaces",
-    });
-  }
+  const workspaces = (
+    await Membership.find({
+      user: req.user._id,
+    }).populate("workspace")
+  ).map((m) => m.workspace);
 
   return res.status(200).send({
     workspaces,
@@ -112,20 +85,11 @@ export const getWorkspaces = async (req: Request, res: Response) => {
  * @returns
  */
 export const getWorkspace = async (req: Request, res: Response) => {
-  let workspace;
-  try {
-    const { workspaceId } = req.params;
+  const { workspaceId } = req.params;
 
-    workspace = await Workspace.findOne({
-      _id: workspaceId,
-    });
-  } catch (err) {
-    Sentry.setUser({ email: req.user.email });
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: "Failed to get workspace",
-    });
-  }
+  const workspace = await Workspace.findOne({
+    _id: workspaceId,
+  });
 
   return res.status(200).send({
     workspace,
@@ -140,43 +104,46 @@ export const getWorkspace = async (req: Request, res: Response) => {
  * @returns
  */
 export const createWorkspace = async (req: Request, res: Response) => {
-  let workspace;
-  try {
-    const { workspaceName, organizationId } = req.body;
+  const { workspaceName, organizationId } = req.body;
 
-    // validate organization membership
-    const membershipOrg = await MembershipOrg.findOne({
-      user: req.user._id,
-      organization: organizationId,
-    });
+  // validate organization membership
+  const membershipOrg = await MembershipOrg.findOne({
+    user: req.user._id,
+    organization: organizationId,
+  });
 
-    if (!membershipOrg) {
-      throw new Error("Failed to validate organization membership");
-    }
-
-    if (workspaceName.length < 1) {
-      throw new Error("Workspace names must be at least 1-character long");
-    }
-
-    // create workspace and add user as member
-    workspace = await create({
-      name: workspaceName,
-      organizationId,
-    });
-
-    await addMemberships({
-      userIds: [req.user._id],
-      workspaceId: workspace._id.toString(),
-      roles: [ADMIN],
-    });
-  } catch (err) {
-    Sentry.setUser({ email: req.user.email });
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: "Failed to create workspace",
-    });
+  if (!membershipOrg) {
+    throw new Error("Failed to validate organization membership");
   }
 
+  const plan = await EELicenseService.getOrganizationPlan(organizationId);
+  
+  if (plan.workspaceLimit !== null) {
+    // case: limit imposed on number of workspaces allowed
+    if (plan.workspacesUsed >= plan.workspaceLimit) {
+      // case: number of workspaces used exceeds the number of workspaces allowed
+      return res.status(400).send({
+        message: 'Failed to create workspace due to plan limit reached. Upgrade plan to add more workspaces.'
+      });
+    }
+  }
+
+  if (workspaceName.length < 1) {
+    throw new Error("Workspace names must be at least 1-character long");
+  }
+
+  // create workspace and add user as member
+  const workspace = await create({
+    name: workspaceName,
+    organizationId,
+  });
+
+  await addMemberships({
+    userIds: [req.user._id],
+    workspaceId: workspace._id.toString(),
+    roles: [ADMIN],
+  });
+
   return res.status(200).send({
     workspace,
   });
@@ -189,20 +156,12 @@ export const createWorkspace = async (req: Request, res: Response) => {
  * @returns
  */
 export const deleteWorkspace = async (req: Request, res: Response) => {
-  try {
-    const { workspaceId } = req.params;
+  const { workspaceId } = req.params;
 
-    // delete workspace
-    await deleteWork({
-      id: workspaceId,
-    });
-  } catch (err) {
-    Sentry.setUser({ email: req.user.email });
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: "Failed to delete workspace",
-    });
-  }
+  // delete workspace
+  await deleteWork({
+    id: workspaceId,
+  });
 
   return res.status(200).send({
     message: "Successfully deleted workspace",
@@ -216,29 +175,20 @@ export const deleteWorkspace = async (req: Request, res: Response) => {
  * @returns
  */
 export const changeWorkspaceName = async (req: Request, res: Response) => {
-  let workspace;
-  try {
-    const { workspaceId } = req.params;
-    const { name } = req.body;
+  const { workspaceId } = req.params;
+  const { name } = req.body;
 
-    workspace = await Workspace.findOneAndUpdate(
-      {
-        _id: workspaceId,
-      },
-      {
-        name,
-      },
-      {
-        new: true,
-      }
-    );
-  } catch (err) {
-    Sentry.setUser({ email: req.user.email });
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: "Failed to change workspace name",
-    });
-  }
+  const workspace = await Workspace.findOneAndUpdate(
+    {
+      _id: workspaceId,
+    },
+    {
+      name,
+    },
+    {
+      new: true,
+    }
+  );
 
   return res.status(200).send({
     message: "Successfully changed workspace name",
@@ -253,20 +203,11 @@ export const changeWorkspaceName = async (req: Request, res: Response) => {
  * @returns
  */
 export const getWorkspaceIntegrations = async (req: Request, res: Response) => {
-  let integrations;
-  try {
-    const { workspaceId } = req.params;
+  const { workspaceId } = req.params;
 
-    integrations = await Integration.find({
-      workspace: workspaceId,
-    });
-  } catch (err) {
-    Sentry.setUser({ email: req.user.email });
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: "Failed to get workspace integrations",
-    });
-  }
+  const integrations = await Integration.find({
+    workspace: workspaceId,
+  });
 
   return res.status(200).send({
     integrations,
@@ -283,20 +224,11 @@ export const getWorkspaceIntegrationAuthorizations = async (
   req: Request,
   res: Response
 ) => {
-  let authorizations;
-  try {
-    const { workspaceId } = req.params;
+  const { workspaceId } = req.params;
 
-    authorizations = await IntegrationAuth.find({
-      workspace: workspaceId,
-    });
-  } catch (err) {
-    Sentry.setUser({ email: req.user.email });
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: "Failed to get workspace integration authorizations",
-    });
-  }
+  const authorizations = await IntegrationAuth.find({
+    workspace: workspaceId,
+  });
 
   return res.status(200).send({
     authorizations,
@@ -313,21 +245,12 @@ export const getWorkspaceServiceTokens = async (
   req: Request,
   res: Response
 ) => {
-  let serviceTokens;
-  try {
-    const { workspaceId } = req.params;
-    // ?? FIX.
-    serviceTokens = await ServiceToken.find({
-      user: req.user._id,
-      workspace: workspaceId,
-    });
-  } catch (err) {
-    Sentry.setUser({ email: req.user.email });
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: "Failed to get workspace service tokens",
-    });
-  }
+  const { workspaceId } = req.params;
+  // ?? FIX.
+  const serviceTokens = await ServiceToken.find({
+    user: req.user._id,
+    workspace: workspaceId,
+  });
 
   return res.status(200).send({
     serviceTokens,

backend/src/controllers/v2/apiKeyDataController.ts

@@ -1,4 +1,3 @@
-import * as Sentry from '@sentry/node';
 import { Request, Response } from 'express';
 import crypto from 'crypto';
 import bcrypt from 'bcrypt';
@@ -14,18 +13,9 @@ import { getSaltRounds } from '../../config';
  * @returns 
  */
 export const getAPIKeyData = async (req: Request, res: Response) => {
-    let apiKeyData;
-    try {
-        apiKeyData = await APIKeyData.find({
-            user: req.user._id
-        });
-    } catch (err) {
-        Sentry.setUser({ email: req.user.email });
-        Sentry.captureException(err);
-        return res.status(400).send({
-            message: 'Failed to get API key data'
-        });
-    }
+    const apiKeyData = await APIKeyData.find({
+        user: req.user._id
+    });
     
     return res.status(200).send({
         apiKeyData
@@ -38,39 +28,30 @@ export const getAPIKeyData = async (req: Request, res: Response) => {
  * @param res 
  */
 export const createAPIKeyData = async (req: Request, res: Response) => {
-    let apiKey, apiKeyData;
-    try {
-        const { name, expiresIn } = req.body;
-        
-        const secret = crypto.randomBytes(16).toString('hex');
-        const secretHash = await bcrypt.hash(secret, await getSaltRounds());
-        
-		const expiresAt = new Date();
-		expiresAt.setSeconds(expiresAt.getSeconds() + expiresIn);
-        
-        apiKeyData = await new APIKeyData({
-            name,
-            lastUsed: new Date(),
-            expiresAt,
-            user: req.user._id,
-            secretHash
-        }).save();
-        
-        // return api key data without sensitive data
-        apiKeyData = await APIKeyData.findById(apiKeyData._id);
-        
-        if (!apiKeyData) throw new Error('Failed to find API key data');
-        
-        apiKey = `ak.${apiKeyData._id.toString()}.${secret}`;
-            
-    } catch (err) {
-        Sentry.setUser({ email: req.user.email });
-        Sentry.captureException(err);
-        return res.status(400).send({
-            message: 'Failed to API key data'
-        });
-    }
+    const { name, expiresIn } = req.body;
     
+    const secret = crypto.randomBytes(16).toString('hex');
+    const secretHash = await bcrypt.hash(secret, await getSaltRounds());
+    
+    const expiresAt = new Date();
+    expiresAt.setSeconds(expiresAt.getSeconds() + expiresIn);
+    
+    let apiKeyData = await new APIKeyData({
+        name,
+        lastUsed: new Date(),
+        expiresAt,
+        user: req.user._id,
+        secretHash
+    }).save();
+    
+    // return api key data without sensitive data
+    // FIX: fix this any
+    apiKeyData = await APIKeyData.findById(apiKeyData._id) as any
+    
+    if (!apiKeyData) throw new Error('Failed to find API key data');
+    
+    const apiKey = `ak.${apiKeyData._id.toString()}.${secret}`;
+            
     return res.status(200).send({
         apiKey,
         apiKeyData
@@ -84,21 +65,10 @@ export const createAPIKeyData = async (req: Request, res: Response) => {
  * @returns 
  */
 export const deleteAPIKeyData = async (req: Request, res: Response) => {
-    let apiKeyData;
-    try {
-        const { apiKeyDataId } = req.params;
-
-        apiKeyData = await APIKeyData.findByIdAndDelete(apiKeyDataId);
-        
-    } catch (err) {
-        Sentry.setUser({ email: req.user.email });
-        Sentry.captureException(err);
-        return res.status(400).send({
-            message: 'Failed to delete API key data'
-        });
-    }
+    const { apiKeyDataId } = req.params;
+    const apiKeyData = await APIKeyData.findByIdAndDelete(apiKeyDataId);
     
     return res.status(200).send({
         apiKeyData
     });
-}
+}

backend/src/controllers/v2/authController.ts

@@ -1,7 +1,6 @@
 /* eslint-disable @typescript-eslint/no-var-requires */
 import { Request, Response } from 'express';
 import jwt from 'jsonwebtoken';
-import * as Sentry from '@sentry/node';
 import * as bigintConversion from 'bigint-conversion';
 const jsrp = require('jsrp');
 import { User, LoginSRPDetail } from '../../models';
@@ -35,47 +34,40 @@ declare module 'jsonwebtoken' {
  * @returns
  */
 export const login1 = async (req: Request, res: Response) => {
-  try {
-    const {
-      email,
-      clientPublicKey
-    }: { email: string; clientPublicKey: string } = req.body;
+  const {
+    email,
+    clientPublicKey
+  }: { email: string; clientPublicKey: string } = req.body;
 
-    const user = await User.findOne({
-      email
-    }).select('+salt +verifier');
+  const user = await User.findOne({
+    email
+  }).select('+salt +verifier');
 
-    if (!user) throw new Error('Failed to find user');
+  if (!user) throw new Error('Failed to find user');
 
-    const server = new jsrp.server();
-    server.init(
-      {
-        salt: user.salt,
-        verifier: user.verifier
-      },
-      async () => {
-        // generate server-side public key
-        const serverPublicKey = server.getPublicKey();
+  const server = new jsrp.server();
+  server.init(
+    {
+      salt: user.salt,
+      verifier: user.verifier
+    },
+    async () => {
+      // generate server-side public key
+      const serverPublicKey = server.getPublicKey();
 
-        await LoginSRPDetail.findOneAndReplace({ email: email }, {
-          email: email,
-          clientPublicKey: clientPublicKey,
-          serverBInt: bigintConversion.bigintToBuf(server.bInt),
-        }, { upsert: true, returnNewDocument: false });
+      await LoginSRPDetail.findOneAndReplace({ email: email }, {
+        email: email,
+        clientPublicKey: clientPublicKey,
+        serverBInt: bigintConversion.bigintToBuf(server.bInt),
+      }, { upsert: true, returnNewDocument: false });
 
-        return res.status(200).send({
-          serverPublicKey,
-          salt: user.salt
-        });
-      }
-    );
-  } catch (err) {
-    Sentry.setUser(null);
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: 'Failed to start authentication process'
-    });
-  }
+      return res.status(200).send({
+        serverPublicKey,
+        salt: user.salt
+      });
+    }
+  );
+  
 };
 
 /**
@@ -86,149 +78,143 @@ export const login1 = async (req: Request, res: Response) => {
  * @returns
  */
 export const login2 = async (req: Request, res: Response) => {
-  try {
+  if (!req.headers['user-agent']) throw InternalServerError({ message: 'User-Agent header is required' });
 
-    if (!req.headers['user-agent']) throw InternalServerError({ message: 'User-Agent header is required' });
+  const { email, clientProof } = req.body;
+  const user = await User.findOne({
+    email
+  }).select('+salt +verifier +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag +publicKey +encryptedPrivateKey +iv +tag +devices');
 
-    const { email, clientProof } = req.body;
-    const user = await User.findOne({
-      email
-    }).select('+salt +verifier +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag +publicKey +encryptedPrivateKey +iv +tag');
+  if (!user) throw new Error('Failed to find user');
 
-    if (!user) throw new Error('Failed to find user');
+  const loginSRPDetail = await LoginSRPDetail.findOneAndDelete({ email: email })
 
-    const loginSRPDetail = await LoginSRPDetail.findOneAndDelete({ email: email })
+  if (!loginSRPDetail) {
+    return BadRequestError(Error("Failed to find login details for SRP"))
+  }
 
-    if (!loginSRPDetail) {
-      return BadRequestError(Error("Failed to find login details for SRP"))
-    }
+  const server = new jsrp.server();
+  server.init(
+    {
+      salt: user.salt,
+      verifier: user.verifier,
+      b: loginSRPDetail.serverBInt
+    },
+    async () => {
+      server.setClientPublicKey(loginSRPDetail.clientPublicKey);
 
-    const server = new jsrp.server();
-    server.init(
-      {
-        salt: user.salt,
-        verifier: user.verifier,
-        b: loginSRPDetail.serverBInt
-      },
-      async () => {
-        server.setClientPublicKey(loginSRPDetail.clientPublicKey);
+      // compare server and client shared keys
+      if (server.checkClientProof(clientProof)) {
+        if (user.isMfaEnabled) {
+          // case: user has MFA enabled
 
-        // compare server and client shared keys
-        if (server.checkClientProof(clientProof)) {
-
-          if (user.isMfaEnabled) {
-            // case: user has MFA enabled
-
-            // generate temporary MFA token
-            const token = createToken({
-              payload: {
-                userId: user._id.toString()
-              },
-              expiresIn: await getJwtMfaLifetime(),
-              secret: await getJwtMfaSecret()
-            });
-
-            const code = await TokenService.createToken({
-              type: TOKEN_EMAIL_MFA,
-              email
-            });
-
-            // send MFA code [code] to [email]
-            await sendMail({
-              template: 'emailMfa.handlebars',
-              subjectLine: 'Infisical MFA code',
-              recipients: [email],
-              substitutions: {
-                code
-              }
-            });
-
-            return res.status(200).send({
-              mfaEnabled: true,
-              token
-            });
-          }
-
-          await checkUserDevice({
-            user,
-            ip: req.ip,
-            userAgent: req.headers['user-agent'] ?? ''
+          // generate temporary MFA token
+          const token = createToken({
+            payload: {
+              userId: user._id.toString()
+            },
+            expiresIn: await getJwtMfaLifetime(),
+            secret: await getJwtMfaSecret()
           });
 
-          // issue tokens
-          const tokens = await issueAuthTokens({ userId: user._id.toString() });
-
-          // store (refresh) token in httpOnly cookie
-          res.cookie('jid', tokens.refreshToken, {
-            httpOnly: true,
-            path: '/',
-            sameSite: 'strict',
-            secure: await getHttpsEnabled()
+          const code = await TokenService.createToken({
+            type: TOKEN_EMAIL_MFA,
+            email
           });
 
-          // case: user does not have MFA enablgged
-          // return (access) token in response
-
-          interface ResponseData {
-            mfaEnabled: boolean;
-            encryptionVersion: any;
-            protectedKey?: string;
-            protectedKeyIV?: string;
-            protectedKeyTag?: string;
-            token: string;
-            publicKey?: string;
-            encryptedPrivateKey?: string;
-            iv?: string;
-            tag?: string;
-          }
-
-          const response: ResponseData = {
-            mfaEnabled: false,
-            encryptionVersion: user.encryptionVersion,
-            token: tokens.token,
-            publicKey: user.publicKey,
-            encryptedPrivateKey: user.encryptedPrivateKey,
-            iv: user.iv,
-            tag: user.tag
-          }
-
-          if (
-            user?.protectedKey &&
-            user?.protectedKeyIV &&
-            user?.protectedKeyTag
-          ) {
-            response.protectedKey = user.protectedKey;
-            response.protectedKeyIV = user.protectedKeyIV
-            response.protectedKeyTag = user.protectedKeyTag;
-          }
-
-          const loginAction = await EELogService.createAction({
-            name: ACTION_LOGIN,
-            userId: user._id
+          // send MFA code [code] to [email]
+          await sendMail({
+            template: 'emailMfa.handlebars',
+            subjectLine: 'Infisical MFA code',
+            recipients: [email],
+            substitutions: {
+              code
+            }
           });
 
-          loginAction && await EELogService.createLog({
-            userId: user._id,
-            actions: [loginAction],
-            channel: getChannelFromUserAgent(req.headers['user-agent']),
-            ipAddress: req.ip
+          return res.status(200).send({
+            mfaEnabled: true,
+            token
           });
-
-          return res.status(200).send(response);
         }
 
-        return res.status(400).send({
-          message: 'Failed to authenticate. Try again?'
+        await checkUserDevice({
+          user,
+          ip: req.realIP,
+          userAgent: req.headers['user-agent'] ?? ''
         });
+
+        // issue tokens
+        const tokens = await issueAuthTokens({ 
+          userId: user._id,
+          ip: req.realIP,
+          userAgent: req.headers['user-agent'] ?? ''
+        });
+
+        // store (refresh) token in httpOnly cookie
+        res.cookie('jid', tokens.refreshToken, {
+          httpOnly: true,
+          path: '/',
+          sameSite: 'strict',
+          secure: await getHttpsEnabled()
+        });
+
+        // case: user does not have MFA enabled
+        // return (access) token in response
+
+        interface ResponseData {
+          mfaEnabled: boolean;
+          encryptionVersion: any;
+          protectedKey?: string;
+          protectedKeyIV?: string;
+          protectedKeyTag?: string;
+          token: string;
+          publicKey?: string;
+          encryptedPrivateKey?: string;
+          iv?: string;
+          tag?: string;
+        }
+
+        const response: ResponseData = {
+          mfaEnabled: false,
+          encryptionVersion: user.encryptionVersion,
+          token: tokens.token,
+          publicKey: user.publicKey,
+          encryptedPrivateKey: user.encryptedPrivateKey,
+          iv: user.iv,
+          tag: user.tag
+        }
+
+        if (
+          user?.protectedKey &&
+          user?.protectedKeyIV &&
+          user?.protectedKeyTag
+        ) {
+          response.protectedKey = user.protectedKey;
+          response.protectedKeyIV = user.protectedKeyIV
+          response.protectedKeyTag = user.protectedKeyTag;
+        }
+
+        const loginAction = await EELogService.createAction({
+          name: ACTION_LOGIN,
+          userId: user._id
+        });
+
+        loginAction && await EELogService.createLog({
+          userId: user._id,
+          actions: [loginAction],
+          channel: getChannelFromUserAgent(req.headers['user-agent']),
+          ipAddress: req.ip
+        });
+
+        return res.status(200).send(response);
       }
-    );
-  } catch (err) {
-    Sentry.setUser(null);
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: 'Failed to authenticate. Try again?'
-    });
-  }
+
+      return res.status(400).send({
+        message: 'Failed to authenticate. Try again?'
+      });
+    }
+  );
 };
 
 /**
@@ -237,30 +223,22 @@ export const login2 = async (req: Request, res: Response) => {
  * @param res 
  */
 export const sendMfaToken = async (req: Request, res: Response) => {
-  try {
-    const { email } = req.body;
+  const { email } = req.body;
 
-    const code = await TokenService.createToken({
-      type: TOKEN_EMAIL_MFA,
-      email
-    });
+  const code = await TokenService.createToken({
+    type: TOKEN_EMAIL_MFA,
+    email
+  });
 
-    // send MFA code [code] to [email]
-    await sendMail({
-      template: 'emailMfa.handlebars',
-      subjectLine: 'Infisical MFA code',
-      recipients: [email],
-      substitutions: {
-        code
-      }
-    });
-  } catch (err) {
-    Sentry.setUser(null);
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: 'Failed to send MFA code'
-    });
-  }
+  // send MFA code [code] to [email]
+  await sendMail({
+    template: 'emailMfa.handlebars',
+    subjectLine: 'Infisical MFA code',
+    recipients: [email],
+    substitutions: {
+      code
+    }
+  });
 
   return res.status(200).send({
     message: 'Successfully sent new MFA code'
@@ -292,12 +270,16 @@ export const verifyMfaToken = async (req: Request, res: Response) => {
 
   await checkUserDevice({
     user,
-    ip: req.ip,
+    ip: req.realIP,
     userAgent: req.headers['user-agent'] ?? ''
   });
 
   // issue tokens
-  const tokens = await issueAuthTokens({ userId: user._id.toString() });
+  const tokens = await issueAuthTokens({ 
+    userId: user._id,
+    ip: req.realIP,
+    userAgent: req.headers['user-agent'] ?? ''
+  });
 
   // store (refresh) token in httpOnly cookie
   res.cookie('jid', tokens.refreshToken, {
@@ -355,7 +337,7 @@ export const verifyMfaToken = async (req: Request, res: Response) => {
     userId: user._id,
     actions: [loginAction],
     channel: getChannelFromUserAgent(req.headers['user-agent']),
-    ipAddress: req.ip
+    ipAddress: req.realIP
   });
 
   return res.status(200).send(resObj);

backend/src/controllers/v2/environmentController.ts

@@ -1,5 +1,4 @@
 import { Request, Response } from 'express';
-import * as Sentry from '@sentry/node';
 import {
   Secret,
   ServiceToken,
@@ -25,30 +24,22 @@ export const createWorkspaceEnvironment = async (
 ) => {
   const { workspaceId } = req.params;
   const { environmentName, environmentSlug } = req.body;
-  try {
-    const workspace = await Workspace.findById(workspaceId).exec();
-    if (
-      !workspace ||
-      workspace?.environments.find(
-        ({ name, slug }) => slug === environmentSlug || environmentName === name
-      )
-    ) {
-      throw new Error('Failed to create workspace environment');
-    }
-
-    workspace?.environments.push({
-      name: environmentName,
-      slug: environmentSlug.toLowerCase(),
-    });
-    await workspace.save();
-  } catch (err) {
-    Sentry.setUser({ email: req.user.email });
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: 'Failed to create new workspace environment',
-    });
+  const workspace = await Workspace.findById(workspaceId).exec();
+  if (
+    !workspace ||
+    workspace?.environments.find(
+      ({ name, slug }) => slug === environmentSlug || environmentName === name
+    )
+  ) {
+    throw new Error('Failed to create workspace environment');
   }
 
+  workspace?.environments.push({
+    name: environmentName,
+    slug: environmentSlug.toLowerCase(),
+  });
+  await workspace.save();
+
   return res.status(200).send({
     message: 'Successfully created new environment',
     workspace: workspaceId,
@@ -72,75 +63,67 @@ export const renameWorkspaceEnvironment = async (
 ) => {
   const { workspaceId } = req.params;
   const { environmentName, environmentSlug, oldEnvironmentSlug } = req.body;
-  try {
-    // user should pass both new slug and env name
-    if (!environmentSlug || !environmentName) {
-      throw new Error('Invalid environment given.');
-    }
-
-    // atomic update the env to avoid conflict
-    const workspace = await Workspace.findById(workspaceId).exec();
-    if (!workspace) {
-      throw new Error('Failed to create workspace environment');
-    }
-
-    const isEnvExist = workspace.environments.some(
-      ({ name, slug }) =>
-        slug !== oldEnvironmentSlug &&
-        (name === environmentName || slug === environmentSlug)
-    );
-    if (isEnvExist) {
-      throw new Error('Invalid environment given');
-    }
-
-    const envIndex = workspace?.environments.findIndex(
-      ({ slug }) => slug === oldEnvironmentSlug
-    );
-    if (envIndex === -1) {
-      throw new Error('Invalid environment given');
-    }
-
-    workspace.environments[envIndex].name = environmentName;
-    workspace.environments[envIndex].slug = environmentSlug.toLowerCase();
-
-    await workspace.save();
-    await Secret.updateMany(
-      { workspace: workspaceId, environment: oldEnvironmentSlug },
-      { environment: environmentSlug }
-    );
-    await SecretVersion.updateMany(
-      { workspace: workspaceId, environment: oldEnvironmentSlug },
-      { environment: environmentSlug }
-    );
-    await ServiceToken.updateMany(
-      { workspace: workspaceId, environment: oldEnvironmentSlug },
-      { environment: environmentSlug }
-    );
-    await ServiceTokenData.updateMany(
-      { workspace: workspaceId, environment: oldEnvironmentSlug },
-      { environment: environmentSlug }
-    );
-    await Integration.updateMany(
-      { workspace: workspaceId, environment: oldEnvironmentSlug },
-      { environment: environmentSlug }
-    );
-    await Membership.updateMany(
-      {
-        workspace: workspaceId,
-        "deniedPermissions.environmentSlug": oldEnvironmentSlug
-      },
-      { $set: { "deniedPermissions.$[element].environmentSlug": environmentSlug } },
-      { arrayFilters: [{ "element.environmentSlug": oldEnvironmentSlug }] }
-    )
-
-  } catch (err) {
-    Sentry.setUser({ email: req.user.email });
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: 'Failed to update workspace environment',
-    });
+  // user should pass both new slug and env name
+  if (!environmentSlug || !environmentName) {
+    throw new Error('Invalid environment given.');
   }
 
+  // atomic update the env to avoid conflict
+  const workspace = await Workspace.findById(workspaceId).exec();
+  if (!workspace) {
+    throw new Error('Failed to create workspace environment');
+  }
+
+  const isEnvExist = workspace.environments.some(
+    ({ name, slug }) =>
+      slug !== oldEnvironmentSlug &&
+      (name === environmentName || slug === environmentSlug)
+  );
+  if (isEnvExist) {
+    throw new Error('Invalid environment given');
+  }
+
+  const envIndex = workspace?.environments.findIndex(
+    ({ slug }) => slug === oldEnvironmentSlug
+  );
+  if (envIndex === -1) {
+    throw new Error('Invalid environment given');
+  }
+
+  workspace.environments[envIndex].name = environmentName;
+  workspace.environments[envIndex].slug = environmentSlug.toLowerCase();
+
+  await workspace.save();
+  await Secret.updateMany(
+    { workspace: workspaceId, environment: oldEnvironmentSlug },
+    { environment: environmentSlug }
+  );
+  await SecretVersion.updateMany(
+    { workspace: workspaceId, environment: oldEnvironmentSlug },
+    { environment: environmentSlug }
+  );
+  await ServiceToken.updateMany(
+    { workspace: workspaceId, environment: oldEnvironmentSlug },
+    { environment: environmentSlug }
+  );
+  await ServiceTokenData.updateMany(
+    { workspace: workspaceId, environment: oldEnvironmentSlug },
+    { environment: environmentSlug }
+  );
+  await Integration.updateMany(
+    { workspace: workspaceId, environment: oldEnvironmentSlug },
+    { environment: environmentSlug }
+  );
+  await Membership.updateMany(
+    {
+      workspace: workspaceId,
+      "deniedPermissions.environmentSlug": oldEnvironmentSlug
+    },
+    { $set: { "deniedPermissions.$[element].environmentSlug": environmentSlug } },
+    { arrayFilters: [{ "element.environmentSlug": oldEnvironmentSlug }] }
+  )
+
+
   return res.status(200).send({
     message: 'Successfully update environment',
     workspace: workspaceId,
@@ -163,57 +146,48 @@ export const deleteWorkspaceEnvironment = async (
 ) => {
   const { workspaceId } = req.params;
   const { environmentSlug } = req.body;
-  try {
-    // atomic update the env to avoid conflict
-    const workspace = await Workspace.findById(workspaceId).exec();
-    if (!workspace) {
-      throw new Error('Failed to create workspace environment');
-    }
-
-    const envIndex = workspace?.environments.findIndex(
-      ({ slug }) => slug === environmentSlug
-    );
-    if (envIndex === -1) {
-      throw new Error('Invalid environment given');
-    }
-
-    workspace.environments.splice(envIndex, 1);
-    await workspace.save();
-
-    // clean up
-    await Secret.deleteMany({
-      workspace: workspaceId,
-      environment: environmentSlug,
-    });
-    await SecretVersion.deleteMany({
-      workspace: workspaceId,
-      environment: environmentSlug,
-    });
-    await ServiceToken.deleteMany({
-      workspace: workspaceId,
-      environment: environmentSlug,
-    });
-    await ServiceTokenData.deleteMany({
-      workspace: workspaceId,
-      environment: environmentSlug,
-    });
-    await Integration.deleteMany({
-      workspace: workspaceId,
-      environment: environmentSlug,
-    });
-    await Membership.updateMany(
-      { workspace: workspaceId },
-      { $pull: { deniedPermissions: { environmentSlug: environmentSlug } } }
-    )
-
-  } catch (err) {
-    Sentry.setUser({ email: req.user.email });
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: 'Failed to delete workspace environment',
-    });
+  // atomic update the env to avoid conflict
+  const workspace = await Workspace.findById(workspaceId).exec();
+  if (!workspace) {
+    throw new Error('Failed to create workspace environment');
   }
 
+  const envIndex = workspace?.environments.findIndex(
+    ({ slug }) => slug === environmentSlug
+  );
+  if (envIndex === -1) {
+    throw new Error('Invalid environment given');
+  }
+
+  workspace.environments.splice(envIndex, 1);
+  await workspace.save();
+
+  // clean up
+  await Secret.deleteMany({
+    workspace: workspaceId,
+    environment: environmentSlug,
+  });
+  await SecretVersion.deleteMany({
+    workspace: workspaceId,
+    environment: environmentSlug,
+  });
+  await ServiceToken.deleteMany({
+    workspace: workspaceId,
+    environment: environmentSlug,
+  });
+  await ServiceTokenData.deleteMany({
+    workspace: workspaceId,
+    environment: environmentSlug,
+  });
+  await Integration.deleteMany({
+    workspace: workspaceId,
+    environment: environmentSlug,
+  });
+  await Membership.updateMany(
+    { workspace: workspaceId },
+    { $pull: { deniedPermissions: { environmentSlug: environmentSlug } } }
+  )
+
   return res.status(200).send({
     message: 'Successfully deleted environment',
     workspace: workspaceId,

backend/src/controllers/v2/organizationsController.ts

@@ -1,5 +1,4 @@
 import { Request, Response } from 'express';
-import * as Sentry from '@sentry/node';
 import { Types } from 'mongoose';
 import { 
     MembershipOrg,
@@ -49,20 +48,11 @@ export const getOrganizationMemberships = async (req: Request, res: Response) =>
         }
     }   
     */
-    let memberships;
-    try {
-        const { organizationId } = req.params;
+    const { organizationId } = req.params;
 
-		memberships = await MembershipOrg.find({
+		const memberships = await MembershipOrg.find({
 			organization: organizationId
 		}).populate('user', '+publicKey');
-    } catch (err) {
-        Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get organization memberships'
-		});
-    }
     
     return res.status(200).send({
         memberships
@@ -128,26 +118,17 @@ export const updateOrganizationMembership = async (req: Request, res: Response)
         }
     }   
     */
-    let membership;
-    try {
-        const { membershipId } = req.params;
-        const { role } = req.body;
-        
-        membership = await MembershipOrg.findByIdAndUpdate(
-            membershipId,
-            {
-                role
-            }, {
-                new: true
-            }
-        );
-    } catch (err) {
-        Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to update organization membership'
-		});
-    }
+    const { membershipId } = req.params;
+    const { role } = req.body;
+    
+    const membership = await MembershipOrg.findByIdAndUpdate(
+        membershipId,
+        {
+            role
+        }, {
+            new: true
+        }
+    );
     
     return res.status(200).send({
         membership
@@ -197,25 +178,16 @@ export const deleteOrganizationMembership = async (req: Request, res: Response)
         }
     }   
     */
-    let membership;
-    try {
-        const { membershipId } = req.params;
-        
-        // delete organization membership
-        membership = await deleteMembershipOrg({
-            membershipOrgId: membershipId
-        });
+    const { membershipId } = req.params;
+    
+    // delete organization membership
+    const membership = await deleteMembershipOrg({
+        membershipOrgId: membershipId
+    });
 
-        await updateSubscriptionOrgQuantity({
+    await updateSubscriptionOrgQuantity({
 			organizationId: membership.organization.toString()
 		});
-    } catch (err) {
-        Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to delete organization membership'
-		});	
-    }
 
     return res.status(200).send({
         membership
@@ -303,4 +275,4 @@ export const getOrganizationServiceAccounts = async (req: Request, res: Response
     return res.status(200).send({
         serviceAccounts
     });
-}
+}

backend/src/controllers/v2/secretsController.ts

@@ -218,6 +218,7 @@ export const batchSecrets = async (req: Request, res: Response) => {
           algorithm: ALGORITHM_AES_256_GCM,
           keyEncoding: ENCODING_SCHEME_UTF8,
           tags: u.tags,
+          folder: u.folder
         })
     );
 
@@ -296,7 +297,7 @@ export const batchSecrets = async (req: Request, res: Response) => {
       workspaceId: new Types.ObjectId(workspaceId),
       actions,
       channel,
-      ipAddress: req.ip,
+      ipAddress: req.realIP,
     });
   }
 
@@ -562,7 +563,7 @@ export const createSecrets = async (req: Request, res: Response) => {
       workspaceId: new Types.ObjectId(workspaceId),
       actions: [addAction],
       channel,
-      ipAddress: req.ip,
+      ipAddress: req.realIP,
     }));
 
   // (EE) take a secret snapshot
@@ -784,7 +785,7 @@ export const getSecrets = async (req: Request, res: Response) => {
       workspaceId: new Types.ObjectId(workspaceId as string),
       actions: [readAction],
       channel,
-      ipAddress: req.ip,
+      ipAddress: req.realIP,
     }));
 
   const postHogClient = await TelemetryService.getPostHogClient();
@@ -909,13 +910,13 @@ export const updateSecrets = async (req: Request, res: Response) => {
             keyEncoding: ENCODING_SCHEME_UTF8,
             tags,
             ...(secretCommentCiphertext !== undefined &&
-            secretCommentIV &&
-            secretCommentTag
+              secretCommentIV &&
+              secretCommentTag
               ? {
-                  secretCommentCiphertext,
-                  secretCommentIV,
-                  secretCommentTag,
-                }
+                secretCommentCiphertext,
+                secretCommentIV,
+                secretCommentTag,
+              }
               : {}),
           },
         },
@@ -1019,7 +1020,7 @@ export const updateSecrets = async (req: Request, res: Response) => {
         workspaceId: new Types.ObjectId(key),
         actions: [updateAction],
         channel,
-        ipAddress: req.ip,
+        ipAddress: req.realIP,
       }));
 
     // (EE) take a secret snapshot
@@ -1157,7 +1158,7 @@ export const deleteSecrets = async (req: Request, res: Response) => {
         workspaceId: new Types.ObjectId(key),
         actions: [deleteAction],
         channel,
-        ipAddress: req.ip,
+        ipAddress: req.realIP,
       }));
 
     // (EE) take a secret snapshot

backend/src/controllers/v2/serviceTokenDataController.ts

@@ -1,4 +1,3 @@
-import * as Sentry from '@sentry/node';
 import { Request, Response } from 'express';
 import crypto from 'crypto';
 import bcrypt from 'bcrypt';
@@ -144,4 +143,4 @@ export const deleteServiceTokenData = async (req: Request, res: Response) => {
     return res.status(200).send({
         serviceTokenData
     });
-}
+}

backend/src/controllers/v2/signupController.ts

@@ -1,5 +1,4 @@
 import { Request, Response } from 'express';
-import * as Sentry from '@sentry/node';
 import { User, MembershipOrg } from '../../models';
 import { completeAccount } from '../../helpers/user';
 import {
@@ -20,136 +19,130 @@ import { updateSubscriptionOrgQuantity } from '../../helpers/organization';
  */
 export const completeAccountSignup = async (req: Request, res: Response) => {
 	let user, token, refreshToken;
-	try {
-		const {
-			email,
-			firstName,
-			lastName,
-			protectedKey,
-			protectedKeyIV,
-			protectedKeyTag,
-			publicKey,
-			encryptedPrivateKey,
-			encryptedPrivateKeyIV,
-			encryptedPrivateKeyTag,
-			salt,
-			verifier,
-			organizationName
-		}: {
-			email: string;
-			firstName: string;
-			lastName: string;
-			protectedKey: string;
-			protectedKeyIV: string;
-			protectedKeyTag: string;
-			publicKey: string;
-			encryptedPrivateKey: string;
-			encryptedPrivateKeyIV: string;
-			encryptedPrivateKeyTag: string;
-			salt: string;
-			verifier: string;
-			organizationName: string;
-		} = req.body;
+  const {
+    email,
+    firstName,
+    lastName,
+    protectedKey,
+    protectedKeyIV,
+    protectedKeyTag,
+    publicKey,
+    encryptedPrivateKey,
+    encryptedPrivateKeyIV,
+    encryptedPrivateKeyTag,
+    salt,
+    verifier,
+    organizationName
+  }: {
+    email: string;
+    firstName: string;
+    lastName: string;
+    protectedKey: string;
+    protectedKeyIV: string;
+    protectedKeyTag: string;
+    publicKey: string;
+    encryptedPrivateKey: string;
+    encryptedPrivateKeyIV: string;
+    encryptedPrivateKeyTag: string;
+    salt: string;
+    verifier: string;
+    organizationName: string;
+  } = req.body;
 
-		// get user
-		user = await User.findOne({ email });
+  // get user
+  user = await User.findOne({ email });
 
-		if (!user || (user && user?.publicKey)) {
-			// case 1: user doesn't exist.
-			// case 2: user has already completed account
-			return res.status(403).send({
-				error: 'Failed to complete account for complete user'
-			});
-		}
+  if (!user || (user && user?.publicKey)) {
+    // case 1: user doesn't exist.
+    // case 2: user has already completed account
+    return res.status(403).send({
+      error: 'Failed to complete account for complete user'
+    });
+  }
 
-		// complete setting up user's account
-		user = await completeAccount({
-			userId: user._id.toString(),
-			firstName,
-			lastName,
-			encryptionVersion: 2,
-			protectedKey,
-			protectedKeyIV,
-			protectedKeyTag,
-			publicKey,
-			encryptedPrivateKey,
-			encryptedPrivateKeyIV,
-			encryptedPrivateKeyTag,
-			salt,
-			verifier
-		});
+  // complete setting up user's account
+  user = await completeAccount({
+    userId: user._id.toString(),
+    firstName,
+    lastName,
+    encryptionVersion: 2,
+    protectedKey,
+    protectedKeyIV,
+    protectedKeyTag,
+    publicKey,
+    encryptedPrivateKey,
+    encryptedPrivateKeyIV,
+    encryptedPrivateKeyTag,
+    salt,
+    verifier
+  });
 
-		if (!user)
-			throw new Error('Failed to complete account for non-existent user'); // ensure user is non-null
+  if (!user)
+    throw new Error('Failed to complete account for non-existent user'); // ensure user is non-null
 
-		// initialize default organization and workspace
-		await initializeDefaultOrg({
-			organizationName,
-			user
-		});
+  // initialize default organization and workspace
+  await initializeDefaultOrg({
+    organizationName,
+    user
+  });
 
-		// update organization membership statuses that are
-		// invited to completed with user attached
-		const membershipsToUpdate = await MembershipOrg.find({
-			inviteEmail: email,
-			status: INVITED
-		});
-		
-		membershipsToUpdate.forEach(async (membership) => {
-			await updateSubscriptionOrgQuantity({
-				organizationId: membership.organization.toString()
-			});
-		});
+  // update organization membership statuses that are
+  // invited to completed with user attached
+  const membershipsToUpdate = await MembershipOrg.find({
+    inviteEmail: email,
+    status: INVITED
+  });
+  
+  membershipsToUpdate.forEach(async (membership) => {
+    await updateSubscriptionOrgQuantity({
+      organizationId: membership.organization.toString()
+    });
+  });
 
-		// update organization membership statuses that are
-		// invited to completed with user attached
-		await MembershipOrg.updateMany(
-			{
-				inviteEmail: email,
-				status: INVITED
-			},
-			{
-				user,
-				status: ACCEPTED
-			}
-		);
+  // update organization membership statuses that are
+  // invited to completed with user attached
+  await MembershipOrg.updateMany(
+    {
+      inviteEmail: email,
+      status: INVITED
+    },
+    {
+      user,
+      status: ACCEPTED
+    }
+  );
 
-		// issue tokens
-		const tokens = await issueAuthTokens({
-			userId: user._id.toString()
-		});
+  // issue tokens
+  const tokens = await issueAuthTokens({
+    userId: user._id,
+    ip: req.realIP,
+    userAgent: req.headers['user-agent'] ?? ''
+  });
 
-		token = tokens.token;
+  token = tokens.token;
 
-		// sending a welcome email to new users
-		if (await getLoopsApiKey()) {
-			await standardRequest.post("https://app.loops.so/api/v1/events/send", {
-				"email": email,
-				"eventName": "Sign Up",
-				"firstName": firstName,
-				"lastName": lastName
-			}, {
-				headers: {
-					"Accept": "application/json",
-					"Authorization": "Bearer " + (await getLoopsApiKey())
-				},
-			});
-		}
+  // sending a welcome email to new users
+  if (await getLoopsApiKey()) {
+    await standardRequest.post("https://app.loops.so/api/v1/events/send", {
+      "email": email,
+      "eventName": "Sign Up",
+      "firstName": firstName,
+      "lastName": lastName
+    }, {
+      headers: {
+        "Accept": "application/json",
+        "Authorization": "Bearer " + (await getLoopsApiKey())
+      },
+    });
+  }
 
-		// store (refresh) token in httpOnly cookie
-		res.cookie('jid', tokens.refreshToken, {
-			httpOnly: true,
-			path: '/',
-			sameSite: 'strict',
-			secure: await getHttpsEnabled()
-		});
-	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to complete account setup'
-		});
-	}
+  // store (refresh) token in httpOnly cookie
+  res.cookie('jid', tokens.refreshToken, {
+    httpOnly: true,
+    path: '/',
+    sameSite: 'strict',
+    secure: await getHttpsEnabled()
+  });
 
 	return res.status(200).send({
 		message: 'Successfully set up account',
@@ -167,109 +160,103 @@ export const completeAccountSignup = async (req: Request, res: Response) => {
  */
 export const completeAccountInvite = async (req: Request, res: Response) => {
 	let user, token, refreshToken;
-	try {
-		const {
-			email,
-			firstName,
-			lastName,
-			protectedKey,
-			protectedKeyIV,
-			protectedKeyTag,
-			publicKey,
-			encryptedPrivateKey,
-			encryptedPrivateKeyIV,
-			encryptedPrivateKeyTag,
-			salt,
-			verifier
-		} = req.body;
+  const {
+    email,
+    firstName,
+    lastName,
+    protectedKey,
+    protectedKeyIV,
+    protectedKeyTag,
+    publicKey,
+    encryptedPrivateKey,
+    encryptedPrivateKeyIV,
+    encryptedPrivateKeyTag,
+    salt,
+    verifier
+  } = req.body;
 
-		// get user
-		user = await User.findOne({ email });
+  // get user
+  user = await User.findOne({ email });
 
-		if (!user || (user && user?.publicKey)) {
-			// case 1: user doesn't exist.
-			// case 2: user has already completed account
-			return res.status(403).send({
-				error: 'Failed to complete account for complete user'
-			});
-		}
+  if (!user || (user && user?.publicKey)) {
+    // case 1: user doesn't exist.
+    // case 2: user has already completed account
+    return res.status(403).send({
+      error: 'Failed to complete account for complete user'
+    });
+  }
 
-		const membershipOrg = await MembershipOrg.findOne({
-			inviteEmail: email,
-			status: INVITED
-		});
+  const membershipOrg = await MembershipOrg.findOne({
+    inviteEmail: email,
+    status: INVITED
+  });
 
-		if (!membershipOrg) throw new Error('Failed to find invitations for email');
+  if (!membershipOrg) throw new Error('Failed to find invitations for email');
 
-		// complete setting up user's account
-		user = await completeAccount({
-			userId: user._id.toString(),
-			firstName,
-			lastName,
-			encryptionVersion: 2,
-			protectedKey,
-			protectedKeyIV,
-			protectedKeyTag,
-			publicKey,
-			encryptedPrivateKey,
-			encryptedPrivateKeyIV,
-			encryptedPrivateKeyTag,
-			salt,
-			verifier
-		});
+  // complete setting up user's account
+  user = await completeAccount({
+    userId: user._id.toString(),
+    firstName,
+    lastName,
+    encryptionVersion: 2,
+    protectedKey,
+    protectedKeyIV,
+    protectedKeyTag,
+    publicKey,
+    encryptedPrivateKey,
+    encryptedPrivateKeyIV,
+    encryptedPrivateKeyTag,
+    salt,
+    verifier
+  });
 
-		if (!user)
-			throw new Error('Failed to complete account for non-existent user');
-		
-		// update organization membership statuses that are
-		// invited to completed with user attached
-		const membershipsToUpdate = await MembershipOrg.find({
-			inviteEmail: email,
-			status: INVITED
-		});
-		
-		membershipsToUpdate.forEach(async (membership) => {
-			await updateSubscriptionOrgQuantity({
-				organizationId: membership.organization.toString()
-			});
-		});
+  if (!user)
+    throw new Error('Failed to complete account for non-existent user');
+  
+  // update organization membership statuses that are
+  // invited to completed with user attached
+  const membershipsToUpdate = await MembershipOrg.find({
+    inviteEmail: email,
+    status: INVITED
+  });
+  
+  membershipsToUpdate.forEach(async (membership) => {
+    await updateSubscriptionOrgQuantity({
+      organizationId: membership.organization.toString()
+    });
+  });
 
-		await MembershipOrg.updateMany(
-			{
-				inviteEmail: email,
-				status: INVITED
-			},
-			{
-				user,
-				status: ACCEPTED
-			}
-		);
+  await MembershipOrg.updateMany(
+    {
+      inviteEmail: email,
+      status: INVITED
+    },
+    {
+      user,
+      status: ACCEPTED
+    }
+  );
 
-		// issue tokens
-		const tokens = await issueAuthTokens({
-			userId: user._id.toString()
-		});
+  // issue tokens
+  const tokens = await issueAuthTokens({
+    userId: user._id,
+    ip: req.realIP,
+    userAgent: req.headers['user-agent'] ?? ''
+  });
 
-		token = tokens.token;
+  token = tokens.token;
 
-		// store (refresh) token in httpOnly cookie
-		res.cookie('jid', tokens.refreshToken, {
-			httpOnly: true,
-			path: '/',
-			sameSite: 'strict',
-			secure: await getHttpsEnabled()
-		});
-	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to complete account setup'
-		});
-	}
+  // store (refresh) token in httpOnly cookie
+  res.cookie('jid', tokens.refreshToken, {
+    httpOnly: true,
+    path: '/',
+    sameSite: 'strict',
+    secure: await getHttpsEnabled()
+  });
 
 	return res.status(200).send({
 		message: 'Successfully set up account',
 		user,
 		token
 	});
-};
+};

backend/src/controllers/v2/tagController.ts

@@ -1,5 +1,4 @@
 import { Request, Response } from 'express';
-import * as Sentry from '@sentry/node';
 import { Types } from 'mongoose';
 import {
 	Membership, Secret,
@@ -69,4 +68,4 @@ export const getWorkspaceTags = async (req: Request, res: Response) => {
 	return res.json({
 		workspaceTags
 	})
-}
+}

backend/src/controllers/v2/usersController.ts

@@ -1,5 +1,4 @@
 import { Request, Response } from 'express';
-import * as Sentry from '@sentry/node';
 import {
     User,
     MembershipOrg
@@ -37,18 +36,9 @@ export const getMe = async (req: Request, res: Response) => {
         }
     }   
     */
-    let user;
-    try {
-        user = await User
-            .findById(req.user._id)
-            .select('+salt +publicKey +encryptedPrivateKey +iv +tag +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag');
-    } catch (err) {
-        Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get current user'
-		});
-    }
+    const user = await User
+        .findById(req.user._id)
+        .select('+salt +publicKey +encryptedPrivateKey +iv +tag +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag');
     
     return res.status(200).send({
         user
@@ -64,29 +54,20 @@ export const getMe = async (req: Request, res: Response) => {
  * @returns 
  */
 export const updateMyMfaEnabled = async (req: Request, res: Response) => {
-    let user;
-    try {
-        const { isMfaEnabled }: { isMfaEnabled: boolean } = req.body;
-        req.user.isMfaEnabled = isMfaEnabled;
-        
-        if (isMfaEnabled) { 
-            // TODO: adapt this route/controller 
-            // to work for different forms of MFA
-            req.user.mfaMethods = ['email'];
-        } else {
-            req.user.mfaMethods = [];
-        }
-
-        await req.user.save();
-        
-        user = req.user;
-    } catch (err) {
-        Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: "Failed to update current user's MFA status"
-		}); 
+    const { isMfaEnabled }: { isMfaEnabled: boolean } = req.body;
+    req.user.isMfaEnabled = isMfaEnabled;
+    
+    if (isMfaEnabled) { 
+        // TODO: adapt this route/controller 
+        // to work for different forms of MFA
+        req.user.mfaMethods = ['email'];
+    } else {
+        req.user.mfaMethods = [];
     }
+
+    await req.user.save();
+    
+    const user = req.user;
     
     return res.status(200).send({
         user
@@ -126,22 +107,13 @@ export const getMyOrganizations = async (req: Request, res: Response) => {
         }
     }   
     */
-	let organizations;
-	try {
-		organizations = (
-			await MembershipOrg.find({
-				user: req.user._id
-			}).populate('organization')
-		).map((m) => m.organization);
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: "Failed to get current user's organizations"
-		});
-	}
+  const organizations = (
+    await MembershipOrg.find({
+      user: req.user._id
+    }).populate('organization')
+  ).map((m) => m.organization);
 
 	return res.status(200).send({
 		organizations
 	});
-}
+}

backend/src/controllers/v2/workspaceController.ts

@@ -1,5 +1,4 @@
 import { Request, Response } from 'express';
-import * as Sentry from '@sentry/node';
 import { Types } from 'mongoose';
 import {
 	Workspace,
@@ -47,66 +46,57 @@ interface V2PushSecret {
  */
 export const pushWorkspaceSecrets = async (req: Request, res: Response) => {
 	// upload (encrypted) secrets to workspace with id [workspaceId]
-	try {
-		const postHogClient = await TelemetryService.getPostHogClient();
-		let { secrets }: { secrets: V2PushSecret[] } = req.body;
-		const { keys, environment, channel } = req.body;
-		const { workspaceId } = req.params;
+  const postHogClient = await TelemetryService.getPostHogClient();
+  let { secrets }: { secrets: V2PushSecret[] } = req.body;
+  const { keys, environment, channel } = req.body;
+  const { workspaceId } = req.params;
 
-		// validate environment
-		const workspaceEnvs = req.membership.workspace.environments;
-		if (!workspaceEnvs.find(({ slug }: { slug: string }) => slug === environment)) {
-			throw new Error('Failed to validate environment');
-		}
+  // validate environment
+  const workspaceEnvs = req.membership.workspace.environments;
+  if (!workspaceEnvs.find(({ slug }: { slug: string }) => slug === environment)) {
+    throw new Error('Failed to validate environment');
+  }
 
-		// sanitize secrets
-		secrets = secrets.filter(
-			(s: V2PushSecret) => s.secretKeyCiphertext !== '' && s.secretValueCiphertext !== ''
-		);
+  // sanitize secrets
+  secrets = secrets.filter(
+    (s: V2PushSecret) => s.secretKeyCiphertext !== '' && s.secretValueCiphertext !== ''
+  );
 
-		await push({
-			userId: req.user._id,
-			workspaceId,
-			environment,
-			secrets,
-			channel: channel ? channel : 'cli',
-			ipAddress: req.ip
-		});
+  await push({
+    userId: req.user._id,
+    workspaceId,
+    environment,
+    secrets,
+    channel: channel ? channel : 'cli',
+    ipAddress: req.realIP
+  });
 
-		await pushKeys({
-			userId: req.user._id,
-			workspaceId,
-			keys
-		});
+  await pushKeys({
+    userId: req.user._id,
+    workspaceId,
+    keys
+  });
 
-		if (postHogClient) {
-			postHogClient.capture({
-				event: 'secrets pushed',
-				distinctId: req.user.email,
-				properties: {
-					numberOfSecrets: secrets.length,
-					environment,
-					workspaceId,
-					channel: channel ? channel : 'cli'
-				}
-			});
-		}
+  if (postHogClient) {
+    postHogClient.capture({
+      event: 'secrets pushed',
+      distinctId: req.user.email,
+      properties: {
+        numberOfSecrets: secrets.length,
+        environment,
+        workspaceId,
+        channel: channel ? channel : 'cli'
+      }
+    });
+  }
 
-		// trigger event - push secrets
-		EventService.handleEvent({
-			event: eventPushSecrets({
-				workspaceId: new Types.ObjectId(workspaceId),
-				environment
-			})
-		});
-
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to upload workspace secrets'
-		});
-	}
+  // trigger event - push secrets
+  EventService.handleEvent({
+    event: eventPushSecrets({
+      workspaceId: new Types.ObjectId(workspaceId),
+      environment
+    })
+  });
 
 	return res.status(200).send({
 		message: 'Successfully uploaded workspace secrets'
@@ -122,56 +112,48 @@ export const pushWorkspaceSecrets = async (req: Request, res: Response) => {
  */
 export const pullSecrets = async (req: Request, res: Response) => {
 	let secrets;
-	try {
-		const postHogClient = await TelemetryService.getPostHogClient();
-		const environment: string = req.query.environment as string;
-		const channel: string = req.query.channel as string;
-		const { workspaceId } = req.params;
+  const postHogClient = await TelemetryService.getPostHogClient();
+  const environment: string = req.query.environment as string;
+  const channel: string = req.query.channel as string;
+  const { workspaceId } = req.params;
 
-		let userId;
-		if (req.user) {
-			userId = req.user._id.toString();
-		} else if (req.serviceTokenData) {
-			userId = req.serviceTokenData.user.toString();
-		}
-		// validate environment
-		const workspaceEnvs = req.membership.workspace.environments;
-		if (!workspaceEnvs.find(({ slug }: { slug: string }) => slug === environment)) {
-			throw new Error('Failed to validate environment');
-		}
+  let userId;
+  if (req.user) {
+    userId = req.user._id.toString();
+  } else if (req.serviceTokenData) {
+    userId = req.serviceTokenData.user.toString();
+  }
+  // validate environment
+  const workspaceEnvs = req.membership.workspace.environments;
+  if (!workspaceEnvs.find(({ slug }: { slug: string }) => slug === environment)) {
+    throw new Error('Failed to validate environment');
+  }
 
-		secrets = await pull({
-			userId,
-			workspaceId,
-			environment,
-			channel: channel ? channel : 'cli',
-			ipAddress: req.ip
-		});
+  secrets = await pull({
+    userId,
+    workspaceId,
+    environment,
+    channel: channel ? channel : 'cli',
+    ipAddress: req.realIP
+  });
 
-		if (channel !== 'cli') {
-			secrets = reformatPullSecrets({ secrets });
-		}
+  if (channel !== 'cli') {
+    secrets = reformatPullSecrets({ secrets });
+  }
 
-		if (postHogClient) {
-			// capture secrets pushed event in production
-			postHogClient.capture({
-				distinctId: req.user.email,
-				event: 'secrets pulled',
-				properties: {
-					numberOfSecrets: secrets.length,
-					environment,
-					workspaceId,
-					channel: channel ? channel : 'cli'
-				}
-			});
-		}
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to pull workspace secrets'
-		});
-	}
+  if (postHogClient) {
+    // capture secrets pushed event in production
+    postHogClient.capture({
+      distinctId: req.user.email,
+      event: 'secrets pulled',
+      properties: {
+        numberOfSecrets: secrets.length,
+        environment,
+        workspaceId,
+        channel: channel ? channel : 'cli'
+      }
+    });
+  }
 
 	return res.status(200).send({
 		secrets
@@ -208,22 +190,14 @@ export const getWorkspaceKey = async (req: Request, res: Response) => {
     }   
     */
 	let key;
-	try {
-		const { workspaceId } = req.params;
+  const { workspaceId } = req.params;
 
-		key = await Key.findOne({
-			workspace: workspaceId,
-			receiver: req.user._id
-		}).populate('sender', '+publicKey');
+  key = await Key.findOne({
+    workspace: workspaceId,
+    receiver: req.user._id
+  }).populate('sender', '+publicKey');
 
-		if (!key) throw new Error('Failed to find workspace key');
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get workspace key'
-		});
-	}
+  if (!key) throw new Error('Failed to find workspace key');
 
 	return res.status(200).json(key);
 }
@@ -231,23 +205,13 @@ export const getWorkspaceServiceTokenData = async (
 	req: Request,
 	res: Response
 ) => {
-	let serviceTokenData;
-	try {
-		const { workspaceId } = req.params;
+  const { workspaceId } = req.params;
 
-		serviceTokenData = await ServiceTokenData
-			.find({
-				workspace: workspaceId
-			})
-			.select('+encryptedKey +iv +tag');
-
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get workspace service token data'
-		});
-	}
+  const serviceTokenData = await ServiceTokenData
+    .find({
+      workspace: workspaceId
+    })
+    .select('+encryptedKey +iv +tag');
 
 	return res.status(200).send({
 		serviceTokenData
@@ -294,20 +258,11 @@ export const getWorkspaceMemberships = async (req: Request, res: Response) => {
         }
     }   
     */
-	let memberships;
-	try {
-		const { workspaceId } = req.params;
+  const { workspaceId } = req.params;
 
-		memberships = await Membership.find({
-			workspace: workspaceId
-		}).populate('user', '+publicKey');
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get workspace memberships'
-		});
-	}
+  const memberships = await Membership.find({
+    workspace: workspaceId
+  }).populate('user', '+publicKey');
 
 	return res.status(200).send({
 		memberships
@@ -374,29 +329,20 @@ export const updateWorkspaceMembership = async (req: Request, res: Response) =>
         }
     }   
     */
-	let membership;
-	try {
-		const {
-			membershipId
-		} = req.params;
-		const { role } = req.body;
-		
-		membership = await Membership.findByIdAndUpdate(
-			membershipId,
-			{
-				role
-			}, {
-				new: true
-			}
-		);
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to update workspace membership'
-		});
-	}
-	
+  const {
+    membershipId
+  } = req.params;
+  const { role } = req.body;
+  
+  const membership = await Membership.findByIdAndUpdate(
+    membershipId,
+    {
+      role
+    }, {
+      new: true
+    }
+  );
+
 	return res.status(200).send({
 		membership
 	}); 
@@ -445,27 +391,18 @@ export const deleteWorkspaceMembership = async (req: Request, res: Response) =>
         }
     }   
     */
-	let membership;
-	try {
-		const { 
-			membershipId
-		} = req.params;
-		
-		membership = await Membership.findByIdAndDelete(membershipId);
-		
-		if (!membership) throw new Error('Failed to delete workspace membership');
-		
-		await Key.deleteMany({
-			receiver: membership.user,
-			workspace: membership.workspace
-		});
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to delete workspace membership'
-		});	
-	}
+  const { 
+    membershipId
+  } = req.params;
+  
+  const membership = await Membership.findByIdAndDelete(membershipId);
+  
+  if (!membership) throw new Error('Failed to delete workspace membership');
+  
+  await Key.deleteMany({
+    receiver: membership.user,
+    workspace: membership.workspace
+  });
 	
 	return res.status(200).send({
 		membership
@@ -479,32 +416,23 @@ export const deleteWorkspaceMembership = async (req: Request, res: Response) =>
  * @returns
  */
 export const toggleAutoCapitalization = async (req: Request, res: Response) => {
-	let workspace;
-	try {
-		const { workspaceId } = req.params;
-		const { autoCapitalization } = req.body;
+  const { workspaceId } = req.params;
+  const { autoCapitalization } = req.body;
 
-		workspace = await Workspace.findOneAndUpdate(
-			{
-				_id: workspaceId
-			},
-			{
-				autoCapitalization
-			},
-			{
-				new: true
-			}
-		);
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to change autoCapitalization setting'
-		});
-	}
+  const workspace = await Workspace.findOneAndUpdate(
+    {
+      _id: workspaceId
+    },
+    {
+      autoCapitalization
+    },
+    {
+      new: true
+    }
+  );
 
 	return res.status(200).send({
 		message: 'Successfully changed autoCapitalization setting',
 		workspace
 	});
-};
+};

backend/src/controllers/v3/authController.ts

@@ -113,7 +113,7 @@ export const login2 = async (req: Request, res: Response) => {
 
         const user = await User.findOne({
             email,
-        }).select('+salt +verifier +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag +publicKey +encryptedPrivateKey +iv +tag');
+        }).select('+salt +verifier +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag +publicKey +encryptedPrivateKey +iv +tag +devices');
 
         if (!user) throw new Error('Failed to find user');
 
@@ -179,12 +179,16 @@ export const login2 = async (req: Request, res: Response) => {
 
                     await checkUserDevice({
                         user,
-                        ip: req.ip,
+                        ip: req.realIP,
                         userAgent: req.headers['user-agent'] ?? ''
                     });
 
                     // issue tokens
-                    const tokens = await issueAuthTokens({ userId: user._id.toString() });
+                    const tokens = await issueAuthTokens({ 
+                        userId: user._id,
+                        ip: req.realIP,
+                        userAgent: req.headers['user-agent'] ?? ''
+                    });
 
                     // store (refresh) token in httpOnly cookie
                     res.cookie('jid', tokens.refreshToken, {
@@ -239,7 +243,7 @@ export const login2 = async (req: Request, res: Response) => {
                         userId: user._id,
                         actions: [loginAction],
                         channel: getChannelFromUserAgent(req.headers['user-agent']),
-                        ipAddress: req.ip
+                        ipAddress: req.realIP
                     });
 
                     return res.status(200).send(response);

backend/src/controllers/v3/signupController.ts

@@ -137,7 +137,9 @@ export const completeAccountSignup = async (req: Request, res: Response) => {
 
 		// issue tokens
 		const tokens = await issueAuthTokens({
-			userId: user._id.toString()
+			userId: user._id,
+			ip: req.realIP,
+			userAgent: req.headers['user-agent'] ?? ''
 		});
 
 		token = tokens.token;

backend/src/ee/controllers/v1/actionController.ts

@@ -1,5 +1,4 @@
 import { Request, Response } from 'express';
-import * as Sentry from '@sentry/node';
 import { Action, SecretVersion } from '../../models';
 import { ActionNotFoundError } from '../../../utils/errors';
 
@@ -28,4 +27,4 @@ export const getAction = async (req: Request, res: Response) => {
     return res.status(200).send({
         action
     });
-}
+}

backend/src/ee/controllers/v1/cloudProductsController.ts

@@ -1,4 +1,3 @@
-import * as Sentry from '@sentry/node';
 import { Request, Response } from 'express';
 import { EELicenseService } from '../../services';
 import { getLicenseServerUrl } from '../../../config';
@@ -12,23 +11,18 @@ import { licenseServerKeyRequest } from '../../../config/request';
  * @returns 
  */
 export const getCloudProducts = async (req: Request, res: Response) => {
-    try {
-        const billingCycle = req.query['billing-cycle'] as string;
+    const billingCycle = req.query['billing-cycle'] as string;
 
-        if (EELicenseService.instanceType === 'cloud') {
-            const { data } = await licenseServerKeyRequest.get(
-                `${await getLicenseServerUrl()}/api/license-server/v1/cloud-products?billing-cycle=${billingCycle}`
-            ); 
+    if (EELicenseService.instanceType === 'cloud') {
+        const { data } = await licenseServerKeyRequest.get(
+            `${await getLicenseServerUrl()}/api/license-server/v1/cloud-products?billing-cycle=${billingCycle}`
+        ); 
 
-            return res.status(200).send(data);
-        }
-    } catch (err) {
-        Sentry.setUser({ email: req.user.email });
-        Sentry.captureException(err);
+        return res.status(200).send(data);
     }
     
     return res.status(200).send({
         head: [],
         rows: []
     });
-}
+}

backend/src/ee/controllers/v1/secretController.ts

@@ -1,5 +1,4 @@
 import { Request, Response } from "express";
-import * as Sentry from "@sentry/node";
 import { Secret } from "../../../models";
 import { SecretVersion } from "../../models";
 import { EESecretService } from "../../services";
@@ -55,29 +54,20 @@ export const getSecretVersions = async (req: Request, res: Response) => {
         }
     }   
     */
-  let secretVersions;
-  try {
-    const { secretId, workspaceId, environment, folderId } = req.params;
+  const { secretId, workspaceId, environment, folderId } = req.params;
 
-    const offset: number = parseInt(req.query.offset as string);
-    const limit: number = parseInt(req.query.limit as string);
+  const offset: number = parseInt(req.query.offset as string);
+  const limit: number = parseInt(req.query.limit as string);
 
-    secretVersions = await SecretVersion.find({
-      secret: secretId,
-      workspace: workspaceId,
-      environment,
-      folder: folderId,
-    })
-      .sort({ createdAt: -1 })
-      .skip(offset)
-      .limit(limit);
-  } catch (err) {
-    Sentry.setUser({ email: req.user.email });
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: "Failed to get secret versions",
-    });
-  }
+  const secretVersions = await SecretVersion.find({
+    secret: secretId,
+    workspace: workspaceId,
+    environment,
+    folder: folderId,
+  })
+    .sort({ createdAt: -1 })
+    .skip(offset)
+    .limit(limit);
 
   return res.status(200).send({
     secretVersions,
@@ -139,74 +129,45 @@ export const rollbackSecretVersion = async (req: Request, res: Response) => {
         }
     }   
     */
-  let secret;
-  try {
-    const { secretId } = req.params;
-    const { version } = req.body;
+  const { secretId } = req.params;
+  const { version } = req.body;
 
-    // validate secret version
-    const oldSecretVersion = await SecretVersion.findOne({
-      secret: secretId,
-      version,
-    }).select("+secretBlindIndex");
+  // validate secret version
+  const oldSecretVersion = await SecretVersion.findOne({
+    secret: secretId,
+    version,
+  }).select("+secretBlindIndex");
 
-    if (!oldSecretVersion) throw new Error("Failed to find secret version");
+  if (!oldSecretVersion) throw new Error("Failed to find secret version");
 
-    const {
-      workspace,
-      type,
-      user,
-      environment,
-      secretBlindIndex,
-      secretKeyCiphertext,
-      secretKeyIV,
-      secretKeyTag,
-      secretValueCiphertext,
-      secretValueIV,
-      secretValueTag,
-      folder,
-      algorithm,
-      keyEncoding,
-    } = oldSecretVersion;
+  const {
+    workspace,
+    type,
+    user,
+    environment,
+    secretBlindIndex,
+    secretKeyCiphertext,
+    secretKeyIV,
+    secretKeyTag,
+    secretValueCiphertext,
+    secretValueIV,
+    secretValueTag,
+    algorithm,
+    folder,
+    keyEncoding,
+  } = oldSecretVersion;
 
-    // update secret
-    secret = await Secret.findByIdAndUpdate(
-      secretId,
-      {
-        $inc: {
-          version: 1,
-        },
-        workspace,
-        type,
-        user,
-        environment,
-        ...(secretBlindIndex ? { secretBlindIndex } : {}),
-        secretKeyCiphertext,
-        secretKeyIV,
-        secretKeyTag,
-        secretValueCiphertext,
-        secretValueIV,
-        secretValueTag,
-        folderId: folder,
-        algorithm,
-        keyEncoding,
+  // update secret
+  const secret = await Secret.findByIdAndUpdate(
+    secretId,
+    {
+      $inc: {
+        version: 1,
       },
-      {
-        new: true,
-      }
-    );
-
-    if (!secret) throw new Error("Failed to find and update secret");
-
-    // add new secret version
-    await new SecretVersion({
-      secret: secretId,
-      version: secret.version,
       workspace,
       type,
       user,
       environment,
-      isDeleted: false,
       ...(secretBlindIndex ? { secretBlindIndex } : {}),
       secretKeyCiphertext,
       secretKeyIV,
@@ -214,24 +175,44 @@ export const rollbackSecretVersion = async (req: Request, res: Response) => {
       secretValueCiphertext,
       secretValueIV,
       secretValueTag,
-      folder,
+      folderId: folder,
       algorithm,
       keyEncoding,
-    }).save();
+    },
+    {
+      new: true,
+    }
+  );
 
-    // take secret snapshot
-    await EESecretService.takeSecretSnapshot({
-      workspaceId: secret.workspace,
-      environment,
-      folderId: folder,
-    });
-  } catch (err) {
-    Sentry.setUser({ email: req.user.email });
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: "Failed to roll back secret version",
-    });
-  }
+  if (!secret) throw new Error("Failed to find and update secret");
+
+  // add new secret version
+  await new SecretVersion({
+    secret: secretId,
+    version: secret.version,
+    workspace,
+    type,
+    user,
+    environment,
+    isDeleted: false,
+    ...(secretBlindIndex ? { secretBlindIndex } : {}),
+    secretKeyCiphertext,
+    secretKeyIV,
+    secretKeyTag,
+    secretValueCiphertext,
+    secretValueIV,
+    secretValueTag,
+    folder,
+    algorithm,
+    keyEncoding,
+  }).save();
+
+  // take secret snapshot
+  await EESecretService.takeSecretSnapshot({
+    workspaceId: secret.workspace,
+    environment,
+    folderId: folder,
+  });
 
   return res.status(200).send({
     secret,

backend/src/ee/controllers/v1/secretSnapshotController.ts

@@ -1,5 +1,4 @@
 import { Request, Response } from "express";
-import * as Sentry from "@sentry/node";
 import {
   ISecretVersion,
   SecretSnapshot,
@@ -13,29 +12,21 @@ import {
  * @returns
  */
 export const getSecretSnapshot = async (req: Request, res: Response) => {
-  let secretSnapshot;
-  try {
-    const { secretSnapshotId } = req.params;
+  const { secretSnapshotId } = req.params;
 
-    secretSnapshot = await SecretSnapshot.findById(secretSnapshotId)
-      .lean()
-      .populate<{ secretVersions: ISecretVersion[] }>({
-        path: 'secretVersions',
-        populate: {
-          path: 'tags',
-          model: 'Tag'
-        }
-      })
-      .populate<{ folderVersion: TFolderRootVersionSchema }>("folderVersion");
-
-    if (!secretSnapshot) throw new Error("Failed to find secret snapshot");
-  } catch (err) {
-    Sentry.setUser({ email: req.user.email });
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: "Failed to get secret snapshot",
-    });
-  }
+  const secretSnapshot = await SecretSnapshot.findById(secretSnapshotId)
+    .lean()
+    .populate<{ secretVersions: ISecretVersion[] }>({
+      path: 'secretVersions',
+      populate: {
+        path: 'tags',
+        model: 'Tag'
+      }
+    })
+    .populate<{ folderVersion: TFolderRootVersionSchema }>("folderVersion");
+  
+  if (!secretSnapshot) throw new Error("Failed to find secret snapshot");
+  
   const folderId = secretSnapshot.folderId;
   // to show only the folder required secrets
   secretSnapshot.secretVersions = secretSnapshot.secretVersions.filter(

backend/src/ee/controllers/v1/stripeController.ts

@@ -1,4 +1,3 @@
-import * as Sentry from '@sentry/node';
 import { Request, Response } from 'express';
 import Stripe from 'stripe';
 import { getStripeSecretKey, getStripeWebhookSecret } from '../../../config';
@@ -10,26 +9,17 @@ import { getStripeSecretKey, getStripeWebhookSecret } from '../../../config';
  * @returns
  */
 export const handleWebhook = async (req: Request, res: Response) => {
-	let event;
-	try {
-		const stripe = new Stripe(await getStripeSecretKey(), {
-			apiVersion: '2022-08-01'
-		});
+  const stripe = new Stripe(await getStripeSecretKey(), {
+    apiVersion: '2022-08-01'
+  });
 
-		// check request for valid stripe signature
-		const sig = req.headers['stripe-signature'] as string;
-		event = stripe.webhooks.constructEvent(
-			req.body,
-			sig,
-			await getStripeWebhookSecret()
-		);
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			error: 'Failed to process webhook'
-		});
-	}
+  // check request for valid stripe signature
+  const sig = req.headers['stripe-signature'] as string;
+  const event = stripe.webhooks.constructEvent(
+    req.body,
+    sig,
+    await getStripeWebhookSecret()
+  );
 
 	switch (event.type) {
 		case '':

backend/src/ee/controllers/v1/workspaceController.ts

@@ -1,5 +1,4 @@
 import { Request, Response } from "express";
-import * as Sentry from "@sentry/node";
 import { PipelineStage, Types } from "mongoose";
 import { Secret } from "../../../models";
 import {
@@ -69,29 +68,20 @@ export const getWorkspaceSecretSnapshots = async (
         }
     }
     */
-  let secretSnapshots;
-  try {
-    const { workspaceId } = req.params;
-    const { environment, folderId } = req.query;
+  const { workspaceId } = req.params;
+  const { environment, folderId } = req.query;
 
-    const offset: number = parseInt(req.query.offset as string);
-    const limit: number = parseInt(req.query.limit as string);
+  const offset: number = parseInt(req.query.offset as string);
+  const limit: number = parseInt(req.query.limit as string);
 
-    secretSnapshots = await SecretSnapshot.find({
-      workspace: workspaceId,
-      environment,
-      folderId: folderId || "root",
-    })
-      .sort({ createdAt: -1 })
-      .skip(offset)
-      .limit(limit);
-  } catch (err) {
-    Sentry.setUser({ email: req.user.email });
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: "Failed to get secret snapshots",
-    });
-  }
+  const secretSnapshots = await SecretSnapshot.find({
+    workspace: workspaceId,
+    environment,
+    folderId: folderId || "root",
+  })
+    .sort({ createdAt: -1 })
+    .skip(offset)
+    .limit(limit);
 
   return res.status(200).send({
     secretSnapshots,
@@ -107,23 +97,14 @@ export const getWorkspaceSecretSnapshotsCount = async (
   req: Request,
   res: Response
 ) => {
-  let count;
-  try {
-    const { workspaceId } = req.params;
-    const { environment, folderId } = req.query;
+  const { workspaceId } = req.params;
+  const { environment, folderId } = req.query;
 
-    count = await SecretSnapshot.countDocuments({
-      workspace: workspaceId,
-      environment,
-      folderId: folderId || "root",
-    });
-  } catch (err) {
-    Sentry.setUser({ email: req.user.email });
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: "Failed to count number of secret snapshots",
-    });
-  }
+  const count = await SecretSnapshot.countDocuments({
+    workspace: workspaceId,
+    environment,
+    folderId: folderId || "root",
+  });
 
   return res.status(200).send({
     count,
@@ -191,324 +172,315 @@ export const rollbackWorkspaceSecretSnapshot = async (
     }   
     */
 
-  let secrets;
-  try {
-    const { workspaceId } = req.params;
-    const { version, environment, folderId = "root" } = req.body;
+  const { workspaceId } = req.params;
+  const { version, environment, folderId = "root" } = req.body;
 
-    // validate secret snapshot
-    const secretSnapshot = await SecretSnapshot.findOne({
-      workspace: workspaceId,
-      version,
-      environment,
-      folderId: folderId,
+  // validate secret snapshot
+  const secretSnapshot = await SecretSnapshot.findOne({
+    workspace: workspaceId,
+    version,
+    environment,
+    folderId: folderId,
+  })
+    .populate<{ secretVersions: ISecretVersion[] }>({
+      path: "secretVersions",
+      select: "+secretBlindIndex",
     })
-      .populate<{ secretVersions: ISecretVersion[] }>({
-        path: "secretVersions",
-        select: "+secretBlindIndex",
-      })
-      .populate<{ folderVersion: TFolderRootVersionSchema }>("folderVersion");
+    .populate<{ folderVersion: TFolderRootVersionSchema }>("folderVersion");
 
-    if (!secretSnapshot) throw new Error("Failed to find secret snapshot");
+  if (!secretSnapshot) throw new Error("Failed to find secret snapshot");
 
-    const snapshotFolderTree = secretSnapshot.folderVersion;
-    const latestFolderTree = await Folder.findOne({
-      workspace: workspaceId,
-      environment,
-    });
+  const snapshotFolderTree = secretSnapshot.folderVersion;
+  const latestFolderTree = await Folder.findOne({
+    workspace: workspaceId,
+    environment,
+  });
 
-    const latestFolderVersion = await FolderVersion.findOne({
-      environment,
-      workspace: workspaceId,
-      "nodes.id": folderId,
-    }).sort({ "nodes.version": -1 });
+  const latestFolderVersion = await FolderVersion.findOne({
+    environment,
+    workspace: workspaceId,
+    "nodes.id": folderId,
+  }).sort({ "nodes.version": -1 });
 
-    const oldSecretVersionsObj: Record<string, ISecretVersion> = {};
-    const secretIds: Types.ObjectId[] = [];
-    const folderIds: string[] = [folderId];
+  const oldSecretVersionsObj: Record<string, ISecretVersion> = {};
+  const secretIds: Types.ObjectId[] = [];
+  const folderIds: string[] = [folderId];
 
-    secretSnapshot.secretVersions.forEach((snapSecVer) => {
-      oldSecretVersionsObj[snapSecVer.secret.toString()] = snapSecVer;
-      secretIds.push(snapSecVer.secret);
-    });
+  secretSnapshot.secretVersions.forEach((snapSecVer) => {
+    oldSecretVersionsObj[snapSecVer.secret.toString()] = snapSecVer;
+    secretIds.push(snapSecVer.secret);
+  });
 
-    // the parent node from current latest one
-    // this will be modified according to the snapshot and latest snapshots
-    const newFolderTree =
-      latestFolderTree && searchByFolderId(latestFolderTree.nodes, folderId);
+  // the parent node from current latest one
+  // this will be modified according to the snapshot and latest snapshots
+  const newFolderTree =
+    latestFolderTree && searchByFolderId(latestFolderTree.nodes, folderId);
 
-    if (newFolderTree) {
-      newFolderTree.children = snapshotFolderTree?.nodes?.children || [];
-      const queue = [newFolderTree];
-      // a bfs algorithm in which we take the latest snapshots of all the folders in a level
+  if (newFolderTree) {
+    newFolderTree.children = snapshotFolderTree?.nodes?.children || [];
+    const queue = [newFolderTree];
+    // a bfs algorithm in which we take the latest snapshots of all the folders in a level
+    while (queue.length) {
+      const groupByFolderId: Record<string, TFolderSchema> = {};
+      // the original queue is popped out completely to get what ever in a level
+      // subqueue is filled with all the children thus next level folders
+      // subQueue will then be transfered to the oriinal queue
+      const subQueue: TFolderSchema[] = [];
+      // get everything inside a level
       while (queue.length) {
-        const groupByFolderId: Record<string, TFolderSchema> = {};
-        // the original queue is popped out completely to get what ever in a level
-        // subqueue is filled with all the children thus next level folders
-        // subQueue will then be transfered to the oriinal queue
-        const subQueue: TFolderSchema[] = [];
-        // get everything inside a level
-        while (queue.length) {
-          const folder = queue.pop() as TFolderSchema;
-          folder.children.forEach((el) => {
-            folderIds.push(el.id); // push ids and data into queu
-            subQueue.push(el);
-            // to modify the original tree very fast we keep a reference object
-            // key with folder id and pointing to the various nodes
-            groupByFolderId[el.id] = el;
-          });
-        }
-        // get latest snapshots of all the folder
-        const matchWsFoldersPipeline = {
-          $match: {
-            workspace: new Types.ObjectId(workspaceId),
-            environment,
-            folderId: {
-              $in: Object.keys(groupByFolderId),
-            },
-          },
-        };
-        const sortByFolderIdAndVersion: PipelineStage = {
-          $sort: { folderId: 1, version: -1 },
-        };
-        const pickLatestVersionOfEachFolder = {
-          $group: {
-            _id: "$folderId",
-            latestVersion: { $first: "$version" },
-            doc: {
-              $first: "$$ROOT",
-            },
-          },
-        };
-        const populateSecVersion = {
-          $lookup: {
-            from: SecretVersion.collection.name,
-            localField: "doc.secretVersions",
-            foreignField: "_id",
-            as: "doc.secretVersions",
-          },
-        };
-        const populateFolderVersion = {
-          $lookup: {
-            from: FolderVersion.collection.name,
-            localField: "doc.folderVersion",
-            foreignField: "_id",
-            as: "doc.folderVersion",
-          },
-        };
-        const unwindFolderVerField = {
-          $unwind: {
-            path: "$doc.folderVersion",
-            preserveNullAndEmptyArrays: true,
-          },
-        };
-        const latestSnapshotsByFolders: Array<{ doc: typeof secretSnapshot }> =
-          await SecretSnapshot.aggregate([
-            matchWsFoldersPipeline,
-            sortByFolderIdAndVersion,
-            pickLatestVersionOfEachFolder,
-            populateSecVersion,
-            populateFolderVersion,
-            unwindFolderVerField,
-          ]);
-
-        // recursive snapshotting each level
-        latestSnapshotsByFolders.forEach((snap) => {
-          // mutate the folder tree to update the nodes to the latest version tree
-          // we are reconstructing the folder tree by latest snapshots here
-          if (groupByFolderId[snap.doc.folderId]) {
-            groupByFolderId[snap.doc.folderId].children =
-              snap.doc?.folderVersion?.nodes?.children || [];
-          }
-
-          // push all children of next level snapshots
-          if (snap.doc.folderVersion?.nodes?.children) {
-            queue.push(...snap.doc.folderVersion.nodes.children);
-          }
-
-          snap.doc.secretVersions.forEach((snapSecVer) => {
-            // record all the secrets
-            oldSecretVersionsObj[snapSecVer.secret.toString()] = snapSecVer;
-            secretIds.push(snapSecVer.secret);
-          });
+        const folder = queue.pop() as TFolderSchema;
+        folder.children.forEach((el) => {
+          folderIds.push(el.id); // push ids and data into queu
+          subQueue.push(el);
+          // to modify the original tree very fast we keep a reference object
+          // key with folder id and pointing to the various nodes
+          groupByFolderId[el.id] = el;
         });
-
-        queue.push(...subQueue);
       }
-    }
-
-    // TODO: fix any
-    const latestSecretVersionIds = await getLatestSecretVersionIds({
-      secretIds,
-    });
-
-    // TODO: fix any
-    const latestSecretVersions: any = (
-      await SecretVersion.find(
-        {
-          _id: {
-            $in: latestSecretVersionIds.map((s) => s.versionId),
+      // get latest snapshots of all the folder
+      const matchWsFoldersPipeline = {
+        $match: {
+          workspace: new Types.ObjectId(workspaceId),
+          environment,
+          folderId: {
+            $in: Object.keys(groupByFolderId),
           },
         },
-        "secret version"
-      )
-    ).reduce(
-      (accumulator, s) => ({
-        ...accumulator,
-        [`${s.secret.toString()}`]: s,
-      }),
-      {}
-    );
+      };
+      const sortByFolderIdAndVersion: PipelineStage = {
+        $sort: { folderId: 1, version: -1 },
+      };
+      const pickLatestVersionOfEachFolder = {
+        $group: {
+          _id: "$folderId",
+          latestVersion: { $first: "$version" },
+          doc: {
+            $first: "$$ROOT",
+          },
+        },
+      };
+      const populateSecVersion = {
+        $lookup: {
+          from: SecretVersion.collection.name,
+          localField: "doc.secretVersions",
+          foreignField: "_id",
+          as: "doc.secretVersions",
+        },
+      };
+      const populateFolderVersion = {
+        $lookup: {
+          from: FolderVersion.collection.name,
+          localField: "doc.folderVersion",
+          foreignField: "_id",
+          as: "doc.folderVersion",
+        },
+      };
+      const unwindFolderVerField = {
+        $unwind: {
+          path: "$doc.folderVersion",
+          preserveNullAndEmptyArrays: true,
+        },
+      };
+      const latestSnapshotsByFolders: Array<{ doc: typeof secretSnapshot }> =
+        await SecretSnapshot.aggregate([
+          matchWsFoldersPipeline,
+          sortByFolderIdAndVersion,
+          pickLatestVersionOfEachFolder,
+          populateSecVersion,
+          populateFolderVersion,
+          unwindFolderVerField,
+        ]);
 
-    const secDelQuery: Record<string, unknown> = {
-      workspace: workspaceId,
-      environment,
-      // undefined means root thus collect all secrets
-    };
-    if (folderId !== "root" && folderIds.length)
-      secDelQuery.folder = { $in: folderIds };
+      // recursive snapshotting each level
+      latestSnapshotsByFolders.forEach((snap) => {
+        // mutate the folder tree to update the nodes to the latest version tree
+        // we are reconstructing the folder tree by latest snapshots here
+        if (groupByFolderId[snap.doc.folderId]) {
+          groupByFolderId[snap.doc.folderId].children =
+            snap.doc?.folderVersion?.nodes?.children || [];
+        }
 
-    // delete existing secrets
-    await Secret.deleteMany(secDelQuery);
-    await Folder.deleteOne({
-      workspace: workspaceId,
-      environment,
-    });
+        // push all children of next level snapshots
+        if (snap.doc.folderVersion?.nodes?.children) {
+          queue.push(...snap.doc.folderVersion.nodes.children);
+        }
 
-    // add secrets
-    secrets = await Secret.insertMany(
-      Object.keys(oldSecretVersionsObj).map((sv) => {
-        const {
-          secret: secretId,
-          workspace,
-          type,
-          user,
-          environment,
-          secretBlindIndex,
-          secretKeyCiphertext,
-          secretKeyIV,
-          secretKeyTag,
-          secretValueCiphertext,
-          secretValueIV,
-          secretValueTag,
-          createdAt,
-          algorithm,
-          keyEncoding,
-          folder: secFolderId,
-        } = oldSecretVersionsObj[sv];
-
-        return {
-          _id: secretId,
-          version: latestSecretVersions[secretId.toString()].version + 1,
-          workspace,
-          type,
-          user,
-          environment,
-          secretBlindIndex: secretBlindIndex ?? undefined,
-          secretKeyCiphertext,
-          secretKeyIV,
-          secretKeyTag,
-          secretValueCiphertext,
-          secretValueIV,
-          secretValueTag,
-          secretCommentCiphertext: "",
-          secretCommentIV: "",
-          secretCommentTag: "",
-          createdAt,
-          algorithm,
-          keyEncoding,
-          folder: secFolderId,
-        };
-      })
-    );
-
-    // add secret versions
-    const secretV = await SecretVersion.insertMany(
-      secrets.map(
-        ({
-          _id,
-          version,
-          workspace,
-          type,
-          user,
-          environment,
-          secretBlindIndex,
-          secretKeyCiphertext,
-          secretKeyIV,
-          secretKeyTag,
-          secretValueCiphertext,
-          secretValueIV,
-          secretValueTag,
-          algorithm,
-          keyEncoding,
-          folder: secFolderId,
-        }) => ({
-          _id: new Types.ObjectId(),
-          secret: _id,
-          version,
-          workspace,
-          type,
-          user,
-          environment,
-          isDeleted: false,
-          secretBlindIndex: secretBlindIndex ?? undefined,
-          secretKeyCiphertext,
-          secretKeyIV,
-          secretKeyTag,
-          secretValueCiphertext,
-          secretValueIV,
-          secretValueTag,
-          algorithm,
-          keyEncoding,
-          folder: secFolderId,
-        })
-      )
-    );
-
-    if (newFolderTree && latestFolderTree) {
-      // save the updated folder tree to the present one
-      newFolderTree.version = (latestFolderVersion?.nodes?.version || 0) + 1;
-      latestFolderTree._id = new Types.ObjectId();
-      latestFolderTree.isNew = true;
-      await latestFolderTree.save();
-
-      // create new folder version
-      const newFolderVersion = new FolderVersion({
-        workspace: workspaceId,
-        environment,
-        nodes: newFolderTree,
+        snap.doc.secretVersions.forEach((snapSecVer) => {
+          // record all the secrets
+          oldSecretVersionsObj[snapSecVer.secret.toString()] = snapSecVer;
+          secretIds.push(snapSecVer.secret);
+        });
       });
-      await newFolderVersion.save();
-    }
 
-    // update secret versions of restored secrets as not deleted
-    await SecretVersion.updateMany(
+      queue.push(...subQueue);
+    }
+  }
+
+  // TODO: fix any
+  const latestSecretVersionIds = await getLatestSecretVersionIds({
+    secretIds,
+  });
+
+  // TODO: fix any
+  const latestSecretVersions: any = (
+    await SecretVersion.find(
       {
-        secret: {
-          $in: Object.keys(oldSecretVersionsObj).map(
-            (sv) => oldSecretVersionsObj[sv].secret
-          ),
+        _id: {
+          $in: latestSecretVersionIds.map((s) => s.versionId),
         },
       },
-      {
-        isDeleted: false,
-      }
-    );
+      "secret version"
+    )
+  ).reduce(
+    (accumulator, s) => ({
+      ...accumulator,
+      [`${s.secret.toString()}`]: s,
+    }),
+    {}
+  );
 
-    // take secret snapshot
-    await EESecretService.takeSecretSnapshot({
-      workspaceId: new Types.ObjectId(workspaceId),
+  const secDelQuery: Record<string, unknown> = {
+    workspace: workspaceId,
+    environment,
+    // undefined means root thus collect all secrets
+  };
+  if (folderId !== "root" && folderIds.length)
+    secDelQuery.folder = { $in: folderIds };
+
+  // delete existing secrets
+  await Secret.deleteMany(secDelQuery);
+  await Folder.deleteOne({
+    workspace: workspaceId,
+    environment,
+  });
+
+  // add secrets
+  const secrets = await Secret.insertMany(
+    Object.keys(oldSecretVersionsObj).map((sv) => {
+      const {
+        secret: secretId,
+        workspace,
+        type,
+        user,
+        environment,
+        secretBlindIndex,
+        secretKeyCiphertext,
+        secretKeyIV,
+        secretKeyTag,
+        secretValueCiphertext,
+        secretValueIV,
+        secretValueTag,
+        createdAt,
+        algorithm,
+        keyEncoding,
+        folder: secFolderId,
+      } = oldSecretVersionsObj[sv];
+
+      return {
+        _id: secretId,
+        version: latestSecretVersions[secretId.toString()].version + 1,
+        workspace,
+        type,
+        user,
+        environment,
+        secretBlindIndex: secretBlindIndex ?? undefined,
+        secretKeyCiphertext,
+        secretKeyIV,
+        secretKeyTag,
+        secretValueCiphertext,
+        secretValueIV,
+        secretValueTag,
+        secretCommentCiphertext: "",
+        secretCommentIV: "",
+        secretCommentTag: "",
+        createdAt,
+        algorithm,
+        keyEncoding,
+        folder: secFolderId,
+      };
+    })
+  );
+
+  // add secret versions
+  const secretV = await SecretVersion.insertMany(
+    secrets.map(
+      ({
+        _id,
+        version,
+        workspace,
+        type,
+        user,
+        environment,
+        secretBlindIndex,
+        secretKeyCiphertext,
+        secretKeyIV,
+        secretKeyTag,
+        secretValueCiphertext,
+        secretValueIV,
+        secretValueTag,
+        algorithm,
+        keyEncoding,
+        folder: secFolderId,
+      }) => ({
+        _id: new Types.ObjectId(),
+        secret: _id,
+        version,
+        workspace,
+        type,
+        user,
+        environment,
+        isDeleted: false,
+        secretBlindIndex: secretBlindIndex ?? undefined,
+        secretKeyCiphertext,
+        secretKeyIV,
+        secretKeyTag,
+        secretValueCiphertext,
+        secretValueIV,
+        secretValueTag,
+        algorithm,
+        keyEncoding,
+        folder: secFolderId,
+      })
+    )
+  );
+
+  if (newFolderTree && latestFolderTree) {
+    // save the updated folder tree to the present one
+    newFolderTree.version = (latestFolderVersion?.nodes?.version || 0) + 1;
+    latestFolderTree._id = new Types.ObjectId();
+    latestFolderTree.isNew = true;
+    await latestFolderTree.save();
+
+    // create new folder version
+    const newFolderVersion = new FolderVersion({
+      workspace: workspaceId,
       environment,
-      folderId,
-    });
-  } catch (err) {
-    Sentry.setUser({ email: req.user.email });
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: "Failed to roll back secret snapshot",
+      nodes: newFolderTree,
     });
+    await newFolderVersion.save();
   }
 
+  // update secret versions of restored secrets as not deleted
+  await SecretVersion.updateMany(
+    {
+      secret: {
+        $in: Object.keys(oldSecretVersionsObj).map(
+          (sv) => oldSecretVersionsObj[sv].secret
+        ),
+      },
+    },
+    {
+      isDeleted: false,
+    }
+  );
+
+  // take secret snapshot
+  await EESecretService.takeSecretSnapshot({
+    workspaceId: new Types.ObjectId(workspaceId),
+    environment,
+    folderId,
+  });
+
   return res.status(200).send({
     secrets,
   });
@@ -587,39 +559,30 @@ export const getWorkspaceLogs = async (req: Request, res: Response) => {
         }
     }   
     */
-  let logs;
-  try {
-    const { workspaceId } = req.params;
+  const { workspaceId } = req.params;
 
-    const offset: number = parseInt(req.query.offset as string);
-    const limit: number = parseInt(req.query.limit as string);
-    const sortBy: string = req.query.sortBy as string;
-    const userId: string = req.query.userId as string;
-    const actionNames: string = req.query.actionNames as string;
+  const offset: number = parseInt(req.query.offset as string);
+  const limit: number = parseInt(req.query.limit as string);
+  const sortBy: string = req.query.sortBy as string;
+  const userId: string = req.query.userId as string;
+  const actionNames: string = req.query.actionNames as string;
 
-    logs = await Log.find({
-      workspace: workspaceId,
-      ...(userId ? { user: userId } : {}),
-      ...(actionNames
-        ? {
-            actionNames: {
-              $in: actionNames.split(","),
-            },
-          }
-        : {}),
-    })
-      .sort({ createdAt: sortBy === "recent" ? -1 : 1 })
-      .skip(offset)
-      .limit(limit)
-      .populate("actions")
-      .populate("user serviceAccount serviceTokenData");
-  } catch (err) {
-    Sentry.setUser({ email: req.user.email });
-    Sentry.captureException(err);
-    return res.status(400).send({
-      message: "Failed to get workspace logs",
-    });
-  }
+  const logs = await Log.find({
+    workspace: workspaceId,
+    ...(userId ? { user: userId } : {}),
+    ...(actionNames
+      ? {
+          actionNames: {
+            $in: actionNames.split(","),
+          },
+        }
+      : {}),
+  })
+    .sort({ createdAt: sortBy === "recent" ? -1 : 1 })
+    .skip(offset)
+    .limit(limit)
+    .populate("actions")
+    .populate("user serviceAccount serviceTokenData");
 
   return res.status(200).send({
     logs,

backend/src/ee/services/EELicenseService.ts

@@ -1,5 +1,5 @@
-import NodeCache from 'node-cache';
 import * as Sentry from '@sentry/node';
+import NodeCache from 'node-cache';
 import { 
     getLicenseKey,
     getLicenseServerKey,
@@ -135,4 +135,4 @@ class EELicenseService {
     }
 }
 
-export default new EELicenseService();
+export default new EELicenseService();

backend/src/helpers/auth.ts

@@ -6,7 +6,9 @@ import {
 	User,
 	ServiceTokenData,
 	ServiceAccount,
-	APIKeyData
+	APIKeyData,
+	TokenVersion,
+	ITokenVersion
 } from '../models';
 import {
 	AccountNotFoundError,
@@ -35,7 +37,7 @@ import {
  * @param {Object} obj
  * @param {Object} obj.headers - HTTP request headers object
  */
-const validateAuthMode = ({
+export const validateAuthMode = ({
 	headers,
 	acceptedAuthModes
 }: {
@@ -97,7 +99,7 @@ const validateAuthMode = ({
  * @param {String} obj.authTokenValue - JWT token value
  * @returns {User} user - user corresponding to JWT token
  */
-const getAuthUserPayload = async ({
+export const getAuthUserPayload = async ({
 	authTokenValue
 }: {
 	authTokenValue: string;
@@ -107,14 +109,32 @@ const getAuthUserPayload = async ({
 	);
 
 	const user = await User.findOne({
-		_id: decodedToken.userId
-	}).select('+publicKey');
+		_id: new Types.ObjectId(decodedToken.userId)
+	}).select('+publicKey +accessVersion');
 
-	if (!user) throw AccountNotFoundError({ message: 'Failed to find User' });
+	if (!user) throw AccountNotFoundError({ message: 'Failed to find user' });
 
-	if (!user?.publicKey) throw UnauthorizedRequestError({ message: 'Failed to authenticate User with partially set up account' });
+	if (!user?.publicKey) throw UnauthorizedRequestError({ message: 'Failed to authenticate user with partially set up account' });
 
-	return user;
+	const tokenVersion = await TokenVersion.findOneAndUpdate({
+		_id: new Types.ObjectId(decodedToken.tokenVersionId),
+		user: user._id
+	}, {
+		lastUsed: new Date()
+	});
+	
+	if (!tokenVersion) throw UnauthorizedRequestError({
+		message: 'Failed to validate access token'
+	});
+	
+	if (decodedToken.accessVersion !== tokenVersion.accessVersion) throw UnauthorizedRequestError({
+		message: 'Failed to validate access token'
+	});
+
+	return ({
+		user,
+		tokenVersionId: tokenVersion._id
+	});
 }
 
 /**
@@ -123,7 +143,7 @@ const getAuthUserPayload = async ({
  * @param {String} obj.authTokenValue - service token value
  * @returns {ServiceTokenData} serviceTokenData - service token data
  */
-const getAuthSTDPayload = async ({
+export const getAuthSTDPayload = async ({
 	authTokenValue
 }: {
 	authTokenValue: string;
@@ -169,7 +189,7 @@ const getAuthSTDPayload = async ({
  * @param {String} obj.authTokenValue - service account access token value
  * @returns {ServiceAccount} serviceAccount
  */
-const getAuthSAAKPayload = async ({
+export const getAuthSAAKPayload = async ({
 	authTokenValue
 }: {
 	authTokenValue: string;
@@ -198,7 +218,7 @@ const getAuthSAAKPayload = async ({
  * @param {String} obj.authTokenValue - API key value
  * @returns {APIKeyData} apiKeyData - API key data
  */
-const getAuthAPIKeyPayload = async ({
+export const getAuthAPIKeyPayload = async ({
 	authTokenValue
 }: {
 	authTokenValue: string;
@@ -255,12 +275,43 @@ const getAuthAPIKeyPayload = async ({
  * @return {String} obj.token - issued JWT token
  * @return {String} obj.refreshToken - issued refresh token
  */
-const issueAuthTokens = async ({ userId }: { userId: string }) => {
+export const issueAuthTokens = async ({ 
+	userId,
+	ip,
+	userAgent
+}: { 
+	userId: Types.ObjectId;
+	ip: string;
+	userAgent: string;
+}) => {
+	let tokenVersion: ITokenVersion | null;
+
+	// continue with (session) token version matching existing ip and user agent
+	tokenVersion = await TokenVersion.findOne({
+		user: userId,
+		ip,
+		userAgent
+	});
+	
+	if (!tokenVersion) {
+		// case: no existing ip and user agent exists
+		// -> create new (session) token version for ip and user agent
+		tokenVersion = await new TokenVersion({
+			user: userId,
+			refreshVersion: 0,
+			accessVersion: 0,
+			ip,
+			userAgent,
+			lastUsed: new Date()
+		}).save();
+	}
 
 	// issue tokens
 	const token = createToken({
 		payload: {
-			userId
+			userId,
+			tokenVersionId: tokenVersion._id.toString(),
+			accessVersion: tokenVersion.accessVersion
 		},
 		expiresIn: await getJwtAuthLifetime(),
 		secret: await getJwtAuthSecret()
@@ -268,7 +319,9 @@ const issueAuthTokens = async ({ userId }: { userId: string }) => {
 
 	const refreshToken = createToken({
 		payload: {
-			userId
+			userId,
+			tokenVersionId: tokenVersion._id.toString(),
+			refreshVersion: tokenVersion.refreshVersion
 		},
 		expiresIn: await getJwtRefreshLifetime(),
 		secret: await getJwtRefreshSecret()
@@ -285,13 +338,15 @@ const issueAuthTokens = async ({ userId }: { userId: string }) => {
  * @param {Object} obj
  * @param {String} obj.userId - id of user whose tokens are cleared.
  */
-const clearTokens = async ({ userId }: { userId: string }): Promise<void> => {
+export const clearTokens = async (tokenVersionId: Types.ObjectId): Promise<void> => {
 	// increment refreshVersion on user by 1
-	User.findOneAndUpdate({
-		_id: userId
+
+	await TokenVersion.findOneAndUpdate({
+		_id: tokenVersionId
 	}, {
 		$inc: {
-			refreshVersion: 1
+			refreshVersion: 1,
+			accessVersion: 1
 		}
 	});
 };
@@ -304,7 +359,7 @@ const clearTokens = async ({ userId }: { userId: string }): Promise<void> => {
  * @param {String} obj.secret - (JWT) secret such as [JWT_AUTH_SECRET]
  * @param {String} obj.expiresIn - string describing time span such as '10h' or '7d'
  */
-const createToken = ({
+export const createToken = ({
 	payload,
 	expiresIn,
 	secret
@@ -318,7 +373,7 @@ const createToken = ({
 	});
 };
 
-const validateProviderAuthToken = async ({
+export const validateProviderAuthToken = async ({
 	email,
 	user,
 	providerAuthToken,
@@ -341,16 +396,4 @@ const validateProviderAuthToken = async ({
 	) {
 		throw new Error('Invalid authentication credentials.')
 	}
-}
-
-export {
-	validateAuthMode,
-	validateProviderAuthToken,
-	getAuthUserPayload,
-	getAuthSTDPayload,
-	getAuthSAAKPayload,
-	getAuthAPIKeyPayload,
-	createToken,
-	issueAuthTokens,
-	clearTokens
-};
+}

backend/src/helpers/bot.ts

@@ -31,7 +31,7 @@ import { InternalServerError } from "../utils/errors";
  * @param {String} obj.name - name of bot
  * @param {String} obj.workspaceId - id of workspace that bot belongs to
  */
-const createBot = async ({
+export const createBot = async ({
   name,
   workspaceId,
 }: {
@@ -93,7 +93,7 @@ const createBot = async ({
  * @param {String} obj.workspaceId - id of workspace
  * @param {String} obj.environment - environment
  */
-const getSecretsHelper = async ({
+export const getSecretsBotHelper = async ({
   workspaceId,
   environment,
 }: {
@@ -136,7 +136,7 @@ const getSecretsHelper = async ({
  * @param {String} obj.workspaceId - id of workspace
  * @returns {String} key - decrypted workspace key
  */
-const getKey = async ({ workspaceId }: { workspaceId: string }) => {
+export const getKey = async ({ workspaceId }: { workspaceId: string }) => {
   const encryptionKey = await getEncryptionKey();
   const rootEncryptionKey = await getRootEncryptionKey();
 
@@ -194,7 +194,7 @@ const getKey = async ({ workspaceId }: { workspaceId: string }) => {
  * @param {String} obj1.workspaceId - id of workspace
  * @param {String} obj1.plaintext - plaintext to encrypt
  */
-const encryptSymmetricHelper = async ({
+export const encryptSymmetricHelper = async ({
   workspaceId,
   plaintext,
 }: {
@@ -222,7 +222,7 @@ const encryptSymmetricHelper = async ({
  * @param {String} obj.iv - iv
  * @param {String} obj.tag - tag
  */
-const decryptSymmetricHelper = async ({
+export const decryptSymmetricHelper = async ({
   workspaceId,
   ciphertext,
   iv,
@@ -242,11 +242,4 @@ const decryptSymmetricHelper = async ({
   });
 
   return plaintext;
-};
-
-export {
-  createBot,
-  getSecretsHelper,
-  encryptSymmetricHelper,
-  decryptSymmetricHelper
-};
+};

backend/src/helpers/database.ts

@@ -7,7 +7,7 @@ import { getLogger } from '../utils/logger';
  * @param {String} obj.mongoURL - mongo connection string
  * @returns 
  */
-const initDatabaseHelper = async ({
+export const initDatabaseHelper = async ({
     mongoURL
 }: {
     mongoURL: string;
@@ -30,7 +30,7 @@ const initDatabaseHelper = async ({
 /**
  * Close database conection
  */
-const closeDatabaseHelper = async () => {
+export const closeDatabaseHelper = async () => {
     return Promise.all([
         new Promise((resolve) => {
             if (mongoose.connection && mongoose.connection.readyState == 1) {
@@ -41,9 +41,4 @@ const closeDatabaseHelper = async () => {
             }
         })
     ]);
-}
-
-export {
-    initDatabaseHelper,
-    closeDatabaseHelper
 }

backend/src/helpers/event.ts

@@ -18,7 +18,7 @@ interface Event {
  * @param {String} obj.event.workspaceId - id of workspace that event is part of
  * @param {Object} obj.event.payload - payload of event (depends on event)
  */
-const handleEventHelper = async ({ event }: { event: Event }) => {
+export const handleEventHelper = async ({ event }: { event: Event }) => {
   const { workspaceId, environment } = event;
 
   // TODO: moduralize bot check into separate function
@@ -37,6 +37,4 @@ const handleEventHelper = async ({ event }: { event: Event }) => {
       });
       break;
   }
-};
-
-export { handleEventHelper };
+};

backend/src/helpers/index.ts

@@ -0,0 +1,17 @@
+export * from './auth';
+export * from './bot';
+export * from './database';
+export * from './event';
+export * from './integration';
+export * from './key';
+export * from './membership';
+export * from './membershipOrg';
+export * from './nodemailer';
+export * from './organization';
+export * from './rateLimiter';
+export * from './secret';
+export * from './secrets';
+export * from './signup';
+export * from './token';
+export * from './user';
+export * from './workspace';

backend/src/helpers/integration.ts

@@ -1,4 +1,3 @@
-import * as Sentry from '@sentry/node';
 import { Types } from 'mongoose';
 import {
     Bot,
@@ -16,7 +15,6 @@ import {
 import { 
     UnauthorizedRequestError,
 } from '../utils/errors';
-import RequestError from '../utils/requestError';
 
 interface Update {
     workspace: string;
@@ -37,7 +35,7 @@ interface Update {
  * @param {String} obj.code - code
  * @returns {IntegrationAuth} integrationAuth - integration auth after OAuth2 code-token exchange
 */
-const handleOAuthExchangeHelper = async ({
+export const handleOAuthExchangeHelper = async ({
     workspaceId,
     integration,
     code,
@@ -48,66 +46,59 @@ const handleOAuthExchangeHelper = async ({
     code: string;
     environment: string;
 }) => {
-    let integrationAuth;
-    try {
-        const bot = await Bot.findOne({
-            workspace: workspaceId,
-            isActive: true
+    const bot = await Bot.findOne({
+        workspace: workspaceId,
+        isActive: true
+    });
+    
+    if (!bot) throw new Error('Bot must be enabled for OAuth2 code-token exchange');
+    
+    // exchange code for access and refresh tokens
+    const res = await exchangeCode({
+        integration,
+        code
+    });
+    
+    const update: Update = {
+        workspace: workspaceId,
+        integration
+    }
+    
+    switch (integration) {
+        case INTEGRATION_VERCEL:
+            update.teamId = res.teamId;
+            break;
+        case INTEGRATION_NETLIFY:
+            update.accountId = res.accountId;
+            break;
+    }
+    
+    const integrationAuth = await IntegrationAuth.findOneAndUpdate({
+        workspace: workspaceId,
+        integration
+    }, update, {
+        new: true,
+        upsert: true
+    });
+    
+    if (res.refreshToken) {
+        // case: refresh token returned from exchange
+        // set integration auth refresh token
+        await setIntegrationAuthRefreshHelper({
+            integrationAuthId: integrationAuth._id.toString(),
+            refreshToken: res.refreshToken
         });
-        
-        if (!bot) throw new Error('Bot must be enabled for OAuth2 code-token exchange');
-        
-        // exchange code for access and refresh tokens
-        const res = await exchangeCode({
-            integration,
-            code
+    }
+    
+    if (res.accessToken) {
+        // case: access token returned from exchange
+        // set integration auth access token
+        await setIntegrationAuthAccessHelper({
+            integrationAuthId: integrationAuth._id.toString(),
+            accessId: null,
+            accessToken: res.accessToken,
+            accessExpiresAt: res.accessExpiresAt
         });
-        
-        const update: Update = {
-            workspace: workspaceId,
-            integration
-        }
-        
-        switch (integration) {
-            case INTEGRATION_VERCEL:
-                update.teamId = res.teamId;
-                break;
-            case INTEGRATION_NETLIFY:
-                update.accountId = res.accountId;
-                break;
-        }
-        
-        integrationAuth = await IntegrationAuth.findOneAndUpdate({
-            workspace: workspaceId,
-            integration
-        }, update, {
-            new: true,
-            upsert: true
-        });
-        
-        if (res.refreshToken) {
-            // case: refresh token returned from exchange
-            // set integration auth refresh token
-            await setIntegrationAuthRefreshHelper({
-                integrationAuthId: integrationAuth._id.toString(),
-                refreshToken: res.refreshToken
-            });
-        }
-        
-        if (res.accessToken) {
-            // case: access token returned from exchange
-            // set integration auth access token
-            await setIntegrationAuthAccessHelper({
-                integrationAuthId: integrationAuth._id.toString(),
-                accessId: null,
-                accessToken: res.accessToken,
-                accessExpiresAt: res.accessExpiresAt
-            });
-        }
-    } catch (err) {
-        Sentry.setUser(null);
-        Sentry.captureException(err);
-        throw new Error('Failed to handle OAuth2 code-token exchange')
     }
     
     return integrationAuth;
@@ -118,54 +109,47 @@ const handleOAuthExchangeHelper = async ({
  * @param {Object} obj
  * @param {Object} obj.workspaceId - id of workspace
  */
-const syncIntegrationsHelper = async ({
+export const syncIntegrationsHelper = async ({
     workspaceId,
     environment
 }: {
     workspaceId: Types.ObjectId;
     environment?: string;
 }) => {
-    let integrations;
-    try {
-        integrations = await Integration.find({
-            workspace: workspaceId,
-            ...(environment ? {
-                environment
-            } : {}),
-            isActive: true,
-            app: { $ne: null }
+    const integrations = await Integration.find({
+        workspace: workspaceId,
+        ...(environment ? {
+            environment
+        } : {}),
+        isActive: true,
+        app: { $ne: null }
+    });
+
+    // for each workspace integration, sync/push secrets
+    // to that integration
+    for await (const integration of integrations) {
+        // get workspace, environment (shared) secrets
+        const secrets = await BotService.getSecrets({ // issue here?
+            workspaceId: integration.workspace,
+            environment: integration.environment
         });
 
-        // for each workspace integration, sync/push secrets
-        // to that integration
-        for await (const integration of integrations) {
-            // get workspace, environment (shared) secrets
-            const secrets = await BotService.getSecrets({ // issue here?
-                workspaceId: integration.workspace,
-                environment: integration.environment
-            });
+        const integrationAuth = await IntegrationAuth.findById(integration.integrationAuth);
+        if (!integrationAuth) throw new Error('Failed to find integration auth');
+        
+        // get integration auth access token
+        const access = await getIntegrationAuthAccessHelper({
+            integrationAuthId: integration.integrationAuth
+        });
 
-            const integrationAuth = await IntegrationAuth.findById(integration.integrationAuth);
-            if (!integrationAuth) throw new Error('Failed to find integration auth');
-            
-            // get integration auth access token
-            const access = await getIntegrationAuthAccessHelper({
-                integrationAuthId: integration.integrationAuth
-            });
-
-            // sync secrets to integration
-            await syncSecrets({
-                integration,
-                integrationAuth,
-                secrets,
-                accessId: access.accessId === undefined ? null : access.accessId,
-                accessToken: access.accessToken
-            });
-        }
-    } catch (err) {
-        Sentry.setUser(null);
-        Sentry.captureException(err);
-        throw new Error('Failed to sync secrets to integrations');
+        // sync secrets to integration
+        await syncSecrets({
+            integration,
+            integrationAuth,
+            secrets,
+            accessId: access.accessId === undefined ? null : access.accessId,
+            accessToken: access.accessToken
+        });
     }
 }
 
@@ -177,31 +161,19 @@ const syncIntegrationsHelper = async ({
  * @param {String} obj.integrationAuthId - id of integration auth
  * @param {String} refreshToken - decrypted refresh token
  */
- const getIntegrationAuthRefreshHelper = async ({ integrationAuthId }: { integrationAuthId: Types.ObjectId }) => {
-    let refreshToken;
-	
-    try {
-        const integrationAuth = await IntegrationAuth
-            .findById(integrationAuthId)
-            .select('+refreshCiphertext +refreshIV +refreshTag');
+export const getIntegrationAuthRefreshHelper = async ({ integrationAuthId }: { integrationAuthId: Types.ObjectId }) => {
+    const integrationAuth = await IntegrationAuth
+        .findById(integrationAuthId)
+        .select('+refreshCiphertext +refreshIV +refreshTag');
 
-        if (!integrationAuth) throw UnauthorizedRequestError({message: 'Failed to locate Integration Authentication credentials'});
+    if (!integrationAuth) throw UnauthorizedRequestError({message: 'Failed to locate Integration Authentication credentials'});
 
-        refreshToken = await BotService.decryptSymmetric({
-            workspaceId: integrationAuth.workspace,
-            ciphertext: integrationAuth.refreshCiphertext as string,
-            iv: integrationAuth.refreshIV as string,
-            tag: integrationAuth.refreshTag as string
-        });
-
-    } catch (err) {
-        Sentry.setUser(null);
-		Sentry.captureException(err);
-        if(err instanceof RequestError)
-            throw err
-        else
-            throw new Error('Failed to get integration refresh token');
-    }
+    const refreshToken = await BotService.decryptSymmetric({
+        workspaceId: integrationAuth.workspace,
+        ciphertext: integrationAuth.refreshCiphertext as string,
+        iv: integrationAuth.refreshIV as string,
+        tag: integrationAuth.refreshTag as string
+    });
     
     return refreshToken;
 }
@@ -214,53 +186,43 @@ const syncIntegrationsHelper = async ({
  * @param {String} obj.integrationAuthId - id of integration auth
  * @returns {String} accessToken - decrypted access token
  */
-const getIntegrationAuthAccessHelper = async ({ integrationAuthId }: { integrationAuthId: Types.ObjectId }) => {
+export const getIntegrationAuthAccessHelper = async ({ integrationAuthId }: { integrationAuthId: Types.ObjectId }) => {
     let accessId;
     let accessToken;
-    try {
-        const integrationAuth = await IntegrationAuth
-            .findById(integrationAuthId)
-            .select('workspace integration +accessCiphertext +accessIV +accessTag +accessExpiresAt + refreshCiphertext +accessIdCiphertext +accessIdIV +accessIdTag');
+    const integrationAuth = await IntegrationAuth
+        .findById(integrationAuthId)
+        .select('workspace integration +accessCiphertext +accessIV +accessTag +accessExpiresAt + refreshCiphertext +accessIdCiphertext +accessIdIV +accessIdTag');
 
-        if (!integrationAuth) throw UnauthorizedRequestError({message: 'Failed to locate Integration Authentication credentials'});
+    if (!integrationAuth) throw UnauthorizedRequestError({message: 'Failed to locate Integration Authentication credentials'});
 
-        accessToken = await BotService.decryptSymmetric({
-            workspaceId: integrationAuth.workspace,
-            ciphertext: integrationAuth.accessCiphertext as string,
-            iv: integrationAuth.accessIV as string,
-            tag: integrationAuth.accessTag as string
-        });
+    accessToken = await BotService.decryptSymmetric({
+        workspaceId: integrationAuth.workspace,
+        ciphertext: integrationAuth.accessCiphertext as string,
+        iv: integrationAuth.accessIV as string,
+        tag: integrationAuth.accessTag as string
+    });
 
-        if (integrationAuth?.accessExpiresAt && integrationAuth?.refreshCiphertext) {
-            // there is a access token expiration date
-            // and refresh token to exchange with the OAuth2 server
-            
-            if (integrationAuth.accessExpiresAt < new Date()) {
-                // access token is expired
-                const refreshToken = await getIntegrationAuthRefreshHelper({ integrationAuthId });
-                accessToken = await exchangeRefresh({
-                    integrationAuth,
-                    refreshToken
-                });
-            }
-        }
+    if (integrationAuth?.accessExpiresAt && integrationAuth?.refreshCiphertext) {
+        // there is a access token expiration date
+        // and refresh token to exchange with the OAuth2 server
         
-        if (integrationAuth?.accessIdCiphertext && integrationAuth?.accessIdIV && integrationAuth?.accessIdTag) {
-            accessId = await BotService.decryptSymmetric({
-                workspaceId: integrationAuth.workspace,
-                ciphertext: integrationAuth.accessIdCiphertext as string,
-                iv: integrationAuth.accessIdIV as string,
-                tag: integrationAuth.accessIdTag as string
+        if (integrationAuth.accessExpiresAt < new Date()) {
+            // access token is expired
+            const refreshToken = await getIntegrationAuthRefreshHelper({ integrationAuthId });
+            accessToken = await exchangeRefresh({
+                integrationAuth,
+                refreshToken
             });
         }
-
-    } catch (err) {
-        Sentry.setUser(null);
-		Sentry.captureException(err);
-        if(err instanceof RequestError)
-            throw err
-        else
-            throw new Error('Failed to get integration access token');
+    }
+    
+    if (integrationAuth?.accessIdCiphertext && integrationAuth?.accessIdIV && integrationAuth?.accessIdTag) {
+        accessId = await BotService.decryptSymmetric({
+            workspaceId: integrationAuth.workspace,
+            ciphertext: integrationAuth.accessIdCiphertext as string,
+            iv: integrationAuth.accessIdIV as string,
+            tag: integrationAuth.accessIdTag as string
+        });
     }
     
     return ({
@@ -277,7 +239,7 @@ const getIntegrationAuthAccessHelper = async ({ integrationAuthId }: { integrati
  * @param {String} obj.integrationAuthId - id of integration auth
  * @param {String} obj.refreshToken - refresh token
  */
-const setIntegrationAuthRefreshHelper = async ({
+export const setIntegrationAuthRefreshHelper = async ({
     integrationAuthId,
     refreshToken
 }: {
@@ -285,34 +247,27 @@ const setIntegrationAuthRefreshHelper = async ({
     refreshToken: string;
 }) => {
     
-    let integrationAuth;
-    try {
-        integrationAuth = await IntegrationAuth
-            .findById(integrationAuthId);
-        
-        if (!integrationAuth) throw new Error('Failed to find integration auth');
-        
-        const obj = await BotService.encryptSymmetric({
-            workspaceId: integrationAuth.workspace,
-            plaintext: refreshToken
-        });
-        
-        integrationAuth = await IntegrationAuth.findOneAndUpdate({
-            _id: integrationAuthId
-        }, {
-            refreshCiphertext: obj.ciphertext,
-            refreshIV: obj.iv,
-            refreshTag: obj.tag,
-            algorithm: ALGORITHM_AES_256_GCM,
-            keyEncoding: ENCODING_SCHEME_UTF8
-        }, {
-            new: true
-        });
-    } catch (err) {
-        Sentry.setUser(null);
-		Sentry.captureException(err);
-		throw new Error('Failed to set integration auth refresh token');
-    }
+    let integrationAuth = await IntegrationAuth
+        .findById(integrationAuthId);
+    
+    if (!integrationAuth) throw new Error('Failed to find integration auth');
+    
+    const obj = await BotService.encryptSymmetric({
+        workspaceId: integrationAuth.workspace,
+        plaintext: refreshToken
+    });
+    
+    integrationAuth = await IntegrationAuth.findOneAndUpdate({
+        _id: integrationAuthId
+    }, {
+        refreshCiphertext: obj.ciphertext,
+        refreshIV: obj.iv,
+        refreshTag: obj.tag,
+        algorithm: ALGORITHM_AES_256_GCM,
+        keyEncoding: ENCODING_SCHEME_UTF8
+    }, {
+        new: true
+    });
     
     return integrationAuth;
 }
@@ -326,7 +281,7 @@ const setIntegrationAuthRefreshHelper = async ({
  * @param {String} obj.accessToken - access token
  * @param {Date} obj.accessExpiresAt - expiration date of access token
  */
-const setIntegrationAuthAccessHelper = async ({
+export const setIntegrationAuthAccessHelper = async ({
     integrationAuthId,
     accessId,
     accessToken,
@@ -337,54 +292,38 @@ const setIntegrationAuthAccessHelper = async ({
     accessToken: string;
     accessExpiresAt: Date | undefined;
 }) => {
-    let integrationAuth;
-    try {
-        integrationAuth = await IntegrationAuth.findById(integrationAuthId);
-        
-        if (!integrationAuth) throw new Error('Failed to find integration auth');
-        
-        const encryptedAccessTokenObj = await BotService.encryptSymmetric({
+    let integrationAuth = await IntegrationAuth.findById(integrationAuthId);
+    
+    if (!integrationAuth) throw new Error('Failed to find integration auth');
+    
+    const encryptedAccessTokenObj = await BotService.encryptSymmetric({
+        workspaceId: integrationAuth.workspace,
+        plaintext: accessToken
+    });
+    
+    let encryptedAccessIdObj;
+    if (accessId) {
+        encryptedAccessIdObj = await BotService.encryptSymmetric({
             workspaceId: integrationAuth.workspace,
-            plaintext: accessToken
-        });
-        
-        let encryptedAccessIdObj;
-        if (accessId) {
-            encryptedAccessIdObj = await BotService.encryptSymmetric({
-                workspaceId: integrationAuth.workspace,
-                plaintext: accessId
-            }); 
-        }
-        
-        integrationAuth = await IntegrationAuth.findOneAndUpdate({
-            _id: integrationAuthId
-        }, {
-            accessIdCiphertext: encryptedAccessIdObj?.ciphertext ?? undefined,
-            accessIdIV: encryptedAccessIdObj?.iv ?? undefined,
-            accessIdTag: encryptedAccessIdObj?.tag ?? undefined,
-            accessCiphertext: encryptedAccessTokenObj.ciphertext,
-            accessIV: encryptedAccessTokenObj.iv,
-            accessTag: encryptedAccessTokenObj.tag,
-            accessExpiresAt,
-            algorithm: ALGORITHM_AES_256_GCM,
-            keyEncoding: ENCODING_SCHEME_UTF8
-        }, {
-            new: true
-        });
-    } catch (err) {
-        Sentry.setUser(null);
-		Sentry.captureException(err);
-		throw new Error('Failed to save integration auth access token');
+            plaintext: accessId
+        }); 
     }
     
+    integrationAuth = await IntegrationAuth.findOneAndUpdate({
+        _id: integrationAuthId
+    }, {
+        accessIdCiphertext: encryptedAccessIdObj?.ciphertext ?? undefined,
+        accessIdIV: encryptedAccessIdObj?.iv ?? undefined,
+        accessIdTag: encryptedAccessIdObj?.tag ?? undefined,
+        accessCiphertext: encryptedAccessTokenObj.ciphertext,
+        accessIV: encryptedAccessTokenObj.iv,
+        accessTag: encryptedAccessTokenObj.tag,
+        accessExpiresAt,
+        algorithm: ALGORITHM_AES_256_GCM,
+        keyEncoding: ENCODING_SCHEME_UTF8
+    }, {
+        new: true
+    });
+    
     return integrationAuth;
-}
-
-export {
-    handleOAuthExchangeHelper,
-    syncIntegrationsHelper,
-    getIntegrationAuthRefreshHelper,
-    getIntegrationAuthAccessHelper,
-    setIntegrationAuthRefreshHelper,
-    setIntegrationAuthAccessHelper
-}
+}

backend/src/helpers/key.ts

@@ -17,7 +17,7 @@ interface Key {
  * @param {String} obj.keys.nonce - nonce for encryption
  * @param {String} obj.keys.userId - id of receiver user
  */
-const pushKeys = async ({
+export const pushKeys = async ({
 	userId,
 	workspaceId,
 	keys
@@ -50,6 +50,4 @@ const pushKeys = async ({
       workspace: workspaceId
     }))
   );
-};
-
-export { pushKeys };
+};

backend/src/helpers/membership.ts

@@ -1,7 +1,6 @@
-import * as Sentry from '@sentry/node';
-import { Types } from 'mongoose';
-import { Membership, Key } from '../models';
-import { MembershipNotFoundError, BadRequestError } from '../utils/errors';
+import { Types } from "mongoose";
+import { Membership, Key } from "../models";
+import { MembershipNotFoundError, BadRequestError } from "../utils/errors";
 
 /**
  * Validate that user with id [userId] is a member of workspace with id [workspaceId]
@@ -11,30 +10,30 @@ import { MembershipNotFoundError, BadRequestError } from '../utils/errors';
  * @param {String} obj.workspaceId - id of workspace
  * @returns {Membership} membership - membership of user with id [userId] for workspace with id [workspaceId]
  */
-const validateMembership = async ({
-  userId,
-  workspaceId,
-  acceptedRoles,
+export const validateMembership = async ({
+	userId,
+	workspaceId,
+	acceptedRoles,
 }: {
   userId: Types.ObjectId | string;
   workspaceId: Types.ObjectId | string;
-  acceptedRoles?: Array<'admin' | 'member'>;
+  acceptedRoles?: Array<"admin" | "member">;
 }) => {
   const membership = await Membership.findOne({
     user: userId,
     workspace: workspaceId,
-  }).populate('workspace');
+  }).populate("workspace");
 
   if (!membership) {
     throw MembershipNotFoundError({
-      message: 'Failed to find workspace membership',
+      message: "Failed to find workspace membership",
     });
   }
 
   if (acceptedRoles) {
     if (!acceptedRoles.includes(membership.role)) {
       throw BadRequestError({
-        message: 'Failed authorization for membership role',
+        message: "Failed authorization for membership role",
       });
     }
   }
@@ -47,16 +46,8 @@ const validateMembership = async ({
  * @param {Object} queryObj - query object
  * @return {Object} membership - membership
  */
-const findMembership = async (queryObj: any) => {
-  let membership;
-  try {
-    membership = await Membership.findOne(queryObj);
-  } catch (err) {
-    Sentry.setUser(null);
-    Sentry.captureException(err);
-    throw new Error('Failed to find membership');
-  }
-
+export const findMembership = async (queryObj: any) => {
+	const membership = await Membership.findOne(queryObj);
   return membership;
 };
 
@@ -68,40 +59,33 @@ const findMembership = async (queryObj: any) => {
  * @param {String} obj.workspaceId - id of workspace.
  * @param {String[]} obj.roles - roles of users.
  */
-const addMemberships = async ({
-  userIds,
-  workspaceId,
-  roles,
+export const addMemberships = async ({
+	userIds,
+	workspaceId,
+	roles
 }: {
   userIds: string[];
   workspaceId: string;
   roles: string[];
 }): Promise<void> => {
-  try {
-    const operations = userIds.map((userId, idx) => {
-      return {
-        updateOne: {
-          filter: {
-            user: userId,
-            workspace: workspaceId,
-            role: roles[idx],
-          },
-          update: {
-            user: userId,
-            workspace: workspaceId,
-            role: roles[idx],
-          },
-          upsert: true,
+  const operations = userIds.map((userId, idx) => {
+    return {
+      updateOne: {
+        filter: {
+          user: userId,
+          workspace: workspaceId,
+          role: roles[idx],
         },
-      };
-    });
-
-    await Membership.bulkWrite(operations as any);
-  } catch (err) {
-    Sentry.setUser(null);
-    Sentry.captureException(err);
-    throw new Error('Failed to add users to workspace');
-  }
+        update: {
+          user: userId,
+          workspace: workspaceId,
+          role: roles[idx],
+        },
+        upsert: true,
+      },
+    };
+  });
+  await Membership.bulkWrite(operations as any);
 };
 
 /**
@@ -109,28 +93,19 @@ const addMemberships = async ({
  * @param {Object} obj
  * @param {String} obj.membershipId - id of membership to delete
  */
-const deleteMembership = async ({ membershipId }: { membershipId: string }) => {
-  let deletedMembership;
-  try {
-    deletedMembership = await Membership.findOneAndDelete({
-      _id: membershipId,
-    });
+export const deleteMembership = async ({ membershipId }: { membershipId: string }) => {
+	const deletedMembership = await Membership.findOneAndDelete({
+    _id: membershipId
+  });
 
-    // delete keys associated with the membership
-    if (deletedMembership?.user) {
-      // case: membership had a registered user
-      await Key.deleteMany({
-        receiver: deletedMembership.user,
-        workspace: deletedMembership.workspace,
-      });
-    }
-  } catch (err) {
-    Sentry.setUser(null);
-    Sentry.captureException(err);
-    throw new Error('Failed to delete membership');
+  // delete keys associated with the membership
+  if (deletedMembership?.user) {
+    // case: membership had a registered user
+    await Key.deleteMany({
+      receiver: deletedMembership.user,
+      workspace: deletedMembership.workspace,
+    });
   }
 
-  return deletedMembership;
+	return deletedMembership;
 };
-
-export { validateMembership, addMemberships, findMembership, deleteMembership };

backend/src/helpers/membershipOrg.ts

@@ -18,7 +18,7 @@ import {
  * @param {Types.ObjectId} obj.organizationId
  * @param {String[]} obj.acceptedRoles
  */
-const validateMembershipOrg = async ({
+export const validateMembershipOrg = async ({
 	userId,
 	organizationId,
 	acceptedRoles,
@@ -59,7 +59,7 @@ const validateMembershipOrg = async ({
  * @param {Object} queryObj - query object
  * @return {Object} membershipOrg - membership
  */
-const findMembershipOrg = (queryObj: any) => {
+export const findMembershipOrg = (queryObj: any) => {
 	const membershipOrg = MembershipOrg.findOne(queryObj);
 	return membershipOrg;
 };
@@ -72,7 +72,7 @@ const findMembershipOrg = (queryObj: any) => {
  * @param {String} obj.organizationId - id of organization.
  * @param {String[]} obj.roles - roles of users.
  */
-const addMembershipsOrg = async ({
+export const addMembershipsOrg = async ({
 	userIds,
 	organizationId,
 	roles,
@@ -111,7 +111,7 @@ const addMembershipsOrg = async ({
  * @param {Object} obj
  * @param {String} obj.membershipOrgId - id of organization membership to delete
  */
-const deleteMembershipOrg = async ({
+export const deleteMembershipOrg = async ({
 	membershipOrgId
 }: {
 	membershipOrgId: string;
@@ -148,11 +148,4 @@ const deleteMembershipOrg = async ({
   }
 
 	return deletedMembershipOrg;
-};
-
-export {
-	validateMembershipOrg,
-	findMembershipOrg,
-	addMembershipsOrg, 
-	deleteMembershipOrg 
-}; 
+};

backend/src/helpers/nodemailer.ts

@@ -1,4 +1,3 @@
-import * as Sentry from '@sentry/node';
 import fs from 'fs';
 import path from 'path';
 import handlebars from 'handlebars';
@@ -14,7 +13,7 @@ let smtpTransporter: nodemailer.Transporter;
  * @param {String[]} obj.recipients - email addresses of people to send email to
  * @param {Object} obj.substitutions - object containing template substitutions
  */
-const sendMail = async ({
+export const sendMail = async ({
   template,
   subjectLine,
   recipients,
@@ -26,29 +25,22 @@ const sendMail = async ({
   substitutions: any;
 }) => {
   if (await getSmtpConfigured()) {
-    try {
-      const html = fs.readFileSync(
-        path.resolve(__dirname, '../templates/' + template),
-        'utf8'
-      );
-      const temp = handlebars.compile(html);
-      const htmlToSend = temp(substitutions);
+    const html = fs.readFileSync(
+      path.resolve(__dirname, '../templates/' + template),
+      'utf8'
+    );
+    const temp = handlebars.compile(html);
+    const htmlToSend = temp(substitutions);
 
-      await smtpTransporter.sendMail({
-        from: `"${await getSmtpFromName()}" <${await getSmtpFromAddress()}>`,
-        to: recipients.join(', '),
-        subject: subjectLine,
-        html: htmlToSend
-      });
-    } catch (err) {
-      Sentry.setUser(null);
-      Sentry.captureException(err);
-    }
+    await smtpTransporter.sendMail({
+      from: `"${await getSmtpFromName()}" <${await getSmtpFromAddress()}>`,
+      to: recipients.join(', '),
+      subject: subjectLine,
+      html: htmlToSend
+    });
   }
 };
 
-const setTransporter = (transporter: nodemailer.Transporter) => {
+export const setTransporter = (transporter: nodemailer.Transporter) => {
   smtpTransporter = transporter;
-};
-
-export { sendMail, setTransporter };
+};

backend/src/helpers/organization.ts

@@ -28,7 +28,7 @@ import {
  * @param {String} obj.email - POC email that will receive invoice info
  * @param {Object} organization - new organization
  */
-const createOrganization = async ({
+export const createOrganization = async ({
   name,
   email,
 }: {
@@ -70,7 +70,7 @@ const createOrganization = async ({
  * @return {Object} obj.stripeSubscription - new stripe subscription
  * @return {Subscription} obj.subscription - new subscription
  */
-const initSubscriptionOrg = async ({
+export const initSubscriptionOrg = async ({
   organizationId,
 }: {
   organizationId: Types.ObjectId;
@@ -125,7 +125,7 @@ const initSubscriptionOrg = async ({
  * @param {Object} obj
  * @param {Number} obj.organizationId - id of subscription's organization
  */
-const updateSubscriptionOrgQuantity = async ({
+export const updateSubscriptionOrgQuantity = async ({
   organizationId,
 }: {
   organizationId: string;
@@ -171,10 +171,4 @@ const updateSubscriptionOrgQuantity = async ({
   }
 
   return stripeSubscription;
-};
-
-export {
-  createOrganization,
-  initSubscriptionOrg,
-  updateSubscriptionOrgQuantity
-};
+};

backend/src/helpers/rateLimiter.ts

@@ -2,7 +2,7 @@ import rateLimit from 'express-rate-limit';
 const MongoStore = require('rate-limit-mongo');
 
 // 200 per minute
-const apiLimiter = rateLimit({
+export const apiLimiter = rateLimit({
   store: new MongoStore({
     uri: process.env.MONGO_URL,
     expireTimeMs: 1000 * 60,
@@ -17,7 +17,7 @@ const apiLimiter = rateLimit({
     return request.path === '/healthcheck' || request.path === '/api/status'
   },
   keyGenerator: (req, res) => {
-    return req.clientIp
+    return req.realIP
   }
 });
 
@@ -34,12 +34,12 @@ const authLimit = rateLimit({
   standardHeaders: true,
   legacyHeaders: false,
   keyGenerator: (req, res) => {
-    return req.clientIp
+    return req.realIP
   }
 });
 
 // 50 requests per 1 hour
-const passwordLimiter = rateLimit({
+export const passwordLimiter = rateLimit({
   store: new MongoStore({
     uri: process.env.MONGO_URL,
     expireTimeMs: 1000 * 60 * 60,
@@ -51,20 +51,14 @@ const passwordLimiter = rateLimit({
   standardHeaders: true,
   legacyHeaders: false,
   keyGenerator: (req, res) => {
-    return req.clientIp
+    return req.realIP
   }
 });
 
-const authLimiter = (req: any, res: any, next: any) => {
+export const authLimiter = (req: any, res: any, next: any) => {
   if (process.env.NODE_ENV === 'production') {
     authLimit(req, res, next);
   } else {
     next();
   }
-};
-
-export {
-  apiLimiter,
-  authLimiter,
-  passwordLimiter
-};
+};

backend/src/helpers/secret.ts

@@ -60,7 +60,7 @@ interface Update {
  * @param {String} obj.environment - environment for secrets
  * @param {Object[]} obj.secrets - secrets to push
  */
-const v1PushSecrets = async ({
+export const v1PushSecrets = async ({
   userId,
   workspaceId,
   environment,
@@ -304,7 +304,7 @@ const v1PushSecrets = async ({
  * @param {String} obj.channel - channel (web/cli/auto)
  * @param {String} obj.ipAddress - ip address of request to push secrets
  */
-const v2PushSecrets = async ({
+export const v2PushSecrets = async ({
   userId,
   workspaceId,
   environment,
@@ -530,7 +530,7 @@ const v2PushSecrets = async ({
  * @param {String} obj.workspaceId - id of workspace to pull from
  * @param {String} obj.environment - environment for secrets
  */
-const getSecrets = async ({
+export const getSecrets = async ({
   userId,
   workspaceId,
   environment,
@@ -570,7 +570,7 @@ const getSecrets = async ({
  * @param {String} obj.channel - channel (web/cli/auto)
  * @param {String} obj.ipAddress - ip address of request to push secrets
  */
-const pullSecrets = async ({
+export const pullSecrets = async ({
   userId,
   workspaceId,
   environment,
@@ -614,7 +614,7 @@ const pullSecrets = async ({
  * @param {Object} obj
  * @param {Object} obj.secrets
  */
-const reformatPullSecrets = ({ secrets }: { secrets: ISecret[] }) => {
+export const reformatPullSecrets = ({ secrets }: { secrets: ISecret[] }) => {
   const reformatedSecrets = secrets.map((s) => ({
     _id: s._id,
     workspace: s.workspace,
@@ -644,6 +644,4 @@ const reformatPullSecrets = ({ secrets }: { secrets: ISecret[] }) => {
   }));
 
   return reformatedSecrets;
-};
-
-export { v1PushSecrets, v2PushSecrets, pullSecrets, reformatPullSecrets };
+};

backend/src/helpers/secrets.ts

@@ -45,8 +45,8 @@ import {
  * @param {Object} obj
  * @param {Types.ObjectId} obj.workspaceId
  */
-const createSecretBlindIndexDataHelper = async ({
-  workspaceId,
+export const createSecretBlindIndexDataHelper = async ({
+    workspaceId
 }: {
   workspaceId: Types.ObjectId;
 }) => {
@@ -98,8 +98,8 @@ const createSecretBlindIndexDataHelper = async ({
  * @param {Types.ObjectId} obj.workspaceId - id of workspace to get salt for
  * @returns
  */
-const getSecretBlindIndexSaltHelper = async ({
-  workspaceId,
+export const getSecretBlindIndexSaltHelper = async ({
+    workspaceId
 }: {
   workspaceId: Types.ObjectId;
 }) => {
@@ -147,9 +147,9 @@ const getSecretBlindIndexSaltHelper = async ({
  * @param {String} obj.secretName - name of secret to generate blind index for
  * @param {String} obj.salt - base64-salt
  */
-const generateSecretBlindIndexWithSaltHelper = async ({
-  secretName,
-  salt,
+export const generateSecretBlindIndexWithSaltHelper = async ({
+    secretName,
+    salt
 }: {
   secretName: string;
   salt: string;
@@ -177,34 +177,64 @@ const generateSecretBlindIndexWithSaltHelper = async ({
  * @param {Stringj} obj.secretName - name of secret to generate blind index for
  * @param {Types.ObjectId} obj.workspaceId - id of workspace that secret belongs to
  */
-const generateSecretBlindIndexHelper = async ({
-  secretName,
-  workspaceId,
+export const generateSecretBlindIndexHelper = async ({
+    secretName,
+    workspaceId
 }: {
   secretName: string;
   workspaceId: Types.ObjectId;
 }) => {
   // check if workspace blind index data exists
+  const encryptionKey = await getEncryptionKey();
+  const rootEncryptionKey = await getRootEncryptionKey();
+
   const secretBlindIndexData = await SecretBlindIndexData.findOne({
     workspace: workspaceId,
-  });
+  }).select('+algorithm +keyEncoding');
 
   if (!secretBlindIndexData) throw SecretBlindIndexDataNotFoundError();
 
-  // decrypt workspace salt
-  const salt = decryptSymmetric128BitHexKeyUTF8({
-    ciphertext: secretBlindIndexData.encryptedSaltCiphertext,
-    iv: secretBlindIndexData.saltIV,
-    tag: secretBlindIndexData.saltTag,
-    key: await getEncryptionKey(),
-  });
+  let salt;
+  if (
+    rootEncryptionKey &&
+    secretBlindIndexData.keyEncoding === ENCODING_SCHEME_BASE64
+  ) {
+    salt = client.decryptSymmetric(
+      secretBlindIndexData.encryptedSaltCiphertext,
+      rootEncryptionKey,
+      secretBlindIndexData.saltIV,
+      secretBlindIndexData.saltTag
+    );
 
-  const secretBlindIndex = await generateSecretBlindIndexWithSaltHelper({
-    secretName,
-    salt,
-  });
+    const secretBlindIndex = await generateSecretBlindIndexWithSaltHelper({
+      secretName,
+      salt,
+    });
 
-  return secretBlindIndex;
+    return secretBlindIndex;
+  } else if (
+    encryptionKey &&
+    secretBlindIndexData.keyEncoding === ENCODING_SCHEME_UTF8
+  ) {
+    // decrypt workspace salt
+    salt = decryptSymmetric128BitHexKeyUTF8({
+      ciphertext: secretBlindIndexData.encryptedSaltCiphertext,
+      iv: secretBlindIndexData.saltIV,
+      tag: secretBlindIndexData.saltTag,
+      key: encryptionKey,
+    });
+
+    const secretBlindIndex = await generateSecretBlindIndexWithSaltHelper({
+      secretName,
+      salt,
+    });
+
+    return secretBlindIndex;
+  }
+  
+  throw InternalServerError({
+    message: 'Failed to generate secret blind index'
+  });
 };
 
 /**
@@ -217,7 +247,7 @@ const generateSecretBlindIndexHelper = async ({
  * @param {AuthData} obj.authData - authentication data on request
  * @returns
  */
-const createSecretHelper = async ({
+export const createSecretHelper = async ({
   secretName,
   workspaceId,
   environment,
@@ -367,10 +397,10 @@ const createSecretHelper = async ({
  * @param {AuthData} obj.authData - authentication data on request
  * @returns
  */
-const getSecretsHelper = async ({
-  workspaceId,
-  environment,
-  authData,
+export const getSecretsHelper = async ({
+    workspaceId,
+    environment,
+    authData
 }: GetSecretsParams) => {
   let secrets: ISecret[] = [];
 
@@ -442,7 +472,7 @@ const getSecretsHelper = async ({
  * @param {AuthData} obj.authData - authentication data on request
  * @returns
  */
-const getSecretHelper = async ({
+export const getSecretHelper = async ({
   secretName,
   workspaceId,
   environment,
@@ -528,7 +558,8 @@ const getSecretHelper = async ({
  * @param {AuthData} obj.authData - authentication data on request
  * @returns
  */
-const updateSecretHelper = async ({
+
+export const updateSecretHelper = async ({
   secretName,
   workspaceId,
   environment,
@@ -668,7 +699,7 @@ const updateSecretHelper = async ({
  * @param {AuthData} obj.authData - authentication data on request
  * @returns
  */
-const deleteSecretHelper = async ({
+export const deleteSecretHelper = async ({
   secretName,
   workspaceId,
   environment,
@@ -769,16 +800,4 @@ const deleteSecretHelper = async ({
     secrets,
     secret,
   };
-};
-
-export {
-  createSecretBlindIndexDataHelper,
-  getSecretBlindIndexSaltHelper,
-  generateSecretBlindIndexWithSaltHelper,
-  generateSecretBlindIndexHelper,
-  createSecretHelper,
-  getSecretsHelper,
-  getSecretHelper,
-  updateSecretHelper,
-  deleteSecretHelper,
-};
+};

backend/src/helpers/signup.ts

@@ -1,4 +1,3 @@
-import * as Sentry from '@sentry/node';
 import { IUser } from '../models';
 import { createOrganization } from './organization';
 import { addMembershipsOrg } from './membershipOrg';
@@ -14,29 +13,21 @@ import { TOKEN_EMAIL_CONFIRMATION } from '../variables';
  * @param {String} obj.email - email
  * @returns {Boolean} success - whether or not operation was successful
  */
-const sendEmailVerification = async ({ email }: { email: string }) => {
-	try {
-		const token = await TokenService.createToken({
-			type: TOKEN_EMAIL_CONFIRMATION,
-			email
-		});
+export const sendEmailVerification = async ({ email }: { email: string }) => {
+	const token = await TokenService.createToken({
+		type: TOKEN_EMAIL_CONFIRMATION,
+		email
+	});
 
-		// send mail
-		await sendMail({
-			template: 'emailVerification.handlebars',
-			subjectLine: 'Infisical confirmation code',
-			recipients: [email],
-			substitutions: {
-				code: token
-			}
-		});
-	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-		throw new Error(
-			"Ouch. We weren't able to send your email verification code"
-		);
-	}
+  // send mail
+  await sendMail({
+    template: 'emailVerification.handlebars',
+    subjectLine: 'Infisical confirmation code',
+    recipients: [email],
+    substitutions: {
+      code: token
+    }
+  });
 };
 
 /**
@@ -45,24 +36,18 @@ const sendEmailVerification = async ({ email }: { email: string }) => {
  * @param {String} obj.email - emai
  * @param {String} obj.code - code that was sent to [email]
  */
-const checkEmailVerification = async ({
+export const checkEmailVerification = async ({
 	email,
 	code
 }: {
 	email: string;
 	code: string;
 }) => {
-	try {
-		await TokenService.validateToken({
-			type: TOKEN_EMAIL_CONFIRMATION,
-			email,
-			token: code
-		});
-	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-		throw new Error("Oops. We weren't able to verify");
-	}
+  await TokenService.validateToken({
+    type: TOKEN_EMAIL_CONFIRMATION,
+    email,
+    token: code
+  });
 };
 
 /**
@@ -72,7 +57,7 @@ const checkEmailVerification = async ({
  * @param {String} obj.organizationName - name of organization to initialize
  * @param {IUser} obj.user - user who we are initializing for
  */
-const initializeDefaultOrg = async ({
+export const initializeDefaultOrg = async ({
 	organizationName,
 	user
 }: {
@@ -96,6 +81,4 @@ const initializeDefaultOrg = async ({
 	} catch (err) {
 		throw new Error(`Failed to initialize default organization and workspace [err=${err}]`);
 	}
-};
-
-export { sendEmailVerification, checkEmailVerification, initializeDefaultOrg };
+};

backend/src/helpers/token.ts

@@ -20,7 +20,7 @@ import { getSaltRounds } from "../config";
  * @param {Types.ObjectId} obj.organizationId
  * @returns {String} token - the created token
  */
-const createTokenHelper = async ({
+export const createTokenHelper = async ({
   type,
   email,
   phoneNumber,
@@ -121,7 +121,7 @@ const createTokenHelper = async ({
  * @param {String} obj.email - email associated with the token
  * @param {String} obj.token - value of the token
  */
-const validateTokenHelper = async ({
+export const validateTokenHelper = async ({
   type,
   email,
   phoneNumber,
@@ -212,6 +212,4 @@ const validateTokenHelper = async ({
 
   // case: token is valid
   await TokenData.findByIdAndDelete(tokenData._id);
-};
-
-export { createTokenHelper, validateTokenHelper };
+};

backend/src/helpers/workspace.ts

@@ -1,4 +1,3 @@
-import * as Sentry from '@sentry/node';
 import {
 	Workspace,
 	Bot,
@@ -16,38 +15,31 @@ import { SecretService } from '../services';
  * @param {String} organizationId - id of organization to create workspace in
  * @param {Object} workspace - new workspace
  */
-const createWorkspace = async ({
+export const createWorkspace = async ({
 	name,
 	organizationId
 }: {
 	name: string;
 	organizationId: string;
 }) => {
-	let workspace;
-	try {
-		// create workspace
-		workspace = await new Workspace({
-			name,
-			organization: organizationId,
-			autoCapitalization: true
-		}).save();
-		
-		// initialize bot for workspace
-		await createBot({
-			name: 'Infisical Bot',
-			workspaceId: workspace._id
-		});
-		
-		// initialize blind index salt for workspace
-		await SecretService.createSecretBlindIndexData({
-			workspaceId: workspace._id
-		});
+  // create workspace
+  const workspace = await new Workspace({
+    name,
+    organization: organizationId,
+    autoCapitalization: true
+  }).save();
+  
+  // initialize bot for workspace
+  await createBot({
+    name: 'Infisical Bot',
+    workspaceId: workspace._id
+  });
+  
+  // initialize blind index salt for workspace
+  await SecretService.createSecretBlindIndexData({
+    workspaceId: workspace._id
+  });
 
-	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-		throw new Error('Failed to create workspace');
-	}
 
 	return workspace;
 };
@@ -58,29 +50,18 @@ const createWorkspace = async ({
  * @param {Object} obj
  * @param {String} obj.id - id of workspace to delete
  */
-const deleteWorkspace = async ({ id }: { id: string }) => {
-	try {
-		await Workspace.deleteOne({ _id: id });
-		await Bot.deleteOne({
-			workspace: id
-		});
-		await Membership.deleteMany({
-			workspace: id
-		});
-		await Secret.deleteMany({
-			workspace: id
-		});
-		await Key.deleteMany({
-			workspace: id
-		});
-	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-		throw new Error('Failed to delete workspace');
-	}
-};
-
-export {
-	createWorkspace, 
-	deleteWorkspace 
+export const deleteWorkspace = async ({ id }: { id: string }) => {
+	await Workspace.deleteOne({ _id: id });
+	await Bot.deleteOne({
+		workspace: id
+	});
+	await Membership.deleteMany({
+		workspace: id
+	});
+	await Secret.deleteMany({
+		workspace: id
+	});
+	await Key.deleteMany({
+		workspace: id
+	});
 };

backend/src/index.ts

@@ -1,6 +1,8 @@
 import dotenv from "dotenv";
 dotenv.config();
 import express from "express";
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+require('express-async-errors');
 import helmet from "helmet";
 import cors from "cors";
 import { DatabaseService } from "./services";
@@ -11,7 +13,6 @@ import swaggerUi = require("swagger-ui-express");
 // eslint-disable-next-line @typescript-eslint/no-var-requires
 const swaggerFile = require("../spec.json");
 // eslint-disable-next-line @typescript-eslint/no-var-requires
-const requestIp = require("request-ip");
 import { apiLimiter } from "./helpers/rateLimiter";
 import {
   workspace as eeWorkspaceRouter,
@@ -84,8 +85,6 @@ const main = async () => {
     })
   );
 
-  app.use(requestIp.mw());
-
   if ((await getNodeEnv()) === "production") {
     // enable app-wide rate-limiting + helmet security
     // in production
@@ -94,6 +93,13 @@ const main = async () => {
     app.use(helmet());
   }
 
+  app.use((req, res, next) => {
+    // default to IP address provided by Cloudflare
+    const cfIp = req.headers['cf-connecting-ip'];
+    req.realIP = Array.isArray(cfIp) ? cfIp[0] : (cfIp as string) || req.ip;
+    next();
+  });
+
   // (EE) routes
   app.use("/api/v1/secret", eeSecretRouter);
   app.use("/api/v1/secret-snapshot", eeSecretSnapshotRouter);

backend/src/interfaces/middleware/index.ts

@@ -1,3 +1,4 @@
+import { Types } from 'mongoose';
 import {
     IUser,
     IServiceAccount,
@@ -10,4 +11,5 @@ export interface AuthData {
     authChannel: string;
     authIP: string;
     authUserAgent: string;
+    tokenVersionId?: Types.ObjectId;
 }

backend/src/middleware/requireAuth.ts

@@ -71,10 +71,12 @@ const requireAuth = ({
 				req.user = authPayload;
 				break;
 			default:
-				authPayload = await getAuthUserPayload({
+				const { user, tokenVersionId } = await getAuthUserPayload({
 					authTokenValue
 				});
-				req.user = authPayload;
+				authPayload = user;
+				req.user = user;
+				req.tokenVersionId = tokenVersionId;
 				break;
 		}
 
@@ -88,8 +90,9 @@ const requireAuth = ({
 			authMode,
 			authPayload, // User, ServiceAccount, ServiceTokenData
 			authChannel: getChannelFromUserAgent(req.headers['user-agent']),
-			authIP: req.ip,
-			authUserAgent: req.headers['user-agent'] ?? 'other'
+			authIP: req.realIP,
+			authUserAgent: req.headers['user-agent'] ?? 'other',
+			tokenVersionId: req.tokenVersionId
 		}
 
 		return next();

backend/src/models/index.ts

@@ -22,6 +22,7 @@ import Workspace, { IWorkspace } from './workspace';
 import ServiceTokenData, { IServiceTokenData } from './serviceTokenData';
 import APIKeyData, { IAPIKeyData } from './apiKeyData';
 import LoginSRPDetail, { ILoginSRPDetail } from './loginSRPDetail';
+import TokenVersion, { ITokenVersion } from './tokenVersion';
 
 export {
 	AuthProvider,
@@ -72,5 +73,7 @@ export {
 	APIKeyData,
 	IAPIKeyData,
 	LoginSRPDetail,
-	ILoginSRPDetail
+	ILoginSRPDetail,
+	TokenVersion,
+	ITokenVersion
 };

backend/src/models/tokenVersion.ts

@@ -0,0 +1,47 @@
+import { Schema, model, Types, Document } from 'mongoose';
+
+export interface ITokenVersion extends Document {
+    user: Types.ObjectId;
+    ip: string;
+    userAgent: string;
+    refreshVersion: number;
+    accessVersion: number;
+    lastUsed: Date;
+}
+
+const tokenVersionSchema = new Schema<ITokenVersion>(
+    {
+        user: {
+            type: Schema.Types.ObjectId,
+            ref: 'User',
+            required: true
+        },
+        ip: {
+            type: String,
+            required: true
+        },
+        userAgent: {
+            type: String,
+            required: true
+        },
+        refreshVersion: {
+            type: Number,
+            required: true
+        },
+        accessVersion: {
+            type: Number,
+            required: true
+        },
+        lastUsed: {
+            type: Date,
+            required: true
+        }
+    },
+    {
+        timestamps: true
+    }
+);
+
+const TokenVersion = model<ITokenVersion>('TokenVersion', tokenVersionSchema);
+
+export default TokenVersion;

backend/src/models/user.ts

@@ -21,7 +21,6 @@ export interface IUser extends Document {
 	tag?: string;
 	salt?: string;
 	verifier?: string;
-	refreshVersion?: number;
 	isMfaEnabled: boolean;
 	mfaMethods: boolean;
 	devices: {
@@ -91,11 +90,6 @@ const userSchema = new Schema<IUser>(
 			type: String,
 			select: false
 		},
-		refreshVersion: {
-			type: Number,
-			default: 0,
-			select: false
-		},
 		isMfaEnabled: {
 			type: Boolean,
 			default: false
@@ -108,7 +102,8 @@ const userSchema = new Schema<IUser>(
 				ip: String,
 				userAgent: String
 			}],
-			default: []
+			default: [],
+			select: false
 		}
 	}, 
 	{

backend/src/routes/v1/auth.ts

@@ -44,8 +44,6 @@ router.post(
   authController.checkAuth
 );
 
-
-
 router.get(
   '/redirect/google',
   authLimiter,
@@ -53,12 +51,27 @@ router.get(
     scope: ['profile', 'email'],
     session: false,
   }),
-)
+);
 
 router.get(
   '/callback/google',
   passport.authenticate('google', { failureRedirect: '/login/provider/error', session: false }),
   authController.handleAuthProviderCallback,
-)
+);
+
+router.get(
+  '/common-passwords',
+  authLimiter,
+  authController.getCommonPasswords
+);
+
+router.delete(
+  '/sessions',
+  authLimiter,
+  requireAuth({
+    acceptedAuthModes: [AUTH_MODE_JWT]
+  }), 
+  authController.revokeAllSessions
+);
 
 export default router;

backend/src/routes/v2/auth.ts

@@ -26,7 +26,7 @@ router.post(
 router.post(
   '/mfa/send',
   authLimiter,
-  body('email').isString().trim().notEmpty(),
+  body('email').isString().trim().notEmpty().isEmail(),
   validateRequest,
   authController.sendMfaToken
 );

backend/src/services/BotService.ts

@@ -1,6 +1,6 @@
 import { Types } from 'mongoose';
 import {
-    getSecretsHelper,
+    getSecretsBotHelper,
     encryptSymmetricHelper,
     decryptSymmetricHelper
 } from '../helpers/bot';
@@ -25,7 +25,7 @@ class BotService {
         workspaceId: Types.ObjectId;
         environment: string;
     }) {
-        return await getSecretsHelper({
+        return await getSecretsBotHelper({
             workspaceId,
             environment
         });

backend/src/types/express/index.d.ts

@@ -1,4 +1,5 @@
 import * as express from 'express';
+import { Types } from 'mongoose';
 import { 
 	IUser,
 	IServiceAccount,
@@ -39,7 +40,9 @@ declare global {
 			serviceTokenData: any;
 			apiKeyData: any;
 			query?: any;
+			tokenVersionId?: Types.ObjectId;
 			authData: AuthData;
+			realIP: string;
 			requestData: {
 				[key: string]: string
 			};

backend/src/types/secret/index.d.ts

@@ -43,4 +43,5 @@ export interface BatchSecret {
   secretCommentIV: string;
   secretCommentTag: string;
   tags: string[];
+  folder: string
 }

backend/src/utils/patchAsyncRoutes.js

@@ -1,69 +0,0 @@
-/*
-Original work Copyright (c) 2016, Nikolay Nemshilov <nemshilov@gmail.com>
-Modified work Copyright (c) 2016, David Banham <david@banham.id.au>
-
-Permission to use, copy, modify, and/or distribute this software for any purpose
-with or without fee is hereby granted, provided that the above copyright notice
-and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
-FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
-OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
-TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
-THIS SOFTWARE.
-
-*/
-
-/* eslint-disable @typescript-eslint/no-var-requires */
-/* eslint-env node */
-const Layer = require('express/lib/router/layer');
-const Router = require('express/lib/router');
-
-const last = (arr = []) => arr[arr.length - 1];
-const noop = Function.prototype;
-
-function copyFnProps(oldFn, newFn) {
-  Object.keys(oldFn).forEach((key) => {
-    newFn[key] = oldFn[key];
-  });
-  return newFn;
-}
-
-function wrap(fn) {
-  const newFn = function newFn(...args) {
-    const ret = fn.apply(this, args);
-    const next = (args.length === 5 ? args[2] : last(args)) || noop;
-    if (ret && ret.catch) ret.catch(err => next(err));
-    return ret;
-  };
-  Object.defineProperty(newFn, 'length', {
-    value: fn.length,
-    writable: false,
-  });
-  return copyFnProps(fn, newFn);
-}
-
-function patchRouterParam() {
-  const originalParam = Router.prototype.constructor.param;
-  Router.prototype.constructor.param = function param(name, fn) {
-    fn = wrap(fn);
-    return originalParam.call(this, name, fn);
-  };
-}
-
-Object.defineProperty(Layer.prototype, 'handle', {
-  enumerable: true,
-  get() {
-    return this.__handle;
-  },
-  set(fn) {
-    fn = wrap(fn);
-    this.__handle = fn;
-  },
-});
-
-module.exports = {
-  patchRouterParam
-};

backend/src/utils/setup/index.ts

@@ -5,7 +5,6 @@ import { EELicenseService } from '../../ee/services';
 import { initSmtp } from '../../services/smtp';
 import { createTestUserForDevelopment } from '../addDevelopmentUser';
 // eslint-disable-next-line @typescript-eslint/no-var-requires
-const { patchRouterParam } = require('../patchAsyncRoutes');
 import { validateEncryptionKeysConfig } from './validateConfig';
 import {
   backfillSecretVersions,
@@ -38,7 +37,6 @@ import { initializePassport } from '../auth';
  * - Re-encrypting data
  */
 export const setup = async () => {
-  patchRouterParam();
   await validateEncryptionKeysConfig();
   await TelemetryService.logTelemetryMessage();
 

backend/src/utils/setup/validateConfig.ts

@@ -21,39 +21,39 @@ import {
 export const validateEncryptionKeysConfig = async () => {
     const encryptionKey = await getEncryptionKey();
     const rootEncryptionKey = await getRootEncryptionKey();
-    
+
     if (
         (encryptionKey === undefined || encryptionKey === "") &&
         (rootEncryptionKey === undefined || rootEncryptionKey === "")
     ) throw InternalServerError({
         message: "Failed to find required root encryption key environment variable. Please make sure that you're passing in a ROOT_ENCRYPTION_KEY environment variable."
     });
-    
-    if (encryptionKey && encryptionKey !== '') {
-        // validate [encryptionKey]
-        
-        const keyBuffer = Buffer.from(encryptionKey, 'hex');
-        const decoded = keyBuffer.toString('hex');
 
-        if (decoded !== encryptionKey) throw InternalServerError({
-            message: 'Failed to validate that the encryption key is correctly encoded in hex.'
-        });
-        
-        if (keyBuffer.length !== 16) throw InternalServerError({
-            message: 'Failed to validate that the encryption key is a 128-bit hex string.'
-        });
-    }
+    // if (encryptionKey && encryptionKey !== '') {
+    //     // validate [encryptionKey]
+
+    //     const keyBuffer = Buffer.from(encryptionKey, 'hex');
+    //     const decoded = keyBuffer.toString('hex');
+
+    //     if (decoded !== encryptionKey) throw InternalServerError({
+    //         message: 'Failed to validate that the encryption key is correctly encoded in hex.'
+    //     });
+
+    //     if (keyBuffer.length !== 16) throw InternalServerError({
+    //         message: 'Failed to validate that the encryption key is a 128-bit hex string.'
+    //     });
+    // }
 
     if (rootEncryptionKey && rootEncryptionKey !== '') {
         // validate [rootEncryptionKey]
-        
+
         const keyBuffer = Buffer.from(rootEncryptionKey, 'base64')
         const decoded = keyBuffer.toString('base64');
 
         if (decoded !== rootEncryptionKey) throw InternalServerError({
             message: 'Failed to validate that the root encryption key is correctly encoded in base64'
         });
-        
+
         if (keyBuffer.length !== 32) throw InternalServerError({
             message: 'Failed to validate that the encryption key is a 256-bit base64 string'
         });

backend/src/validation/index.ts

@@ -1,3 +1,4 @@
+export * from './user';
 export * from './workspace';
 export * from './bot';
 export * from './integration';

backend/src/validation/user.ts

@@ -1,3 +1,5 @@
+import fs from 'fs';
+import path from 'path';
 import { Types } from 'mongoose';
 import {
 	IUser, 
@@ -8,7 +10,7 @@ import {
 } from '../models';
 import { validateMembership } from '../helpers/membership';
 import _ from 'lodash';
-import { BadRequestError, UnauthorizedRequestError } from '../utils/errors';
+import { BadRequestError, UnauthorizedRequestError, ValidationError } from '../utils/errors';
 import {
 	validateMembershipOrg
 } from '../helpers/membershipOrg';
@@ -17,6 +19,22 @@ import {
 	PERMISSION_WRITE_SECRETS
 } from '../variables';
 
+/**
+ * Validate that email [email] is not disposable
+ * @param email - email to validate
+ */
+export const validateUserEmail = (email: string) => {
+	const emailDomain = email.split('@')[1];
+	const disposableEmails = fs.readFileSync(
+		path.resolve(__dirname, '../data/' + 'disposable_emails.txt'),
+		'utf8'
+	).split('\n');	
+	
+	if (disposableEmails.includes(emailDomain)) throw ValidationError({
+		message: 'Failed to validate email as non-disposable'
+	});
+}
+
 /**
  * Validate that user (client) can access workspace
  * with id [workspaceId] and its environment [environment] with required permissions

backend/src/validation/workspace.ts

@@ -51,7 +51,6 @@ export const validateClientForWorkspace = async ({
 	requiredPermissions?: string[];
 	requireBlindIndicesEnabled: boolean;
 }) => {
-	
 	const workspace = await Workspace.findById(workspaceId);
 
 	if (!workspace) throw WorkspaceNotFoundError({

docs/mint.json

@@ -121,12 +121,6 @@
     {
       "group": "Self-host Infisical",
       "pages": [
-        {
-          "group": "Authentication",
-          "pages": [
-            "self-hosting/authentication/google"
-          ]
-        },
         {
           "group": "Deployment options",
           "pages": [

docs/self-hosting/configuration/email.mdx

@@ -3,17 +3,16 @@ title: "Configure email service"
 description: "How to configure your email when self-hosting Infisical."
 ---
 
-Infisical requires you to configure your own SMTP server for certain functionality like:
+By default, the core functions of Infisical work without any email service configuration. Without email service, basic sign up/login and secret operations will function without any issue. 
+However, the following functionality will be disabled.
 
-- Sending email confirmation links to sign up.
-- Sending invite links for projects.
-- Sending alerts.
-
-We strongly recommend using an email service to act as your email server and provide examples for common providers.
+- Multi-factor authentication 
+- Sending invite links via email for projects to teammates
+- Sending alerts such as suspicious login attempts 
 
 ## General configuration
 
-By default, you need to configure the following SMTP [environment variables](https://infisical.com/docs/self-hosting/configuration/envars):
+If you choose to setup email service, you need to configure the following SMTP [environment variables](https://infisical.com/docs/self-hosting/configuration/envars):
 
 - `SMTP_HOST`: Hostname to connect to for establishing SMTP connections.
 - `SMTP_USERNAME`: Credential to connect to host (e.g. team@infisical.com)

frontend/src/components/login/InitialLoginStep.tsx

@@ -1,19 +1,65 @@
+import { useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import Link from 'next/link';
 import { useRouter } from 'next/router';
 
+import attemptLogin from '@app/components/utilities/attemptLogin';
+
+import Error from '../basic/Error';
 // import { faGoogle } from '@fortawesome/free-brands-svg-icons';
 // import { FontAwesomeIcon } from '@fortawesome/react-fontawesome';
-import { Button } from '../v2';
+import { Button, Input } from '../v2';
 
 export default function InitialLoginStep({
-    setIsLoginWithEmail,
+    setStep,
+    email,
+    setEmail,
+    password,
+    setPassword,
 }: {
-    setIsLoginWithEmail: (value: boolean) => void;
+    setStep: (step: number) => void;
+    email: string;
+    setEmail: (email: string) => void;
+    password: string;
+    setPassword: (password: string) => void;
 }) {
 
     const router = useRouter();
     const { t } = useTranslation();
+    const [isLoading, setIsLoading] = useState(false);
+    const [loginError, setLoginError] = useState(false);
+
+    const handleLogin = async () => {
+        try {
+          if (!email || !password) {
+            return;
+          }
+    
+          setIsLoading(true);
+          const isLoginSuccessful = await attemptLogin({
+            email,
+            password,
+          });
+          if (isLoginSuccessful && isLoginSuccessful.success) {
+            // case: login was successful
+    
+            if (isLoginSuccessful.mfaEnabled) {
+              // case: login requires MFA step
+              setStep(2);
+              setIsLoading(false);
+              return;
+            }
+    
+            // case: login does not require MFA step
+            router.push(`/dashboard/${localStorage.getItem('projectData.id')}`);
+          }
+    
+        } catch (err) {
+          setLoginError(true);
+        }
+    
+        setIsLoading(false);
+    }
 
     return <div className='flex flex-col mx-auto w-full justify-center items-center'>
         <h1 className='text-xl font-medium text-transparent bg-clip-text bg-gradient-to-b from-white to-bunker-200 text-center mb-8' >Login to Infisical</h1>
@@ -30,18 +76,49 @@ export default function InitialLoginStep({
                 {t('login.continue-with-google')}
             </Button>
         </div> */}
-        <div className='lg:w-1/6 w-1/4 min-w-[20rem] text-center rounded-md'>
+        <div className="relative md:px-1.5 flex items-center justify-center lg:w-1/6 w-1/4 min-w-[20rem] md:min-w-[22rem] mx-auto w-full rounded-lg max-h-24 md:max-h-28">
+            <div className="flex items-center justify-center w-full md:px-2 md:py-1 rounded-lg max-h-24 md:max-h-28">
+                <Input
+                    value={email}
+                    onChange={(e) => setEmail(e.target.value)}
+                    type="email"
+                    placeholder="Enter your email..."
+                    isRequired
+                    autoComplete="username"
+                    className="h-12"
+                />
+            </div>
+        </div>
+        <div className="relative pt-2 md:pt-0 md:px-1.5 flex items-center justify-center lg:w-1/6 w-1/4 min-w-[20rem] md:min-w-[22rem] mx-auto w-full rounded-lg max-h-24 md:max-h-28">
+          <div className="flex items-center justify-center w-full md:p-2 rounded-lg max-h-24 md:max-h-28">
+            <Input
+              value={password}
+              onChange={(e) => setPassword(e.target.value)}
+              type="password"
+              placeholder="Enter your password..."
+              isRequired
+              autoComplete="current-password"
+              id="current-password"
+              className="h-12 select:-webkit-autofill:focus"
+            />
+          </div>
+        </div>
+        {!isLoading && loginError && <Error text={t('login.error-login') ?? ''} />}
+        <div className='lg:w-1/6 w-1/4 min-w-[21.2rem] md:min-w-[20.1rem] text-center rounded-md mt-4'>
             <Button
-                colorSchema="primary" 
-                variant="solid"
-                onClick={() => {
-                    setIsLoginWithEmail(true);
-                }} 
+                onClick={async () => handleLogin()}
+                size="sm"
                 isFullWidth
-                className="h-14 w-full mx-0"
-            > 
-                {t('login.continue-with-email')} 
-            </Button>
+                className='h-12'
+                colorSchema="primary"
+                variant="solid"
+                isLoading={isLoading}
+            > Login </Button>
+        </div>
+        <div className='lg:w-1/6 w-1/4 min-w-[20rem] flex flex-row items-center mt-4 py-2'>
+            <div className='w-1/2 border-t border-mineshaft-500'/>
+            <span className='px-4 text-sm text-bunker-400'>or</span>
+            <div className='w-1/2 border-t border-mineshaft-500'/>
         </div>
         <div className='lg:w-1/6 w-1/4 min-w-[20rem] text-center rounded-md mt-4'>
             <Button
@@ -54,7 +131,7 @@ export default function InitialLoginStep({
                 Continue with SAML SSO
             </Button>
         </div>
-        <div className="mt-4 text-bunker-400 text-sm flex flex-row">
+        <div className="mt-6 text-bunker-400 text-sm flex flex-row">
             <span className="mr-1">Don&apos;t have an acount yet?</span>
             <Link href="/signup">
                 <span className='hover:underline hover:underline-offset-4 hover:decoration-primary-700 hover:text-bunker-200 duration-200 cursor-pointer'>{t('login.create-account')}</span>

frontend/src/components/login/MFAStep.tsx

@@ -16,10 +16,10 @@ const props = {
     fontFamily: 'monospace',
     margin: '4px',
     MozAppearance: 'textfield',
-    width: '55px',
+    width: '48px',
     borderRadius: '5px',
     fontSize: '24px',
-    height: '55px',
+    height: '48px',
     paddingLeft: '7',
     backgroundColor: '#0d1117',
     color: 'white',
@@ -115,7 +115,7 @@ export default function MFAStep({
   };
 
   return (
-    <form className="mx-auto w-max px-8 pb-4 pt-4 md:mb-16">
+    <form className="mx-auto w-max md:px-8 pb-4 pt-4 md:mb-16">
       <p className="text-l flex justify-center text-bunker-300">{t('mfa.step2-message')}</p>
       <p className="text-l my-1 flex justify-center font-semibold text-bunker-300">{email} </p>
       <div className="hidden md:block w-max min-w-[20rem] mx-auto">

frontend/src/components/signup/CodeInputStep.tsx

@@ -85,7 +85,7 @@ export default function CodeInputStep({
   };
 
   return (
-    <div className="mx-auto h-full w-full pb-4 px-8">
+    <div className="mx-auto h-full w-full pb-4 md:px-8">
       <p className="text-md flex justify-center text-bunker-200">{t('signup.step2-message')}</p>
       <p className="text-md flex justify-center font-semibold my-1 text-bunker-200">{email} </p>
       <div className="hidden md:block w-max min-w-[20rem] mx-auto">

frontend/src/components/signup/DonwloadBackupPDFStep.tsx

@@ -34,7 +34,7 @@ export default function DonwloadBackupPDFStep({
       <p className="text-xl text-center font-medium flex justify-center text-transparent bg-clip-text bg-gradient-to-b from-white to-bunker-200">
         <FontAwesomeIcon icon={faWarning} className="ml-2 mr-3 pt-1 text-2xl text-bunker-200" />{t('signup.step4-message')}
       </p>
-      <div className="flex flex-col pb-2 bg-mineshaft-900 border border-mineshaft-700 items-center justify-center text-center lg:w-1/6 w-full md:min-w-[24rem] mt-8 max-w-md text-bunker-300 text-md rounded-md">
+      <div className="flex flex-col pb-2 bg-mineshaft-800 border border-mineshaft-600 items-center justify-center text-center lg:w-1/6 w-full md:min-w-[24rem] mt-8 max-w-md text-bunker-300 text-md rounded-md">
         <div className="w-full mt-4 md:mt-8 flex flex-row text-center items-center m-2 text-bunker-300 rounded-md lg:w-1/6 lg:w-1/6 w-full md:min-w-[23rem] px-3 mx-auto">
           <span className='mb-2'>{t('signup.step4-description1')} {t('signup.step4-description3')}</span>
         </div>

frontend/src/components/signup/InitialSignupStep.tsx

@@ -39,7 +39,7 @@ export default function InitialSignupStep({
                 isFullWidth
                 className="h-14 w-full mx-0"
             >
-                {t('signup.continue-with-email')}
+                Sign Up with email
             </Button>
         </div>
         <div className='lg:w-1/6 w-1/4 min-w-[20rem] text-center rounded-md mt-4'>

frontend/src/components/signup/UserInfoStep.tsx

@@ -2,18 +2,19 @@ import crypto from 'crypto';
 
 import React, { useState } from 'react';
 import { useTranslation } from 'react-i18next';
-import { faCheck, faXmark } from '@fortawesome/free-solid-svg-icons';
+import { faXmark } from '@fortawesome/free-solid-svg-icons';
 import { FontAwesomeIcon } from '@fortawesome/react-fontawesome';
 import jsrp from 'jsrp';
 import nacl from 'tweetnacl';
 import { encodeBase64 } from 'tweetnacl-util';
 
+import { useGetCommonPasswords } from '@app/hooks/api';
 import completeAccountInformationSignup from '@app/pages/api/auth/CompleteAccountInformationSignup';
 import getOrganizations from '@app/pages/api/organization/getOrgs';
 import ProjectService from '@app/services/ProjectService';
 
 import InputField from '../basic/InputField';
-import passwordCheck from '../utilities/checks/PasswordCheck';
+import checkPassword from '../utilities/checks/checkPassword';
 import Aes256Gcm from '../utilities/cryptography/aes-256-gcm';
 import { deriveArgonKey } from '../utilities/cryptography/crypto';
 import { saveTokenToLocalStorage } from '../utilities/saveTokenToLocalStorage';
@@ -37,6 +38,15 @@ interface UserInfoStepProps {
   providerAuthToken?: string;
 }
 
+type Errors = {
+  length?: string,
+  upperCase?: string,
+  lowerCase?: string,
+  number?: string,
+  specialChar?: string,
+  repeatedChar?: string,
+};
+
 /**
  * This is the step of the sign up flow where people provife their name/surname and password
  * @param {object} obj
@@ -63,11 +73,11 @@ export default function UserInfoStep({
   setAttributionSource,
   providerAuthToken,
 }: UserInfoStepProps): JSX.Element {
+  const { data: commonPasswords } = useGetCommonPasswords();
   const [nameError, setNameError] = useState(false);
   const [organizationNameError, setOrganizationNameError] = useState(false);
-  const [passwordErrorLength, setPasswordErrorLength] = useState(false);
-  const [passwordErrorNumber, setPasswordErrorNumber] = useState(false);
-  const [passwordErrorLowerCase, setPasswordErrorLowerCase] = useState(false);
+
+  const [errors, setErrors] = useState<Errors>({});
 
   const [isLoading, setIsLoading] = useState(false);
   const { t } = useTranslation();
@@ -89,12 +99,11 @@ export default function UserInfoStep({
     } else {
       setOrganizationNameError(false);
     }
-    errorCheck = passwordCheck({
+    
+    errorCheck = checkPassword({
       password,
-      setPasswordErrorLength,
-      setPasswordErrorNumber,
-      setPasswordErrorLowerCase,
-      errorCheck
+      commonPasswords,
+      setErrors
     });
 
     if (!errorCheck) {
@@ -205,11 +214,11 @@ export default function UserInfoStep({
   };
 
   return (
-    <div className="h-full mx-auto mb-36 w-max rounded-xl px-8 md:mb-16">
+    <div className="h-full mx-auto mb-36 w-max rounded-xl md:px-8 md:mb-16">
       <p className="mx-8 mb-6 flex justify-center text-xl font-bold text-medium md:mx-16 text-transparent bg-clip-text bg-gradient-to-b from-white to-bunker-200">
         {t('signup.step3-message')}
       </p>
-      <div className="h-full mx-auto mb-36 w-max rounded-xl py-6 px-8 md:mb-16 border border-mineshaft-600 bg-mineshaft-800">
+      <div className="h-full mx-auto mb-36 w-max rounded-xl py-6 md:px-8 md:mb-16 md:border md:border-mineshaft-600 md:bg-mineshaft-800">
         <div className="relative z-0 lg:w-1/6 w-1/4 min-w-[20rem] flex flex-col items-center justify-end w-full py-2 rounded-lg">
           <p className='text-left w-full text-sm text-bunker-300 mb-1 ml-1 font-medium'>Your Name</p>
           <Input
@@ -248,59 +257,45 @@ export default function UserInfoStep({
             label={t('section.password.password')}
             onChangeHandler={(pass: string) => {
               setPassword(pass);
-              passwordCheck({
+              checkPassword({
                 password: pass,
-                setPasswordErrorLength,
-                setPasswordErrorNumber,
-                setPasswordErrorLowerCase,
-                errorCheck: false
+                commonPasswords,
+                setErrors
               });
             }}
             type="password"
             value={password}
             isRequired
-            error={passwordErrorLength && passwordErrorNumber && passwordErrorLowerCase}
+            error={Object.keys(errors).length > 0}
             autoComplete="new-password"
             id="new-password"
           />
-          {passwordErrorLength || passwordErrorLowerCase || passwordErrorNumber ? (
+          {Object.keys(errors).length > 0 && (
             <div className="mt-4 flex w-full flex-col items-start rounded-md bg-white/5 px-2 py-2">
-              <div className="mb-1 text-sm text-gray-400">{t('section.password.validate-base')}</div>
-              <div className="ml-1 flex flex-row items-center justify-start">
-                {passwordErrorLength ? (
-                  <FontAwesomeIcon icon={faXmark} className="text-md text-red ml-0.5 mr-2.5" />
-                ) : (
-                  <FontAwesomeIcon icon={faCheck} className="text-md mr-2 text-primary" />
-                )}
-                <div className={`${passwordErrorLength ? 'text-gray-400' : 'text-gray-600'} text-sm`}>
-                  {t('section.password.validate-length')}
-                </div>
-              </div>
-              <div className="ml-1 flex flex-row items-center justify-start">
-                {passwordErrorLowerCase ? (
-                  <FontAwesomeIcon icon={faXmark} className="text-md text-red ml-0.5 mr-2.5" />
-                ) : (
-                  <FontAwesomeIcon icon={faCheck} className="text-md mr-2 text-primary" />
-                )}
-                <div
-                  className={`${passwordErrorLowerCase ? 'text-gray-400' : 'text-gray-600'} text-sm`}
-                >
-                  {t('section.password.validate-case')}
-                </div>
-              </div>
-              <div className="ml-1 flex flex-row items-center justify-start">
-                {passwordErrorNumber ? (
-                  <FontAwesomeIcon icon={faXmark} className="text-md text-red ml-0.5 mr-2.5" />
-                ) : (
-                  <FontAwesomeIcon icon={faCheck} className="text-md mr-2 text-primary" />
-                )}
-                <div className={`${passwordErrorNumber ? 'text-gray-400' : 'text-gray-600'} text-sm`}>
-                  {t('section.password.validate-number')}
-                </div>
-              </div>
+              <div className="mb-2 text-sm text-gray-400">{t('section.password.validate-base')}</div> 
+              {Object.keys(errors).map((key) => {
+                if (errors[key as keyof Errors]) {
+                  return (
+                    <div 
+                      className="ml-1 flex flex-row items-top justify-start"
+                      key={key}
+                    >
+                      <div>
+                        <FontAwesomeIcon 
+                          icon={faXmark} 
+                          className="text-md text-red ml-0.5 mr-2.5"
+                        />
+                      </div>
+                      <p className="text-gray-400 text-sm">
+                        {errors[key as keyof Errors]} 
+                      </p>
+                    </div>
+                  );
+                }
+
+                return null;
+              })}
             </div>
-          ) : (
-            <div className="py-2" />
           )}
         </div>
         <div className="flex flex-col items-center justify-center lg:w-[19%] w-1/4 min-w-[20rem] mt-2 max-w-xs md:max-w-md mx-auto text-sm text-center md:text-left">

frontend/src/components/utilities/checks/PasswordCheck.ts

@@ -17,6 +17,7 @@ const passwordCheck = ({
   setPasswordErrorLowerCase,
   errorCheck
 }: PasswordCheckProps) => {
+  
   if (!password || password.length < 14) {
     setPasswordErrorLength(true);
     errorCheck = true;

frontend/src/components/utilities/checks/checkPassword.ts

@@ -0,0 +1,72 @@
+type Errors = {
+    length?: string,
+    upperCase?: string,
+    lowerCase?: string,
+    number?: string,
+    specialChar?: string,
+    repeatedChar?: string,
+    commonPassword?: string
+  };
+
+interface CheckPasswordParams {
+    password: string;
+    commonPasswords: string[];
+    setErrors: (value: Errors) => void;
+}
+
+/**
+ * Validate that the password [password] is at least:
+ * - 8 characters long
+ * - Contains 1 uppercase character (A-Z)
+ * - Contains 1 lowercase character (a-z)
+ * - Contains 1 number (0-9)
+ * - Does not contain 3 repeat, consecutive characters
+ * 
+ * The function returns whether or not the password [password]
+ * passes the minimum requirements above. It sets errors on 
+ * an erorr object via [setErrors].
+ * 
+ * @param {Object} obj
+ * @param {String} obj.password - the password to check
+ * @param {Function} obj.setErrors - set state function to set error object
+ */
+const checkPassword = ({
+    password,
+    commonPasswords,
+    setErrors
+}: CheckPasswordParams): boolean => {
+    const errors: Errors = {}; 
+    
+    if (password.length < 8) {
+        errors.length = "8 characters";
+    }
+
+    if (!/[A-Z]/.test(password)) {
+        errors.upperCase = "1 uppercase character (A-Z)";
+    }
+
+    if (!/[a-z]/.test(password)) {
+        errors.lowerCase = "1 lowercase character (a-z)";
+    }
+
+    if (!/[0-9]/.test(password)) {
+        errors.number = "1 number (0-9)";
+    }
+
+    if (!/[!@#$%^&*(),.?":{}|<>]/.test(password)) {
+        errors.specialChar = "1 special character (!@#$%^&*(),.?)";
+    }
+
+    if (/([A-Za-z0-9])\1\1\1/.test(password)) {
+        errors.repeatedChar = "No 3 repeat, consecutive characters";
+    }
+    
+    if (commonPasswords.includes(password)) {
+        errors.commonPassword = "No common passwords"; 
+    }
+    
+    setErrors(errors);
+    return Object.keys(errors).length > 0;
+}
+
+export default checkPassword;

frontend/src/components/utilities/cryptography/changePassword.ts

@@ -125,6 +125,10 @@ const changePassword = async (
                 setPasswordChanged(true);
                 setCurrentPassword('');
                 setNewPassword('');
+
+                window.location.href = '/login';
+
+                // move to login page
               } catch (error) {
                 setCurrentPasswordError(true);
                 console.log(error);

frontend/src/components/v2/DeleteActionModal/DeleteActionModal.tsx

@@ -73,10 +73,15 @@ export const DeleteActionModal = ({
         }
         onClose={onClose}
       >
-        <form>
+        <form
+          onSubmit={(evt) => {
+            evt.preventDefault();
+            if (deleteKey === inputData) onDelete();
+          }}
+        >
           <FormControl
             label={
-              <div className="pb-2 text-sm break-words">
+              <div className="break-words pb-2 text-sm">
                 Type <span className="font-bold">{deleteKey}</span> to delete the resource
               </div>
             }

frontend/src/hooks/api/auth/index.tsx

@@ -1,4 +1,7 @@
 export {
     useGetAuthToken,
     useSendMfaToken, 
-    useVerifyMfaToken} from './queries'
+    useVerifyMfaToken,
+    useRevokeAllSessions,
+    useGetCommonPasswords
+} from './queries'

frontend/src/hooks/api/auth/queries.tsx

@@ -10,7 +10,8 @@ import {
   VerifyMfaTokenRes} from './types';
 
 const authKeys = {
-  getAuthToken: ['token'] as const
+  getAuthToken: ['token'] as const,
+  commonPasswords: ['common-passwords'] as const
 };
 
 export const useSendMfaToken = () => {
@@ -49,3 +50,20 @@ export const useGetAuthToken = () =>
     onSuccess: (data) => setAuthToken(data.token),
     retry: 0
   });
+
+export const useRevokeAllSessions = () => {
+  return useMutation({
+    mutationFn: async () => {
+      const { data } = await apiRequest.delete('/api/v1/auth/sessions');
+      return data;
+    }
+  });
+}
+
+const fetchCommonPasswords = async () => {
+  const { data } = await apiRequest.get('/api/v1/auth/common-passwords');
+  return data || [];
+};
+
+export const useGetCommonPasswords = () =>
+  useQuery({ queryKey: authKeys.commonPasswords, queryFn: fetchCommonPasswords });

frontend/src/pages/login.tsx

@@ -7,7 +7,6 @@ import { useRouter } from 'next/router';
 
 // import ListBox from '@app/components/basic/Listbox';
 import InitialLoginStep from '@app/components/login/InitialLoginStep';
-import LoginStep from '@app/components/login/LoginStep';
 import MFAStep from '@app/components/login/MFAStep';
 import PasswordInputStep from '@app/components/login/PasswordInputStep';
 import { useProviderAuth } from '@app/hooks/useProviderAuth';
@@ -22,7 +21,6 @@ export default function Login() {
   const [step, setStep] = useState(1);
   const { t } = useTranslation();
   // const lang = router.locale ?? 'en';
-  const [isLoginWithEmail, setIsLoginWithEmail] = useState(false);
   const {
     providerAuthToken,
     email: providerEmail,
@@ -70,20 +68,14 @@ export default function Login() {
       );
     }
 
-    if (isLoginWithEmail && loginStep === 1) {
-      return (
-        <LoginStep
-          email={email}
-          setEmail={setEmail}
-          password={password}
-          setPassword={setPassword}
-          setStep={setStep}
-        />
-      );
-    }
-
-    if (!isLoginWithEmail && loginStep === 1) {
-      return <InitialLoginStep setIsLoginWithEmail={setIsLoginWithEmail} />;
+    if (loginStep === 1) {
+      return <InitialLoginStep 
+        setStep={setStep}
+        email={email}
+        setEmail={setEmail}
+        password={password}
+        setPassword={setPassword}
+      />;
     }
 
     if (step === 2) {

frontend/src/pages/saml-sso.tsx

@@ -46,16 +46,16 @@ export default function Login() {
           <Image src="/images/gradientLogo.svg" height={90} width={120} alt="Infisical logo" />
         </div>
       </Link>
-      <div className="mx-auto w-full max-w-md px-6">
+      <div className="mx-auto w-full max-w-md md:px-6">
         <p className="mx-auto mb-6 flex w-max justify-center text-xl font-medium text-transparent bg-clip-text bg-gradient-to-b from-white to-bunker-200 text-center mb-8">
           What’s your email?
         </p>
-        <div className="relative flex items-center justify-center lg:w-1/6 w-1/4 min-w-[22rem] mx-auto w-full rounded-lg max-h-24 md:max-h-28">
+        <div className="relative flex items-center justify-center lg:w-1/6 w-1/4 min-w-[20rem] md:min-w-[22rem] mx-auto w-full rounded-lg max-h-24 md:max-h-28">
           <div className="flex items-center justify-center w-full rounded-lg max-h-24 md:max-h-28">
             <Input
               value={password}
               onChange={(e) => setPassword(e.target.value)}
-              type="password"
+              type="email"
               placeholder="Enter your email..."
               isRequired
               autoComplete="email"
@@ -64,7 +64,7 @@ export default function Login() {
             />
           </div>
         </div>
-        <div className='lg:w-1/6 w-1/4 w-full mx-auto flex items-center justify-center min-w-[22rem] text-center rounded-md mt-4'>
+        <div className='lg:w-1/6 w-1/4 w-full mx-auto flex items-center justify-center min-w-[20rem] md:min-w-[22rem] text-center rounded-md mt-4'>
           <Button
               colorSchema="primary" 
               variant="outline_bg"

frontend/src/pages/settings/personal/[id].tsx

@@ -2,7 +2,7 @@ import { useEffect, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import Head from 'next/head';
 import { useRouter } from 'next/router';
-import { faCheck, faPlus, faX } from '@fortawesome/free-solid-svg-icons';
+import { faBan,faCheck, faPlus, faXmark } from '@fortawesome/free-solid-svg-icons';
 import { FontAwesomeIcon } from '@fortawesome/react-fontawesome';
 
 import Button from '@app/components/basic/buttons/Button';
@@ -10,21 +10,31 @@ import InputField from '@app/components/basic/InputField';
 import ListBox from '@app/components/basic/Listbox';
 import ApiKeyTable from '@app/components/basic/table/ApiKeyTable';
 import NavHeader from '@app/components/navigation/NavHeader';
-import passwordCheck from '@app/components/utilities/checks/PasswordCheck';
+import checkPassword from '@app/components/utilities/checks/checkPassword';
 import changePassword from '@app/components/utilities/cryptography/changePassword';
 import issueBackupKey from '@app/components/utilities/cryptography/issueBackupKey';
+import {
+  useGetCommonPasswords,
+  useRevokeAllSessions} from '@app/hooks/api';
 import { SecuritySection } from '@app/views/Settings/PersonalSettingsPage/SecuritySection/SecuritySection';
 
 import AddApiKeyDialog from '../../../components/basic/dialog/AddApiKeyDialog';
 import getAPIKeys from '../../api/apiKey/getAPIKeys';
 import getUser from '../../api/user/getUser';
 
+type Errors = {
+  length?: string,
+  upperCase?: string,
+  lowerCase?: string,
+  number?: string,
+  specialChar?: string,
+  repeatedChar?: string,
+};
+
 export default function PersonalSettings() {
+  const { data: commonPasswords } = useGetCommonPasswords();
   const [personalEmail, setPersonalEmail] = useState('');
   const [personalName, setPersonalName] = useState('');
-  const [passwordErrorLength, setPasswordErrorLength] = useState(false);
-  const [passwordErrorNumber, setPasswordErrorNumber] = useState(false);
-  const [passwordErrorLowerCase, setPasswordErrorLowerCase] = useState(false);
   const [currentPasswordError, setCurrentPasswordError] = useState(false);
   const [currentPassword, setCurrentPassword] = useState('');
   const [newPassword, setNewPassword] = useState('');
@@ -34,6 +44,9 @@ export default function PersonalSettings() {
   const [backupKeyError, setBackupKeyError] = useState(false);
   const [isAddApiKeyDialogOpen, setIsAddApiKeyDialogOpen] = useState(false);
   const [apiKeys, setApiKeys] = useState<any[]>([]);
+  const [errors, setErrors] = useState<Errors>({});
+  
+  const revokeAllSessions = useRevokeAllSessions();
 
   const { t, i18n } = useTranslation();
   const router = useRouter();
@@ -154,78 +167,54 @@ export default function PersonalSettings() {
                   label={t('section.password.new') as string}
                   onChangeHandler={(password) => {
                     setNewPassword(password);
-                    passwordCheck({
+                    checkPassword({
                       password,
-                      setPasswordErrorLength,
-                      setPasswordErrorNumber,
-                      setPasswordErrorLowerCase,
-                      errorCheck: false
+                      commonPasswords,
+                      setErrors
                     });
                   }}
                   type="password"
                   value={newPassword}
                   isRequired
-                  error={passwordErrorLength && passwordErrorLowerCase && passwordErrorNumber}
+                  error={Object.keys(errors).length > 0}
                   autoComplete="new-password"
                   id="new-password"
                 />
               </div>
-              {passwordErrorLength || passwordErrorLowerCase || passwordErrorNumber ? (
-                <div className="mt-3 mb-2 flex w-full max-w-xl flex-col items-start rounded-md bg-white/5 px-2 py-2">
-                  <div className="mb-1 text-sm text-gray-400">
-                    {t('section.password.validate-base')}
-                  </div>
-                  <div className="ml-1 flex flex-row items-center justify-start">
-                    {passwordErrorLength ? (
-                      <FontAwesomeIcon icon={faX} className="text-md mr-2.5 text-red" />
-                    ) : (
-                      <FontAwesomeIcon icon={faCheck} className="text-md mr-2 text-primary" />
-                    )}
-                    <div
-                      className={`${
-                        passwordErrorLength ? 'text-gray-400' : 'text-gray-600'
-                      } text-sm`}
-                    >
-                      {t('section.password.validate-length')}
-                    </div>
-                  </div>
-                  <div className="ml-1 flex flex-row items-center justify-start">
-                    {passwordErrorLowerCase ? (
-                      <FontAwesomeIcon icon={faX} className="text-md mr-2.5 text-red" />
-                    ) : (
-                      <FontAwesomeIcon icon={faCheck} className="text-md mr-2 text-primary" />
-                    )}
-                    <div
-                      className={`${
-                        passwordErrorLowerCase ? 'text-gray-400' : 'text-gray-600'
-                      } text-sm`}
-                    >
-                      {t('section.password.validate-case')}
-                    </div>
-                  </div>
-                  <div className="ml-1 flex flex-row items-center justify-start">
-                    {passwordErrorNumber ? (
-                      <FontAwesomeIcon icon={faX} className="text-md mr-2.5 text-red" />
-                    ) : (
-                      <FontAwesomeIcon icon={faCheck} className="text-md mr-2 text-primary" />
-                    )}
-                    <div
-                      className={`${
-                        passwordErrorNumber ? 'text-gray-400' : 'text-gray-600'
-                      } text-sm`}
-                    >
-                      {t('section.password.validate-number')}
-                    </div>
-                  </div>
+              {Object.keys(errors).length > 0 && (
+                <div className="mt-4 flex w-full flex-col items-start rounded-md bg-white/5 px-2 py-2">
+                  <div className="mb-2 text-sm text-gray-400">{t('section.password.validate-base')}</div> 
+                  {Object.keys(errors).map((key) => {
+                    if (errors[key as keyof Errors]) {
+                      return (
+                        <div className="ml-1 flex flex-row items-top justify-start" key={key}>
+                          <div>
+                            <FontAwesomeIcon 
+                              icon={faXmark} 
+                              className="text-md text-red ml-0.5 mr-2.5"
+                            />
+                          </div>
+                          <p className="text-gray-400 text-sm">
+                            {errors[key as keyof Errors]} 
+                          </p>
+                        </div>
+                      );
+                    }
+
+                    return null;
+                  })}
                 </div>
-              ) : (
-                <div className="py-2" />
               )}
               <div className="mt-3 flex w-52 flex-row items-center pr-3">
                 <Button
                   text={t('section.password.change') as string}
                   onButtonPressed={() => {
-                    if (!passwordErrorLength && !passwordErrorLowerCase && !passwordErrorNumber) {
+                    const errorCheck = checkPassword({
+                      password: newPassword,
+                      commonPasswords,
+                      setErrors
+                    });
+                    if (!errorCheck) {
                       changePassword(
                         personalEmail,
                         currentPassword,
@@ -239,11 +228,6 @@ export default function PersonalSettings() {
                   }}
                   color="mineshaft"
                   size="md"
-                  active={
-                    newPassword !== '' &&
-                    currentPassword !== '' &&
-                    !(passwordErrorLength || passwordErrorLowerCase || passwordErrorNumber)
-                  }
                   textDisabled={t('section.password.change') as string}
                 />
                 <FontAwesomeIcon
@@ -254,6 +238,28 @@ export default function PersonalSettings() {
                 />
               </div>
             </div>
+            <div className="mb-6 mt-2 flex w-full flex-col items-start rounded-md bg-white/5 px-6 pb-6 pt-2">
+              <div className="my-4 flex w-full flex-row justify-between">
+                <p className="text-xl font-semibold w-full">
+                  Sessions
+                </p>
+                <div className="w-40">
+                  <Button
+                    text="Revoke all"
+                    onButtonPressed={async () => {
+                      await revokeAllSessions.mutateAsync();
+                      router.push('/login');
+                    }}
+                    color="mineshaft"
+                    icon={faBan}
+                    size="md"
+                    />
+                </div>
+              </div>
+              <p className="mb-5 text-sm text-mineshaft-300">
+                Logging into Infisical via browser or CLI creates a session. Revoking all sessions logs your account out all active sessions across all browsers and CLIs.
+              </p> 
+            </div>
 
             <div className="mt-2 mb-6 flex w-full flex-col items-start rounded-md bg-white/5 px-6 pt-5 pb-6">
               <div className="flex w-full max-w-5xl flex-row items-center justify-between">

frontend/src/pages/signupinvite.tsx

@@ -7,7 +7,7 @@ import Head from 'next/head';
 import Image from 'next/image';
 import Link from 'next/link';
 import { useRouter } from 'next/router';
-import { faCheck, faWarning, faX } from '@fortawesome/free-solid-svg-icons';
+import { faCheck, faWarning, faXmark } from '@fortawesome/free-solid-svg-icons';
 import { FontAwesomeIcon } from '@fortawesome/react-fontawesome';
 import jsrp from 'jsrp';
 import queryString from 'query-string';
@@ -17,7 +17,9 @@ import { encodeBase64 } from 'tweetnacl-util';
 import Button from '@app/components/basic/buttons/Button';
 import InputField from '@app/components/basic/InputField';
 import attemptLogin from '@app/components/utilities/attemptLogin';
-import passwordCheck from '@app/components/utilities/checks/PasswordCheck';
+
+import checkPassword from '@app/components/utilities/checks/checkPassword';
+
 import Aes256Gcm from '@app/components/utilities/cryptography/aes-256-gcm';
 import { deriveArgonKey } from '@app/components/utilities/cryptography/crypto';
 import issueBackupKey from '@app/components/utilities/cryptography/issueBackupKey';
@@ -25,28 +27,36 @@ import { saveTokenToLocalStorage } from '@app/components/utilities/saveTokenToLo
 import SecurityClient from '@app/components/utilities/SecurityClient';
 import getOrganizations from '@app/pages/api/organization/getOrgs';
 import getOrganizationUserProjects from '@app/pages/api/organization/GetOrgUserProjects';
-
+import {
+  useGetCommonPasswords
+} from '@app/hooks/api';
 import completeAccountInformationSignupInvite from './api/auth/CompleteAccountInformationSignupInvite';
 import verifySignupInvite from './api/auth/VerifySignupInvite';
 
 // eslint-disable-next-line new-cap
 const client = new jsrp.client();
 
+type Errors = {
+  length?: string,
+  upperCase?: string,
+  lowerCase?: string,
+  number?: string,
+  specialChar?: string,
+  repeatedChar?: string,
+};
+
 export default function SignupInvite() {
+  const { data: commonPasswords } = useGetCommonPasswords();
   const [password, setPassword] = useState('');
   const [firstName, setFirstName] = useState('');
   const [lastName, setLastName] = useState('');
   const [firstNameError, setFirstNameError] = useState(false);
   const [lastNameError, setLastNameError] = useState(false);
-  const [passwordErrorLength, setPasswordErrorLength] = useState(false);
-  const [passwordErrorNumber, setPasswordErrorNumber] = useState(false);
-  const [passwordErrorLowerCase, setPasswordErrorLowerCase] = useState(false);
-  const [errorLogin, setErrorLogin] = useState(false);
   const [isLoading, setIsLoading] = useState(false);
   const [step, setStep] = useState(1);
   const [backupKeyError, setBackupKeyError] = useState(false);
-  const [verificationToken, setVerificationToken] = useState('');
   const [backupKeyIssued, setBackupKeyIssued] = useState(false);
+  const [errors, setErrors] = useState<Errors>({});
 
   const router = useRouter();
   const parsedUrl = queryString.parse(router.asPath.split('?')[1]);
@@ -70,12 +80,11 @@ export default function SignupInvite() {
     } else {
       setLastNameError(false);
     }
-    errorCheck = passwordCheck({
+  
+    errorCheck = checkPassword({
       password,
-      setPasswordErrorLength,
-      setPasswordErrorNumber,
-      setPasswordErrorLowerCase,
-      errorCheck
+      commonPasswords,
+      setErrors
     });
 
     if (!errorCheck) {
@@ -252,60 +261,43 @@ export default function SignupInvite() {
           label="Password"
           onChangeHandler={(pass) => {
             setPassword(pass);
-            passwordCheck({
+            checkPassword({
               password: pass,
-              setPasswordErrorLength,
-              setPasswordErrorNumber,
-              setPasswordErrorLowerCase,
-              errorCheck: false
+              commonPasswords,
+              setErrors
             });
           }}
           type="password"
           value={password}
           isRequired
-          error={passwordErrorLength && passwordErrorNumber && passwordErrorLowerCase}
+          error={Object.keys(errors).length > 0}
           autoComplete="new-password"
           id="new-password"
         />
-        {passwordErrorLength || passwordErrorLowerCase || passwordErrorNumber ? (
-          <div className="w-full mt-4 bg-white/5 px-2 flex flex-col items-start py-2 rounded-md">
-            <div className="text-gray-400 text-sm mb-1">Password should contain at least:</div>
-            <div className="flex flex-row justify-start items-center ml-1">
-              {passwordErrorLength ? (
-                <FontAwesomeIcon icon={faX} className="text-md text-red mr-2.5" />
-              ) : (
-                <FontAwesomeIcon icon={faCheck} className="text-md text-primary mr-2" />
-              )}
-              <div className={`${passwordErrorLength ? 'text-gray-400' : 'text-gray-600'} text-sm`}>
-                14 characters
-              </div>
+        {Object.keys(errors).length > 0 && (
+            <div className="mt-4 flex w-full flex-col items-start rounded-md bg-white/5 px-2 py-2">
+              <div className="mb-2 text-sm text-gray-400">Password should contain at least:</div> 
+              {Object.keys(errors).map((key) => {
+                if (errors[key as keyof Errors]) {
+                  return (
+                    <div className="ml-1 flex flex-row items-top justify-start" key={key}>
+                      <div>
+                        <FontAwesomeIcon 
+                          icon={faXmark} 
+                          className="text-md text-red ml-0.5 mr-2.5"
+                        />
+                      </div>
+                      <p className="text-gray-400 text-sm">
+                        {errors[key as keyof Errors]} 
+                      </p>
+                    </div>
+                  );
+                }
+
+                return null;
+              })}
             </div>
-            <div className="flex flex-row justify-start items-center ml-1">
-              {passwordErrorLowerCase ? (
-                <FontAwesomeIcon icon={faX} className="text-md text-red mr-2.5" />
-              ) : (
-                <FontAwesomeIcon icon={faCheck} className="text-md text-primary mr-2" />
-              )}
-              <div
-                className={`${passwordErrorLowerCase ? 'text-gray-400' : 'text-gray-600'} text-sm`}
-              >
-                1 lowercase character
-              </div>
-            </div>
-            <div className="flex flex-row justify-start items-center ml-1">
-              {passwordErrorNumber ? (
-                <FontAwesomeIcon icon={faX} className="text-md text-red mr-2.5" />
-              ) : (
-                <FontAwesomeIcon icon={faCheck} className="text-md text-primary mr-2" />
-              )}
-              <div className={`${passwordErrorNumber ? 'text-gray-400' : 'text-gray-600'} text-sm`}>
-                1 number
-              </div>
-            </div>
-          </div>
-        ) : (
-          <div className="py-2" />
-        )}
+          )}
       </div>
       <div className="flex flex-col items-center justify-center md:px-4 md:py-5 mt-2 px-2 py-3 max-h-24 max-w-max mx-auto text-lg">
         <Button

frontend/src/views/DashboardPage/DashboardPage.tsx

@@ -717,9 +717,9 @@ export const DashboardPage = ({ envFromTop }: { envFromTop: string }) => {
                 isLoading={isSubmitting}
                 leftIcon={<FontAwesomeIcon icon={isRollbackMode ? faClockRotateLeft : faCheck} />}
                 onClick={handleSubmit(onSaveSecret)}
-                className="h-10"
+                className="h-10 text-black"
                 color="primary"
-                variant="star"
+                variant="solid"
               >
                 {isRollbackMode ? 'Rollback' : 'Save Changes'}
               </Button>