fix: backend/package.json & backend/package-lock.json to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ZOD-5925617

.dockerignore

@@ -1,10 +1,2 @@
 backend/node_modules
-frontend/node_modules
-backend/frontend-build
-**/node_modules
-**/.next
-.dockerignore
-.git
-README.md
-.dockerignore
-**/Dockerfile
+frontend/node_modules

.env.example

@@ -1,12 +1,23 @@
 # Keys
 # Required key for platform encryption/decryption ops
-# THIS IS A SAMPLE ENCRYPTION KEY AND SHOULD NEVER BE USED FOR PRODUCTION
+# THIS IS A SAMPLE ENCRYPTION KEY AND SHOULD NOT BE USED FOR PRODUCTION
 ENCRYPTION_KEY=6c1fe4e407b8911c104518103505b218
 
 # JWT
 # Required secrets to sign JWT tokens
-# THIS IS A SAMPLE AUTH_SECRET KEY AND SHOULD NEVER BE USED FOR PRODUCTION
-AUTH_SECRET=5lrMXKKWCVocS/uerPsl7V+TX/aaUaI7iDkgl3tSmLE=
+JWT_SIGNUP_SECRET=3679e04ca949f914c03332aaaeba805a
+JWT_REFRESH_SECRET=5f2f3c8f0159068dc2bbb3a652a716ff
+JWT_AUTH_SECRET=4be6ba5602e0fa0ac6ac05c3cd4d247f
+JWT_SERVICE_SECRET=f32f716d70a42c5703f4656015e76200
+JWT_PROVIDER_AUTH_SECRET=f32f716d70a42c5703f4656015e76201
+
+# JWT lifetime
+# Optional lifetimes for JWT tokens expressed in seconds or a string 
+# describing a time span (e.g. 60, "2 days", "10h", "7d")
+JWT_AUTH_LIFETIME=
+JWT_REFRESH_LIFETIME=
+JWT_SIGNUP_LIFETIME=
+JWT_PROVIDER_AUTH_LIFETIME=
 
 # MongoDB
 # Backend will connect to the MongoDB instance at connection string MONGO_URL which can either be a ref
@@ -56,12 +67,5 @@ SENTRY_DSN=
 POSTHOG_HOST=
 POSTHOG_PROJECT_API_KEY=
 
-# SSO-specific variables
-CLIENT_ID_GOOGLE_LOGIN=
-CLIENT_SECRET_GOOGLE_LOGIN=
-
-CLIENT_ID_GITHUB_LOGIN=
-CLIENT_SECRET_GITHUB_LOGIN=
-
-CLIENT_ID_GITLAB_LOGIN=
-CLIENT_SECRET_GITLAB_LOGIN=
+CLIENT_ID_GOOGLE=
+CLIENT_SECRET_GOOGLE=

.github/resources/docker-compose.be-test.yml

@@ -6,7 +6,7 @@ services:
     restart: unless-stopped
     depends_on:
       - mongo
-    image: infisical/infisical:test
+    image: infisical/backend:test
     command: npm run start
     environment:
       - NODE_ENV=production

.github/values.yaml

@@ -1,3 +1,29 @@
+# secretScanningGitApp:
+#   enabled: false
+#   deploymentAnnotations:
+#     secrets.infisical.com/auto-reload: "true"
+#   image:
+#     repository: infisical/staging_deployment_secret-scanning-git-app
+    
+frontend:
+  enabled: true
+  name: frontend
+  podAnnotations: {}
+  deploymentAnnotations:
+    secrets.infisical.com/auto-reload: "true"
+  replicaCount: 2
+  image:
+    repository: infisical/staging_deployment_frontend
+    tag: "latest"
+    pullPolicy: Always
+  kubeSecretRef: managed-secret-frontend
+  service:
+    annotations: {}
+    type: ClusterIP
+    nodePort: ""
+
+frontendEnvironmentVariables: null
+
 backend:
   enabled: true
   name: backend
@@ -6,7 +32,7 @@ backend:
     secrets.infisical.com/auto-reload: "true"
   replicaCount: 2
   image:
-    repository: infisical/staging_infisical
+    repository: infisical/staging_deployment_backend
     tag: "latest"
     pullPolicy: Always
   kubeSecretRef: managed-backend-secret
@@ -14,15 +40,12 @@ backend:
     annotations: {}
     type: ClusterIP
     nodePort: ""
-  resources:
-    limits:
-      memory: 300Mi
 
 backendEnvironmentVariables: null
 
 ## Mongo DB persistence
 mongodb:
-  enabled: false
+  enabled: true
   persistence:
     enabled: false
 
@@ -37,8 +60,14 @@ ingress:
   enabled: true
   # annotations:
   #   kubernetes.io/ingress.class: "nginx"
-  # cert-manager.io/issuer: letsencrypt-nginx
+    # cert-manager.io/issuer: letsencrypt-nginx
   hostName: gamma.infisical.com ## <- Replace with your own domain
+  frontend:
+    path: /
+    pathType: Prefix
+  backend:
+    path: /api
+    pathType: Prefix
   tls:
     []
     # - secretName: letsencrypt-nginx

.github/workflows/build-docker-image-to-prod.yml

@@ -39,7 +39,7 @@ jobs:
           token: ${{ secrets.DEPOT_PROJECT_TOKEN }}
           load: true
           context: backend
-          tags: infisical/infisical:test
+          tags: infisical/backend:test
       - name: ⏻ Spawn backend container and dependencies
         run: |
           docker compose -f .github/resources/docker-compose.be-test.yml up --wait --quiet-pull
@@ -93,7 +93,6 @@ jobs:
           tags: infisical/frontend:test
           build-args: |
             POSTHOG_API_KEY=${{ secrets.PUBLIC_POSTHOG_API_KEY }}
-            NEXT_INFISICAL_PLATFORM_VERSION=${{ steps.extract_version.outputs.version }}
       - name: ⏻ Spawn frontend container
         run: |
           docker run -d --rm --name infisical-frontend-test infisical/frontend:test
@@ -117,4 +116,3 @@ jobs:
           platforms: linux/amd64,linux/arm64
           build-args: |
             POSTHOG_API_KEY=${{ secrets.PUBLIC_POSTHOG_API_KEY }}
-            NEXT_INFISICAL_PLATFORM_VERSION=${{ steps.extract_version.outputs.version }}

.github/workflows/build-staging-img.yml

@@ -2,7 +2,7 @@ name: Build, Publish and Deploy to Gamma
 on: [workflow_dispatch]
 
 jobs:
-  infisical-image:
+  backend-image:
     name: Build backend image
     runs-on: ubuntu-latest
     steps:
@@ -32,9 +32,8 @@ jobs:
           project: 64mmf0n610
           token: ${{ secrets.DEPOT_PROJECT_TOKEN }}
           load: true
-          context: .
-          file: Dockerfile.standalone-infisical
-          tags: infisical/infisical:test
+          context: backend
+          tags: infisical/backend:test
       - name: ⏻ Spawn backend container and dependencies
         run: |
           docker compose -f .github/resources/docker-compose.be-test.yml up --wait --quiet-pull
@@ -50,20 +49,66 @@ jobs:
           project: 64mmf0n610
           token: ${{ secrets.DEPOT_PROJECT_TOKEN }}
           push: true
-          context: .
-          file: Dockerfile.standalone-infisical
+          context: backend
           tags: |
-            infisical/staging_infisical:${{ steps.commit.outputs.short }}
-            infisical/staging_infisical:latest
+            infisical/staging_deployment_backend:${{ steps.commit.outputs.short }}
+            infisical/staging_deployment_backend:latest
+          platforms: linux/amd64,linux/arm64
+
+  frontend-image:
+    name: Build frontend image
+    runs-on: ubuntu-latest
+    steps:
+      - name: ☁️ Checkout source
+        uses: actions/checkout@v3
+      - name: Save commit hashes for tag
+        id: commit
+        uses: pr-mpt/actions-commit-hash@v2
+      - name: 🔧 Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+      - name: 🐋 Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Set up Depot CLI
+        uses: depot/setup-action@v1
+      - name: 📦 Build frontend and export to Docker
+        uses: depot/build-push-action@v1
+        with:
+          load: true
+          token: ${{ secrets.DEPOT_PROJECT_TOKEN }}
+          project: 64mmf0n610
+          context: frontend
+          tags: infisical/staging_deployment_frontend:test
+          build-args: |
+            POSTHOG_API_KEY=${{ secrets.PUBLIC_POSTHOG_API_KEY }}
+      - name: ⏻ Spawn frontend container
+        run: |
+          docker run -d --rm --name infisical-frontend-test infisical/staging_deployment_frontend:test
+      - name: 🧪 Test frontend image
+        run: |
+          ./.github/resources/healthcheck.sh infisical-frontend-test
+      - name: ⏻ Shut down frontend container
+        run: |
+          docker stop infisical-frontend-test
+      - name: 🏗️ Build frontend and push
+        uses: depot/build-push-action@v1
+        with:
+          project: 64mmf0n610
+          push: true
+          token: ${{ secrets.DEPOT_PROJECT_TOKEN }}
+          context: frontend
+          tags: |
+            infisical/staging_deployment_frontend:${{ steps.commit.outputs.short }}
+            infisical/staging_deployment_frontend:latest
           platforms: linux/amd64,linux/arm64
           build-args: |
             POSTHOG_API_KEY=${{ secrets.PUBLIC_POSTHOG_API_KEY }}
-            INFISICAL_PLATFORM_VERSION=${{ steps.extract_version.outputs.version }}
-
   gamma-deployment:
     name: Deploy to gamma
     runs-on: ubuntu-latest
-    needs: [infisical-image]
+    needs: [frontend-image, backend-image]
     steps:
       - name: ☁️ Checkout source
         uses: actions/checkout@v3

.github/workflows/release-standalone-docker-img.yml

@@ -73,6 +73,3 @@ jobs:
             infisical/infisical:${{ steps.extract_version.outputs.version }}
           platforms: linux/amd64,linux/arm64
           file: Dockerfile.standalone-infisical
-          build-args: |
-            POSTHOG_API_KEY=${{ secrets.PUBLIC_POSTHOG_API_KEY }}
-            INFISICAL_PLATFORM_VERSION=${{ steps.extract_version.outputs.version }}

.gitignore

@@ -33,7 +33,7 @@ reports
 junit.xml
 
 # next.js
-.next/
+/.next/
 /out/
 
 # production
@@ -59,6 +59,4 @@ yarn-error.log*
 .infisical.json
 
 # Editor specific
-.vscode/*
-
-frontend-build
+.vscode/*

Dockerfile.standalone-infisical

@@ -1,13 +1,7 @@
 ARG POSTHOG_HOST=https://app.posthog.com
 ARG POSTHOG_API_KEY=posthog-api-key
-ARG INTERCOM_ID=intercom-id
 
-FROM  node:16-alpine AS base
-
-FROM base AS frontend-dependencies
-
-# Check https://github.com/nodejs/docker-node/tree/b4117f9333da4138b03a546ec926ef50a31506c3#nodealpine to understand why libc6-compat might be needed.
-RUN apk add --no-cache libc6-compat
+FROM node:16-alpine AS frontend-dependencies
 
 WORKDIR /app
 
@@ -17,7 +11,7 @@ COPY frontend/package.json frontend/package-lock.json frontend/next.config.js ./
 RUN npm ci --only-production --ignore-scripts
 
 # Rebuild the source code only when needed
-FROM base AS frontend-builder
+FROM node:16-alpine AS frontend-builder
 WORKDIR /app
 
 # Copy dependencies
@@ -33,38 +27,41 @@ ARG POSTHOG_API_KEY
 ENV NEXT_PUBLIC_POSTHOG_API_KEY $POSTHOG_API_KEY
 ARG INTERCOM_ID
 ENV NEXT_PUBLIC_INTERCOM_ID $INTERCOM_ID
-ARG INFISICAL_PLATFORM_VERSION
-ENV NEXT_PUBLIC_INFISICAL_PLATFORM_VERSION $INFISICAL_PLATFORM_VERSION
 
 # Build
 RUN npm run build
 
 # Production image
-FROM base AS frontend-runner
+FROM node:16-alpine AS frontend-runner
 WORKDIR /app
 
 RUN addgroup --system --gid 1001 nodejs
-RUN adduser --system --uid 1001 non-root-user
+RUN adduser --system --uid 1001 nextjs
 
-RUN mkdir -p /app/.next/cache/images && chown non-root-user:nodejs /app/.next/cache/images
+RUN mkdir -p /app/.next/cache/images && chown nextjs:nodejs /app/.next/cache/images
 VOLUME /app/.next/cache/images
 
-COPY --chown=non-root-user:nodejs --chmod=555 frontend/scripts ./scripts
-COPY --from=frontend-builder /app/public ./public
-RUN chown non-root-user:nodejs ./public/data
-COPY --from=frontend-builder --chown=non-root-user:nodejs /app/.next/standalone ./
-COPY --from=frontend-builder --chown=non-root-user:nodejs /app/.next/static ./.next/static
+ARG POSTHOG_API_KEY
+ENV NEXT_PUBLIC_POSTHOG_API_KEY=$POSTHOG_API_KEY \
+  BAKED_NEXT_PUBLIC_POSTHOG_API_KEY=$POSTHOG_API_KEY
+ARG INTERCOM_ID
+ENV NEXT_PUBLIC_INTERCOM_ID=$INTERCOM_ID \
+  BAKED_NEXT_PUBLIC_INTERCOM_ID=$INTERCOM_ID
 
-USER non-root-user
+COPY --chown=nextjs:nodejs --chmod=555 frontend/scripts ./scripts
+COPY --from=frontend-builder /app/public ./public
+RUN chown nextjs:nodejs ./public/data
+COPY --from=frontend-builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=frontend-builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+
+USER nextjs
 
 ENV NEXT_TELEMETRY_DISABLED 1
 
 ##
 ## BACKEND
 ##
-FROM base AS backend-build
-RUN addgroup --system --gid 1001 nodejs \
-  && adduser --system --uid 1001 non-root-user
+FROM node:16-alpine AS backend-build
 
 WORKDIR /app
 
@@ -72,11 +69,10 @@ COPY backend/package*.json ./
 RUN npm ci --only-production
 
 COPY /backend .
-COPY --chown=non-root-user:nodejs standalone-entrypoint.sh standalone-entrypoint.sh
 RUN npm run build
 
 # Production stage
-FROM base AS backend-runner
+FROM node:16-alpine AS backend-runner
 
 WORKDIR /app
 
@@ -85,44 +81,27 @@ RUN npm ci --only-production
 
 COPY --from=backend-build /app .
 
-RUN mkdir frontend-build
-
 # Production stage
-FROM base AS production
-RUN addgroup --system --gid 1001 nodejs \
-  && adduser --system --uid 1001 non-root-user
-
-## set pre baked keys
-ARG POSTHOG_API_KEY
-ENV NEXT_PUBLIC_POSTHOG_API_KEY=$POSTHOG_API_KEY \
-  BAKED_NEXT_PUBLIC_POSTHOG_API_KEY=$POSTHOG_API_KEY
-ARG INTERCOM_ID=intercom-id
-ENV NEXT_PUBLIC_INTERCOM_ID=$INTERCOM_ID \
-  BAKED_NEXT_PUBLIC_INTERCOM_ID=$INTERCOM_ID
+FROM node:16-alpine AS production
 
 WORKDIR / 
 
+# Install PM2
+RUN npm install -g pm2
+# Copy ecosystem.config.js
+COPY ecosystem.config.js .
+
+RUN apk add --no-cache nginx
+
+COPY nginx/default-stand-alone-docker.conf /etc/nginx/nginx.conf
+
 COPY --from=backend-runner /app /backend
 
-COPY --from=frontend-runner /app ./backend/frontend-build
+COPY --from=frontend-runner /app/ /app/
 
-ENV PORT 8080
+EXPOSE 80
 ENV HTTPS_ENABLED false 
-ENV NODE_ENV production
-ENV STANDALONE_BUILD true 
-
-WORKDIR /backend
-
-ENV TELEMETRY_ENABLED true
-
-HEALTHCHECK --interval=10s --timeout=3s --start-period=10s \  
-  CMD node healthcheck.js
-
-EXPOSE 8080
-
-USER non-root-user
-
-CMD ["./standalone-entrypoint.sh"]
 
+CMD ["pm2-runtime", "start", "ecosystem.config.js"]
 
 

README.md

@@ -1,8 +1,9 @@
 <h1 align="center">
+  <img width="300" src="/img/logoname-black.svg#gh-light-mode-only" alt="infisical">
   <img width="300" src="/img/logoname-white.svg#gh-dark-mode-only" alt="infisical">
 </h1>
 <p align="center">
-  <p align="center"><b>The open-source secret management platform</b>: Sync secrets/configs across your team/infrastructure and prevent secret leaks.</p>
+  <p align="center"><b>Open-source, end-to-end encrypted secret management platform</b>: distribute secrets/configs across your team/infrastructure and prevent secret leaks.</p>
 </p>
 
 <h4 align="center">
@@ -33,7 +34,7 @@
     <img src="https://img.shields.io/github/commit-activity/m/infisical/infisical" alt="git commit activity" />
   </a>
   <a href="https://cloudsmith.io/~infisical/repos/">
-    <img src="https://img.shields.io/badge/Downloads-2.58M-orange" alt="Cloudsmith downloads" />
+    <img src="https://img.shields.io/badge/Downloads-1.38M-orange" alt="Cloudsmith downloads" />
   </a>
   <a href="https://infisical.com/slack">
     <img src="https://img.shields.io/badge/chat-on%20Slack-blueviolet" alt="Slack community channel" />
@@ -43,11 +44,11 @@
   </a>
 </h4>
 
-<img src="/img/infisical_github_repo2.png" width="100%" alt="Dashboard" />
+<img src="/img/infisical_github_repo.png" width="100%" alt="Dashboard" />
 
 ## Introduction
 
-**[Infisical](https://infisical.com)** is the open source secret management platform that teams use to centralize their secrets like API keys, database credentials, and configurations.
+**[Infisical](https://infisical.com)** is an open source, end-to-end encrypted secret management platform that teams use to centralize their secrets like API keys, database credentials, and configurations.
 
 We're on a mission to make secret management more accessible to everyone, not just security teams, and that means redesigning the entire developer experience from ground up.
 
@@ -133,6 +134,7 @@ Whether it's big or small, we love contributions. Check out our guide to see how
 
 Not sure where to get started? You can:
 
+- [Book a free, non-pressure pairing session / code walkthrough with one of our teammates](https://cal.com/tony-infisical/30-min-meeting-contributing)!
 - Join our <a href="https://infisical.com/slack">Slack</a>, and ask us any questions there.
 - Join our [community calls](https://us06web.zoom.us/j/82623506356) every Wednesday at 11am EST to ask any questions, provide feedback, hangout and more.
 

backend/.eslintrc

@@ -26,7 +26,6 @@
     ],
     "@typescript-eslint/no-unused-vars": "off",
     "unused-imports/no-unused-imports": "error",
-    "@typescript-eslint/no-extra-semi": "off", // added to be able to push
     "unused-imports/no-unused-vars": [
       "warn",
       {

backend/package.json

@@ -6,13 +6,11 @@
     "@godaddy/terminus": "^4.12.0",
     "@node-saml/passport-saml": "^4.0.4",
     "@octokit/rest": "^19.0.5",
-    "@sentry/node": "^7.77.0",
+    "@sentry/node": "^7.49.0",
     "@sentry/tracing": "^7.48.0",
-    "@serdnam/pino-cloudwatch-transport": "^1.0.4",
     "@types/crypto-js": "^4.1.1",
     "@types/libsodium-wrappers": "^0.7.10",
     "@ucast/mongo2js": "^1.3.4",
-    "ajv": "^8.12.0",
     "argon2": "^0.30.3",
     "aws-sdk": "^2.1364.0",
     "axios": "^1.3.5",
@@ -21,7 +19,7 @@
     "bigint-conversion": "^2.4.0",
     "cookie-parser": "^1.4.6",
     "cors": "^2.8.5",
-    "crypto-js": "^4.2.0",
+    "crypto-js": "^4.1.1",
     "dotenv": "^16.0.1",
     "express": "^4.18.1",
     "express-async-errors": "^3.1.1",
@@ -31,25 +29,19 @@
     "helmet": "^5.1.1",
     "infisical-node": "^1.2.1",
     "ioredis": "^5.3.2",
-    "jmespath": "^0.16.0",
     "js-yaml": "^4.1.0",
     "jsonwebtoken": "^9.0.0",
     "jsrp": "^0.2.4",
     "libsodium-wrappers": "^0.7.10",
     "lodash": "^4.17.21",
+    "mongodb": "^5.7.0",
     "mongoose": "^7.4.1",
-    "mysql2": "^3.6.2",
     "nanoid": "^3.3.6",
     "node-cache": "^5.1.2",
     "nodemailer": "^6.8.0",
-    "ora": "^5.4.1",
     "passport": "^0.6.0",
     "passport-github": "^1.1.0",
-    "passport-gitlab2": "^5.0.0",
     "passport-google-oauth20": "^2.0.0",
-    "pg": "^8.11.3",
-    "pino": "^8.16.1",
-    "pino-http": "^8.5.1",
     "posthog-node": "^2.6.0",
     "probot": "^12.3.1",
     "query-string": "^7.1.3",
@@ -60,19 +52,16 @@
     "tweetnacl-util": "^0.15.1",
     "typescript": "^4.9.3",
     "utility-types": "^3.10.0",
+    "winston": "^3.8.2",
+    "winston-loki": "^6.0.6",
     "zod": "^3.22.3"
   },
-  "overrides": {
-    "rate-limit-mongo": {
-      "mongodb": "5.8.0"
-    }
-  },
   "name": "infisical-api",
   "version": "1.0.0",
   "main": "src/index.js",
   "scripts": {
     "start": "node build/index.js",
-    "dev": "nodemon index.js",
+    "dev": "nodemon",
     "swagger-autogen": "node ./swagger/index.ts",
     "build": "rimraf ./build && tsc && cp -R ./src/templates ./build && cp -R ./src/data ./build",
     "lint": "eslint . --ext .ts",
@@ -97,8 +86,6 @@
   "devDependencies": {
     "@jest/globals": "^29.3.1",
     "@posthog/plugin-scaffold": "^1.3.4",
-    "@swc/core": "^1.3.99",
-    "@swc/helpers": "^0.5.3",
     "@types/bcrypt": "^5.0.0",
     "@types/bcryptjs": "^2.4.2",
     "@types/bull": "^4.10.0",
@@ -106,15 +93,12 @@
     "@types/cors": "^2.8.12",
     "@types/express": "^4.17.14",
     "@types/jest": "^29.5.0",
-    "@types/jmespath": "^0.15.1",
     "@types/jsonwebtoken": "^8.5.9",
     "@types/lodash": "^4.14.191",
     "@types/node": "^18.11.3",
     "@types/nodemailer": "^6.4.6",
     "@types/passport": "^1.0.12",
-    "@types/pg": "^8.10.7",
     "@types/picomatch": "^2.3.0",
-    "@types/pino": "^7.0.5",
     "@types/supertest": "^2.0.12",
     "@types/swagger-jsdoc": "^6.0.1",
     "@types/swagger-ui-express": "^4.1.3",
@@ -128,8 +112,6 @@
     "jest-junit": "^15.0.0",
     "nodemon": "^2.0.19",
     "npm": "^8.19.3",
-    "pino-pretty": "^10.2.3",
-    "regenerator-runtime": "^0.14.0",
     "smee-client": "^1.2.3",
     "supertest": "^6.3.3",
     "swagger-autogen": "^2.23.5",

backend/src/bootstrap.ts

@@ -1,43 +0,0 @@
-import ora from "ora";
-import nodemailer from "nodemailer";
-import { getSmtpHost, getSmtpPort } from "./config";
-import { logger } from "./utils/logging";
-import mongoose from "mongoose";
-import { redisClient } from "./services/RedisService";
-
-type BootstrapOpt = {
-  transporter: nodemailer.Transporter;
-};
-
-export const bootstrap = async ({ transporter }: BootstrapOpt) => {
-  const spinner = ora().start();
-  spinner.info("Checking configurations...");
-  spinner.info("Testing smtp connection");
-
-  await transporter
-    .verify()
-    .then(async () => {
-      spinner.succeed("SMTP successfully connected");
-    })
-    .catch(async (err) => {
-      spinner.fail(`SMTP - Failed to connect to ${await getSmtpHost()}:${await getSmtpPort()}`);
-      logger.error(err);
-    });
-
-  spinner.info("Testing mongodb connection");
-  if (mongoose.connection.readyState !== mongoose.ConnectionStates.connected) {
-    spinner.fail("Mongo DB - Failed to connect");
-  } else {
-    spinner.succeed("Mongodb successfully connected");
-  }
-
-  spinner.info("Testing redis connection");
-  const redisPing = await redisClient?.ping();
-  if (!redisPing) {
-    spinner.fail("Redis - Failed to connect");
-  } else {
-    spinner.succeed("Redis successfully connected");
-  }
-
-  spinner.stop();
-};

backend/src/config/index.ts

@@ -1,173 +1,100 @@
-import { GITLAB_URL } from "../variables";
-
 import InfisicalClient from "infisical-node";
 
 export const client = new InfisicalClient({
-  token: process.env.INFISICAL_TOKEN!
+  token: process.env.INFISICAL_TOKEN!,
 });
 
 export const getPort = async () => (await client.getSecret("PORT")).secretValue || 4000;
 export const getEncryptionKey = async () => {
   const secretValue = (await client.getSecret("ENCRYPTION_KEY")).secretValue;
   return secretValue === "" ? undefined : secretValue;
-};
+}
 export const getRootEncryptionKey = async () => {
   const secretValue = (await client.getSecret("ROOT_ENCRYPTION_KEY")).secretValue;
   return secretValue === "" ? undefined : secretValue;
-};
-export const getInviteOnlySignup = async () =>
-  (await client.getSecret("INVITE_ONLY_SIGNUP")).secretValue === "true";
-export const getSaltRounds = async () =>
-  parseInt((await client.getSecret("SALT_ROUNDS")).secretValue) || 10;
-export const getAuthSecret = async () =>
-  (await client.getSecret("JWT_AUTH_SECRET")).secretValue ??
-  (await client.getSecret("AUTH_SECRET")).secretValue;
-export const getJwtAuthLifetime = async () =>
-  (await client.getSecret("JWT_AUTH_LIFETIME")).secretValue || "10d";
-export const getJwtMfaLifetime = async () =>
-  (await client.getSecret("JWT_MFA_LIFETIME")).secretValue || "5m";
-export const getJwtRefreshLifetime = async () =>
-  (await client.getSecret("JWT_REFRESH_LIFETIME")).secretValue || "90d";
-export const getJwtServiceSecret = async () =>
-  (await client.getSecret("JWT_SERVICE_SECRET")).secretValue; // TODO: deprecate (related to ST V1)
-export const getJwtSignupLifetime = async () =>
-  (await client.getSecret("JWT_SIGNUP_LIFETIME")).secretValue || "15m";
-export const getJwtProviderAuthLifetime = async () =>
-  (await client.getSecret("JWT_PROVIDER_AUTH_LIFETIME")).secretValue || "15m";
+}
+export const getInviteOnlySignup = async () => (await client.getSecret("INVITE_ONLY_SIGNUP")).secretValue === "true"
+export const getSaltRounds = async () => parseInt((await client.getSecret("SALT_ROUNDS")).secretValue) || 10;
+export const getJwtAuthLifetime = async () => (await client.getSecret("JWT_AUTH_LIFETIME")).secretValue || "10d";
+export const getJwtAuthSecret = async () => (await client.getSecret("JWT_AUTH_SECRET")).secretValue;
+export const getJwtMfaLifetime = async () => (await client.getSecret("JWT_MFA_LIFETIME")).secretValue || "5m";
+export const getJwtMfaSecret = async () => (await client.getSecret("JWT_MFA_LIFETIME")).secretValue || "5m";
+export const getJwtRefreshLifetime = async () => (await client.getSecret("JWT_REFRESH_LIFETIME")).secretValue || "90d";
+export const getJwtRefreshSecret = async () => (await client.getSecret("JWT_REFRESH_SECRET")).secretValue;
+export const getJwtServiceSecret = async () => (await client.getSecret("JWT_SERVICE_SECRET")).secretValue;
+export const getJwtSignupLifetime = async () => (await client.getSecret("JWT_SIGNUP_LIFETIME")).secretValue || "15m";
+export const getJwtProviderAuthSecret = async () => (await client.getSecret("JWT_PROVIDER_AUTH_SECRET")).secretValue;
+export const getJwtProviderAuthLifetime = async () => (await client.getSecret("JWT_PROVIDER_AUTH_LIFETIME")).secretValue || "15m";
+export const getJwtSignupSecret = async () => (await client.getSecret("JWT_SIGNUP_SECRET")).secretValue;
 export const getMongoURL = async () => (await client.getSecret("MONGO_URL")).secretValue;
-export const getNodeEnv = async () =>
-  (await client.getSecret("NODE_ENV")).secretValue || "production";
-export const getVerboseErrorOutput = async () =>
-  (await client.getSecret("VERBOSE_ERROR_OUTPUT")).secretValue === "true" && true;
+export const getNodeEnv = async () => (await client.getSecret("NODE_ENV")).secretValue || "production";
+export const getVerboseErrorOutput = async () => (await client.getSecret("VERBOSE_ERROR_OUTPUT")).secretValue === "true" && true;
 export const getLokiHost = async () => (await client.getSecret("LOKI_HOST")).secretValue;
 export const getClientIdAzure = async () => (await client.getSecret("CLIENT_ID_AZURE")).secretValue;
-export const getClientIdHeroku = async () =>
-  (await client.getSecret("CLIENT_ID_HEROKU")).secretValue;
-export const getClientIdVercel = async () =>
-  (await client.getSecret("CLIENT_ID_VERCEL")).secretValue;
-export const getClientIdNetlify = async () =>
-  (await client.getSecret("CLIENT_ID_NETLIFY")).secretValue;
-export const getClientIdGitHub = async () =>
-  (await client.getSecret("CLIENT_ID_GITHUB")).secretValue;
-export const getClientIdGitLab = async () =>
-  (await client.getSecret("CLIENT_ID_GITLAB")).secretValue;
-export const getClientIdBitBucket = async () =>
-  (await client.getSecret("CLIENT_ID_BITBUCKET")).secretValue;
-export const getClientIdGCPSecretManager = async () =>
-  (await client.getSecret("CLIENT_ID_GCP_SECRET_MANAGER")).secretValue;
-export const getClientSecretAzure = async () =>
-  (await client.getSecret("CLIENT_SECRET_AZURE")).secretValue;
-export const getClientSecretHeroku = async () =>
-  (await client.getSecret("CLIENT_SECRET_HEROKU")).secretValue;
-export const getClientSecretVercel = async () =>
-  (await client.getSecret("CLIENT_SECRET_VERCEL")).secretValue;
-export const getClientSecretNetlify = async () =>
-  (await client.getSecret("CLIENT_SECRET_NETLIFY")).secretValue;
-export const getClientSecretGitHub = async () =>
-  (await client.getSecret("CLIENT_SECRET_GITHUB")).secretValue;
-export const getClientSecretGitLab = async () =>
-  (await client.getSecret("CLIENT_SECRET_GITLAB")).secretValue;
-export const getClientSecretBitBucket = async () =>
-  (await client.getSecret("CLIENT_SECRET_BITBUCKET")).secretValue;
-export const getClientSecretGCPSecretManager = async () =>
-  (await client.getSecret("CLIENT_SECRET_GCP_SECRET_MANAGER")).secretValue;
-export const getClientSlugVercel = async () =>
-  (await client.getSecret("CLIENT_SLUG_VERCEL")).secretValue;
+export const getClientIdHeroku = async () => (await client.getSecret("CLIENT_ID_HEROKU")).secretValue;
+export const getClientIdVercel = async () => (await client.getSecret("CLIENT_ID_VERCEL")).secretValue;
+export const getClientIdNetlify = async () => (await client.getSecret("CLIENT_ID_NETLIFY")).secretValue;
+export const getClientIdGitHub = async () => (await client.getSecret("CLIENT_ID_GITHUB")).secretValue;
+export const getClientIdGitLab = async () => (await client.getSecret("CLIENT_ID_GITLAB")).secretValue;
+export const getClientIdBitBucket = async () => (await client.getSecret("CLIENT_ID_BITBUCKET")).secretValue;
+export const getClientIdGCPSecretManager = async () => (await client.getSecret("CLIENT_ID_GCP_SECRET_MANAGER")).secretValue;
+export const getClientSecretAzure = async () => (await client.getSecret("CLIENT_SECRET_AZURE")).secretValue;
+export const getClientSecretHeroku = async () => (await client.getSecret("CLIENT_SECRET_HEROKU")).secretValue;
+export const getClientSecretVercel = async () => (await client.getSecret("CLIENT_SECRET_VERCEL")).secretValue;
+export const getClientSecretNetlify = async () => (await client.getSecret("CLIENT_SECRET_NETLIFY")).secretValue;
+export const getClientSecretGitHub = async () => (await client.getSecret("CLIENT_SECRET_GITHUB")).secretValue;
+export const getClientSecretGitLab = async () => (await client.getSecret("CLIENT_SECRET_GITLAB")).secretValue;
+export const getClientSecretBitBucket = async () => (await client.getSecret("CLIENT_SECRET_BITBUCKET")).secretValue;
+export const getClientSecretGCPSecretManager = async () => (await client.getSecret("CLIENT_SECRET_GCP_SECRET_MANAGER")).secretValue;
+export const getClientSlugVercel = async () => (await client.getSecret("CLIENT_SLUG_VERCEL")).secretValue;
 
-export const getClientIdGoogleLogin = async () =>
-  (await client.getSecret("CLIENT_ID_GOOGLE_LOGIN")).secretValue;
-export const getClientSecretGoogleLogin = async () =>
-  (await client.getSecret("CLIENT_SECRET_GOOGLE_LOGIN")).secretValue;
-export const getClientIdGitHubLogin = async () =>
-  (await client.getSecret("CLIENT_ID_GITHUB_LOGIN")).secretValue;
-export const getClientSecretGitHubLogin = async () =>
-  (await client.getSecret("CLIENT_SECRET_GITHUB_LOGIN")).secretValue;
-export const getClientIdGitLabLogin = async () =>
-  (await client.getSecret("CLIENT_ID_GITLAB_LOGIN")).secretValue;
-export const getClientSecretGitLabLogin = async () =>
-  (await client.getSecret("CLIENT_SECRET_GITLAB_LOGIN")).secretValue;
-export const getUrlGitLabLogin = async () =>
-  (await client.getSecret("URL_GITLAB_LOGIN")).secretValue || GITLAB_URL;
+export const getClientIdGoogleLogin = async () => (await client.getSecret("CLIENT_ID_GOOGLE_LOGIN")).secretValue;
+export const getClientSecretGoogleLogin = async () => (await client.getSecret("CLIENT_SECRET_GOOGLE_LOGIN")).secretValue;
+export const getClientIdGitHubLogin = async () => (await client.getSecret("CLIENT_ID_GITHUB_LOGIN")).secretValue;
+export const getClientSecretGitHubLogin = async () => (await client.getSecret("CLIENT_SECRET_GITHUB_LOGIN")).secretValue;
 
-export const getAwsCloudWatchLog = async () => {
-  const logGroupName =
-    (await client.getSecret("AWS_CLOUDWATCH_LOG_GROUP_NAME")).secretValue || "infisical-log-stream";
-  const region = (await client.getSecret("AWS_CLOUDWATCH_LOG_REGION")).secretValue;
-  const accessKeyId = (await client.getSecret("AWS_CLOUDWATCH_LOG_ACCESS_KEY_ID")).secretValue;
-  const accessKeySecret = (await client.getSecret("AWS_CLOUDWATCH_LOG_ACCESS_KEY_SECRET"))
-    .secretValue;
-  const interval = parseInt(
-    (await client.getSecret("AWS_CLOUDWATCH_LOG_INTERVAL")).secretValue || 1000,
-    10
-  );
-  if (!region || !accessKeyId || !accessKeySecret) return;
-  return { logGroupName, region, accessKeySecret, accessKeyId, interval };
-};
-
-export const getPostHogHost = async () =>
-  (await client.getSecret("POSTHOG_HOST")).secretValue || "https://app.posthog.com";
-export const getPostHogProjectApiKey = async () =>
-  (await client.getSecret("POSTHOG_PROJECT_API_KEY")).secretValue ||
-  "phc_nSin8j5q2zdhpFDI1ETmFNUIuTG4DwKVyIigrY10XiE";
+export const getPostHogHost = async () => (await client.getSecret("POSTHOG_HOST")).secretValue || "https://app.posthog.com";
+export const getPostHogProjectApiKey = async () => (await client.getSecret("POSTHOG_PROJECT_API_KEY")).secretValue || "phc_nSin8j5q2zdhpFDI1ETmFNUIuTG4DwKVyIigrY10XiE";
 export const getSentryDSN = async () => (await client.getSecret("SENTRY_DSN")).secretValue;
 export const getSiteURL = async () => (await client.getSecret("SITE_URL")).secretValue;
 export const getSmtpHost = async () => (await client.getSecret("SMTP_HOST")).secretValue;
-export const getSmtpSecure = async () =>
-  (await client.getSecret("SMTP_SECURE")).secretValue === "true" || false;
-export const getSmtpPort = async () =>
-  parseInt((await client.getSecret("SMTP_PORT")).secretValue) || 587;
+export const getSmtpSecure = async () => (await client.getSecret("SMTP_SECURE")).secretValue === "true" || false;
+export const getSmtpPort = async () => parseInt((await client.getSecret("SMTP_PORT")).secretValue) || 587;
 export const getSmtpUsername = async () => (await client.getSecret("SMTP_USERNAME")).secretValue;
 export const getSmtpPassword = async () => (await client.getSecret("SMTP_PASSWORD")).secretValue;
-export const getSmtpFromAddress = async () =>
-  (await client.getSecret("SMTP_FROM_ADDRESS")).secretValue;
-export const getSmtpFromName = async () =>
-  (await client.getSecret("SMTP_FROM_NAME")).secretValue || "Infisical";
+export const getSmtpFromAddress = async () => (await client.getSecret("SMTP_FROM_ADDRESS")).secretValue;
+export const getSmtpFromName = async () => (await client.getSecret("SMTP_FROM_NAME")).secretValue || "Infisical";
 
-export const getSecretScanningWebhookProxy = async () =>
-  (await client.getSecret("SECRET_SCANNING_WEBHOOK_PROXY")).secretValue;
-export const getSecretScanningWebhookSecret = async () =>
-  (await client.getSecret("SECRET_SCANNING_WEBHOOK_SECRET")).secretValue;
-export const getSecretScanningGitAppId = async () =>
-  (await client.getSecret("SECRET_SCANNING_GIT_APP_ID")).secretValue;
-export const getSecretScanningPrivateKey = async () =>
-  (await client.getSecret("SECRET_SCANNING_PRIVATE_KEY")).secretValue;
+export const getSecretScanningWebhookProxy = async () => (await client.getSecret("SECRET_SCANNING_WEBHOOK_PROXY")).secretValue;
+export const getSecretScanningWebhookSecret = async () => (await client.getSecret("SECRET_SCANNING_WEBHOOK_SECRET")).secretValue;
+export const getSecretScanningGitAppId = async () => (await client.getSecret("SECRET_SCANNING_GIT_APP_ID")).secretValue;
+export const getSecretScanningPrivateKey = async () => (await client.getSecret("SECRET_SCANNING_PRIVATE_KEY")).secretValue;
 
 export const getRedisUrl = async () => (await client.getSecret("REDIS_URL")).secretValue;
-export const getIsInfisicalCloud = async () =>
-  (await client.getSecret("INFISICAL_CLOUD")).secretValue === "true";
 
 export const getLicenseKey = async () => {
   const secretValue = (await client.getSecret("LICENSE_KEY")).secretValue;
   return secretValue === "" ? undefined : secretValue;
-};
+}
 export const getLicenseServerKey = async () => {
   const secretValue = (await client.getSecret("LICENSE_SERVER_KEY")).secretValue;
   return secretValue === "" ? undefined : secretValue;
-};
-export const getLicenseServerUrl = async () =>
-  (await client.getSecret("LICENSE_SERVER_URL")).secretValue || "https://portal.infisical.com";
+}
+export const getLicenseServerUrl = async () => (await client.getSecret("LICENSE_SERVER_URL")).secretValue || "https://portal.infisical.com";
 
-export const getTelemetryEnabled = async () =>
-  (await client.getSecret("TELEMETRY_ENABLED")).secretValue !== "false" && true;
+export const getTelemetryEnabled = async () => (await client.getSecret("TELEMETRY_ENABLED")).secretValue !== "false" && true;
 export const getLoopsApiKey = async () => (await client.getSecret("LOOPS_API_KEY")).secretValue;
-export const getSmtpConfigured = async () =>
-  (await client.getSecret("SMTP_HOST")).secretValue == "" ||
-  (await client.getSecret("SMTP_HOST")).secretValue == undefined
-    ? false
-    : true;
+export const getSmtpConfigured = async () => (await client.getSecret("SMTP_HOST")).secretValue == "" || (await client.getSecret("SMTP_HOST")).secretValue == undefined ? false : true
 export const getHttpsEnabled = async () => {
   if ((await getNodeEnv()) != "production") {
     // no https for anything other than prod
-    return false;
+    return false
   }
 
-  if (
-    (await client.getSecret("HTTPS_ENABLED")).secretValue == undefined ||
-    (await client.getSecret("HTTPS_ENABLED")).secretValue == ""
-  ) {
+  if ((await client.getSecret("HTTPS_ENABLED")).secretValue == undefined || (await client.getSecret("HTTPS_ENABLED")).secretValue == "") {
     // default when no value present
-    return true;
+    return true
   }
 
-  return (await client.getSecret("HTTPS_ENABLED")).secretValue === "true" && true;
-};
+  return (await client.getSecret("HTTPS_ENABLED")).secretValue === "true" && true
+}

backend/src/config/serverConfig.ts

@@ -1,24 +0,0 @@
-import { IServerConfig, ServerConfig } from "../models/serverConfig";
-
-let serverConfig: IServerConfig;
-
-export const serverConfigInit = async () => {
-  const cfg = await ServerConfig.findOne({});
-  if (!cfg) {
-    const cfg = new ServerConfig();
-    await cfg.save();
-    serverConfig = cfg;
-  } else {
-    serverConfig = cfg;
-  }
-  return serverConfig;
-};
-
-export const getServerConfig = () => serverConfig;
-
-export const updateServerConfig = async (data: Partial<IServerConfig>) => {
-  const cfg = await ServerConfig.findByIdAndUpdate(serverConfig._id, data, { new: true });
-  if (!cfg) throw new Error("Failed to update server config");
-  serverConfig = cfg;
-  return serverConfig;
-};

backend/src/controllers/v1/adminController.ts

@@ -1,100 +0,0 @@
-import { Request, Response } from "express";
-import { getHttpsEnabled } from "../../config";
-import { getServerConfig, updateServerConfig as setServerConfig } from "../../config/serverConfig";
-import { initializeDefaultOrg, issueAuthTokens } from "../../helpers";
-import { validateRequest } from "../../helpers/validation";
-import { User } from "../../models";
-import { TelemetryService } from "../../services";
-import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
-import * as reqValidator from "../../validation/admin";
-
-export const getServerConfigInfo = (_req: Request, res: Response) => {
-  const config = getServerConfig();
-  return res.send({ config });
-};
-
-export const updateServerConfig = async (req: Request, res: Response) => {
-  const {
-    body: { allowSignUp }
-  } = await validateRequest(reqValidator.UpdateServerConfigV1, req);
-  const config = await setServerConfig({ allowSignUp });
-  return res.send({ config });
-};
-
-export const adminSignUp = async (req: Request, res: Response) => {
-  const cfg = getServerConfig();
-  if (cfg.initialized) throw UnauthorizedRequestError({ message: "Admin has been created" });
-  const {
-    body: {
-      email,
-      publicKey,
-      salt,
-      lastName,
-      verifier,
-      firstName,
-      protectedKey,
-      protectedKeyIV,
-      protectedKeyTag,
-      encryptedPrivateKey,
-      encryptedPrivateKeyIV,
-      encryptedPrivateKeyTag
-    }
-  } = await validateRequest(reqValidator.SignupV1, req);
-  let user = await User.findOne({ email });
-  if (user) throw BadRequestError({ message: "User already exist" });
-  user = new User({
-    email,
-    firstName,
-    lastName,
-    encryptionVersion: 2,
-    protectedKey,
-    protectedKeyIV,
-    protectedKeyTag,
-    publicKey,
-    encryptedPrivateKey,
-    iv: encryptedPrivateKeyIV,
-    tag: encryptedPrivateKeyTag,
-    salt,
-    verifier,
-    superAdmin: true
-  });
-  await user.save();
-  await initializeDefaultOrg({ organizationName: "Admin Org", user });
-
-  await setServerConfig({ initialized: true });
-
-  // issue tokens
-  const tokens = await issueAuthTokens({
-    userId: user._id,
-    ip: req.realIP,
-    userAgent: req.headers["user-agent"] ?? ""
-  });
-
-  const token = tokens.token;
-
-  const postHogClient = await TelemetryService.getPostHogClient();
-  if (postHogClient) {
-    postHogClient.capture({
-      event: "admin initialization",
-      properties: {
-        email: user.email,
-        lastName,
-        firstName
-      }
-    });
-  }
-
-  // store (refresh) token in httpOnly cookie
-  res.cookie("jid", tokens.refreshToken, {
-    httpOnly: true,
-    path: "/",
-    sameSite: "strict",
-    secure: await getHttpsEnabled()
-  });
-
-  return res.status(200).send({
-    message: "Successfully set up admin account",
-    user,
-    token
-  });
-};

backend/src/controllers/v1/authController.ts

@@ -6,30 +6,25 @@ const jsrp = require("jsrp");
 import { LoginSRPDetail, TokenVersion, User } from "../../models";
 import { clearTokens, createToken, issueAuthTokens } from "../../helpers/auth";
 import { checkUserDevice } from "../../helpers/user";
-import { AuthTokenType } from "../../variables";
+import { ACTION_LOGIN, ACTION_LOGOUT } from "../../variables";
 import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
+import { EELogService } from "../../ee/services";
+import { getUserAgentType } from "../../utils/posthog";
 import {
-  getAuthSecret,
   getHttpsEnabled,
-  getJwtAuthLifetime
+  getJwtAuthLifetime,
+  getJwtAuthSecret,
+  getJwtRefreshSecret
 } from "../../config";
 import { ActorType } from "../../ee/models";
 import { validateRequest } from "../../helpers/validation";
 import * as reqValidator from "../../validation/auth";
 
 declare module "jsonwebtoken" {
-  export interface AuthnJwtPayload extends jwt.JwtPayload {
-    authTokenType: AuthTokenType;
-  }
   export interface UserIDJwtPayload extends jwt.JwtPayload {
     userId: string;
     refreshVersion?: number;
   }
-  export interface ServiceRefreshTokenJwtPayload extends jwt.JwtPayload {
-    serviceTokenDataId: string;
-    authTokenType: string;
-    tokenVersion: number;
-  }
 }
 
 /**
@@ -139,6 +134,19 @@ export const login2 = async (req: Request, res: Response) => {
           secure: await getHttpsEnabled()
         });
 
+        const loginAction = await EELogService.createAction({
+          name: ACTION_LOGIN,
+          userId: user._id
+        });
+
+        loginAction &&
+          (await EELogService.createLog({
+            userId: user._id,
+            actions: [loginAction],
+            channel: getUserAgentType(req.headers["user-agent"]),
+            ipAddress: req.realIP
+          }));
+
         // return (access) token in response
         return res.status(200).send({
           token: tokens.token,
@@ -175,6 +183,19 @@ export const logout = async (req: Request, res: Response) => {
     secure: (await getHttpsEnabled()) as boolean
   });
 
+  const logoutAction = await EELogService.createAction({
+    name: ACTION_LOGOUT,
+    userId: req.user._id
+  });
+
+  logoutAction &&
+    (await EELogService.createLog({
+      userId: req.user._id,
+      actions: [logoutAction],
+      channel: getUserAgentType(req.headers["user-agent"]),
+      ipAddress: req.realIP
+    }));
+
   return res.status(200).send({
     message: "Successfully logged out."
   });
@@ -217,7 +238,6 @@ export const checkAuth = async (req: Request, res: Response) => {
  * @returns
  */
 export const getNewToken = async (req: Request, res: Response) => {
-
   const refreshToken = req.cookies.jid;
 
   if (!refreshToken)
@@ -225,9 +245,7 @@ export const getNewToken = async (req: Request, res: Response) => {
       message: "Failed to find refresh token in request cookies"
     });
 
-  const decodedToken = <jwt.UserIDJwtPayload>jwt.verify(refreshToken, await getAuthSecret());
-  
-  if (decodedToken.authTokenType !== AuthTokenType.REFRESH_TOKEN) throw UnauthorizedRequestError();
+  const decodedToken = <jwt.UserIDJwtPayload>jwt.verify(refreshToken, await getJwtRefreshSecret());
 
   const user = await User.findOne({
     _id: decodedToken.userId
@@ -250,13 +268,12 @@ export const getNewToken = async (req: Request, res: Response) => {
 
   const token = createToken({
     payload: {
-      authTokenType: AuthTokenType.ACCESS_TOKEN,
       userId: decodedToken.userId,
       tokenVersionId: tokenVersion._id.toString(),
       accessVersion: tokenVersion.refreshVersion
     },
     expiresIn: await getJwtAuthLifetime(),
-    secret: await getAuthSecret()
+    secret: await getJwtAuthSecret()
   });
 
   return res.status(200).send({

backend/src/controllers/v1/botController.ts

@@ -7,7 +7,7 @@ import * as reqValidator from "../../validation/bot";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
 import { BadRequestError } from "../../utils/errors";
@@ -28,11 +28,7 @@ export const getBotByWorkspaceId = async (req: Request, res: Response) => {
   const {
     params: { workspaceId }
   } = await validateRequest(reqValidator.GetBotByWorkspaceIdV1, req);
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -74,11 +70,7 @@ export const setBotActiveState = async (req: Request, res: Response) => {
   }
   const userId = req.user._id;
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: bot.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(userId, bot.workspace.toString());
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.Integrations

backend/src/controllers/v1/index.ts

@@ -16,7 +16,7 @@ import * as workspaceController from "./workspaceController";
 import * as secretScanningController from "./secretScanningController";
 import * as webhookController from "./webhookController";
 import * as secretImpsController from "./secretImpsController";
-import * as adminController from "./adminController";
+import * as secretApprovalPolicyController from "./secretApprovalPolicyController";
 
 export {
   authController,
@@ -37,5 +37,5 @@ export {
   secretScanningController,
   webhookController,
   secretImpsController,
-  adminController
+  secretApprovalPolicyController
 };

backend/src/controllers/v1/integrationAuthController.ts

@@ -10,7 +10,6 @@ import {
   ALGORITHM_AES_256_GCM,
   ENCODING_SCHEME_UTF8,
   INTEGRATION_BITBUCKET_API_URL,
-  INTEGRATION_CHECKLY_API_URL,
   INTEGRATION_GCP_SECRET_MANAGER,
   INTEGRATION_NORTHFLANK_API_URL,
   INTEGRATION_QOVERY_API_URL,
@@ -25,10 +24,11 @@ import * as reqValidator from "../../validation/integrationAuth";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
 import { getIntegrationAuthAccessHelper } from "../../helpers";
+import { ObjectId } from "mongodb";
 
 /***
  * Return integration authorization with id [integrationAuthId]
@@ -40,15 +40,15 @@ export const getIntegrationAuth = async (req: Request, res: Response) => {
 
   const integrationAuth = await IntegrationAuth.findById(integrationAuthId);
 
-  if (!integrationAuth) return res.status(400).send({
-    message: "Failed to find integration authorization"
-  });
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
-  });
+  if (!integrationAuth)
+    return res.status(400).send({
+      message: "Failed to find integration authorization"
+    });
 
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -79,11 +79,7 @@ export const oAuthExchange = async (req: Request, res: Response) => {
   } = await validateRequest(reqValidator.OauthExchangeV1, req);
   if (!INTEGRATION_SET.has(integration)) throw new Error("Failed to validate integration");
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-  
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.Integrations
@@ -135,11 +131,7 @@ export const saveIntegrationToken = async (req: Request, res: Response) => {
     body: { workspaceId, integration, url, accessId, namespace, accessToken, refreshToken }
   } = await validateRequest(reqValidator.SaveIntegrationAccessTokenV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.Integrations
@@ -230,14 +222,13 @@ export const getIntegrationAuthApps = async (req: Request, res: Response) => {
 
   // TODO(akhilmhdh): remove class -> static function path and makes these into reusable independent functions
   const { integrationAuth, accessToken, accessId } = await getIntegrationAuthAccessHelper({
-    integrationAuthId: new Types.ObjectId(integrationAuthId)
-  });
-  
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
+    integrationAuthId: new ObjectId(integrationAuthId)
   });
 
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -269,14 +260,13 @@ export const getIntegrationAuthTeams = async (req: Request, res: Response) => {
 
   // TODO(akhilmhdh): remove class -> static function path and makes these into reusable independent functions
   const { integrationAuth, accessToken } = await getIntegrationAuthAccessHelper({
-    integrationAuthId: new Types.ObjectId(integrationAuthId)
-  });
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
+    integrationAuthId: new ObjectId(integrationAuthId)
   });
 
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -306,14 +296,13 @@ export const getIntegrationAuthVercelBranches = async (req: Request, res: Respon
 
   // TODO(akhilmhdh): remove class -> static function path and makes these into reusable independent functions
   const { integrationAuth, accessToken } = await getIntegrationAuthAccessHelper({
-    integrationAuthId: new Types.ObjectId(integrationAuthId)
+    integrationAuthId: new ObjectId(integrationAuthId)
   });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
-  });
-  
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -356,60 +345,6 @@ export const getIntegrationAuthVercelBranches = async (req: Request, res: Respon
   });
 };
 
-/**
- * Return list of Checkly groups for a specific user
- * @param req
- * @param res
- */
-export const getIntegrationAuthChecklyGroups = async (req: Request, res: Response) => {
-  const {
-    params: { integrationAuthId },
-    query: { accountId }
-  } = await validateRequest(reqValidator.GetIntegrationAuthChecklyGroupsV1, req);
-  
-  const { integrationAuth, accessToken } = await getIntegrationAuthAccessHelper({
-    integrationAuthId: new Types.ObjectId(integrationAuthId)
-  });
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
-  });
-  
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Read,
-    ProjectPermissionSub.Integrations
-  );
-
-  interface ChecklyGroup {
-    id: number;
-    name: string;
-  }
-  
-  if (accountId && accountId !== "") {
-    const { data }: { data: ChecklyGroup[] } = (
-      await standardRequest.get(`${INTEGRATION_CHECKLY_API_URL}/v1/check-groups`, {
-          headers: {
-              Authorization: `Bearer ${accessToken}`,
-              Accept: "application/json",
-              "X-Checkly-Account": accountId
-          }
-      })
-    );
-    
-    return res.status(200).send({
-      groups: data.map((g: ChecklyGroup) => ({
-        name: g.name,
-        groupId: g.id,
-      }))
-    });
-  }
-
-  return res.status(200).send({
-    groups: []
-  });
-}
-
 /**
  * Return list of Qovery Orgs for a specific user
  * @param req
@@ -422,14 +357,13 @@ export const getIntegrationAuthQoveryOrgs = async (req: Request, res: Response)
 
   // TODO(akhilmhdh): remove class -> static function path and makes these into reusable independent functions
   const { integrationAuth, accessToken } = await getIntegrationAuthAccessHelper({
-    integrationAuthId: new Types.ObjectId(integrationAuthId)
-  });
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
+    integrationAuthId: new ObjectId(integrationAuthId)
   });
 
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -475,14 +409,13 @@ export const getIntegrationAuthQoveryProjects = async (req: Request, res: Respon
   
   // TODO(akhilmhdh): remove class -> static function path and makes these into reusable independent functions
   const { integrationAuth, accessToken } = await getIntegrationAuthAccessHelper({
-    integrationAuthId: new Types.ObjectId(integrationAuthId)
-  });
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
+    integrationAuthId: new ObjectId(integrationAuthId)
   });
 
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -537,14 +470,13 @@ export const getIntegrationAuthQoveryEnvironments = async (req: Request, res: Re
 
   // TODO(akhilmhdh): remove class -> static function path and makes these into reusable independent functions
   const { integrationAuth, accessToken } = await getIntegrationAuthAccessHelper({
-    integrationAuthId: new Types.ObjectId(integrationAuthId)
-  });
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
+    integrationAuthId: new ObjectId(integrationAuthId)
   });
 
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -599,14 +531,13 @@ export const getIntegrationAuthQoveryApps = async (req: Request, res: Response)
 
   // TODO(akhilmhdh): remove class -> static function path and makes these into reusable independent functions
   const { integrationAuth, accessToken } = await getIntegrationAuthAccessHelper({
-    integrationAuthId: new Types.ObjectId(integrationAuthId)
+    integrationAuthId: new ObjectId(integrationAuthId)
   });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
-  });
-  
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -661,14 +592,13 @@ export const getIntegrationAuthQoveryContainers = async (req: Request, res: Resp
 
   // TODO(akhilmhdh): remove class -> static function path and makes these into reusable independent functions
   const { integrationAuth, accessToken } = await getIntegrationAuthAccessHelper({
-    integrationAuthId: new Types.ObjectId(integrationAuthId)
+    integrationAuthId: new ObjectId(integrationAuthId)
   });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
-  });
-  
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -723,14 +653,13 @@ export const getIntegrationAuthQoveryJobs = async (req: Request, res: Response)
 
   // TODO(akhilmhdh): remove class -> static function path and makes these into reusable independent functions
   const { integrationAuth, accessToken } = await getIntegrationAuthAccessHelper({
-    integrationAuthId: new Types.ObjectId(integrationAuthId)
-  });
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
+    integrationAuthId: new ObjectId(integrationAuthId)
   });
 
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -786,14 +715,13 @@ export const getIntegrationAuthRailwayEnvironments = async (req: Request, res: R
 
   // TODO(akhilmhdh): remove class -> static function path and makes these into reusable independent functions
   const { integrationAuth, accessToken } = await getIntegrationAuthAccessHelper({
-    integrationAuthId: new Types.ObjectId(integrationAuthId)
+    integrationAuthId: new ObjectId(integrationAuthId)
   });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
-  });
-  
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -880,14 +808,13 @@ export const getIntegrationAuthRailwayServices = async (req: Request, res: Respo
 
   // TODO(akhilmhdh): remove class -> static function path and makes these into reusable independent functions
   const { integrationAuth, accessToken } = await getIntegrationAuthAccessHelper({
-    integrationAuthId: new Types.ObjectId(integrationAuthId)
-  });
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
+    integrationAuthId: new ObjectId(integrationAuthId)
   });
 
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -1005,14 +932,13 @@ export const getIntegrationAuthBitBucketWorkspaces = async (req: Request, res: R
 
   // TODO(akhilmhdh): remove class -> static function path and makes these into reusable independent functions
   const { integrationAuth, accessToken } = await getIntegrationAuthAccessHelper({
-    integrationAuthId: new Types.ObjectId(integrationAuthId)
-  });
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
+    integrationAuthId: new ObjectId(integrationAuthId)
   });
 
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -1062,14 +988,13 @@ export const getIntegrationAuthNorthflankSecretGroups = async (req: Request, res
 
   // TODO(akhilmhdh): remove class -> static function path and makes these into reusable independent functions
   const { integrationAuth, accessToken } = await getIntegrationAuthAccessHelper({
-    integrationAuthId: new Types.ObjectId(integrationAuthId)
+    integrationAuthId: new ObjectId(integrationAuthId)
   });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
-  });
-  
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -1151,14 +1076,13 @@ export const getIntegrationAuthTeamCityBuildConfigs = async (req: Request, res:
   
   // TODO(akhilmhdh): remove class -> static function path and makes these into reusable independent functions
   const { integrationAuth, accessToken } = await getIntegrationAuthAccessHelper({
-    integrationAuthId: new Types.ObjectId(integrationAuthId)
-  });
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
+    integrationAuthId: new ObjectId(integrationAuthId)
   });
 
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -1221,14 +1145,13 @@ export const deleteIntegrationAuth = async (req: Request, res: Response) => {
 
   // TODO(akhilmhdh): remove class -> static function path and makes these into reusable independent functions
   const { integrationAuth, accessToken } = await getIntegrationAuthAccessHelper({
-    integrationAuthId: new Types.ObjectId(integrationAuthId)
+    integrationAuthId: new ObjectId(integrationAuthId)
   });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
-  });
-  
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Delete,
     ProjectPermissionSub.Integrations

backend/src/controllers/v1/integrationController.ts

@@ -13,7 +13,7 @@ import * as reqValidator from "../../validation/integration";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
 
@@ -51,12 +51,11 @@ export const createIntegration = async (req: Request, res: Response) => {
     );
 
   if (!integrationAuth) throw BadRequestError({ message: "Integration auth not found" });
-  
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace._id
-  });
-  
+
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace._id.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.Integrations
@@ -165,11 +164,10 @@ export const updateIntegration = async (req: Request, res: Response) => {
   const integration = await Integration.findById(integrationId);
   if (!integration) throw BadRequestError({ message: "Integration not found" });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integration.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integration.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.Integrations
@@ -236,11 +234,10 @@ export const deleteIntegration = async (req: Request, res: Response) => {
   const integration = await Integration.findById(integrationId);
   if (!integration) throw BadRequestError({ message: "Integration not found" });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integration.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integration.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Delete,
     ProjectPermissionSub.Integrations
@@ -288,11 +285,7 @@ export const manualSync = async (req: Request, res: Response) => {
     body: { workspaceId, environment }
   } = await validateRequest(reqValidator.ManualSyncV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-  
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.Integrations

backend/src/controllers/v1/keyController.ts

@@ -9,7 +9,7 @@ import * as reqValidator from "../../validation/key";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
 
@@ -26,11 +26,7 @@ export const uploadKey = async (req: Request, res: Response) => {
     body: { key }
   } = await validateRequest(reqValidator.UploadKeyV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-  
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.Member

backend/src/controllers/v1/membershipController.ts

@@ -1,7 +1,7 @@
 import { Request, Response } from "express";
 import { Types } from "mongoose";
 import { IUser, Key, Membership, MembershipOrg, User, Workspace } from "../../models";
-import { EventType, Role } from "../../ee/models";
+import { EventType } from "../../ee/models";
 import { deleteMembership as deleteMember, findMembership } from "../../helpers/membership";
 import { sendMail } from "../../helpers/nodemailer";
 import { ACCEPTED, ADMIN, CUSTOM, MEMBER, VIEWER } from "../../variables";
@@ -12,9 +12,10 @@ import * as reqValidator from "../../validation/membership";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
+import Role from "../../ee/models/role";
 import { BadRequestError } from "../../utils/errors";
 import { InviteUserToWorkspaceV1 } from "../../validation/workspace";
 
@@ -63,12 +64,11 @@ export const deleteMembership = async (req: Request, res: Response) => {
   if (!membershipToDelete) {
     throw new Error("Failed to delete workspace membership that doesn't exist");
   }
-  
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: membershipToDelete.workspace
-  });
-  
+
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    membershipToDelete.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Delete,
     ProjectPermissionSub.Member
@@ -119,11 +119,10 @@ export const changeMembershipRole = async (req: Request, res: Response) => {
     throw new Error("Failed to find membership to change role");
   }
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: membershipToChangeRole.workspace
-  });
-  
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    membershipToChangeRole.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.Member
@@ -193,12 +192,7 @@ export const inviteUserToWorkspace = async (req: Request, res: Response) => {
     params: { workspaceId },
     body: { email }
   } = await validateRequest(InviteUserToWorkspaceV1, req);
-  
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-  
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.Member

backend/src/controllers/v1/membershipOrgController.ts

@@ -8,11 +8,11 @@ import { updateSubscriptionOrgQuantity } from "../../helpers/organization";
 import { sendMail } from "../../helpers/nodemailer";
 import { TokenService } from "../../services";
 import { EELicenseService } from "../../ee/services";
-import { ACCEPTED, AuthTokenType, INVITED, MEMBER, TOKEN_EMAIL_ORG_INVITATION } from "../../variables";
+import { ACCEPTED, INVITED, MEMBER, TOKEN_EMAIL_ORG_INVITATION } from "../../variables";
 import * as reqValidator from "../../validation/membershipOrg";
 import {
-  getAuthSecret,
   getJwtSignupLifetime,
+  getJwtSignupSecret,
   getSiteURL,
   getSmtpConfigured
 } from "../../config";
@@ -272,11 +272,10 @@ export const verifyUserToOrganization = async (req: Request, res: Response) => {
   // generate temporary signup token
   const token = createToken({
     payload: {
-      authTokenType: AuthTokenType.SIGNUP_TOKEN,
       userId: user._id.toString()
     },
     expiresIn: await getJwtSignupLifetime(),
-    secret: await getAuthSecret()
+    secret: await getJwtSignupSecret()
   });
 
   return res.status(200).send({

backend/src/controllers/v1/organizationController.ts

@@ -6,11 +6,13 @@ import {
   Organization,
   Workspace
 } from "../../models";
+import { createOrganization as create } from "../../helpers/organization";
+import { addMembershipsOrg } from "../../helpers/membershipOrg";
+import { ACCEPTED, ADMIN } from "../../variables";
 import { getLicenseServerUrl, getSiteURL } from "../../config";
 import { licenseServerKeyRequest } from "../../config/request";
 import { validateRequest } from "../../helpers/validation";
 import * as reqValidator from "../../validation/organization";
-import { ACCEPTED } from "../../variables";
 import {
   OrgPermissionActions,
   OrgPermissionSubjects,
@@ -32,6 +34,36 @@ export const getOrganizations = async (req: Request, res: Response) => {
   });
 };
 
+/**
+ * Create new organization named [organizationName]
+ * and add user as owner
+ * @param req
+ * @param res
+ * @returns
+ */
+export const createOrganization = async (req: Request, res: Response) => {
+  const {
+    body: { organizationName }
+  } = await validateRequest(reqValidator.CreateOrgv1, req);
+
+  // create organization and add user as member
+  const organization = await create({
+    email: req.user.email,
+    name: organizationName
+  });
+
+  await addMembershipsOrg({
+    userIds: [req.user._id.toString()],
+    organizationId: organization._id.toString(),
+    roles: [ADMIN],
+    statuses: [ACCEPTED]
+  });
+
+  return res.status(200).send({
+    organization
+  });
+};
+
 /**
  * Return organization with id [organizationId]
  * @param req

backend/src/controllers/v1/passwordController.ts

@@ -5,12 +5,12 @@ import * as bigintConversion from "bigint-conversion";
 import { BackupPrivateKey, LoginSRPDetail, User } from "../../models";
 import { clearTokens, createToken, sendMail } from "../../helpers";
 import { TokenService } from "../../services";
-import { AuthTokenType, TOKEN_EMAIL_PASSWORD_RESET } from "../../variables";
+import { TOKEN_EMAIL_PASSWORD_RESET } from "../../variables";
 import { BadRequestError } from "../../utils/errors";
 import {
-  getAuthSecret,
   getHttpsEnabled,
   getJwtSignupLifetime,
+  getJwtSignupSecret,
   getSiteURL
 } from "../../config";
 import { ActorType } from "../../ee/models";
@@ -88,11 +88,10 @@ export const emailPasswordResetVerify = async (req: Request, res: Response) => {
   // generate temporary password-reset token
   const token = createToken({
     payload: {
-      authTokenType: AuthTokenType.SIGNUP_TOKEN,
       userId: user._id.toString()
     },
     expiresIn: await getJwtSignupLifetime(),
-    secret: await getAuthSecret()
+    secret: await getJwtSignupSecret()
   });
 
   return res.status(200).send({

backend/src/controllers/v1/secretApprovalPolicyController.ts

@@ -1,30 +1,23 @@
-import { Types } from "mongoose";
-import { ForbiddenError, subject } from "@casl/ability";
+import { ForbiddenError } from "@casl/ability";
 import { Request, Response } from "express";
-import { nanoid } from "nanoid";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
-} from "../../services/ProjectRoleService";
-import { validateRequest } from "../../../helpers/validation";
+  getUserProjectPermissions
+} from "../../ee/services/ProjectRoleService";
+import { validateRequest } from "../../helpers/validation";
 import { SecretApprovalPolicy } from "../../models/secretApprovalPolicy";
-import { getSecretPolicyOfBoard } from "../../services/SecretApprovalService";
-import { BadRequestError } from "../../../utils/errors";
+import { BadRequestError } from "../../utils/errors";
 import * as reqValidator from "../../validation/secretApproval";
 
 const ERR_SECRET_APPROVAL_NOT_FOUND = BadRequestError({ message: "secret approval not found" });
 
 export const createSecretApprovalPolicy = async (req: Request, res: Response) => {
   const {
-    body: { approvals, secretPath, approvers, environment, workspaceId, name }
+    body: { approvals, secretPath, approvers, environment, workspaceId }
   } = await validateRequest(reqValidator.CreateSecretApprovalRule, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.SecretApproval
@@ -32,7 +25,6 @@ export const createSecretApprovalPolicy = async (req: Request, res: Response) =>
 
   const secretApproval = new SecretApprovalPolicy({
     workspace: workspaceId,
-    name: name ?? `${environment}-${nanoid(3)}`,
     secretPath,
     environment,
     approvals,
@@ -47,18 +39,17 @@ export const createSecretApprovalPolicy = async (req: Request, res: Response) =>
 
 export const updateSecretApprovalPolicy = async (req: Request, res: Response) => {
   const {
-    body: { approvals, approvers, secretPath, name },
+    body: { approvals, approvers, secretPath },
     params: { id }
   } = await validateRequest(reqValidator.UpdateSecretApprovalRule, req);
 
   const secretApproval = await SecretApprovalPolicy.findById(id);
   if (!secretApproval) throw ERR_SECRET_APPROVAL_NOT_FOUND;
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: secretApproval.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    secretApproval.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.SecretApproval
@@ -67,7 +58,6 @@ export const updateSecretApprovalPolicy = async (req: Request, res: Response) =>
   const updatedDoc = await SecretApprovalPolicy.findByIdAndUpdate(id, {
     approvals,
     approvers,
-    name: (name || secretApproval?.name) ?? `${secretApproval.environment}-${nanoid(3)}`,
     ...(secretPath === null ? { $unset: { secretPath: 1 } } : { secretPath })
   });
 
@@ -84,11 +74,10 @@ export const deleteSecretApprovalPolicy = async (req: Request, res: Response) =>
   const secretApproval = await SecretApprovalPolicy.findById(id);
   if (!secretApproval) throw ERR_SECRET_APPROVAL_NOT_FOUND;
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: secretApproval.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    secretApproval.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Delete,
     ProjectPermissionSub.SecretApproval
@@ -106,11 +95,7 @@ export const getSecretApprovalPolicy = async (req: Request, res: Response) => {
     query: { workspaceId }
   } = await validateRequest(reqValidator.GetSecretApprovalRuleList, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.SecretApproval
@@ -122,22 +107,3 @@ export const getSecretApprovalPolicy = async (req: Request, res: Response) => {
     approvals: doc
   });
 };
-
-export const getSecretApprovalPolicyOfBoard = async (req: Request, res: Response) => {
-  const {
-    query: { workspaceId, environment, secretPath }
-  } = await validateRequest(reqValidator.GetSecretApprovalPolicyOfABoard, req);
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Read,
-    subject(ProjectPermissionSub.Secrets, { secretPath, environment })
-  );
-
-  const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
-  return res.send({ policy: secretApprovalPolicy });
-};

backend/src/controllers/v1/secretImpsController.ts

@@ -1,6 +1,4 @@
-
 import { Request, Response } from "express";
-import { Types } from "mongoose";
 import { isValidScope } from "../../helpers";
 import { Folder, IServiceTokenData, SecretImport, ServiceTokenData } from "../../models";
 import { getAllImportedSecrets } from "../../services/SecretImportService";
@@ -17,14 +15,14 @@ import * as reqValidator from "../../validation/secretImports";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError, subject } from "@casl/ability";
 
 export const createSecretImp = async (req: Request, res: Response) => {
   /* 
     #swagger.summary = 'Create secret import'
-    #swagger.description = 'Create secret import'
+    #swagger.description = 'Create a new secret import for a specified workspace and environment'
 
     #swagger.requestBody = {
         content: {
@@ -34,36 +32,36 @@ export const createSecretImp = async (req: Request, res: Response) => {
                     "properties": {
                         "workspaceId": {
                             "type": "string",
-                            "description": "ID of workspace where to create secret import",
+                            "description": "ID of the workspace where the secret import will be created",
                             "example": "someWorkspaceId"
                         },
                         "environment": {
                             "type": "string",
-                            "description": "Slug of environment where to create secret import",
-                            "example": "dev"
+                            "description": "Environment to import to",
+                            "example": "production"
                         },
-                        "directory": {
+                        "folderId": {
                             "type": "string",
-                            "description": "Path where to create secret import like / or /foo/bar. Default is /",
-                            "example": "/foo/bar"
+                            "description": "Folder ID. Use root for the root folder.",
+                            "example": "my_folder"
                         },
                         "secretImport": {
                             "type": "object",
                             "properties": {
                               "environment": {
                                 "type": "string",
-                                "description": "Slug of environment to import from",
+                                "description": "Import from environment",
                                 "example": "development"
                               },
                               "secretPath": {
                                 "type": "string",
-                                "description": "Path where to import from like / or /foo/bar.",
+                                "description": "Import from secret path",
                                 "example": "/user/oauth"
                               }
                             }
                         }
                     },
-                    "required": ["workspaceId", "environment", "directory", "secretImport"]
+                    "required": ["workspaceId", "environment", "folderName"]
                 }
             }
         }
@@ -107,11 +105,7 @@ export const createSecretImp = async (req: Request, res: Response) => {
       throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
     }
   } else {
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: new Types.ObjectId(workspaceId)
-    });
-    
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Create,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: directory })
@@ -212,12 +206,12 @@ export const createSecretImp = async (req: Request, res: Response) => {
  */
 export const updateSecretImport = async (req: Request, res: Response) => {
   /*
-    #swagger.summary = 'Update secret import'
-    #swagger.description = 'Update secret import'
+    #swagger.summary = 'Update a secret import'
+    #swagger.description = 'Updates an existing secret import based on the provided ID and new import details'
 
     #swagger.parameters['id'] = {
         in: 'path',
-        description: 'ID of secret import to update',
+        description: 'ID of the secret import to be updated',
         required: true,
         type: 'string',
         example: 'import12345'
@@ -231,19 +225,19 @@ export const updateSecretImport = async (req: Request, res: Response) => {
                     "properties": {
                         "secretImports": {
                             "type": "array",
-                            "description": "List of secret imports to update to",
+                            "description": "List of new secret imports",
                             "items": {
                                 "type": "object",
                                 "properties": {
                                     "environment": {
                                         "type": "string",
-                                        "description": "Slug of environment to import from",
-                                        "example": "dev"
+                                        "description": "Environment of the secret import",
+                                        "example": "production"
                                     },
                                     "secretPath": {
                                         "type": "string",
-                                        "description": "Path where to import secrets from like / or /foo/bar",
-                                        "example": "/foo/bar"
+                                        "description": "Path of the secret import",
+                                        "example": "/path/to/secret"
                                     }
                                 },
                                 "required": ["environment", "secretPath"]
@@ -319,11 +313,10 @@ export const updateSecretImport = async (req: Request, res: Response) => {
     }
   } else {
     // non token entry check
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: importSecDoc.workspace
-    });
-    
+    const { permission } = await getUserProjectPermissions(
+      req.user._id,
+      importSecDoc.workspace.toString()
+    );
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Edit,
       subject(ProjectPermissionSub.Secrets, {
@@ -371,7 +364,7 @@ export const deleteSecretImport = async (req: Request, res: Response) => {
 
     #swagger.parameters['id'] = {
         in: 'path',
-        description: 'ID of parent secret import document from which to delete secret import',
+        description: 'ID of the secret import',
         required: true,
         type: 'string',
         example: '12345abcde'
@@ -385,12 +378,12 @@ export const deleteSecretImport = async (req: Request, res: Response) => {
                     "properties": {
                         "secretImportEnv": {
                             "type": "string",
-                            "description": "Slug of environment of import to delete",
+                            "description": "Import from environment",
                             "example": "someWorkspaceId"
                         },
                         "secretImportPath": {
                             "type": "string",
-                            "description": "Path like / or /foo/bar of import to delete",
+                            "description": "Import from secret path",
                             "example": "production"
                         }
                     },
@@ -449,11 +442,10 @@ export const deleteSecretImport = async (req: Request, res: Response) => {
       throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
     }
   } else {
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: importSecDoc.workspace
-    });
-    
+    const { permission } = await getUserProjectPermissions(
+      req.user._id,
+      importSecDoc.workspace.toString()
+    );
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Delete,
       subject(ProjectPermissionSub.Secrets, {
@@ -497,12 +489,12 @@ export const deleteSecretImport = async (req: Request, res: Response) => {
  */
 export const getSecretImports = async (req: Request, res: Response) => {
   /*
-    #swagger.summary = 'Get secret imports'
-    #swagger.description = 'Get secret imports'
+    #swagger.summary = 'Retrieve secret imports'
+    #swagger.description = 'Fetches the secret imports based on the workspaceId, environment, and folderId'
 
     #swagger.parameters['workspaceId'] = {
         in: 'query',
-        description: 'ID of workspace where to get secret imports from',
+        description: 'ID of the workspace of secret imports to get',
         required: true,
         type: 'string',
         example: 'workspace12345'
@@ -510,15 +502,15 @@ export const getSecretImports = async (req: Request, res: Response) => {
 
     #swagger.parameters['environment'] = {
         in: 'query',
-        description: 'Slug of environment where to get secret imports from',
+        description: 'Environment of secret imports to get',
         required: true,
         type: 'string',
         example: 'production'
     }
 
-    #swagger.parameters['directory'] = {
+    #swagger.parameters['folderId'] = {
         in: 'query',
-        description: 'Path where to get secret imports from like / or /foo/bar. Default is /',
+        description: 'ID of the folder containing the secret imports. Default: root',
         required: false,
         type: 'string',
         example: 'folder12345'
@@ -532,7 +524,8 @@ export const getSecretImports = async (req: Request, res: Response) => {
                     "type": "object",
                     "properties": {
                         "secretImport": {
-                          $ref: '#/definitions/SecretImport'
+                            "type": "object",
+                            "description": "Details of a secret import"
                         }
                     }
                 }
@@ -558,11 +551,7 @@ export const getSecretImports = async (req: Request, res: Response) => {
       throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
     }
   } else {
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: new Types.ObjectId(workspaceId)
-    });
-
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Read,
       subject(ProjectPermissionSub.Secrets, {
@@ -616,11 +605,7 @@ export const getAllSecretsFromImport = async (req: Request, res: Response) => {
       throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
     }
   } else {
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: new Types.ObjectId(workspaceId)
-    });
-    
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Read,
       subject(ProjectPermissionSub.Secrets, {
@@ -673,11 +658,10 @@ export const getAllSecretsFromImport = async (req: Request, res: Response) => {
     permissionCheckFn = (env: string, secPath: string) =>
       isValidScope(req.authData.authPayload as IServiceTokenData, env, secPath);
   } else {
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: importSecDoc.workspace
-    });
-    
+    const { permission } = await getUserProjectPermissions(
+      req.user._id,
+      importSecDoc.workspace.toString()
+    );
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Read,
       subject(ProjectPermissionSub.Secrets, {

backend/src/controllers/v1/secretScanningController.ts

@@ -1,15 +1,12 @@
 import { Request, Response } from "express";
-import {
-  GitAppInstallationSession,
-  GitAppOrganizationInstallation,
-  GitRisks
-} from "../../ee/models";
+import GitAppInstallationSession from "../../ee/models/gitAppInstallationSession";
 import crypto from "crypto";
 import { Types } from "mongoose";
 import { OrganizationNotFoundError, UnauthorizedRequestError } from "../../utils/errors";
+import GitAppOrganizationInstallation from "../../ee/models/gitAppOrganizationInstallation";
 import { scanGithubFullRepoForSecretLeaks } from "../../queues/secret-scanning/githubScanFullRepository";
 import { getSecretScanningGitAppId, getSecretScanningPrivateKey } from "../../config";
-import {
+import GitRisks, {
   STATUS_RESOLVED_FALSE_POSITIVE,
   STATUS_RESOLVED_NOT_REVOKED,
   STATUS_RESOLVED_REVOKED

backend/src/controllers/v1/secretsFolderController.ts

@@ -9,6 +9,7 @@ import { Secret, ServiceTokenData } from "../../models";
 import { Folder } from "../../models/folder";
 import {
   appendFolder,
+  generateFolderId,
   getAllFolderIds,
   getFolderByPath,
   getFolderWithPathFromId,
@@ -17,7 +18,7 @@ import {
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
 import * as reqValidator from "../../validation/folders";
@@ -27,12 +28,11 @@ const ERR_FOLDER_NOT_FOUND = BadRequestError({ message: "The folder doesn't exis
 // verify workspace id/environment
 export const createFolder = async (req: Request, res: Response) => {
   /* 
-    #swagger.summary = 'Create folder'
-    #swagger.description = 'Create folder'
+    #swagger.summary = 'Create a folder'
+    #swagger.description = 'Create a new folder in a specified workspace and environment'
     
     #swagger.security = [{
-        "apiKeyAuth": [],
-        "bearerAuth": []
+        "apiKeyAuth": []
     }]
 
     #swagger.requestBody = {
@@ -43,23 +43,23 @@ export const createFolder = async (req: Request, res: Response) => {
                     "properties": {
                         "workspaceId": {
                             "type": "string",
-                            "description": "ID of the workspace where to create folder",
+                            "description": "ID of the workspace where the folder will be created",
                             "example": "someWorkspaceId"
                         },
                         "environment": {
                             "type": "string",
-                            "description": "Slug of environment where to create folder",
+                            "description": "Environment where the folder will reside",
                             "example": "production"
                         },
                         "folderName": {
                             "type": "string",
-                            "description": "Name of folder to create",
+                            "description": "Name of the folder to be created",
                             "example": "my_folder"
                         },
-                        "directory": {
+                        "parentFolderId": {
                             "type": "string",
-                            "description": "Path where to create folder like / or /foo/bar. Default is /",
-                            "example": "/foo/bar"
+                            "description": "ID of the parent folder under which this folder will be created. If not specified, it will be created at the root level.",
+                            "example": "someParentFolderId"
                         }
                     },
                     "required": ["workspaceId", "environment", "folderName"]
@@ -79,21 +79,14 @@ export const createFolder = async (req: Request, res: Response) => {
                             "properties": {
                                 "id": {
                                     "type": "string",
-                                    "description": "ID of folder",
                                     "example": "someFolderId"
                                 },
                                 "name": {
                                     "type": "string",
-                                    "description": "Name of folder",
                                     "example": "my_folder"
-                                },
-                                "version": {
-                                    "type": "number",
-                                    "description": "Version of folder",
-                                    "example": 1
                                 }
                             },
-                            "description": "Details of created folder"
+                            "description": "Details of the created folder"
                         }
                     }
                 }
@@ -125,11 +118,7 @@ export const createFolder = async (req: Request, res: Response) => {
     }
   } else {
     // user check
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: new Types.ObjectId(workspaceId)
-    });
-
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Create,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: directory })
@@ -143,6 +132,9 @@ export const createFolder = async (req: Request, res: Response) => {
 
   // space has no folders initialized
   if (!folders) {
+    if (directory !== "/") throw ERR_FOLDER_NOT_FOUND;
+
+    const id = generateFolderId();
     const folder = new Folder({
       workspace: workspaceId,
       environment,
@@ -150,15 +142,14 @@ export const createFolder = async (req: Request, res: Response) => {
         id: "root",
         name: "root",
         version: 1,
-        children: []
+        children: [{ id, name: folderName, children: [], version: 1 }]
       }
     });
-    const { parent, child } = appendFolder(folder.nodes, { folderName, directory });
     await folder.save();
     const folderVersion = new FolderVersion({
       workspace: workspaceId,
       environment,
-      nodes: parent
+      nodes: folder.nodes
     });
     await folderVersion.save();
     await EESecretService.takeSecretSnapshot({
@@ -172,9 +163,9 @@ export const createFolder = async (req: Request, res: Response) => {
         type: EventType.CREATE_FOLDER,
         metadata: {
           environment,
-          folderId: child.id,
+          folderId: id,
           folderName,
-          folderPath: directory
+          folderPath: `root/${folderName}`
         }
       },
       {
@@ -182,26 +173,26 @@ export const createFolder = async (req: Request, res: Response) => {
       }
     );
 
-    return res.json({ folder: { id: child.id, name: folderName } });
+    return res.json({ folder: { id, name: folderName } });
   }
 
-  const { parent, child, hasCreated } = appendFolder(folders.nodes, { folderName, directory });
-
-  if (!hasCreated) return res.json({ folder: child });
+  const parentFolder = getFolderByPath(folders.nodes, directory);
+  if (!parentFolder) throw ERR_FOLDER_NOT_FOUND;
 
+  const folder = appendFolder(folders.nodes, { folderName, parentFolderId: parentFolder.id });
   await Folder.findByIdAndUpdate(folders._id, folders);
 
   const folderVersion = new FolderVersion({
     workspace: workspaceId,
     environment,
-    nodes: parent
+    nodes: parentFolder
   });
   await folderVersion.save();
 
   await EESecretService.takeSecretSnapshot({
     workspaceId: new Types.ObjectId(workspaceId),
     environment,
-    folderId: child.id
+    folderId: parentFolder.id
   });
 
   await EEAuditLogService.createAuditLog(
@@ -210,7 +201,7 @@ export const createFolder = async (req: Request, res: Response) => {
       type: EventType.CREATE_FOLDER,
       metadata: {
         environment,
-        folderId: child.id,
+        folderId: folder.id,
         folderName,
         folderPath: directory
       }
@@ -220,7 +211,7 @@ export const createFolder = async (req: Request, res: Response) => {
     }
   );
 
-  return res.json({ folder: child });
+  return res.json({ folder });
 };
 
 /**
@@ -231,18 +222,18 @@ export const createFolder = async (req: Request, res: Response) => {
  */
 export const updateFolderById = async (req: Request, res: Response) => {
   /* 
-    #swagger.summary = 'Update folder'
-    #swagger.description = 'Update folder'
+    #swagger.summary = 'Update a folder by ID'
+    #swagger.description = 'Update the name of a folder in a specified workspace and environment by its ID'
     
     #swagger.security = [{
-        "apiKeyAuth": [],
-        "bearerAuth": []
+        "apiKeyAuth": []
     }]
 
-    #swagger.parameters['folderName'] = {
-        "description": "Name of folder to update",
+    #swagger.parameters['folderId'] = {
+        "description": "ID of the folder to be updated",
         "required": true,
-        "type": "string"
+        "type": "string",
+        "in": "path"
     }
 
     #swagger.requestBody = {
@@ -253,23 +244,18 @@ export const updateFolderById = async (req: Request, res: Response) => {
                     "properties": {
                         "workspaceId": {
                             "type": "string",
-                            "description": "ID of workspace where to update folder",
+                            "description": "ID of the workspace where the folder is located",
                             "example": "someWorkspaceId"
                         },
                         "environment": {
                             "type": "string",
-                            "description": "Slug of environment where to update folder",
+                            "description": "Environment where the folder is located",
                             "example": "production"
                         },
                         "name": {
                             "type": "string",
-                            "description": "Name of folder to update to",
+                            "description": "New name for the folder",
                             "example": "updated_folder_name"
-                        },
-                        "directory": {
-                            "type": "string",
-                            "description": "Path where to update folder like / or /foo/bar. Default is /",
-                            "example": "/foo/bar"
                         }
                     },
                     "required": ["workspaceId", "environment", "name"]
@@ -286,7 +272,6 @@ export const updateFolderById = async (req: Request, res: Response) => {
                     "properties": {
                         "message": {
                             "type": "string",
-                            "description": "Success message",
                             "example": "Successfully updated folder"
                         },
                         "folder": {
@@ -294,13 +279,11 @@ export const updateFolderById = async (req: Request, res: Response) => {
                             "properties": {
                                 "name": {
                                     "type": "string",
-                                    "description": "Name of updated folder",
                                     "example": "updated_folder_name"
                                 },
                                 "id": {
                                     "type": "string",
-                                    "description": "ID of created folder",
-                                    "example": "abc123"
+                                    "example": "someFolderId"
                                 }
                             },
                             "description": "Details of the updated folder"
@@ -336,11 +319,7 @@ export const updateFolderById = async (req: Request, res: Response) => {
       throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
     }
   } else {
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: new Types.ObjectId(workspaceId)
-    });
-  
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Edit,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: directory })
@@ -411,16 +390,15 @@ export const updateFolderById = async (req: Request, res: Response) => {
  */
 export const deleteFolder = async (req: Request, res: Response) => {
   /* 
-    #swagger.summary = 'Delete folder'
-    #swagger.description = 'Delete folder'
+    #swagger.summary = 'Delete a folder by ID'
+    #swagger.description = 'Delete the specified folder from a specified workspace and environment using its ID'
     
     #swagger.security = [{
-        "apiKeyAuth": [],
-        "bearerAuth": []
+        "apiKeyAuth": []
     }]
 
-    #swagger.parameters['folderName'] = {
-        "description": "Name of folder to delete",
+    #swagger.parameters['folderId'] = {
+        "description": "ID of the folder to be deleted",
         "required": true,
         "type": "string",
         "in": "path"
@@ -434,18 +412,13 @@ export const deleteFolder = async (req: Request, res: Response) => {
                     "properties": {
                         "workspaceId": {
                             "type": "string",
-                            "description": "ID of the workspace where to delete folder",
+                            "description": "ID of the workspace where the folder is located",
                             "example": "someWorkspaceId"
                         },
                         "environment": {
                             "type": "string",
-                            "description": "Slug of environment where to delete folder",
+                            "description": "Environment where the folder is located",
                             "example": "production"
-                        },
-                        "directory": {
-                            "type": "string",
-                            "description": "Path where to delete folder like / or /foo/bar. Default is /",
-                            "example": "/foo/bar"
                         }
                     },
                     "required": ["workspaceId", "environment"]
@@ -462,7 +435,6 @@ export const deleteFolder = async (req: Request, res: Response) => {
                     "properties": {
                         "message": {
                             "type": "string",
-                            "description": "Success message",
                             "example": "successfully deleted folders"
                         },
                         "folders": {
@@ -472,17 +444,15 @@ export const deleteFolder = async (req: Request, res: Response) => {
                                 "properties": {
                                     "id": {
                                         "type": "string",
-                                        "description": "ID of deleted folder",
-                                        "example": "abc123"
+                                        "example": "someFolderId"
                                     },
                                     "name": {
                                         "type": "string",
-                                        "description": "Name of deleted folder",
                                         "example": "someFolderName"
                                     }
                                 }
                             },
-                            "description": "List of IDs and names of deleted folders"
+                            "description": "List of IDs and names of the deleted folders"
                         }
                     }
                 }
@@ -510,11 +480,7 @@ export const deleteFolder = async (req: Request, res: Response) => {
     }
   } else {
     // check that user is a member of the workspace
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: new Types.ObjectId(workspaceId)
-    });
-
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Delete,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: directory })
@@ -577,37 +543,43 @@ export const deleteFolder = async (req: Request, res: Response) => {
 
 /**
  * Get folders for workspace with id [workspaceId] and environment [environment]
- * considering directory/path [directory]
+ * considering [parentFolderId] and [parentFolderPath]
  * @param req
  * @param res
  * @returns
  */
 export const getFolders = async (req: Request, res: Response) => {
   /*
-    #swagger.summary = 'Get folders'
-    #swagger.description = 'Get folders'
+    #swagger.summary = 'Retrieve folders based on specific conditions'
+    #swagger.description = 'Fetches folders from the specified workspace and environment, optionally providing either a parentFolderId or a parentFolderPath to narrow down results'
     
     #swagger.security = [{
-        "apiKeyAuth": [],
-        "bearerAuth": []
+        "apiKeyAuth": []
     }]
 
     #swagger.parameters['workspaceId'] = {
-        "description": "ID of the workspace where to get folders from",
+        "description": "ID of the workspace from which the folders are to be fetched",
         "required": true,
         "type": "string",
         "in": "query"
     }
 
     #swagger.parameters['environment'] = {
-        "description": "Slug of environment where to get folders from",
+        "description": "Environment where the folder is located",
         "required": true,
         "type": "string",
         "in": "query"
     }
 
-    #swagger.parameters['directory'] = {
-        "description": "Path where to get fodlers from like / or /foo/bar. Default is /",
+    #swagger.parameters['parentFolderId'] = {
+        "description": "ID of the parent folder",
+        "required": false,
+        "type": "string",
+        "in": "query"
+    }
+
+    #swagger.parameters['parentFolderPath'] = {
+        "description": "Path of the parent folder, like /folder1/folder2",
         "required": false,
         "type": "string",
         "in": "query"
@@ -635,6 +607,23 @@ export const getFolders = async (req: Request, res: Response) => {
                                 }
                             },
                             "description": "List of folders"
+                        },
+                        "dir": {
+                            "type": "array",
+                            "items": {
+                                "type": "object",
+                                "properties": {
+                                    "name": {
+                                        "type": "string",
+                                        "example": "parentFolderName"
+                                    },
+                                    "id": {
+                                        "type": "string",
+                                        "example": "parentFolderId"
+                                    }
+                                }
+                            },
+                            "description": "List of directories"
                         }
                     }
                 }
@@ -661,10 +650,7 @@ export const getFolders = async (req: Request, res: Response) => {
     }
   } else {
     // check that user is a member of the workspace
-    await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: new Types.ObjectId(workspaceId)
-    });
+    await getUserProjectPermissions(req.user._id, workspaceId);
   }
 
   const folders = await Folder.findOne({ workspace: workspaceId, environment });

backend/src/controllers/v1/signupController.ts

@@ -2,15 +2,16 @@ import { Request, Response } from "express";
 import { AuthMethod, User } from "../../models";
 import { checkEmailVerification, sendEmailVerification } from "../../helpers/signup";
 import { createToken } from "../../helpers/auth";
+import { BadRequestError } from "../../utils/errors";
 import {
-  getAuthSecret,
+  getInviteOnlySignup,
   getJwtSignupLifetime,
+  getJwtSignupSecret,
   getSmtpConfigured
 } from "../../config";
 import { validateUserEmail } from "../../validation";
 import { validateRequest } from "../../helpers/validation";
 import * as reqValidator from "../../validation/auth";
-import { AuthTokenType } from "../../variables";
 
 /**
  * Signup step 1: Initialize account for user under email [email] and send a verification code
@@ -66,6 +67,16 @@ export const verifyEmailSignup = async (req: Request, res: Response) => {
     });
   }
 
+  if (await getInviteOnlySignup()) {
+    // Only one user can create an account without being invited. The rest need to be invited in order to make an account
+    const userCount = await User.countDocuments({});
+    if (userCount != 0) {
+      throw BadRequestError({
+        message: "New user sign ups are not allowed at this time. You must be invited to sign up."
+      });
+    }
+  }
+
   // verify email
   if (await getSmtpConfigured()) {
     await checkEmailVerification({
@@ -84,11 +95,10 @@ export const verifyEmailSignup = async (req: Request, res: Response) => {
   // generate temporary signup token
   const token = createToken({
     payload: {
-      authTokenType: AuthTokenType.SIGNUP_TOKEN,
       userId: user._id.toString()
     },
     expiresIn: await getJwtSignupLifetime(),
-    secret: await getAuthSecret()
+    secret: await getJwtSignupSecret()
   });
 
   return res.status(200).send({

backend/src/controllers/v1/webhookController.ts

@@ -1,36 +1,27 @@
 import { Request, Response } from "express";
 import { Types } from "mongoose";
-import { client, getEncryptionKey, getRootEncryptionKey } from "../../config";
+import { client, getRootEncryptionKey } from "../../config";
 import { Webhook } from "../../models";
 import { getWebhookPayload, triggerWebhookRequest } from "../../services/WebhookService";
 import { BadRequestError, ResourceNotFoundError } from "../../utils/errors";
 import { EEAuditLogService } from "../../ee/services";
 import { EventType } from "../../ee/models";
-import {
-  ALGORITHM_AES_256_GCM,
-  ENCODING_SCHEME_BASE64,
-  ENCODING_SCHEME_UTF8
-} from "../../variables";
+import { ALGORITHM_AES_256_GCM, ENCODING_SCHEME_BASE64 } from "../../variables";
 import { validateRequest } from "../../helpers/validation";
 import * as reqValidator from "../../validation/webhooks";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
-import { encryptSymmetric128BitHexKeyUTF8 } from "../../utils/crypto";
 
 export const createWebhook = async (req: Request, res: Response) => {
   const {
     body: { webhookUrl, webhookSecretKey, environment, workspaceId, secretPath }
   } = await validateRequest(reqValidator.CreateWebhookV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-  
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.Webhooks
@@ -40,31 +31,17 @@ export const createWebhook = async (req: Request, res: Response) => {
     workspace: workspaceId,
     environment,
     secretPath,
-    url: webhookUrl
+    url: webhookUrl,
+    algorithm: ALGORITHM_AES_256_GCM,
+    keyEncoding: ENCODING_SCHEME_BASE64
   });
 
   if (webhookSecretKey) {
-    const encryptionKey = await getEncryptionKey();
     const rootEncryptionKey = await getRootEncryptionKey();
-
-    if (rootEncryptionKey) {
-      const { ciphertext, iv, tag } = client.encryptSymmetric(webhookSecretKey, rootEncryptionKey);
-      webhook.iv = iv;
-      webhook.tag = tag;
-      webhook.encryptedSecretKey = ciphertext;
-      webhook.algorithm = ALGORITHM_AES_256_GCM;
-      webhook.keyEncoding = ENCODING_SCHEME_BASE64;
-    } else if (encryptionKey) {
-      const { ciphertext, iv, tag } = encryptSymmetric128BitHexKeyUTF8({
-        plaintext: webhookSecretKey,
-        key: encryptionKey
-      });
-      webhook.iv = iv;
-      webhook.tag = tag;
-      webhook.encryptedSecretKey = ciphertext;
-      webhook.algorithm = ALGORITHM_AES_256_GCM;
-      webhook.keyEncoding = ENCODING_SCHEME_UTF8;
-    }
+    const { ciphertext, iv, tag } = client.encryptSymmetric(webhookSecretKey, rootEncryptionKey);
+    webhook.iv = iv;
+    webhook.tag = tag;
+    webhook.encryptedSecretKey = ciphertext;
   }
 
   await webhook.save();
@@ -102,11 +79,11 @@ export const updateWebhook = async (req: Request, res: Response) => {
   if (!webhook) {
     throw BadRequestError({ message: "Webhook not found!!" });
   }
-  
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: webhook.workspace
-  });
+
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    webhook.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.Webhooks
@@ -150,11 +127,10 @@ export const deleteWebhook = async (req: Request, res: Response) => {
     throw ResourceNotFoundError({ message: "Webhook not found!!" });
   }
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: webhook.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    webhook.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Delete,
     ProjectPermissionSub.Webhooks
@@ -198,11 +174,10 @@ export const testWebhook = async (req: Request, res: Response) => {
     throw BadRequestError({ message: "Webhook not found!!" });
   }
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: webhook.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    webhook.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Webhooks
@@ -242,12 +217,8 @@ export const listWebhooks = async (req: Request, res: Response) => {
   const {
     query: { environment, workspaceId, secretPath }
   } = await validateRequest(reqValidator.ListWebhooksV1, req);
-  
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-  
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Webhooks

backend/src/controllers/v1/workspaceController.ts

@@ -25,7 +25,7 @@ import * as reqValidator from "../../validation";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 
 /**
@@ -39,11 +39,7 @@ export const getWorkspacePublicKeys = async (req: Request, res: Response) => {
     params: { workspaceId }
   } = await validateRequest(reqValidator.GetWorkspacePublicKeysV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-  
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Member
@@ -76,11 +72,7 @@ export const getWorkspaceMemberships = async (req: Request, res: Response) => {
     params: { workspaceId }
   } = await validateRequest(reqValidator.GetWorkspaceMembershipsV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Member
@@ -203,23 +195,19 @@ export const deleteWorkspace = async (req: Request, res: Response) => {
     params: { workspaceId }
   } = await validateRequest(reqValidator.DeleteWorkspaceV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-  
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Delete,
     ProjectPermissionSub.Workspace
   );
 
   // delete workspace
-  const workspace = await deleteWork({
-    workspaceId: new Types.ObjectId(workspaceId)
+  await deleteWork({
+    id: workspaceId
   });
 
   return res.status(200).send({
-    workspace
+    message: "Successfully deleted workspace"
   });
 };
 
@@ -235,11 +223,7 @@ export const changeWorkspaceName = async (req: Request, res: Response) => {
     body: { name }
   } = await validateRequest(reqValidator.ChangeWorkspaceNameV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.Workspace
@@ -273,12 +257,7 @@ export const getWorkspaceIntegrations = async (req: Request, res: Response) => {
   const {
     params: { workspaceId }
   } = await validateRequest(reqValidator.GetWorkspaceIntegrationsV1, req);
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -304,11 +283,7 @@ export const getWorkspaceIntegrationAuthorizations = async (req: Request, res: R
     params: { workspaceId }
   } = await validateRequest(reqValidator.GetWorkspaceIntegrationAuthorizationsV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -334,11 +309,7 @@ export const getWorkspaceServiceTokens = async (req: Request, res: Response) =>
     params: { workspaceId }
   } = await validateRequest(reqValidator.GetWorkspaceServiceTokensV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.ServiceTokens

backend/src/controllers/v2/authController.ts

@@ -8,9 +8,11 @@ import { createToken, issueAuthTokens } from "../../helpers/auth";
 import { checkUserDevice } from "../../helpers/user";
 import { sendMail } from "../../helpers/nodemailer";
 import { TokenService } from "../../services";
+import { EELogService } from "../../ee/services";
 import { BadRequestError, InternalServerError } from "../../utils/errors";
-import { AuthTokenType, TOKEN_EMAIL_MFA } from "../../variables";
-import { getAuthSecret, getHttpsEnabled, getJwtMfaLifetime } from "../../config";
+import { ACTION_LOGIN, TOKEN_EMAIL_MFA } from "../../variables";
+import { getUserAgentType } from "../../utils/posthog"; // TODO: move this
+import { getHttpsEnabled, getJwtMfaLifetime, getJwtMfaSecret } from "../../config";
 import { validateRequest } from "../../helpers/validation";
 import * as reqValidator from "../../validation/auth";
 
@@ -107,11 +109,10 @@ export const login2 = async (req: Request, res: Response) => {
           // generate temporary MFA token
           const token = createToken({
             payload: {
-              authTokenType: AuthTokenType.MFA_TOKEN,
               userId: user._id.toString()
             },
             expiresIn: await getJwtMfaLifetime(),
-            secret: await getAuthSecret()
+            secret: await getJwtMfaSecret()
           });
 
           const code = await TokenService.createToken({
@@ -188,6 +189,19 @@ export const login2 = async (req: Request, res: Response) => {
           response.protectedKeyTag = user.protectedKeyTag;
         }
 
+        const loginAction = await EELogService.createAction({
+          name: ACTION_LOGIN,
+          userId: user._id
+        });
+
+        loginAction &&
+          (await EELogService.createLog({
+            userId: user._id,
+            actions: [loginAction],
+            channel: getUserAgentType(req.headers["user-agent"]),
+            ipAddress: req.ip
+          }));
+
         return res.status(200).send(response);
       }
 
@@ -315,5 +329,18 @@ export const verifyMfaToken = async (req: Request, res: Response) => {
     resObj.protectedKeyTag = user.protectedKeyTag;
   }
 
+  const loginAction = await EELogService.createAction({
+    name: ACTION_LOGIN,
+    userId: user._id
+  });
+
+  loginAction &&
+    (await EELogService.createLog({
+      userId: user._id,
+      actions: [loginAction],
+      channel: getUserAgentType(req.headers["user-agent"]),
+      ipAddress: req.realIP
+    }));
+
   return res.status(200).send(resObj);
 };

backend/src/controllers/v2/environmentController.ts

@@ -12,15 +12,18 @@ import {
 import { EventType, SecretVersion } from "../../ee/models";
 import { EEAuditLogService, EELicenseService } from "../../ee/services";
 import { BadRequestError, WorkspaceNotFoundError } from "../../utils/errors";
+import _ from "lodash";
+import { PERMISSION_READ_SECRETS, PERMISSION_WRITE_SECRETS } from "../../variables";
 import { validateRequest } from "../../helpers/validation";
 import * as reqValidator from "../../validation/environments";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
 import { SecretImport } from "../../models";
+import { ServiceAccountWorkspacePermission } from "../../models";
 import { Webhook } from "../../models";
 
 /**
@@ -31,21 +34,34 @@ import { Webhook } from "../../models";
  * @returns
  */
 export const createWorkspaceEnvironment = async (req: Request, res: Response) => {
-  /*
+  /* 
     #swagger.summary = 'Create environment'
     #swagger.description = 'Create environment'
-
+    
     #swagger.security = [{
-        "apiKeyAuth": [],
+        "apiKeyAuth": []
     }]
 
 	#swagger.parameters['workspaceId'] = {
-		"description": "ID of workspace where to create environment",
+		"description": "ID of project",
 		"required": true,
-		"type": "string",
-    "in": "path"
-	}
-  
+		"type": "string"
+	} 
+
+  /* 
+    #swagger.summary = 'Create environment'
+    #swagger.description = 'Create environment'
+    
+    #swagger.security = [{
+        "apiKeyAuth": []
+    }]
+
+	#swagger.parameters['workspaceId'] = {
+		"description": "ID of project",
+		"required": true,
+		"type": "string"
+	} 
+
   #swagger.requestBody = {
       content: {
           "application/json": {
@@ -54,12 +70,12 @@ export const createWorkspaceEnvironment = async (req: Request, res: Response) =>
                   "properties": {
                       "environmentName": {
                           "type": "string",
-                          "description": "Name of the environment to create",
+                          "description": "Name of the environment",
                           "example": "development"
                       },
                       "environmentSlug": {
                           "type": "string",
-                          "description": "Slug of environment to create",
+                          "description": "Slug of the environment",
                           "example": "dev-environment"
                       }
                   },
@@ -70,53 +86,45 @@ export const createWorkspaceEnvironment = async (req: Request, res: Response) =>
   }
 
   #swagger.responses[200] = {
-        content: {
-            "application/json": {
-                "schema": {
-                    "type": "object",
-                    "properties": {
-                        "message": {
-                            "type": "string",
-                            "description": "Sucess message",
-                            "example": "Successfully created environment"
-                        },
-                        "workspace": {
-                            "type": "string",
-                            "description": "ID of workspace where environment was created",
-                            "example": "abc123"
-                        },
-                        "environment": {
-                            "type": "object",
-                            "properties": {
-                                "name": {
-                                    "type": "string",
-                                    "description": "Name of created environment",
-                                    "example": "Staging"
-                                },
-                                "slug": {
-                                    "type": "string",
-                                    "description": "Slug of created environment",
-                                    "example": "staging"
-                                }
-                            }
-                        }
-                    },
-                    "description": "Details of the created environment"
-                }
-            }
-        }
-    }
+      content: {
+          "application/json": {
+              "schema": { 
+                  "type": "object",
+                  "properties": {
+                      "message": {
+                          "type": "string",
+                          "example": "Successfully created new environment"
+                      },
+                      "workspace": {
+                          "type": "string",
+                          "example": "someWorkspaceId"
+                      },
+                      "environment": {
+                          "type": "object",
+                          "properties": {
+                              "name": {
+                                  "type": "string",
+                                  "example": "someEnvironmentName"
+                              },
+                              "slug": {
+                                  "type": "string",
+                                  "example": "someEnvironmentSlug"
+                              }
+                          }
+                      }
+                  },
+                  "description": "Response after creating a new environment"
+              }
+          }           
+      }
+  }
   */
   const {
     params: { workspaceId },
     body: { environmentName, environmentSlug }
   } = await validateRequest(reqValidator.CreateWorkspaceEnvironmentV2, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-  
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.Environments
@@ -193,11 +201,7 @@ export const reorderWorkspaceEnvironments = async (req: Request, res: Response)
     body: { environmentName, environmentSlug, otherEnvironmentSlug, otherEnvironmentName }
   } = await validateRequest(reqValidator.ReorderWorkspaceEnvironmentsV2, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.Environments
@@ -242,20 +246,16 @@ export const reorderWorkspaceEnvironments = async (req: Request, res: Response)
  * @returns
  */
 export const renameWorkspaceEnvironment = async (req: Request, res: Response) => {
-  /*
-    #swagger.summary = 'Update environment'
-    #swagger.description = 'Update environment'
-
-    #swagger.security = [{
-        "apiKeyAuth": [],
-    }]
+  /* 
+    #swagger.summary = 'Rename workspace environment'
+    #swagger.description = 'Rename a specific environment within a workspace'
 
     #swagger.parameters['workspaceId'] = {
-      "description": "ID of workspace where to update environment",
-      "required": true,
-      "type": "string",
-      "in": "path"
-    }
+    "description": "ID of the workspace",
+    "required": true,
+    "type": "string",
+        "in": "path"
+  }
 
     #swagger.requestBody = {
         content: {
@@ -265,17 +265,17 @@ export const renameWorkspaceEnvironment = async (req: Request, res: Response) =>
                     "properties": {
                         "environmentName": {
                             "type": "string",
-                            "description": "Name of environment to update to",
+                            "description": "New name for the environment",
                             "example": "Staging-Renamed"
                         },
                         "environmentSlug": {
                             "type": "string",
-                            "description": "Slug of environment to update to",
+                            "description": "New slug for the environment",
                             "example": "staging-renamed"
                         },
                         "oldEnvironmentSlug": {
                             "type": "string",
-                            "description": "Current slug of environment",
+                            "description": "Current slug of the environment to rename",
                             "example": "staging-old"
                         }
                     },
@@ -293,25 +293,21 @@ export const renameWorkspaceEnvironment = async (req: Request, res: Response) =>
                     "properties": {
                         "message": {
                             "type": "string",
-                            "description": "Success message",
                             "example": "Successfully update environment"
                         },
                         "workspace": {
                             "type": "string",
-                            "description": "ID of workspace where environment was updated",
-                            "example": "abc123"
+                            "example": "someWorkspaceId"
                         },
                         "environment": {
                             "type": "object",
                             "properties": {
                                 "name": {
                                     "type": "string",
-                                    "description": "Name of updated environment",
                                     "example": "Staging-Renamed"
                                 },
                                 "slug": {
                                     "type": "string",
-                                    "description": "Slug of updated environment",
                                     "example": "staging-renamed"
                                 }
                             }
@@ -321,18 +317,14 @@ export const renameWorkspaceEnvironment = async (req: Request, res: Response) =>
                 }
             }
         }
-    }
+    }   
   */
   const {
     params: { workspaceId },
     body: { environmentName, environmentSlug, oldEnvironmentSlug }
   } = await validateRequest(reqValidator.UpdateWorkspaceEnvironmentV2, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.Environments
@@ -402,10 +394,10 @@ export const renameWorkspaceEnvironment = async (req: Request, res: Response) =>
     { workspace: workspaceId, environment: oldEnvironmentSlug },
     { environment: environmentSlug }
   );
-  await SecretImport.updateMany(
-    { workspace: workspaceId, "imports.environment": oldEnvironmentSlug },
-    { $set: { "imports.$[element].environment": environmentSlug } },
-    { arrayFilters: [{ "element.environment": oldEnvironmentSlug }] },
+
+  await ServiceAccountWorkspacePermission.updateMany(
+    { workspace: workspaceId, environment: oldEnvironmentSlug },
+    { environment: environmentSlug }
   );
 
   await Webhook.updateMany(
@@ -455,20 +447,20 @@ export const renameWorkspaceEnvironment = async (req: Request, res: Response) =>
  * @returns
  */
 export const deleteWorkspaceEnvironment = async (req: Request, res: Response) => {
-  /*
-    #swagger.summary = 'Delete environment'
-    #swagger.description = 'Delete environment'
-
+  /* 
+    #swagger.summary = 'Delete workspace environment'
+    #swagger.description = 'Delete a specific environment from a workspace'
+    
     #swagger.security = [{
         "apiKeyAuth": []
     }]
 
     #swagger.parameters['workspaceId'] = {
-      "description": "ID of workspace where to delete environment",
-      "required": true,
-      "type": "string",
-      "in": "path"
-	  }
+		"description": "ID of the workspace",
+		"required": true,
+		"type": "string",
+        "in": "path"
+	}
 
     #swagger.requestBody = {
         content: {
@@ -478,8 +470,8 @@ export const deleteWorkspaceEnvironment = async (req: Request, res: Response) =>
                     "properties": {
                         "environmentSlug": {
                             "type": "string",
-                            "description": "Slug of environment to delete",
-                            "example": "dev"
+                            "description": "Slug of the environment to delete",
+                            "example": "dev-environment"
                         }
                     },
                     "required": ["environmentSlug"]
@@ -491,41 +483,34 @@ export const deleteWorkspaceEnvironment = async (req: Request, res: Response) =>
     #swagger.responses[200] = {
         content: {
             "application/json": {
-                "schema": {
+                "schema": { 
                     "type": "object",
                     "properties": {
                         "message": {
                             "type": "string",
-                            "description": "Success message",
                             "example": "Successfully deleted environment"
                         },
                         "workspace": {
                             "type": "string",
-                            "description": "ID of workspace where environment was deleted",
-                            "example": "abc123"
+                            "example": "someWorkspaceId"
                         },
                         "environment": {
                             "type": "string",
-                            "description": "Slug of deleted environment",
-                            "example": "dev"
+                            "example": "dev-environment"
                         }
                     },
                     "description": "Response after deleting an environment from a workspace"
                 }
-            }
+            }           
         }
-    }
+    }   
 */
   const {
     params: { workspaceId },
     body: { environmentSlug }
   } = await validateRequest(reqValidator.DeleteWorkspaceEnvironmentV2, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Delete,
     ProjectPermissionSub.Environments
@@ -601,4 +586,98 @@ export const deleteWorkspaceEnvironment = async (req: Request, res: Response) =>
     workspace: workspaceId,
     environment: environmentSlug
   });
-};
+};
+
+// TODO(akhilmhdh) after rbac this can be completely removed
+export const getAllAccessibleEnvironmentsOfWorkspace = async (req: Request, res: Response) => {
+  /* 
+    #swagger.summary = 'Get all accessible environments of a workspace'
+    #swagger.description = 'Fetch all environments that the user has access to in a specified workspace'
+    
+    #swagger.security = [{
+        "apiKeyAuth": []
+    }]
+
+    #swagger.parameters['workspaceId'] = {
+		"description": "ID of the workspace",
+		"required": true,
+		"type": "string",
+        "in": "path"
+	}
+
+    #swagger.responses[200] = {
+        content: {
+            "application/json": {
+                "schema": {
+                    "type": "object",
+                    "properties": {
+                        "accessibleEnvironments": {
+                            "type": "array",
+                            "items": {
+                                "type": "object",
+                                "properties": {
+                                    "name": {
+                                        "type": "string",
+                                        "example": "Development"
+                                    },
+                                    "slug": {
+                                        "type": "string",
+                                        "example": "development"
+                                    },
+                                    "isWriteDenied": {
+                                        "type": "boolean",
+                                        "example": false
+                                    },
+                                    "isReadDenied": {
+                                        "type": "boolean",
+                                        "example": false
+                                    }
+                                }
+                            }
+                        }
+                    },
+                    "description": "List of environments the user has access to in the specified workspace"
+                }
+            }
+        }
+    }   
+  */
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetAllAccessibileEnvironmentsOfWorkspaceV2, req);
+
+  const { membership: workspacesUserIsMemberOf } = await getUserProjectPermissions(
+    req.user._id,
+    workspaceId
+  );
+
+  const accessibleEnvironments: any = [];
+  const deniedPermission = workspacesUserIsMemberOf.deniedPermissions;
+
+  const relatedWorkspace = await Workspace.findById(workspaceId);
+  if (!relatedWorkspace) {
+    throw BadRequestError();
+  }
+  relatedWorkspace.environments.forEach((environment) => {
+    const isReadBlocked = _.some(deniedPermission, {
+      environmentSlug: environment.slug,
+      ability: PERMISSION_READ_SECRETS
+    });
+    const isWriteBlocked = _.some(deniedPermission, {
+      environmentSlug: environment.slug,
+      ability: PERMISSION_WRITE_SECRETS
+    });
+    if (isReadBlocked && isWriteBlocked) {
+      return;
+    } else {
+      accessibleEnvironments.push({
+        name: environment.name,
+        slug: environment.slug,
+        isWriteDenied: isWriteBlocked,
+        isReadDenied: isReadBlocked
+      });
+    }
+  });
+
+  res.json({ accessibleEnvironments });
+};

backend/src/controllers/v2/index.ts

@@ -6,20 +6,20 @@ import * as workspaceController from "./workspaceController";
 import * as serviceTokenDataController from "./serviceTokenDataController";
 import * as secretController from "./secretController";
 import * as secretsController from "./secretsController";
+import * as serviceAccountsController from "./serviceAccountsController";
 import * as environmentController from "./environmentController";
 import * as tagController from "./tagController";
-import * as membershipController from "./membershipController";
 
 export {
-  authController,
-  signupController,
-  usersController,
-  organizationsController,
-  workspaceController,
-  serviceTokenDataController,
-  secretController,
-  secretsController,
-  environmentController,
-  tagController,
-  membershipController
-};
+    authController,
+    signupController,
+    usersController,
+    organizationsController,
+    workspaceController,
+    serviceTokenDataController,
+    secretController,
+    secretsController,
+    serviceAccountsController,
+    environmentController,
+    tagController,
+}

backend/src/controllers/v2/membershipController.ts

@@ -1,107 +0,0 @@
-import { ForbiddenError } from "@casl/ability";
-import { Request, Response } from "express";
-import { Types } from "mongoose";
-
-import { getSiteURL } from "../../config";
-import { EventType } from "../../ee/models";
-import { EEAuditLogService } from "../../ee/services";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSub,
-  getAuthDataProjectPermissions
-} from "../../ee/services/ProjectRoleService";
-import { sendMail } from "../../helpers";
-import { validateRequest } from "../../helpers/validation";
-import { IUser, Key, Membership, MembershipOrg, Workspace } from "../../models";
-import { BadRequestError } from "../../utils/errors";
-import * as reqValidator from "../../validation/membership";
-import { ACCEPTED, MEMBER } from "../../variables";
-
-export const addUserToWorkspace = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId },
-    body: { members }
-  } = await validateRequest(reqValidator.AddUserToWorkspaceV2, req);
-  // check workspace
-  const workspace = await Workspace.findById(workspaceId);
-  if (!workspace) throw new Error("Failed to find workspace");
-
-  // check permission
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-  
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Create,
-    ProjectPermissionSub.Member
-  );
-
-  // validate members are part of the organization
-  const orgMembers = await MembershipOrg.find({
-    status: ACCEPTED,
-    _id: { $in: members.map(({ orgMembershipId }) => orgMembershipId) },
-    organization: workspace.organization
-  })
-    .populate<{ user: IUser }>("user")
-    .select({ _id: 1, user: 1 })
-    .lean();
-  if (orgMembers.length !== members.length)
-    throw BadRequestError({ message: "Org member not found" });
-
-  const existingMember = await Membership.find({
-    workspace: workspaceId,
-    user: { $in: orgMembers.map(({ user }) => user) }
-  });
-  if (existingMember?.length)
-    throw BadRequestError({ message: "Some users are already part of workspace" });
-
-  await Membership.insertMany(
-    orgMembers.map(({ user }) => ({ user: user._id, workspace: workspaceId, role: MEMBER }))
-  );
-
-  const encKeyGroupedByOrgMemberId = members.reduce<Record<string, (typeof members)[number]>>(
-    (prev, curr) => ({ ...prev, [curr.orgMembershipId]: curr }),
-    {}
-  );
-  await Key.insertMany(
-    orgMembers.map(({ user, _id: id }) => ({
-      encryptedKey: encKeyGroupedByOrgMemberId[id.toString()].workspaceEncryptedKey,
-      nonce: encKeyGroupedByOrgMemberId[id.toString()].workspaceEncryptedNonce,
-      sender: req.user._id,
-      receiver: user._id,
-      workspace: workspaceId
-    }))
-  );
-
-  await sendMail({
-    template: "workspaceInvitation.handlebars",
-    subjectLine: "Infisical workspace invitation",
-    recipients: orgMembers.map(({ user }) => user.email),
-    substitutions: {
-      inviterFirstName: req.user.firstName,
-      inviterEmail: req.user.email,
-      workspaceName: workspace.name,
-      callback_url: (await getSiteURL()) + "/login"
-    }
-  });
-
-  await EEAuditLogService.createAuditLog(
-    req.authData,
-    {
-      type: EventType.ADD_BATCH_WORKSPACE_MEMBER,
-      metadata: orgMembers.map(({ user }) => ({
-        userId: user._id.toString(),
-        email: user.email
-      }))
-    },
-    {
-      workspaceId: new Types.ObjectId(workspaceId)
-    }
-  );
-
-  return res.status(200).send({
-    success: true,
-    data: orgMembers
-  });
-};

backend/src/controllers/v2/organizationsController.ts

@@ -1,16 +1,11 @@
 import { Request, Response } from "express";
 import { Types } from "mongoose";
-import { Membership, MembershipOrg, Workspace } from "../../models";
-import { Role } from "../../ee/models";
+import { Membership, MembershipOrg, ServiceAccount, Workspace } from "../../models";
 import { deleteMembershipOrg } from "../../helpers/membershipOrg";
-import {
-  createOrganization as create,
-  deleteOrganization,
-  updateSubscriptionOrgQuantity
-} from "../../helpers/organization";
-import { addMembershipsOrg } from "../../helpers/membershipOrg";
-import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
-import { ACCEPTED, ADMIN, CUSTOM } from "../../variables";
+import { updateSubscriptionOrgQuantity } from "../../helpers/organization";
+import Role from "../../ee/models/role";
+import { BadRequestError } from "../../utils/errors";
+import { CUSTOM } from "../../variables";
 import * as reqValidator from "../../validation/organization";
 import { validateRequest } from "../../helpers/validation";
 import {
@@ -147,7 +142,7 @@ export const updateOrganizationMembership = async (req: Request, res: Response)
     OrgPermissionSubjects.Member
   );
 
-  const isCustomRole = !["admin", "member"].includes(role);
+  const isCustomRole = !["admin", "member", "owner"].includes(role);
   if (isCustomRole) {
     const orgRole = await Role.findOne({ slug: role, isOrgRole: true });
     if (!orgRole) throw BadRequestError({ message: "Role not found" });
@@ -322,58 +317,18 @@ export const getOrganizationWorkspaces = async (req: Request, res: Response) =>
 };
 
 /**
- * Create new organization named [organizationName]
- * and add user as owner
- * @param req
- * @param res
- * @returns
- */
-export const createOrganization = async (req: Request, res: Response) => {
-  const {
-    body: { name }
-  } = await validateRequest(reqValidator.CreateOrgv2, req);
-
-  // create organization and add user as member
-  const organization = await create({
-    email: req.user.email,
-    name
-  });
-
-  await addMembershipsOrg({
-    userIds: [req.user._id.toString()],
-    organizationId: organization._id.toString(),
-    roles: [ADMIN],
-    statuses: [ACCEPTED]
-  });
-
-  return res.status(200).send({
-    organization
-  });
-};
-
-/**
- * Delete organization with id [organizationId]
+ * Return service accounts for organization with id [organizationId]
  * @param req
  * @param res
  */
-export const deleteOrganizationById = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId }
-  } = await validateRequest(reqValidator.DeleteOrgv2, req);
+export const getOrganizationServiceAccounts = async (req: Request, res: Response) => {
+  const { organizationId } = req.params;
 
-  const membershipOrg = await MembershipOrg.findOne({
-    user: req.user._id,
-    organization: new Types.ObjectId(organizationId),
-    role: ADMIN
-  });
-
-  if (!membershipOrg) throw UnauthorizedRequestError();
-
-  const organization = await deleteOrganization({
-    organizationId: new Types.ObjectId(organizationId)
+  const serviceAccounts = await ServiceAccount.find({
+    organization: new Types.ObjectId(organizationId)
   });
 
   return res.status(200).send({
-    organization
+    serviceAccounts
   });
 };

backend/src/controllers/v2/secretController.ts

@@ -11,6 +11,7 @@ import {
   ValidationError as RouteValidationError,
   UnauthorizedRequestError
 } from "../../utils/errors";
+import { AnyBulkWriteOperation } from "mongodb";
 import {
   ALGORITHM_AES_256_GCM,
   ENCODING_SCHEME_UTF8,
@@ -18,7 +19,7 @@ import {
   SECRET_SHARED
 } from "../../variables";
 import { TelemetryService } from "../../services";
-import { Secret, User } from "../../models";
+import { ISecret, Secret, User } from "../../models";
 import { AccountNotFoundError } from "../../utils/errors";
 
 /**
@@ -144,22 +145,22 @@ export const deleteSecrets = async (req: Request, res: Response) => {
   const secretsUserCanDeleteSet: Set<string> = new Set(
     secretIdsUserCanDelete.map((objectId) => objectId._id.toString())
   );
+  const deleteOperationsToPerform: AnyBulkWriteOperation<ISecret>[] = [];
 
-  // Filter out IDs that user can delete and then map them to delete operations
-  const deleteOperationsToPerform = secretIdsToDelete
-    .filter(secretIdToDelete => {
-      if (!secretsUserCanDeleteSet.has(secretIdToDelete)) {
-        throw RouteValidationError({
-          message: "You cannot delete secrets that you do not have access to"
-        });
-      }
-      return true;
-    })
-    .map(secretIdToDelete => ({
-      deleteOne: { filter: { _id: new Types.ObjectId(secretIdToDelete) } }
-    }));
-
-  const numSecretsDeleted = deleteOperationsToPerform.length;
+  let numSecretsDeleted = 0;
+  secretIdsToDelete.forEach((secretIdToDelete) => {
+    if (secretsUserCanDeleteSet.has(secretIdToDelete)) {
+      const deleteOperation = {
+        deleteOne: { filter: { _id: new Types.ObjectId(secretIdToDelete) } }
+      };
+      deleteOperationsToPerform.push(deleteOperation);
+      numSecretsDeleted++;
+    } else {
+      throw RouteValidationError({
+        message: "You cannot delete secrets that you do not have access to"
+      });
+    }
+  });
 
   await Secret.bulkWrite(deleteOperationsToPerform);
 

backend/src/controllers/v2/secretsController.ts

@@ -1,8 +1,12 @@
 import { Types } from "mongoose";
 import { Request, Response } from "express";
 import { Folder, ISecret, Secret, ServiceTokenData, Tag } from "../../models";
-import { AuditLog, EventType, SecretVersion } from "../../ee/models";
+import { AuditLog, EventType, IAction, SecretVersion } from "../../ee/models";
 import {
+  ACTION_ADD_SECRETS,
+  ACTION_DELETE_SECRETS,
+  ACTION_READ_SECRETS,
+  ACTION_UPDATE_SECRETS,
   ALGORITHM_AES_256_GCM,
   ENCODING_SCHEME_UTF8,
   K8_USER_AGENT_NAME,
@@ -11,7 +15,7 @@ import {
 import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
 import { EventService } from "../../services";
 import { eventPushSecrets } from "../../events";
-import { EEAuditLogService, EESecretService } from "../../ee/services";
+import { EEAuditLogService, EELogService, EESecretService } from "../../ee/services";
 import { SecretService, TelemetryService } from "../../services";
 import { getUserAgentType } from "../../utils/posthog";
 import { PERMISSION_WRITE_SECRETS } from "../../variables";
@@ -39,7 +43,7 @@ import {
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError, subject } from "@casl/ability";
 
@@ -78,6 +82,7 @@ export const batchSecrets = async (req: Request, res: Response) => {
   const createSecrets: any[] = [];
   const updateSecrets: any[] = [];
   const deleteSecrets: { _id: Types.ObjectId; secretName: string }[] = [];
+  const actions: IAction[] = [];
 
   // get secret blind index salt
   const salt = await SecretService.getSecretBlindIndexSalt({
@@ -159,11 +164,7 @@ export const batchSecrets = async (req: Request, res: Response) => {
   }
   // not using service token  using auth
   if (!(req.authData.authPayload instanceof ServiceTokenData)) {
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: new Types.ObjectId(workspaceId)
-    });
-
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
     if (createSecrets.length)
       ForbiddenError.from(permission).throwUnlessCan(
         ProjectPermissionActions.Create,
@@ -223,6 +224,16 @@ export const batchSecrets = async (req: Request, res: Response) => {
 
     await AuditLog.insertMany(auditLogs);
 
+    const addAction = (await EELogService.createAction({
+      name: ACTION_ADD_SECRETS,
+      userId: req.user?._id,
+      serviceAccountId: req.serviceAccount?._id,
+      serviceTokenDataId: req.serviceTokenData?._id,
+      workspaceId: new Types.ObjectId(workspaceId),
+      secretIds: createdSecrets.map((n) => n._id)
+    })) as IAction;
+    actions.push(addAction);
+
     if (postHogClient) {
       postHogClient.capture({
         event: "secrets added",
@@ -339,6 +350,14 @@ export const batchSecrets = async (req: Request, res: Response) => {
 
     await AuditLog.insertMany(auditLogs);
 
+    const updateAction = (await EELogService.createAction({
+      name: ACTION_UPDATE_SECRETS,
+      userId: req.user._id,
+      workspaceId: new Types.ObjectId(workspaceId),
+      secretIds: updatedSecrets.map((u) => u._id)
+    })) as IAction;
+    actions.push(updateAction);
+
     if (postHogClient) {
       postHogClient.capture({
         event: "secrets modified",
@@ -409,6 +428,14 @@ export const batchSecrets = async (req: Request, res: Response) => {
 
     await AuditLog.insertMany(auditLogs);
 
+    const deleteAction = (await EELogService.createAction({
+      name: ACTION_DELETE_SECRETS,
+      userId: req.user._id,
+      workspaceId: new Types.ObjectId(workspaceId),
+      secretIds: deleteSecretIds
+    })) as IAction;
+    actions.push(deleteAction);
+
     if (postHogClient) {
       postHogClient.capture({
         event: "secrets deleted",
@@ -424,6 +451,17 @@ export const batchSecrets = async (req: Request, res: Response) => {
     }
   }
 
+  if (actions.length > 0) {
+    // (EE) create (audit) log
+    await EELogService.createLog({
+      userId: req.user._id.toString(),
+      workspaceId: new Types.ObjectId(workspaceId),
+      actions,
+      channel,
+      ipAddress: req.realIP
+    });
+  }
+
   // // trigger event - push secrets
   await EventService.handleEvent({
     event: eventPushSecrets({
@@ -693,6 +731,27 @@ export const createSecrets = async (req: Request, res: Response) => {
     )
   });
 
+  const addAction = await EELogService.createAction({
+    name: ACTION_ADD_SECRETS,
+    userId: req.user?._id,
+    serviceAccountId: req.serviceAccount?._id,
+    serviceTokenDataId: req.serviceTokenData?._id,
+    workspaceId: new Types.ObjectId(workspaceId),
+    secretIds: newlyCreatedSecrets.map((n) => n._id)
+  });
+
+  // (EE) create (audit) log
+  addAction &&
+    (await EELogService.createLog({
+      userId: req.user?._id,
+      serviceAccountId: req.serviceAccount?._id,
+      serviceTokenDataId: req.serviceTokenData?._id,
+      workspaceId: new Types.ObjectId(workspaceId),
+      actions: [addAction],
+      channel,
+      ipAddress: req.realIP
+    }));
+
   // (EE) take a secret snapshot
   await EESecretService.takeSecretSnapshot({
     workspaceId: new Types.ObjectId(workspaceId),
@@ -901,6 +960,22 @@ export const getSecrets = async (req: Request, res: Response) => {
     secrets = await Secret.find(secretQuery).populate("tags");
   }
 
+  // case: client authorization is via service account
+  if (req.serviceAccount) {
+    const secretQuery: any = {
+      workspace: workspaceId,
+      environment,
+      folder: folderId,
+      user: { $exists: false } // shared secrets only from workspace
+    };
+
+    if (tagIds.length > 0) {
+      secretQuery.tags = { $in: tagIds };
+    }
+
+    secrets = await Secret.find(secretQuery).populate("tags");
+  }
+
   // TODO(akhilmhdh) - secret-imp change this to org type
   let importedSecrets: any[] = [];
   if (include_imports) {
@@ -913,6 +988,28 @@ export const getSecrets = async (req: Request, res: Response) => {
     );
   }
 
+  const channel = getUserAgentType(req.headers["user-agent"]);
+
+  const readAction = await EELogService.createAction({
+    name: ACTION_READ_SECRETS,
+    userId: req.user?._id,
+    serviceAccountId: req.serviceAccount?._id,
+    serviceTokenDataId: req.serviceTokenData?._id,
+    workspaceId: new Types.ObjectId(workspaceId as string),
+    secretIds: secrets.map((n: any) => n._id)
+  });
+
+  readAction &&
+    (await EELogService.createLog({
+      userId: req.user?._id,
+      serviceAccountId: req.serviceAccount?._id,
+      serviceTokenDataId: req.serviceTokenData?._id,
+      workspaceId: new Types.ObjectId(workspaceId as string),
+      actions: [readAction],
+      channel,
+      ipAddress: req.realIP
+    }));
+
   await EEAuditLogService.createAuditLog(
     req.authData,
     {
@@ -1150,6 +1247,27 @@ export const updateSecrets = async (req: Request, res: Response) => {
     //   });
     // }, 10000);
 
+    const updateAction = await EELogService.createAction({
+      name: ACTION_UPDATE_SECRETS,
+      userId: req.user?._id,
+      serviceAccountId: req.serviceAccount?._id,
+      serviceTokenDataId: req.serviceTokenData?._id,
+      workspaceId: new Types.ObjectId(key),
+      secretIds: workspaceSecretObj[key].map((secret: ISecret) => secret._id)
+    });
+
+    // (EE) create (audit) log
+    updateAction &&
+      (await EELogService.createLog({
+        userId: req.user?._id,
+        serviceAccountId: req.serviceAccount?._id,
+        serviceTokenDataId: req.serviceTokenData?._id,
+        workspaceId: new Types.ObjectId(key),
+        actions: [updateAction],
+        channel,
+        ipAddress: req.realIP
+      }));
+
     // (EE) take a secret snapshot
     // IMP(akhilmhdh): commented out due to unknown where the environment is
     // await EESecretService.takeSecretSnapshot({
@@ -1269,6 +1387,26 @@ export const deleteSecrets = async (req: Request, res: Response) => {
     //     workspaceId: new Types.ObjectId(key)
     //   })
     // });
+    const deleteAction = await EELogService.createAction({
+      name: ACTION_DELETE_SECRETS,
+      userId: req.user?._id,
+      serviceAccountId: req.serviceAccount?._id,
+      serviceTokenDataId: req.serviceTokenData?._id,
+      workspaceId: new Types.ObjectId(key),
+      secretIds: workspaceSecretObj[key].map((secret: ISecret) => secret._id)
+    });
+
+    // (EE) create (audit) log
+    deleteAction &&
+      (await EELogService.createLog({
+        userId: req.user?._id,
+        serviceAccountId: req.serviceAccount?._id,
+        serviceTokenDataId: req.serviceTokenData?._id,
+        workspaceId: new Types.ObjectId(key),
+        actions: [deleteAction],
+        channel,
+        ipAddress: req.realIP
+      }));
 
     // (EE) take a secret snapshot
     // IMP(akhilmhdh): Not sure how to take secretSnapshot

backend/src/controllers/v2/serviceAccountsController.ts

@@ -0,0 +1,306 @@
+import { Request, Response } from "express";
+import { Types } from "mongoose";
+import crypto from "crypto";
+import bcrypt from "bcrypt";
+import {
+    ServiceAccount,
+    ServiceAccountKey,
+    ServiceAccountOrganizationPermission,
+    ServiceAccountWorkspacePermission,
+} from "../../models";
+import {
+    CreateServiceAccountDto,
+} from "../../interfaces/serviceAccounts/dto";
+import { BadRequestError, ServiceAccountNotFoundError } from "../../utils/errors";
+import { getSaltRounds } from "../../config";
+
+/**
+ * Return service account tied to the request (service account) client
+ * @param req
+ * @param res
+ */
+export const getCurrentServiceAccount = async (req: Request, res: Response) => {
+    const serviceAccount = await ServiceAccount.findById(req.serviceAccount._id);
+
+    if (!serviceAccount) {
+        throw ServiceAccountNotFoundError({ message: "Failed to find service account" });
+    }
+
+    return res.status(200).send({
+        serviceAccount,
+    });
+}
+
+/**
+ * Return service account with id [serviceAccountId]
+ * @param req 
+ * @param res 
+ */
+export const getServiceAccountById = async (req: Request, res: Response) => {
+    const { serviceAccountId } = req.params;
+
+    const serviceAccount = await ServiceAccount.findById(serviceAccountId);
+
+    if (!serviceAccount) {
+        throw ServiceAccountNotFoundError({ message: "Failed to find service account" });
+    }
+
+    return res.status(200).send({
+        serviceAccount,
+    });
+}
+
+/**
+ * Create a new service account under organization with id [organizationId]
+ * that has access to workspaces [workspaces]
+ * @param req 
+ * @param res 
+ * @returns
+ */
+export const createServiceAccount = async (req: Request, res: Response) => {
+    const {
+        name,
+        organizationId,
+        publicKey,
+        expiresIn,
+    }: CreateServiceAccountDto = req.body;
+
+    let expiresAt;
+    if (expiresIn) {
+        expiresAt = new Date();
+        expiresAt.setSeconds(expiresAt.getSeconds() + expiresIn);
+    }
+
+    const secret = crypto.randomBytes(16).toString("base64");
+    const secretHash = await bcrypt.hash(secret, await getSaltRounds());
+
+    // create service account
+    const serviceAccount = await new ServiceAccount({
+        name,
+        organization: new Types.ObjectId(organizationId),
+        user: req.user,
+        publicKey,
+        lastUsed: new Date(),
+        expiresAt,
+        secretHash,
+    }).save()
+
+    const serviceAccountObj = serviceAccount.toObject();
+
+    delete (serviceAccountObj as any).secretHash;
+
+    // provision default org-level permission for service account
+    await new ServiceAccountOrganizationPermission({
+        serviceAccount: serviceAccount._id,
+    }).save();
+
+    const secretId = Buffer.from(serviceAccount._id.toString(), "hex").toString("base64");
+
+    return res.status(200).send({
+        serviceAccountAccessKey: `sa.${secretId}.${secret}`,
+        serviceAccount: serviceAccountObj,
+    });
+}
+
+/**
+ * Change name of service account with id [serviceAccountId] to [name]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const changeServiceAccountName = async (req: Request, res: Response) => {
+    const { serviceAccountId } = req.params;
+    const { name } = req.body;
+
+    const serviceAccount = await ServiceAccount.findOneAndUpdate(
+        {
+            _id: new Types.ObjectId(serviceAccountId),
+        },
+        {
+            name,
+        },
+        {
+            new: true,
+        }
+    );
+
+    return res.status(200).send({
+        serviceAccount,
+    });
+}
+
+/**
+ * Add a service account key to service account with id [serviceAccountId]
+ * for workspace with id [workspaceId]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const addServiceAccountKey = async (req: Request, res: Response) => {
+    const {
+        workspaceId,
+        encryptedKey,
+        nonce,
+    } = req.body;
+
+    const serviceAccountKey = await new ServiceAccountKey({
+        encryptedKey,
+        nonce,
+        sender: req.user._id,
+        serviceAccount: req.serviceAccount._d,
+        workspace: new Types.ObjectId(workspaceId),
+    }).save();
+
+    return serviceAccountKey;
+}
+
+/**
+ * Return workspace-level permission for service account with id [serviceAccountId]
+ * @param req 
+ * @param res 
+ */
+export const getServiceAccountWorkspacePermissions = async (req: Request, res: Response) => {
+    const serviceAccountWorkspacePermissions = await ServiceAccountWorkspacePermission.find({
+        serviceAccount: req.serviceAccount._id,
+    }).populate("workspace");
+
+    return res.status(200).send({
+        serviceAccountWorkspacePermissions,
+    });
+}
+
+/**
+ * Add a workspace permission to service account with id [serviceAccountId]
+ * @param req 
+ * @param res 
+ */
+export const addServiceAccountWorkspacePermission = async (req: Request, res: Response) => {
+    const { serviceAccountId } = req.params;
+    const {
+        environment,
+        workspaceId,
+        read = false,
+        write = false,
+        encryptedKey,
+        nonce,
+    } = req.body;
+
+    if (!req.membership.workspace.environments.some((e: { name: string; slug: string }) => e.slug === environment)) {
+        return res.status(400).send({
+            message: "Failed to validate workspace environment",
+        });
+    }
+
+    const existingPermission = await ServiceAccountWorkspacePermission.findOne({
+        serviceAccount: new Types.ObjectId(serviceAccountId),
+        workspace: new Types.ObjectId(workspaceId),
+        environment,
+    });
+
+    if (existingPermission) throw BadRequestError({ message: "Failed to add workspace permission to service account due to already-existing " });
+
+    const serviceAccountWorkspacePermission = await new ServiceAccountWorkspacePermission({
+        serviceAccount: new Types.ObjectId(serviceAccountId),
+        workspace: new Types.ObjectId(workspaceId),
+        environment,
+        read,
+        write,
+    }).save();
+
+    const existingServiceAccountKey = await ServiceAccountKey.findOne({
+        serviceAccount: new Types.ObjectId(serviceAccountId),
+        workspace: new Types.ObjectId(workspaceId),
+    });
+
+    if (!existingServiceAccountKey) {
+        await new ServiceAccountKey({
+            encryptedKey,
+            nonce,
+            sender: req.user._id,
+            serviceAccount: new Types.ObjectId(serviceAccountId),
+            workspace: new Types.ObjectId(workspaceId),
+        }).save();
+    }
+
+    return res.status(200).send({
+        serviceAccountWorkspacePermission,
+    });
+}
+
+/**
+ * Delete workspace permission from service account with id [serviceAccountId]
+ * @param req 
+ * @param res 
+ */
+export const deleteServiceAccountWorkspacePermission = async (req: Request, res: Response) => {
+    const { serviceAccountWorkspacePermissionId } = req.params;
+    const serviceAccountWorkspacePermission = await ServiceAccountWorkspacePermission.findByIdAndDelete(serviceAccountWorkspacePermissionId);
+
+    if (serviceAccountWorkspacePermission) {
+        const { serviceAccount, workspace } = serviceAccountWorkspacePermission;
+        const count = await ServiceAccountWorkspacePermission.countDocuments({
+            serviceAccount,
+            workspace,
+        });
+
+        if (count === 0) {
+            await ServiceAccountKey.findOneAndDelete({
+                serviceAccount,
+                workspace,
+            });
+        }
+    }
+
+    return res.status(200).send({
+        serviceAccountWorkspacePermission,
+    });
+}
+
+/**
+ * Delete service account with id [serviceAccountId]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const deleteServiceAccount = async (req: Request, res: Response) => {
+    const { serviceAccountId } = req.params;
+
+    const serviceAccount = await ServiceAccount.findByIdAndDelete(serviceAccountId);
+
+    if (serviceAccount) {
+        await ServiceAccountKey.deleteMany({
+            serviceAccount: serviceAccount._id,
+        });
+
+        await ServiceAccountOrganizationPermission.deleteMany({
+            serviceAccount: new Types.ObjectId(serviceAccountId),
+        });
+
+        await ServiceAccountWorkspacePermission.deleteMany({
+            serviceAccount: new Types.ObjectId(serviceAccountId),
+        });
+    }
+
+    return res.status(200).send({
+        serviceAccount,
+    });
+}
+
+/**
+ * Return service account keys for service account with id [serviceAccountId]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const getServiceAccountKeys = async (req: Request, res: Response) => {
+    const workspaceId = req.query.workspaceId as string;
+
+    const serviceAccountKeys = await ServiceAccountKey.find({
+        serviceAccount: req.serviceAccount._id,
+        ...(workspaceId ? { workspace: new Types.ObjectId(workspaceId) } : {}),
+    });
+
+    return res.status(200).send({
+        serviceAccountKeys,
+    });
+}

backend/src/controllers/v2/serviceTokenDataController.ts

@@ -11,7 +11,7 @@ import * as reqValidator from "../../validation/serviceTokenData";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
 import { Types } from "mongoose";
@@ -75,12 +75,7 @@ export const createServiceTokenData = async (req: Request, res: Response) => {
   const {
     body: { workspaceId, permissions, tag, encryptedKey, scopes, name, expiresIn, iv }
   } = await validateRequest(reqValidator.CreateServiceTokenV2, req);
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.ServiceTokens
@@ -156,11 +151,10 @@ export const deleteServiceTokenData = async (req: Request, res: Response) => {
   let serviceTokenData = await ServiceTokenData.findById(serviceTokenDataId);
   if (!serviceTokenData) throw BadRequestError({ message: "Service token not found" });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: serviceTokenData.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    serviceTokenData.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Delete,
     ProjectPermissionSub.ServiceTokens

backend/src/controllers/v2/tagController.ts

@@ -7,7 +7,7 @@ import { validateRequest } from "../../helpers/validation";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import * as reqValidator from "../../validation/tags";
 
@@ -17,11 +17,7 @@ export const createWorkspaceTag = async (req: Request, res: Response) => {
     params: { workspaceId }
   } = await validateRequest(reqValidator.CreateWorkspaceTagsV2, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.Tags
@@ -49,11 +45,10 @@ export const deleteWorkspaceTag = async (req: Request, res: Response) => {
     throw BadRequestError();
   }
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: tagFromDB.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    tagFromDB.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Delete,
     ProjectPermissionSub.Tags
@@ -71,12 +66,7 @@ export const getWorkspaceTags = async (req: Request, res: Response) => {
   const {
     params: { workspaceId }
   } = await validateRequest(reqValidator.GetWorkspaceTagsV2, req);
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Tags

backend/src/controllers/v2/usersController.ts

@@ -5,9 +5,49 @@ import bcrypt from "bcrypt";
 import { APIKeyData, AuthMethod, MembershipOrg, TokenVersion, User } from "../../models";
 import { getSaltRounds } from "../../config";
 import { validateRequest } from "../../helpers/validation";
-import { deleteUser } from "../../helpers/user";
 import * as reqValidator from "../../validation";
 
+/**
+ * Return the current user.
+ * @param req
+ * @param res
+ * @returns
+ */
+export const getMe = async (req: Request, res: Response) => {
+  /* 
+    #swagger.summary = "Retrieve the current user on the request"
+    #swagger.description = "Retrieve the current user on the request"
+    
+    #swagger.security = [{
+        "apiKeyAuth": []
+    }]
+
+    #swagger.responses[200] = {
+        content: {
+            "application/json": {
+                "schema": { 
+                    "type": "object",
+                    "properties": {
+                        "user": {
+                            "type": "object",
+                            $ref: "#/components/schemas/CurrentUser",
+                            "description": "Current user on request"
+                        }
+                    }
+                }
+            }           
+        }
+    }   
+    */
+  const user = await User.findById(req.user._id).select(
+    "+salt +publicKey +encryptedPrivateKey +iv +tag +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag"
+  );
+
+  return res.status(200).send({
+    user
+  });
+};
+
 /**
  * Update the current user's MFA-enabled status [isMfaEnabled].
  * Note: Infisical currently only supports email-based 2FA only; this will expand to
@@ -256,59 +296,3 @@ export const deleteMySessions = async (req: Request, res: Response) => {
     message: "Successfully revoked all sessions"
   });
 };
-
-/**
- * Return the current user.
- * @param req
- * @param res
- * @returns
- */
- export const getMe = async (req: Request, res: Response) => {
-  /* 
-    #swagger.summary = "Retrieve the current user on the request"
-    #swagger.description = "Retrieve the current user on the request"
-    
-    #swagger.security = [{
-        "apiKeyAuth": []
-    }]
-
-    #swagger.responses[200] = {
-        content: {
-            "application/json": {
-                "schema": { 
-                    "type": "object",
-                    "properties": {
-                        "user": {
-                            "type": "object",
-                            $ref: "#/components/schemas/CurrentUser",
-                            "description": "Current user on request"
-                        }
-                    }
-                }
-            }           
-        }
-    }   
-    */
-  const user = await User.findById(req.user._id).select(
-    "+salt +publicKey +encryptedPrivateKey +iv +tag +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag"
-  );
-
-  return res.status(200).send({
-    user
-  });
-};
-
-/**
- * Delete the current user.
- * @param req 
- * @param res 
- */
-export const deleteMe = async (req: Request, res: Response) => {
-  const user = await deleteUser({
-    userId: req.user._id
-  });
-
-  return res.status(200).send({
-    user
-  });
-}

backend/src/controllers/v2/workspaceController.ts

@@ -16,7 +16,7 @@ import * as reqValidator from "../../validation";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
 
@@ -272,11 +272,7 @@ export const getWorkspaceMemberships = async (req: Request, res: Response) => {
     params: { workspaceId }
   } = await validateRequest(reqValidator.GetWorkspaceMembershipsV2, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Member
@@ -356,11 +352,7 @@ export const updateWorkspaceMembership = async (req: Request, res: Response) =>
     body: { role }
   } = await validateRequest(reqValidator.UpdateWorkspaceMembershipsV2, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.Member
@@ -428,11 +420,7 @@ export const deleteWorkspaceMembership = async (req: Request, res: Response) =>
     params: { workspaceId, membershipId }
   } = await validateRequest(reqValidator.DeleteWorkspaceMembershipsV2, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Delete,
     ProjectPermissionSub.Member
@@ -464,11 +452,7 @@ export const toggleAutoCapitalization = async (req: Request, res: Response) => {
     body: { autoCapitalization }
   } = await validateRequest(reqValidator.ToggleAutoCapitalizationV2, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.Settings

backend/src/controllers/v3/authController.ts

@@ -8,9 +8,11 @@ import { createToken, issueAuthTokens, validateProviderAuthToken } from "../../h
 import { checkUserDevice } from "../../helpers/user";
 import { sendMail } from "../../helpers/nodemailer";
 import { TokenService } from "../../services";
+import { EELogService } from "../../ee/services";
 import { BadRequestError, InternalServerError } from "../../utils/errors";
-import { AuthTokenType, TOKEN_EMAIL_MFA } from "../../variables";
-import { getAuthSecret, getHttpsEnabled, getJwtMfaLifetime } from "../../config";
+import { ACTION_LOGIN, TOKEN_EMAIL_MFA } from "../../variables";
+import { getUserAgentType } from "../../utils/posthog"; // TODO: move this
+import { getHttpsEnabled, getJwtMfaLifetime, getJwtMfaSecret } from "../../config";
 import { AuthMethod } from "../../models/user";
 import { validateRequest } from "../../helpers/validation";
 import * as reqValidator from "../../validation/auth";
@@ -132,11 +134,10 @@ export const login2 = async (req: Request, res: Response) => {
           // generate temporary MFA token
           const token = createToken({
             payload: {
-              authTokenType: AuthTokenType.MFA_TOKEN,
               userId: user._id.toString()
             },
             expiresIn: await getJwtMfaLifetime(),
-            secret: await getAuthSecret()
+            secret: await getJwtMfaSecret()
           });
 
           const code = await TokenService.createToken({
@@ -213,6 +214,19 @@ export const login2 = async (req: Request, res: Response) => {
           response.protectedKeyTag = user.protectedKeyTag;
         }
 
+        const loginAction = await EELogService.createAction({
+          name: ACTION_LOGIN,
+          userId: user._id
+        });
+
+        loginAction &&
+          (await EELogService.createLog({
+            userId: user._id,
+            actions: [loginAction],
+            channel: getUserAgentType(req.headers["user-agent"]),
+            ipAddress: req.realIP
+          }));
+
         return res.status(200).send(response);
       }
 

backend/src/controllers/v3/index.ts

@@ -1,13 +1,11 @@
-import * as usersController from "./usersController";
 import * as secretsController from "./secretsController";
 import * as workspacesController from "./workspacesController";
 import * as authController from "./authController";
 import * as signupController from "./signupController";
 
 export {
-    usersController,
     authController,
     secretsController,
     signupController,
-    workspacesController
+    workspacesController,
 }

backend/src/controllers/v3/signupController.ts

@@ -5,10 +5,10 @@ import { MembershipOrg, User } from "../../models";
 import { completeAccount } from "../../helpers/user";
 import { initializeDefaultOrg } from "../../helpers/signup";
 import { issueAuthTokens, validateProviderAuthToken } from "../../helpers/auth";
-import { ACCEPTED, AuthTokenType, INVITED } from "../../variables";
+import { ACCEPTED, INVITED } from "../../variables";
 import { standardRequest } from "../../config/request";
-import { getAuthSecret, getHttpsEnabled, getLoopsApiKey } from "../../config";
-import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
+import { getHttpsEnabled, getJwtSignupSecret, getLoopsApiKey } from "../../config";
+import { BadRequestError } from "../../utils/errors";
 import { TelemetryService } from "../../services";
 import { AuthMethod } from "../../models";
 import { validateRequest } from "../../helpers/validation";
@@ -78,11 +78,12 @@ export const completeAccountSignup = async (req: Request, res: Response) => {
       }
 
       const decodedToken = <jwt.UserIDJwtPayload>(
-        jwt.verify(AUTH_TOKEN_VALUE, await getAuthSecret())
+        jwt.verify(AUTH_TOKEN_VALUE, await getJwtSignupSecret())
       );
-      
-      if (decodedToken.authTokenType !== AuthTokenType.SIGNUP_TOKEN) throw UnauthorizedRequestError();
-      if (decodedToken.userId !== user.id) throw UnauthorizedRequestError();
+
+      if (decodedToken.userId !== user.id) {
+        throw BadRequestError();
+      }
     }
 
     // complete setting up user's account

backend/src/controllers/v3/usersController.ts

@@ -1,18 +0,0 @@
-import { Request, Response } from "express";
-import { APIKeyDataV2 } from "../../models";
-
-/**
- * Return API keys belonging to current user.
- * @param req
- * @param res
- * @returns
- */
-export const getMyAPIKeys = async (req: Request, res: Response) => {
-    const apiKeyData = await APIKeyDataV2.find({
-        user: req.user._id
-    });
-
-    return res.status(200).send({
-        apiKeyData
-    });
-}

backend/src/controllers/v3/workspacesController.ts

@@ -1,9 +1,9 @@
 import { Request, Response } from "express";
 import { Types } from "mongoose";
 import { validateRequest } from "../../helpers/validation";
-import { Membership, Secret, ServiceTokenDataV3, User } from "../../models";
+import { Secret } from "../../models";
 import { SecretService } from "../../services";
-import { getAuthDataProjectPermissions } from "../../ee/services/ProjectRoleService";
+import { getUserProjectPermissions } from "../../ee/services/ProjectRoleService";
 import { UnauthorizedRequestError } from "../../utils/errors";
 import * as reqValidator from "../../validation/workspace";
 
@@ -19,22 +19,9 @@ export const getWorkspaceBlindIndexStatus = async (req: Request, res: Response)
     params: { workspaceId }
   } = await validateRequest(reqValidator.GetWorkspaceBlinkIndexStatusV3, req);
 
-  await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
-  if (req.authData.authPayload instanceof User) {
-    const membership = await Membership.findOne({
-      user: req.authData.authPayload._id,
-      workspace: new Types.ObjectId(workspaceId)
-    });
-    
-    if (!membership) throw UnauthorizedRequestError();
-
-    if (membership.role !== "admin")
-      throw UnauthorizedRequestError({ message: "User must be an admin" });
-  }
+  const { membership } = await getUserProjectPermissions(req.user._id, workspaceId);
+  if (membership.role !== "admin")
+    throw UnauthorizedRequestError({ message: "User must be an admin" });
 
   const secretsWithoutBlindIndex = await Secret.countDocuments({
     workspace: new Types.ObjectId(workspaceId),
@@ -54,22 +41,9 @@ export const getWorkspaceSecrets = async (req: Request, res: Response) => {
     params: { workspaceId }
   } = await validateRequest(reqValidator.GetWorkspaceSecretsV3, req);
 
-  await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
-  if (req.authData.authPayload instanceof User) {
-    const membership = await Membership.findOne({
-      user: req.authData.authPayload._id,
-      workspace: new Types.ObjectId(workspaceId)
-    });
-    
-    if (!membership) throw UnauthorizedRequestError();
-
-    if (membership.role !== "admin")
-      throw UnauthorizedRequestError({ message: "User must be an admin" });
-  }
+  const { membership } = await getUserProjectPermissions(req.user._id, workspaceId);
+  if (membership.role !== "admin")
+    throw UnauthorizedRequestError({ message: "User must be an admin" });
 
   const secrets = await Secret.find({
     workspace: new Types.ObjectId(workspaceId)
@@ -91,22 +65,9 @@ export const nameWorkspaceSecrets = async (req: Request, res: Response) => {
     body: { secretsToUpdate }
   } = await validateRequest(reqValidator.NameWorkspaceSecretsV3, req);
 
-  await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
-  if (req.authData.authPayload instanceof User) {
-    const membership = await Membership.findOne({
-      user: req.authData.authPayload._id,
-      workspace: new Types.ObjectId(workspaceId)
-    });
-    
-    if (!membership) throw UnauthorizedRequestError();
-
-    if (membership.role !== "admin")
-      throw UnauthorizedRequestError({ message: "User must be an admin" });
-  }
+  const { membership } = await getUserProjectPermissions(req.user._id, workspaceId);
+  if (membership.role !== "admin")
+    throw UnauthorizedRequestError({ message: "User must be an admin" });
 
   // get secret blind index salt
   const salt = await SecretService.getSecretBlindIndexSalt({
@@ -140,17 +101,3 @@ export const nameWorkspaceSecrets = async (req: Request, res: Response) => {
     message: "Successfully named workspace secrets"
   });
 };
-
-export const getWorkspaceServiceTokenData = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId }
-  } = await validateRequest(reqValidator.GetWorkspaceServiceTokenDataV3, req);
-  
-  const serviceTokenData = await ServiceTokenDataV3.find({
-    workspace: new Types.ObjectId(workspaceId)
-  }).populate("customRole");
-  
-  return res.status(200).send({
-    serviceTokenData
-  });
-}

backend/src/ee/controllers/v1/actionController.ts

@@ -0,0 +1,32 @@
+import { Request, Response } from "express";
+import { Action } from "../../models";
+import { ActionNotFoundError } from "../../../utils/errors";
+import { validateRequest } from "../../../helpers/validation";
+import * as reqValidator from "../../../validation/action";
+
+export const getAction = async (req: Request, res: Response) => {
+  let action;
+  try {
+    const {
+      params: { actionId }
+    } = await validateRequest(reqValidator.GetActionV1, req);
+
+    action = await Action.findById(actionId).populate([
+      "payload.secretVersions.oldSecretVersion",
+      "payload.secretVersions.newSecretVersion"
+    ]);
+
+    if (!action)
+      throw ActionNotFoundError({
+        message: "Failed to find action"
+      });
+  } catch (err) {
+    throw ActionNotFoundError({
+      message: "Failed to find action"
+    });
+  }
+
+  return res.status(200).send({
+    action
+  });
+};

backend/src/ee/controllers/v1/index.ts

@@ -4,13 +4,10 @@ import * as organizationsController from "./organizationsController";
 import * as ssoController from "./ssoController";
 import * as usersController from "./usersController";
 import * as workspaceController from "./workspaceController";
+import * as actionController from "./actionController";
 import * as membershipController from "./membershipController";
 import * as cloudProductsController from "./cloudProductsController";
 import * as roleController from "./roleController";
-import * as secretApprovalPolicyController from "./secretApprovalPolicyController";
-import * as secretApprovalRequestController from "./secretApprovalRequestsController";
-import * as secretRotationProviderController from "./secretRotationProviderController";
-import * as secretRotationController from "./secretRotationController";
 
 export {
   secretController,
@@ -19,11 +16,8 @@ export {
   ssoController,
   usersController,
   workspaceController,
+  actionController,
   membershipController,
   cloudProductsController,
-  roleController,
-  secretApprovalPolicyController,
-  secretApprovalRequestController,
-  secretRotationProviderController,
-  secretRotationController
+  roleController
 };

backend/src/ee/controllers/v1/roleController.ts

@@ -1,6 +1,4 @@
 import { Request, Response } from "express";
-import { Types } from "mongoose";
-import { Membership, User } from "../../../models";
 import {
   CreateRoleSchema,
   DeleteRoleSchema,
@@ -13,7 +11,7 @@ import {
   ProjectPermissionActions,
   ProjectPermissionSub,
   adminProjectPermissions,
-  getAuthDataProjectPermissions,
+  getUserProjectPermissions,
   memberProjectPermissions,
   viewerProjectPermission
 } from "../../services/ProjectRoleService";
@@ -25,7 +23,7 @@ import {
   memberPermissions
 } from "../../services/RoleService";
 import { BadRequestError } from "../../../utils/errors";
-import { Role } from "../../models";
+import Role from "../../models/role";
 import { validateRequest } from "../../../helpers/validation";
 import { packRules } from "@casl/ability/extra";
 
@@ -41,10 +39,7 @@ export const createRole = async (req: Request, res: Response) => {
       throw BadRequestError({ message: "user doesn't have the permission." });
     }
   } else {
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: new Types.ObjectId(workspaceId)
-    });
+    const { permission } = await getUserProjectPermissions(req.user.id, workspaceId);
     if (permission.cannot(ProjectPermissionActions.Create, ProjectPermissionSub.Role)) {
       throw BadRequestError({ message: "User doesn't have the permission." });
     }
@@ -87,11 +82,7 @@ export const updateRole = async (req: Request, res: Response) => {
       throw BadRequestError({ message: "User doesn't have the org permission." });
     }
   } else {
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: new Types.ObjectId(workspaceId)
-    });
-
+    const { permission } = await getUserProjectPermissions(req.user.id, workspaceId);
     if (permission.cannot(ProjectPermissionActions.Edit, ProjectPermissionSub.Role)) {
       throw BadRequestError({ message: "User doesn't have the workspace permission." });
     }
@@ -143,11 +134,7 @@ export const deleteRole = async (req: Request, res: Response) => {
       throw BadRequestError({ message: "User doesn't have the org permission." });
     }
   } else {
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: role.workspace
-    });
-
+    const { permission } = await getUserProjectPermissions(req.user.id, role.workspace.toString());
     if (permission.cannot(ProjectPermissionActions.Delete, ProjectPermissionSub.Role)) {
       throw BadRequestError({ message: "User doesn't have the workspace permission." });
     }
@@ -175,11 +162,7 @@ export const getRoles = async (req: Request, res: Response) => {
       throw BadRequestError({ message: "User doesn't have the org permission." });
     }
   } else {
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: new Types.ObjectId(workspaceId)
-    });
-
+    const { permission } = await getUserProjectPermissions(req.user.id, workspaceId);
     if (permission.cannot(ProjectPermissionActions.Read, ProjectPermissionSub.Role)) {
       throw BadRequestError({ message: "User doesn't have the workspace permission." });
     }
@@ -229,13 +212,11 @@ export const getUserPermissions = async (req: Request, res: Response) => {
   const {
     params: { orgId }
   } = await validateRequest(GetUserPermission, req);
-
-  const { permission, membership } = await getUserOrgPermissions(req.user._id, orgId);
+  const { permission } = await getUserOrgPermissions(req.user._id, orgId);
 
   res.status(200).json({
     data: {
-      permissions: packRules(permission.rules),
-      membership
+      permissions: packRules(permission.rules)
     }
   });
 };
@@ -244,24 +225,11 @@ export const getUserWorkspacePermissions = async (req: Request, res: Response) =
   const {
     params: { workspaceId }
   } = await validateRequest(GetUserProjectPermission, req);
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-  
-  let membership;
-  if (req.authData.authPayload instanceof User) {
-    membership = await Membership.findOne({
-      user: req.authData.authPayload._id,
-      workspace: new Types.ObjectId(workspaceId)
-    })
-  }
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
 
   res.status(200).json({
     data: {
-      permissions: packRules(permission.rules),
-      membership
+      permissions: packRules(permission.rules)
     }
   });
 };

backend/src/ee/controllers/v1/secretApprovalRequestsController.ts

@@ -1,366 +0,0 @@
-import { Request, Response } from "express";
-import { validateRequest } from "../../../helpers/validation";
-import { Folder, Membership, User } from "../../../models";
-import { ApprovalStatus, SecretApprovalRequest } from "../../models/secretApprovalRequest";
-import * as reqValidator from "../../validation/secretApprovalRequest";
-import { getFolderWithPathFromId } from "../../../services/FolderService";
-import { BadRequestError, UnauthorizedRequestError } from "../../../utils/errors";
-import { ISecretApprovalPolicy, SecretApprovalPolicy } from "../../models/secretApprovalPolicy";
-import { performSecretApprovalRequestMerge } from "../../services/SecretApprovalService";
-import { Types } from "mongoose";
-import { EEAuditLogService } from "../../services";
-import { EventType } from "../../models";
-
-export const getSecretApprovalRequestCount = async (req: Request, res: Response) => {
-  const {
-    query: { workspaceId }
-  } = await validateRequest(reqValidator.getSecretApprovalRequestCount, req);
-
-  if (!(req.authData.authPayload instanceof User)) return;
-  
-  const membership = await Membership.findOne({
-    user: req.authData.authPayload._id,
-    workspace: new Types.ObjectId(workspaceId)
-  });
-  
-  if (!membership) throw UnauthorizedRequestError();
-
-  const approvalRequestCount = await SecretApprovalRequest.aggregate([
-    {
-      $match: {
-        workspace: new Types.ObjectId(workspaceId)
-      }
-    },
-    {
-      $lookup: {
-        from: SecretApprovalPolicy.collection.name,
-        localField: "policy",
-        foreignField: "_id",
-        as: "policy"
-      }
-    },
-    { $unwind: "$policy" },
-    ...(membership.role !== "admin"
-      ? [
-          {
-            $match: {
-              $or: [
-                { committer: new Types.ObjectId(membership.id) },
-                { "policy.approvers": new Types.ObjectId(membership.id) }
-              ]
-            }
-          }
-        ]
-      : []),
-    {
-      $group: {
-        _id: "$status",
-        count: { $sum: 1 }
-      }
-    }
-  ]);
-  const openRequests = approvalRequestCount.find(({ _id }) => _id === "open");
-  const closedRequests = approvalRequestCount.find(({ _id }) => _id === "close");
-
-  return res.send({
-    approvals: { open: openRequests?.count || 0, closed: closedRequests?.count || 0 }
-  });
-};
-
-export const getSecretApprovalRequests = async (req: Request, res: Response) => {
-  const {
-    query: { status, committer, workspaceId, environment, limit, offset }
-  } = await validateRequest(reqValidator.getSecretApprovalRequests, req);
-
-  if (!(req.authData.authPayload instanceof User)) return;
-  
-  const membership = await Membership.findOne({
-    user: req.authData.authPayload._id,
-    workspace: new Types.ObjectId(workspaceId)
-  });
-  
-  if (!membership) throw UnauthorizedRequestError();
-
-  const query = {
-    workspace: new Types.ObjectId(workspaceId),
-    environment,
-    committer: committer ? new Types.ObjectId(committer) : undefined,
-    status
-  };
-  // to strip of undefined in query we use es6 spread to ignore those fields
-  Object.entries(query).forEach(
-    ([key, value]) => value === undefined && delete query[key as keyof typeof query]
-  );
-  const approvalRequests = await SecretApprovalRequest.aggregate([
-    {
-      $match: query
-    },
-    { $sort: { createdAt: -1 } },
-    {
-      $lookup: {
-        from: SecretApprovalPolicy.collection.name,
-        localField: "policy",
-        foreignField: "_id",
-        as: "policy"
-      }
-    },
-    { $unwind: "$policy" },
-    ...(membership.role !== "admin"
-      ? [
-          {
-            $match: {
-              $or: [
-                { committer: new Types.ObjectId(membership.id) },
-                { "policy.approvers": new Types.ObjectId(membership.id) }
-              ]
-            }
-          }
-        ]
-      : []),
-    { $skip: offset },
-    { $limit: limit }
-  ]);
-  if (!approvalRequests.length) return res.send({ approvals: [] });
-
-  const unqiueEnvs = environment ?? {
-    $in: [...new Set(approvalRequests.map(({ environment }) => environment))]
-  };
-  const approvalRootFolders = await Folder.find({
-    workspace: workspaceId,
-    environment: unqiueEnvs
-  }).lean();
-
-  const formatedApprovals = approvalRequests.map((el) => {
-    let secretPath = "/";
-    const folders = approvalRootFolders.find(({ environment }) => environment === el.environment);
-    if (folders) {
-      secretPath = getFolderWithPathFromId(folders?.nodes, el.folderId)?.folderPath || "/";
-    }
-    return { ...el, secretPath };
-  });
-
-  return res.send({
-    approvals: formatedApprovals
-  });
-};
-
-export const getSecretApprovalRequestDetails = async (req: Request, res: Response) => {
-  const {
-    params: { id }
-  } = await validateRequest(reqValidator.getSecretApprovalRequestDetails, req);
-  const secretApprovalRequest = await SecretApprovalRequest.findById(id)
-    .populate<{ policy: ISecretApprovalPolicy }>("policy")
-    .populate({
-      path: "commits.secretVersion",
-      populate: {
-        path: "tags"
-      }
-    })
-    .populate("commits.secret", "version")
-    .populate("commits.newVersion.tags")
-    .lean();
-  if (!secretApprovalRequest)
-    throw BadRequestError({ message: "Secret approval request not found" });
-
-  if (!(req.authData.authPayload instanceof User)) return;
-
-  const membership = await Membership.findOne({
-    user: req.authData.authPayload._id,
-    workspace: secretApprovalRequest.workspace
-  });
-  
-  if (!membership) throw UnauthorizedRequestError();
-
-  // allow to fetch only if its admin or is the committer or approver
-  if (
-    membership.role !== "admin" &&
-    secretApprovalRequest.committer !== membership.id &&
-    !secretApprovalRequest.policy.approvers.find(
-      (approverId) => approverId.toString() === membership._id.toString()
-    )
-  ) {
-    throw UnauthorizedRequestError({ message: "User has no access" });
-  }
-
-  let secretPath = "/";
-  const approvalRootFolders = await Folder.findOne({
-    workspace: secretApprovalRequest.workspace,
-    environment: secretApprovalRequest.environment
-  }).lean();
-  if (approvalRootFolders) {
-    secretPath =
-      getFolderWithPathFromId(approvalRootFolders?.nodes, secretApprovalRequest.folderId)
-        ?.folderPath || "/";
-  }
-
-  return res.send({
-    approval: { ...secretApprovalRequest, secretPath }
-  });
-};
-
-export const updateSecretApprovalReviewStatus = async (req: Request, res: Response) => {
-  const {
-    body: { status },
-    params: { id }
-  } = await validateRequest(reqValidator.updateSecretApprovalReviewStatus, req);
-  const secretApprovalRequest = await SecretApprovalRequest.findById(id).populate<{
-    policy: ISecretApprovalPolicy;
-  }>("policy");
-  if (!secretApprovalRequest)
-    throw BadRequestError({ message: "Secret approval request not found" });
-
-  if (!(req.authData.authPayload instanceof User)) return;
-
-  const membership = await Membership.findOne({
-    user: req.authData.authPayload._id,
-    workspace: secretApprovalRequest.workspace
-  });
-  
-  if (!membership) throw UnauthorizedRequestError();
-
-  if (
-    membership.role !== "admin" &&
-    secretApprovalRequest.committer !== membership.id &&
-    !secretApprovalRequest.policy.approvers.find((approverId) => approverId.equals(membership.id))
-  ) {
-    throw UnauthorizedRequestError({ message: "User has no access" });
-  }
-
-  const reviewerPos = secretApprovalRequest.reviewers.findIndex(
-    ({ member }) => member.toString() === membership._id.toString()
-  );
-  if (reviewerPos !== -1) {
-    secretApprovalRequest.reviewers[reviewerPos].status = status;
-  } else {
-    secretApprovalRequest.reviewers.push({ member: membership._id, status });
-  }
-  await secretApprovalRequest.save();
-
-  return res.send({ status });
-};
-
-export const mergeSecretApprovalRequest = async (req: Request, res: Response) => {
-  const {
-    params: { id }
-  } = await validateRequest(reqValidator.mergeSecretApprovalRequest, req);
-
-  const secretApprovalRequest = await SecretApprovalRequest.findById(id).populate<{
-    policy: ISecretApprovalPolicy;
-  }>("policy");
-
-  if (!secretApprovalRequest)
-    throw BadRequestError({ message: "Secret approval request not found" });
-
-  if (!(req.authData.authPayload instanceof User)) return;
-
-  const membership = await Membership.findOne({
-    user: req.authData.authPayload._id,
-    workspace: secretApprovalRequest.workspace
-  });
-  
-  if (!membership) throw UnauthorizedRequestError();
-
-  if (
-    membership.role !== "admin" &&
-    secretApprovalRequest.committer !== membership.id &&
-    !secretApprovalRequest.policy.approvers.find((approverId) => approverId.equals(membership.id))
-  ) {
-    throw UnauthorizedRequestError({ message: "User has no access" });
-  }
-
-  const reviewers = secretApprovalRequest.reviewers.reduce<Record<string, ApprovalStatus>>(
-    (prev, curr) => ({ ...prev, [curr.member.toString()]: curr.status }),
-    {}
-  );
-  const hasMinApproval =
-    secretApprovalRequest.policy.approvals <=
-    secretApprovalRequest.policy.approvers.filter(
-      (approverId) => reviewers[approverId.toString()] === ApprovalStatus.APPROVED
-    ).length;
-
-  if (!hasMinApproval) throw BadRequestError({ message: "Doesn't have minimum approvals needed" });
-
-  const approval = await performSecretApprovalRequestMerge(
-    id,
-    req.authData,
-    membership._id.toString()
-  );
-  return res.send({ approval });
-};
-
-export const updateSecretApprovalRequestStatus = async (req: Request, res: Response) => {
-  const {
-    body: { status },
-    params: { id }
-  } = await validateRequest(reqValidator.updateSecretApprovalRequestStatus, req);
-
-  const secretApprovalRequest = await SecretApprovalRequest.findById(id).populate<{
-    policy: ISecretApprovalPolicy;
-  }>("policy");
-
-  if (!secretApprovalRequest)
-    throw BadRequestError({ message: "Secret approval request not found" });
-
-  if (!(req.authData.authPayload instanceof User)) return;
-
-  const membership = await Membership.findOne({
-    user: req.authData.authPayload._id,
-    workspace: secretApprovalRequest.workspace
-  });
-  
-  if (!membership) throw UnauthorizedRequestError();
-
-  if (
-    membership.role !== "admin" &&
-    secretApprovalRequest.committer !== membership.id &&
-    !secretApprovalRequest.policy.approvers.find((approverId) => approverId.equals(membership._id))
-  ) {
-    throw UnauthorizedRequestError({ message: "User has no access" });
-  }
-
-  if (secretApprovalRequest.hasMerged)
-    throw BadRequestError({ message: "Approval request has been merged" });
-  if (secretApprovalRequest.status === "close" && status === "close")
-    throw BadRequestError({ message: "Approval request is already closed" });
-  if (secretApprovalRequest.status === "open" && status === "open")
-    throw BadRequestError({ message: "Approval request is already open" });
-
-  const updatedRequest = await SecretApprovalRequest.findByIdAndUpdate(
-    id,
-    { status, statusChangeBy: membership._id },
-    { new: true }
-  );
-
-  if (status === "close") {
-    await EEAuditLogService.createAuditLog(
-      req.authData,
-      {
-        type: EventType.SECRET_APPROVAL_CLOSED,
-        metadata: {
-          closedBy: membership._id.toString(),
-          secretApprovalRequestId: id,
-          secretApprovalRequestSlug: secretApprovalRequest.slug
-        }
-      },
-      {
-        workspaceId: secretApprovalRequest.workspace
-      }
-    );
-  } else {
-    await EEAuditLogService.createAuditLog(
-      req.authData,
-      {
-        type: EventType.SECRET_APPROVAL_REOPENED,
-        metadata: {
-          reopenedBy: membership._id.toString(),
-          secretApprovalRequestId: id,
-          secretApprovalRequestSlug: secretApprovalRequest.slug
-        }
-      },
-      {
-        workspaceId: secretApprovalRequest.workspace
-      }
-    );
-  }
-  return res.send({ approval: updatedRequest });
-};

backend/src/ee/controllers/v1/secretController.ts

@@ -5,7 +5,7 @@ import { Folder, Secret } from "../../../models";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../services/ProjectRoleService";
 import { BadRequestError } from "../../../utils/errors";
 import * as reqValidator from "../../../validation";
@@ -74,11 +74,7 @@ export const getSecretVersions = async (req: Request, res: Response) => {
     throw BadRequestError({ message: "Failed to find secret" });
   }
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: secret.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, secret.workspace.toString());
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.SecretRollback
@@ -161,12 +157,10 @@ export const rollbackSecretVersion = async (req: Request, res: Response) => {
   if (!toBeUpdatedSec) {
     throw BadRequestError({ message: "Failed to find secret" });
   }
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: toBeUpdatedSec.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    toBeUpdatedSec.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.SecretRollback

backend/src/ee/controllers/v1/secretRotationController.ts

@@ -1,110 +0,0 @@
-import { Request, Response } from "express";
-import { Types } from "mongoose";
-import { validateRequest } from "../../../helpers/validation";
-import * as reqValidator from "../../validation/secretRotation";
-import * as secretRotationService from "../../secretRotation/service";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSub,
-  getAuthDataProjectPermissions
-} from "../../services/ProjectRoleService";
-import { ForbiddenError } from "@casl/ability";
-
-export const createSecretRotation = async (req: Request, res: Response) => {
-  const {
-    body: {
-      provider,
-      customProvider,
-      interval,
-      outputs,
-      secretPath,
-      environment,
-      workspaceId,
-      inputs
-    }
-  } = await validateRequest(reqValidator.createSecretRotationV1, req);
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Create,
-    ProjectPermissionSub.SecretRotation
-  );
-
-  const secretRotation = await secretRotationService.createSecretRotation({
-    workspaceId,
-    inputs,
-    environment,
-    secretPath,
-    outputs,
-    interval,
-    customProvider,
-    provider
-  });
-
-  return res.send({ secretRotation });
-};
-
-export const restartSecretRotations = async (req: Request, res: Response) => {
-  const {
-    body: { id }
-  } = await validateRequest(reqValidator.restartSecretRotationV1, req);
-
-  const doc = await secretRotationService.getSecretRotationById({ id });
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: doc.workspace
-  });
-
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Edit,
-    ProjectPermissionSub.SecretRotation
-  );
-
-  const secretRotation = await secretRotationService.restartSecretRotation({ id });
-  return res.send({ secretRotation });
-};
-
-export const deleteSecretRotations = async (req: Request, res: Response) => {
-  const {
-    params: { id }
-  } = await validateRequest(reqValidator.removeSecretRotationV1, req);
-
-  const doc = await secretRotationService.getSecretRotationById({ id });
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: doc.workspace
-  });
-
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Delete,
-    ProjectPermissionSub.SecretRotation
-  );
-
-  const secretRotations = await secretRotationService.deleteSecretRotation({ id });
-  return res.send({ secretRotations });
-};
-
-export const getSecretRotations = async (req: Request, res: Response) => {
-  const {
-    query: { workspaceId }
-  } = await validateRequest(reqValidator.getSecretRotationV1, req);
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Read,
-    ProjectPermissionSub.SecretRotation
-  );
-
-  const secretRotations = await secretRotationService.getSecretRotationOfWorkspace(workspaceId);
-  return res.send({ secretRotations });
-};

backend/src/ee/controllers/v1/secretRotationProviderController.ts

@@ -1,33 +0,0 @@
-import { Request, Response } from "express";
-import { Types } from "mongoose";
-import { validateRequest } from "../../../helpers/validation";
-import * as reqValidator from "../../validation/secretRotationProvider";
-import * as secretRotationProviderService from "../../secretRotation/service";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSub,
-  getAuthDataProjectPermissions
-} from "../../services/ProjectRoleService";
-import { ForbiddenError } from "@casl/ability";
-
-export const getProviderTemplates = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId }
-  } = await validateRequest(reqValidator.getSecretRotationProvidersV1, req);
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Read,
-    ProjectPermissionSub.SecretRotation
-  );
-
-  const rotationProviderList = await secretRotationProviderService.getProviderTemplate({
-    workspaceId
-  });
-
-  return res.send(rotationProviderList);
-};

backend/src/ee/controllers/v1/secretSnapshotController.ts

@@ -4,7 +4,7 @@ import { validateRequest } from "../../../helpers/validation";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../services/ProjectRoleService";
 import * as reqValidator from "../../../validation/secretSnapshot";
 import { ISecretVersion, SecretSnapshot, TFolderRootVersionSchema } from "../../models";
@@ -33,11 +33,10 @@ export const getSecretSnapshot = async (req: Request, res: Response) => {
 
   if (!secretSnapshot) throw new Error("Failed to find secret snapshot");
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: secretSnapshot.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    secretSnapshot.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.SecretRollback

backend/src/ee/controllers/v1/workspaceController.ts

@@ -5,7 +5,6 @@ import {
   Membership,
   Secret,
   ServiceTokenData,
-  ServiceTokenDataV3,
   TFolderSchema,
   User,
   Workspace
@@ -17,16 +16,17 @@ import {
   FolderVersion,
   IPType,
   ISecretVersion,
+  Log,
   SecretSnapshot,
   SecretVersion,
   ServiceActor,
-  ServiceActorV3,
   TFolderRootVersionSchema,
   TrustedIP,
   UserActor
 } from "../../models";
 import { EESecretService } from "../../services";
 import { getLatestSecretVersionIds } from "../../helpers/secretVersion";
+// import Folder, { TFolderSchema } from "../../../models/folder";
 import { getFolderByPath, searchByFolderId } from "../../../services/FolderService";
 import { EEAuditLogService, EELicenseService } from "../../services";
 import { extractIPDetails, isValidIpOrCidr } from "../../../utils/ip";
@@ -36,6 +36,7 @@ import {
   DeleteWorkspaceTrustedIpV1,
   GetWorkspaceAuditLogActorFilterOptsV1,
   GetWorkspaceAuditLogsV1,
+  GetWorkspaceLogsV1,
   GetWorkspaceSecretSnapshotsCountV1,
   GetWorkspaceSecretSnapshotsV1,
   GetWorkspaceTrustedIpsV1,
@@ -45,7 +46,7 @@ import {
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
 import { BadRequestError } from "../../../utils/errors";
@@ -106,11 +107,7 @@ export const getWorkspaceSecretSnapshots = async (req: Request, res: Response) =
     query: { environment, directory, offset, limit }
   } = await validateRequest(GetWorkspaceSecretSnapshotsV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.SecretRollback
@@ -151,11 +148,7 @@ export const getWorkspaceSecretSnapshotsCount = async (req: Request, res: Respon
     query: { environment, directory }
   } = await validateRequest(GetWorkspaceSecretSnapshotsCountV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.SecretRollback
@@ -245,11 +238,7 @@ export const rollbackWorkspaceSecretSnapshot = async (req: Request, res: Respons
     body: { directory, environment, version }
   } = await validateRequest(RollbackWorkspaceSecretSnapshotV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.SecretRollback
@@ -573,97 +562,123 @@ export const rollbackWorkspaceSecretSnapshot = async (req: Request, res: Respons
 };
 
 /**
- * Return audit logs for workspace with id [workspaceId]
+ * Return (audit) logs for workspace with id [workspaceId]
  * @param req
  * @param res
+ * @returns
  */
-export const getWorkspaceAuditLogs = async (req: Request, res: Response) => {
+export const getWorkspaceLogs = async (req: Request, res: Response) => {
   /* 
-    #swagger.summary = 'Return audit logs'
-    #swagger.description = 'Return audit logs'
+    #swagger.summary = 'Return project (audit) logs'
+    #swagger.description = 'Return project (audit) logs'
     
     #swagger.security = [{
-      "apiKeyAuth": []
+        "apiKeyAuth": []
     }]
 
-    #swagger.parameters['workspaceId'] = {
-      "description": "ID of the workspace where to get folders from",
-      "required": true,
-      "type": "string",
-      "in": "path"
-    }
+	#swagger.parameters['workspaceId'] = {
+		"description": "ID of project",
+		"required": true,
+		"type": "string"
+	} 
 
-    #swagger.parameters['offset'] = {
-      "description": "Number of logs to skip before starting to return logs for pagination",
-      "required": false,
-      "type": "string"
-    }
+	#swagger.parameters['userId'] = {
+		"description": "ID of project member",
+		"required": false,
+		"type": "string"
+	} 
 
-    #swagger.parameters['limit'] = {
-      "description": "Maximum number of logs to return for pagination",
-      "required": false,
-      "type": "string"
-    }
+	#swagger.parameters['offset'] = {
+		"description": "Number of logs to skip",
+		"required": false,
+		"type": "string"
+	}
 
-   #swagger.parameters['startDate'] = {
-      "description": "Filter logs from this date in ISO-8601 format",
-      "required": false,
-      "type": "string"
-    }
+	#swagger.parameters['limit'] = {
+		"description": "Maximum number of logs to return",
+		"required": false,
+		"type": "string"
+	}
 
-   #swagger.parameters['endDate'] = {
-      "description": "Filter logs till this date in ISO-8601 format",
-      "required": false,
-      "type": "string"
-    }
+	#swagger.parameters['sortBy'] = {
+		"description": "Order to sort the logs by",
+		"schema": {
+			"type": "string",
+			"@enum": ["oldest", "recent"]
+		},
+		"required": false
+	}
 
-    #swagger.parameters['eventType'] = {
-      "description": "Filter by type of event such as get-secrets, get-secret, create-secret, update-secret, delete-secret, etc.",
-      "required": false,
-      "type": "string",
-    }
-
-    #swagger.parameters['userAgentType'] = {
-      "description": "Filter by type of user agent such as web, cli, k8-operator, or other",
-      "required": false,
-      "type": "string",
-    }
-
-    #swagger.parameters['actor'] = {
-      "description": "Filter by actor such as user or service",
-      "required": false,
-      "type": "string"
-    }
+	#swagger.parameters['actionNames'] = {
+		"description": "Names of log actions (comma-separated)",
+		"required": false,
+		"type": "string"
+	}
 
     #swagger.responses[200] = {
         content: {
             "application/json": {
                 schema: { 
-                  "type": "object",
-                  "properties": {
-                        "auditLogs": {
-                            "type": "array",
-                            "items": {
-			      $ref: "#/components/schemas/AuditLog",
-                            },
-                            "description": "List of audit log"                        
-                          },
-                  }
+					"type": "object",
+					"properties": {
+						"logs": {
+							"type": "array",
+							"items": {
+								$ref: "#/components/schemas/Log" 
+							},
+							"description": "Project logs"
+						}
+					}
                 }
             }           
         }
     }   
     */
+  const {
+    query: { limit, offset, userId, sortBy, actionNames },
+    params: { workspaceId }
+  } = await validateRequest(GetWorkspaceLogsV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.AuditLogs
+  );
+
+  const logs = await Log.find({
+    workspace: workspaceId,
+    ...(userId ? { user: userId } : {}),
+    ...(actionNames
+      ? {
+          actionNames: {
+            $in: actionNames.split(",")
+          }
+        }
+      : {})
+  })
+    .sort({ createdAt: sortBy === "recent" ? -1 : 1 })
+    .skip(offset)
+    .limit(limit)
+    .populate("actions")
+    .populate("user serviceAccount serviceTokenData");
+
+  return res.status(200).send({
+    logs
+  });
+};
+
+/**
+ * Return audit logs for workspace with id [workspaceId]
+ * @param req
+ * @param res
+ */
+export const getWorkspaceAuditLogs = async (req: Request, res: Response) => {
   const {
     query: { limit, offset, endDate, eventType, startDate, userAgentType, actor },
     params: { workspaceId }
   } = await validateRequest(GetWorkspaceAuditLogsV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.AuditLogs
@@ -683,13 +698,13 @@ export const getWorkspaceAuditLogs = async (req: Request, res: Response) => {
       : {}),
     ...(actor
       ? {
-          "actor.type": actor.substring(0, actor.lastIndexOf("-")),
+          "actor.type": actor.split("-", 2)[0],
           ...(actor.split("-", 2)[0] === ActorType.USER
             ? {
-                "actor.metadata.userId": actor.substring(actor.lastIndexOf("-") + 1)
+                "actor.metadata.userId": actor.split("-", 2)[1]
               }
             : {
-                "actor.metadata.serviceId": actor.substring(actor.lastIndexOf("-") + 1)
+                "actor.metadata.serviceId": actor.split("-", 2)[1]
               })
         }
       : {}),
@@ -702,9 +717,14 @@ export const getWorkspaceAuditLogs = async (req: Request, res: Response) => {
         }
       : {})
   };
+
   const auditLogs = await AuditLog.find(query).sort({ createdAt: -1 }).skip(offset).limit(limit);
+
+  const totalCount = await AuditLog.countDocuments(query);
+
   return res.status(200).send({
-    auditLogs
+    auditLogs,
+    totalCount
   });
 };
 
@@ -718,11 +738,7 @@ export const getWorkspaceAuditLogActorFilterOpts = async (req: Request, res: Res
     params: { workspaceId }
   } = await validateRequest(GetWorkspaceAuditLogActorFilterOptsV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.AuditLogs
@@ -757,22 +773,8 @@ export const getWorkspaceAuditLogActorFilterOpts = async (req: Request, res: Res
     }
   }));
 
-  const serviceV3Actors: ServiceActorV3[] = (
-    await ServiceTokenDataV3.find({
-      workspace: new Types.ObjectId(workspaceId)
-    })
-  ).map((serviceTokenData) => ({
-    type: ActorType.SERVICE_V3,
-    metadata: {
-      serviceId: serviceTokenData._id.toString(),
-      name: serviceTokenData.name
-    }
-  }));
-
-  const actors = [...userActors, ...serviceActors, ...serviceV3Actors];
-
   return res.status(200).send({
-    actors
+    actors: [...userActors, ...serviceActors]
   });
 };
 
@@ -786,11 +788,7 @@ export const getWorkspaceTrustedIps = async (req: Request, res: Response) => {
     params: { workspaceId }
   } = await validateRequest(GetWorkspaceTrustedIpsV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.IpAllowList
@@ -816,11 +814,7 @@ export const addWorkspaceTrustedIp = async (req: Request, res: Response) => {
     body: { comment, isActive, ipAddress: ip }
   } = await validateRequest(AddWorkspaceTrustedIpV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.IpAllowList
@@ -886,11 +880,7 @@ export const updateWorkspaceTrustedIp = async (req: Request, res: Response) => {
     body: { ipAddress: ip, comment }
   } = await validateRequest(UpdateWorkspaceTrustedIpV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.IpAllowList
@@ -982,11 +972,7 @@ export const deleteWorkspaceTrustedIp = async (req: Request, res: Response) => {
     params: { workspaceId, trustedIpId }
   } = await validateRequest(DeleteWorkspaceTrustedIpV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Delete,
     ProjectPermissionSub.IpAllowList

backend/src/ee/controllers/v3/apiKeyDataController.ts

@@ -1,101 +0,0 @@
-import { Request, Response } from "express";
-import { Types } from "mongoose";
-import { APIKeyDataV2 } from "../../../models/apiKeyDataV2";
-import { validateRequest } from "../../../helpers/validation";
-import { BadRequestError } from "../../../utils/errors";
-import * as reqValidator from "../../../validation";
-import { createToken } from "../../../helpers";
-import { AuthTokenType } from "../../../variables";
-import { getAuthSecret } from "../../../config";
-
-/**
- * Create API key data v2
- * @param req 
- * @param res 
- */
-export const createAPIKeyData = async (req: Request, res: Response) => {
-    const {
-        body: {
-            name
-        }
-    } = await validateRequest(reqValidator.CreateAPIKeyV3, req);
-
-    const apiKeyData = await new APIKeyDataV2({
-        name,
-        user: req.user._id,
-        usageCount: 0,
-    }).save();
-    
-    const apiKey = createToken({
-        payload: {
-            authTokenType: AuthTokenType.API_KEY,
-            apiKeyDataId: apiKeyData._id.toString(),
-            userId: req.user._id.toString()
-        },
-        secret: await getAuthSecret()
-    });
-
-    return res.status(200).send({
-        apiKeyData,
-        apiKey
-    });
-}
-
-/**
- * Update API key data v2 with id [apiKeyDataId]
- * @param req 
- * @param res 
- */
- export const updateAPIKeyData = async (req: Request, res: Response) => {
-    const {
-        params: { apiKeyDataId },
-        body: { 
-            name, 
-        }
-    } = await validateRequest(reqValidator.UpdateAPIKeyV3, req);
-
-    const apiKeyData = await APIKeyDataV2.findOneAndUpdate(
-        {
-            _id: new Types.ObjectId(apiKeyDataId),
-            user: req.user._id
-        },
-        {
-            name
-        },
-        {
-            new: true
-        }
-    );
-    
-    if (!apiKeyData) throw BadRequestError({
-        message: "Failed to update API key"
-    });
-
-    return res.status(200).send({
-        apiKeyData
-    });
-}
-
-/**
- * Delete API key data v2 with id [apiKeyDataId]
- * @param req 
- * @param res 
- */
- export const deleteAPIKeyData = async (req: Request, res: Response) => {
-    const {
-        params: { apiKeyDataId }
-    } = await validateRequest(reqValidator.DeleteAPIKeyV3, req);
-
-    const apiKeyData = await APIKeyDataV2.findOneAndDelete({
-        _id: new Types.ObjectId(apiKeyDataId),
-        user: req.user._id
-    });
-
-    if (!apiKeyData) throw BadRequestError({
-        message: "Failed to delete API key"
-    });
-    
-    return res.status(200).send({
-        apiKeyData
-    });
-}

backend/src/ee/controllers/v3/index.ts

@@ -1,7 +0,0 @@
-import * as serviceTokenDataController from "./serviceTokenDataController";
-import * as apiKeyDataController from "./apiKeyDataController";
-
-export {
-    serviceTokenDataController,
-    apiKeyDataController
-}

backend/src/ee/controllers/v3/serviceTokenDataController.ts

@@ -1,469 +0,0 @@
-import jwt from "jsonwebtoken";
-import { Request, Response } from "express";
-import { Types } from "mongoose";
-import { 
-    IServiceTokenDataV3,
-    IUser,
-    ServiceTokenDataV3,
-    ServiceTokenDataV3Key,
-    Workspace
-} from "../../../models";
-import { IServiceTokenV3TrustedIp } from "../../../models/serviceTokenDataV3";
-import {
-    ActorType,
-    EventType,
-    Role
-} from "../../models";
-import { validateRequest } from "../../../helpers/validation";
-import * as reqValidator from "../../../validation/serviceTokenDataV3";
-import { createToken } from "../../../helpers/auth";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSub,
-  getAuthDataProjectPermissions
-} from "../../services/ProjectRoleService";
-import { ForbiddenError } from "@casl/ability"; 
-import { BadRequestError, ResourceNotFoundError, UnauthorizedRequestError } from "../../../utils/errors";
-import { extractIPDetails, isValidIpOrCidr } from "../../../utils/ip";
-import { EEAuditLogService, EELicenseService } from "../../services";
-import { getAuthSecret } from "../../../config";
-import { ADMIN, AuthTokenType, CUSTOM, MEMBER, VIEWER } from "../../../variables";
-
-/**
- * Return project key for service token V3
- * @param req 
- * @param res 
- */
-export const getServiceTokenDataKey = async (req: Request, res: Response) => {
-    const key = await ServiceTokenDataV3Key.findOne({
-        serviceTokenData: (req.authData.authPayload as IServiceTokenDataV3)._id
-    }).populate<{ sender: IUser }>("sender", "publicKey");
-    
-    if (!key) throw ResourceNotFoundError({
-        message: "Failed to find project key for service token"
-    });
-    
-    const { _id, workspace, encryptedKey, nonce, sender: { publicKey } } = key;
-    
-    return res.status(200).send({
-        key: {
-            _id,
-            workspace,
-            encryptedKey,
-            publicKey,
-            nonce
-        }
-    });
-}
-
-/**
- * Return access and refresh token as per refresh operation
- * @param req 
- * @param res 
- */
- export const refreshToken = async (req: Request, res: Response) => {
-    const {
-        body: {
-            refresh_token
-        }
-    } = await validateRequest(reqValidator.RefreshTokenV3, req);
-
-    const decodedToken = <jwt.ServiceRefreshTokenJwtPayload>(
-		jwt.verify(refresh_token, await getAuthSecret())
-	);
-    
-    if (decodedToken.authTokenType !== AuthTokenType.SERVICE_REFRESH_TOKEN) throw UnauthorizedRequestError();
-    
-    let serviceTokenData = await ServiceTokenDataV3.findOne({
-        _id: new Types.ObjectId(decodedToken.serviceTokenDataId),
-        isActive: true
-    });
-    
-    if (!serviceTokenData) throw UnauthorizedRequestError();
-
-    if (decodedToken.tokenVersion !== serviceTokenData.tokenVersion) {
-        // raise alarm
-        throw UnauthorizedRequestError();
-    }
-    
-    const response: {
-        refresh_token?: string;
-        access_token: string;
-        expires_in: number;
-        token_type: string;
-    } = {
-        refresh_token,
-        access_token: "",
-        expires_in: 0,
-        token_type: "Bearer"
-    };
-
-    if (serviceTokenData.isRefreshTokenRotationEnabled) {
-        serviceTokenData = await ServiceTokenDataV3.findByIdAndUpdate(
-            serviceTokenData._id,
-            {
-                $inc: {
-                    tokenVersion: 1
-                }
-            },
-            {
-                new: true
-            }
-        );
-        
-        if (!serviceTokenData) throw BadRequestError();
-        
-        response.refresh_token = createToken({
-            payload: {
-                serviceTokenDataId: serviceTokenData._id.toString(),
-                authTokenType: AuthTokenType.SERVICE_REFRESH_TOKEN,
-                tokenVersion: serviceTokenData.tokenVersion
-            },
-            secret: await getAuthSecret()
-        });
-    }
-
-    response.access_token = createToken({
-        payload: {
-            serviceTokenDataId: serviceTokenData._id.toString(),
-            authTokenType: AuthTokenType.SERVICE_ACCESS_TOKEN,
-            tokenVersion: serviceTokenData.tokenVersion
-        },
-        expiresIn: serviceTokenData.accessTokenTTL,
-        secret: await getAuthSecret()
-    });
-
-    response.expires_in = serviceTokenData.accessTokenTTL;
-
-    await ServiceTokenDataV3.findByIdAndUpdate(
-        serviceTokenData._id,
-        {
-            refreshTokenLastUsed: new Date(),
-            $inc: { refreshTokenUsageCount: 1 }
-        },
-        {
-            new: true
-        }
-    );
-    
-    return res.status(200).send(response);
-}
-
-/**
- * Create service token data V3
- * @param req 
- * @param res 
- * @returns 
- */
-export const createServiceTokenData = async (req: Request, res: Response) => {
-    const {
-        body: { 
-            name, 
-            workspaceId, 
-            publicKey, 
-            role,
-            trustedIps,
-            expiresIn, 
-            accessTokenTTL,
-            isRefreshTokenRotationEnabled,
-            encryptedKey, // for ServiceTokenDataV3Key
-            nonce, // for ServiceTokenDataV3Key
-        }
-    } = await validateRequest(reqValidator.CreateServiceTokenV3, req);
-    const { permission } = await getAuthDataProjectPermissions({
-        authData: req.authData,
-        workspaceId: new Types.ObjectId(workspaceId)
-      });
-
-    ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Create,
-        ProjectPermissionSub.ServiceTokens
-    );
-    
-    const workspace = await Workspace.findById(workspaceId);
-    if (!workspace) throw BadRequestError({ message: "Workspace not found" });
-
-    const isCustomRole = ![ADMIN, MEMBER, VIEWER].includes(role);
-    
-    let customRole;
-    if (isCustomRole) {
-        customRole = await Role.findOne({
-            slug: role,
-            isOrgRole: false,
-            workspace: workspace._id
-        });
-        
-        if (!customRole) throw BadRequestError({ message: "Role not found" });
-    }
-
-    const plan = await EELicenseService.getPlan(workspace.organization);
-    
-    // validate trusted ips
-    const reformattedTrustedIps = trustedIps.map((trustedIp) => {
-        if (!plan.ipAllowlisting && trustedIp.ipAddress !== "0.0.0.0/0") return res.status(400).send({
-            message: "Failed to add IP access range to service token due to plan restriction. Upgrade plan to add IP access range."
-        });
-
-        const isValidIPOrCidr = isValidIpOrCidr(trustedIp.ipAddress);
-        
-        if (!isValidIPOrCidr) return res.status(400).send({
-            message: "The IP is not a valid IPv4, IPv6, or CIDR block"
-        });
-        
-        return extractIPDetails(trustedIp.ipAddress);
-    });
-    
-    let expiresAt;
-    if (expiresIn) {
-        expiresAt = new Date();
-        expiresAt.setSeconds(expiresAt.getSeconds() + expiresIn);
-    }
-    
-    let user;
-    if (req.authData.actor.type === ActorType.USER) {
-        user = req.authData.authPayload._id;
-    }
-    
-    const isActive = true;
-    const serviceTokenData = await new ServiceTokenDataV3({
-        name,
-        user,
-        workspace: new Types.ObjectId(workspaceId),
-        publicKey,
-        refreshTokenUsageCount: 0,
-        accessTokenUsageCount: 0,
-        tokenVersion: 1,
-        trustedIps: reformattedTrustedIps,
-        role: isCustomRole ? CUSTOM : role,
-        customRole,
-        isActive,
-        expiresAt,
-        accessTokenTTL,
-        isRefreshTokenRotationEnabled
-    }).save();
-    
-    await new ServiceTokenDataV3Key({
-        encryptedKey,
-        nonce,
-        sender: req.user._id,
-        serviceTokenData: serviceTokenData._id,
-        workspace: new Types.ObjectId(workspaceId)
-    }).save();
-    
-    const refreshToken = createToken({
-        payload: {
-            serviceTokenDataId: serviceTokenData._id.toString(),
-            authTokenType: AuthTokenType.SERVICE_REFRESH_TOKEN,
-            tokenVersion: serviceTokenData.tokenVersion
-        },
-        secret: await getAuthSecret()
-    });
-    
-    await EEAuditLogService.createAuditLog(
-        req.authData,
-        {
-            type: EventType.CREATE_SERVICE_TOKEN_V3, // TODO: update
-            metadata: {
-                name,
-                isActive,
-                role,
-                trustedIps: reformattedTrustedIps as Array<IServiceTokenV3TrustedIp>,
-                expiresAt
-            }
-        },
-        {
-            workspaceId: new Types.ObjectId(workspaceId)
-        }
-    );
-    
-    return res.status(200).send({
-        serviceTokenData,
-        refreshToken
-    });
-}
-
-/**
- * Update service token V3 data with id [serviceTokenDataId]
- * @param req 
- * @param res 
- * @returns 
- */
-export const updateServiceTokenData = async (req: Request, res: Response) => {
-    const {
-        params: { serviceTokenDataId },
-        body: { 
-            name, 
-            isActive,
-            role,
-            trustedIps,
-            expiresIn,
-            accessTokenTTL,
-            isRefreshTokenRotationEnabled
-        }
-    } = await validateRequest(reqValidator.UpdateServiceTokenV3, req);
-
-    let serviceTokenData = await ServiceTokenDataV3.findById(serviceTokenDataId);
-    if (!serviceTokenData) throw ResourceNotFoundError({ 
-        message: "Service token not found" 
-    });
-    
-    const { permission } = await getAuthDataProjectPermissions({
-        authData: req.authData,
-        workspaceId: serviceTokenData.workspace
-    });
-    
-    ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Edit,
-        ProjectPermissionSub.ServiceTokens
-    );
-
-    const workspace = await Workspace.findById(serviceTokenData.workspace);
-    if (!workspace) throw BadRequestError({ message: "Workspace not found" });
-
-    let customRole;
-    if (role) {
-        const isCustomRole = ![ADMIN, MEMBER, VIEWER].includes(role);
-        if (isCustomRole) {
-            customRole = await Role.findOne({
-                slug: role,
-                isOrgRole: false,
-                workspace: workspace._id
-            });
-            
-            if (!customRole) throw BadRequestError({ message: "Role not found" });
-        }
-    }
-
-    const plan = await EELicenseService.getPlan(workspace.organization);
-
-    // validate trusted ips
-    let reformattedTrustedIps;
-    if (trustedIps) {
-        reformattedTrustedIps = trustedIps.map((trustedIp) => {
-            if (!plan.ipAllowlisting && trustedIp.ipAddress !== "0.0.0.0/0") return res.status(400).send({
-                message: "Failed to update IP access range to service token due to plan restriction. Upgrade plan to update IP access range."
-            });
-
-            const isValidIPOrCidr = isValidIpOrCidr(trustedIp.ipAddress);
-            
-            if (!isValidIPOrCidr) return res.status(400).send({
-                message: "The IP is not a valid IPv4, IPv6, or CIDR block"
-            });
-            
-            return extractIPDetails(trustedIp.ipAddress);
-        });
-    }
-
-    let expiresAt;
-    if (expiresIn) {
-        expiresAt = new Date();
-        expiresAt.setSeconds(expiresAt.getSeconds() + expiresIn);
-    }
-    
-    serviceTokenData = await ServiceTokenDataV3.findByIdAndUpdate(
-        serviceTokenDataId,
-        {
-            name,
-            isActive,
-            role: customRole ? CUSTOM : role,
-            ...(customRole ? {
-                customRole 
-            } : {}),
-            ...(role && !customRole ? { // non-custom role
-                $unset: {
-                    customRole: 1
-                }
-            } : {}),
-            trustedIps: reformattedTrustedIps,
-            expiresAt,
-            accessTokenTTL,
-            isRefreshTokenRotationEnabled
-        },
-        {
-            new: true
-        }
-    );
-
-    if (!serviceTokenData) throw BadRequestError({
-        message: "Failed to update service token"
-    });
-
-    await EEAuditLogService.createAuditLog(
-        req.authData,
-        {
-            type: EventType.UPDATE_SERVICE_TOKEN_V3,
-            metadata: {
-                name: serviceTokenData.name,
-                isActive,
-                role,
-                trustedIps: reformattedTrustedIps as Array<IServiceTokenV3TrustedIp>,
-                expiresAt
-            }
-        },
-        {
-            workspaceId: serviceTokenData.workspace
-        }
-    );
-
-    return res.status(200).send({
-        serviceTokenData
-    }); 
-}
-
-/**
- * Delete service token data with id [serviceTokenDataId]
- * @param req 
- * @param res 
- * @returns 
- */
-export const deleteServiceTokenData = async (req: Request, res: Response) => {
-    const {
-        params: { serviceTokenDataId }
-    } = await validateRequest(reqValidator.DeleteServiceTokenV3, req);
-    
-    let serviceTokenData = await ServiceTokenDataV3.findById(serviceTokenDataId);
-    if (!serviceTokenData) throw ResourceNotFoundError({ 
-        message: "Service token not found" 
-    });
-    
-    const { permission } = await getAuthDataProjectPermissions({
-        authData: req.authData,
-        workspaceId: serviceTokenData.workspace
-    });
-    
-    ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Delete,
-        ProjectPermissionSub.ServiceTokens
-    );
-    
-    serviceTokenData = await ServiceTokenDataV3.findByIdAndDelete(serviceTokenDataId);
-    
-    if (!serviceTokenData) throw BadRequestError({
-        message: "Failed to delete service token"
-    });
-    
-    await ServiceTokenDataV3Key.findOneAndDelete({
-        serviceTokenData: serviceTokenData._id
-    });
-    
-    await EEAuditLogService.createAuditLog(
-        req.authData,
-        {
-            type: EventType.DELETE_SERVICE_TOKEN_V3,
-            metadata: {
-                name: serviceTokenData.name,
-                isActive: serviceTokenData.isActive,
-                role: serviceTokenData.role,
-                trustedIps: serviceTokenData.trustedIps as Array<IServiceTokenV3TrustedIp>,
-                expiresAt: serviceTokenData.expiresAt
-            }
-        },
-        {
-            workspaceId: serviceTokenData.workspace
-        }
-    );
-
-    return res.status(200).send({
-        serviceTokenData
-    }); 
-}

backend/src/ee/helpers/action.ts

@@ -0,0 +1,195 @@
+import { Types } from "mongoose";
+import { Action } from "../models";
+import { 
+    getLatestNSecretSecretVersionIds,
+    getLatestSecretVersionIds,
+} from "../helpers/secretVersion";
+import { 
+    ACTION_ADD_SECRETS,
+    ACTION_DELETE_SECRETS,
+    ACTION_LOGIN,
+    ACTION_LOGOUT,
+    ACTION_READ_SECRETS,
+    ACTION_UPDATE_SECRETS,
+} from "../../variables";
+
+/**
+ * Create an (audit) action for updating secrets
+ * @param {Object} obj
+ * @param {String} obj.name - name of action
+ * @param {Types.ObjectId} obj.secretIds - ids of relevant secrets
+ * @returns {Action} action - new action
+ */
+const createActionUpdateSecret = async ({
+    name,
+    userId,
+    serviceAccountId,
+    serviceTokenDataId,
+    workspaceId,
+    secretIds,
+}: {
+    name: string;
+    userId?: Types.ObjectId;
+    serviceAccountId?: Types.ObjectId;
+    serviceTokenDataId?: Types.ObjectId;
+    workspaceId: Types.ObjectId;
+    secretIds: Types.ObjectId[];
+}) => {
+    const latestSecretVersions = (await getLatestNSecretSecretVersionIds({
+            secretIds,
+            n: 2,
+        }))
+        .map((s) => ({
+            oldSecretVersion: s.versions[0]._id,
+            newSecretVersion: s.versions[1]._id,
+        }));
+    
+    const action = await new Action({
+        name,
+        user: userId,
+        serviceAccount: serviceAccountId,
+        serviceTokenData: serviceTokenDataId,
+        workspace: workspaceId,
+        payload: {
+            secretVersions: latestSecretVersions,
+        },
+    }).save();
+    
+    return action;
+}
+
+/**
+ * Create an (audit) action for creating, reading, and deleting
+ * secrets
+ * @param {Object} obj
+ * @param {String} obj.name - name of action
+ * @param {Types.ObjectId} obj.secretIds - ids of relevant secrets
+ * @returns {Action} action - new action
+ */
+const createActionSecret = async ({
+    name,
+    userId,
+    serviceAccountId,
+    serviceTokenDataId,
+    workspaceId,
+    secretIds,
+}: {
+    name: string;
+    userId?: Types.ObjectId;
+    serviceAccountId?: Types.ObjectId;
+    serviceTokenDataId?: Types.ObjectId;
+    workspaceId: Types.ObjectId;
+    secretIds: Types.ObjectId[];
+}) => {
+    // case: action is adding, deleting, or reading secrets
+    // -> add new secret versions
+    const latestSecretVersions = (await getLatestSecretVersionIds({
+        secretIds,
+    }))
+    .map((s) => ({
+        newSecretVersion: s.versionId,
+    }));
+    
+   const action = await new Action({
+        name,
+        user: userId,
+        serviceAccount: serviceAccountId,
+        serviceTokenData: serviceTokenDataId,
+        workspace: workspaceId,
+        payload: {
+            secretVersions: latestSecretVersions,
+        },
+    }).save(); 
+    
+    return action;
+}
+
+/**
+ * Create an (audit) action for client with id [userId],
+ * [serviceAccountId], or [serviceTokenDataId]
+ * @param {Object} obj 
+ * @param {String} obj.name - name of action
+ * @param {String} obj.userId - id of user associated with action
+ * @returns 
+ */
+const createActionClient = ({
+    name,
+    userId,
+    serviceAccountId,
+    serviceTokenDataId,
+}: {
+    name: string;
+    userId?: Types.ObjectId;
+    serviceAccountId?: Types.ObjectId;
+    serviceTokenDataId?: Types.ObjectId;
+}) => {
+    const action = new Action({
+        name,
+        user: userId,
+        serviceAccount: serviceAccountId,
+        serviceTokenData: serviceTokenDataId,
+    }).save();
+
+    return action; 
+}
+
+/**
+ * Create an (audit) action. 
+ * @param {Object} obj
+ * @param {Object} obj.name - name of action
+ * @param {Types.ObjectId} obj.userId - id of user associated with action
+ * @param {Types.ObjectId} obj.workspaceId - id of workspace associated with action
+ * @param {Types.ObjectId[]} obj.secretIds - ids of secrets associated with action
+*/
+const createActionHelper = async ({
+    name,
+    userId,
+    serviceAccountId,
+    serviceTokenDataId,
+    workspaceId,
+    secretIds,
+}: {
+    name: string;
+    userId?: Types.ObjectId;
+    serviceAccountId?: Types.ObjectId;
+    serviceTokenDataId?: Types.ObjectId;
+    workspaceId?: Types.ObjectId;
+    secretIds?: Types.ObjectId[];
+}) => {
+    let action;
+    switch (name) {
+        case ACTION_LOGIN:
+        case ACTION_LOGOUT:
+            action = await createActionClient({
+                name,
+                userId,
+            });
+            break;
+        case ACTION_ADD_SECRETS:
+        case ACTION_READ_SECRETS:
+        case ACTION_DELETE_SECRETS:
+            if (!workspaceId || !secretIds) throw new Error("Missing required params workspace id or secret ids to create action secret");
+            action = await createActionSecret({
+                name,
+                userId,
+                workspaceId,
+                secretIds,
+            });
+            break;
+        case ACTION_UPDATE_SECRETS:
+            if (!workspaceId || !secretIds) throw new Error("Missing required params workspace id or secret ids to create action secret");
+            action = await createActionUpdateSecret({
+                name,
+                userId,
+                workspaceId,
+                secretIds,
+            });
+            break;
+    }
+    
+    return action;
+}
+
+export { 
+    createActionHelper,
+};

backend/src/ee/helpers/log.ts

@@ -0,0 +1,50 @@
+import { Types } from "mongoose";
+import { 
+    IAction,
+    Log,
+} from "../models";
+
+/**
+ * Create an (audit) log
+ * @param {Object} obj
+ * @param {Types.ObjectId} obj.userId - id of user associated with the log
+ * @param {Types.ObjectId} obj.workspaceId - id of workspace associated with the log
+ * @param {IAction[]} obj.actions - actions to include in log
+ * @param {String} obj.channel - channel (web/cli/auto) associated with the log
+ * @param {String} obj.ipAddress - ip address associated with the log
+ * @returns {Log} log - new audit log
+ */
+const createLogHelper = async ({
+    userId,
+    serviceAccountId,
+    serviceTokenDataId,
+    workspaceId,
+    actions,
+    channel,
+    ipAddress,
+}: {
+    userId?: Types.ObjectId;
+    serviceAccountId?: Types.ObjectId;
+    serviceTokenDataId?: Types.ObjectId;
+    workspaceId?: Types.ObjectId;
+    actions: IAction[];
+    channel: string;
+    ipAddress: string;
+}) => {
+    const log = await new Log({
+        user: userId,
+        serviceAccount: serviceAccountId,
+        serviceTokenData: serviceTokenDataId,
+        workspace: workspaceId ?? undefined,
+        actionNames: actions.map((a) => a.name),
+        actions,
+        channel,
+        ipAddress,
+    }).save();
+
+    return log;
+}
+
+export {
+    createLogHelper,
+}

backend/src/ee/middleware/index.ts

@@ -0,0 +1,5 @@
+import requireSecretSnapshotAuth from "./requireSecretSnapshotAuth";
+
+export {
+    requireSecretSnapshotAuth,
+}

backend/src/ee/middleware/requireSecretSnapshotAuth.ts

@@ -0,0 +1,43 @@
+import { NextFunction, Request, Response } from "express";
+import { SecretSnapshotNotFoundError } from "../../utils/errors";
+import { SecretSnapshot } from "../models";
+import {
+    validateMembership,
+} from "../../helpers/membership";
+
+/**
+ * Validate if user on request has proper membership for secret snapshot
+ * @param {Object} obj
+ * @param {String[]} obj.acceptedRoles - accepted workspace roles
+ * @param {String[]} obj.acceptedStatuses - accepted workspace statuses
+ * @param {String[]} obj.location - location of [workspaceId] on request (e.g. params, body) for parsing
+ */
+const requireSecretSnapshotAuth = ({
+    acceptedRoles,
+}: {
+    acceptedRoles: Array<"admin" | "member">;
+}) => {
+    return async (req: Request, res: Response, next: NextFunction) => {
+        const { secretSnapshotId } = req.params;
+        
+        const secretSnapshot = await SecretSnapshot.findById(secretSnapshotId);
+        
+        if (!secretSnapshot) {
+            return next(SecretSnapshotNotFoundError({
+                message: "Failed to find secret snapshot",
+            }));
+        }
+        
+        await validateMembership({
+            userId: req.user._id,
+            workspaceId: secretSnapshot.workspace,
+            acceptedRoles,
+        });
+        
+        req.secretSnapshot = secretSnapshot as any;
+
+        next();
+    }
+}
+
+export default requireSecretSnapshotAuth;

backend/src/ee/models/action.ts

@@ -0,0 +1,69 @@
+import { Schema, Types, model } from "mongoose";
+import {
+    ACTION_ADD_SECRETS,
+    ACTION_DELETE_SECRETS,
+    ACTION_LOGIN,
+    ACTION_LOGOUT,
+    ACTION_READ_SECRETS,
+    ACTION_UPDATE_SECRETS,
+} from "../../variables";
+
+export interface IAction {
+    name: string;
+    user?: Types.ObjectId,
+    serviceAccount?: Types.ObjectId,
+    serviceTokenData?: Types.ObjectId,
+    workspace?: Types.ObjectId,
+    payload?: {
+        secretVersions?: Types.ObjectId[]
+    }
+}
+
+const actionSchema = new Schema<IAction>(
+    {
+        name: {
+            type: String,
+            required: true,
+            enum: [
+                ACTION_LOGIN,
+                ACTION_LOGOUT,
+                ACTION_ADD_SECRETS,
+                ACTION_UPDATE_SECRETS,
+                ACTION_READ_SECRETS,
+                ACTION_DELETE_SECRETS,
+            ],
+        },
+        user: {
+            type: Schema.Types.ObjectId,
+            ref: "User",
+        },
+        serviceAccount: {
+            type: Schema.Types.ObjectId,
+            ref: "ServiceAccount",
+        },
+        serviceTokenData: {
+            type: Schema.Types.ObjectId,
+            ref: "ServiceTokenData",
+        },
+        workspace: {
+            type: Schema.Types.ObjectId,
+            ref: "Workspace",
+        },
+        payload: {
+            secretVersions: [{
+                oldSecretVersion: {
+                    type: Schema.Types.ObjectId,
+                    ref: "SecretVersion",
+                },
+                newSecretVersion: {
+                    type: Schema.Types.ObjectId,
+                    ref: "SecretVersion",
+                },
+            }],
+        },
+    }, {
+        timestamps: true,
+    }
+);
+
+export const Action = model<IAction>("Action", actionSchema);

backend/src/ee/models/auditLog/auditLog.ts

@@ -1,70 +1,76 @@
 import { Schema, Types, model } from "mongoose";
-import { ActorType, EventType, UserAgentType } from "./enums";
-import { Actor, Event } from "./types";
+import {
+    ActorType,
+    EventType,
+    UserAgentType
+} from "./enums";
+import {
+    Actor,
+    Event
+} from "./types";
 
 export interface IAuditLog {
-  actor: Actor;
-  organization: Types.ObjectId;
-  workspace: Types.ObjectId;
-  ipAddress: string;
-  event: Event;
-  userAgent: string;
-  userAgentType: UserAgentType;
-  expiresAt: Date;
+    actor: Actor;
+    organization: Types.ObjectId;
+    workspace: Types.ObjectId;
+    ipAddress: string;
+    event: Event;
+    userAgent: string;
+    userAgentType: UserAgentType;
+    expiresAt: Date;
 }
 
 const auditLogSchema = new Schema<IAuditLog>(
-  {
-    actor: {
-      type: {
-        type: String,
-        enum: ActorType,
-        required: true
-      },
-      metadata: {
-        type: Schema.Types.Mixed
-      }
+    {
+        actor: {
+            type: {
+                type: String,
+                enum: ActorType,
+                required: true
+            },
+            metadata: {
+                type: Schema.Types.Mixed
+            }
+        },
+        organization: {
+            type: Schema.Types.ObjectId,
+            required: false
+        },
+        workspace: {
+            type: Schema.Types.ObjectId,
+            required: false
+        },
+        ipAddress: {
+            type: String,
+            required: true
+        },
+        event: {
+            type: {
+                type: String,
+                enum: EventType,
+                required: true
+            },
+            metadata: {
+                type: Schema.Types.Mixed
+            }
+        },
+        userAgent: {
+            type: String,
+            required: true
+        },
+        userAgentType: {
+            type: String,
+            enum: UserAgentType,
+            required: true
+        },
+        expiresAt: {
+            type: Date,
+            expires: 0
+        }
     },
-    organization: {
-      type: Schema.Types.ObjectId,
-      required: false
-    },
-    workspace: {
-      type: Schema.Types.ObjectId,
-      required: false,
-      index: true
-    },
-    ipAddress: {
-      type: String,
-      required: true
-    },
-    event: {
-      type: {
-        type: String,
-        enum: EventType,
-        required: true
-      },
-      metadata: {
-        type: Schema.Types.Mixed
-      }
-    },
-    userAgent: {
-      type: String,
-      required: true
-    },
-    userAgentType: {
-      type: String,
-      enum: UserAgentType,
-      required: true
-    },
-    expiresAt: {
-      type: Date,
-      expires: 0
+    {
+        timestamps: true
     }
-  },
-  {
-    timestamps: true
-  }
 );
 
-export const AuditLog = model<IAuditLog>("AuditLog", auditLogSchema);
+export const AuditLog = model<IAuditLog>("AuditLog", auditLogSchema); 

backend/src/ee/models/auditLog/enums.ts

@@ -1,8 +1,6 @@
 export enum ActorType {
   USER = "user",
-  SERVICE = "service",
-  SERVICE_V3 = "service-v3",
-  // Machine = "machine"
+  SERVICE = "service"
 }
 
 export enum UserAgentType {
@@ -30,16 +28,12 @@ export enum EventType {
   ADD_TRUSTED_IP = "add-trusted-ip",
   UPDATE_TRUSTED_IP = "update-trusted-ip",
   DELETE_TRUSTED_IP = "delete-trusted-ip",
-  CREATE_SERVICE_TOKEN = "create-service-token", // v2
-  DELETE_SERVICE_TOKEN = "delete-service-token", // v2
-  CREATE_SERVICE_TOKEN_V3 = "create-service-token-v3", // v3
-  UPDATE_SERVICE_TOKEN_V3 = "update-service-token-v3", // v3
-  DELETE_SERVICE_TOKEN_V3 = "delete-service-token-v3", // v3
+  CREATE_SERVICE_TOKEN = "create-service-token",
+  DELETE_SERVICE_TOKEN = "delete-service-token",
   CREATE_ENVIRONMENT = "create-environment",
   UPDATE_ENVIRONMENT = "update-environment",
   DELETE_ENVIRONMENT = "delete-environment",
   ADD_WORKSPACE_MEMBER = "add-workspace-member",
-  ADD_BATCH_WORKSPACE_MEMBER = "add-workspace-members",
   REMOVE_WORKSPACE_MEMBER = "remove-workspace-member",
   CREATE_FOLDER = "create-folder",
   UPDATE_FOLDER = "update-folder",
@@ -52,9 +46,5 @@ export enum EventType {
   UPDATE_SECRET_IMPORT = "update-secret-import",
   DELETE_SECRET_IMPORT = "delete-secret-import",
   UPDATE_USER_WORKSPACE_ROLE = "update-user-workspace-role",
-  UPDATE_USER_WORKSPACE_DENIED_PERMISSIONS = "update-user-workspace-denied-permissions",
-  SECRET_APPROVAL_MERGED = "secret-approval-merged",
-  SECRET_APPROVAL_REQUEST = "secret-approval-request",
-  SECRET_APPROVAL_CLOSED = "secret-approval-closed",
-  SECRET_APPROVAL_REOPENED = "secret-approval-reopened"
+  UPDATE_USER_WORKSPACE_DENIED_PERMISSIONS = "update-user-workspace-denied-permissions"
 }

backend/src/ee/models/auditLog/types.ts

@@ -1,5 +1,4 @@
 import { ActorType, EventType } from "./enums";
-import { IServiceTokenV3TrustedIp } from "../../../models/serviceTokenDataV3";
 
 interface UserActorMetadata {
   userId: string;
@@ -21,16 +20,7 @@ export interface ServiceActor {
   metadata: ServiceActorMetadata;
 }
 
-export interface ServiceActorV3 {
-  type: ActorType.SERVICE_V3;
-  metadata: ServiceActorMetadata;
-}
-
-// export interface MachineActor {
-//   type: ActorType.Machine;
-// }
-
-export type Actor = UserActor | ServiceActor | ServiceActorV3;
+export type Actor = UserActor | ServiceActor;
 
 interface GetSecretsEvent {
   type: EventType.GET_SECRETS;
@@ -220,39 +210,6 @@ interface DeleteServiceTokenEvent {
   };
 }
 
-interface CreateServiceTokenV3Event {
-  type: EventType.CREATE_SERVICE_TOKEN_V3;
-  metadata: {
-    name: string;
-    isActive: boolean;
-    role: string;
-    trustedIps: Array<IServiceTokenV3TrustedIp>;
-    expiresAt?: Date;
-  };
-}
-
-interface UpdateServiceTokenV3Event {
-  type: EventType.UPDATE_SERVICE_TOKEN_V3;
-  metadata: {
-    name?: string;
-    isActive?: boolean;
-    role?: string;
-    trustedIps?: Array<IServiceTokenV3TrustedIp>;
-    expiresAt?: Date;
-  };
-}
-
-interface DeleteServiceTokenV3Event {
-  type: EventType.DELETE_SERVICE_TOKEN_V3;
-  metadata: {
-    name: string;
-    isActive: boolean;
-    role: string;
-    expiresAt?: Date;
-    trustedIps: Array<IServiceTokenV3TrustedIp>;
-  };
-}
-
 interface CreateEnvironmentEvent {
   type: EventType.CREATE_ENVIRONMENT;
   metadata: {
@@ -287,14 +244,6 @@ interface AddWorkspaceMemberEvent {
   };
 }
 
-interface AddBatchWorkspaceMemberEvent {
-  type: EventType.ADD_BATCH_WORKSPACE_MEMBER;
-  metadata: Array<{
-    userId: string;
-    email: string;
-  }>;
-}
-
 interface RemoveWorkspaceMemberEvent {
   type: EventType.REMOVE_WORKSPACE_MEMBER;
   metadata: {
@@ -440,41 +389,6 @@ interface UpdateUserDeniedPermissions {
     }[];
   };
 }
-interface SecretApprovalMerge {
-  type: EventType.SECRET_APPROVAL_MERGED;
-  metadata: {
-    mergedBy: string;
-    secretApprovalRequestSlug: string;
-    secretApprovalRequestId: string;
-  };
-}
-
-interface SecretApprovalClosed {
-  type: EventType.SECRET_APPROVAL_CLOSED;
-  metadata: {
-    closedBy: string;
-    secretApprovalRequestSlug: string;
-    secretApprovalRequestId: string;
-  };
-}
-
-interface SecretApprovalReopened {
-  type: EventType.SECRET_APPROVAL_REOPENED;
-  metadata: {
-    reopenedBy: string;
-    secretApprovalRequestSlug: string;
-    secretApprovalRequestId: string;
-  };
-}
-
-interface SecretApprovalRequest {
-  type: EventType.SECRET_APPROVAL_REQUEST;
-  metadata: {
-    committedBy: string;
-    secretApprovalRequestSlug: string;
-    secretApprovalRequestId: string;
-  };
-}
 
 export type Event =
   | GetSecretsEvent
@@ -495,14 +409,10 @@ export type Event =
   | DeleteTrustedIPEvent
   | CreateServiceTokenEvent
   | DeleteServiceTokenEvent
-  | CreateServiceTokenV3Event
-  | UpdateServiceTokenV3Event
-  | DeleteServiceTokenV3Event
   | CreateEnvironmentEvent
   | UpdateEnvironmentEvent
   | DeleteEnvironmentEvent
   | AddWorkspaceMemberEvent
-  | AddBatchWorkspaceMemberEvent
   | RemoveWorkspaceMemberEvent
   | CreateFolderEvent
   | UpdateFolderEvent
@@ -515,8 +425,4 @@ export type Event =
   | UpdateSecretImportEvent
   | DeleteSecretImportEvent
   | UpdateUserRole
-  | UpdateUserDeniedPermissions
-  | SecretApprovalMerge
-  | SecretApprovalClosed
-  | SecretApprovalRequest
-  | SecretApprovalReopened;
+  | UpdateUserDeniedPermissions;

backend/src/ee/models/gitAppInstallationSession.ts

@@ -29,4 +29,6 @@ const gitAppInstallationSession = new Schema<GitAppInstallationSession>({
 });
 
 
-export const GitAppInstallationSession = model<GitAppInstallationSession>("git_app_installation_session", gitAppInstallationSession);
+const GitAppInstallationSession = model<GitAppInstallationSession>("git_app_installation_session", gitAppInstallationSession);
+
+export default GitAppInstallationSession;

backend/src/ee/models/gitAppOrganizationInstallation.ts

@@ -26,4 +26,6 @@ const gitAppOrganizationInstallation = new Schema<Installation>({
 });
 
 
-export const GitAppOrganizationInstallation = model<Installation>("git_app_organization_installation", gitAppOrganizationInstallation);
+const GitAppOrganizationInstallation = model<Installation>("git_app_organization_installation", gitAppOrganizationInstallation);
+
+export default GitAppOrganizationInstallation;

backend/src/ee/models/gitRisks.ts

@@ -5,7 +5,7 @@ export const STATUS_RESOLVED_REVOKED = "RESOLVED_REVOKED";
 export const STATUS_RESOLVED_NOT_REVOKED = "RESOLVED_NOT_REVOKED";
 export const STATUS_UNRESOLVED = "UNRESOLVED";
 
-export type IGitRisks = {
+export type GitRisks = {
   id: string;
   description: string;
   startLine: string;
@@ -42,7 +42,7 @@ export type IGitRisks = {
   organization: Schema.Types.ObjectId,
 }
 
-const gitRisks = new Schema<IGitRisks>({
+const gitRisks = new Schema<GitRisks>({
   id: {
     type: String,
   },
@@ -147,4 +147,6 @@ const gitRisks = new Schema<IGitRisks>({
   }
 }, { timestamps: true });
 
-export const GitRisks = model<IGitRisks>("GitRisks", gitRisks);
+const GitRisks = model<GitRisks>("GitRisks", gitRisks);
+
+export default GitRisks;

backend/src/ee/models/index.ts

@@ -1,12 +1,11 @@
 export * from "./secretSnapshot";
 export * from "./secretVersion";
 export * from "./folderVersion";
-export * from "./role";
+export * from "./log";
+export * from "./action";
 export * from "./ssoConfig";
 export * from "./trustedIp";
 export * from "./auditLog";
 export * from  "./gitRisks";
 export * from  "./gitAppOrganizationInstallation";
 export * from  "./gitAppInstallationSession";
-export * from "./secretApprovalPolicy";
-export * from "./secretApprovalRequest";

backend/src/ee/models/log.ts

@@ -0,0 +1,72 @@
+import { Schema, Types, model } from "mongoose";
+import {
+    ACTION_ADD_SECRETS,
+    ACTION_DELETE_SECRETS,
+    ACTION_LOGIN,
+    ACTION_LOGOUT,
+    ACTION_READ_SECRETS,
+    ACTION_UPDATE_SECRETS,
+} from "../../variables";
+
+export interface ILog {
+    _id: Types.ObjectId;
+    user?: Types.ObjectId;
+    serviceAccount?: Types.ObjectId;
+    serviceTokenData?: Types.ObjectId;
+    workspace?: Types.ObjectId;
+    actionNames: string[];
+    actions: Types.ObjectId[];
+    channel: string;
+    ipAddress?: string;
+}
+
+const logSchema = new Schema<ILog>(
+    {
+        user: {
+            type: Schema.Types.ObjectId,
+            ref: "User",
+        },
+        serviceAccount: {
+            type: Schema.Types.ObjectId,
+            ref: "ServiceAccount",
+        },
+        serviceTokenData: {
+            type: Schema.Types.ObjectId,
+            ref: "ServiceTokenData",
+        },
+        workspace: {
+            type: Schema.Types.ObjectId,
+            ref: "Workspace",
+        },
+        actionNames: {
+            type: [String],
+            enum: [
+                ACTION_LOGIN,
+                ACTION_LOGOUT,
+                ACTION_ADD_SECRETS,
+                ACTION_UPDATE_SECRETS,
+                ACTION_READ_SECRETS,
+                ACTION_DELETE_SECRETS,
+            ],
+            required: true,
+        },
+        actions: [{
+            type: Schema.Types.ObjectId,
+            ref: "Action",
+            required: true,
+        }],
+        channel: {
+            type: String,
+            enum: ["web", "cli", "auto", "k8-operator", "other"],
+            required: true,
+        },
+        ipAddress: {
+            type: String,
+        },
+    }, 
+    {
+        timestamps: true,
+    }
+);
+
+export const Log = model<ILog>("Log", logSchema);

backend/src/ee/models/role.ts

@@ -50,4 +50,6 @@ const roleSchema = new Schema<IRole>(
 
 roleSchema.index({ organization: 1, workspace: 1 });
 
-export const Role = model<IRole>("Role", roleSchema);
+const Role = model<IRole>("Role", roleSchema);
+
+export default Role;

backend/src/ee/models/secretApprovalRequest.ts

@@ -1,203 +0,0 @@
-import { Schema, Types, model } from "mongoose";
-import { customAlphabet } from "nanoid";
-import {
-  ALGORITHM_AES_256_GCM,
-  ENCODING_SCHEME_BASE64,
-  ENCODING_SCHEME_UTF8
-} from "../../variables";
-
-export enum ApprovalStatus {
-  PENDING = "pending",
-  APPROVED = "approved",
-  REJECTED = "rejected"
-}
-
-export enum CommitType {
-  DELETE = "delete",
-  UPDATE = "update",
-  CREATE = "create"
-}
-
-const SLUG_ALPHABETS = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
-const nanoId = customAlphabet(SLUG_ALPHABETS, 10);
-
-export interface ISecretApprovalSecChange {
-  _id: Types.ObjectId;
-  version: number;
-  secretBlindIndex?: string;
-  secretKeyCiphertext: string;
-  secretKeyIV: string;
-  secretKeyTag: string;
-  secretValueCiphertext: string;
-  secretValueIV: string;
-  secretValueTag: string;
-  secretCommentIV?: string;
-  secretCommentTag?: string;
-  secretCommentCiphertext?: string;
-  skipMultilineEncoding?: boolean;
-  algorithm?: "aes-256-gcm";
-  keyEncoding?: "utf8" | "base64";
-  tags?: string[];
-}
-
-export type ISecretCommits<T = Types.ObjectId, J = Types.ObjectId> = Array<
-  | {
-      newVersion: ISecretApprovalSecChange;
-      op: CommitType.CREATE;
-    }
-  | {
-      // secret is recorded to get the latest version, we can keep ref to secret for pulling change as it will also get changed
-      //  on merge
-      secretVersion: J;
-      secret: T;
-      newVersion: Partial<Omit<ISecretApprovalSecChange, "_id">> & { _id: Types.ObjectId };
-      op: CommitType.UPDATE;
-    }
-  | {
-      secret: T;
-      secretVersion: J;
-      op: CommitType.DELETE;
-    }
->;
-export interface ISecretApprovalRequest {
-  _id: Types.ObjectId;
-  committer: Types.ObjectId;
-  slug: string;
-  statusChangeBy: Types.ObjectId;
-  reviewers: {
-    member: Types.ObjectId;
-    status: ApprovalStatus;
-  }[];
-  workspace: Types.ObjectId;
-  environment: string;
-  folderId: string;
-  hasMerged: boolean;
-  status: "open" | "close";
-  policy: Types.ObjectId;
-  commits: ISecretCommits;
-  conflicts: Array<{ secretId: string; op: CommitType }>;
-}
-
-const secretApprovalSecretChangeSchema = new Schema<ISecretApprovalSecChange>({
-  version: {
-    type: Number,
-    default: 1,
-    required: true
-  },
-  secretBlindIndex: {
-    type: String,
-    select: false
-  },
-  secretKeyCiphertext: {
-    type: String,
-    required: true
-  },
-  secretKeyIV: {
-    type: String, // symmetric
-    required: true
-  },
-  secretKeyTag: {
-    type: String, // symmetric
-    required: true
-  },
-  secretValueCiphertext: {
-    type: String,
-    required: true
-  },
-  secretValueIV: {
-    type: String, // symmetric
-    required: true
-  },
-  secretValueTag: {
-    type: String, // symmetric
-    required: true
-  },
-  skipMultilineEncoding: {
-    type: Boolean,
-    required: false
-  },
-  algorithm: {
-    // the encryption algorithm used
-    type: String,
-    enum: [ALGORITHM_AES_256_GCM],
-    required: true,
-    default: ALGORITHM_AES_256_GCM
-  },
-  keyEncoding: {
-    type: String,
-    enum: [ENCODING_SCHEME_UTF8, ENCODING_SCHEME_BASE64],
-    required: true,
-    default: ENCODING_SCHEME_UTF8
-  },
-  tags: {
-    ref: "Tag",
-    type: [Schema.Types.ObjectId],
-    default: []
-  }
-});
-
-const secretApprovalRequestSchema = new Schema<ISecretApprovalRequest>(
-  {
-    workspace: {
-      type: Schema.Types.ObjectId,
-      ref: "Workspace",
-      required: true
-    },
-    environment: {
-      type: String,
-      required: true
-    },
-    folderId: {
-      type: String,
-      required: true,
-      default: "root"
-    },
-    slug: {
-      type: String,
-      default: () => nanoId()
-    },
-    reviewers: {
-      type: [
-        {
-          member: {
-            // user associated with the personal secret
-            type: Schema.Types.ObjectId,
-            ref: "Membership"
-          },
-          status: { type: String, enum: ApprovalStatus, default: ApprovalStatus.PENDING }
-        }
-      ],
-      default: []
-    },
-    policy: { type: Schema.Types.ObjectId, ref: "SecretApprovalPolicy" },
-    hasMerged: { type: Boolean, default: false },
-    status: { type: String, enum: ["close", "open"], default: "open" },
-    committer: { type: Schema.Types.ObjectId, ref: "Membership" },
-    statusChangeBy: { type: Schema.Types.ObjectId, ref: "Membership" },
-    commits: [
-      {
-        secret: { type: Types.ObjectId, ref: "Secret" },
-        newVersion: secretApprovalSecretChangeSchema,
-        secretVersion: { type: Types.ObjectId, ref: "SecretVersion" },
-        op: { type: String, enum: [CommitType], required: true }
-      }
-    ],
-    conflicts: {
-      type: [
-        {
-          secretId: { type: String, required: true },
-          op: { type: String, enum: [CommitType], required: true }
-        }
-      ],
-      default: []
-    }
-  },
-  {
-    timestamps: true
-  }
-);
-
-export const SecretApprovalRequest = model<ISecretApprovalRequest>(
-  "SecretApprovalRequest",
-  secretApprovalRequestSchema
-);

backend/src/ee/routes/v1/action.ts

@@ -0,0 +1,8 @@
+import express from "express";
+const router = express.Router();
+import { actionController } from "../../controllers/v1";
+
+// TODO: put into action controller
+router.get("/:actionId", actionController.getAction);
+
+export default router;

backend/src/ee/routes/v1/index.ts

@@ -4,13 +4,10 @@ import organizations from "./organizations";
 import sso from "./sso";
 import users from "./users";
 import workspace from "./workspace";
+import action from "./action";
 import cloudProducts from "./cloudProducts";
 import secretScanning from "./secretScanning";
 import roles from "./role";
-import secretApprovalPolicy from "./secretApprovalPolicy";
-import secretApprovalRequest from "./secretApprovalRequest";
-import secretRotationProvider from "./secretRotationProvider";
-import secretRotation from "./secretRotation";
 
 export {
   secret,
@@ -19,11 +16,8 @@ export {
   sso,
   users,
   workspace,
+  action,
   cloudProducts,
   secretScanning,
-  roles,
-  secretApprovalPolicy,
-  secretApprovalRequest,
-  secretRotationProvider,
-  secretRotation
+  roles
 };

backend/src/ee/routes/v1/secretApprovalRequest.ts

@@ -1,55 +0,0 @@
-import express from "express";
-const router = express.Router();
-import { requireAuth } from "../../../middleware";
-import { secretApprovalRequestController } from "../../controllers/v1";
-import { AuthMode } from "../../../variables";
-
-router.get(
-  "/",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
-  }),
-  secretApprovalRequestController.getSecretApprovalRequests
-);
-
-router.get(
-  "/count",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
-  }),
-  secretApprovalRequestController.getSecretApprovalRequestCount
-);
-
-router.get(
-  "/:id",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
-  }),
-  secretApprovalRequestController.getSecretApprovalRequestDetails
-);
-
-router.post(
-  "/:id/merge",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
-  }),
-  secretApprovalRequestController.mergeSecretApprovalRequest
-);
-
-router.post(
-  "/:id/review",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
-  }),
-  secretApprovalRequestController.updateSecretApprovalReviewStatus
-);
-
-router.post(
-  "/:id/status",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
-  }),
-  secretApprovalRequestController.updateSecretApprovalRequestStatus
-);
-
-export default router;

backend/src/ee/routes/v1/secretRotation.ts

@@ -1,41 +0,0 @@
-import express from "express";
-
-import { AuthMode } from "../../../variables";
-import { requireAuth } from "../../../middleware";
-import { secretRotationController } from "../../controllers/v1";
-
-const router = express.Router();
-
-router.post(
-  "/",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
-  }),
-  secretRotationController.createSecretRotation
-);
-
-router.post(
-  "/restart",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
-  }),
-  secretRotationController.restartSecretRotations
-);
-
-router.get(
-  "/",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
-  }),
-  secretRotationController.getSecretRotations
-);
-
-router.delete(
-  "/:id",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
-  }),
-  secretRotationController.deleteSecretRotations
-);
-
-export default router;

backend/src/ee/routes/v1/secretRotationProvider.ts

@@ -1,17 +0,0 @@
-import express from "express";
-
-import { AuthMode } from "../../../variables";
-import { requireAuth } from "../../../middleware";
-import { secretRotationProviderController } from "../../controllers/v1";
-
-const router = express.Router();
-
-router.get(
-  "/:workspaceId",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
-  }),
-  secretRotationProviderController.getProviderTemplates
-);
-
-export default router;

backend/src/ee/routes/v1/sso.ts

@@ -6,23 +6,58 @@ import { ssoController } from "../../controllers/v1";
 import { authLimiter } from "../../../helpers/rateLimiter";
 import { AuthMode } from "../../../variables";
 
+router.get("/redirect/google", authLimiter, (req, res, next) => {
+  passport.authenticate("google", {
+    scope: ["profile", "email"],
+    session: false,
+    ...(req.query.callback_port
+      ? {
+          state: req.query.callback_port as string
+        }
+      : {})
+  })(req, res, next);
+});
+
 router.get(
-  "/redirect/saml2/:ssoIdentifier",
-  authLimiter,
-  (req, res, next) => {
-    const options = {
-        failureRedirect: "/",
-        additionalParams: {
-          RelayState: JSON.stringify({
-            spInitiated: true,
-            callbackPort: req.query.callback_port ?? ""
-          })
-        },
-    };
-    passport.authenticate("saml", options)(req, res, next);
-  }
+  "/google",
+  passport.authenticate("google", {
+    failureRedirect: "/login/provider/error",
+    session: false
+  }),
+  ssoController.redirectSSO
 );
 
+router.get("/redirect/github", authLimiter, (req, res, next) => {
+  passport.authenticate("github", {
+    session: false,
+    ...(req.query.callback_port
+      ? {
+          state: req.query.callback_port as string
+        }
+      : {})
+  })(req, res, next);
+});
+
+router.get(
+  "/github",
+  authLimiter,
+  passport.authenticate("github", {
+    failureRedirect: "/login/provider/error",
+    session: false
+  }),
+  ssoController.redirectSSO
+);
+
+router.get("/redirect/saml2/:ssoIdentifier", authLimiter, (req, res, next) => {
+  const options = {
+    failureRedirect: "/",
+    additionalParams: {
+      RelayState: req.query.callback_port ?? ""
+    }
+  };
+  passport.authenticate("saml", options)(req, res, next);
+});
+
 router.post(
   "/saml2/:ssoIdentifier",
   passport.authenticate("saml", {

backend/src/ee/routes/v1/workspace.ts

@@ -28,6 +28,14 @@ router.post(
   workspaceController.rollbackWorkspaceSecretSnapshot
 );
 
+router.get(
+  "/:workspaceId/logs",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  workspaceController.getWorkspaceLogs
+);
+
 router.get(
   "/:workspaceId/audit-logs",
   requireAuth({

backend/src/ee/routes/v3/apiKeyData.ts

@@ -1,31 +0,0 @@
-import express from "express";
-const router = express.Router();
-import { requireAuth } from "../../../middleware";
-import { AuthMode } from "../../../variables";
-import { apiKeyDataController } from "../../controllers/v3";
-
-router.post(
-    "/",
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT]
-    }),
-    apiKeyDataController.createAPIKeyData
-);
-
-router.patch(
-    "/:apiKeyDataId",
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT]
-    }),
-    apiKeyDataController.updateAPIKeyData
-);
-
-router.delete(
-    "/:apiKeyDataId",
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT]
-    }),
-    apiKeyDataController.deleteAPIKeyData
-);
-
-export default router;

backend/src/ee/routes/v3/index.ts

@@ -1,7 +0,0 @@
-import serviceTokenData from "./serviceTokenData";
-import apiKeyData from "./apiKeyData";
-
-export {
-    serviceTokenData,
-    apiKeyData
-}

backend/src/ee/routes/v3/serviceTokenData.ts

@@ -1,44 +0,0 @@
-import express from "express";
-const router = express.Router();
-import { requireAuth } from "../../../middleware";
-import { AuthMode } from "../../../variables";
-import { serviceTokenDataController } from "../../controllers/v3";
-
-router.get(
-  "/me/key",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.SERVICE_ACCESS_TOKEN]
-  }),
-  serviceTokenDataController.getServiceTokenDataKey
-);
-
-router.post(
-  "/me/token",
-  serviceTokenDataController.refreshToken
-);
-
-router.post(
-    "/",
-    requireAuth({
-      acceptedAuthModes: [AuthMode.JWT]
-    }),
-    serviceTokenDataController.createServiceTokenData
-);
-
-router.patch(
-    "/:serviceTokenDataId",
-    requireAuth({
-      acceptedAuthModes: [AuthMode.JWT]
-    }),
-    serviceTokenDataController.updateServiceTokenData
-);
-
-router.delete(
-  "/:serviceTokenDataId",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
-  }),
-  serviceTokenDataController.deleteServiceTokenData
-);
-
-export default router;

backend/src/ee/secretRotation/models.ts

@@ -1,91 +0,0 @@
-import { Schema, model } from "mongoose";
-import {
-  ALGORITHM_AES_256_GCM,
-  ENCODING_SCHEME_BASE64,
-  ENCODING_SCHEME_UTF8
-} from "../../variables";
-import { ISecretRotation } from "./types";
-
-const secretRotationSchema = new Schema(
-  {
-    workspace: {
-      type: Schema.Types.ObjectId,
-      ref: "Workspace"
-    },
-    provider: {
-      type: String,
-      required: true
-    },
-    customProvider: {
-      type: Schema.Types.ObjectId,
-      ref: "SecretRotationProvider"
-    },
-    environment: {
-      type: String,
-      required: true
-    },
-    secretPath: {
-      type: String,
-      required: true
-    },
-    interval: {
-      type: Number,
-      required: true
-    },
-    lastRotatedAt: {
-      type: String
-    },
-    status: {
-      type: String,
-      enum: ["success", "failed"]
-    },
-    statusMessage: {
-      type: String
-    },
-    // encrypted data on input keys and secrets got
-    encryptedData: {
-      type: String,
-      select: false
-    },
-    encryptedDataIV: {
-      type: String,
-      select: false
-    },
-    encryptedDataTag: {
-      type: String,
-      select: false
-    },
-    algorithm: {
-      // the encryption algorithm used
-      type: String,
-      enum: [ALGORITHM_AES_256_GCM],
-      required: true,
-      select: false,
-      default: ALGORITHM_AES_256_GCM
-    },
-    keyEncoding: {
-      type: String,
-      enum: [ENCODING_SCHEME_UTF8, ENCODING_SCHEME_BASE64],
-      required: true,
-      select: false,
-      default: ENCODING_SCHEME_UTF8
-    },
-    outputs: [
-      {
-        key: {
-          type: String,
-          required: true
-        },
-        secret: {
-          type: Schema.Types.ObjectId,
-          ref: "Secret"
-        }
-      }
-    ]
-  },
-  {
-    timestamps: true
-  }
-);
-
-export const SecretRotation = model<ISecretRotation>("SecretRotation", secretRotationSchema);

backend/src/ee/secretRotation/queue/queue.ts

@@ -1,288 +0,0 @@
-import Queue, { Job } from "bull";
-import { client, getEncryptionKey, getRootEncryptionKey } from "../../../config";
-import { BotService, EventService, TelemetryService } from "../../../services";
-import { SecretRotation } from "../models";
-import { rotationTemplates } from "../templates";
-import {
-  ISecretRotationData,
-  ISecretRotationEncData,
-  ISecretRotationProviderTemplate,
-  TProviderFunctionTypes
-} from "../types";
-import {
-  decryptSymmetric128BitHexKeyUTF8,
-  encryptSymmetric128BitHexKeyUTF8
-} from "../../../utils/crypto";
-import { ISecret, Secret } from "../../../models";
-import { ENCODING_SCHEME_BASE64, ENCODING_SCHEME_UTF8, SECRET_SHARED } from "../../../variables";
-import { EESecretService } from "../../services";
-import { SecretVersion } from "../../models";
-import { eventPushSecrets } from "../../../events";
-import { logger } from "../../../utils/logging";
-
-import {
-  secretRotationPreSetFn,
-  secretRotationRemoveFn,
-  secretRotationSetFn,
-  secretRotationTestFn
-} from "./queue.utils";
-
-const secretRotationQueue = new Queue("secret-rotation-service", process.env.REDIS_URL as string);
-
-secretRotationQueue.process(async (job: Job) => {
-  logger.info(`secretRotationQueue.process: [rotationDocument=${job.data.rotationDocId}]`);
-  const rotationStratDocId = job.data.rotationDocId;
-  const secretRotation = await SecretRotation.findById(rotationStratDocId)
-    .select("+encryptedData +encryptedDataTag +encryptedDataIV +keyEncoding")
-    .populate<{
-      outputs: [
-        {
-          key: string;
-          secret: ISecret;
-        }
-      ];
-    }>("outputs.secret");
-
-  const infisicalRotationProvider = rotationTemplates.find(
-    ({ name }) => name === secretRotation?.provider
-  );
-
-  try {
-    if (!infisicalRotationProvider || !secretRotation)
-      throw new Error("Failed to find rotation strategy");
-
-    if (secretRotation.outputs.some(({ secret }) => !secret))
-      throw new Error("Secrets not found in dashboard");
-
-    const workspaceId = secretRotation.workspace;
-
-    // deep copy
-    const provider = JSON.parse(
-      JSON.stringify(infisicalRotationProvider)
-    ) as ISecretRotationProviderTemplate;
-
-    // decrypt user  provided inputs for secret rotation
-    const encryptionKey = await getEncryptionKey();
-    const rootEncryptionKey = await getRootEncryptionKey();
-    let decryptedData = "";
-    if (rootEncryptionKey && secretRotation.keyEncoding === ENCODING_SCHEME_BASE64) {
-      // case: encoding scheme is base64
-      decryptedData = client.decryptSymmetric(
-        secretRotation.encryptedData,
-        rootEncryptionKey,
-        secretRotation.encryptedDataIV,
-        secretRotation.encryptedDataTag
-      );
-    } else if (encryptionKey && secretRotation.keyEncoding === ENCODING_SCHEME_UTF8) {
-      // case: encoding scheme is utf8
-      decryptedData = decryptSymmetric128BitHexKeyUTF8({
-        ciphertext: secretRotation.encryptedData,
-        iv: secretRotation.encryptedDataIV,
-        tag: secretRotation.encryptedDataTag,
-        key: encryptionKey
-      });
-    }
-
-    const variables = JSON.parse(decryptedData) as ISecretRotationEncData;
-
-    // rotation set cycle
-    const newCredential: ISecretRotationData = {
-      inputs: variables.inputs,
-      outputs: {},
-      internal: {}
-    };
-    // special glue code for database
-    if (provider.template.functions.set.type === TProviderFunctionTypes.DB) {
-      const lastCred = variables.creds.at(-1);
-      if (lastCred && variables.creds.length === 1) {
-        newCredential.internal.username =
-          lastCred.internal.username === variables.inputs.username1
-            ? variables.inputs.username2
-            : variables.inputs.username1;
-      } else {
-        newCredential.internal.username = lastCred
-          ? lastCred.internal.username
-          : variables.inputs.username1;
-      }
-    }
-    if (provider.template.functions.set?.pre) {
-      secretRotationPreSetFn(provider.template.functions.set.pre, newCredential);
-    }
-    await secretRotationSetFn(provider.template.functions.set, newCredential);
-    await secretRotationTestFn(provider.template.functions.test, newCredential);
-
-    if (variables.creds.length === 2) {
-      const deleteCycleCred = variables.creds.pop();
-      if (deleteCycleCred && provider.template.functions.remove) {
-        const deleteCycleVar = { inputs: variables.inputs, ...deleteCycleCred };
-        await secretRotationRemoveFn(provider.template.functions.remove, deleteCycleVar);
-      }
-    }
-    variables.creds.unshift({ outputs: newCredential.outputs, internal: newCredential.internal });
-    const { ciphertext, iv, tag } = client.encryptSymmetric(
-      JSON.stringify(variables),
-      rootEncryptionKey
-    );
-
-    // save the rotation state
-    await SecretRotation.findByIdAndUpdate(rotationStratDocId, {
-      encryptedData: ciphertext,
-      encryptedDataIV: iv,
-      encryptedDataTag: tag,
-      status: "success",
-      statusMessage: "Rotated successfully",
-      lastRotatedAt: new Date().toUTCString()
-    });
-
-    const key = await BotService.getWorkspaceKeyWithBot({
-      workspaceId: secretRotation.workspace
-    });
-
-    const encryptedSecrets = secretRotation.outputs.map(({ key: outputKey, secret }) => ({
-      secret,
-      value: encryptSymmetric128BitHexKeyUTF8({
-        plaintext:
-          typeof newCredential.outputs[outputKey] === "object"
-            ? JSON.stringify(newCredential.outputs[outputKey])
-            : String(newCredential.outputs[outputKey]),
-        key
-      })
-    }));
-
-    // now save the secret do a bulk update
-    // can't use the updateSecret function due to various parameter required issue
-    // REFACTOR(akhilmhdh): secret module should be lot more flexible. Ability to update bulk or individually by blindIndex, by id etc
-    await Secret.bulkWrite(
-      encryptedSecrets.map(({ secret, value }) => ({
-        updateOne: {
-          filter: {
-            workspace: workspaceId,
-            environment: secretRotation.environment,
-            _id: secret._id,
-            type: SECRET_SHARED
-          },
-          update: {
-            $inc: {
-              version: 1
-            },
-            secretValueCiphertext: value.ciphertext,
-            secretValueIV: value.iv,
-            secretValueTag: value.tag
-          }
-        }
-      }))
-    );
-
-    await EESecretService.addSecretVersions({
-      secretVersions: encryptedSecrets.map(({ secret, value }) => {
-        const {
-          _id,
-          version,
-          workspace,
-          type,
-          folder,
-          secretBlindIndex,
-          secretKeyIV,
-          secretKeyTag,
-          secretKeyCiphertext,
-          skipMultilineEncoding,
-          environment,
-          algorithm,
-          keyEncoding
-        } = secret;
-
-        return new SecretVersion({
-          secret: _id,
-          version: version + 1,
-          workspace: workspace,
-          type,
-          folder,
-          environment,
-          isDeleted: false,
-          secretBlindIndex: secretBlindIndex,
-          secretKeyCiphertext: secretKeyCiphertext,
-          secretKeyIV: secretKeyIV,
-          secretKeyTag: secretKeyTag,
-          secretValueCiphertext: value.ciphertext,
-          secretValueIV: value.iv,
-          secretValueTag: value.tag,
-          algorithm,
-          keyEncoding,
-          skipMultilineEncoding
-        });
-      })
-    });
-
-    // akhilmhdh: @tony need to do something about this as its depend on authData which is not possibile in here
-    // await EEAuditLogService.createAuditLog(
-    //   {actor:ActorType.Machine},
-    //   {
-    //     type: EventType.UPDATE_SECRETS,
-    //     metadata: {
-    //       environment,
-    //       secretPath,
-    //       secrets: secretsToBeUpdated.map(({ _id, version, secretBlindIndex }) => ({
-    //         secretId: _id.toString(),
-    //         secretKey: secretBlindIndexToKey[secretBlindIndex || ""],
-    //         secretVersion: version + 1
-    //       }))
-    //     }
-    //   },
-    //   {
-    //     workspaceId
-    //   }
-    // );
-
-    const folderId = encryptedSecrets?.[0]?.secret?.folder;
-    // (EE) take a secret snapshot
-    await EESecretService.takeSecretSnapshot({
-      workspaceId,
-      environment: secretRotation.environment,
-      folderId
-    });
-
-    await EventService.handleEvent({
-      event: eventPushSecrets({
-        workspaceId: secretRotation.workspace,
-        environment: secretRotation.environment,
-        secretPath: secretRotation.secretPath
-      })
-    });
-
-    const postHogClient = await TelemetryService.getPostHogClient();
-    if (postHogClient) {
-      postHogClient.capture({
-        event: "secrets rotated",
-        properties: {
-          numberOfSecrets: encryptedSecrets.length,
-          environment: secretRotation.environment,
-          workspaceId,
-          folderId
-        }
-      });
-    }
-  } catch (err) {
-    logger.error(err);
-    await SecretRotation.findByIdAndUpdate(rotationStratDocId, {
-      status: "failed",
-      statusMessage: (err as Error).message,
-      lastRotatedAt: new Date().toUTCString()
-    });
-  }
-
-  return Promise.resolve();
-});
-
-const daysToMillisecond = (days: number) => days * 24 * 60 * 60 * 1000;
-export const startSecretRotationQueue = async (rotationDocId: string, interval: number) => {
-  // when migration to bull mq just use the option immedite to trigger repeatable immediately
-  secretRotationQueue.add({ rotationDocId }, { jobId: rotationDocId, removeOnComplete: true });
-  return secretRotationQueue.add(
-    { rotationDocId },
-    { repeat: { every: daysToMillisecond(interval) }, jobId: rotationDocId }
-  );
-};
-
-export const removeSecretRotationQueue = async (rotationDocId: string, interval: number) => {
-  return secretRotationQueue.removeRepeatable({ every: interval * 1000, jobId: rotationDocId });
-};

backend/src/ee/secretRotation/queue/queue.utils.ts

@@ -1,179 +0,0 @@
-import axios from "axios";
-import jmespath from "jmespath";
-import { customAlphabet } from "nanoid";
-import { Client as PgClient } from "pg";
-import mysql from "mysql2";
-import {
-  ISecretRotationData,
-  TAssignOp,
-  TDbProviderClients,
-  TDbProviderFunction,
-  TDirectAssignOp,
-  THttpProviderFunction,
-  TProviderFunction,
-  TProviderFunctionTypes
-} from "../types";
-const REGEX = /\${([^}]+)}/g;
-const SLUG_ALPHABETS = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
-const nanoId = customAlphabet(SLUG_ALPHABETS, 10);
-
-export const interpolate = (data: any, getValue: (key: string) => unknown) => {
-  if (!data) return;
-
-  if (typeof data === "number") return data;
-
-  if (typeof data === "string") {
-    return data.replace(REGEX, (_a, b) => getValue(b) as string);
-  }
-
-  if (typeof data === "object" && Array.isArray(data)) {
-    data.forEach((el, index) => {
-      data[index] = interpolate(el, getValue);
-    });
-  }
-
-  if (typeof data === "object") {
-    if ((data as { ref: string })?.ref) return getValue((data as { ref: string }).ref);
-    const temp = data as Record<string, unknown>; // for converting ts object to record type
-    Object.keys(temp).forEach((key) => {
-      temp[key as keyof typeof temp] = interpolate(data[key as keyof typeof temp], getValue);
-    });
-  }
-  return data;
-};
-
-const getInterpolationValue = (variables: ISecretRotationData) => (key: string) => {
-  if (key.includes("|")) {
-    const [keyword, ...arg] = key.split("|").map((el) => el.trim());
-    switch (keyword) {
-      case "random": {
-        return nanoId(parseInt(arg[0], 10));
-      }
-      default: {
-        throw Error(`Interpolation key not found - ${key}`);
-      }
-    }
-  }
-  const [type, keyName] = key.split(".").map((el) => el.trim());
-  return variables[type as keyof ISecretRotationData][keyName];
-};
-
-export const secretRotationHttpFn = async (
-  func: THttpProviderFunction,
-  variables: ISecretRotationData
-) => {
-  // string interpolation
-  const headers = interpolate(func.header, getInterpolationValue(variables));
-  const url = interpolate(func.url, getInterpolationValue(variables));
-  const body = interpolate(func.body, getInterpolationValue(variables));
-  // axios will automatically throw error if req status is not between 2xx range
-  return axios({ method: func.method, url, headers, data: body });
-};
-
-export const secretRotationDbFn = async (
-  func: TDbProviderFunction,
-  variables: ISecretRotationData
-) => {
-  const { type, client, pre, ...dbConnection } = func;
-  const { username, password, host, database, port, query, ca } = interpolate(
-    dbConnection,
-    getInterpolationValue(variables)
-  );
-  const ssl = ca ? { rejectUnauthorized: false, ca } : undefined;
-  if (host === "localhost" || host === "127.0.0.1") throw new Error("Invalid db host");
-  if (client === TDbProviderClients.Pg) {
-    const pgClient = new PgClient({ user: username, password, host, database, port, ssl });
-    await pgClient.connect();
-    const res = await pgClient.query(query);
-    await pgClient.end();
-    return res.rows[0];
-  } else if (client === TDbProviderClients.Sql) {
-    const sqlClient = mysql.createPool({
-      user: username,
-      password,
-      host,
-      database,
-      port,
-      connectionLimit: 1,
-      ssl
-    });
-    const res = await new Promise((resolve, reject) => {
-      sqlClient.query(query, (err, data) => {
-        if (err) return reject(err);
-        resolve(data);
-      });
-    });
-    await new Promise((resolve, reject) => {
-      sqlClient.end(function (err) {
-        if (err) return reject(err);
-        return resolve({});
-      });
-    });
-    return (res as any)?.[0];
-  }
-};
-
-export const secretRotationPreSetFn = (
-  op: Record<string, TDirectAssignOp>,
-  variables: ISecretRotationData
-) => {
-  const getValFn = getInterpolationValue(variables);
-  Object.entries(op || {}).forEach(([key, assignFn]) => {
-    const [type, keyName] = key.split(".") as [keyof ISecretRotationData, string];
-    variables[type][keyName] = interpolate(assignFn.value, getValFn);
-  });
-};
-
-export const secretRotationSetFn = async (
-  func: TProviderFunction,
-  variables: ISecretRotationData
-) => {
-  const getValFn = getInterpolationValue(variables);
-  // http setter
-  if (func.type === TProviderFunctionTypes.HTTP) {
-    const res = await secretRotationHttpFn(func, variables);
-    Object.entries(func.setter || {}).forEach(([key, assignFn]) => {
-      const [type, keyName] = key.split(".") as [keyof ISecretRotationData, string];
-      if (assignFn.assign === TAssignOp.JmesPath) {
-        variables[type][keyName] = jmespath.search(res.data, assignFn.path);
-      } else if (assignFn.value) {
-        variables[type][keyName] = interpolate(assignFn.value, getValFn);
-      }
-    });
-    // db setter
-  } else if (func.type === TProviderFunctionTypes.DB) {
-    const data = await secretRotationDbFn(func, variables);
-    Object.entries(func.setter || {}).forEach(([key, assignFn]) => {
-      const [type, keyName] = key.split(".") as [keyof ISecretRotationData, string];
-      if (assignFn.assign === TAssignOp.JmesPath) {
-        if (typeof data === "object") {
-          variables[type][keyName] = jmespath.search(data, assignFn.path);
-        }
-      } else if (assignFn.value) {
-        variables[type][keyName] = interpolate(assignFn.value, getValFn);
-      }
-    });
-  }
-};
-
-export const secretRotationTestFn = async (
-  func: TProviderFunction,
-  variables: ISecretRotationData
-) => {
-  if (func.type === TProviderFunctionTypes.HTTP) {
-    await secretRotationHttpFn(func, variables);
-  } else if (func.type === TProviderFunctionTypes.DB) {
-    await secretRotationDbFn(func, variables);
-  }
-};
-
-export const secretRotationRemoveFn = async (
-  func: TProviderFunction,
-  variables: ISecretRotationData
-) => {
-  if (!func) return;
-  if (func.type === TProviderFunctionTypes.HTTP) {
-    // string interpolation
-    return await secretRotationHttpFn(func, variables);
-  }
-};

backend/src/ee/secretRotation/service.ts

@@ -1,130 +0,0 @@
-import { ISecretRotationEncData, TCreateSecretRotation, TGetProviderTemplates } from "./types";
-import { rotationTemplates } from "./templates";
-import { SecretRotation } from "./models";
-import { client, getEncryptionKey, getRootEncryptionKey } from "../../config";
-import { BadRequestError } from "../../utils/errors";
-import Ajv from "ajv";
-import { removeSecretRotationQueue, startSecretRotationQueue } from "./queue/queue";
-import {
-  ALGORITHM_AES_256_GCM,
-  ENCODING_SCHEME_BASE64,
-  ENCODING_SCHEME_UTF8
-} from "../../variables";
-import { encryptSymmetric128BitHexKeyUTF8 } from "../../utils/crypto";
-
-const ajv = new Ajv({ strict: false });
-
-export const getProviderTemplate = async ({ workspaceId }: TGetProviderTemplates) => {
-  return {
-    custom: [],
-    providers: rotationTemplates
-  };
-};
-
-export const createSecretRotation = async ({
-  workspaceId,
-  secretPath,
-  environment,
-  provider,
-  interval,
-  inputs,
-  outputs
-}: TCreateSecretRotation) => {
-  const rotationTemplate = rotationTemplates.find(({ name }) => name === provider);
-  if (!rotationTemplate) throw BadRequestError({ message: "Provider not found" });
-
-  const formattedInputs: Record<string, unknown> = {};
-  Object.entries(inputs).forEach(([key, value]) => {
-    const type = rotationTemplate.template.inputs.properties[key].type;
-    if (type === "string") {
-      formattedInputs[key] = value;
-      return;
-    }
-    if (type === "integer") {
-      formattedInputs[key] = parseInt(value as string, 10);
-      return;
-    }
-    formattedInputs[key] = JSON.parse(value as string);
-  });
-  // ensure input one follows the correct schema
-  const valid = ajv.validate(rotationTemplate.template.inputs, formattedInputs);
-  if (!valid) {
-    throw BadRequestError({ message: ajv.errors?.[0].message });
-  }
-
-  const encData: Partial<ISecretRotationEncData> = {
-    inputs: formattedInputs,
-    creds: []
-  };
-
-  const secretRotation = new SecretRotation({
-    workspace: workspaceId,
-    provider,
-    environment,
-    secretPath,
-    interval,
-    outputs: Object.entries(outputs).map(([key, secret]) => ({ key, secret }))
-  });
-
-  const encryptionKey = await getEncryptionKey();
-  const rootEncryptionKey = await getRootEncryptionKey();
-
-  if (rootEncryptionKey) {
-    const { ciphertext, iv, tag } = client.encryptSymmetric(
-      JSON.stringify(encData),
-      rootEncryptionKey
-    );
-    secretRotation.encryptedDataIV = iv;
-    secretRotation.encryptedDataTag = tag;
-    secretRotation.encryptedData = ciphertext;
-    secretRotation.algorithm = ALGORITHM_AES_256_GCM;
-    secretRotation.keyEncoding = ENCODING_SCHEME_BASE64;
-  } else if (encryptionKey) {
-    const { ciphertext, iv, tag } = encryptSymmetric128BitHexKeyUTF8({
-      plaintext: JSON.stringify(encData),
-      key: encryptionKey
-    });
-    secretRotation.encryptedDataIV = iv;
-    secretRotation.encryptedDataTag = tag;
-    secretRotation.encryptedData = ciphertext;
-    secretRotation.algorithm = ALGORITHM_AES_256_GCM;
-    secretRotation.keyEncoding = ENCODING_SCHEME_UTF8;
-  }
-
-  await secretRotation.save();
-  await startSecretRotationQueue(secretRotation._id.toString(), interval);
-
-  return secretRotation;
-};
-
-export const deleteSecretRotation = async ({ id }: { id: string }) => {
-  const doc = await SecretRotation.findByIdAndRemove(id);
-  if (!doc) throw BadRequestError({ message: "Rotation not found" });
-
-  await removeSecretRotationQueue(doc._id.toString(), doc.interval);
-  return doc;
-};
-
-export const restartSecretRotation = async ({ id }: { id: string }) => {
-  const secretRotation = await SecretRotation.findById(id);
-  if (!secretRotation) throw BadRequestError({ message: "Rotation not found" });
-
-  await removeSecretRotationQueue(secretRotation._id.toString(), secretRotation.interval);
-  await startSecretRotationQueue(secretRotation._id.toString(), secretRotation.interval);
-
-  return secretRotation;
-};
-
-export const getSecretRotationById = async ({ id }: { id: string }) => {
-  const doc = await SecretRotation.findById(id);
-  if (!doc) throw BadRequestError({ message: "Rotation not found" });
-  return doc;
-};
-
-export const getSecretRotationOfWorkspace = async (workspaceId: string) => {
-  const secretRotations = await SecretRotation.find({
-    workspace: workspaceId
-  }).populate("outputs.secret");
-
-  return secretRotations;
-};

backend/src/ee/secretRotation/templates/index.ts

@@ -1,28 +0,0 @@
-import { ISecretRotationProviderTemplate } from "../types";
-import { MYSQL_TEMPLATE } from "./mysql";
-import { POSTGRES_TEMPLATE } from "./postgres";
-import { SENDGRID_TEMPLATE } from "./sendgrid";
-
-export const rotationTemplates: ISecretRotationProviderTemplate[] = [
-  {
-    name: "sendgrid",
-    title: "Twilio Sendgrid",
-    image: "sendgrid.png",
-    description: "Rotate Twilio Sendgrid API keys",
-    template: SENDGRID_TEMPLATE
-  },
-  {
-    name: "postgres",
-    title: "PostgreSQL",
-    image: "postgres.png",
-    description: "Rotate PostgreSQL/CockroachDB user credentials",
-    template: POSTGRES_TEMPLATE
-  },
-  {
-    name: "mysql",
-    title: "MySQL",
-    image: "mysql.png",
-    description: "Rotate MySQL@7/MariaDB user credentials",
-    template: MYSQL_TEMPLATE
-  }
-];

backend/src/ee/secretRotation/templates/mysql.ts

@@ -1,83 +0,0 @@
-import { TAssignOp, TDbProviderClients, TProviderFunctionTypes } from "../types";
-
-export const MYSQL_TEMPLATE = {
-  inputs: {
-    type: "object" as const,
-    properties: {
-      admin_username: { type: "string" as const },
-      admin_password: { type: "string" as const },
-      host: { type: "string" as const },
-      database: { type: "string" as const },
-      port: { type: "integer" as const, default: "3306" },
-      username1: {
-        type: "string",
-        default: "infisical-sql-user1",
-        desc: "This user must be created in your database"
-      },
-      username2: {
-        type: "string",
-        default: "infisical-sql-user2",
-        desc: "This user must be created in your database"
-      },
-      ca: { type: "string", desc: "SSL certificate for db auth(string)" }
-    },
-    required: [
-      "admin_username",
-      "admin_password",
-      "host",
-      "database",
-      "username1",
-      "username2",
-      "port"
-    ],
-    additionalProperties: false
-  },
-  outputs: {
-    db_username: { type: "string" },
-    db_password: { type: "string" }
-  },
-  internal: {
-    rotated_password: { type: "string" },
-    username: { type: "string" }
-  },
-  functions: {
-    set: {
-      type: TProviderFunctionTypes.DB as const,
-      client: TDbProviderClients.Sql,
-      username: "${inputs.admin_username}",
-      password: "${inputs.admin_password}",
-      host: "${inputs.host}",
-      database: "${inputs.database}",
-      port: "${inputs.port}",
-      ca: "${inputs.ca}",
-      query: "ALTER USER ${internal.username} IDENTIFIED BY '${internal.rotated_password}'",
-      setter: {
-        "outputs.db_username": {
-          assign: TAssignOp.Direct as const,
-          value: "${internal.username}"
-        },
-        "outputs.db_password": {
-          assign: TAssignOp.Direct as const,
-          value: "${internal.rotated_password}"
-        }
-      },
-      pre: {
-        "internal.rotated_password": {
-          assign: TAssignOp.Direct as const,
-          value: "${random | 32}"
-        }
-      }
-    },
-    test: {
-      type: TProviderFunctionTypes.DB as const,
-      client: TDbProviderClients.Sql,
-      username: "${internal.username}",
-      password: "${internal.rotated_password}",
-      host: "${inputs.host}",
-      database: "${inputs.database}",
-      port: "${inputs.port}",
-      ca: "${inputs.ca}",
-      query: "SELECT NOW()"
-    }
-  }
-};

backend/src/ee/secretRotation/templates/postgres.ts

@@ -1,83 +0,0 @@
-import { TAssignOp, TDbProviderClients, TProviderFunctionTypes } from "../types";
-
-export const POSTGRES_TEMPLATE = {
-  inputs: {
-    type: "object" as const,
-    properties: {
-      admin_username: { type: "string" as const },
-      admin_password: { type: "string" as const },
-      host: { type: "string" as const },
-      database: { type: "string" as const },
-      port: { type: "integer" as const, default: "5432" },
-      username1: {
-        type: "string",
-        default: "infisical-pg-user1",
-        desc: "This user must be created in your database"
-      },
-      username2: {
-        type: "string",
-        default: "infisical-pg-user2",
-        desc: "This user must be created in your database"
-      },
-      ca: { type: "string", desc: "SSL certificate for db auth(string)" }
-    },
-    required: [
-      "admin_username",
-      "admin_password",
-      "host",
-      "database",
-      "username1",
-      "username2",
-      "port"
-    ],
-    additionalProperties: false
-  },
-  outputs: {
-    db_username: { type: "string" },
-    db_password: { type: "string" }
-  },
-  internal: {
-    rotated_password: { type: "string" },
-    username: { type: "string" }
-  },
-  functions: {
-    set: {
-      type: TProviderFunctionTypes.DB as const,
-      client: TDbProviderClients.Pg,
-      username: "${inputs.admin_username}",
-      password: "${inputs.admin_password}",
-      host: "${inputs.host}",
-      database: "${inputs.database}",
-      port: "${inputs.port}",
-      ca: "${inputs.ca}",
-      query: "ALTER USER ${internal.username} WITH PASSWORD '${internal.rotated_password}'",
-      setter: {
-        "outputs.db_username": {
-          assign: TAssignOp.Direct as const,
-          value: "${internal.username}"
-        },
-        "outputs.db_password": {
-          assign: TAssignOp.Direct as const,
-          value: "${internal.rotated_password}"
-        }
-      },
-      pre: {
-        "internal.rotated_password": {
-          assign: TAssignOp.Direct as const,
-          value: "${random | 32}"
-        }
-      }
-    },
-    test: {
-      type: TProviderFunctionTypes.DB as const,
-      client: TDbProviderClients.Pg,
-      username: "${internal.username}",
-      password: "${internal.rotated_password}",
-      host: "${inputs.host}",
-      database: "${inputs.database}",
-      port: "${inputs.port}",
-      ca: "${inputs.ca}",
-      query: "SELECT NOW()"
-    }
-  }
-};

backend/src/ee/secretRotation/templates/sendgrid.ts

@@ -1,63 +0,0 @@
-import { TAssignOp, TProviderFunctionTypes } from "../types";
-
-export const SENDGRID_TEMPLATE = {
-  inputs: {
-    type: "object" as const,
-    properties: {
-      admin_api_key: { type: "string" as const, desc: "Sendgrid admin api key to create new keys" },
-      api_key_scopes: {
-        type: "array",
-        items: { type: "string" as const },
-        desc: "Scopes for created tokens by rotation(Array)"
-      }
-    },
-    required: ["admin_api_key", "api_key_scopes"],
-    additionalProperties: false
-  },
-  outputs: {
-    api_key: { type: "string" }
-  },
-  internal: {
-    api_key_id: { type: "string" }
-  },
-  functions: {
-    set: {
-      type: TProviderFunctionTypes.HTTP as const,
-      url: "https://api.sendgrid.com/v3/api_keys",
-      method: "POST",
-      header: {
-        Authorization: "Bearer ${inputs.admin_api_key}"
-      },
-      body: {
-        name: "infisical-${random | 16}",
-        scopes: { ref: "inputs.api_key_scopes" }
-      },
-      setter: {
-        "outputs.api_key": {
-          assign: TAssignOp.JmesPath as const,
-          path: "api_key"
-        },
-        "internal.api_key_id": {
-          assign: TAssignOp.JmesPath as const,
-          path: "api_key_id"
-        }
-      }
-    },
-    remove: {
-      type: TProviderFunctionTypes.HTTP as const,
-      url: "https://api.sendgrid.com/v3/api_keys/${internal.api_key_id}",
-      header: {
-        Authorization: "Bearer ${inputs.admin_api_key}"
-      },
-      method: "DELETE"
-    },
-    test: {
-      type: TProviderFunctionTypes.HTTP as const,
-      url: "https://api.sendgrid.com/v3/api_keys/${internal.api_key_id}",
-      header: {
-        Authorization: "Bearer ${inputs.admin_api_key}"
-      },
-      method: "GET"
-    }
-  }
-};

backend/src/ee/secretRotation/types.ts

@@ -1,131 +0,0 @@
-import { Document, Types } from "mongoose";
-
-export interface ISecretRotation extends Document {
-  _id: Types.ObjectId;
-  name: string;
-  interval: number;
-  provider: string;
-  customProvider: Types.ObjectId;
-  workspace: Types.ObjectId;
-  environment: string;
-  secretPath: string;
-  outputs: Array<{
-    key: string;
-    secret: Types.ObjectId;
-  }>;
-  status?: "success" | "failed";
-  lastRotatedAt?: string;
-  statusMessage?: string;
-  encryptedData: string;
-  encryptedDataIV: string;
-  encryptedDataTag: string;
-  algorithm: string;
-  keyEncoding: string;
-}
-
-export type ISecretRotationEncData = {
-  inputs: Record<string, unknown>;
-  creds: Array<{
-    outputs: Record<string, unknown>;
-    internal: Record<string, unknown>;
-  }>;
-};
-
-export type ISecretRotationData = {
-  inputs: Record<string, unknown>;
-  outputs: Record<string, unknown>;
-  internal: Record<string, unknown>;
-};
-
-export type ISecretRotationProviderTemplate = {
-  name: string;
-  title: string;
-  image?: string;
-  description?: string;
-  template: TProviderTemplate;
-};
-
-export enum TProviderFunctionTypes {
-  HTTP = "http",
-  DB = "database"
-}
-
-export enum TDbProviderClients {
-  // postgres, cockroack db, amazon red shift
-  Pg = "pg",
-  // mysql and maria db
-  Sql = "sql"
-}
-
-export enum TAssignOp {
-  Direct = "direct",
-  JmesPath = "jmesopath"
-}
-
-export type TJmesPathAssignOp = {
-  assign: TAssignOp.JmesPath;
-  path: string;
-};
-
-export type TDirectAssignOp = {
-  assign: TAssignOp.Direct;
-  value: string;
-};
-
-export type TAssignFunction = TJmesPathAssignOp | TDirectAssignOp;
-
-export type THttpProviderFunction = {
-  type: TProviderFunctionTypes.HTTP;
-  url: string;
-  method: string;
-  header?: Record<string, string>;
-  query?: Record<string, string>;
-  body?: Record<string, unknown>;
-  setter?: Record<string, TAssignFunction>;
-  pre?: Record<string, TDirectAssignOp>;
-};
-
-export type TDbProviderFunction = {
-  type: TProviderFunctionTypes.DB;
-  client: TDbProviderClients;
-  username: string;
-  password: string;
-  host: string;
-  database: string;
-  port: string;
-  query: string;
-  setter?: Record<string, TAssignFunction>;
-  pre?: Record<string, TDirectAssignOp>;
-};
-
-export type TProviderFunction = THttpProviderFunction | TDbProviderFunction;
-
-export type TProviderTemplate = {
-  inputs: {
-    type: "object";
-    properties: Record<string, { type: string; [x: string]: unknown; desc?: string }>;
-    required?: string[];
-  };
-  outputs: Record<string, unknown>;
-  functions: {
-    set: TProviderFunction;
-    remove?: TProviderFunction;
-    test: TProviderFunction;
-  };
-};
-
-// function type args
-export type TGetProviderTemplates = {
-  workspaceId: string;
-};
-
-export type TCreateSecretRotation = {
-  provider: string;
-  customProvider?: string;
-  workspaceId: string;
-  secretPath: string;
-  environment: string;
-  interval: number;
-  inputs: Record<string, unknown>;
-  outputs: Record<string, string>;
-};