Merge pull request #1004 from vwbusguy/bugfix/no-auto-capitalization-support

Fix no Auto-Capitalization for secrets get/set. Fixes #1003

.env.example

@@ -25,6 +25,9 @@ JWT_PROVIDER_AUTH_LIFETIME=
 # Required
 MONGO_URL=mongodb://root:example@mongo:27017/?authSource=admin
 
+# Redis
+REDIS_URL=redis://redis:6379
+
 # Optional credentials for MongoDB container instance and Mongo-Express
 MONGO_USERNAME=root
 MONGO_PASSWORD=example

.github/ISSUE_TEMPLATE/feature_request.md

@@ -8,7 +8,7 @@ assignees: ''
 ---
 
 ### Feature description
-A clear and concise description of what the the feature should be.
+A clear and concise description of what the feature should be.
 
 ### Why would it be useful?
 Why would this feature be useful for Infisical users? 

.github/workflows/build-docker-image-to-prod.yml

@@ -17,9 +17,9 @@ jobs:
       - name: 📦 Install dependencies to test all dependencies
         run: npm ci --only-production
         working-directory: backend
-      - name: 🧪 Run tests
-        run: npm run test:ci
-        working-directory: backend
+      # - name: 🧪 Run tests
+      #   run: npm run test:ci
+      #   working-directory: backend
       - name: Save commit hashes for tag
         id: commit
         uses: pr-mpt/actions-commit-hash@v2

.github/workflows/build-staging-img.yml

@@ -11,9 +11,9 @@ jobs:
       - name: 📦 Install dependencies to test all dependencies
         run: npm ci --only-production
         working-directory: backend
-      - name: 🧪 Run tests
-        run: npm run test:ci
-        working-directory: backend
+      # - name: 🧪 Run tests
+      #   run: npm run test:ci
+      #   working-directory: backend
       - name: Save commit hashes for tag
         id: commit
         uses: pr-mpt/actions-commit-hash@v2

.gitignore

@@ -57,3 +57,6 @@ yarn-error.log*
 
 # Infisical init
 .infisical.json
+
+# Editor specific
+.vscode/*

.goreleaser.yaml

@@ -108,6 +108,22 @@ brews:
       zsh_completion.install "completions/infisical.zsh" => "_infisical"
       fish_completion.install "completions/infisical.fish"
       man1.install "manpages/infisical.1.gz"
+  - name: 'infisical@{{.Version}}'
+    tap:
+      owner: Infisical
+      name: homebrew-get-cli
+    commit_author:
+      name: "Infisical"
+      email: ai@infisical.com
+    folder: Formula
+    homepage: "https://infisical.com"
+    description: "The official Infisical CLI"
+    install: |-
+      bin.install "infisical"
+      bash_completion.install "completions/infisical.bash" => "infisical"
+      zsh_completion.install "completions/infisical.zsh" => "_infisical"
+      fish_completion.install "completions/infisical.fish"
+      man1.install "manpages/infisical.1.gz"
 
 nfpms:
   - id: infisical

.husky/pre-commit

@@ -1,4 +1,3 @@
-
 #!/usr/bin/env sh
 . "$(dirname -- "$0")/_/husky.sh"
 

.infisicalignore

@@ -1 +1 @@
-.github/resources/docker-compose.be-test.yml:generic-api-key:16
+.github/resources/docker-compose.be-test.yml:generic-api-key:16

.vscode/settings.json

@@ -1,3 +0,0 @@
-{
-	"workbench.editor.wrapTabs": true
-}

backend/.eslintrc

@@ -10,6 +10,8 @@
     "plugin:@typescript-eslint/recommended"
   ],
   "rules": {
+    "no-empty-function": "off",
+    "@typescript-eslint/no-empty-function": "off",
     "no-console": 2,
     "quotes": [
       "error",

backend/Dockerfile

@@ -14,18 +14,20 @@ FROM node:16-alpine
 
 WORKDIR /app
 
+ENV npm_config_cache /home/node/.npm
+
 COPY package*.json ./
-RUN npm ci --only-production
+RUN npm ci --only-production && npm cache clean --force
 
 COPY --from=build /app .
 
 RUN apk add --no-cache bash curl && curl -1sLf \
   'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.alpine.sh' | bash \
-  && apk add infisical=0.8.1
+  && apk add infisical=0.8.1 && apk add --no-cache git
 
 HEALTHCHECK --interval=10s --timeout=3s --start-period=10s \  
   CMD node healthcheck.js
 
 EXPOSE 4000
 
-CMD ["npm", "run", "start"]
+CMD ["node", "build/index.js"]

backend/package.json

@@ -1,6 +1,8 @@
 {
   "dependencies": {
     "@aws-sdk/client-secrets-manager": "^3.319.0",
+    "@casl/ability": "^6.5.0",
+    "@casl/mongoose": "^7.2.1",
     "@godaddy/terminus": "^4.12.0",
     "@node-saml/passport-saml": "^4.0.4",
     "@octokit/rest": "^19.0.5",
@@ -8,6 +10,7 @@
     "@sentry/tracing": "^7.48.0",
     "@types/crypto-js": "^4.1.1",
     "@types/libsodium-wrappers": "^0.7.10",
+    "@ucast/mongo2js": "^1.3.4",
     "argon2": "^0.30.3",
     "aws-sdk": "^2.1364.0",
     "axios": "^1.3.5",
@@ -25,30 +28,33 @@
     "handlebars": "^4.7.7",
     "helmet": "^5.1.1",
     "infisical-node": "^1.2.1",
+    "ioredis": "^5.3.2",
     "js-yaml": "^4.1.0",
     "jsonwebtoken": "^9.0.0",
     "jsrp": "^0.2.4",
     "libsodium-wrappers": "^0.7.10",
     "lodash": "^4.17.21",
-    "mongoose": "^6.10.5",
+    "mongodb": "^5.7.0",
+    "mongoose": "^7.4.1",
     "nanoid": "^3.3.6",
     "node-cache": "^5.1.2",
     "nodemailer": "^6.8.0",
     "passport": "^0.6.0",
+    "passport-github": "^1.1.0",
     "passport-google-oauth20": "^2.0.0",
     "posthog-node": "^2.6.0",
     "probot": "^12.3.1",
     "query-string": "^7.1.3",
     "rate-limit-mongo": "^2.3.2",
     "rimraf": "^3.0.2",
-    "swagger-autogen": "^2.22.0",
     "swagger-ui-express": "^4.6.2",
     "tweetnacl": "^1.0.3",
     "tweetnacl-util": "^0.15.1",
     "typescript": "^4.9.3",
     "utility-types": "^3.10.0",
     "winston": "^3.8.2",
-    "winston-loki": "^6.0.6"
+    "winston-loki": "^6.0.6",
+    "zod": "^3.21.4"
   },
   "name": "infisical-api",
   "version": "1.0.0",
@@ -82,6 +88,7 @@
     "@posthog/plugin-scaffold": "^1.3.4",
     "@types/bcrypt": "^5.0.0",
     "@types/bcryptjs": "^2.4.2",
+    "@types/bull": "^4.10.0",
     "@types/cookie-parser": "^1.4.3",
     "@types/cors": "^2.8.12",
     "@types/express": "^4.17.14",
@@ -107,6 +114,7 @@
     "npm": "^8.19.3",
     "smee-client": "^1.2.3",
     "supertest": "^6.3.3",
+    "swagger-autogen": "^2.23.5",
     "ts-jest": "^29.0.3",
     "ts-node": "^10.9.1"
   },

backend/src/config/index.ts

@@ -36,17 +36,23 @@ export const getClientIdVercel = async () => (await client.getSecret("CLIENT_ID_
 export const getClientIdNetlify = async () => (await client.getSecret("CLIENT_ID_NETLIFY")).secretValue;
 export const getClientIdGitHub = async () => (await client.getSecret("CLIENT_ID_GITHUB")).secretValue;
 export const getClientIdGitLab = async () => (await client.getSecret("CLIENT_ID_GITLAB")).secretValue;
-export const getClientIdGoogle = async () => (await client.getSecret("CLIENT_ID_GOOGLE")).secretValue;
 export const getClientIdBitBucket = async () => (await client.getSecret("CLIENT_ID_BITBUCKET")).secretValue;
+export const getClientIdGCPSecretManager = async () => (await client.getSecret("CLIENT_ID_GCP_SECRET_MANAGER")).secretValue;
 export const getClientSecretAzure = async () => (await client.getSecret("CLIENT_SECRET_AZURE")).secretValue;
 export const getClientSecretHeroku = async () => (await client.getSecret("CLIENT_SECRET_HEROKU")).secretValue;
 export const getClientSecretVercel = async () => (await client.getSecret("CLIENT_SECRET_VERCEL")).secretValue;
 export const getClientSecretNetlify = async () => (await client.getSecret("CLIENT_SECRET_NETLIFY")).secretValue;
 export const getClientSecretGitHub = async () => (await client.getSecret("CLIENT_SECRET_GITHUB")).secretValue;
 export const getClientSecretGitLab = async () => (await client.getSecret("CLIENT_SECRET_GITLAB")).secretValue;
-export const getClientSecretGoogle = async () => (await client.getSecret("CLIENT_SECRET_GOOGLE")).secretValue;
 export const getClientSecretBitBucket = async () => (await client.getSecret("CLIENT_SECRET_BITBUCKET")).secretValue;
+export const getClientSecretGCPSecretManager = async () => (await client.getSecret("CLIENT_SECRET_GCP_SECRET_MANAGER")).secretValue;
 export const getClientSlugVercel = async () => (await client.getSecret("CLIENT_SLUG_VERCEL")).secretValue;
+
+export const getClientIdGoogleLogin = async () => (await client.getSecret("CLIENT_ID_GOOGLE_LOGIN")).secretValue;
+export const getClientSecretGoogleLogin = async () => (await client.getSecret("CLIENT_SECRET_GOOGLE_LOGIN")).secretValue;
+export const getClientIdGitHubLogin = async () => (await client.getSecret("CLIENT_ID_GITHUB_LOGIN")).secretValue;
+export const getClientSecretGitHubLogin = async () => (await client.getSecret("CLIENT_SECRET_GITHUB_LOGIN")).secretValue;
+
 export const getPostHogHost = async () => (await client.getSecret("POSTHOG_HOST")).secretValue || "https://app.posthog.com";
 export const getPostHogProjectApiKey = async () => (await client.getSecret("POSTHOG_PROJECT_API_KEY")).secretValue || "phc_nSin8j5q2zdhpFDI1ETmFNUIuTG4DwKVyIigrY10XiE";
 export const getSentryDSN = async () => (await client.getSecret("SENTRY_DSN")).secretValue;
@@ -64,6 +70,8 @@ export const getSecretScanningWebhookSecret = async () => (await client.getSecre
 export const getSecretScanningGitAppId = async () => (await client.getSecret("SECRET_SCANNING_GIT_APP_ID")).secretValue;
 export const getSecretScanningPrivateKey = async () => (await client.getSecret("SECRET_SCANNING_PRIVATE_KEY")).secretValue;
 
+export const getRedisUrl = async () => (await client.getSecret("REDIS_URL")).secretValue;
+
 export const getLicenseKey = async () => {
   const secretValue = (await client.getSecret("LICENSE_KEY")).secretValue;
   return secretValue === "" ? undefined : secretValue;

backend/src/controllers/v1/authController.ts

@@ -1,34 +1,24 @@
 import { Request, Response } from "express";
-import fs from "fs";
-import path from "path";
 import jwt from "jsonwebtoken";
 import * as bigintConversion from "bigint-conversion";
 // eslint-disable-next-line @typescript-eslint/no-var-requires
 const jsrp = require("jsrp");
-import { 
-  LoginSRPDetail, 
-  TokenVersion,
-  User,
-} from "../../models";
+import { LoginSRPDetail, TokenVersion, User } from "../../models";
 import { clearTokens, createToken, issueAuthTokens } from "../../helpers/auth";
 import { checkUserDevice } from "../../helpers/user";
-import {
-  ACTION_LOGIN,
-  ACTION_LOGOUT,
-  AUTH_MODE_JWT,
-} from "../../variables";
-import { 
-  BadRequestError,
-  UnauthorizedRequestError,
-} from "../../utils/errors";
+import { ACTION_LOGIN, ACTION_LOGOUT } from "../../variables";
+import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
 import { EELogService } from "../../ee/services";
-import { getChannelFromUserAgent } from "../../utils/posthog";
+import { getUserAgentType } from "../../utils/posthog";
 import {
   getHttpsEnabled,
   getJwtAuthLifetime,
   getJwtAuthSecret,
-  getJwtRefreshSecret,
+  getJwtRefreshSecret
 } from "../../config";
+import { ActorType } from "../../ee/models";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/auth";
 
 declare module "jsonwebtoken" {
   export interface UserIDJwtPayload extends jwt.JwtPayload {
@@ -45,12 +35,11 @@ declare module "jsonwebtoken" {
  */
 export const login1 = async (req: Request, res: Response) => {
   const {
-    email,
-    clientPublicKey,
-  }: { email: string; clientPublicKey: string } = req.body;
+    body: { email, clientPublicKey }
+  } = await validateRequest(reqValidator.Login1V1, req);
 
   const user = await User.findOne({
-    email,
+    email
   }).select("+salt +verifier");
 
   if (!user) throw new Error("Failed to find user");
@@ -59,21 +48,25 @@ export const login1 = async (req: Request, res: Response) => {
   server.init(
     {
       salt: user.salt,
-      verifier: user.verifier,
+      verifier: user.verifier
     },
     async () => {
       // generate server-side public key
       const serverPublicKey = server.getPublicKey();
 
-      await LoginSRPDetail.findOneAndReplace({ email: email }, {
-        email: email,
-        clientPublicKey: clientPublicKey,
-        serverBInt: bigintConversion.bigintToBuf(server.bInt),
-      }, { upsert: true, returnNewDocument: false })
+      await LoginSRPDetail.findOneAndReplace(
+        { email: email },
+        {
+          email: email,
+          clientPublicKey: clientPublicKey,
+          serverBInt: bigintConversion.bigintToBuf(server.bInt)
+        },
+        { upsert: true, returnNewDocument: false }
+      );
 
       return res.status(200).send({
         serverPublicKey,
-        salt: user.salt,
+        salt: user.salt
       });
     }
   );
@@ -87,17 +80,24 @@ export const login1 = async (req: Request, res: Response) => {
  * @returns
  */
 export const login2 = async (req: Request, res: Response) => {
-  const { email, clientProof } = req.body;
+  const {
+    body: { email, clientProof }
+  } = await validateRequest(reqValidator.Login2V1, req);
+
   const user = await User.findOne({
-    email,
+    email
   }).select("+salt +verifier +publicKey +encryptedPrivateKey +iv +tag");
 
   if (!user) throw new Error("Failed to find user");
 
-  const loginSRPDetailFromDB = await LoginSRPDetail.findOneAndDelete({ email: email })
+  const loginSRPDetailFromDB = await LoginSRPDetail.findOneAndDelete({ email: email });
 
   if (!loginSRPDetailFromDB) {
-    return BadRequestError(Error("It looks like some details from the first login are not found. Please try login one again"))
+    return BadRequestError(
+      Error(
+        "It looks like some details from the first login are not found. Please try login one again"
+      )
+    );
   }
 
   const server = new jsrp.server();
@@ -105,7 +105,7 @@ export const login2 = async (req: Request, res: Response) => {
     {
       salt: user.salt,
       verifier: user.verifier,
-      b: loginSRPDetailFromDB.serverBInt,
+      b: loginSRPDetailFromDB.serverBInt
     },
     async () => {
       server.setClientPublicKey(loginSRPDetailFromDB.clientPublicKey);
@@ -117,13 +117,13 @@ export const login2 = async (req: Request, res: Response) => {
         await checkUserDevice({
           user,
           ip: req.realIP,
-          userAgent: req.headers["user-agent"] ?? "",
+          userAgent: req.headers["user-agent"] ?? ""
         });
 
-        const tokens = await issueAuthTokens({ 
+        const tokens = await issueAuthTokens({
           userId: user._id,
           ip: req.realIP,
-          userAgent: req.headers["user-agent"] ?? "",
+          userAgent: req.headers["user-agent"] ?? ""
         });
 
         // store (refresh) token in httpOnly cookie
@@ -131,20 +131,21 @@ export const login2 = async (req: Request, res: Response) => {
           httpOnly: true,
           path: "/",
           sameSite: "strict",
-          secure: await getHttpsEnabled(),
+          secure: await getHttpsEnabled()
         });
 
         const loginAction = await EELogService.createAction({
           name: ACTION_LOGIN,
-          userId: user._id,
+          userId: user._id
         });
 
-        loginAction && await EELogService.createLog({
-          userId: user._id,
-          actions: [loginAction],
-          channel: getChannelFromUserAgent(req.headers["user-agent"]),
-          ipAddress: req.realIP,
-        });
+        loginAction &&
+          (await EELogService.createLog({
+            userId: user._id,
+            actions: [loginAction],
+            channel: getUserAgentType(req.headers["user-agent"]),
+            ipAddress: req.realIP
+          }));
 
         // return (access) token in response
         return res.status(200).send({
@@ -152,12 +153,12 @@ export const login2 = async (req: Request, res: Response) => {
           publicKey: user.publicKey,
           encryptedPrivateKey: user.encryptedPrivateKey,
           iv: user.iv,
-          tag: user.tag,
+          tag: user.tag
         });
       }
 
       return res.status(400).send({
-        message: "Failed to authenticate. Try again?",
+        message: "Failed to authenticate. Try again?"
       });
     }
   );
@@ -170,8 +171,8 @@ export const login2 = async (req: Request, res: Response) => {
  * @returns
  */
 export const logout = async (req: Request, res: Response) => {
-  if (req.authData.authMode === AUTH_MODE_JWT && req.authData.authPayload instanceof User && req.authData.tokenVersionId) {
-    await clearTokens(req.authData.tokenVersionId)
+  if (req.authData.actor.type === ActorType.USER && req.authData.tokenVersionId) {
+    await clearTokens(req.authData.tokenVersionId);
   }
 
   // clear httpOnly cookie
@@ -179,49 +180,44 @@ export const logout = async (req: Request, res: Response) => {
     httpOnly: true,
     path: "/",
     sameSite: "strict",
-    secure: (await getHttpsEnabled()) as boolean,
+    secure: (await getHttpsEnabled()) as boolean
   });
 
   const logoutAction = await EELogService.createAction({
     name: ACTION_LOGOUT,
-    userId: req.user._id,
+    userId: req.user._id
   });
 
-  logoutAction && await EELogService.createLog({
-    userId: req.user._id,
-    actions: [logoutAction],
-    channel: getChannelFromUserAgent(req.headers["user-agent"]),
-    ipAddress: req.realIP,
-  });
+  logoutAction &&
+    (await EELogService.createLog({
+      userId: req.user._id,
+      actions: [logoutAction],
+      channel: getUserAgentType(req.headers["user-agent"]),
+      ipAddress: req.realIP
+    }));
 
   return res.status(200).send({
-    message: "Successfully logged out.",
+    message: "Successfully logged out."
   });
 };
 
-export const getCommonPasswords = async (req: Request, res: Response) => {
-  const commonPasswords = fs.readFileSync(
-		path.resolve(__dirname, "../../data/" + "common_passwords.txt"),
-		"utf8"
-	).split("\n");	
-
-  return res.status(200).send(commonPasswords);
-}
-
 export const revokeAllSessions = async (req: Request, res: Response) => {
-  await TokenVersion.updateMany({
-    user: req.user._id,
-  }, {
-    $inc: {
-      refreshVersion: 1,
-      accessVersion: 1,
+  await TokenVersion.updateMany(
+    {
+      user: req.user._id
     },
-  });
+    {
+      $inc: {
+        refreshVersion: 1,
+        accessVersion: 1
+      }
+    }
+  );
 
   return res.status(200).send({
-    message: "Successfully revoked all sessions.",
-  }); 
-}
+    message: "Successfully revoked all sessions."
+  });
+};
 
 /**
  * Return user is authenticated
@@ -231,9 +227,9 @@ export const revokeAllSessions = async (req: Request, res: Response) => {
  */
 export const checkAuth = async (req: Request, res: Response) => {
   return res.status(200).send({
-    message: "Authenticated",
+    message: "Authenticated"
   });
-}
+};
 
 /**
  * Return new JWT access token by first validating the refresh token
@@ -244,47 +240,47 @@ export const checkAuth = async (req: Request, res: Response) => {
 export const getNewToken = async (req: Request, res: Response) => {
   const refreshToken = req.cookies.jid;
 
-  if (!refreshToken) throw BadRequestError({
-    message: "Failed to find refresh token in request cookies"
-  });
+  if (!refreshToken)
+    throw BadRequestError({
+      message: "Failed to find refresh token in request cookies"
+    });
 
-  const decodedToken = <jwt.UserIDJwtPayload>(
-    jwt.verify(refreshToken, await getJwtRefreshSecret())
-  );
+  const decodedToken = <jwt.UserIDJwtPayload>jwt.verify(refreshToken, await getJwtRefreshSecret());
 
   const user = await User.findOne({
-    _id: decodedToken.userId,
+    _id: decodedToken.userId
   }).select("+publicKey +refreshVersion +accessVersion");
 
   if (!user) throw new Error("Failed to authenticate unfound user");
-  if (!user?.publicKey)
-    throw new Error("Failed to authenticate not fully set up account");
-  
+  if (!user?.publicKey) throw new Error("Failed to authenticate not fully set up account");
+
   const tokenVersion = await TokenVersion.findById(decodedToken.tokenVersionId);
 
-  if (!tokenVersion) throw UnauthorizedRequestError({
-    message: "Failed to validate refresh token",
-  });
+  if (!tokenVersion)
+    throw UnauthorizedRequestError({
+      message: "Failed to validate refresh token"
+    });
 
-  if (decodedToken.refreshVersion !== tokenVersion.refreshVersion) throw BadRequestError({
-    message: "Failed to validate refresh token",
-  });
+  if (decodedToken.refreshVersion !== tokenVersion.refreshVersion)
+    throw BadRequestError({
+      message: "Failed to validate refresh token"
+    });
 
   const token = createToken({
     payload: {
       userId: decodedToken.userId,
       tokenVersionId: tokenVersion._id.toString(),
-      accessVersion: tokenVersion.refreshVersion,
+      accessVersion: tokenVersion.refreshVersion
     },
     expiresIn: await getJwtAuthLifetime(),
-    secret: await getJwtAuthSecret(),
+    secret: await getJwtAuthSecret()
   });
 
   return res.status(200).send({
-    token,
+    token
   });
 };
 
 export const handleAuthProviderCallback = (req: Request, res: Response) => {
   res.redirect(`/login/provider/success?token=${encodeURIComponent(req.providerAuthToken)}`);
-}
+};

backend/src/controllers/v1/botController.ts

@@ -2,10 +2,19 @@ import { Request, Response } from "express";
 import { Types } from "mongoose";
 import { Bot, BotKey } from "../../models";
 import { createBot } from "../../helpers/bot";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/bot";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../ee/services/ProjectRoleService";
+import { ForbiddenError } from "@casl/ability";
+import { BadRequestError } from "../../utils/errors";
 
 interface BotKey {
-    encryptedKey: string;
-    nonce: string;
+  encryptedKey: string;
+  nonce: string;
 }
 
 /**
@@ -16,23 +25,30 @@ interface BotKey {
  * @returns
  */
 export const getBotByWorkspaceId = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetBotByWorkspaceIdV1, req);
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Integrations
+  );
 
   let bot = await Bot.findOne({
-      workspace: workspaceId,
+    workspace: workspaceId
   });
-  
+
   if (!bot) {
-      // case: bot doesn't exist for workspace with id [workspaceId]
-      // -> create a new bot and return it
-      bot = await createBot({
-          name: "Infisical Bot",
-          workspaceId: new Types.ObjectId(workspaceId),
-      });
+    // case: bot doesn't exist for workspace with id [workspaceId]
+    // -> create a new bot and return it
+    bot = await createBot({
+      name: "Infisical Bot",
+      workspaceId: new Types.ObjectId(workspaceId)
+    });
   }
-    
+
   return res.status(200).send({
-      bot,
+    bot
   });
 };
 
@@ -43,46 +59,69 @@ export const getBotByWorkspaceId = async (req: Request, res: Response) => {
  * @returns
  */
 export const setBotActiveState = async (req: Request, res: Response) => {
-    const { isActive, botKey }: { isActive: boolean, botKey: BotKey } = req.body;
-    
-    if (isActive) {
-        // bot state set to active -> share workspace key with bot
-        if (!botKey?.encryptedKey || !botKey?.nonce) {
-            return res.status(400).send({
-                message: "Failed to set bot state to active - missing bot key",
-            });
-        }
-        
-        await BotKey.findOneAndUpdate({
-            workspace: req.bot.workspace,
-        }, {
-            encryptedKey: botKey.encryptedKey,
-            nonce: botKey.nonce,
-            sender: req.user._id,
-            bot: req.bot._id,
-            workspace: req.bot.workspace,
-        }, {
-            upsert: true,
-            new: true,
-        });
-    } else {
-        // case: bot state set to inactive -> delete bot's workspace key
-        await BotKey.deleteOne({
-            bot: req.bot._id,
-        });
+  const {
+    body: { botKey, isActive },
+    params: { botId }
+  } = await validateRequest(reqValidator.SetBotActiveStateV1, req);
+
+  const bot = await Bot.findById(botId);
+  if (!bot) {
+    throw BadRequestError({ message: "Bot not found" });
+  }
+  const userId = req.user._id;
+
+  const { permission } = await getUserProjectPermissions(userId, bot.workspace.toString());
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Edit,
+    ProjectPermissionSub.Integrations
+  );
+
+  if (isActive) {
+    // bot state set to active -> share workspace key with bot
+    if (!botKey?.encryptedKey || !botKey?.nonce) {
+      return res.status(400).send({
+        message: "Failed to set bot state to active - missing bot key"
+      });
     }
 
-    const bot = await Bot.findOneAndUpdate({
-        _id: req.bot._id,
-    }, {
-        isActive,
-    }, {
-        new: true,
-    });
-    
-    if (!bot) throw new Error("Failed to update bot active state");
-    
-    return res.status(200).send({
-        bot,
+    await BotKey.findOneAndUpdate(
+      {
+        workspace: bot.workspace
+      },
+      {
+        encryptedKey: botKey.encryptedKey,
+        nonce: botKey.nonce,
+        sender: userId,
+        bot: bot._id,
+        workspace: bot.workspace
+      },
+      {
+        upsert: true,
+        new: true
+      }
+    );
+  } else {
+    // case: bot state set to inactive -> delete bot's workspace key
+    await BotKey.deleteOne({
+      bot: bot._id
     });
+  }
+
+  const updatedBot = await Bot.findOneAndUpdate(
+    {
+      _id: bot._id
+    },
+    {
+      isActive
+    },
+    {
+      new: true
+    }
+  );
+
+  if (!updatedBot) throw new Error("Failed to update bot active state");
+
+  return res.status(200).send({
+    bot
+  });
 };

backend/src/controllers/v1/index.ts

@@ -15,7 +15,7 @@ import * as userController from "./userController";
 import * as workspaceController from "./workspaceController";
 import * as secretScanningController from "./secretScanningController";
 import * as webhookController from "./webhookController";
-import * as secretImportController from "./secretImportController";
+import * as secretImpsController from "./secretImpsController";
 
 export {
   authController,
@@ -35,5 +35,5 @@ export {
   workspaceController,
   secretScanningController,
   webhookController,
-  secretImportController
+  secretImpsController
 };

backend/src/controllers/v1/integrationController.ts

@@ -1,11 +1,21 @@
 import { Request, Response } from "express";
 import { Types } from "mongoose";
-import { Integration } from "../../models";
+import { Folder, IWorkspace, Integration, IntegrationAuth } from "../../models";
 import { EventService } from "../../services";
 import { eventStartIntegration } from "../../events";
-import Folder from "../../models/folder";
 import { getFolderByPath } from "../../services/FolderService";
 import { BadRequestError } from "../../utils/errors";
+import { EEAuditLogService } from "../../ee/services";
+import { EventType } from "../../ee/models";
+import { syncSecretsToActiveIntegrationsQueue } from "../../queues/integrations/syncSecretsToThirdPartyServices";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/integration";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../ee/services/ProjectRoleService";
+import { ForbiddenError } from "@casl/ability";
 
 /**
  * Create/initialize an (empty) integration for integration authorization
@@ -15,23 +25,44 @@ import { BadRequestError } from "../../utils/errors";
  */
 export const createIntegration = async (req: Request, res: Response) => {
   const {
-    integrationAuthId,
-    app,
-    appId,
-    isActive,
-    sourceEnvironment,
-    targetEnvironment,
-    targetEnvironmentId,
-    targetService,
-    targetServiceId,
-    owner,
-    path,
-    region,
-    secretPath
-  } = req.body;
+    body: {
+      isActive,
+      sourceEnvironment,
+      secretPath,
+      app,
+      path,
+      appId,
+      owner,
+      region,
+      scope,
+      targetService,
+      targetServiceId,
+      integrationAuthId,
+      targetEnvironment,
+      targetEnvironmentId,
+      metadata
+    }
+  } = await validateRequest(reqValidator.CreateIntegrationV1, req);
+  
+  const integrationAuth = await IntegrationAuth.findById(integrationAuthId)
+    .populate<{ workspace: IWorkspace }>("workspace")
+    .select(
+      "+refreshCiphertext +refreshIV +refreshTag +accessCiphertext +accessIV +accessTag +accessExpiresAt"
+    );
+
+  if (!integrationAuth) throw BadRequestError({ message: "Integration auth not found" });
+
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace._id.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Create,
+    ProjectPermissionSub.Integrations
+  );
 
   const folders = await Folder.findOne({
-    workspace: req.integrationAuth.workspace._id,
+    workspace: integrationAuth.workspace._id,
     environment: sourceEnvironment
   });
 
@@ -39,7 +70,7 @@ export const createIntegration = async (req: Request, res: Response) => {
     const folder = getFolderByPath(folders.nodes, secretPath);
     if (!folder) {
       throw BadRequestError({
-        message: "Path for service token does not exist"
+        message: "Folder path doesn't exist"
       });
     }
   }
@@ -48,7 +79,7 @@ export const createIntegration = async (req: Request, res: Response) => {
 
   // initialize new integration after saving integration access token
   const integration = await new Integration({
-    workspace: req.integrationAuth.workspace._id,
+    workspace: integrationAuth.workspace._id,
     environment: sourceEnvironment,
     isActive,
     app,
@@ -60,9 +91,11 @@ export const createIntegration = async (req: Request, res: Response) => {
     owner,
     path,
     region,
+    scope,
     secretPath,
-    integration: req.integrationAuth.integration,
-    integrationAuth: new Types.ObjectId(integrationAuthId)
+    integration: integrationAuth.integration,
+    integrationAuth: new Types.ObjectId(integrationAuthId),
+    metadata
   }).save();
 
   if (integration) {
@@ -75,6 +108,31 @@ export const createIntegration = async (req: Request, res: Response) => {
     });
   }
 
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.CREATE_INTEGRATION,
+      metadata: {
+        integrationId: integration._id.toString(),
+        integration: integration.integration,
+        environment: integration.environment,
+        secretPath,
+        url: integration.url,
+        app: integration.app,
+        appId: integration.appId,
+        targetEnvironment: integration.targetEnvironment,
+        targetEnvironmentId: integration.targetEnvironmentId,
+        targetService: integration.targetService,
+        targetServiceId: integration.targetServiceId,
+        path: integration.path,
+        region: integration.region
+      }
+    },
+    {
+      workspaceId: integration.workspace
+    }
+  );
+
   return res.status(200).send({
     integration
   });
@@ -91,17 +149,32 @@ export const updateIntegration = async (req: Request, res: Response) => {
   // integration has the correct fields populated in [Integration]
 
   const {
-    environment,
-    isActive,
-    app,
-    appId,
-    targetEnvironment,
-    owner, // github-specific integration param
-    secretPath
-  } = req.body;
+    body: {
+      environment,
+      isActive,
+      app,
+      appId,
+      targetEnvironment,
+      owner, // github-specific integration param
+      secretPath
+    },
+    params: { integrationId }
+  } = await validateRequest(reqValidator.UpdateIntegrationV1, req);
+
+  const integration = await Integration.findById(integrationId);
+  if (!integration) throw BadRequestError({ message: "Integration not found" });
+
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integration.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Edit,
+    ProjectPermissionSub.Integrations
+  );
 
   const folders = await Folder.findOne({
-    workspace: req.integration.workspace,
+    workspace: integration.workspace,
     environment
   });
 
@@ -114,9 +187,9 @@ export const updateIntegration = async (req: Request, res: Response) => {
     }
   }
 
-  const integration = await Integration.findOneAndUpdate(
+  const updatedIntegration = await Integration.findOneAndUpdate(
     {
-      _id: req.integration._id
+      _id: integration._id
     },
     {
       environment,
@@ -132,38 +205,96 @@ export const updateIntegration = async (req: Request, res: Response) => {
     }
   );
 
-  if (integration) {
+  if (updatedIntegration) {
     // trigger event - push secrets
     EventService.handleEvent({
       event: eventStartIntegration({
-        workspaceId: integration.workspace,
+        workspaceId: updatedIntegration.workspace,
         environment
       })
     });
   }
 
   return res.status(200).send({
-    integration
+    integration: updatedIntegration
   });
 };
 
 /**
- * Delete integration with id [integrationId] and deactivate bot if there are
- * no integrations left
+ * Delete integration with id [integrationId]
  * @param req
  * @param res
  * @returns
  */
 export const deleteIntegration = async (req: Request, res: Response) => {
-  const { integrationId } = req.params;
+  const {
+    params: { integrationId }
+  } = await validateRequest(reqValidator.DeleteIntegrationV1, req);
 
-  const integration = await Integration.findOneAndDelete({
+  const integration = await Integration.findById(integrationId);
+  if (!integration) throw BadRequestError({ message: "Integration not found" });
+
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integration.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Delete,
+    ProjectPermissionSub.Integrations
+  );
+
+  const deletedIntegration = await Integration.findOneAndDelete({
     _id: integrationId
   });
 
-  if (!integration) throw new Error("Failed to find integration");
+  if (!deletedIntegration) throw new Error("Failed to find integration");
+
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.DELETE_INTEGRATION,
+      metadata: {
+        integrationId: integration._id.toString(),
+        integration: integration.integration,
+        environment: integration.environment,
+        secretPath: integration.secretPath,
+        url: integration.url,
+        app: integration.app,
+        appId: integration.appId,
+        targetEnvironment: integration.targetEnvironment,
+        targetEnvironmentId: integration.targetEnvironmentId,
+        targetService: integration.targetService,
+        targetServiceId: integration.targetServiceId,
+        path: integration.path,
+        region: integration.region
+      }
+    },
+    {
+      workspaceId: integration.workspace
+    }
+  );
 
   return res.status(200).send({
     integration
   });
 };
+
+// Will trigger sync for all integrations within the given env and workspace id
+export const manualSync = async (req: Request, res: Response) => {
+  const {
+    body: { workspaceId, environment }
+  } = await validateRequest(reqValidator.ManualSyncV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Edit,
+    ProjectPermissionSub.Integrations
+  );
+
+  syncSecretsToActiveIntegrationsQueue({
+    workspaceId,
+    environment
+  });
+
+  res.status(200).send();
+};

backend/src/controllers/v1/keyController.ts

@@ -1,6 +1,17 @@
+import { Types } from "mongoose";
 import { Request, Response } from "express";
 import { Key } from "../../models";
 import { findMembership } from "../../helpers/membership";
+import { EventType } from "../../ee/models";
+import { EEAuditLogService } from "../../ee/services";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/key";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../ee/services/ProjectRoleService";
+import { ForbiddenError } from "@casl/ability";
 
 /**
  * Add (encrypted) copy of workspace key for workspace with id [workspaceId] for user with
@@ -10,13 +21,21 @@ import { findMembership } from "../../helpers/membership";
  * @returns
  */
 export const uploadKey = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
-  const { key } = req.body;
+  const {
+    params: { workspaceId },
+    body: { key }
+  } = await validateRequest(reqValidator.UploadKeyV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Edit,
+    ProjectPermissionSub.Member
+  );
 
   // validate membership of receiver
   const receiverMembership = await findMembership({
     user: key.userId,
-    workspace: workspaceId,
+    workspace: workspaceId
   });
 
   if (!receiverMembership) {
@@ -28,12 +47,12 @@ export const uploadKey = async (req: Request, res: Response) => {
     nonce: key.nonce,
     sender: req.user._id,
     receiver: key.userId,
-    workspace: workspaceId,
+    workspace: workspaceId
   }).save();
 
-	return res.status(200).send({
-		message: "Successfully uploaded key to workspace",
-	});
+  return res.status(200).send({
+    message: "Successfully uploaded key to workspace"
+  });
 };
 
 /**
@@ -43,22 +62,36 @@ export const uploadKey = async (req: Request, res: Response) => {
  * @returns
  */
 export const getLatestKey = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetLatestKeyV1, req);
 
   // get latest key
   const latestKey = await Key.find({
     workspace: workspaceId,
-    receiver: req.user._id,
+    receiver: req.user._id
   })
     .sort({ createdAt: -1 })
     .limit(1)
     .populate("sender", "+publicKey");
 
-	const resObj: any = {};
+  const resObj: any = {};
 
-	if (latestKey.length > 0) {
-		resObj["latestKey"] = latestKey[0];
-	}
+  if (latestKey.length > 0) {
+    resObj["latestKey"] = latestKey[0];
+    await EEAuditLogService.createAuditLog(
+      req.authData,
+      {
+        type: EventType.GET_WORKSPACE_KEY,
+        metadata: {
+          keyId: latestKey[0]._id.toString()
+        }
+      },
+      {
+        workspaceId: new Types.ObjectId(workspaceId)
+      }
+    );
+  }
 
-	return res.status(200).send(resObj);
+  return res.status(200).send(resObj);
 };

backend/src/controllers/v1/membershipController.ts

@@ -1,9 +1,23 @@
 import { Request, Response } from "express";
-import { Key, Membership, MembershipOrg, User } from "../../models";
+import { Types } from "mongoose";
+import { IUser, Key, Membership, MembershipOrg, User, Workspace } from "../../models";
+import { EventType } from "../../ee/models";
 import { deleteMembership as deleteMember, findMembership } from "../../helpers/membership";
 import { sendMail } from "../../helpers/nodemailer";
-import { ACCEPTED, ADMIN, MEMBER } from "../../variables";
+import { ACCEPTED, ADMIN, CUSTOM, MEMBER, VIEWER } from "../../variables";
 import { getSiteURL } from "../../config";
+import { EEAuditLogService } from "../../ee/services";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/membership";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../ee/services/ProjectRoleService";
+import { ForbiddenError } from "@casl/ability";
+import Role from "../../ee/models/role";
+import { BadRequestError } from "../../utils/errors";
+import { InviteUserToWorkspaceV1 } from "../../validation/workspace";
 
 /**
  * Check that user is a member of workspace with id [workspaceId]
@@ -12,7 +26,10 @@ import { getSiteURL } from "../../config";
  * @returns
  */
 export const validateMembership = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.ValidateMembershipV1, req);
+
   // validate membership
   const membership = await findMembership({
     user: req.user._id,
@@ -35,38 +52,47 @@ export const validateMembership = async (req: Request, res: Response) => {
  * @returns
  */
 export const deleteMembership = async (req: Request, res: Response) => {
-  const { membershipId } = req.params;
+  const {
+    params: { membershipId }
+  } = await validateRequest(reqValidator.DeleteMembershipV1, req);
 
   // check if membership to delete exists
   const membershipToDelete = await Membership.findOne({
     _id: membershipId
-  }).populate("user");
+  }).populate<{ user: IUser }>("user");
 
   if (!membershipToDelete) {
     throw new Error("Failed to delete workspace membership that doesn't exist");
   }
 
-  // check if user is a member and admin of the workspace
-  // whose membership we wish to delete
-  const membership = await Membership.findOne({
-    user: req.user._id,
-    workspace: membershipToDelete.workspace
-  });
-
-  if (!membership) {
-    throw new Error("Failed to validate workspace membership");
-  }
-
-  if (membership.role !== ADMIN) {
-    // user is not an admin member of the workspace
-    throw new Error("Insufficient role for deleting workspace membership");
-  }
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    membershipToDelete.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Delete,
+    ProjectPermissionSub.Member
+  );
 
   // delete workspace membership
   const deletedMembership = await deleteMember({
     membershipId: membershipToDelete._id.toString()
   });
 
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.REMOVE_WORKSPACE_MEMBER,
+      metadata: {
+        userId: membershipToDelete.user._id.toString(),
+        email: membershipToDelete.user.email
+      }
+    },
+    {
+      workspaceId: membershipToDelete.workspace
+    }
+  );
+
   return res.status(200).send({
     deletedMembership
   });
@@ -79,43 +105,79 @@ export const deleteMembership = async (req: Request, res: Response) => {
  * @returns
  */
 export const changeMembershipRole = async (req: Request, res: Response) => {
-  const { membershipId } = req.params;
-  const { role } = req.body;
-
-  if (![ADMIN, MEMBER].includes(role)) {
-    throw new Error("Failed to validate role");
-  }
+  const {
+    body: { role },
+    params: { membershipId }
+  } = await validateRequest(reqValidator.ChangeMembershipRoleV1, req);
 
   // validate target membership
-  const membershipToChangeRole = await findMembership({
-    _id: membershipId
-  });
+  const membershipToChangeRole = await Membership.findById(membershipId).populate<{ user: IUser }>(
+    "user"
+  );
 
   if (!membershipToChangeRole) {
     throw new Error("Failed to find membership to change role");
   }
 
-  // check if user is a member and admin of target membership's
-  // workspace
-  const membership = await findMembership({
-    user: req.user._id,
-    workspace: membershipToChangeRole.workspace
-  });
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    membershipToChangeRole.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Edit,
+    ProjectPermissionSub.Member
+  );
 
-  if (!membership) {
-    throw new Error("Failed to validate membership");
+  const isCustomRole = ![ADMIN, MEMBER, VIEWER].includes(role);
+  if (isCustomRole) {
+    const wsRole = await Role.findOne({
+      slug: role,
+      isOrgRole: false,
+      workspace: membershipToChangeRole.workspace
+    });
+    if (!wsRole) throw BadRequestError({ message: "Role not found" });
+    const membership = await Membership.findByIdAndUpdate(membershipId, {
+      role: CUSTOM,
+      customRole: wsRole
+    });
+    return res.status(200).send({
+      membership
+    });
   }
 
-  if (membership.role !== ADMIN) {
-    // user is not an admin member of the workspace
-    throw new Error("Insufficient role for changing member roles");
-  }
+  const membership = await Membership.findByIdAndUpdate(
+    membershipId,
+    {
+      $set: {
+        role
+      },
+      $unset: {
+        customRole: 1
+      }
+    },
+    {
+      new: true
+    }
+  );
 
-  membershipToChangeRole.role = role;
-  await membershipToChangeRole.save();
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.UPDATE_USER_WORKSPACE_ROLE,
+      metadata: {
+        userId: membershipToChangeRole.user._id.toString(),
+        email: membershipToChangeRole.user.email,
+        oldRole: membershipToChangeRole.role,
+        newRole: role
+      }
+    },
+    {
+      workspaceId: membershipToChangeRole.workspace
+    }
+  );
 
   return res.status(200).send({
-    membership: membershipToChangeRole
+    membership
   });
 };
 
@@ -126,8 +188,15 @@ export const changeMembershipRole = async (req: Request, res: Response) => {
  * @returns
  */
 export const inviteUserToWorkspace = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
-  const { email }: { email: string } = req.body;
+  const {
+    params: { workspaceId },
+    body: { email }
+  } = await validateRequest(InviteUserToWorkspaceV1, req);
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Create,
+    ProjectPermissionSub.Member
+  );
 
   const invitee = await User.findOne({
     email
@@ -140,15 +209,17 @@ export const inviteUserToWorkspace = async (req: Request, res: Response) => {
   const inviteeMembership = await Membership.findOne({
     user: invitee._id,
     workspace: workspaceId
-  });
+  }).populate<{ user: IUser }>("user");
 
   if (inviteeMembership) throw new Error("Failed to add existing member of workspace");
 
+  const workspace = await Workspace.findById(workspaceId);
+  if (!workspace) throw new Error("Failed to find workspace");
   // validate invitee's organization membership - ensure that only
   // (accepted) organization members can be added to the workspace
   const membershipOrg = await MembershipOrg.findOne({
     user: invitee._id,
-    organization: req.membership.workspace.organization,
+    organization: workspace.organization,
     status: ACCEPTED
   });
 
@@ -176,11 +247,25 @@ export const inviteUserToWorkspace = async (req: Request, res: Response) => {
     substitutions: {
       inviterFirstName: req.user.firstName,
       inviterEmail: req.user.email,
-      workspaceName: req.membership.workspace.name,
+      workspaceName: workspace.name,
       callback_url: (await getSiteURL()) + "/login"
     }
   });
 
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.ADD_WORKSPACE_MEMBER,
+      metadata: {
+        userId: invitee._id.toString(),
+        email: invitee.email
+      }
+    },
+    {
+      workspaceId: new Types.ObjectId(workspaceId)
+    }
+  );
+
   return res.status(200).send({
     invitee,
     latestKey

backend/src/controllers/v1/membershipOrgController.ts

@@ -1,20 +1,15 @@
 import { Types } from "mongoose";
 import { Request, Response } from "express";
 import { MembershipOrg, Organization, User } from "../../models";
+import { SSOConfig } from "../../ee/models";
 import { deleteMembershipOrg as deleteMemberFromOrg } from "../../helpers/membershipOrg";
 import { createToken } from "../../helpers/auth";
 import { updateSubscriptionOrgQuantity } from "../../helpers/organization";
 import { sendMail } from "../../helpers/nodemailer";
 import { TokenService } from "../../services";
 import { EELicenseService } from "../../ee/services";
-import {
-  ACCEPTED,
-  ADMIN,
-  INVITED,
-  MEMBER,
-  OWNER,
-  TOKEN_EMAIL_ORG_INVITATION
-} from "../../variables";
+import { ACCEPTED, INVITED, MEMBER, TOKEN_EMAIL_ORG_INVITATION } from "../../variables";
+import * as reqValidator from "../../validation/membershipOrg";
 import {
   getJwtSignupLifetime,
   getJwtSignupSecret,
@@ -22,6 +17,13 @@ import {
   getSmtpConfigured
 } from "../../config";
 import { validateUserEmail } from "../../validation";
+import { validateRequest } from "../../helpers/validation";
+import {
+  OrgPermissionActions,
+  OrgPermissionSubjects,
+  getUserOrgPermissions
+} from "../../ee/services/RoleService";
+import { ForbiddenError } from "@casl/ability";
 
 /**
  * Delete organization membership with id [membershipOrgId] from organization
@@ -30,7 +32,9 @@ import { validateUserEmail } from "../../validation";
  * @returns
  */
 export const deleteMembershipOrg = async (req: Request, _res: Response) => {
-  const { membershipOrgId } = req.params;
+  const {
+    params: { membershipOrgId }
+  } = await validateRequest(reqValidator.DelOrgMembershipv1, req);
 
   // check if organization membership to delete exists
   const membershipOrgToDelete = await MembershipOrg.findOne({
@@ -41,21 +45,14 @@ export const deleteMembershipOrg = async (req: Request, _res: Response) => {
     throw new Error("Failed to delete organization membership that doesn't exist");
   }
 
-  // check if user is a member and admin of the organization
-  // whose membership we wish to delete
-  const membershipOrg = await MembershipOrg.findOne({
-    user: req.user._id,
-    organization: membershipOrgToDelete.organization
-  });
-
-  if (!membershipOrg) {
-    throw new Error("Failed to validate organization membership");
-  }
-
-  if (membershipOrg.role !== OWNER && membershipOrg.role !== ADMIN) {
-    // user is not an admin member of the organization
-    throw new Error("Insufficient role for deleting organization membership");
-  }
+  const { permission, membership: membershipOrg } = await getUserOrgPermissions(
+    req.user._id,
+    membershipOrgToDelete.organization.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Delete,
+    OrgPermissionSubjects.Member
+  );
 
   // delete organization membership
   await deleteMemberFromOrg({
@@ -95,22 +92,31 @@ export const changeMembershipOrgRole = async (req: Request, res: Response) => {
  */
 export const inviteUserToOrganization = async (req: Request, res: Response) => {
   let inviteeMembershipOrg, completeInviteLink;
-  const { organizationId, inviteeEmail } = req.body;
+  const {
+    body: { inviteeEmail, organizationId }
+  } = await validateRequest(reqValidator.InviteUserToOrgv1, req);
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Create,
+    OrgPermissionSubjects.Member
+  );
+
   const host = req.headers.host;
   const siteUrl = `${req.protocol}://${host}`;
+  const plan = await EELicenseService.getPlan(new Types.ObjectId(organizationId));
 
-  // validate membership
-  const membershipOrg = await MembershipOrg.findOne({
-    user: req.user._id,
-    organization: organizationId
+  const ssoConfig = await SSOConfig.findOne({
+    organization: new Types.ObjectId(organizationId)
   });
 
-  if (!membershipOrg) {
-    throw new Error("Failed to validate organization membership");
+  if (ssoConfig && ssoConfig.isActive) {
+    // case: SAML SSO is enabled for the organization
+    return res.status(400).send({
+      message: "Failed to invite member due to SAML SSO configured for organization"
+    });
   }
 
-  const plan = await EELicenseService.getPlan(organizationId);
-
   if (plan.memberLimit !== null) {
     // case: limit imposed on number of members allowed
 
@@ -218,7 +224,10 @@ export const inviteUserToOrganization = async (req: Request, res: Response) => {
  */
 export const verifyUserToOrganization = async (req: Request, res: Response) => {
   let user;
-  const { email, organizationId, code } = req.body;
+
+  const {
+    body: { organizationId, email, code }
+  } = await validateRequest(reqValidator.VerifyUserToOrgv1, req);
 
   user = await User.findOne({ email }).select("+publicKey");
 

backend/src/controllers/v1/organizationController.ts

@@ -1,28 +1,37 @@
 import { Request, Response } from "express";
 import {
-	IncidentContactOrg,
-	Membership,
-	MembershipOrg,
-	Organization,
-	Workspace,
+  IncidentContactOrg,
+  Membership,
+  MembershipOrg,
+  Organization,
+  Workspace
 } from "../../models";
 import { createOrganization as create } from "../../helpers/organization";
 import { addMembershipsOrg } from "../../helpers/membershipOrg";
-import { ACCEPTED, OWNER } from "../../variables";
+import { ACCEPTED, ADMIN } from "../../variables";
 import { getLicenseServerUrl, getSiteURL } from "../../config";
 import { licenseServerKeyRequest } from "../../config/request";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/organization";
+import {
+  OrgPermissionActions,
+  OrgPermissionSubjects,
+  getUserOrgPermissions
+} from "../../ee/services/RoleService";
+import { OrganizationNotFoundError } from "../../utils/errors";
+import { ForbiddenError } from "@casl/ability";
 
 export const getOrganizations = async (req: Request, res: Response) => {
   const organizations = (
     await MembershipOrg.find({
       user: req.user._id,
-      status: ACCEPTED,
+      status: ACCEPTED
     }).populate("organization")
   ).map((m) => m.organization);
 
-	return res.status(200).send({
-		organizations,
-	});
+  return res.status(200).send({
+    organizations
+  });
 };
 
 /**
@@ -33,28 +42,26 @@ export const getOrganizations = async (req: Request, res: Response) => {
  * @returns
  */
 export const createOrganization = async (req: Request, res: Response) => {
-  const { organizationName } = req.body;
-
-  if (organizationName.length < 1) {
-    throw new Error("Organization names must be at least 1-character long");
-  }
+  const {
+    body: { organizationName }
+  } = await validateRequest(reqValidator.CreateOrgv1, req);
 
   // create organization and add user as member
   const organization = await create({
     email: req.user.email,
-    name: organizationName,
+    name: organizationName
   });
 
   await addMembershipsOrg({
     userIds: [req.user._id.toString()],
     organizationId: organization._id.toString(),
-    roles: [OWNER],
-    statuses: [ACCEPTED],
+    roles: [ADMIN],
+    statuses: [ACCEPTED]
   });
 
-	return res.status(200).send({
-		organization,
-	});
+  return res.status(200).send({
+    organization
+  });
 };
 
 /**
@@ -64,10 +71,23 @@ export const createOrganization = async (req: Request, res: Response) => {
  * @returns
  */
 export const getOrganization = async (req: Request, res: Response) => {
-	const organization = req.organization
-	return res.status(200).send({
-		organization,
-	});
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgv1, req);
+
+  // ensure user has membership
+  await getUserOrgPermissions(req.user._id, organizationId);
+
+  const organization = await Organization.findById(organizationId);
+  if (!organization) {
+    throw OrganizationNotFoundError({
+      message: "Failed to find organization"
+    });
+  }
+
+  return res.status(200).send({
+    organization
+  });
 };
 
 /**
@@ -77,15 +97,23 @@ export const getOrganization = async (req: Request, res: Response) => {
  * @returns
  */
 export const getOrganizationMembers = async (req: Request, res: Response) => {
-  const { organizationId } = req.params;
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgMembersv1, req);
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Read,
+    OrgPermissionSubjects.Member
+  );
 
   const users = await MembershipOrg.find({
-    organization: organizationId,
+    organization: organizationId
   }).populate("user", "+publicKey");
 
-	return res.status(200).send({
-		users,
-	});
+  return res.status(200).send({
+    users
+  });
 };
 
 /**
@@ -94,17 +122,22 @@ export const getOrganizationMembers = async (req: Request, res: Response) => {
  * @param res
  * @returns
  */
-export const getOrganizationWorkspaces = async (
-	req: Request,
-	res: Response
-) => {
-  const { organizationId } = req.params;
+export const getOrganizationWorkspaces = async (req: Request, res: Response) => {
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgWorkspacesv1, req);
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Read,
+    OrgPermissionSubjects.Workspace
+  );
 
   const workspacesSet = new Set(
     (
       await Workspace.find(
         {
-          organization: organizationId,
+          organization: organizationId
         },
         "_id"
       )
@@ -113,15 +146,15 @@ export const getOrganizationWorkspaces = async (
 
   const workspaces = (
     await Membership.find({
-      user: req.user._id,
+      user: req.user._id
     }).populate("workspace")
   )
     .filter((m) => workspacesSet.has(m.workspace._id.toString()))
     .map((m) => m.workspace);
 
-	return res.status(200).send({
-		workspaces,
-	});
+  return res.status(200).send({
+    workspaces
+  });
 };
 
 /**
@@ -131,25 +164,33 @@ export const getOrganizationWorkspaces = async (
  * @returns
  */
 export const changeOrganizationName = async (req: Request, res: Response) => {
-  const { organizationId } = req.params;
-  const { name } = req.body;
+  const {
+    params: { organizationId },
+    body: { name }
+  } = await validateRequest(reqValidator.ChangeOrgNamev1, req);
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Edit,
+    OrgPermissionSubjects.Settings
+  );
 
   const organization = await Organization.findOneAndUpdate(
     {
-      _id: organizationId,
+      _id: organizationId
     },
     {
-      name,
+      name
     },
     {
-      new: true,
+      new: true
     }
   );
 
-	return res.status(200).send({
-		message: "Successfully changed organization name",
-		organization,
-	});
+  return res.status(200).send({
+    message: "Successfully changed organization name",
+    organization
+  });
 };
 
 /**
@@ -158,19 +199,24 @@ export const changeOrganizationName = async (req: Request, res: Response) => {
  * @param res
  * @returns
  */
-export const getOrganizationIncidentContacts = async (
-	req: Request,
-	res: Response
-) => {
-  const { organizationId } = req.params;
+export const getOrganizationIncidentContacts = async (req: Request, res: Response) => {
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgIncidentContactv1, req);
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Read,
+    OrgPermissionSubjects.IncidentAccount
+  );
 
   const incidentContactsOrg = await IncidentContactOrg.find({
-    organization: organizationId,
+    organization: organizationId
   });
 
-	return res.status(200).send({
-		incidentContactsOrg,
-	});
+  return res.status(200).send({
+    incidentContactsOrg
+  });
 };
 
 /**
@@ -179,12 +225,17 @@ export const getOrganizationIncidentContacts = async (
  * @param res
  * @returns
  */
-export const addOrganizationIncidentContact = async (
-	req: Request,
-	res: Response
-) => {
-  const { organizationId } = req.params;
-  const { email } = req.body;
+export const addOrganizationIncidentContact = async (req: Request, res: Response) => {
+  const {
+    params: { organizationId },
+    body: { email }
+  } = await validateRequest(reqValidator.CreateOrgIncideContact, req);
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Create,
+    OrgPermissionSubjects.IncidentAccount
+  );
 
   const incidentContactOrg = await IncidentContactOrg.findOneAndUpdate(
     { email, organization: organizationId },
@@ -192,9 +243,9 @@ export const addOrganizationIncidentContact = async (
     { upsert: true, new: true }
   );
 
-	return res.status(200).send({
-		incidentContactOrg,
-	});
+  return res.status(200).send({
+    incidentContactOrg
+  });
 };
 
 /**
@@ -203,22 +254,27 @@ export const addOrganizationIncidentContact = async (
  * @param res
  * @returns
  */
-export const deleteOrganizationIncidentContact = async (
-	req: Request,
-	res: Response
-) => {
-  const { organizationId } = req.params;
-  const { email } = req.body;
+export const deleteOrganizationIncidentContact = async (req: Request, res: Response) => {
+  const {
+    params: { organizationId },
+    body: { email }
+  } = await validateRequest(reqValidator.DelOrgIncideContact, req);
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Delete,
+    OrgPermissionSubjects.IncidentAccount
+  );
 
   const incidentContactOrg = await IncidentContactOrg.findOneAndDelete({
     email,
-    organization: organizationId,
+    organization: organizationId
   });
 
-	return res.status(200).send({
-		message: "Successfully deleted organization incident contact",
-		incidentContactOrg,
-	});
+  return res.status(200).send({
+    message: "Successfully deleted organization incident contact",
+    incidentContactOrg
+  });
 };
 
 /**
@@ -228,19 +284,41 @@ export const deleteOrganizationIncidentContact = async (
  * @param res
  * @returns
  */
-export const createOrganizationPortalSession = async (
-	req: Request,
-	res: Response
-) => {
-  const { data: { pmtMethods } } = await licenseServerKeyRequest.get(
-    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${req.organization.customerId}/billing-details/payment-methods`,
+export const createOrganizationPortalSession = async (req: Request, res: Response) => {
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgPlanBillingInfov1, req);
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Edit,
+    OrgPermissionSubjects.Billing
   );
-  
+
+  const organization = await Organization.findById(organizationId);
+  if (!organization) {
+    throw OrganizationNotFoundError({
+      message: "Failed to find organization"
+    });
+  }
+
+  const {
+    data: { pmtMethods }
+  } = await licenseServerKeyRequest.get(
+    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
+      organization.customerId
+    }/billing-details/payment-methods`
+  );
+
   if (pmtMethods.length < 1) {
     // case: organization has no payment method on file
-    // -> redirect to add payment method portal 
-    const { data: { url } } = await licenseServerKeyRequest.post(
-      `${await getLicenseServerUrl()}/api/license-server/v1/customers/${req.organization.customerId}/billing-details/payment-methods`,
+    // -> redirect to add payment method portal
+    const {
+      data: { url }
+    } = await licenseServerKeyRequest.post(
+      `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
+        organization.customerId
+      }/billing-details/payment-methods`,
       {
         success_url: (await getSiteURL()) + "/dashboard",
         cancel_url: (await getSiteURL()) + "/dashboard"
@@ -250,8 +328,12 @@ export const createOrganizationPortalSession = async (
   } else {
     // case: organization has payment method on file
     // -> redirect to billing portal
-    const { data: { url } } = await licenseServerKeyRequest.post(
-      `${await getLicenseServerUrl()}/api/license-server/v1/customers/${req.organization.customerId}/billing-details/billing-portal`,
+    const {
+      data: { url }
+    } = await licenseServerKeyRequest.post(
+      `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
+        organization.customerId
+      }/billing-details/billing-portal`,
       {
         return_url: (await getSiteURL()) + "/dashboard"
       }
@@ -260,58 +342,49 @@ export const createOrganizationPortalSession = async (
   }
 };
 
-/**
- * Return organization subscriptions
- * @param req
- * @param res
- * @returns
- */
-export const getOrganizationSubscriptions = async (
-	req: Request,
-	res: Response
-) => {
-	return res.status(200).send({
-		subscriptions: []
-	});
-};
-
-
 /**
  * Given a org id, return the projects each member of the org belongs to
  * @param req
  * @param res
  * @returns
  */
-export const getOrganizationMembersAndTheirWorkspaces = async (
-	req: Request,
-	res: Response
-) => {
-	const { organizationId } = req.params;
+export const getOrganizationMembersAndTheirWorkspaces = async (req: Request, res: Response) => {
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgMembersv1, req);
 
-	const workspacesSet = (
-			await Workspace.find(
-				{
-					organization: organizationId,
-				},
-				"_id"
-			)
-		).map((w) => w._id.toString());
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Read,
+    OrgPermissionSubjects.Member
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Read,
+    OrgPermissionSubjects.Workspace
+  );
 
-	const memberships = (
-		await Membership.find({
-			workspace: { $in: workspacesSet },
-		}).populate("workspace")
-	);
-	const userToWorkspaceIds: any = {};
+  const workspacesSet = (
+    await Workspace.find(
+      {
+        organization: organizationId
+      },
+      "_id"
+    )
+  ).map((w) => w._id.toString());
 
-	memberships.forEach(membership => {
-		const user = membership.user.toString();
-		if (userToWorkspaceIds[user]) {
-			userToWorkspaceIds[user].push(membership.workspace);
-		} else {
-			userToWorkspaceIds[user] = [membership.workspace];
-		}
-	});
+  const memberships = await Membership.find({
+    workspace: { $in: workspacesSet }
+  }).populate("workspace");
+  const userToWorkspaceIds: any = {};
 
-	return res.json(userToWorkspaceIds);
+  memberships.forEach((membership) => {
+    const user = membership.user.toString();
+    if (userToWorkspaceIds[user]) {
+      userToWorkspaceIds[user].push(membership.workspace);
+    } else {
+      userToWorkspaceIds[user] = [membership.workspace];
+    }
+  });
+
+  return res.json(userToWorkspaceIds);
 };

backend/src/controllers/v1/passwordController.ts

@@ -5,7 +5,7 @@ import * as bigintConversion from "bigint-conversion";
 import { BackupPrivateKey, LoginSRPDetail, User } from "../../models";
 import { clearTokens, createToken, sendMail } from "../../helpers";
 import { TokenService } from "../../services";
-import { AUTH_MODE_JWT, TOKEN_EMAIL_PASSWORD_RESET } from "../../variables";
+import { TOKEN_EMAIL_PASSWORD_RESET } from "../../variables";
 import { BadRequestError } from "../../utils/errors";
 import {
   getHttpsEnabled,
@@ -13,6 +13,9 @@ import {
   getJwtSignupSecret,
   getSiteURL
 } from "../../config";
+import { ActorType } from "../../ee/models";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/auth";
 
 /**
  * Password reset step 1: Send email verification link to email [email]
@@ -22,7 +25,9 @@ import {
  * @returns
  */
 export const emailPasswordReset = async (req: Request, res: Response) => {
-  const email: string = req.body.email;
+  const {
+    body: { email }
+  } = await validateRequest(reqValidator.EmailPasswordResetV1, req);
 
   const user = await User.findOne({ email }).select("+publicKey");
   if (!user || !user?.publicKey) {
@@ -61,7 +66,9 @@ export const emailPasswordReset = async (req: Request, res: Response) => {
  * @returns
  */
 export const emailPasswordResetVerify = async (req: Request, res: Response) => {
-  const { email, code } = req.body;
+  const {
+    body: { email, code }
+  } = await validateRequest(reqValidator.EmailPasswordResetVerifyV1, req);
 
   const user = await User.findOne({ email }).select("+publicKey");
   if (!user || !user?.publicKey) {
@@ -102,8 +109,10 @@ export const emailPasswordResetVerify = async (req: Request, res: Response) => {
  */
 export const srp1 = async (req: Request, res: Response) => {
   // return salt, serverPublicKey as part of first step of SRP protocol
+  const {
+    body: { clientPublicKey }
+  } = await validateRequest(reqValidator.Srp1V1, req);
 
-  const { clientPublicKey } = req.body;
   const user = await User.findOne({
     email: req.user.email
   }).select("+salt +verifier");
@@ -148,16 +157,18 @@ export const srp1 = async (req: Request, res: Response) => {
  */
 export const changePassword = async (req: Request, res: Response) => {
   const {
-    clientProof,
-    protectedKey,
-    protectedKeyIV,
-    protectedKeyTag,
-    encryptedPrivateKey,
-    encryptedPrivateKeyIV,
-    encryptedPrivateKeyTag,
-    salt,
-    verifier
-  } = req.body;
+    body: {
+      clientProof,
+      protectedKey,
+      protectedKeyIV,
+      protectedKeyTag,
+      encryptedPrivateKey,
+      encryptedPrivateKeyIV,
+      encryptedPrivateKeyTag,
+      salt,
+      verifier
+    }
+  } = await validateRequest(reqValidator.ChangePasswordV1, req);
 
   const user = await User.findOne({
     email: req.user.email
@@ -207,11 +218,7 @@ export const changePassword = async (req: Request, res: Response) => {
           }
         );
 
-        if (
-          req.authData.authMode === AUTH_MODE_JWT &&
-          req.authData.authPayload instanceof User &&
-          req.authData.tokenVersionId
-        ) {
+        if (req.authData.actor.type === ActorType.USER && req.authData.tokenVersionId) {
           await clearTokens(req.authData.tokenVersionId);
         }
 
@@ -246,8 +253,9 @@ export const createBackupPrivateKey = async (req: Request, res: Response) => {
   // create/change backup private key
   // requires verifying [clientProof] as part of second step of SRP protocol
   // as initiated in /srp1
-
-  const { clientProof, encryptedPrivateKey, iv, tag, salt, verifier } = req.body;
+  const {
+    body: { clientProof, encryptedPrivateKey, salt, verifier, iv, tag }
+  } = await validateRequest(reqValidator.CreateBackupPrivateKeyV1, req);
   const user = await User.findOne({
     email: req.user.email
   }).select("+salt +verifier");
@@ -325,15 +333,17 @@ export const getBackupPrivateKey = async (req: Request, res: Response) => {
 
 export const resetPassword = async (req: Request, res: Response) => {
   const {
-    protectedKey,
-    protectedKeyIV,
-    protectedKeyTag,
-    encryptedPrivateKey,
-    encryptedPrivateKeyIV,
-    encryptedPrivateKeyTag,
-    salt,
-    verifier
-  } = req.body;
+    body: {
+      encryptedPrivateKey,
+      protectedKeyTag,
+      protectedKey,
+      protectedKeyIV,
+      salt,
+      verifier,
+      encryptedPrivateKeyIV,
+      encryptedPrivateKeyTag
+    }
+  } = await validateRequest(reqValidator.ResetPasswordV1, req);
 
   await User.findByIdAndUpdate(
     req.user._id.toString(),

backend/src/controllers/v1/secretImportController.ts

@@ -1,117 +0,0 @@
-import { Request, Response } from "express";
-import { validateMembership } from "../../helpers";
-import SecretImport from "../../models/secretImports";
-import { getAllImportedSecrets } from "../../services/SecretImportService";
-import { BadRequestError } from "../../utils/errors";
-import { ADMIN, MEMBER } from "../../variables";
-
-export const createSecretImport = async (req: Request, res: Response) => {
-  const { workspaceId, environment, folderId, secretImport } = req.body;
-  const importSecDoc = await SecretImport.findOne({
-    workspace: workspaceId,
-    environment,
-    folderId
-  });
-
-  if (!importSecDoc) {
-    const doc = new SecretImport({
-      workspace: workspaceId,
-      environment,
-      folderId,
-      imports: [{ environment: secretImport.environment, secretPath: secretImport.secretPath }]
-    });
-    await doc.save();
-    return res.status(200).json({ message: "successfully created secret import" });
-  }
-
-  const doesImportExist = importSecDoc.imports.find(
-    (el) => el.environment === secretImport.environment && el.secretPath === secretImport.secretPath
-  );
-  if (doesImportExist) {
-    throw BadRequestError({ message: "Secret import already exist" });
-  }
-
-  importSecDoc.imports.push({
-    environment: secretImport.environment,
-    secretPath: secretImport.secretPath
-  });
-  await importSecDoc.save();
-  return res.status(200).json({ message: "successfully created secret import" });
-};
-
-// to keep the ordering, you must pass all the imports in here not the only updated one
-// this is because the order decide which import gets overriden
-export const updateSecretImport = async (req: Request, res: Response) => {
-  const { id } = req.params;
-  const { secretImports } = req.body;
-  const importSecDoc = await SecretImport.findById(id);
-  if (!importSecDoc) {
-    throw BadRequestError({ message: "Import not found" });
-  }
-
-  await validateMembership({
-    userId: req.user._id.toString(),
-    workspaceId: importSecDoc.workspace,
-    acceptedRoles: [ADMIN, MEMBER]
-  });
-
-  importSecDoc.imports = secretImports;
-  await importSecDoc.save();
-  return res.status(200).json({ message: "successfully updated secret import" });
-};
-
-export const deleteSecretImport = async (req: Request, res: Response) => {
-  const { id } = req.params;
-  const { secretImportEnv, secretImportPath } = req.body;
-  const importSecDoc = await SecretImport.findById(id);
-  if (!importSecDoc) {
-    throw BadRequestError({ message: "Import not found" });
-  }
-
-  await validateMembership({
-    userId: req.user._id.toString(),
-    workspaceId: importSecDoc.workspace,
-    acceptedRoles: [ADMIN, MEMBER]
-  });
-  importSecDoc.imports = importSecDoc.imports.filter(
-    ({ environment, secretPath }) =>
-      !(environment === secretImportEnv && secretPath === secretImportPath)
-  );
-  await importSecDoc.save();
-  return res.status(200).json({ message: "successfully delete secret import" });
-};
-
-export const getSecretImports = async (req: Request, res: Response) => {
-  const { workspaceId, environment, folderId } = req.query;
-  const importSecDoc = await SecretImport.findOne({
-    workspace: workspaceId,
-    environment,
-    folderId
-  });
-
-  if (!importSecDoc) {
-    return res.status(200).json({ secretImport: {} });
-  }
-
-  return res.status(200).json({ secretImport: importSecDoc });
-};
-
-export const getAllSecretsFromImport = async (req: Request, res: Response) => {
-  const { workspaceId, environment, folderId } = req.query as {
-    workspaceId: string;
-    environment: string;
-    folderId: string;
-  };
-  const importSecDoc = await SecretImport.findOne({
-    workspace: workspaceId,
-    environment,
-    folderId
-  });
-
-  if (!importSecDoc) {
-    return res.status(200).json({ secrets: {} });
-  }
-
-  const secrets = await getAllImportedSecrets(workspaceId, environment, folderId);
-  return res.status(200).json({ secrets });
-};

backend/src/controllers/v1/secretImpsController.ts

@@ -0,0 +1,706 @@
+import { Request, Response } from "express";
+import { isValidScope } from "../../helpers";
+import { Folder, IServiceTokenData, SecretImport, ServiceTokenData } from "../../models";
+import { getAllImportedSecrets } from "../../services/SecretImportService";
+import { getFolderWithPathFromId } from "../../services/FolderService";
+import {
+  BadRequestError,
+  ResourceNotFoundError,
+  UnauthorizedRequestError
+} from "../../utils/errors";
+import { EEAuditLogService } from "../../ee/services";
+import { EventType } from "../../ee/models";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/secretImports";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../ee/services/ProjectRoleService";
+import { ForbiddenError, subject } from "@casl/ability";
+
+export const createSecretImp = async (req: Request, res: Response) => {
+  /* 
+    #swagger.summary = 'Create secret import'
+    #swagger.description = 'Create a new secret import for a specified workspace and environment'
+
+    #swagger.requestBody = {
+        content: {
+            "application/json": {
+                "schema": {
+                    "type": "object",
+                    "properties": {
+                        "workspaceId": {
+                            "type": "string",
+                            "description": "ID of the workspace where the secret import will be created",
+                            "example": "someWorkspaceId"
+                        },
+                        "environment": {
+                            "type": "string",
+                            "description": "Environment to import to",
+                            "example": "production"
+                        },
+                        "folderId": {
+                            "type": "string",
+                            "description": "Folder ID. Use root for the root folder.",
+                            "example": "my_folder"
+                        },
+                        "secretImport": {
+                            "type": "object",
+                            "properties": {
+                              "environment": {
+                                "type": "string",
+                                "description": "Import from environment",
+                                "example": "development"
+                              },
+                              "secretPath": {
+                                "type": "string",
+                                "description": "Import from secret path",
+                                "example": "/user/oauth"
+                              }
+                            }
+                        }
+                    },
+                    "required": ["workspaceId", "environment", "folderName"]
+                }
+            }
+        }
+    }
+
+    #swagger.responses[200] = {
+        content: {
+            "application/json": {
+                "schema": {
+                    "type": "object",
+                    "properties": {
+                        "message": {
+                            "type": "string",
+                            "example": "successfully created secret import"
+                        }
+                    },
+                    "description": "Confirmation of secret import creation"
+                }
+            }
+        }
+    }
+    #swagger.responses[400] = {
+        description: "Bad Request. For example, 'Secret import already exist'"
+    }
+    #swagger.responses[401] = {
+        description: "Unauthorized request. For example, 'Folder Permission Denied'"
+    }
+    #swagger.responses[404] = {
+        description: "Resource Not Found. For example, 'Failed to find folder'"
+    }   
+  */
+
+  const {
+    body: { workspaceId, environment, folderId, secretImport }
+  } = await validateRequest(reqValidator.CreateSecretImportV1, req);
+
+  const folders = await Folder.findOne({
+    workspace: workspaceId,
+    environment
+  }).lean();
+
+  if (!folders && folderId !== "root") {
+    throw ResourceNotFoundError({
+      message: "Failed to find folder"
+    });
+  }
+
+  let secretPath = "/";
+  if (folders) {
+    const { folderPath } = getFolderWithPathFromId(folders.nodes, folderId);
+    secretPath = folderPath;
+  }
+
+  if (req.authData.authPayload instanceof ServiceTokenData) {
+    // root check
+    let isValidScopeAccess = isValidScope(req.authData.authPayload, environment, secretPath);
+    if (!isValidScopeAccess) {
+      throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
+    }
+    isValidScopeAccess = isValidScope(
+      req.authData.authPayload,
+      secretImport.environment,
+      secretImport.secretPath
+    );
+    if (!isValidScopeAccess) {
+      throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
+    }
+  } else {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Create,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.Secrets, {
+        environment: secretImport.environment,
+        secretPath: secretImport.secretPath
+      })
+    );
+  }
+
+  const importSecDoc = await SecretImport.findOne({
+    workspace: workspaceId,
+    environment,
+    folderId
+  });
+
+  const importToSecretPath = folders
+    ? getFolderWithPathFromId(folders.nodes, folderId).folderPath
+    : "/";
+
+  if (!importSecDoc) {
+    const doc = new SecretImport({
+      workspace: workspaceId,
+      environment,
+      folderId,
+      imports: [{ environment: secretImport.environment, secretPath: secretImport.secretPath }]
+    });
+
+    await doc.save();
+    await EEAuditLogService.createAuditLog(
+      req.authData,
+      {
+        type: EventType.CREATE_SECRET_IMPORT,
+        metadata: {
+          secretImportId: doc._id.toString(),
+          folderId: doc.folderId.toString(),
+          importFromEnvironment: secretImport.environment,
+          importFromSecretPath: secretImport.secretPath,
+          importToEnvironment: environment,
+          importToSecretPath
+        }
+      },
+      {
+        workspaceId: doc.workspace
+      }
+    );
+    return res.status(200).json({ message: "successfully created secret import" });
+  }
+
+  const doesImportExist = importSecDoc.imports.find(
+    (el) => el.environment === secretImport.environment && el.secretPath === secretImport.secretPath
+  );
+  if (doesImportExist) {
+    throw BadRequestError({ message: "Secret import already exist" });
+  }
+
+  importSecDoc.imports.push({
+    environment: secretImport.environment,
+    secretPath: secretImport.secretPath
+  });
+  await importSecDoc.save();
+
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.CREATE_SECRET_IMPORT,
+      metadata: {
+        secretImportId: importSecDoc._id.toString(),
+        folderId: importSecDoc.folderId.toString(),
+        importFromEnvironment: secretImport.environment,
+        importFromSecretPath: secretImport.secretPath,
+        importToEnvironment: environment,
+        importToSecretPath
+      }
+    },
+    {
+      workspaceId: importSecDoc.workspace
+    }
+  );
+  return res.status(200).json({ message: "successfully created secret import" });
+};
+
+// to keep the ordering, you must pass all the imports in here not the only updated one
+// this is because the order decide which import gets overriden
+
+/**
+ * Update secret import
+ * @param req
+ * @param res
+ * @returns
+ */
+export const updateSecretImport = async (req: Request, res: Response) => {
+  /*
+    #swagger.summary = 'Update a secret import'
+    #swagger.description = 'Updates an existing secret import based on the provided ID and new import details'
+
+    #swagger.parameters['id'] = {
+        in: 'path',
+        description: 'ID of the secret import to be updated',
+        required: true,
+        type: 'string',
+        example: 'import12345'
+    }
+
+    #swagger.requestBody = {
+        content: {
+            "application/json": {
+                "schema": {
+                    "type": "object",
+                    "properties": {
+                        "secretImports": {
+                            "type": "array",
+                            "description": "List of new secret imports",
+                            "items": {
+                                "type": "object",
+                                "properties": {
+                                    "environment": {
+                                        "type": "string",
+                                        "description": "Environment of the secret import",
+                                        "example": "production"
+                                    },
+                                    "secretPath": {
+                                        "type": "string",
+                                        "description": "Path of the secret import",
+                                        "example": "/path/to/secret"
+                                    }
+                                },
+                                "required": ["environment", "secretPath"]
+                            }
+                        }
+                    },
+                    "required": ["secretImports"]
+                }
+            }
+        }
+    }
+
+    #swagger.responses[200] = {
+        description: 'Successfully updated the secret import',
+        content: {
+            "application/json": {
+                "schema": {
+                    "type": "object",
+                    "properties": {
+                        "message": {
+                            "type": "string",
+                            "example": "successfully updated secret import"
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    #swagger.responses[400] = {
+        description: 'Bad Request - Import not found',
+    }
+
+    #swagger.responses[403] = {
+        description: 'Forbidden access due to insufficient permissions',
+    }
+
+    #swagger.responses[401] = {
+        description: 'Unauthorized access due to invalid token or scope',
+    }
+  */
+  const {
+    body: { secretImports },
+    params: { id }
+  } = await validateRequest(reqValidator.UpdateSecretImportV1, req);
+
+  const importSecDoc = await SecretImport.findById(id);
+  if (!importSecDoc) {
+    throw BadRequestError({ message: "Import not found" });
+  }
+
+  // check for service token validity
+  const folders = await Folder.findOne({
+    workspace: importSecDoc.workspace,
+    environment: importSecDoc.environment
+  }).lean();
+
+  let secretPath = "/";
+  if (folders) {
+    const { folderPath } = getFolderWithPathFromId(folders.nodes, importSecDoc.folderId);
+    secretPath = folderPath;
+  }
+
+  if (req.authData.authPayload instanceof ServiceTokenData) {
+    // token permission check
+    const isValidScopeAccess = isValidScope(
+      req.authData.authPayload,
+      importSecDoc.environment,
+      secretPath
+    );
+    if (!isValidScopeAccess) {
+      throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
+    }
+  } else {
+    // non token entry check
+    const { permission } = await getUserProjectPermissions(
+      req.user._id,
+      importSecDoc.workspace.toString()
+    );
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Edit,
+      subject(ProjectPermissionSub.Secrets, {
+        environment: importSecDoc.environment,
+        secretPath
+      })
+    );
+  }
+
+  const orderBefore = importSecDoc.imports;
+  importSecDoc.imports = secretImports;
+
+  await importSecDoc.save();
+
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.UPDATE_SECRET_IMPORT,
+      metadata: {
+        importToEnvironment: importSecDoc.environment,
+        importToSecretPath: secretPath,
+        secretImportId: importSecDoc._id.toString(),
+        folderId: importSecDoc.folderId.toString(),
+        orderBefore,
+        orderAfter: secretImports
+      }
+    },
+    {
+      workspaceId: importSecDoc.workspace
+    }
+  );
+  return res.status(200).json({ message: "successfully updated secret import" });
+};
+
+/**
+ * Delete secret import
+ * @param req
+ * @param res
+ * @returns
+ */
+export const deleteSecretImport = async (req: Request, res: Response) => {
+  /* 
+    #swagger.summary = 'Delete secret import'
+    #swagger.description = 'Delete secret import'
+
+    #swagger.parameters['id'] = {
+        in: 'path',
+        description: 'ID of the secret import',
+        required: true,
+        type: 'string',
+        example: '12345abcde'
+    }
+
+    #swagger.requestBody = {
+        content: {
+            "application/json": {
+                "schema": {
+                    "type": "object",
+                    "properties": {
+                        "secretImportEnv": {
+                            "type": "string",
+                            "description": "Import from environment",
+                            "example": "someWorkspaceId"
+                        },
+                        "secretImportPath": {
+                            "type": "string",
+                            "description": "Import from secret path",
+                            "example": "production"
+                        }
+                    },
+                    "required": ["id", "secretImportEnv", "secretImportPath"]
+                }
+            }
+        }
+    }
+
+    #swagger.responses[200] = {
+        content: {
+            "application/json": {
+                "schema": {
+                    "type": "object",
+                    "properties": {
+                        "message": {
+                            "type": "string",
+                            "example": "successfully delete secret import"
+                        }
+                    },
+                    "description": "Confirmation of secret import deletion"
+                }
+            }
+        }
+    }
+  */
+  const {
+    params: { id },
+    body: { secretImportEnv, secretImportPath }
+  } = await validateRequest(reqValidator.DeleteSecretImportV1, req);
+
+  const importSecDoc = await SecretImport.findById(id);
+  if (!importSecDoc) {
+    throw BadRequestError({ message: "Import not found" });
+  }
+
+  // check for service token validity
+  const folders = await Folder.findOne({
+    workspace: importSecDoc.workspace,
+    environment: importSecDoc.environment
+  }).lean();
+
+  let secretPath = "/";
+  if (folders) {
+    const { folderPath } = getFolderWithPathFromId(folders.nodes, importSecDoc.folderId);
+    secretPath = folderPath;
+  }
+
+  if (req.authData.authPayload instanceof ServiceTokenData) {
+    const isValidScopeAccess = isValidScope(
+      req.authData.authPayload,
+      importSecDoc.environment,
+      secretPath
+    );
+    if (!isValidScopeAccess) {
+      throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
+    }
+  } else {
+    const { permission } = await getUserProjectPermissions(
+      req.user._id,
+      importSecDoc.workspace.toString()
+    );
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Delete,
+      subject(ProjectPermissionSub.Secrets, {
+        environment: importSecDoc.environment,
+        secretPath
+      })
+    );
+  }
+  importSecDoc.imports = importSecDoc.imports.filter(
+    ({ environment, secretPath }) =>
+      !(environment === secretImportEnv && secretPath === secretImportPath)
+  );
+  await importSecDoc.save();
+
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.DELETE_SECRET_IMPORT,
+      metadata: {
+        secretImportId: importSecDoc._id.toString(),
+        folderId: importSecDoc.folderId.toString(),
+        importFromEnvironment: secretImportEnv,
+        importFromSecretPath: secretImportPath,
+        importToEnvironment: importSecDoc.environment,
+        importToSecretPath: secretPath
+      }
+    },
+    {
+      workspaceId: importSecDoc.workspace
+    }
+  );
+
+  return res.status(200).json({ message: "successfully delete secret import" });
+};
+
+/**
+ * Get secret imports
+ * @param req
+ * @param res
+ * @returns
+ */
+export const getSecretImports = async (req: Request, res: Response) => {
+  /*
+    #swagger.summary = 'Retrieve secret imports'
+    #swagger.description = 'Fetches the secret imports based on the workspaceId, environment, and folderId'
+
+    #swagger.parameters['workspaceId'] = {
+        in: 'query',
+        description: 'ID of the workspace of secret imports to get',
+        required: true,
+        type: 'string',
+        example: 'workspace12345'
+    }
+
+    #swagger.parameters['environment'] = {
+        in: 'query',
+        description: 'Environment of secret imports to get',
+        required: true,
+        type: 'string',
+        example: 'production'
+    }
+
+    #swagger.parameters['folderId'] = {
+        in: 'query',
+        description: 'ID of the folder containing the secret imports. Default: root',
+        required: false,
+        type: 'string',
+        example: 'folder12345'
+    }
+
+    #swagger.responses[200] = {
+        description: 'Successfully retrieved secret import',
+        content: {
+            "application/json": {
+                "schema": {
+                    "type": "object",
+                    "properties": {
+                        "secretImport": {
+                            "type": "object",
+                            "description": "Details of a secret import"
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    #swagger.responses[403] = {
+        description: 'Forbidden access due to insufficient permissions',
+    }
+
+    #swagger.responses[401] = {
+        description: 'Unauthorized access due to invalid token or scope',
+    }
+  */
+  const {
+    query: { workspaceId, environment, folderId }
+  } = await validateRequest(reqValidator.GetSecretImportsV1, req);
+  const importSecDoc = await SecretImport.findOne({
+    workspace: workspaceId,
+    environment,
+    folderId
+  });
+
+  if (!importSecDoc) {
+    return res.status(200).json({ secretImport: {} });
+  }
+
+  // check for service token validity
+  const folders = await Folder.findOne({
+    workspace: importSecDoc.workspace,
+    environment: importSecDoc.environment
+  }).lean();
+
+  let secretPath = "/";
+  if (folders) {
+    const { folderPath } = getFolderWithPathFromId(folders.nodes, importSecDoc.folderId);
+    secretPath = folderPath;
+  }
+
+  if (req.authData.authPayload instanceof ServiceTokenData) {
+    const isValidScopeAccess = isValidScope(
+      req.authData.authPayload,
+      importSecDoc.environment,
+      secretPath
+    );
+    if (!isValidScopeAccess) {
+      throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
+    }
+  } else {
+    const { permission } = await getUserProjectPermissions(
+      req.user._id,
+      importSecDoc.workspace.toString()
+    );
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.Secrets, {
+        environment: importSecDoc.environment,
+        secretPath
+      })
+    );
+  }
+
+  return res.status(200).json({ secretImport: importSecDoc });
+};
+
+/**
+ * Get all secret imports
+ * @param req
+ * @param res
+ * @returns
+ */
+export const getAllSecretsFromImport = async (req: Request, res: Response) => {
+  const {
+    query: { workspaceId, environment, folderId }
+  } = await validateRequest(reqValidator.GetAllSecretsFromImportV1, req);
+
+  const importSecDoc = await SecretImport.findOne({
+    workspace: workspaceId,
+    environment,
+    folderId
+  });
+
+  if (!importSecDoc) {
+    return res.status(200).json({ secrets: [] });
+  }
+
+  const folders = await Folder.findOne({
+    workspace: importSecDoc.workspace,
+    environment: importSecDoc.environment
+  }).lean();
+
+  let secretPath = "/";
+  if (folders) {
+    const { folderPath } = getFolderWithPathFromId(folders.nodes, importSecDoc.folderId);
+    secretPath = folderPath;
+  }
+
+  let permissionCheckFn: (env: string, secPath: string) => boolean; // used to pass as callback function to import secret
+  if (req.authData.authPayload instanceof ServiceTokenData) {
+    // check for service token validity
+    const isValidScopeAccess = isValidScope(
+      req.authData.authPayload,
+      importSecDoc.environment,
+      secretPath
+    );
+    if (!isValidScopeAccess) {
+      throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
+    }
+    permissionCheckFn = (env: string, secPath: string) =>
+      isValidScope(req.authData.authPayload as IServiceTokenData, env, secPath);
+  } else {
+    const { permission } = await getUserProjectPermissions(
+      req.user._id,
+      importSecDoc.workspace.toString()
+    );
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.Secrets, {
+        environment: importSecDoc.environment,
+        secretPath
+      })
+    );
+    permissionCheckFn = (env: string, secPath: string) =>
+      permission.can(
+        ProjectPermissionActions.Read,
+        subject(ProjectPermissionSub.Secrets, {
+          environment: env,
+          secretPath: secPath
+        })
+      );
+  }
+
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.GET_SECRET_IMPORTS,
+      metadata: {
+        environment,
+        secretImportId: importSecDoc._id.toString(),
+        folderId,
+        numberOfImports: importSecDoc.imports.length
+      }
+    },
+    {
+      workspaceId: importSecDoc.workspace
+    }
+  );
+
+  const secrets = await getAllImportedSecrets(
+    workspaceId,
+    environment,
+    folderId,
+    permissionCheckFn
+  );
+  return res.status(200).json({ secrets });
+};

backend/src/controllers/v1/secretScanningController.ts

@@ -1,18 +1,50 @@
 import { Request, Response } from "express";
-import GitAppInstallationSession from "../../models/gitAppInstallationSession";
+import GitAppInstallationSession from "../../ee/models/gitAppInstallationSession";
 import crypto from "crypto";
 import { Types } from "mongoose";
-import { UnauthorizedRequestError } from "../../utils/errors";
-import GitAppOrganizationInstallation from "../../models/gitAppOrganizationInstallation";
-import { MembershipOrg } from "../../models";
-import GitRisks, { STATUS_RESOLVED_FALSE_POSITIVE, STATUS_RESOLVED_NOT_REVOKED, STATUS_RESOLVED_REVOKED } from "../../models/gitRisks";
+import { OrganizationNotFoundError, UnauthorizedRequestError } from "../../utils/errors";
+import GitAppOrganizationInstallation from "../../ee/models/gitAppOrganizationInstallation";
+import { scanGithubFullRepoForSecretLeaks } from "../../queues/secret-scanning/githubScanFullRepository";
+import { getSecretScanningGitAppId, getSecretScanningPrivateKey } from "../../config";
+import GitRisks, {
+  STATUS_RESOLVED_FALSE_POSITIVE,
+  STATUS_RESOLVED_NOT_REVOKED,
+  STATUS_RESOLVED_REVOKED
+} from "../../ee/models/gitRisks";
+import { ProbotOctokit } from "probot";
+import { Organization } from "../../models";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/secretScanning";
+import {
+  OrgPermissionActions,
+  OrgPermissionSubjects,
+  getUserOrgPermissions
+} from "../../ee/services/RoleService";
+import { ForbiddenError } from "@casl/ability";
 
 export const createInstallationSession = async (req: Request, res: Response) => {
   const sessionId = crypto.randomBytes(16).toString("hex");
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.CreateInstalLSessionv1, req);
+
+  const organization = await Organization.findById(organizationId);
+  if (!organization) {
+    throw OrganizationNotFoundError({
+      message: "Failed to find organization"
+    });
+  }
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Create,
+    OrgPermissionSubjects.SecretScanning
+  );
+
   await GitAppInstallationSession.findByIdAndUpdate(
-    req.organization,
+    organization,
     {
-      organization: new Types.ObjectId(req.organization),
+      organization: organization.id,
       sessionId: sessionId,
       user: new Types.ObjectId(req.user._id)
     },
@@ -21,71 +53,128 @@ export const createInstallationSession = async (req: Request, res: Response) =>
 
   res.send({
     sessionId: sessionId
-  })
-}
+  });
+};
 
 export const linkInstallationToOrganization = async (req: Request, res: Response) => {
-  const { installationId, sessionId } = req.body
+  const {
+    body: { sessionId, installationId }
+  } = await validateRequest(reqValidator.LinkInstallationToOrgv1, req);
 
-  const installationSession = await GitAppInstallationSession.findOneAndDelete({ sessionId: sessionId })
+  const installationSession = await GitAppInstallationSession.findOneAndDelete({
+    sessionId: sessionId
+  });
   if (!installationSession) {
-    throw UnauthorizedRequestError()
+    throw UnauthorizedRequestError();
   }
 
-  const userMembership = await MembershipOrg.find({ user: req.user._id, organization: installationSession.organization })
-  if (!userMembership) {
-    throw UnauthorizedRequestError()
+  const { permission } = await getUserOrgPermissions(
+    req.user._id,
+    installationSession.organization.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Edit,
+    OrgPermissionSubjects.SecretScanning
+  );
+
+  const installationLink = await GitAppOrganizationInstallation.findOneAndUpdate(
+    {
+      organizationId: installationSession.organization
+    },
+    {
+      installationId: installationId,
+      organizationId: installationSession.organization,
+      user: installationSession.user
+    },
+    {
+      upsert: true
+    }
+  ).lean();
+
+  const octokit = new ProbotOctokit({
+    auth: {
+      appId: await getSecretScanningGitAppId(),
+      privateKey: await getSecretScanningPrivateKey(),
+      installationId: installationId.toString()
+    }
+  });
+
+  const {
+    data: { repositories }
+  } = await octokit.apps.listReposAccessibleToInstallation();
+  for (const repository of repositories) {
+    scanGithubFullRepoForSecretLeaks({
+      organizationId: installationSession.organization.toString(),
+      installationId,
+      repository: { id: repository.id, fullName: repository.full_name }
+    });
   }
-
-  const installationLink = await GitAppOrganizationInstallation.findOneAndUpdate({
-    organizationId: installationSession.organization,
-  }, {
-    installationId: installationId,
-    organizationId: installationSession.organization,
-    user: installationSession.user
-  }, {
-    upsert: true
-  }).lean()
-
-  res.json(installationLink)
-}
+  res.json(installationLink);
+};
 
 export const getCurrentOrganizationInstallationStatus = async (req: Request, res: Response) => {
-  const { organizationId } = req.params
+  const { organizationId } = req.params;
   try {
-    const appInstallation = await GitAppOrganizationInstallation.findOne({ organizationId: organizationId }).lean()
+    const appInstallation = await GitAppOrganizationInstallation.findOne({
+      organizationId: organizationId
+    }).lean();
     if (!appInstallation) {
       res.json({
         appInstallationComplete: false
-      })
+      });
     }
 
     res.json({
       appInstallationComplete: true
-    })
+    });
   } catch {
     res.json({
       appInstallationComplete: false
-    })
+    });
   }
-}
+};
 
 export const getRisksForOrganization = async (req: Request, res: Response) => {
-  const { organizationId } = req.params
-  const risks = await GitRisks.find({ organization: organizationId }).sort({ createdAt: -1 }).lean()
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgRisksv1, req);
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Read,
+    OrgPermissionSubjects.SecretScanning
+  );
+
+  const risks = await GitRisks.find({ organization: organizationId })
+    .sort({ createdAt: -1 })
+    .lean();
   res.json({
     risks: risks
-  })
-}
+  });
+};
 
 export const updateRisksStatus = async (req: Request, res: Response) => {
-  const { riskId } = req.params
-  const { status } = req.body
-  const isRiskResolved = status == STATUS_RESOLVED_FALSE_POSITIVE || status == STATUS_RESOLVED_REVOKED || status == STATUS_RESOLVED_NOT_REVOKED ? true : false
+  const {
+    params: { organizationId, riskId },
+    body: { status }
+  } = await validateRequest(reqValidator.UpdateRiskStatusv1, req);
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Edit,
+    OrgPermissionSubjects.SecretScanning
+  );
+
+  const isRiskResolved =
+    status == STATUS_RESOLVED_FALSE_POSITIVE ||
+    status == STATUS_RESOLVED_REVOKED ||
+    status == STATUS_RESOLVED_NOT_REVOKED
+      ? true
+      : false;
   const risk = await GitRisks.findByIdAndUpdate(riskId, {
     status: status,
     isResolved: isRiskResolved
-  }).lean()
+  }).lean();
 
-  res.json(risk)
-}
+  res.json(risk);
+};

backend/src/controllers/v1/secretsFolderController.ts

@@ -1,39 +1,149 @@
+import { ForbiddenError, subject } from "@casl/ability";
 import { Request, Response } from "express";
-import { Secret } from "../../models";
-import Folder from "../../models/folder";
-import { BadRequestError } from "../../utils/errors";
+import { Types } from "mongoose";
+import { EventType, FolderVersion } from "../../ee/models";
+import { EEAuditLogService, EESecretService } from "../../ee/services";
+import { isValidScope } from "../../helpers/secrets";
+import { validateRequest } from "../../helpers/validation";
+import { Secret, ServiceTokenData } from "../../models";
+import { Folder } from "../../models/folder";
 import {
   appendFolder,
   deleteFolderById,
   generateFolderId,
   getAllFolderIds,
   getFolderByPath,
+  getFolderWithPathFromId,
   getParentFromFolderId,
-  searchByFolderId,
-  searchByFolderIdWithDir,
-  validateFolderName,
+  validateFolderName
 } from "../../services/FolderService";
-import { ADMIN, MEMBER } from "../../variables";
-import { validateMembership } from "../../helpers/membership";
-import { FolderVersion } from "../../ee/models";
-import { EESecretService } from "../../ee/services";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../ee/services/ProjectRoleService";
+import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
+import * as reqValidator from "../../validation/folders";
 
-// TODO
-// verify workspace id/environment
+/**
+ * Create folder with name [folderName] for workspace with id [workspaceId]
+ * and environment [environment]
+ * @param req
+ * @param res
+ * @returns
+ */
 export const createFolder = async (req: Request, res: Response) => {
-  const { workspaceId, environment, folderName, parentFolderId } = req.body;
+  /* 
+    #swagger.summary = 'Create a folder'
+    #swagger.description = 'Create a new folder in a specified workspace and environment'
+    
+    #swagger.security = [{
+        "apiKeyAuth": []
+    }]
+
+    #swagger.requestBody = {
+        content: {
+            "application/json": {
+                "schema": {
+                    "type": "object",
+                    "properties": {
+                        "workspaceId": {
+                            "type": "string",
+                            "description": "ID of the workspace where the folder will be created",
+                            "example": "someWorkspaceId"
+                        },
+                        "environment": {
+                            "type": "string",
+                            "description": "Environment where the folder will reside",
+                            "example": "production"
+                        },
+                        "folderName": {
+                            "type": "string",
+                            "description": "Name of the folder to be created",
+                            "example": "my_folder"
+                        },
+                        "parentFolderId": {
+                            "type": "string",
+                            "description": "ID of the parent folder under which this folder will be created. If not specified, it will be created at the root level.",
+                            "example": "someParentFolderId"
+                        }
+                    },
+                    "required": ["workspaceId", "environment", "folderName"]
+                }
+            }
+        }
+    }
+
+    #swagger.responses[200] = {
+        content: {
+            "application/json": {
+                "schema": {
+                    "type": "object",
+                    "properties": {
+                        "folder": {
+                            "type": "object",
+                            "properties": {
+                                "id": {
+                                    "type": "string",
+                                    "example": "someFolderId"
+                                },
+                                "name": {
+                                    "type": "string",
+                                    "example": "my_folder"
+                                }
+                            },
+                            "description": "Details of the created folder"
+                        }
+                    }
+                }
+            }
+        }
+    }
+    #swagger.responses[400] = {
+        description: "Bad Request. For example, 'Folder name cannot contain spaces. Only underscore and dashes'"
+    }
+    #swagger.responses[401] = {
+        description: "Unauthorized request. For example, 'Folder Permission Denied'"
+    }
+  */
+  const {
+    body: { workspaceId, environment, folderName, parentFolderId }
+  } = await validateRequest(reqValidator.CreateFolderV1, req);
+
   if (!validateFolderName(folderName)) {
     throw BadRequestError({
-      message: "Folder name cannot contain spaces. Only underscore and dashes",
+      message: "Folder name cannot contain spaces. Only underscore and dashes"
     });
   }
 
   const folders = await Folder.findOne({
     workspace: workspaceId,
-    environment,
+    environment
   }).lean();
+
+  if (req.user) {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    const secretPath =
+      folders && parentFolderId
+        ? getFolderWithPathFromId(folders.nodes, parentFolderId).folderPath
+        : "/";
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Create,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
+  }
+
   // space has no folders initialized
+
   if (!folders) {
+    if (req.authData.authPayload instanceof ServiceTokenData) {
+      // root check
+      const isValidScopeAccess = isValidScope(req.authData.authPayload, environment, "/");
+      if (!isValidScopeAccess) {
+        throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
+      }
+    }
+
     const id = generateFolderId();
     const folder = new Folder({
       workspace: workspaceId,
@@ -42,68 +152,230 @@ export const createFolder = async (req: Request, res: Response) => {
         id: "root",
         name: "root",
         version: 1,
-        children: [{ id, name: folderName, children: [], version: 1 }],
-      },
+        children: [{ id, name: folderName, children: [], version: 1 }]
+      }
     });
     await folder.save();
     const folderVersion = new FolderVersion({
       workspace: workspaceId,
       environment,
-      nodes: folder.nodes,
+      nodes: folder.nodes
     });
     await folderVersion.save();
     await EESecretService.takeSecretSnapshot({
-      workspaceId,
-      environment,
+      workspaceId: new Types.ObjectId(workspaceId),
+      environment
     });
+
+    await EEAuditLogService.createAuditLog(
+      req.authData,
+      {
+        type: EventType.CREATE_FOLDER,
+        metadata: {
+          environment,
+          folderId: id,
+          folderName,
+          folderPath: `root/${folderName}`
+        }
+      },
+      {
+        workspaceId: new Types.ObjectId(workspaceId)
+      }
+    );
+
     return res.json({ folder: { id, name: folderName } });
   }
 
   const folder = appendFolder(folders.nodes, { folderName, parentFolderId });
+
+  await Folder.findByIdAndUpdate(folders._id, folders);
+
+  const { folder: parentFolder, folderPath: parentFolderPath } = getFolderWithPathFromId(
+    folders.nodes,
+    parentFolderId || "root"
+  );
+
+  if (req.authData.authPayload instanceof ServiceTokenData) {
+    // root check
+    const isValidScopeAccess = isValidScope(
+      req.authData.authPayload,
+      environment,
+      parentFolderPath
+    );
+    if (!isValidScopeAccess) {
+      throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
+    }
+  }
+
   await Folder.findByIdAndUpdate(folders._id, folders);
 
-  const parentFolder = searchByFolderId(folders.nodes, parentFolderId);
   const folderVersion = new FolderVersion({
     workspace: workspaceId,
     environment,
-    nodes: parentFolder,
+    nodes: parentFolder
   });
   await folderVersion.save();
 
   await EESecretService.takeSecretSnapshot({
-    workspaceId,
+    workspaceId: new Types.ObjectId(workspaceId),
     environment,
-    folderId: parentFolderId,
+    folderId: parentFolderId
   });
 
+  const { folderPath } = getFolderWithPathFromId(folders.nodes, folder.id);
+
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.CREATE_FOLDER,
+      metadata: {
+        environment,
+        folderId: folder.id,
+        folderName,
+        folderPath
+      }
+    },
+    {
+      workspaceId: new Types.ObjectId(workspaceId)
+    }
+  );
+
   return res.json({ folder });
 };
 
+/**
+ * Update folder with id [folderId]
+ * @param req
+ * @param res
+ * @returns
+ */
 export const updateFolderById = async (req: Request, res: Response) => {
-  const { folderId } = req.params;
-  const { name, workspaceId, environment } = req.body;
+  /* 
+    #swagger.summary = 'Update a folder by ID'
+    #swagger.description = 'Update the name of a folder in a specified workspace and environment by its ID'
+    
+    #swagger.security = [{
+        "apiKeyAuth": []
+    }]
+
+    #swagger.parameters['folderId'] = {
+        "description": "ID of the folder to be updated",
+        "required": true,
+        "type": "string",
+        "in": "path"
+    }
+
+    #swagger.requestBody = {
+        content: {
+            "application/json": {
+                "schema": {
+                    "type": "object",
+                    "properties": {
+                        "workspaceId": {
+                            "type": "string",
+                            "description": "ID of the workspace where the folder is located",
+                            "example": "someWorkspaceId"
+                        },
+                        "environment": {
+                            "type": "string",
+                            "description": "Environment where the folder is located",
+                            "example": "production"
+                        },
+                        "name": {
+                            "type": "string",
+                            "description": "New name for the folder",
+                            "example": "updated_folder_name"
+                        }
+                    },
+                    "required": ["workspaceId", "environment", "name"]
+                }
+            }
+        }
+    }
+
+    #swagger.responses[200] = {
+        content: {
+            "application/json": {
+                "schema": {
+                    "type": "object",
+                    "properties": {
+                        "message": {
+                            "type": "string",
+                            "example": "Successfully updated folder"
+                        },
+                        "folder": {
+                            "type": "object",
+                            "properties": {
+                                "name": {
+                                    "type": "string",
+                                    "example": "updated_folder_name"
+                                },
+                                "id": {
+                                    "type": "string",
+                                    "example": "someFolderId"
+                                }
+                            },
+                            "description": "Details of the updated folder"
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    #swagger.responses[400] = {
+        description: "Bad Request. Reasons can include 'The folder doesn't exist' or 'Folder name cannot contain spaces. Only underscore and dashes'"
+    }
+
+    #swagger.responses[401] = {
+        description: "Unauthorized request. For example, 'Folder Permission Denied'"
+    }
+  */
+  const {
+    body: { workspaceId, environment, name },
+    params: { folderId }
+  } = await validateRequest(reqValidator.UpdateFolderV1, req);
+
+  if (!validateFolderName(name)) {
+    throw BadRequestError({
+      message: "Folder name cannot contain spaces. Only underscore and dashes"
+    });
+  }
 
   const folders = await Folder.findOne({ workspace: workspaceId, environment });
   if (!folders) {
     throw BadRequestError({ message: "The folder doesn't exist" });
   }
 
-  // check that user is a member of the workspace
-  await validateMembership({
-    userId: req.user._id.toString(),
-    workspaceId,
-    acceptedRoles: [ADMIN, MEMBER],
-  });
-
   const parentFolder = getParentFromFolderId(folders.nodes, folderId);
   if (!parentFolder) {
     throw BadRequestError({ message: "The folder doesn't exist" });
   }
+
+  if (req.user) {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    const secretPath = getFolderWithPathFromId(folders.nodes, parentFolder.id).folderPath;
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Edit,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
+  }
+
   const folder = parentFolder.children.find(({ id }) => id === folderId);
   if (!folder) {
     throw BadRequestError({ message: "The folder doesn't exist" });
   }
 
+  if (req.authData.authPayload instanceof ServiceTokenData) {
+    const { folderPath: secretPath } = getFolderWithPathFromId(folders.nodes, parentFolder.id);
+    // root check
+    const isValidScopeAccess = isValidScope(req.authData.authPayload, environment, secretPath);
+    if (!isValidScopeAccess) {
+      throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
+    }
+  }
+
+  const oldFolderName = folder.name;
   parentFolder.version += 1;
   folder.name = name;
 
@@ -111,43 +383,157 @@ export const updateFolderById = async (req: Request, res: Response) => {
   const folderVersion = new FolderVersion({
     workspace: workspaceId,
     environment,
-    nodes: parentFolder,
+    nodes: parentFolder
   });
   await folderVersion.save();
 
   await EESecretService.takeSecretSnapshot({
-    workspaceId,
+    workspaceId: new Types.ObjectId(workspaceId),
     environment,
-    folderId: parentFolder.id,
+    folderId: parentFolder.id
   });
 
+  const { folderPath } = getFolderWithPathFromId(folders.nodes, folder.id);
+
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.UPDATE_FOLDER,
+      metadata: {
+        environment,
+        folderId: folder.id,
+        oldFolderName,
+        newFolderName: name,
+        folderPath
+      }
+    },
+    {
+      workspaceId: new Types.ObjectId(workspaceId)
+    }
+  );
+
   return res.json({
     message: "Successfully updated folder",
-    folder: { name: folder.name, id: folder.id },
+    folder: { name: folder.name, id: folder.id }
   });
 };
 
+/**
+ * Delete folder with id [folderId]
+ * @param req
+ * @param res
+ * @returns
+ */
 export const deleteFolder = async (req: Request, res: Response) => {
-  const { folderId } = req.params;
-  const { workspaceId, environment } = req.body;
+  /* 
+    #swagger.summary = 'Delete a folder by ID'
+    #swagger.description = 'Delete the specified folder from a specified workspace and environment using its ID'
+    
+    #swagger.security = [{
+        "apiKeyAuth": []
+    }]
+
+    #swagger.parameters['folderId'] = {
+        "description": "ID of the folder to be deleted",
+        "required": true,
+        "type": "string",
+        "in": "path"
+    }
+
+    #swagger.requestBody = {
+        content: {
+            "application/json": {
+                "schema": {
+                    "type": "object",
+                    "properties": {
+                        "workspaceId": {
+                            "type": "string",
+                            "description": "ID of the workspace where the folder is located",
+                            "example": "someWorkspaceId"
+                        },
+                        "environment": {
+                            "type": "string",
+                            "description": "Environment where the folder is located",
+                            "example": "production"
+                        }
+                    },
+                    "required": ["workspaceId", "environment"]
+                }
+            }
+        }
+    }
+
+    #swagger.responses[200] = {
+        content: {
+            "application/json": {
+                "schema": {
+                    "type": "object",
+                    "properties": {
+                        "message": {
+                            "type": "string",
+                            "example": "successfully deleted folders"
+                        },
+                        "folders": {
+                            "type": "array",
+                            "items": {
+                                "type": "object",
+                                "properties": {
+                                    "id": {
+                                        "type": "string",
+                                        "example": "someFolderId"
+                                    },
+                                    "name": {
+                                        "type": "string",
+                                        "example": "someFolderName"
+                                    }
+                                }
+                            },
+                            "description": "List of IDs and names of the deleted folders"
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    #swagger.responses[400] = {
+        description: "Bad Request. Reasons can include 'The folder doesn't exist'"
+    }
+
+    #swagger.responses[401] = {
+        description: "Unauthorized request. For example, 'Folder Permission Denied'"
+    }
+  */
+  const {
+    params: { folderId },
+    body: { environment, workspaceId }
+  } = await validateRequest(reqValidator.DeleteFolderV1, req);
 
   const folders = await Folder.findOne({ workspace: workspaceId, environment });
   if (!folders) {
     throw BadRequestError({ message: "The folder doesn't exist" });
   }
 
-  // check that user is a member of the workspace
-  await validateMembership({
-    userId: req.user._id.toString(),
-    workspaceId,
-    acceptedRoles: [ADMIN, MEMBER],
-  });
-
   const delOp = deleteFolderById(folders.nodes, folderId);
   if (!delOp) {
     throw BadRequestError({ message: "The folder doesn't exist" });
   }
   const { deletedNode: delFolder, parent: parentFolder } = delOp;
+  const { folderPath: secretPath } = getFolderWithPathFromId(folders.nodes, parentFolder.id);
+
+  if (req.authData.authPayload instanceof ServiceTokenData) {
+    const isValidScopeAccess = isValidScope(req.authData.authPayload, environment, secretPath);
+    if (!isValidScopeAccess) {
+      throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
+    }
+  } else {
+    // check that user is a member of the workspace
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Delete,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
+  }
 
   parentFolder.version += 1;
   const delFolderIds = getAllFolderIds(delFolder);
@@ -156,52 +542,167 @@ export const deleteFolder = async (req: Request, res: Response) => {
   const folderVersion = new FolderVersion({
     workspace: workspaceId,
     environment,
-    nodes: parentFolder,
+    nodes: parentFolder
   });
   await folderVersion.save();
   if (delFolderIds.length) {
     await Secret.deleteMany({
       folder: { $in: delFolderIds.map(({ id }) => id) },
       workspace: workspaceId,
-      environment,
+      environment
     });
   }
 
   await EESecretService.takeSecretSnapshot({
-    workspaceId,
+    workspaceId: new Types.ObjectId(workspaceId),
     environment,
-    folderId: parentFolder.id,
+    folderId: parentFolder.id
   });
 
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.DELETE_FOLDER,
+      metadata: {
+        environment,
+        folderId,
+        folderName: delFolder.name,
+        folderPath: secretPath
+      }
+    },
+    {
+      workspaceId: new Types.ObjectId(workspaceId)
+    }
+  );
+
   res.send({ message: "successfully deleted folders", folders: delFolderIds });
 };
 
-// TODO: validate workspace
+/**
+ * Get folders for workspace with id [workspaceId] and environment [environment]
+ * considering [parentFolderId] and [parentFolderPath]
+ * @param req
+ * @param res
+ * @returns
+ */
 export const getFolders = async (req: Request, res: Response) => {
-  const { workspaceId, environment, parentFolderId, parentFolderPath } =
-    req.query as {
-      workspaceId: string;
-      environment: string;
-      parentFolderId?: string;
-      parentFolderPath?: string;
-    };
+  /*
+    #swagger.summary = 'Retrieve folders based on specific conditions'
+    #swagger.description = 'Fetches folders from the specified workspace and environment, optionally providing either a parentFolderId or a parentFolderPath to narrow down results'
+    
+    #swagger.security = [{
+        "apiKeyAuth": []
+    }]
+
+    #swagger.parameters['workspaceId'] = {
+        "description": "ID of the workspace from which the folders are to be fetched",
+        "required": true,
+        "type": "string",
+        "in": "query"
+    }
+
+    #swagger.parameters['environment'] = {
+        "description": "Environment where the folder is located",
+        "required": true,
+        "type": "string",
+        "in": "query"
+    }
+
+    #swagger.parameters['parentFolderId'] = {
+        "description": "ID of the parent folder",
+        "required": false,
+        "type": "string",
+        "in": "query"
+    }
+
+    #swagger.parameters['parentFolderPath'] = {
+        "description": "Path of the parent folder, like /folder1/folder2",
+        "required": false,
+        "type": "string",
+        "in": "query"
+    }
+
+    #swagger.responses[200] = {
+        content: {
+            "application/json": {
+                "schema": {
+                    "type": "object",
+                    "properties": {
+                        "folders": {
+                            "type": "array",
+                            "items": {
+                                "type": "object",
+                                "properties": {
+                                    "id": {
+                                        "type": "string",
+                                        "example": "someFolderId"
+                                    },
+                                    "name": {
+                                        "type": "string",
+                                        "example": "someFolderName"
+                                    }
+                                }
+                            },
+                            "description": "List of folders"
+                        },
+                        "dir": {
+                            "type": "array",
+                            "items": {
+                                "type": "object",
+                                "properties": {
+                                    "name": {
+                                        "type": "string",
+                                        "example": "parentFolderName"
+                                    },
+                                    "id": {
+                                        "type": "string",
+                                        "example": "parentFolderId"
+                                    }
+                                }
+                            },
+                            "description": "List of directories"
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    #swagger.responses[400] = {
+        description: "Bad Request. For instance, 'The folder doesn't exist'"
+    }
+
+    #swagger.responses[401] = {
+        description: "Unauthorized request. For example, 'Folder Permission Denied'"
+    }
+  */
+  const {
+    query: { workspaceId, environment, parentFolderId, parentFolderPath }
+  } = await validateRequest(reqValidator.GetFoldersV1, req);
 
   const folders = await Folder.findOne({ workspace: workspaceId, environment });
+
+  if (req.user) await getUserProjectPermissions(req.user._id, workspaceId);
+
   if (!folders) {
     res.send({ folders: [], dir: [] });
     return;
   }
 
-  // check that user is a member of the workspace
-  await validateMembership({
-    userId: req.user._id.toString(),
-    workspaceId,
-    acceptedRoles: [ADMIN, MEMBER],
-  });
-
   // if instead of parentFolderId given a path like /folder1/folder2
   if (parentFolderPath) {
+    if (req.authData.authPayload instanceof ServiceTokenData) {
+      const isValidScopeAccess = isValidScope(
+        req.authData.authPayload,
+        environment,
+        parentFolderPath
+      );
+      if (!isValidScopeAccess) {
+        throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
+      }
+    }
     const folder = getFolderByPath(folders.nodes, parentFolderPath);
+
     if (!folder) {
       res.send({ folders: [], dir: [] });
       return;
@@ -209,27 +710,36 @@ export const getFolders = async (req: Request, res: Response) => {
     // dir is not needed at present as this is only used in overview section of secrets
     res.send({
       folders: folder.children.map(({ id, name }) => ({ id, name })),
-      dir: [{ name: folder.name, id: folder.id }],
+      dir: [{ name: folder.name, id: folder.id }]
     });
   }
 
   if (!parentFolderId) {
+    if (req.authData.authPayload instanceof ServiceTokenData) {
+      const isValidScopeAccess = isValidScope(req.authData.authPayload, environment, "/");
+      if (!isValidScopeAccess) {
+        throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
+      }
+    }
+
     const rootFolders = folders.nodes.children.map(({ id, name }) => ({
       id,
-      name,
+      name
     }));
     res.send({ folders: rootFolders });
     return;
   }
 
-  const folderBySearch = searchByFolderIdWithDir(folders.nodes, parentFolderId);
-  if (!folderBySearch) {
-    throw BadRequestError({ message: "The folder doesn't exist" });
+  const { folder, folderPath, dir } = getFolderWithPathFromId(folders.nodes, parentFolderId);
+  if (req.authData.authPayload instanceof ServiceTokenData) {
+    const isValidScopeAccess = isValidScope(req.authData.authPayload, environment, folderPath);
+    if (!isValidScopeAccess) {
+      throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
+    }
   }
-  const { folder, dir } = folderBySearch;
 
   res.send({
     folders: folder.children.map(({ id, name }) => ({ id, name })),
-    dir,
+    dir
   });
 };

backend/src/controllers/v1/signupController.ts

@@ -1,5 +1,5 @@
 import { Request, Response } from "express";
-import { User } from "../../models";
+import { AuthMethod, User } from "../../models";
 import { checkEmailVerification, sendEmailVerification } from "../../helpers/signup";
 import { createToken } from "../../helpers/auth";
 import { BadRequestError } from "../../utils/errors";
@@ -10,6 +10,8 @@ import {
   getSmtpConfigured
 } from "../../config";
 import { validateUserEmail } from "../../validation";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/auth";
 
 /**
  * Signup step 1: Initialize account for user under email [email] and send a verification code
@@ -19,7 +21,9 @@ import { validateUserEmail } from "../../validation";
  * @returns
  */
 export const beginEmailSignup = async (req: Request, res: Response) => {
-  const email: string = req.body.email;
+  const {
+    body: { email }
+  } = await validateRequest(reqValidator.BeginEmailSignUpV1, req);
 
   // validate that email is not disposable
   validateUserEmail(email);
@@ -50,7 +54,9 @@ export const beginEmailSignup = async (req: Request, res: Response) => {
  */
 export const verifyEmailSignup = async (req: Request, res: Response) => {
   let user;
-  const { email, code } = req.body;
+  const {
+    body: { email, code }
+  } = await validateRequest(reqValidator.VerifyEmailSignUpV1, req);
 
   // initialize user account
   user = await User.findOne({ email }).select("+publicKey");
@@ -81,7 +87,8 @@ export const verifyEmailSignup = async (req: Request, res: Response) => {
 
   if (!user) {
     user = await new User({
-      email
+      email,
+      authMethods: [AuthMethod.EMAIL]
     }).save();
   }
 

backend/src/controllers/v1/userActionController.ts

@@ -1,5 +1,7 @@
 import { Request, Response } from "express";
+import { validateRequest } from "../../helpers/validation";
 import { UserAction } from "../../models";
+import * as reqValidator from "../../validation/action";
 
 /**
  * Add user action [action]
@@ -8,26 +10,27 @@ import { UserAction } from "../../models";
  * @returns
  */
 export const addUserAction = async (req: Request, res: Response) => {
-	// add/record new action [action] for user with id [req.user._id]
-
-  const { action } = req.body;
+  // add/record new action [action] for user with id [req.user._id]
+  const {
+    body: { action }
+  } = await validateRequest(reqValidator.AddUserActionV1, req);
 
   const userAction = await UserAction.findOneAndUpdate(
     {
       user: req.user._id,
-      action,
+      action
     },
     { user: req.user._id, action },
     {
       new: true,
-      upsert: true,
+      upsert: true
     }
   );
 
-	return res.status(200).send({
-		message: "Successfully recorded user action",
-		userAction,
-	});
+  return res.status(200).send({
+    message: "Successfully recorded user action",
+    userAction
+  });
 };
 
 /**
@@ -37,15 +40,17 @@ export const addUserAction = async (req: Request, res: Response) => {
  * @returns
  */
 export const getUserAction = async (req: Request, res: Response) => {
-	// get user action [action] for user with id [req.user._id]
-  const action: string = req.query.action as string;
+  // get user action [action] for user with id [req.user._id]
+  const {
+    query: { action }
+  } = await validateRequest(reqValidator.GetUserActionV1, req);
 
   const userAction = await UserAction.findOne({
     user: req.user._id,
-    action,
+    action
   });
 
-	return res.status(200).send({
-		userAction,
-	});
+  return res.status(200).send({
+    userAction
+  });
 };

backend/src/controllers/v1/webhookController.ts

@@ -1,14 +1,32 @@
 import { Request, Response } from "express";
 import { Types } from "mongoose";
 import { client, getRootEncryptionKey } from "../../config";
-import { validateMembership } from "../../helpers";
-import Webhook from "../../models/webhooks";
+import { Webhook } from "../../models";
 import { getWebhookPayload, triggerWebhookRequest } from "../../services/WebhookService";
-import { BadRequestError } from "../../utils/errors";
-import { ADMIN, ALGORITHM_AES_256_GCM, ENCODING_SCHEME_BASE64, MEMBER } from "../../variables";
+import { BadRequestError, ResourceNotFoundError } from "../../utils/errors";
+import { EEAuditLogService } from "../../ee/services";
+import { EventType } from "../../ee/models";
+import { ALGORITHM_AES_256_GCM, ENCODING_SCHEME_BASE64 } from "../../variables";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/webhooks";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../ee/services/ProjectRoleService";
+import { ForbiddenError } from "@casl/ability";
 
 export const createWebhook = async (req: Request, res: Response) => {
-  const { webhookUrl, webhookSecretKey, environment, workspaceId, secretPath } = req.body;
+  const {
+    body: { webhookUrl, webhookSecretKey, environment, workspaceId, secretPath }
+  } = await validateRequest(reqValidator.CreateWebhookV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Create,
+    ProjectPermissionSub.Webhooks
+  );
+
   const webhook = new Webhook({
     workspace: workspaceId,
     environment,
@@ -28,6 +46,23 @@ export const createWebhook = async (req: Request, res: Response) => {
 
   await webhook.save();
 
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.CREATE_WEBHOOK,
+      metadata: {
+        webhookId: webhook._id.toString(),
+        environment,
+        secretPath,
+        webhookUrl,
+        isDisabled: false
+      }
+    },
+    {
+      workspaceId: new Types.ObjectId(workspaceId)
+    }
+  );
+
   return res.status(200).send({
     webhook,
     message: "successfully created webhook"
@@ -35,25 +70,47 @@ export const createWebhook = async (req: Request, res: Response) => {
 };
 
 export const updateWebhook = async (req: Request, res: Response) => {
-  const { webhookId } = req.params;
-  const { isDisabled } = req.body;
+  const {
+    body: { isDisabled },
+    params: { webhookId }
+  } = await validateRequest(reqValidator.UpdateWebhookV1, req);
+
   const webhook = await Webhook.findById(webhookId);
   if (!webhook) {
     throw BadRequestError({ message: "Webhook not found!!" });
   }
 
-  // check that user is a member of the workspace
-  await validateMembership({
-    userId: req.user._id.toString(),
-    workspaceId: webhook.workspace,
-    acceptedRoles: [ADMIN, MEMBER]
-  });
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    webhook.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Edit,
+    ProjectPermissionSub.Webhooks
+  );
 
   if (typeof isDisabled !== undefined) {
     webhook.isDisabled = isDisabled;
   }
   await webhook.save();
 
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.UPDATE_WEBHOOK_STATUS,
+      metadata: {
+        webhookId: webhook._id.toString(),
+        environment: webhook.environment,
+        secretPath: webhook.secretPath,
+        webhookUrl: webhook.url,
+        isDisabled
+      }
+    },
+    {
+      workspaceId: webhook.workspace
+    }
+  );
+
   return res.status(200).send({
     webhook,
     message: "successfully updated webhook"
@@ -61,18 +118,46 @@ export const updateWebhook = async (req: Request, res: Response) => {
 };
 
 export const deleteWebhook = async (req: Request, res: Response) => {
-  const { webhookId } = req.params;
-  const webhook = await Webhook.findById(webhookId);
+  const {
+    params: { webhookId }
+  } = await validateRequest(reqValidator.DeleteWebhookV1, req);
+  let webhook = await Webhook.findById(webhookId);
+
   if (!webhook) {
-    throw BadRequestError({ message: "Webhook not found!!" });
+    throw ResourceNotFoundError({ message: "Webhook not found!!" });
   }
 
-  await validateMembership({
-    userId: req.user._id.toString(),
-    workspaceId: webhook.workspace,
-    acceptedRoles: [ADMIN, MEMBER]
-  });
-  await webhook.remove();
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    webhook.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Delete,
+    ProjectPermissionSub.Webhooks
+  );
+
+  webhook = await Webhook.findByIdAndDelete(webhookId);
+
+  if (!webhook) {
+    throw ResourceNotFoundError({ message: "Webhook not found!!" });
+  }
+
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.DELETE_WEBHOOK,
+      metadata: {
+        webhookId: webhook._id.toString(),
+        environment: webhook.environment,
+        secretPath: webhook.secretPath,
+        webhookUrl: webhook.url,
+        isDisabled: webhook.isDisabled
+      }
+    },
+    {
+      workspaceId: webhook.workspace
+    }
+  );
 
   return res.status(200).send({
     message: "successfully removed webhook"
@@ -80,17 +165,23 @@ export const deleteWebhook = async (req: Request, res: Response) => {
 };
 
 export const testWebhook = async (req: Request, res: Response) => {
-  const { webhookId } = req.params;
+  const {
+    params: { webhookId }
+  } = await validateRequest(reqValidator.TestWebhookV1, req);
+
   const webhook = await Webhook.findById(webhookId);
   if (!webhook) {
     throw BadRequestError({ message: "Webhook not found!!" });
   }
 
-  await validateMembership({
-    userId: req.user._id.toString(),
-    workspaceId: webhook.workspace,
-    acceptedRoles: [ADMIN, MEMBER]
-  });
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    webhook.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Webhooks
+  );
 
   try {
     await triggerWebhookRequest(
@@ -123,7 +214,15 @@ export const testWebhook = async (req: Request, res: Response) => {
 };
 
 export const listWebhooks = async (req: Request, res: Response) => {
-  const { environment, workspaceId, secretPath } = req.query;
+  const {
+    query: { environment, workspaceId, secretPath }
+  } = await validateRequest(reqValidator.ListWebhooksV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Webhooks
+  );
 
   const optionalFilters: Record<string, string> = {};
   if (environment) optionalFilters.environment = environment as string;

backend/src/controllers/v1/workspaceController.ts

@@ -1,20 +1,32 @@
+import { Types } from "mongoose";
 import { Request, Response } from "express";
 import {
   IUser,
   Integration,
   IntegrationAuth,
   Membership,
-  MembershipOrg,
+  Organization,
   ServiceToken,
-  Workspace,
+  Workspace
 } from "../../models";
-import {
-  createWorkspace as create,
-  deleteWorkspace as deleteWork,
-} from "../../helpers/workspace";
+import { createWorkspace as create, deleteWorkspace as deleteWork } from "../../helpers/workspace";
 import { EELicenseService } from "../../ee/services";
 import { addMemberships } from "../../helpers/membership";
 import { ADMIN } from "../../variables";
+import { OrganizationNotFoundError } from "../../utils/errors";
+import {
+  OrgPermissionActions,
+  OrgPermissionSubjects,
+  getUserOrgPermissions
+} from "../../ee/services/RoleService";
+import { ForbiddenError } from "@casl/ability";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../ee/services/ProjectRoleService";
 
 /**
  * Return public keys of members of workspace with id [workspaceId]
@@ -23,21 +35,29 @@ import { ADMIN } from "../../variables";
  * @returns
  */
 export const getWorkspacePublicKeys = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetWorkspacePublicKeysV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Member
+  );
 
   const publicKeys = (
     await Membership.find({
-      workspace: workspaceId,
+      workspace: workspaceId
     }).populate<{ user: IUser }>("user", "publicKey")
   ).map((member) => {
     return {
       publicKey: member.user.publicKey,
-      userId: member.user._id,
+      userId: member.user._id
     };
   });
 
   return res.status(200).send({
-    publicKeys,
+    publicKeys
   });
 };
 
@@ -48,14 +68,22 @@ export const getWorkspacePublicKeys = async (req: Request, res: Response) => {
  * @returns
  */
 export const getWorkspaceMemberships = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetWorkspaceMembershipsV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Member
+  );
 
   const users = await Membership.find({
-    workspace: workspaceId,
+    workspace: workspaceId
   }).populate("user", "+publicKey");
 
   return res.status(200).send({
-    users,
+    users
   });
 };
 
@@ -68,12 +96,12 @@ export const getWorkspaceMemberships = async (req: Request, res: Response) => {
 export const getWorkspaces = async (req: Request, res: Response) => {
   const workspaces = (
     await Membership.find({
-      user: req.user._id,
+      user: req.user._id
     }).populate("workspace")
   ).map((m) => m.workspace);
 
   return res.status(200).send({
-    workspaces,
+    workspaces
   });
 };
 
@@ -84,14 +112,16 @@ export const getWorkspaces = async (req: Request, res: Response) => {
  * @returns
  */
 export const getWorkspace = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetWorkspaceV1, req);
 
   const workspace = await Workspace.findOne({
-    _id: workspaceId,
+    _id: workspaceId
   });
 
   return res.status(200).send({
-    workspace,
+    workspace
   });
 };
 
@@ -103,26 +133,32 @@ export const getWorkspace = async (req: Request, res: Response) => {
  * @returns
  */
 export const createWorkspace = async (req: Request, res: Response) => {
-  const { workspaceName, organizationId } = req.body;
+  const {
+    body: { organizationId, workspaceName }
+  } = await validateRequest(reqValidator.CreateWorkspaceV1, req);
 
-  // validate organization membership
-  const membershipOrg = await MembershipOrg.findOne({
-    user: req.user._id,
-    organization: organizationId,
-  });
-
-  if (!membershipOrg) {
-    throw new Error("Failed to validate organization membership");
+  const organization = await Organization.findById(organizationId);
+  if (!organization) {
+    throw OrganizationNotFoundError({
+      message: "Failed to find organization"
+    });
   }
 
-  const plan = await EELicenseService.getPlan(organizationId);
-  
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Create,
+    OrgPermissionSubjects.Workspace
+  );
+
+  const plan = await EELicenseService.getPlan(new Types.ObjectId(organizationId));
+
   if (plan.workspaceLimit !== null) {
     // case: limit imposed on number of workspaces allowed
     if (plan.workspacesUsed >= plan.workspaceLimit) {
       // case: number of workspaces used exceeds the number of workspaces allowed
       return res.status(400).send({
-        message: "Failed to create workspace due to plan limit reached. Upgrade plan to add more workspaces.",
+        message:
+          "Failed to create workspace due to plan limit reached. Upgrade plan to add more workspaces."
       });
     }
   }
@@ -134,17 +170,17 @@ export const createWorkspace = async (req: Request, res: Response) => {
   // create workspace and add user as member
   const workspace = await create({
     name: workspaceName,
-    organizationId,
+    organizationId: new Types.ObjectId(organizationId)
   });
 
   await addMemberships({
     userIds: [req.user._id],
     workspaceId: workspace._id.toString(),
-    roles: [ADMIN],
+    roles: [ADMIN]
   });
 
   return res.status(200).send({
-    workspace,
+    workspace
   });
 };
 
@@ -155,15 +191,23 @@ export const createWorkspace = async (req: Request, res: Response) => {
  * @returns
  */
 export const deleteWorkspace = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.DeleteWorkspaceV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Delete,
+    ProjectPermissionSub.Workspace
+  );
 
   // delete workspace
   await deleteWork({
-    id: workspaceId,
+    id: workspaceId
   });
 
   return res.status(200).send({
-    message: "Successfully deleted workspace",
+    message: "Successfully deleted workspace"
   });
 };
 
@@ -174,24 +218,32 @@ export const deleteWorkspace = async (req: Request, res: Response) => {
  * @returns
  */
 export const changeWorkspaceName = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
-  const { name } = req.body;
+  const {
+    params: { workspaceId },
+    body: { name }
+  } = await validateRequest(reqValidator.ChangeWorkspaceNameV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Edit,
+    ProjectPermissionSub.Workspace
+  );
 
   const workspace = await Workspace.findOneAndUpdate(
     {
-      _id: workspaceId,
+      _id: workspaceId
     },
     {
-      name,
+      name
     },
     {
-      new: true,
+      new: true
     }
   );
 
   return res.status(200).send({
     message: "Successfully changed workspace name",
-    workspace,
+    workspace
   });
 };
 
@@ -202,14 +254,21 @@ export const changeWorkspaceName = async (req: Request, res: Response) => {
  * @returns
  */
 export const getWorkspaceIntegrations = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetWorkspaceIntegrationsV1, req);
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Integrations
+  );
 
   const integrations = await Integration.find({
-    workspace: workspaceId,
+    workspace: workspaceId
   });
 
   return res.status(200).send({
-    integrations,
+    integrations
   });
 };
 
@@ -219,18 +278,23 @@ export const getWorkspaceIntegrations = async (req: Request, res: Response) => {
  * @param res
  * @returns
  */
-export const getWorkspaceIntegrationAuthorizations = async (
-  req: Request,
-  res: Response
-) => {
-  const { workspaceId } = req.params;
+export const getWorkspaceIntegrationAuthorizations = async (req: Request, res: Response) => {
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetWorkspaceIntegrationAuthorizationsV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Integrations
+  );
 
   const authorizations = await IntegrationAuth.find({
-    workspace: workspaceId,
+    workspace: workspaceId
   });
 
   return res.status(200).send({
-    authorizations,
+    authorizations
   });
 };
 
@@ -240,18 +304,24 @@ export const getWorkspaceIntegrationAuthorizations = async (
  * @param res
  * @returns
  */
-export const getWorkspaceServiceTokens = async (
-  req: Request,
-  res: Response
-) => {
-  const { workspaceId } = req.params;
+export const getWorkspaceServiceTokens = async (req: Request, res: Response) => {
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetWorkspaceServiceTokensV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.ServiceTokens
+  );
+
   // ?? FIX.
   const serviceTokens = await ServiceToken.find({
     user: req.user._id,
-    workspace: workspaceId,
+    workspace: workspaceId
   });
 
   return res.status(200).send({
-    serviceTokens,
+    serviceTokens
   });
 };

backend/src/controllers/v2/authController.ts

@@ -10,16 +10,11 @@ import { sendMail } from "../../helpers/nodemailer";
 import { TokenService } from "../../services";
 import { EELogService } from "../../ee/services";
 import { BadRequestError, InternalServerError } from "../../utils/errors";
-import {
-  ACTION_LOGIN,
-  TOKEN_EMAIL_MFA,
-} from "../../variables";
-import { getChannelFromUserAgent } from "../../utils/posthog"; // TODO: move this
-import {
-  getHttpsEnabled,
-  getJwtMfaLifetime,
-  getJwtMfaSecret,
-} from "../../config";
+import { ACTION_LOGIN, TOKEN_EMAIL_MFA } from "../../variables";
+import { getUserAgentType } from "../../utils/posthog"; // TODO: move this
+import { getHttpsEnabled, getJwtMfaLifetime, getJwtMfaSecret } from "../../config";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/auth";
 
 declare module "jsonwebtoken" {
   export interface UserIDJwtPayload extends jwt.JwtPayload {
@@ -34,13 +29,10 @@ declare module "jsonwebtoken" {
  * @returns
  */
 export const login1 = async (req: Request, res: Response) => {
-  const {
-    email,
-    clientPublicKey,
-  }: { email: string; clientPublicKey: string } = req.body;
+  const { email, clientPublicKey }: { email: string; clientPublicKey: string } = req.body;
 
   const user = await User.findOne({
-    email,
+    email
   }).select("+salt +verifier");
 
   if (!user) throw new Error("Failed to find user");
@@ -49,25 +41,28 @@ export const login1 = async (req: Request, res: Response) => {
   server.init(
     {
       salt: user.salt,
-      verifier: user.verifier,
+      verifier: user.verifier
     },
     async () => {
       // generate server-side public key
       const serverPublicKey = server.getPublicKey();
 
-      await LoginSRPDetail.findOneAndReplace({ email: email }, {
-        email: email,
-        clientPublicKey: clientPublicKey,
-        serverBInt: bigintConversion.bigintToBuf(server.bInt),
-      }, { upsert: true, returnNewDocument: false });
+      await LoginSRPDetail.findOneAndReplace(
+        { email: email },
+        {
+          email: email,
+          clientPublicKey: clientPublicKey,
+          serverBInt: bigintConversion.bigintToBuf(server.bInt)
+        },
+        { upsert: true, returnNewDocument: false }
+      );
 
       return res.status(200).send({
         serverPublicKey,
-        salt: user.salt,
+        salt: user.salt
       });
     }
   );
-  
 };
 
 /**
@@ -78,19 +73,22 @@ export const login1 = async (req: Request, res: Response) => {
  * @returns
  */
 export const login2 = async (req: Request, res: Response) => {
-  if (!req.headers["user-agent"]) throw InternalServerError({ message: "User-Agent header is required" });
+  if (!req.headers["user-agent"])
+    throw InternalServerError({ message: "User-Agent header is required" });
 
   const { email, clientProof } = req.body;
   const user = await User.findOne({
-    email,
-  }).select("+salt +verifier +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag +publicKey +encryptedPrivateKey +iv +tag +devices");
+    email
+  }).select(
+    "+salt +verifier +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag +publicKey +encryptedPrivateKey +iv +tag +devices"
+  );
 
   if (!user) throw new Error("Failed to find user");
 
-  const loginSRPDetail = await LoginSRPDetail.findOneAndDelete({ email: email })
+  const loginSRPDetail = await LoginSRPDetail.findOneAndDelete({ email: email });
 
   if (!loginSRPDetail) {
-    return BadRequestError(Error("Failed to find login details for SRP"))
+    return BadRequestError(Error("Failed to find login details for SRP"));
   }
 
   const server = new jsrp.server();
@@ -98,7 +96,7 @@ export const login2 = async (req: Request, res: Response) => {
     {
       salt: user.salt,
       verifier: user.verifier,
-      b: loginSRPDetail.serverBInt,
+      b: loginSRPDetail.serverBInt
     },
     async () => {
       server.setClientPublicKey(loginSRPDetail.clientPublicKey);
@@ -111,15 +109,15 @@ export const login2 = async (req: Request, res: Response) => {
           // generate temporary MFA token
           const token = createToken({
             payload: {
-              userId: user._id.toString(),
+              userId: user._id.toString()
             },
             expiresIn: await getJwtMfaLifetime(),
-            secret: await getJwtMfaSecret(),
+            secret: await getJwtMfaSecret()
           });
 
           const code = await TokenService.createToken({
             type: TOKEN_EMAIL_MFA,
-            email,
+            email
           });
 
           // send MFA code [code] to [email]
@@ -128,27 +126,27 @@ export const login2 = async (req: Request, res: Response) => {
             subjectLine: "Infisical MFA code",
             recipients: [email],
             substitutions: {
-              code,
-            },
+              code
+            }
           });
 
           return res.status(200).send({
             mfaEnabled: true,
-            token,
+            token
           });
         }
 
         await checkUserDevice({
           user,
           ip: req.realIP,
-          userAgent: req.headers["user-agent"] ?? "",
+          userAgent: req.headers["user-agent"] ?? ""
         });
 
         // issue tokens
-        const tokens = await issueAuthTokens({ 
+        const tokens = await issueAuthTokens({
           userId: user._id,
           ip: req.realIP,
-          userAgent: req.headers["user-agent"] ?? "",
+          userAgent: req.headers["user-agent"] ?? ""
         });
 
         // store (refresh) token in httpOnly cookie
@@ -156,7 +154,7 @@ export const login2 = async (req: Request, res: Response) => {
           httpOnly: true,
           path: "/",
           sameSite: "strict",
-          secure: await getHttpsEnabled(),
+          secure: await getHttpsEnabled()
         });
 
         // case: user does not have MFA enabled
@@ -182,36 +180,33 @@ export const login2 = async (req: Request, res: Response) => {
           publicKey: user.publicKey,
           encryptedPrivateKey: user.encryptedPrivateKey,
           iv: user.iv,
-          tag: user.tag,
-        }
+          tag: user.tag
+        };
 
-        if (
-          user?.protectedKey &&
-          user?.protectedKeyIV &&
-          user?.protectedKeyTag
-        ) {
+        if (user?.protectedKey && user?.protectedKeyIV && user?.protectedKeyTag) {
           response.protectedKey = user.protectedKey;
-          response.protectedKeyIV = user.protectedKeyIV
+          response.protectedKeyIV = user.protectedKeyIV;
           response.protectedKeyTag = user.protectedKeyTag;
         }
 
         const loginAction = await EELogService.createAction({
           name: ACTION_LOGIN,
-          userId: user._id,
+          userId: user._id
         });
 
-        loginAction && await EELogService.createLog({
-          userId: user._id,
-          actions: [loginAction],
-          channel: getChannelFromUserAgent(req.headers["user-agent"]),
-          ipAddress: req.ip,
-        });
+        loginAction &&
+          (await EELogService.createLog({
+            userId: user._id,
+            actions: [loginAction],
+            channel: getUserAgentType(req.headers["user-agent"]),
+            ipAddress: req.ip
+          }));
 
         return res.status(200).send(response);
       }
 
       return res.status(400).send({
-        message: "Failed to authenticate. Try again?",
+        message: "Failed to authenticate. Try again?"
       });
     }
   );
@@ -219,15 +214,17 @@ export const login2 = async (req: Request, res: Response) => {
 
 /**
  * Send MFA token to email [email]
- * @param req 
- * @param res 
+ * @param req
+ * @param res
  */
 export const sendMfaToken = async (req: Request, res: Response) => {
-  const { email } = req.body;
+  const {
+    body: { email }
+  } = await validateRequest(reqValidator.SendMfaTokenV2, req);
 
   const code = await TokenService.createToken({
     type: TOKEN_EMAIL_MFA,
-    email,
+    email
   });
 
   // send MFA code [code] to [email]
@@ -236,49 +233,53 @@ export const sendMfaToken = async (req: Request, res: Response) => {
     subjectLine: "Infisical MFA code",
     recipients: [email],
     substitutions: {
-      code,
-    },
+      code
+    }
   });
 
   return res.status(200).send({
-    message: "Successfully sent new MFA code",
+    message: "Successfully sent new MFA code"
   });
-}
+};
 
 /**
  * Verify MFA token [mfaToken] and issue JWT and refresh tokens if the
  * MFA token [mfaToken] is valid
- * @param req 
- * @param res 
+ * @param req
+ * @param res
  */
 export const verifyMfaToken = async (req: Request, res: Response) => {
-  const { email, mfaToken } = req.body;
+  const {
+    body: { email, mfaToken }
+  } = await validateRequest(reqValidator.VerifyMfaTokenV2, req);
 
   await TokenService.validateToken({
     type: TOKEN_EMAIL_MFA,
     email,
-    token: mfaToken,
+    token: mfaToken
   });
 
   const user = await User.findOne({
-    email,
-  }).select("+salt +verifier +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag +publicKey +encryptedPrivateKey +iv +tag +devices");
+    email
+  }).select(
+    "+salt +verifier +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag +publicKey +encryptedPrivateKey +iv +tag +devices"
+  );
 
   if (!user) throw new Error("Failed to find user");
 
-  await LoginSRPDetail.deleteOne({ userId: user.id })
+  await LoginSRPDetail.deleteOne({ userId: user.id });
 
   await checkUserDevice({
     user,
     ip: req.realIP,
-    userAgent: req.headers["user-agent"] ?? "",
+    userAgent: req.headers["user-agent"] ?? ""
   });
 
   // issue tokens
-  const tokens = await issueAuthTokens({ 
+  const tokens = await issueAuthTokens({
     userId: user._id,
     ip: req.realIP,
-    userAgent: req.headers["user-agent"] ?? "",
+    userAgent: req.headers["user-agent"] ?? ""
   });
 
   // store (refresh) token in httpOnly cookie
@@ -286,7 +287,7 @@ export const verifyMfaToken = async (req: Request, res: Response) => {
     httpOnly: true,
     path: "/",
     sameSite: "strict",
-    secure: await getHttpsEnabled(),
+    secure: await getHttpsEnabled()
   });
 
   interface VerifyMfaTokenRes {
@@ -319,8 +320,8 @@ export const verifyMfaToken = async (req: Request, res: Response) => {
     publicKey: user.publicKey as string,
     encryptedPrivateKey: user.encryptedPrivateKey as string,
     iv: user.iv as string,
-    tag: user.tag as string,
-  }
+    tag: user.tag as string
+  };
 
   if (user?.protectedKey && user?.protectedKeyIV && user?.protectedKeyTag) {
     resObj.protectedKey = user.protectedKey;
@@ -330,15 +331,16 @@ export const verifyMfaToken = async (req: Request, res: Response) => {
 
   const loginAction = await EELogService.createAction({
     name: ACTION_LOGIN,
-    userId: user._id,
+    userId: user._id
   });
 
-  loginAction && await EELogService.createLog({
-    userId: user._id,
-    actions: [loginAction],
-    channel: getChannelFromUserAgent(req.headers["user-agent"]),
-    ipAddress: req.realIP,
-  });
+  loginAction &&
+    (await EELogService.createLog({
+      userId: user._id,
+      actions: [loginAction],
+      channel: getUserAgentType(req.headers["user-agent"]),
+      ipAddress: req.realIP
+    }));
 
   return res.status(200).send(resObj);
-}
+};

backend/src/controllers/v2/environmentController.ts

@@ -1,36 +1,136 @@
 import { Request, Response } from "express";
+import { Types } from "mongoose";
 import {
   Integration,
   Membership,
   Secret,
   ServiceToken,
   ServiceTokenData,
-  Workspace,
+  Workspace
 } from "../../models";
-import { SecretVersion } from "../../ee/models";
-import { EELicenseService } from "../../ee/services";
+import { EventType, SecretVersion } from "../../ee/models";
+import { EEAuditLogService, EELicenseService } from "../../ee/services";
 import { BadRequestError, WorkspaceNotFoundError } from "../../utils/errors";
 import _ from "lodash";
 import { PERMISSION_READ_SECRETS, PERMISSION_WRITE_SECRETS } from "../../variables";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/environments";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../ee/services/ProjectRoleService";
+import { ForbiddenError } from "@casl/ability";
 
 /**
- * Create new workspace environment named [environmentName] under workspace with id
+ * Create new workspace environment named [environmentName] 
+ * with slug [environmentSlug] under workspace with id
  * @param req
  * @param res
  * @returns
  */
-export const createWorkspaceEnvironment = async (
-  req: Request,
-  res: Response
-) => {
+export const createWorkspaceEnvironment = async (req: Request, res: Response) => {
+  /* 
+    #swagger.summary = 'Create environment'
+    #swagger.description = 'Create environment'
+    
+    #swagger.security = [{
+        "apiKeyAuth": []
+    }]
+
+	#swagger.parameters['workspaceId'] = {
+		"description": "ID of project",
+		"required": true,
+		"type": "string"
+	} 
+
+  /* 
+    #swagger.summary = 'Create environment'
+    #swagger.description = 'Create environment'
+    
+    #swagger.security = [{
+        "apiKeyAuth": []
+    }]
+
+	#swagger.parameters['workspaceId'] = {
+		"description": "ID of project",
+		"required": true,
+		"type": "string"
+	} 
+
+  #swagger.requestBody = {
+      content: {
+          "application/json": {
+              "schema": {
+                  "type": "object",
+                  "properties": {
+                      "environmentName": {
+                          "type": "string",
+                          "description": "Name of the environment",
+                          "example": "development"
+                      },
+                      "environmentSlug": {
+                          "type": "string",
+                          "description": "Slug of the environment",
+                          "example": "dev-environment"
+                      }
+                  },
+                  "required": ["environmentName", "environmentSlug"]
+              }
+          }
+      }
+  }
+
+  #swagger.responses[200] = {
+      content: {
+          "application/json": {
+              "schema": { 
+                  "type": "object",
+                  "properties": {
+                      "message": {
+                          "type": "string",
+                          "example": "Successfully created new environment"
+                      },
+                      "workspace": {
+                          "type": "string",
+                          "example": "someWorkspaceId"
+                      },
+                      "environment": {
+                          "type": "object",
+                          "properties": {
+                              "name": {
+                                  "type": "string",
+                                  "example": "someEnvironmentName"
+                              },
+                              "slug": {
+                                  "type": "string",
+                                  "example": "someEnvironmentSlug"
+                              }
+                          }
+                      }
+                  },
+                  "description": "Response after creating a new environment"
+              }
+          }           
+      }
+  }
+  */
+  const {
+    params: { workspaceId },
+    body: { environmentName, environmentSlug }
+  } = await validateRequest(reqValidator.CreateWorkspaceEnvironmentV2, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Create,
+    ProjectPermissionSub.Environments
+  );
 
-  const { workspaceId } = req.params;
-  const { environmentName, environmentSlug } = req.body;
   const workspace = await Workspace.findById(workspaceId).exec();
 
   if (!workspace) throw WorkspaceNotFoundError();
 
-  const plan = await EELicenseService.getPlan(workspace.organization.toString());
+  const plan = await EELicenseService.getPlan(workspace.organization);
 
   if (plan.environmentLimit !== null) {
     // case: limit imposed on number of environments allowed
@@ -38,7 +138,8 @@ export const createWorkspaceEnvironment = async (
       // case: number of environments used exceeds the number of environments allowed
 
       return res.status(400).send({
-        message: "Failed to create environment due to environment limit reached. Upgrade plan to create more environments.",
+        message:
+          "Failed to create environment due to environment limit reached. Upgrade plan to create more environments."
       });
     }
   }
@@ -54,19 +155,82 @@ export const createWorkspaceEnvironment = async (
 
   workspace?.environments.push({
     name: environmentName,
-    slug: environmentSlug.toLowerCase(),
+    slug: environmentSlug.toLowerCase()
   });
   await workspace.save();
 
-  await EELicenseService.refreshPlan(workspace.organization.toString(), workspaceId);
+  await EELicenseService.refreshPlan(workspace.organization, new Types.ObjectId(workspaceId));
+
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.CREATE_ENVIRONMENT,
+      metadata: {
+        name: environmentName,
+        slug: environmentSlug
+      }
+    },
+    {
+      workspaceId: workspace._id
+    }
+  );
 
   return res.status(200).send({
     message: "Successfully created new environment",
     workspace: workspaceId,
     environment: {
       name: environmentName,
-      slug: environmentSlug,
-    },
+      slug: environmentSlug
+    }
+  });
+};
+
+/**
+ * Swaps the ordering of two environments in the database. This is purely for aesthetic purposes.
+ * @param req
+ * @param res
+ * @returns
+ */
+export const reorderWorkspaceEnvironments = async (req: Request, res: Response) => {
+  const {
+    params: { workspaceId },
+    body: { environmentName, environmentSlug, otherEnvironmentSlug, otherEnvironmentName }
+  } = await validateRequest(reqValidator.ReorderWorkspaceEnvironmentsV2, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Edit,
+    ProjectPermissionSub.Environments
+  );
+
+  // atomic update the env to avoid conflict
+  const workspace = await Workspace.findById(workspaceId).exec();
+  if (!workspace) {
+    throw BadRequestError({ message: "Couldn't load workspace" });
+  }
+
+  const environmentIndex = workspace.environments.findIndex(
+    (env) => env.name === environmentName && env.slug === environmentSlug
+  );
+  const otherEnvironmentIndex = workspace.environments.findIndex(
+    (env) => env.name === otherEnvironmentName && env.slug === otherEnvironmentSlug
+  );
+
+  if (environmentIndex === -1 || otherEnvironmentIndex === -1) {
+    throw BadRequestError({ message: "environment or otherEnvironment couldn't be found" });
+  }
+
+  // swap the order of the environments
+  [workspace.environments[environmentIndex], workspace.environments[otherEnvironmentIndex]] = [
+    workspace.environments[otherEnvironmentIndex],
+    workspace.environments[environmentIndex]
+  ];
+
+  await workspace.save();
+
+  return res.status(200).send({
+    message: "Successfully reordered environments",
+    workspace: workspaceId
   });
 };
 
@@ -77,12 +241,91 @@ export const createWorkspaceEnvironment = async (
  * @param res
  * @returns
  */
-export const renameWorkspaceEnvironment = async (
-  req: Request,
-  res: Response
-) => {
-  const { workspaceId } = req.params;
-  const { environmentName, environmentSlug, oldEnvironmentSlug } = req.body;
+export const renameWorkspaceEnvironment = async (req: Request, res: Response) => {
+  /* 
+    #swagger.summary = 'Rename workspace environment'
+    #swagger.description = 'Rename a specific environment within a workspace'
+
+    #swagger.parameters['workspaceId'] = {
+    "description": "ID of the workspace",
+    "required": true,
+    "type": "string",
+        "in": "path"
+  }
+
+    #swagger.requestBody = {
+        content: {
+            "application/json": {
+                "schema": {
+                    "type": "object",
+                    "properties": {
+                        "environmentName": {
+                            "type": "string",
+                            "description": "New name for the environment",
+                            "example": "Staging-Renamed"
+                        },
+                        "environmentSlug": {
+                            "type": "string",
+                            "description": "New slug for the environment",
+                            "example": "staging-renamed"
+                        },
+                        "oldEnvironmentSlug": {
+                            "type": "string",
+                            "description": "Current slug of the environment to rename",
+                            "example": "staging-old"
+                        }
+                    },
+                    "required": ["environmentName", "environmentSlug", "oldEnvironmentSlug"]
+                }
+            }
+        }
+    }
+
+    #swagger.responses[200] = {
+        content: {
+            "application/json": {
+                "schema": {
+                    "type": "object",
+                    "properties": {
+                        "message": {
+                            "type": "string",
+                            "example": "Successfully update environment"
+                        },
+                        "workspace": {
+                            "type": "string",
+                            "example": "someWorkspaceId"
+                        },
+                        "environment": {
+                            "type": "object",
+                            "properties": {
+                                "name": {
+                                    "type": "string",
+                                    "example": "Staging-Renamed"
+                                },
+                                "slug": {
+                                    "type": "string",
+                                    "example": "staging-renamed"
+                                }
+                            }
+                        }
+                    },
+                    "description": "Details of the renamed environment"
+                }
+            }
+        }
+    }   
+  */
+  const {
+    params: { workspaceId },
+    body: { environmentName, environmentSlug, oldEnvironmentSlug }
+  } = await validateRequest(reqValidator.UpdateWorkspaceEnvironmentV2, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Edit,
+    ProjectPermissionSub.Environments
+  );
+
   // user should pass both new slug and env name
   if (!environmentSlug || !environmentName) {
     throw new Error("Invalid environment given.");
@@ -96,20 +339,19 @@ export const renameWorkspaceEnvironment = async (
 
   const isEnvExist = workspace.environments.some(
     ({ name, slug }) =>
-      slug !== oldEnvironmentSlug &&
-      (name === environmentName || slug === environmentSlug)
+      slug !== oldEnvironmentSlug && (name === environmentName || slug === environmentSlug)
   );
   if (isEnvExist) {
     throw new Error("Invalid environment given");
   }
 
-  const envIndex = workspace?.environments.findIndex(
-    ({ slug }) => slug === oldEnvironmentSlug
-  );
+  const envIndex = workspace?.environments.findIndex(({ slug }) => slug === oldEnvironmentSlug);
   if (envIndex === -1) {
     throw new Error("Invalid environment given");
   }
 
+  const oldEnvironment = workspace.environments[envIndex];
+
   workspace.environments[envIndex].name = environmentName;
   workspace.environments[envIndex].slug = environmentSlug.toLowerCase();
 
@@ -137,20 +379,35 @@ export const renameWorkspaceEnvironment = async (
   await Membership.updateMany(
     {
       workspace: workspaceId,
-      "deniedPermissions.environmentSlug": oldEnvironmentSlug,
+      "deniedPermissions.environmentSlug": oldEnvironmentSlug
     },
     { $set: { "deniedPermissions.$[element].environmentSlug": environmentSlug } },
     { arrayFilters: [{ "element.environmentSlug": oldEnvironmentSlug }] }
-  )
+  );
 
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.UPDATE_ENVIRONMENT,
+      metadata: {
+        oldName: oldEnvironment.name,
+        newName: environmentName,
+        oldSlug: oldEnvironment.slug,
+        newSlug: environmentSlug.toLowerCase()
+      }
+    },
+    {
+      workspaceId: workspace._id
+    }
+  );
 
   return res.status(200).send({
     message: "Successfully update environment",
     workspace: workspaceId,
     environment: {
       name: environmentName,
-      slug: environmentSlug,
-    },
+      slug: environmentSlug
+    }
   });
 };
 
@@ -160,36 +417,100 @@ export const renameWorkspaceEnvironment = async (
  * @param res
  * @returns
  */
-export const deleteWorkspaceEnvironment = async (
-  req: Request,
-  res: Response
-) => {
-  const { workspaceId } = req.params;
-  const { environmentSlug } = req.body;
+export const deleteWorkspaceEnvironment = async (req: Request, res: Response) => {
+  /* 
+    #swagger.summary = 'Delete workspace environment'
+    #swagger.description = 'Delete a specific environment from a workspace'
+    
+    #swagger.security = [{
+        "apiKeyAuth": []
+    }]
+
+    #swagger.parameters['workspaceId'] = {
+		"description": "ID of the workspace",
+		"required": true,
+		"type": "string",
+        "in": "path"
+	}
+
+    #swagger.requestBody = {
+        content: {
+            "application/json": {
+                "schema": {
+                    "type": "object",
+                    "properties": {
+                        "environmentSlug": {
+                            "type": "string",
+                            "description": "Slug of the environment to delete",
+                            "example": "dev-environment"
+                        }
+                    },
+                    "required": ["environmentSlug"]
+                }
+            }
+        }
+    }
+
+    #swagger.responses[200] = {
+        content: {
+            "application/json": {
+                "schema": { 
+                    "type": "object",
+                    "properties": {
+                        "message": {
+                            "type": "string",
+                            "example": "Successfully deleted environment"
+                        },
+                        "workspace": {
+                            "type": "string",
+                            "example": "someWorkspaceId"
+                        },
+                        "environment": {
+                            "type": "string",
+                            "example": "dev-environment"
+                        }
+                    },
+                    "description": "Response after deleting an environment from a workspace"
+                }
+            }           
+        }
+    }   
+*/
+  const {
+    params: { workspaceId },
+    body: { environmentSlug }
+  } = await validateRequest(reqValidator.DeleteWorkspaceEnvironmentV2, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Delete,
+    ProjectPermissionSub.Environments
+  );
+
   // atomic update the env to avoid conflict
   const workspace = await Workspace.findById(workspaceId).exec();
   if (!workspace) {
     throw new Error("Failed to create workspace environment");
   }
 
-  const envIndex = workspace?.environments.findIndex(
-    ({ slug }) => slug === environmentSlug
-  );
+  const envIndex = workspace?.environments.findIndex(({ slug }) => slug === environmentSlug);
   if (envIndex === -1) {
     throw new Error("Invalid environment given");
   }
 
+  const oldEnvironment = workspace.environments[envIndex];
+
   workspace.environments.splice(envIndex, 1);
   await workspace.save();
 
   // clean up
   await Secret.deleteMany({
     workspace: workspaceId,
-    environment: environmentSlug,
+    environment: environmentSlug
   });
   await SecretVersion.deleteMany({
     workspace: workspaceId,
-    environment: environmentSlug,
+    environment: environmentSlug
   });
 
   // await ServiceToken.deleteMany({
@@ -208,58 +529,126 @@ export const deleteWorkspaceEnvironment = async (
 
   await Integration.deleteMany({
     workspace: workspaceId,
-    environment: environmentSlug,
+    environment: environmentSlug
   });
   await Membership.updateMany(
     { workspace: workspaceId },
     { $pull: { deniedPermissions: { environmentSlug: environmentSlug } } }
   );
 
-  await EELicenseService.refreshPlan(workspace.organization.toString(), workspaceId);
+  await EELicenseService.refreshPlan(workspace.organization, new Types.ObjectId(workspaceId));
+
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.DELETE_ENVIRONMENT,
+      metadata: {
+        name: oldEnvironment.name,
+        slug: oldEnvironment.slug
+      }
+    },
+    {
+      workspaceId: workspace._id
+    }
+  );
 
   return res.status(200).send({
     message: "Successfully deleted environment",
     workspace: workspaceId,
-    environment: environmentSlug,
+    environment: environmentSlug
   });
 };
 
+// TODO(akhilmhdh) after rbac this can be completely removed
+export const getAllAccessibleEnvironmentsOfWorkspace = async (req: Request, res: Response) => {
+  /* 
+    #swagger.summary = 'Get all accessible environments of a workspace'
+    #swagger.description = 'Fetch all environments that the user has access to in a specified workspace'
+    
+    #swagger.security = [{
+        "apiKeyAuth": []
+    }]
 
-export const getAllAccessibleEnvironmentsOfWorkspace = async (
-  req: Request,
-  res: Response
-) => {
-  const { workspaceId } = req.params;
-  const workspacesUserIsMemberOf = await Membership.findOne({
-    workspace: workspaceId,
-    user: req.user,
-  })
+    #swagger.parameters['workspaceId'] = {
+		"description": "ID of the workspace",
+		"required": true,
+		"type": "string",
+        "in": "path"
+	}
 
-  if (!workspacesUserIsMemberOf) {
-    throw BadRequestError()
-  }
+    #swagger.responses[200] = {
+        content: {
+            "application/json": {
+                "schema": {
+                    "type": "object",
+                    "properties": {
+                        "accessibleEnvironments": {
+                            "type": "array",
+                            "items": {
+                                "type": "object",
+                                "properties": {
+                                    "name": {
+                                        "type": "string",
+                                        "example": "Development"
+                                    },
+                                    "slug": {
+                                        "type": "string",
+                                        "example": "development"
+                                    },
+                                    "isWriteDenied": {
+                                        "type": "boolean",
+                                        "example": false
+                                    },
+                                    "isReadDenied": {
+                                        "type": "boolean",
+                                        "example": false
+                                    }
+                                }
+                            }
+                        }
+                    },
+                    "description": "List of environments the user has access to in the specified workspace"
+                }
+            }
+        }
+    }   
+  */
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetAllAccessibileEnvironmentsOfWorkspaceV2, req);
 
-  const accessibleEnvironments: any = []
-  const deniedPermission = workspacesUserIsMemberOf.deniedPermissions
+  const { membership: workspacesUserIsMemberOf } = await getUserProjectPermissions(
+    req.user._id,
+    workspaceId
+  );
 
-  const relatedWorkspace = await Workspace.findById(workspaceId)
+  const accessibleEnvironments: any = [];
+  const deniedPermission = workspacesUserIsMemberOf.deniedPermissions;
+
+  const relatedWorkspace = await Workspace.findById(workspaceId);
   if (!relatedWorkspace) {
-    throw BadRequestError()
+    throw BadRequestError();
   }
-  relatedWorkspace.environments.forEach(environment => {
-    const isReadBlocked = _.some(deniedPermission, { environmentSlug: environment.slug, ability: PERMISSION_READ_SECRETS })
-    const isWriteBlocked = _.some(deniedPermission, { environmentSlug: environment.slug, ability: PERMISSION_WRITE_SECRETS })
+  relatedWorkspace.environments.forEach((environment) => {
+    const isReadBlocked = _.some(deniedPermission, {
+      environmentSlug: environment.slug,
+      ability: PERMISSION_READ_SECRETS
+    });
+    const isWriteBlocked = _.some(deniedPermission, {
+      environmentSlug: environment.slug,
+      ability: PERMISSION_WRITE_SECRETS
+    });
     if (isReadBlocked && isWriteBlocked) {
-      return
+      return;
     } else {
       accessibleEnvironments.push({
         name: environment.name,
         slug: environment.slug,
         isWriteDenied: isWriteBlocked,
-        isReadDenied: isReadBlocked,
-      })
+        isReadDenied: isReadBlocked
+      });
     }
-  })
+  });
 
-  res.json({ accessibleEnvironments })
+  res.json({ accessibleEnvironments });
 };

backend/src/controllers/v2/organizationsController.ts

@@ -1,21 +1,27 @@
 import { Request, Response } from "express";
 import { Types } from "mongoose";
-import { 
-    Membership,
-    MembershipOrg,
-    ServiceAccount,
-    Workspace,
-} from "../../models";
+import { Membership, MembershipOrg, ServiceAccount, Workspace } from "../../models";
 import { deleteMembershipOrg } from "../../helpers/membershipOrg";
 import { updateSubscriptionOrgQuantity } from "../../helpers/organization";
+import Role from "../../ee/models/role";
+import { BadRequestError } from "../../utils/errors";
+import { CUSTOM } from "../../variables";
+import * as reqValidator from "../../validation/organization";
+import { validateRequest } from "../../helpers/validation";
+import {
+  OrgPermissionActions,
+  OrgPermissionSubjects,
+  getUserOrgPermissions
+} from "../../ee/services/RoleService";
+import { ForbiddenError } from "@casl/ability";
 
 /**
  * Return memberships for organization with id [organizationId]
- * @param req 
- * @param res 
+ * @param req
+ * @param res
  */
 export const getOrganizationMemberships = async (req: Request, res: Response) => {
-    /* 
+  /* 
     #swagger.summary = 'Return organization memberships'
     #swagger.description = 'Return organization memberships'
     
@@ -48,24 +54,32 @@ export const getOrganizationMemberships = async (req: Request, res: Response) =>
         }
     }   
     */
-    const { organizationId } = req.params;
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgMembersv2, req);
 
-		const memberships = await MembershipOrg.find({
-			organization: organizationId,
-		}).populate("user", "+publicKey");
-    
-    return res.status(200).send({
-        memberships,
-    });
-}
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Read,
+    OrgPermissionSubjects.Member
+  );
+
+  const memberships = await MembershipOrg.find({
+    organization: organizationId
+  }).populate("user", "+publicKey");
+
+  return res.status(200).send({
+    memberships
+  });
+};
 
 /**
  * Update role of membership with id [membershipId] to role [role]
- * @param req 
- * @param res 
+ * @param req
+ * @param res
  */
 export const updateOrganizationMembership = async (req: Request, res: Response) => {
-    /* 
+  /* 
     #swagger.summary = 'Update organization membership'
     #swagger.description = 'Update organization membership'
     
@@ -118,31 +132,58 @@ export const updateOrganizationMembership = async (req: Request, res: Response)
         }
     }   
     */
-    const { membershipId } = req.params;
-    const { role } = req.body;
-    
-    const membership = await MembershipOrg.findByIdAndUpdate(
-        membershipId,
-        {
-            role,
-        }, {
-            new: true,
-        }
-    );
-    
-    return res.status(200).send({
-        membership,
+  const {
+    params: { organizationId, membershipId },
+    body: { role }
+  } = await validateRequest(reqValidator.UpdateOrgMemberv2, req);
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Edit,
+    OrgPermissionSubjects.Member
+  );
+
+  const isCustomRole = !["admin", "member", "owner"].includes(role);
+  if (isCustomRole) {
+    const orgRole = await Role.findOne({ slug: role, isOrgRole: true });
+    if (!orgRole) throw BadRequestError({ message: "Role not found" });
+
+    const membership = await MembershipOrg.findByIdAndUpdate(membershipId, {
+      role: CUSTOM,
+      customRole: orgRole
     });
-}
+    return res.status(200).send({
+      membership
+    });
+  }
+
+  const membership = await MembershipOrg.findByIdAndUpdate(
+    membershipId,
+    {
+      $set: {
+        role
+      },
+      $unset: {
+        customRole: 1
+      }
+    },
+    {
+      new: true
+    }
+  );
+
+  return res.status(200).send({
+    membership
+  });
+};
 
 /**
  * Delete organization membership with id [membershipId]
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const deleteOrganizationMembership = async (req: Request, res: Response) => {
-    /* 
+  /* 
     #swagger.summary = 'Delete organization membership'
     #swagger.description = 'Delete organization membership'
     
@@ -178,30 +219,37 @@ export const deleteOrganizationMembership = async (req: Request, res: Response)
         }
     }   
     */
-    const { membershipId } = req.params;
-    
-    // delete organization membership
-    const membership = await deleteMembershipOrg({
-        membershipOrgId: membershipId,
-    });
+  const {
+    params: { organizationId, membershipId }
+  } = await validateRequest(reqValidator.DeleteOrgMemberv2, req);
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Delete,
+    OrgPermissionSubjects.Member
+  );
 
-    await updateSubscriptionOrgQuantity({
-			organizationId: membership.organization.toString(),
-		});
+  // delete organization membership
+  const membership = await deleteMembershipOrg({
+    membershipOrgId: membershipId
+  });
 
-    return res.status(200).send({
-        membership,
-    });
-}
+  await updateSubscriptionOrgQuantity({
+    organizationId: membership.organization.toString()
+  });
+
+  return res.status(200).send({
+    membership
+  });
+};
 
 /**
  * Return workspaces for organization with id [organizationId] that user has
  * access to
- * @param req 
- * @param res 
+ * @param req
+ * @param res
  */
 export const getOrganizationWorkspaces = async (req: Request, res: Response) => {
-    /* 
+  /* 
     #swagger.summary = 'Return projects in organization that user is part of'
     #swagger.description = 'Return projects in organization that user is part of'
     
@@ -234,45 +282,53 @@ export const getOrganizationWorkspaces = async (req: Request, res: Response) =>
         }
     }   
     */
-    const { organizationId } = req.params;
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgWorkspacesv2, req);
 
-    const workspacesSet = new Set(
-        (
-            await Workspace.find(
-                {
-                    organization: organizationId,
-                },
-                "_id"
-            )
-        ).map((w) => w._id.toString())
-    );
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Read,
+    OrgPermissionSubjects.Workspace
+  );
 
-    const workspaces = (
-        await Membership.find({
-            user: req.user._id,
-        }).populate("workspace")
-    )
+  const workspacesSet = new Set(
+    (
+      await Workspace.find(
+        {
+          organization: organizationId
+        },
+        "_id"
+      )
+    ).map((w) => w._id.toString())
+  );
+
+  const workspaces = (
+    await Membership.find({
+      user: req.user._id
+    }).populate("workspace")
+  )
     .filter((m) => workspacesSet.has(m.workspace._id.toString()))
     .map((m) => m.workspace);
 
-return res.status(200).send({
-        workspaces,
-    });
-}
+  return res.status(200).send({
+    workspaces
+  });
+};
 
 /**
  * Return service accounts for organization with id [organizationId]
- * @param req 
- * @param res 
+ * @param req
+ * @param res
  */
 export const getOrganizationServiceAccounts = async (req: Request, res: Response) => {
-    const { organizationId } = req.params;
-    
-    const serviceAccounts = await ServiceAccount.find({
-        organization: new Types.ObjectId(organizationId),
-    });
-    
-    return res.status(200).send({
-        serviceAccounts,
-    });
-}
+  const { organizationId } = req.params;
+
+  const serviceAccounts = await ServiceAccount.find({
+    organization: new Types.ObjectId(organizationId)
+  });
+
+  return res.status(200).send({
+    serviceAccounts
+  });
+};

backend/src/controllers/v2/secretController.ts

@@ -1,6 +1,5 @@
 import { Request, Response } from "express";
 import mongoose, { Types } from "mongoose";
-import Secret, { ISecret } from "../../models/secret";
 import {
   CreateSecretRequestBody,
   ModifySecretRequestBody,
@@ -20,7 +19,7 @@ import {
   SECRET_SHARED
 } from "../../variables";
 import { TelemetryService } from "../../services";
-import { User } from "../../models";
+import { ISecret, Secret, User } from "../../models";
 import { AccountNotFoundError } from "../../utils/errors";
 
 /**
@@ -309,16 +308,16 @@ export const updateSecret = async (req: Request, res: Response) => {
     { _id: secretModificationsRequested._id, workspace: workspaceId },
     { $inc: { version: 1 }, $set: sanitizedSecret }
   )
-  .catch((error) => {
-    if (error instanceof ValidationError) {
-      throw RouteValidationError({
-        message: "Unable to apply modifications, please try again",
-        stack: error.stack
-      });
-    }
+    .catch((error) => {
+      if (error instanceof ValidationError) {
+        throw RouteValidationError({
+          message: "Unable to apply modifications, please try again",
+          stack: error.stack
+        });
+      }
 
-    throw error;
-  });
+      throw error;
+    });
 
   if (postHogClient) {
     postHogClient.capture({
@@ -370,12 +369,12 @@ export const getSecrets = async (req: Request, res: Response) => {
     $or: [{ user: userId }, { user: { $exists: false } }],
     type: { $in: [SECRET_SHARED, SECRET_PERSONAL] }
   })
-  .catch((err) => {
-    throw RouteValidationError({
-      message: "Failed to get secrets, please try again",
-      stack: err.stack
-    });
-  })
+    .catch((err) => {
+      throw RouteValidationError({
+        message: "Failed to get secrets, please try again",
+        stack: err.stack
+      });
+    })
 
   if (postHogClient) {
     postHogClient.capture({

backend/src/controllers/v2/secretsController.ts

@@ -1,7 +1,7 @@
 import { Types } from "mongoose";
 import { Request, Response } from "express";
-import { ISecret, Secret, ServiceTokenData } from "../../models";
-import { IAction, SecretVersion } from "../../ee/models";
+import { Folder, ISecret, Secret, ServiceTokenData, Tag } from "../../models";
+import { AuditLog, EventType, IAction, SecretVersion } from "../../ee/models";
 import {
   ACTION_ADD_SECRETS,
   ACTION_DELETE_SECRETS,
@@ -9,24 +9,22 @@ import {
   ACTION_UPDATE_SECRETS,
   ALGORITHM_AES_256_GCM,
   ENCODING_SCHEME_UTF8,
+  K8_USER_AGENT_NAME,
   SECRET_PERSONAL
 } from "../../variables";
 import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
 import { EventService } from "../../services";
 import { eventPushSecrets } from "../../events";
-import { EELogService, EESecretService } from "../../ee/services";
+import { EEAuditLogService, EELogService, EESecretService } from "../../ee/services";
 import { SecretService, TelemetryService } from "../../services";
-import { getChannelFromUserAgent } from "../../utils/posthog";
+import { getUserAgentType } from "../../utils/posthog";
 import { PERMISSION_WRITE_SECRETS } from "../../variables";
 import {
   userHasNoAbility,
   userHasWorkspaceAccess,
   userHasWriteOnlyAbility
 } from "../../ee/helpers/checkMembershipPermissions";
-import Tag from "../../models/tag";
 import _ from "lodash";
-import { BatchSecret, BatchSecretRequest } from "../../types/secret";
-import Folder from "../../models/folder";
 import {
   getFolderByPath,
   getFolderIdFromServiceToken,
@@ -36,6 +34,18 @@ import {
 import { isValidScope } from "../../helpers/secrets";
 import path from "path";
 import { getAllImportedSecrets } from "../../services/SecretImportService";
+import { validateRequest } from "../../helpers/validation";
+import {
+  BatchSecretsV2,
+  GetSecretsV2,
+  validateServiceTokenDataClientForWorkspace
+} from "../../validation";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../ee/services/ProjectRoleService";
+import { ForbiddenError, subject } from "@casl/ability";
 
 /**
  * Peform a batch of any specified CUD secret operations
@@ -44,24 +54,34 @@ import { getAllImportedSecrets } from "../../services/SecretImportService";
  * @param res
  */
 export const batchSecrets = async (req: Request, res: Response) => {
-  const channel = getChannelFromUserAgent(req.headers["user-agent"]);
+  const channel = getUserAgentType(req.headers["user-agent"]);
   const postHogClient = await TelemetryService.getPostHogClient();
 
+  const validatedData = await validateRequest(BatchSecretsV2, req);
   const {
-    workspaceId,
-    environment,
-    requests
-  }: {
-    workspaceId: string;
-    environment: string;
-    requests: BatchSecretRequest[];
-  } = req.body;
-  let secretPath = req.body.secretPath as string;
-  let folderId = req.body.folderId as string;
+    body: { workspaceId, environment, requests }
+  } = validatedData;
+  let {
+    body: { secretPath, folderId }
+  } = validatedData;
 
-  const createSecrets: BatchSecret[] = [];
-  const updateSecrets: BatchSecret[] = [];
-  const deleteSecrets: Types.ObjectId[] = [];
+  const secretIds = requests
+    .filter(({ method }) => method !== "POST")
+    // akhilmhdh: ts is dumb
+    .map((el) => new Types.ObjectId((el.secret as any)._id));
+
+  const oldSecrets = await Secret.find({
+    _id: {
+      $in: secretIds
+    }
+  });
+  if (oldSecrets.length != secretIds.length) {
+    throw BadRequestError({ message: "Failed to validate non-existent secrets" });
+  }
+
+  const createSecrets: any[] = [];
+  const updateSecrets: any[] = [];
+  const deleteSecrets: { _id: Types.ObjectId; secretName: string }[] = [];
   const actions: IAction[] = [];
 
   // get secret blind index salt
@@ -69,31 +89,33 @@ export const batchSecrets = async (req: Request, res: Response) => {
     workspaceId: new Types.ObjectId(workspaceId)
   });
 
-  const folders = await Folder.findOne({ workspace: workspaceId, environment });
-
-  if (req.authData.authPayload instanceof ServiceTokenData) {
-    const isValidScopeAccess = isValidScope(req.authData.authPayload, environment, secretPath);
-
-    // in service token when not giving secretpath folderid must be root
-    // this is to avoid giving folderid when service tokens are used
-    if ((!secretPath && folderId !== "root") || (secretPath && !isValidScopeAccess)) {
-      throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
-    }
-  }
-
-  if (secretPath) {
+  if (secretPath !== "/") {
     folderId = await getFolderIdFromServiceToken(workspaceId, environment, secretPath);
   }
 
-  if (folders && folderId !== "root") {
+  if (folderId !== "root") {
+    const folders = await Folder.findOne({ workspace: workspaceId, environment });
+    if (!folders) throw BadRequestError({ message: "Folder not found" });
+
     const folder = searchByFolderIdWithDir(folders.nodes, folderId as string);
     if (!folder?.folder) throw BadRequestError({ message: "Folder not found" });
+
     secretPath = path.join(
       "/",
       ...folder.dir.map(({ name }) => name).filter((name) => name !== "root")
     );
   }
 
+  if (req.authData.authPayload instanceof ServiceTokenData) {
+    await validateServiceTokenDataClientForWorkspace({
+      serviceTokenData: req.authData.authPayload,
+      workspaceId: new Types.ObjectId(workspaceId),
+      environment,
+      secretPath,
+      requiredPermissions: [PERMISSION_WRITE_SECRETS]
+    });
+  }
+
   for await (const request of requests) {
     // do a validation
 
@@ -110,7 +132,7 @@ export const batchSecrets = async (req: Request, res: Response) => {
           version: 1,
           user: request.secret.type === SECRET_PERSONAL ? req.user : undefined,
           environment,
-          workspace: new Types.ObjectId(workspaceId),
+          workspace: workspaceId,
           folder: folderId,
           secretBlindIndex,
           algorithm: ALGORITHM_AES_256_GCM,
@@ -125,7 +147,7 @@ export const batchSecrets = async (req: Request, res: Response) => {
 
         updateSecrets.push({
           ...request.secret,
-          _id: new Types.ObjectId(request.secret._id),
+          _id: request.secret._id,
           secretBlindIndex,
           folder: folderId,
           algorithm: ALGORITHM_AES_256_GCM,
@@ -133,15 +155,39 @@ export const batchSecrets = async (req: Request, res: Response) => {
         });
         break;
       case "DELETE":
-        deleteSecrets.push(new Types.ObjectId(request.secret._id));
+        deleteSecrets.push({
+          _id: new Types.ObjectId(request.secret._id),
+          secretName: request.secret.secretName
+        });
         break;
     }
   }
+  // not using service token  using auth
+  if (!(req.authData.authPayload instanceof ServiceTokenData)) {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    if (createSecrets.length)
+      ForbiddenError.from(permission).throwUnlessCan(
+        ProjectPermissionActions.Create,
+        subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      );
+
+    if (updateSecrets.length)
+      ForbiddenError.from(permission).throwUnlessCan(
+        ProjectPermissionActions.Edit,
+        subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      );
+
+    if (deleteSecrets.length)
+      ForbiddenError.from(permission).throwUnlessCan(
+        ProjectPermissionActions.Delete,
+        subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      );
+  }
 
   // handle create secrets
   let createdSecrets: ISecret[] = [];
   if (createSecrets.length > 0) {
-    createdSecrets = await Secret.insertMany(createSecrets);
+    createdSecrets = (await Secret.insertMany(createSecrets)) as any;
     // (EE) add secret versions for new secrets
     await EESecretService.addSecretVersions({
       secretVersions: createdSecrets.map((n: any) => {
@@ -154,6 +200,30 @@ export const batchSecrets = async (req: Request, res: Response) => {
       })
     });
 
+    const auditLogs = await Promise.all(
+      createdSecrets.map((secret, index) => {
+        return EEAuditLogService.createAuditLog(
+          req.authData,
+          {
+            type: EventType.CREATE_SECRET,
+            metadata: {
+              environment: secret.environment,
+              secretPath: secretPath ?? "/",
+              secretId: secret._id.toString(),
+              secretKey: createSecrets[index].secretName,
+              secretVersion: secret.version
+            }
+          },
+          {
+            workspaceId: secret.workspace
+          },
+          false
+        );
+      })
+    );
+
+    await AuditLog.insertMany(auditLogs);
+
     const addAction = (await EELogService.createAction({
       name: ACTION_ADD_SECRETS,
       userId: req.user?._id,
@@ -182,7 +252,7 @@ export const batchSecrets = async (req: Request, res: Response) => {
 
   // handle update secrets
   let updatedSecrets: ISecret[] = [];
-  if (updateSecrets.length > 0 && req.secrets) {
+  if (updateSecrets.length > 0 && oldSecrets) {
     // construct object containing all secrets
     let listedSecretsObj: {
       [key: string]: {
@@ -191,7 +261,7 @@ export const batchSecrets = async (req: Request, res: Response) => {
       };
     } = {};
 
-    listedSecretsObj = req.secrets.reduce(
+    listedSecretsObj = oldSecrets.reduce(
       (obj: any, secret: ISecret) => ({
         ...obj,
         [secret._id.toString()]: secret
@@ -203,18 +273,21 @@ export const batchSecrets = async (req: Request, res: Response) => {
       updateOne: {
         filter: {
           _id: new Types.ObjectId(u._id),
-          workspace: new Types.ObjectId(workspaceId)
+          workspace: new Types.ObjectId(workspaceId),
+          environment
         },
         update: {
           $inc: {
             version: 1
           },
+          $unset: {
+            "metadata.source": true as const
+          },
           ...u,
           _id: new Types.ObjectId(u._id)
         }
       }
     }));
-
     await Secret.bulkWrite(updateOperations);
 
     const secretVersions = updateSecrets.map(
@@ -253,6 +326,30 @@ export const batchSecrets = async (req: Request, res: Response) => {
       }
     });
 
+    const auditLogs = await Promise.all(
+      updateSecrets.map((secret) => {
+        return EEAuditLogService.createAuditLog(
+          req.authData,
+          {
+            type: EventType.UPDATE_SECRET,
+            metadata: {
+              environment,
+              secretPath: secretPath ?? "/",
+              secretId: secret._id.toString(),
+              secretKey: secret.secretName,
+              secretVersion: listedSecretsObj[secret._id.toString()].version
+            }
+          },
+          {
+            workspaceId: new Types.ObjectId(workspaceId)
+          },
+          false
+        );
+      })
+    );
+
+    await AuditLog.insertMany(auditLogs);
+
     const updateAction = (await EELogService.createAction({
       name: ACTION_UPDATE_SECRETS,
       userId: req.user._id,
@@ -279,21 +376,63 @@ export const batchSecrets = async (req: Request, res: Response) => {
 
   // handle delete secrets
   if (deleteSecrets.length > 0) {
+    const deleteSecretIds: Types.ObjectId[] = deleteSecrets.map((s) => s._id);
+
+    const deletedSecretsObj = (
+      await Secret.find({
+        _id: {
+          $in: deleteSecretIds
+        }
+      })
+    ).reduce(
+      (obj: any, secret: ISecret) => ({
+        ...obj,
+        [secret._id.toString()]: secret
+      }),
+      {}
+    );
+
     await Secret.deleteMany({
       _id: {
-        $in: deleteSecrets
-      }
+        $in: deleteSecretIds
+      },
+      workspace: new Types.ObjectId(workspaceId),
+      environment
     });
 
     await EESecretService.markDeletedSecretVersions({
-      secretIds: deleteSecrets
+      secretIds: deleteSecretIds
     });
 
+    const auditLogs = await Promise.all(
+      deleteSecrets.map((secret) => {
+        return EEAuditLogService.createAuditLog(
+          req.authData,
+          {
+            type: EventType.DELETE_SECRET,
+            metadata: {
+              environment,
+              secretPath: secretPath ?? "/",
+              secretId: secret._id.toString(),
+              secretKey: secret.secretName,
+              secretVersion: deletedSecretsObj[secret._id.toString()].version
+            }
+          },
+          {
+            workspaceId: new Types.ObjectId(workspaceId)
+          },
+          false
+        );
+      })
+    );
+
+    await AuditLog.insertMany(auditLogs);
+
     const deleteAction = (await EELogService.createAction({
       name: ACTION_DELETE_SECRETS,
       userId: req.user._id,
       workspaceId: new Types.ObjectId(workspaceId),
-      secretIds: deleteSecrets
+      secretIds: deleteSecretIds
     })) as IAction;
     actions.push(deleteAction);
 
@@ -351,7 +490,7 @@ export const batchSecrets = async (req: Request, res: Response) => {
   }
 
   if (deleteSecrets.length > 0) {
-    resObj["deletedSecrets"] = deleteSecrets.map((d) => d.toString());
+    resObj["deletedSecrets"] = deleteSecrets.map((d) => d._id.toString());
   }
 
   return res.status(200).send(resObj);
@@ -416,7 +555,7 @@ export const createSecrets = async (req: Request, res: Response) => {
     }   
     */
 
-  const channel = getChannelFromUserAgent(req.headers["user-agent"]);
+  const channel = getUserAgentType(req.headers["user-agent"]);
   const {
     workspaceId,
     environment,
@@ -691,16 +830,25 @@ export const getSecrets = async (req: Request, res: Response) => {
     }   
     */
 
-  const { tagSlugs, secretPath, include_imports } = req.query;
-  let { folderId } = req.query;
-  const workspaceId = req.query.workspaceId as string;
-  const environment = req.query.environment as string;
+  const validatedData = await validateRequest(GetSecretsV2, req);
+  const {
+    query: { tagSlugs, secretPath, include_imports, workspaceId, environment }
+  } = validatedData;
+  let {
+    query: { folderId }
+  } = validatedData;
 
   const folders = await Folder.findOne({ workspace: workspaceId, environment });
-  if ((!folders && folderId && folderId !== "root") || (!folders && secretPath)) {
+
+  if (
+    // if no folders and asking for a non root folder id or non root secret path
+    (!folders && folderId && folderId !== "root") ||
+    (!folders && secretPath && secretPath !== "/")
+  ) {
     res.send({ secrets: [] });
     return;
   }
+
   if (folders && folderId !== "root") {
     const folder = searchByFolderId(folders.nodes, folderId as string);
     if (!folder) {
@@ -831,10 +979,16 @@ export const getSecrets = async (req: Request, res: Response) => {
   // TODO(akhilmhdh) - secret-imp change this to org type
   let importedSecrets: any[] = [];
   if (include_imports) {
-    importedSecrets = await getAllImportedSecrets(workspaceId, environment, folderId as string);
+    // depreciated
+    importedSecrets = await getAllImportedSecrets(
+      workspaceId,
+      environment,
+      folderId as string,
+      () => false
+    );
   }
 
-  const channel = getChannelFromUserAgent(req.headers["user-agent"]);
+  const channel = getUserAgentType(req.headers["user-agent"]);
 
   const readAction = await EELogService.createAction({
     name: ACTION_READ_SECRETS,
@@ -856,22 +1010,52 @@ export const getSecrets = async (req: Request, res: Response) => {
       ipAddress: req.realIP
     }));
 
-  const postHogClient = await TelemetryService.getPostHogClient();
-  if (postHogClient) {
-    postHogClient.capture({
-      event: "secrets pulled",
-      distinctId: await TelemetryService.getDistinctId({
-        authData: req.authData
-      }),
-      properties: {
-        numberOfSecrets: secrets.length,
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.GET_SECRETS,
+      metadata: {
         environment,
-        workspaceId,
-        channel,
-        folderId,
-        userAgent: req.headers?.["user-agent"]
+        secretPath: (secretPath as string) ?? "/",
+        numberOfSecrets: secrets.length
       }
-    });
+    },
+    {
+      workspaceId: new Types.ObjectId(workspaceId as string)
+    }
+  );
+
+  const postHogClient = await TelemetryService.getPostHogClient();
+
+  // reduce the number of events captured
+  let shouldRecordK8Event = false;
+  if (req.authData.userAgent == K8_USER_AGENT_NAME) {
+    const randomNumber = Math.random();
+    if (randomNumber > 0.9) {
+      shouldRecordK8Event = true;
+    }
+  }
+
+  if (postHogClient) {
+    const shouldCapture = req.authData.userAgent !== K8_USER_AGENT_NAME || shouldRecordK8Event;
+    const approximateForNoneCapturedEvents = secrets.length * 10;
+
+    if (shouldCapture) {
+      postHogClient.capture({
+        event: "secrets pulled",
+        distinctId: await TelemetryService.getDistinctId({
+          authData: req.authData
+        }),
+        properties: {
+          numberOfSecrets: shouldRecordK8Event ? approximateForNoneCapturedEvents : secrets.length,
+          environment,
+          workspaceId,
+          folderId,
+          channel: req.authData.userAgentType,
+          userAgent: req.authData.userAgent
+        }
+      });
+    }
   }
 
   return res.status(200).send({
@@ -1170,7 +1354,7 @@ export const deleteSecrets = async (req: Request, res: Response) => {
     }   
     */
 
-  const channel = getChannelFromUserAgent(req.headers["user-agent"]);
+  const channel = getUserAgentType(req.headers["user-agent"]);
   const toDelete = req.secrets.map((s: any) => s._id);
 
   await Secret.deleteMany({

backend/src/controllers/v2/serviceAccountsController.ts

@@ -2,7 +2,7 @@ import { Request, Response } from "express";
 import { Types } from "mongoose";
 import crypto from "crypto";
 import bcrypt from "bcrypt";
-import { 
+import {
     ServiceAccount,
     ServiceAccountKey,
     ServiceAccountOrganizationPermission,
@@ -21,11 +21,11 @@ import { getSaltRounds } from "../../config";
  */
 export const getCurrentServiceAccount = async (req: Request, res: Response) => {
     const serviceAccount = await ServiceAccount.findById(req.serviceAccount._id);
-    
+
     if (!serviceAccount) {
         throw ServiceAccountNotFoundError({ message: "Failed to find service account" });
     }
-    
+
     return res.status(200).send({
         serviceAccount,
     });
@@ -38,13 +38,13 @@ export const getCurrentServiceAccount = async (req: Request, res: Response) => {
  */
 export const getServiceAccountById = async (req: Request, res: Response) => {
     const { serviceAccountId } = req.params;
-    
+
     const serviceAccount = await ServiceAccount.findById(serviceAccountId);
-    
+
     if (!serviceAccount) {
         throw ServiceAccountNotFoundError({ message: "Failed to find service account" });
     }
-    
+
     return res.status(200).send({
         serviceAccount,
     });
@@ -73,7 +73,7 @@ export const createServiceAccount = async (req: Request, res: Response) => {
 
     const secret = crypto.randomBytes(16).toString("base64");
     const secretHash = await bcrypt.hash(secret, await getSaltRounds());
-    
+
     // create service account
     const serviceAccount = await new ServiceAccount({
         name,
@@ -83,17 +83,17 @@ export const createServiceAccount = async (req: Request, res: Response) => {
         lastUsed: new Date(),
         expiresAt,
         secretHash,
-    }).save();
-    
+    }).save()
+
     const serviceAccountObj = serviceAccount.toObject();
-    
-    delete serviceAccountObj.secretHash;
+
+    delete (serviceAccountObj as any).secretHash;
 
     // provision default org-level permission for service account
     await new ServiceAccountOrganizationPermission({
         serviceAccount: serviceAccount._id,
     }).save();
-    
+
     const secretId = Buffer.from(serviceAccount._id.toString(), "hex").toString("base64");
 
     return res.status(200).send({
@@ -111,7 +111,7 @@ export const createServiceAccount = async (req: Request, res: Response) => {
 export const changeServiceAccountName = async (req: Request, res: Response) => {
     const { serviceAccountId } = req.params;
     const { name } = req.body;
-    
+
     const serviceAccount = await ServiceAccount.findOneAndUpdate(
         {
             _id: new Types.ObjectId(serviceAccountId),
@@ -123,7 +123,7 @@ export const changeServiceAccountName = async (req: Request, res: Response) => {
             new: true,
         }
     );
-    
+
     return res.status(200).send({
         serviceAccount,
     });
@@ -142,7 +142,7 @@ export const addServiceAccountKey = async (req: Request, res: Response) => {
         encryptedKey,
         nonce,
     } = req.body;
-    
+
     const serviceAccountKey = await new ServiceAccountKey({
         encryptedKey,
         nonce,
@@ -163,7 +163,7 @@ export const getServiceAccountWorkspacePermissions = async (req: Request, res: R
     const serviceAccountWorkspacePermissions = await ServiceAccountWorkspacePermission.find({
         serviceAccount: req.serviceAccount._id,
     }).populate("workspace");
-    
+
     return res.status(200).send({
         serviceAccountWorkspacePermissions,
     });
@@ -184,19 +184,19 @@ export const addServiceAccountWorkspacePermission = async (req: Request, res: Re
         encryptedKey,
         nonce,
     } = req.body;
-    
+
     if (!req.membership.workspace.environments.some((e: { name: string; slug: string }) => e.slug === environment)) {
         return res.status(400).send({
             message: "Failed to validate workspace environment",
         });
     }
-    
+
     const existingPermission = await ServiceAccountWorkspacePermission.findOne({
         serviceAccount: new Types.ObjectId(serviceAccountId),
         workspace: new Types.ObjectId(workspaceId),
         environment,
     });
-    
+
     if (existingPermission) throw BadRequestError({ message: "Failed to add workspace permission to service account due to already-existing " });
 
     const serviceAccountWorkspacePermission = await new ServiceAccountWorkspacePermission({
@@ -206,12 +206,12 @@ export const addServiceAccountWorkspacePermission = async (req: Request, res: Re
         read,
         write,
     }).save();
-    
+
     const existingServiceAccountKey = await ServiceAccountKey.findOne({
         serviceAccount: new Types.ObjectId(serviceAccountId),
-        workspace: new Types.ObjectId(workspaceId), 
+        workspace: new Types.ObjectId(workspaceId),
     });
-    
+
     if (!existingServiceAccountKey) {
         await new ServiceAccountKey({
             encryptedKey,
@@ -242,7 +242,7 @@ export const deleteServiceAccountWorkspacePermission = async (req: Request, res:
             serviceAccount,
             workspace,
         });
-        
+
         if (count === 0) {
             await ServiceAccountKey.findOneAndDelete({
                 serviceAccount,
@@ -294,12 +294,12 @@ export const deleteServiceAccount = async (req: Request, res: Response) => {
  */
 export const getServiceAccountKeys = async (req: Request, res: Response) => {
     const workspaceId = req.query.workspaceId as string;
-    
+
     const serviceAccountKeys = await ServiceAccountKey.find({
         serviceAccount: req.serviceAccount._id,
         ...(workspaceId ? { workspace: new Types.ObjectId(workspaceId) } : {}),
     });
-    
+
     return res.status(200).send({
         serviceAccountKeys,
     });

backend/src/controllers/v2/serviceTokenDataController.ts

@@ -1,10 +1,20 @@
 import { Request, Response } from "express";
 import crypto from "crypto";
 import bcrypt from "bcrypt";
-import { ServiceAccount, ServiceTokenData, User } from "../../models";
-import { AUTH_MODE_JWT, AUTH_MODE_SERVICE_ACCOUNT } from "../../variables";
+import { ServiceTokenData } from "../../models";
 import { getSaltRounds } from "../../config";
 import { BadRequestError } from "../../utils/errors";
+import { ActorType, EventType } from "../../ee/models";
+import { EEAuditLogService } from "../../ee/services";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/serviceTokenData";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../ee/services/ProjectRoleService";
+import { ForbiddenError } from "@casl/ability";
+import { Types } from "mongoose";
 
 /**
  * Return service token data associated with service token on request
@@ -62,7 +72,14 @@ export const getServiceTokenData = async (req: Request, res: Response) => {
 export const createServiceTokenData = async (req: Request, res: Response) => {
   let serviceTokenData;
 
-  const { name, workspaceId, encryptedKey, iv, tag, expiresIn, permissions, scopes } = req.body;
+  const {
+    body: { workspaceId, permissions, tag, encryptedKey, scopes, name, expiresIn, iv }
+  } = await validateRequest(reqValidator.CreateServiceTokenV2, req);
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Create,
+    ProjectPermissionSub.ServiceTokens
+  );
 
   const secret = crypto.randomBytes(16).toString("hex");
   const secretHash = await bcrypt.hash(secret, await getSaltRounds());
@@ -73,24 +90,16 @@ export const createServiceTokenData = async (req: Request, res: Response) => {
     expiresAt.setSeconds(expiresAt.getSeconds() + expiresIn);
   }
 
-  let user, serviceAccount;
+  let user;
 
-  if (req.authData.authMode === AUTH_MODE_JWT && req.authData.authPayload instanceof User) {
+  if (req.authData.actor.type === ActorType.USER) {
     user = req.authData.authPayload._id;
   }
 
-  if (
-    req.authData.authMode === AUTH_MODE_SERVICE_ACCOUNT &&
-    req.authData.authPayload instanceof ServiceAccount
-  ) {
-    serviceAccount = req.authData.authPayload._id;
-  }
-
   serviceTokenData = await new ServiceTokenData({
     name,
     workspace: workspaceId,
     user,
-    serviceAccount,
     scopes,
     lastUsed: new Date(),
     expiresAt,
@@ -108,6 +117,20 @@ export const createServiceTokenData = async (req: Request, res: Response) => {
 
   const serviceToken = `st.${serviceTokenData._id.toString()}.${secret}`;
 
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.CREATE_SERVICE_TOKEN,
+      metadata: {
+        name,
+        scopes
+      }
+    },
+    {
+      workspaceId: new Types.ObjectId(workspaceId)
+    }
+  );
+
   return res.status(200).send({
     serviceToken,
     serviceTokenData
@@ -121,9 +144,42 @@ export const createServiceTokenData = async (req: Request, res: Response) => {
  * @returns
  */
 export const deleteServiceTokenData = async (req: Request, res: Response) => {
-  const { serviceTokenDataId } = req.params;
+  const {
+    params: { serviceTokenDataId }
+  } = await validateRequest(reqValidator.DeleteServiceTokenV2, req);
 
-  const serviceTokenData = await ServiceTokenData.findByIdAndDelete(serviceTokenDataId);
+  let serviceTokenData = await ServiceTokenData.findById(serviceTokenDataId);
+  if (!serviceTokenData) throw BadRequestError({ message: "Service token not found" });
+
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    serviceTokenData.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Delete,
+    ProjectPermissionSub.ServiceTokens
+  );
+
+  serviceTokenData = await ServiceTokenData.findByIdAndDelete(serviceTokenDataId);
+
+  if (!serviceTokenData)
+    return res.status(200).send({
+      message: "Failed to delete service token"
+    });
+
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.DELETE_SERVICE_TOKEN,
+      metadata: {
+        name: serviceTokenData.name,
+        scopes: serviceTokenData?.scopes
+      }
+    },
+    {
+      workspaceId: serviceTokenData.workspace
+    }
+  );
 
   return res.status(200).send({
     serviceTokenData

backend/src/controllers/v2/tagController.ts

@@ -1,42 +1,58 @@
+import { ForbiddenError } from "@casl/ability";
 import { Request, Response } from "express";
 import { Types } from "mongoose";
-import { Membership, Secret } from "../../models";
-import Tag from "../../models/tag";
-import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
+import { Secret, Tag } from "../../models";
+import { BadRequestError } from "../../utils/errors";
+import { validateRequest } from "../../helpers/validation";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../ee/services/ProjectRoleService";
+import * as reqValidator from "../../validation/tags";
 
 export const createWorkspaceTag = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
-  const { name, slug } = req.body;
-  
+  const {
+    body: { name, slug },
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.CreateWorkspaceTagsV2, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Create,
+    ProjectPermissionSub.Tags
+  );
+
   const tagToCreate = {
-      name,
-      workspace: new Types.ObjectId(workspaceId),
-      slug,
-      user: new Types.ObjectId(req.user._id),
-    };
-  
+    name,
+    workspace: new Types.ObjectId(workspaceId),
+    slug,
+    user: new Types.ObjectId(req.user._id)
+  };
+
   const createdTag = await new Tag(tagToCreate).save();
-  
+
   res.json(createdTag);
 };
 
 export const deleteWorkspaceTag = async (req: Request, res: Response) => {
-  const { tagId } = req.params;
+  const {
+    params: { tagId }
+  } = await validateRequest(reqValidator.DeleteWorkspaceTagsV2, req);
 
   const tagFromDB = await Tag.findById(tagId);
   if (!tagFromDB) {
     throw BadRequestError();
   }
 
-  // can only delete if the request user is one that belongs to the same workspace as the tag
-  const membership = await Membership.findOne({
-    user: req.user,
-    workspace: tagFromDB.workspace
-  });
-
-  if (!membership) {
-    UnauthorizedRequestError({ message: "Failed to validate membership" });
-  }
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    tagFromDB.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Delete,
+    ProjectPermissionSub.Tags
+  );
 
   const result = await Tag.findByIdAndDelete(tagId);
 
@@ -47,12 +63,19 @@ export const deleteWorkspaceTag = async (req: Request, res: Response) => {
 };
 
 export const getWorkspaceTags = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
-  
-  const workspaceTags = await Tag.find({ 
-    workspace: new Types.ObjectId(workspaceId) 
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetWorkspaceTagsV2, req);
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Tags
+  );
+
+  const workspaceTags = await Tag.find({
+    workspace: new Types.ObjectId(workspaceId)
   });
-  
+
   return res.json({
     workspaceTags
   });

backend/src/controllers/v2/usersController.ts

@@ -2,22 +2,19 @@ import { Request, Response } from "express";
 import { Types } from "mongoose";
 import crypto from "crypto";
 import bcrypt from "bcrypt";
-import {
-    APIKeyData,
-    MembershipOrg,
-    TokenVersion,
-    User
-} from "../../models";
+import { APIKeyData, AuthMethod, MembershipOrg, TokenVersion, User } from "../../models";
 import { getSaltRounds } from "../../config";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation";
 
 /**
  * Return the current user.
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const getMe = async (req: Request, res: Response) => {
-    /* 
+  /* 
     #swagger.summary = "Retrieve the current user on the request"
     #swagger.description = "Retrieve the current user on the request"
     
@@ -42,71 +39,117 @@ export const getMe = async (req: Request, res: Response) => {
         }
     }   
     */
-    const user = await User
-        .findById(req.user._id)
-        .select("+salt +publicKey +encryptedPrivateKey +iv +tag +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag");
-    
-    return res.status(200).send({
-        user,
-    });
-}
+  const user = await User.findById(req.user._id).select(
+    "+salt +publicKey +encryptedPrivateKey +iv +tag +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag"
+  );
+
+  return res.status(200).send({
+    user
+  });
+};
 
 /**
  * Update the current user's MFA-enabled status [isMfaEnabled].
  * Note: Infisical currently only supports email-based 2FA only; this will expand to
  * include SMS and authenticator app modes of authentication in the future.
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const updateMyMfaEnabled = async (req: Request, res: Response) => {
-    const { isMfaEnabled }: { isMfaEnabled: boolean } = req.body;
-    req.user.isMfaEnabled = isMfaEnabled;
-    
-    if (isMfaEnabled) { 
-        // TODO: adapt this route/controller 
-        // to work for different forms of MFA
-        req.user.mfaMethods = ["email"];
-    } else {
-        req.user.mfaMethods = [];
-    }
+  const {
+    body: { isMfaEnabled }
+  } = await validateRequest(reqValidator.UpdateMyMfaEnabledV2, req);
 
-    await req.user.save();
-    
-    const user = req.user;
-    
-    return res.status(200).send({
-        user,
-    });
-}
+  req.user.isMfaEnabled = isMfaEnabled;
+
+  if (isMfaEnabled) {
+    // TODO: adapt this route/controller
+    // to work for different forms of MFA
+    req.user.mfaMethods = ["email"];
+  } else {
+    req.user.mfaMethods = [];
+  }
+
+  await req.user.save();
+
+  const user = req.user;
+
+  return res.status(200).send({
+    user
+  });
+};
 
 /**
- * Update the current user's name [firstName, lastName].
- * @param req 
- * @param res 
- * @returns 
+ * Update name of the current user to [firstName, lastName].
+ * @param req
+ * @param res
+ * @returns
  */
 export const updateName = async (req: Request, res: Response) => {
-    const { firstName, lastName }: { firstName: string; lastName: string; } = req.body;
-    req.user.firstName = firstName;
-    req.user.lastName = lastName || "";
-    
-    await req.user.save();
-    
-    const user = req.user;
-    
-    return res.status(200).send({
-        user,
+  const {
+    body: { lastName, firstName }
+  } = await validateRequest(reqValidator.UpdateNameV2, req);
+
+  const user = await User.findByIdAndUpdate(
+    req.user._id.toString(),
+    {
+      firstName,
+      lastName: lastName ?? ""
+    },
+    {
+      new: true
+    }
+  );
+
+  return res.status(200).send({
+    user
+  });
+};
+
+/**
+ * Update auth method of the current user to [authMethods]
+ * @param req
+ * @param res
+ * @returns
+ */
+export const updateAuthMethods = async (req: Request, res: Response) => {
+  const {
+    body: { authMethods }
+  } = await validateRequest(reqValidator.UpdateAuthMethodsV2, req);
+
+  const hasSamlEnabled = req.user.authMethods.some((authMethod: AuthMethod) =>
+    [AuthMethod.OKTA_SAML, AuthMethod.AZURE_SAML, AuthMethod.JUMPCLOUD_SAML].includes(authMethod)
+  );
+
+  if (hasSamlEnabled) {
+    return res.status(400).send({
+      message: "Failed to update user authentication method because SAML SSO is enforced"
     });
-}
+  }
+
+  const user = await User.findByIdAndUpdate(
+    req.user._id.toString(),
+    {
+      authMethods
+    },
+    {
+      new: true
+    }
+  );
+
+  return res.status(200).send({
+    user
+  });
+};
 
 /**
  * Return organizations that the current user is part of.
- * @param req 
- * @param res 
+ * @param req
+ * @param res
  */
 export const getMyOrganizations = async (req: Request, res: Response) => {
-    /* 
+  /* 
     #swagger.summary = 'Return organizations that current user is part of'
     #swagger.description = 'Return organizations that current user is part of'
     
@@ -135,114 +178,121 @@ export const getMyOrganizations = async (req: Request, res: Response) => {
     */
   const organizations = (
     await MembershipOrg.find({
-      user: req.user._id,
+      user: req.user._id
     }).populate("organization")
   ).map((m) => m.organization);
 
-	return res.status(200).send({
-		organizations,
-	});
-}
+  return res.status(200).send({
+    organizations
+  });
+};
 
 /**
  * Return API keys belonging to current user.
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const getMyAPIKeys = async (req: Request, res: Response) => {
-    const apiKeyData = await APIKeyData.find({
-		user: req.user._id,
-	});
+  const apiKeyData = await APIKeyData.find({
+    user: req.user._id
+  });
 
-	return res.status(200).send(apiKeyData);
-}
+  return res.status(200).send(apiKeyData);
+};
 
 /**
  * Create new API key for current user.
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const createAPIKey = async (req: Request, res: Response) => {
-	const { name, expiresIn } = req.body;
+  const {
+    body: { name, expiresIn }
+  } = await validateRequest(reqValidator.CreateApiKeyV2, req);
 
-	const secret = crypto.randomBytes(16).toString("hex");
-	const secretHash = await bcrypt.hash(secret, await getSaltRounds());
+  const secret = crypto.randomBytes(16).toString("hex");
+  const secretHash = await bcrypt.hash(secret, await getSaltRounds());
 
-	const expiresAt = new Date();
-	expiresAt.setSeconds(expiresAt.getSeconds() + expiresIn);
+  const expiresAt = new Date();
+  expiresAt.setSeconds(expiresAt.getSeconds() + expiresIn);
 
-	let apiKeyData = await new APIKeyData({
-		name,
-		lastUsed: new Date(),
-		expiresAt,
-		user: req.user._id,
-		secretHash,
-	}).save();
+  let apiKeyData = await new APIKeyData({
+    name,
+    lastUsed: new Date(),
+    expiresAt,
+    user: req.user._id,
+    secretHash
+  }).save();
 
-	// return api key data without sensitive data
-	apiKeyData = (await APIKeyData.findById(apiKeyData._id)) as any;
+  // return api key data without sensitive data
+  apiKeyData = (await APIKeyData.findById(apiKeyData._id)) as any;
 
-	if (!apiKeyData) throw new Error("Failed to find API key data");
+  if (!apiKeyData) throw new Error("Failed to find API key data");
 
-	const apiKey = `ak.${apiKeyData._id.toString()}.${secret}`;
+  const apiKey = `ak.${apiKeyData._id.toString()}.${secret}`;
 
-	return res.status(200).send({
-		apiKey,
-		apiKeyData,
-	});
-}
+  return res.status(200).send({
+    apiKey,
+    apiKeyData
+  });
+};
 
 /**
  * Delete API key with id [apiKeyDataId] belonging to current user
- * @param req 
- * @param res 
+ * @param req
+ * @param res
  */
 export const deleteAPIKey = async (req: Request, res: Response) => {
-    const { apiKeyDataId } = req.params;
+  const {
+    params: { apiKeyDataId }
+  } = await validateRequest(reqValidator.DeleteApiKeyV2, req);
 
-    const apiKeyData = await APIKeyData.findOneAndDelete({
-        _id: new Types.ObjectId(apiKeyDataId),
-        user: req.user._id
-    });
+  const apiKeyData = await APIKeyData.findOneAndDelete({
+    _id: new Types.ObjectId(apiKeyDataId),
+    user: req.user._id
+  });
 
-	return res.status(200).send({
-		apiKeyData
-	});
-}
+  return res.status(200).send({
+    apiKeyData
+  });
+};
 
 /**
  * Return active sessions (TokenVersion) belonging to user
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const getMySessions = async (req: Request, res: Response) => {
-    const tokenVersions = await TokenVersion.find({
-        user: req.user._id
-    });
-    
-    return res.status(200).send(tokenVersions);
-}
+  const tokenVersions = await TokenVersion.find({
+    user: req.user._id
+  });
+
+  return res.status(200).send(tokenVersions);
+};
 
 /**
  * Revoke all active sessions belong to user
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const deleteMySessions = async (req: Request, res: Response) => {
-    await TokenVersion.updateMany({
-        user: req.user._id,
-    }, {
-        $inc: {
-            refreshVersion: 1,
-            accessVersion: 1,
-        },
-    });
+  await TokenVersion.updateMany(
+    {
+      user: req.user._id
+    },
+    {
+      $inc: {
+        refreshVersion: 1,
+        accessVersion: 1
+      }
+    }
+  );
 
-    return res.status(200).send({
-        message: "Successfully revoked all sessions"
-    });
-}
+  return res.status(200).send({
+    message: "Successfully revoked all sessions"
+  });
+};

backend/src/controllers/v2/workspaceController.ts

@@ -9,6 +9,16 @@ import {
 import { pushKeys } from "../../helpers/key";
 import { EventService, TelemetryService } from "../../services";
 import { eventPushSecrets } from "../../events";
+import { EEAuditLogService } from "../../ee/services";
+import { EventType } from "../../ee/models";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../ee/services/ProjectRoleService";
+import { ForbiddenError } from "@casl/ability";
 
 interface V2PushSecret {
   type: string; // personal or shared
@@ -179,7 +189,9 @@ export const getWorkspaceKey = async (req: Request, res: Response) => {
         }
     }   
     */
-  const { workspaceId } = req.params;
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetWorkspaceKeyV2, req);
 
   const key = await Key.findOne({
     workspace: workspaceId,
@@ -188,8 +200,22 @@ export const getWorkspaceKey = async (req: Request, res: Response) => {
 
   if (!key) throw new Error("Failed to find workspace key");
 
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.GET_WORKSPACE_KEY,
+      metadata: {
+        keyId: key._id.toString()
+      }
+    },
+    {
+      workspaceId: new Types.ObjectId(workspaceId)
+    }
+  );
+
   return res.status(200).json(key);
 };
+
 export const getWorkspaceServiceTokenData = async (req: Request, res: Response) => {
   const { workspaceId } = req.params;
 
@@ -242,7 +268,15 @@ export const getWorkspaceMemberships = async (req: Request, res: Response) => {
         }
     }   
     */
-  const { workspaceId } = req.params;
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetWorkspaceMembershipsV2, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Member
+  );
 
   const memberships = await Membership.find({
     workspace: workspaceId
@@ -313,8 +347,16 @@ export const updateWorkspaceMembership = async (req: Request, res: Response) =>
         }
     }   
     */
-  const { membershipId } = req.params;
-  const { role } = req.body;
+  const {
+    params: { workspaceId, membershipId },
+    body: { role }
+  } = await validateRequest(reqValidator.UpdateWorkspaceMembershipsV2, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Edit,
+    ProjectPermissionSub.Member
+  );
 
   const membership = await Membership.findByIdAndUpdate(
     membershipId,
@@ -374,7 +416,15 @@ export const deleteWorkspaceMembership = async (req: Request, res: Response) =>
         }
     }   
     */
-  const { membershipId } = req.params;
+  const {
+    params: { workspaceId, membershipId }
+  } = await validateRequest(reqValidator.DeleteWorkspaceMembershipsV2, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Delete,
+    ProjectPermissionSub.Member
+  );
 
   const membership = await Membership.findByIdAndDelete(membershipId);
 
@@ -397,8 +447,16 @@ export const deleteWorkspaceMembership = async (req: Request, res: Response) =>
  * @returns
  */
 export const toggleAutoCapitalization = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
-  const { autoCapitalization } = req.body;
+  const {
+    params: { workspaceId },
+    body: { autoCapitalization }
+  } = await validateRequest(reqValidator.ToggleAutoCapitalizationV2, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Edit,
+    ProjectPermissionSub.Settings
+  );
 
   const workspace = await Workspace.findOneAndUpdate(
     {

backend/src/controllers/v3/authController.ts

@@ -1,7 +1,6 @@
 /* eslint-disable @typescript-eslint/no-var-requires */
 import { Request, Response } from "express";
 import jwt from "jsonwebtoken";
-import * as Sentry from "@sentry/node";
 import * as bigintConversion from "bigint-conversion";
 const jsrp = require("jsrp");
 import { LoginSRPDetail, User } from "../../models";
@@ -11,25 +10,20 @@ import { sendMail } from "../../helpers/nodemailer";
 import { TokenService } from "../../services";
 import { EELogService } from "../../ee/services";
 import { BadRequestError, InternalServerError } from "../../utils/errors";
-import {
-    ACTION_LOGIN,
-    TOKEN_EMAIL_MFA,
-} from "../../variables";
-import { getChannelFromUserAgent } from "../../utils/posthog"; // TODO: move this
-import {
-    getHttpsEnabled,
-    getJwtMfaLifetime,
-    getJwtMfaSecret,
-} from "../../config";
-import { AuthProvider } from "../../models/user";
+import { ACTION_LOGIN, TOKEN_EMAIL_MFA } from "../../variables";
+import { getUserAgentType } from "../../utils/posthog"; // TODO: move this
+import { getHttpsEnabled, getJwtMfaLifetime, getJwtMfaSecret } from "../../config";
+import { AuthMethod } from "../../models/user";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/auth";
 
 declare module "jsonwebtoken" {
-    export interface ProviderAuthJwtPayload extends jwt.JwtPayload {
-        userId: string;
-        email: string;
-        authProvider: AuthProvider;
-        isUserCompleted: boolean,
-    }
+  export interface ProviderAuthJwtPayload extends jwt.JwtPayload {
+    userId: string;
+    email: string;
+    authProvider: AuthMethod;
+    isUserCompleted: boolean;
+  }
 }
 
 /**
@@ -39,62 +33,51 @@ declare module "jsonwebtoken" {
  * @returns
  */
 export const login1 = async (req: Request, res: Response) => {
-    try {
-        const {
-            email,
-            providerAuthToken,
-            clientPublicKey,
-        }: {
-            email: string;
-            clientPublicKey: string,
-            providerAuthToken?: string;
-        } = req.body;
+  const {
+    body: { email, clientPublicKey, providerAuthToken }
+  } = await validateRequest(reqValidator.Login1V3, req);
 
-        const user = await User.findOne({
-            email,
-        }).select("+salt +verifier");
+  const user = await User.findOne({
+    email
+  }).select("+salt +verifier");
 
-        if (!user) throw new Error("Failed to find user");
+  if (!user) throw new Error("Failed to find user");
 
-        if (user.authProvider) {
-            await validateProviderAuthToken({
-                email,
-                user,
-                providerAuthToken,
-            })
-        }
+  if (!user.authMethods.includes(AuthMethod.EMAIL)) {
+    await validateProviderAuthToken({
+      email,
+      providerAuthToken
+    });
+  }
 
-        const server = new jsrp.server();
-        server.init(
-            {
-                salt: user.salt,
-                verifier: user.verifier,
-            },
-            async () => {
-                // generate server-side public key
-                const serverPublicKey = server.getPublicKey();
-                await LoginSRPDetail.findOneAndReplace({
-                    email: email,
-                }, {
-                    email,
-                    userId: user.id,
-                    clientPublicKey: clientPublicKey,
-                    serverBInt: bigintConversion.bigintToBuf(server.bInt),
-                }, { upsert: true, returnNewDocument: false });
+  const server = new jsrp.server();
+  server.init(
+    {
+      salt: user.salt,
+      verifier: user.verifier
+    },
+    async () => {
+      // generate server-side public key
+      const serverPublicKey = server.getPublicKey();
+      await LoginSRPDetail.findOneAndReplace(
+        {
+          email: email
+        },
+        {
+          email,
+          userId: user.id,
+          clientPublicKey: clientPublicKey,
+          serverBInt: bigintConversion.bigintToBuf(server.bInt)
+        },
+        { upsert: true, returnNewDocument: false }
+      );
 
-                return res.status(200).send({
-                    serverPublicKey,
-                    salt: user.salt,
-                });
-            }
-        );
-    } catch (err) {
-        Sentry.setUser(null);
-        Sentry.captureException(err);
-        return res.status(400).send({
-            message: "Failed to start authentication process",
-        });
+      return res.status(200).send({
+        serverPublicKey,
+        salt: user.salt
+      });
     }
+  );
 };
 
 /**
@@ -105,160 +88,151 @@ export const login1 = async (req: Request, res: Response) => {
  * @returns
  */
 export const login2 = async (req: Request, res: Response) => {
-    try {
+  if (!req.headers["user-agent"])
+    throw InternalServerError({ message: "User-Agent header is required" });
 
-        if (!req.headers["user-agent"]) throw InternalServerError({ message: "User-Agent header is required" });
+  const {
+    body: { email, providerAuthToken, clientProof }
+  } = await validateRequest(reqValidator.Login2V3, req);
 
-        const { email, clientProof, providerAuthToken } = req.body;
+  const user = await User.findOne({
+    email
+  }).select(
+    "+salt +verifier +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag +publicKey +encryptedPrivateKey +iv +tag +devices"
+  );
 
-        const user = await User.findOne({
-            email,
-        }).select("+salt +verifier +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag +publicKey +encryptedPrivateKey +iv +tag +devices");
+  if (!user) throw new Error("Failed to find user");
 
-        if (!user) throw new Error("Failed to find user");
+  if (!user.authMethods.includes(AuthMethod.EMAIL)) {
+    await validateProviderAuthToken({
+      email,
+      providerAuthToken
+    });
+  }
 
-        if (user.authProvider) {
-            await validateProviderAuthToken({
-                email,
-                user,
-                providerAuthToken,
-            })
-        }
+  const loginSRPDetail = await LoginSRPDetail.findOneAndDelete({ email: email });
 
-        const loginSRPDetail = await LoginSRPDetail.findOneAndDelete({ email: email })
+  if (!loginSRPDetail) {
+    return BadRequestError(Error("Failed to find login details for SRP"));
+  }
 
-        if (!loginSRPDetail) {
-            return BadRequestError(Error("Failed to find login details for SRP"))
-        }
+  const server = new jsrp.server();
+  server.init(
+    {
+      salt: user.salt,
+      verifier: user.verifier,
+      b: loginSRPDetail.serverBInt
+    },
+    async () => {
+      server.setClientPublicKey(loginSRPDetail.clientPublicKey);
 
-        const server = new jsrp.server();
-        server.init(
-            {
-                salt: user.salt,
-                verifier: user.verifier,
-                b: loginSRPDetail.serverBInt,
+      // compare server and client shared keys
+      if (server.checkClientProof(clientProof)) {
+        if (user.isMfaEnabled) {
+          // case: user has MFA enabled
+
+          // generate temporary MFA token
+          const token = createToken({
+            payload: {
+              userId: user._id.toString()
             },
-            async () => {
-                server.setClientPublicKey(loginSRPDetail.clientPublicKey);
+            expiresIn: await getJwtMfaLifetime(),
+            secret: await getJwtMfaSecret()
+          });
 
-                // compare server and client shared keys
-                if (server.checkClientProof(clientProof)) {
+          const code = await TokenService.createToken({
+            type: TOKEN_EMAIL_MFA,
+            email
+          });
 
-                    if (user.isMfaEnabled) {
-                        // case: user has MFA enabled
-
-                        // generate temporary MFA token
-                        const token = createToken({
-                            payload: {
-                                userId: user._id.toString(),
-                            },
-                            expiresIn: await getJwtMfaLifetime(),
-                            secret: await getJwtMfaSecret(),
-                        });
-
-                        const code = await TokenService.createToken({
-                            type: TOKEN_EMAIL_MFA,
-                            email,
-                        });
-
-                        // send MFA code [code] to [email]
-                        await sendMail({
-                            template: "emailMfa.handlebars",
-                            subjectLine: "Infisical MFA code",
-                            recipients: [user.email],
-                            substitutions: {
-                                code,
-                            },
-                        });
-
-                        return res.status(200).send({
-                            mfaEnabled: true,
-                            token,
-                        });
-                    }
-
-                    await checkUserDevice({
-                        user,
-                        ip: req.realIP,
-                        userAgent: req.headers["user-agent"] ?? "",
-                    });
-
-                    // issue tokens
-                    const tokens = await issueAuthTokens({ 
-                        userId: user._id,
-                        ip: req.realIP,
-                        userAgent: req.headers["user-agent"] ?? "",
-                    });
-
-                    // store (refresh) token in httpOnly cookie
-                    res.cookie("jid", tokens.refreshToken, {
-                        httpOnly: true,
-                        path: "/",
-                        sameSite: "strict",
-                        secure: await getHttpsEnabled(),
-                    });
-
-                    // case: user does not have MFA enablgged
-                    // return (access) token in response
-
-                    interface ResponseData {
-                        mfaEnabled: boolean;
-                        encryptionVersion: any;
-                        protectedKey?: string;
-                        protectedKeyIV?: string;
-                        protectedKeyTag?: string;
-                        token: string;
-                        publicKey?: string;
-                        encryptedPrivateKey?: string;
-                        iv?: string;
-                        tag?: string;
-                    }
-
-                    const response: ResponseData = {
-                        mfaEnabled: false,
-                        encryptionVersion: user.encryptionVersion,
-                        token: tokens.token,
-                        publicKey: user.publicKey,
-                        encryptedPrivateKey: user.encryptedPrivateKey,
-                        iv: user.iv,
-                        tag: user.tag,
-                    }
-
-                    if (
-                        user?.protectedKey &&
-                        user?.protectedKeyIV &&
-                        user?.protectedKeyTag
-                    ) {
-                        response.protectedKey = user.protectedKey;
-                        response.protectedKeyIV = user.protectedKeyIV
-                        response.protectedKeyTag = user.protectedKeyTag;
-                    }
-
-                    const loginAction = await EELogService.createAction({
-                        name: ACTION_LOGIN,
-                        userId: user._id,
-                    });
-
-                    loginAction && await EELogService.createLog({
-                        userId: user._id,
-                        actions: [loginAction],
-                        channel: getChannelFromUserAgent(req.headers["user-agent"]),
-                        ipAddress: req.realIP,
-                    });
-
-                    return res.status(200).send(response);
-                }
-
-                return res.status(400).send({
-                    message: "Failed to authenticate. Try again?",
-                });
+          // send MFA code [code] to [email]
+          await sendMail({
+            template: "emailMfa.handlebars",
+            subjectLine: "Infisical MFA code",
+            recipients: [user.email],
+            substitutions: {
+              code
             }
-        );
-    } catch (err) {
-        Sentry.setUser(null);
-        Sentry.captureException(err);
-        return res.status(400).send({
-            message: "Failed to authenticate. Try again?",
+          });
+
+          return res.status(200).send({
+            mfaEnabled: true,
+            token
+          });
+        }
+
+        await checkUserDevice({
+          user,
+          ip: req.realIP,
+          userAgent: req.headers["user-agent"] ?? ""
         });
+
+        // issue tokens
+        const tokens = await issueAuthTokens({
+          userId: user._id,
+          ip: req.realIP,
+          userAgent: req.headers["user-agent"] ?? ""
+        });
+
+        // store (refresh) token in httpOnly cookie
+        res.cookie("jid", tokens.refreshToken, {
+          httpOnly: true,
+          path: "/",
+          sameSite: "strict",
+          secure: await getHttpsEnabled()
+        });
+
+        // case: user does not have MFA enablgged
+        // return (access) token in response
+
+        interface ResponseData {
+          mfaEnabled: boolean;
+          encryptionVersion: any;
+          protectedKey?: string;
+          protectedKeyIV?: string;
+          protectedKeyTag?: string;
+          token: string;
+          publicKey?: string;
+          encryptedPrivateKey?: string;
+          iv?: string;
+          tag?: string;
+        }
+
+        const response: ResponseData = {
+          mfaEnabled: false,
+          encryptionVersion: user.encryptionVersion,
+          token: tokens.token,
+          publicKey: user.publicKey,
+          encryptedPrivateKey: user.encryptedPrivateKey,
+          iv: user.iv,
+          tag: user.tag
+        };
+
+        if (user?.protectedKey && user?.protectedKeyIV && user?.protectedKeyTag) {
+          response.protectedKey = user.protectedKey;
+          response.protectedKeyIV = user.protectedKeyIV;
+          response.protectedKeyTag = user.protectedKeyTag;
+        }
+
+        const loginAction = await EELogService.createAction({
+          name: ACTION_LOGIN,
+          userId: user._id
+        });
+
+        loginAction &&
+          (await EELogService.createLog({
+            userId: user._id,
+            actions: [loginAction],
+            channel: getUserAgentType(req.headers["user-agent"]),
+            ipAddress: req.realIP
+          }));
+
+        return res.status(200).send(response);
+      }
+
+      return res.status(400).send({
+        message: "Failed to authenticate. Try again?"
+      });
     }
+  );
 };

backend/src/controllers/v3/secretsController.ts

@@ -3,12 +3,22 @@ import { Types } from "mongoose";
 import { EventService, SecretService } from "../../services";
 import { eventPushSecrets } from "../../events";
 import { BotService } from "../../services";
-import { repackageSecretToRaw } from "../../helpers/secrets";
+import { containsGlobPatterns, isValidScope, repackageSecretToRaw } from "../../helpers/secrets";
 import { encryptSymmetric128BitHexKeyUTF8 } from "../../utils/crypto";
 import { getAllImportedSecrets } from "../../services/SecretImportService";
-import Folder from "../../models/folder";
-import { getFolderByPath } from "../../services/FolderService";
+import { Folder, IServiceTokenData } from "../../models";
+import { getFolderByPath, getFolderWithPathFromId } from "../../services/FolderService";
 import { BadRequestError } from "../../utils/errors";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/secrets";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../ee/services/ProjectRoleService";
+import { ForbiddenError, subject } from "@casl/ability";
+import { validateServiceTokenDataClientForWorkspace } from "../../validation";
+import { PERMISSION_READ_SECRETS, PERMISSION_WRITE_SECRETS } from "../../variables";
 
 /**
  * Return secrets for workspace with id [workspaceId] and environment
@@ -17,14 +27,68 @@ import { BadRequestError } from "../../utils/errors";
  * @param res
  */
 export const getSecretsRaw = async (req: Request, res: Response) => {
-  const workspaceId = req.query.workspaceId as string;
-  const environment = req.query.environment as string;
-  const secretPath = req.query.secretPath as string;
-  const includeImports = req.query.include_imports as string;
+  const validatedData = await validateRequest(reqValidator.GetSecretsRawV3, req);
+  let {
+    query: { secretPath, environment, workspaceId }
+  } = validatedData;
+  const {
+    query: { folderId, include_imports: includeImports }
+  } = validatedData;
+
+  // if the service token has single scope, it will get all secrets for that scope by default
+  const serviceTokenDetails: IServiceTokenData = req?.serviceTokenData;
+  if (
+    serviceTokenDetails &&
+    serviceTokenDetails.scopes.length == 1 &&
+    !containsGlobPatterns(serviceTokenDetails.scopes[0].secretPath)
+  ) {
+    const scope = serviceTokenDetails.scopes[0];
+    secretPath = scope.secretPath;
+    environment = scope.environment;
+    workspaceId = serviceTokenDetails.workspace.toString();
+  }
+
+  if (folderId && folderId !== "root") {
+    const folder = await Folder.findOne({ workspace: workspaceId, environment });
+    if (!folder) throw BadRequestError({ message: "Folder not found" });
+
+    secretPath = getFolderWithPathFromId(folder.nodes, folderId).folderPath;
+  }
+
+  if (!environment || !workspaceId)
+    throw BadRequestError({ message: "Missing environment or workspace id" });
+
+  let permissionCheckFn: (env: string, secPath: string) => boolean; // used to pass as callback function to import secret
+  if (req.user?._id) {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
+    permissionCheckFn = (env: string, secPath: string) =>
+      permission.can(
+        ProjectPermissionActions.Read,
+        subject(ProjectPermissionSub.Secrets, {
+          environment: env,
+          secretPath: secPath
+        })
+      );
+  } else {
+    await validateServiceTokenDataClientForWorkspace({
+      serviceTokenData: req.authData.authPayload as IServiceTokenData,
+      workspaceId: new Types.ObjectId(workspaceId),
+      environment,
+      secretPath,
+      requiredPermissions: [PERMISSION_READ_SECRETS]
+    });
+    permissionCheckFn = (env: string, secPath: string) =>
+      isValidScope(req.authData.authPayload as IServiceTokenData, env, secPath);
+  }
 
   const secrets = await SecretService.getSecrets({
     workspaceId: new Types.ObjectId(workspaceId),
     environment,
+    folderId,
     secretPath,
     authData: req.authData
   });
@@ -44,7 +108,12 @@ export const getSecretsRaw = async (req: Request, res: Response) => {
       }
       folderId = folder.id;
     }
-    const importedSecrets = await getAllImportedSecrets(workspaceId, environment, folderId);
+    const importedSecrets = await getAllImportedSecrets(
+      workspaceId,
+      environment,
+      folderId,
+      permissionCheckFn
+    );
     return res.status(200).send({
       secrets: secrets.map((secret) =>
         repackageSecretToRaw({
@@ -76,11 +145,26 @@ export const getSecretsRaw = async (req: Request, res: Response) => {
  * @param res
  */
 export const getSecretByNameRaw = async (req: Request, res: Response) => {
-  const { secretName } = req.params;
-  const workspaceId = req.query.workspaceId as string;
-  const environment = req.query.environment as string;
-  const secretPath = req.query.secretPath as string;
-  const type = req.query.type as "shared" | "personal" | undefined;
+  const {
+    query: { secretPath, environment, workspaceId, type },
+    params: { secretName }
+  } = await validateRequest(reqValidator.GetSecretByNameRawV3, req);
+
+  if (req.user?._id) {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
+  } else {
+    await validateServiceTokenDataClientForWorkspace({
+      serviceTokenData: req.authData.authPayload as IServiceTokenData,
+      workspaceId: new Types.ObjectId(workspaceId),
+      environment,
+      secretPath,
+      requiredPermissions: [PERMISSION_READ_SECRETS]
+    });
+  }
 
   const secret = await SecretService.getSecret({
     secretName,
@@ -109,8 +193,26 @@ export const getSecretByNameRaw = async (req: Request, res: Response) => {
  * @param res
  */
 export const createSecretRaw = async (req: Request, res: Response) => {
-  const { secretName } = req.params;
-  const { workspaceId, environment, type, secretValue, secretComment, secretPath = "/" } = req.body;
+  const {
+    params: { secretName },
+    body: { secretPath, environment, workspaceId, type, secretValue, secretComment }
+  } = await validateRequest(reqValidator.CreateSecretRawV3, req);
+
+  if (req.user?._id) {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Create,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
+  } else {
+    await validateServiceTokenDataClientForWorkspace({
+      serviceTokenData: req.authData.authPayload as IServiceTokenData,
+      workspaceId: new Types.ObjectId(workspaceId),
+      environment,
+      secretPath,
+      requiredPermissions: [PERMISSION_WRITE_SECRETS]
+    });
+  }
 
   const key = await BotService.getWorkspaceKeyWithBot({
     workspaceId: new Types.ObjectId(workspaceId)
@@ -174,8 +276,26 @@ export const createSecretRaw = async (req: Request, res: Response) => {
  * @param res
  */
 export const updateSecretByNameRaw = async (req: Request, res: Response) => {
-  const { secretName } = req.params;
-  const { workspaceId, environment, type, secretValue, secretPath = "/" } = req.body;
+  const {
+    params: { secretName },
+    body: { secretValue, environment, secretPath, type, workspaceId }
+  } = await validateRequest(reqValidator.UpdateSecretByNameRawV3, req);
+
+  if (req.user?._id) {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Edit,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
+  } else {
+    await validateServiceTokenDataClientForWorkspace({
+      serviceTokenData: req.authData.authPayload as IServiceTokenData,
+      workspaceId: new Types.ObjectId(workspaceId),
+      environment,
+      secretPath,
+      requiredPermissions: [PERMISSION_WRITE_SECRETS]
+    });
+  }
 
   const key = await BotService.getWorkspaceKeyWithBot({
     workspaceId: new Types.ObjectId(workspaceId)
@@ -188,7 +308,7 @@ export const updateSecretByNameRaw = async (req: Request, res: Response) => {
 
   const secret = await SecretService.updateSecret({
     secretName,
-    workspaceId,
+    workspaceId: new Types.ObjectId(workspaceId),
     environment,
     type,
     authData: req.authData,
@@ -220,12 +340,30 @@ export const updateSecretByNameRaw = async (req: Request, res: Response) => {
  * @param res
  */
 export const deleteSecretByNameRaw = async (req: Request, res: Response) => {
-  const { secretName } = req.params;
-  const { workspaceId, environment, type, secretPath = "/" } = req.body;
+  const {
+    params: { secretName },
+    body: { environment, secretPath, type, workspaceId }
+  } = await validateRequest(reqValidator.DeleteSecretByNameRawV3, req);
+
+  if (req.user?._id) {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Delete,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
+  } else {
+    await validateServiceTokenDataClientForWorkspace({
+      serviceTokenData: req.authData.authPayload as IServiceTokenData,
+      workspaceId: new Types.ObjectId(workspaceId),
+      environment,
+      secretPath,
+      requiredPermissions: [PERMISSION_WRITE_SECRETS]
+    });
+  }
 
   const { secret } = await SecretService.deleteSecret({
     secretName,
-    workspaceId,
+    workspaceId: new Types.ObjectId(workspaceId),
     environment,
     type,
     authData: req.authData,
@@ -259,14 +397,53 @@ export const deleteSecretByNameRaw = async (req: Request, res: Response) => {
  * @param res
  */
 export const getSecrets = async (req: Request, res: Response) => {
-  const workspaceId = req.query.workspaceId as string;
-  const environment = req.query.environment as string;
-  const secretPath = req.query.secretPath as string;
-  const includeImports = req.query.include_imports as string;
+  const validatedData = await validateRequest(reqValidator.GetSecretsV3, req);
+  const {
+    query: { environment, workspaceId, include_imports: includeImports, folderId }
+  } = validatedData;
+
+  let {
+    query: { secretPath }
+  } = validatedData;
+
+  if (folderId && folderId !== "root") {
+    const folder = await Folder.findOne({ workspace: workspaceId, environment });
+    if (!folder) throw BadRequestError({ message: "Folder not found" });
+
+    secretPath = getFolderWithPathFromId(folder.nodes, folderId).folderPath;
+  }
+
+  let permissionCheckFn: (env: string, secPath: string) => boolean; // used to pass as callback function to import secret
+  if (req.user?._id) {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
+    permissionCheckFn = (env: string, secPath: string) =>
+      permission.can(
+        ProjectPermissionActions.Read,
+        subject(ProjectPermissionSub.Secrets, {
+          environment: env,
+          secretPath: secPath
+        })
+      );
+  } else {
+    await validateServiceTokenDataClientForWorkspace({
+      serviceTokenData: req.authData.authPayload as IServiceTokenData,
+      workspaceId: new Types.ObjectId(workspaceId),
+      environment,
+      secretPath,
+      requiredPermissions: [PERMISSION_READ_SECRETS]
+    });
+    permissionCheckFn = (env: string, secPath: string) =>
+      isValidScope(req.authData.authPayload as IServiceTokenData, env, secPath);
+  }
 
   const secrets = await SecretService.getSecrets({
     workspaceId: new Types.ObjectId(workspaceId),
     environment,
+    folderId,
     secretPath,
     authData: req.authData
   });
@@ -282,7 +459,12 @@ export const getSecrets = async (req: Request, res: Response) => {
       }
       folderId = folder.id;
     }
-    const importedSecrets = await getAllImportedSecrets(workspaceId, environment, folderId);
+    const importedSecrets = await getAllImportedSecrets(
+      workspaceId,
+      environment,
+      folderId,
+      permissionCheckFn
+    );
     return res.status(200).send({
       secrets,
       imports: importedSecrets
@@ -300,11 +482,26 @@ export const getSecrets = async (req: Request, res: Response) => {
  * @param res
  */
 export const getSecretByName = async (req: Request, res: Response) => {
-  const { secretName } = req.params;
-  const workspaceId = req.query.workspaceId as string;
-  const environment = req.query.environment as string;
-  const secretPath = req.query.secretPath as string;
-  const type = req.query.type as "shared" | "personal" | undefined;
+  const {
+    query: { secretPath, environment, workspaceId, type },
+    params: { secretName }
+  } = await validateRequest(reqValidator.GetSecretByNameV3, req);
+
+  if (req.user?._id) {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
+  } else {
+    await validateServiceTokenDataClientForWorkspace({
+      serviceTokenData: req.authData.authPayload as IServiceTokenData,
+      workspaceId: new Types.ObjectId(workspaceId),
+      environment,
+      secretPath,
+      requiredPermissions: [PERMISSION_READ_SECRETS]
+    });
+  }
 
   const secret = await SecretService.getSecret({
     secretName,
@@ -326,22 +523,41 @@ export const getSecretByName = async (req: Request, res: Response) => {
  * @param res
  */
 export const createSecret = async (req: Request, res: Response) => {
-  const { secretName } = req.params;
   const {
-    workspaceId,
-    environment,
-    type,
-    secretKeyCiphertext,
-    secretKeyIV,
-    secretKeyTag,
-    secretValueCiphertext,
-    secretValueIV,
-    secretValueTag,
-    secretCommentCiphertext,
-    secretCommentIV,
-    secretCommentTag,
-    secretPath = "/"
-  } = req.body;
+    body: {
+      workspaceId,
+      secretPath,
+      environment,
+      metadata,
+      type,
+      secretKeyIV,
+      secretKeyTag,
+      secretValueIV,
+      secretValueTag,
+      secretCommentIV,
+      secretCommentTag,
+      secretKeyCiphertext,
+      secretValueCiphertext,
+      secretCommentCiphertext
+    },
+    params: { secretName }
+  } = await validateRequest(reqValidator.CreateSecretV3, req);
+
+  if (req.user?._id) {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Create,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
+  } else {
+    await validateServiceTokenDataClientForWorkspace({
+      serviceTokenData: req.authData.authPayload as IServiceTokenData,
+      workspaceId: new Types.ObjectId(workspaceId),
+      environment,
+      secretPath,
+      requiredPermissions: [PERMISSION_WRITE_SECRETS]
+    });
+  }
 
   const secret = await SecretService.createSecret({
     secretName,
@@ -358,7 +574,8 @@ export const createSecret = async (req: Request, res: Response) => {
     secretPath,
     secretCommentCiphertext,
     secretCommentIV,
-    secretCommentTag
+    secretCommentTag,
+    metadata
   });
 
   await EventService.handleEvent({
@@ -383,20 +600,38 @@ export const createSecret = async (req: Request, res: Response) => {
  * @param res
  */
 export const updateSecretByName = async (req: Request, res: Response) => {
-  const { secretName } = req.params;
   const {
-    workspaceId,
-    environment,
-    type,
-    secretValueCiphertext,
-    secretValueIV,
-    secretValueTag,
-    secretPath = "/"
-  } = req.body;
+    body: {
+      secretValueCiphertext,
+      secretValueTag,
+      secretValueIV,
+      type,
+      environment,
+      secretPath,
+      workspaceId
+    },
+    params: { secretName }
+  } = await validateRequest(reqValidator.UpdateSecretByNameV3, req);
+
+  if (req.user?._id) {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Edit,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
+  } else {
+    await validateServiceTokenDataClientForWorkspace({
+      serviceTokenData: req.authData.authPayload as IServiceTokenData,
+      workspaceId: new Types.ObjectId(workspaceId),
+      environment,
+      secretPath,
+      requiredPermissions: [PERMISSION_WRITE_SECRETS]
+    });
+  }
 
   const secret = await SecretService.updateSecret({
     secretName,
-    workspaceId,
+    workspaceId: new Types.ObjectId(workspaceId),
     environment,
     type,
     authData: req.authData,
@@ -425,12 +660,30 @@ export const updateSecretByName = async (req: Request, res: Response) => {
  * @param res
  */
 export const deleteSecretByName = async (req: Request, res: Response) => {
-  const { secretName } = req.params;
-  const { workspaceId, environment, type, secretPath = "/" } = req.body;
+  const {
+    body: { type, environment, secretPath, workspaceId },
+    params: { secretName }
+  } = await validateRequest(reqValidator.DeleteSecretByNameV3, req);
+
+  if (req.user?._id) {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Delete,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
+  } else {
+    await validateServiceTokenDataClientForWorkspace({
+      serviceTokenData: req.authData.authPayload as IServiceTokenData,
+      workspaceId: new Types.ObjectId(workspaceId),
+      environment,
+      secretPath,
+      requiredPermissions: [PERMISSION_WRITE_SECRETS]
+    });
+  }
 
   const { secret } = await SecretService.deleteSecret({
     secretName,
-    workspaceId,
+    workspaceId: new Types.ObjectId(workspaceId),
     environment,
     type,
     authData: req.authData,

backend/src/controllers/v3/signupController.ts

@@ -3,16 +3,16 @@ import { Request, Response } from "express";
 import * as Sentry from "@sentry/node";
 import { MembershipOrg, User } from "../../models";
 import { completeAccount } from "../../helpers/user";
-import {
-	initializeDefaultOrg,
-} from "../../helpers/signup";
+import { initializeDefaultOrg } from "../../helpers/signup";
 import { issueAuthTokens, validateProviderAuthToken } from "../../helpers/auth";
 import { ACCEPTED, INVITED } from "../../variables";
 import { standardRequest } from "../../config/request";
 import { getHttpsEnabled, getJwtSignupSecret, getLoopsApiKey } from "../../config";
 import { BadRequestError } from "../../utils/errors";
 import { TelemetryService } from "../../services";
-import { AuthProvider } from "../../models";
+import { AuthMethod } from "../../models";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/auth";
 
 /**
  * Complete setting up user by adding their personal and auth information as part of the
@@ -22,176 +22,173 @@ import { AuthProvider } from "../../models";
  * @returns
  */
 export const completeAccountSignup = async (req: Request, res: Response) => {
-	let user, token, refreshToken;
-	try {
-		const {
-			email,
-			firstName,
-			lastName,
-			protectedKey,
-			protectedKeyIV,
-			protectedKeyTag,
-			publicKey,
-			encryptedPrivateKey,
-			encryptedPrivateKeyIV,
-			encryptedPrivateKeyTag,
-			salt,
-			verifier,
-			organizationName,
-			providerAuthToken,
-			attributionSource,
-		}: {
-			email: string;
-			firstName: string;
-			lastName: string;
-			protectedKey: string;
-			protectedKeyIV: string;
-			protectedKeyTag: string;
-			publicKey: string;
-			encryptedPrivateKey: string;
-			encryptedPrivateKeyIV: string;
-			encryptedPrivateKeyTag: string;
-			salt: string;
-			verifier: string;
-			organizationName: string;
-			providerAuthToken?: string;
-			attributionSource?: string;
-		} = req.body;
+  let user, token;
+  try {
+    const {
+      body: {
+        email,
+        publicKey,
+        salt,
+        lastName,
+        verifier,
+        firstName,
+        protectedKey,
+        protectedKeyIV,
+        protectedKeyTag,
+        organizationName,
+        providerAuthToken,
+        attributionSource,
+        encryptedPrivateKey,
+        encryptedPrivateKeyIV,
+        encryptedPrivateKeyTag
+      }
+    } = await validateRequest(reqValidator.CompletedAccountSignupV3, req);
 
-		user = await User.findOne({ email });
+    user = await User.findOne({ email });
 
-		if (!user || (user && user?.publicKey)) {
-			// case 1: user doesn't exist.
-			// case 2: user has already completed account
-			return res.status(403).send({
-				error: "Failed to complete account for complete user",
-			});
-		}
+    if (!user || (user && user?.publicKey)) {
+      // case 1: user doesn't exist.
+      // case 2: user has already completed account
+      return res.status(403).send({
+        error: "Failed to complete account for complete user"
+      });
+    }
 
-		if (providerAuthToken) {
-			await validateProviderAuthToken({
-				email,
-				providerAuthToken,
-				user,
-			});
-		} else {
-			const [AUTH_TOKEN_TYPE, AUTH_TOKEN_VALUE] = <[string, string]>req.headers["authorization"]?.split(" ", 2) ?? [null, null]
-			if (AUTH_TOKEN_TYPE === null) {
-				throw BadRequestError({ message: "Missing Authorization Header in the request header." });
-			}
-			if (AUTH_TOKEN_TYPE.toLowerCase() !== "bearer") {
-				throw BadRequestError({ message: `The provided authentication type '${AUTH_TOKEN_TYPE}' is not supported.` })
-			}
-			if (AUTH_TOKEN_VALUE === null) {
-				throw BadRequestError({
-					message: "Missing Authorization Body in the request header",
-				})
-			}
+    if (providerAuthToken) {
+      await validateProviderAuthToken({
+        email,
+        providerAuthToken
+      });
+    } else {
+      const [AUTH_TOKEN_TYPE, AUTH_TOKEN_VALUE] = <[string, string]>(
+        req.headers["authorization"]?.split(" ", 2)
+      ) ?? [null, null];
+      if (AUTH_TOKEN_TYPE === null) {
+        throw BadRequestError({ message: "Missing Authorization Header in the request header." });
+      }
+      if (AUTH_TOKEN_TYPE.toLowerCase() !== "bearer") {
+        throw BadRequestError({
+          message: `The provided authentication type '${AUTH_TOKEN_TYPE}' is not supported.`
+        });
+      }
+      if (AUTH_TOKEN_VALUE === null) {
+        throw BadRequestError({
+          message: "Missing Authorization Body in the request header"
+        });
+      }
 
-			const decodedToken = <jwt.UserIDJwtPayload>(
-				jwt.verify(AUTH_TOKEN_VALUE, await getJwtSignupSecret())
-			);
+      const decodedToken = <jwt.UserIDJwtPayload>(
+        jwt.verify(AUTH_TOKEN_VALUE, await getJwtSignupSecret())
+      );
 
-			if (decodedToken.userId !== user.id) {
-				throw BadRequestError();
-			}
-		}
+      if (decodedToken.userId !== user.id) {
+        throw BadRequestError();
+      }
+    }
 
-		// complete setting up user's account
-		user = await completeAccount({
-			userId: user._id.toString(),
-			firstName,
-			lastName,
-			encryptionVersion: 2,
-			protectedKey,
-			protectedKeyIV,
-			protectedKeyTag,
-			publicKey,
-			encryptedPrivateKey,
-			encryptedPrivateKeyIV,
-			encryptedPrivateKeyTag,
-			salt,
-			verifier,
-		});
+    // complete setting up user's account
+    user = await completeAccount({
+      userId: user._id.toString(),
+      firstName,
+      lastName,
+      encryptionVersion: 2,
+      protectedKey,
+      protectedKeyIV,
+      protectedKeyTag,
+      publicKey,
+      encryptedPrivateKey,
+      encryptedPrivateKeyIV,
+      encryptedPrivateKeyTag,
+      salt,
+      verifier
+    });
 
-		if (!user)
-			throw new Error("Failed to complete account for non-existent user"); // ensure user is non-null
+    if (!user) throw new Error("Failed to complete account for non-existent user"); // ensure user is non-null
 
-		if (user.authProvider !== AuthProvider.OKTA_SAML) {
-			// initialize default organization and workspace
-			await initializeDefaultOrg({
-				organizationName,
-				user,
-			});
-		}
+    const hasSamlEnabled = user.authMethods.some((authMethod: AuthMethod) =>
+      [AuthMethod.OKTA_SAML, AuthMethod.AZURE_SAML, AuthMethod.JUMPCLOUD_SAML].includes(authMethod)
+    );
 
-		// update organization membership statuses that are
-		// invited to completed with user attached
-		await MembershipOrg.updateMany(
-			{
-				inviteEmail: email,
-				status: INVITED,
-			},
-			{
-				user,
-				status: ACCEPTED,
-			}
-		);
+    if (!hasSamlEnabled) {
+      // TODO: modify this part
+      // initialize default organization and workspace
+      await initializeDefaultOrg({
+        organizationName,
+        user
+      });
+    }
 
-		// issue tokens
-		const tokens = await issueAuthTokens({
-			userId: user._id,
-			ip: req.realIP,
-			userAgent: req.headers["user-agent"] ?? "",
-		});
+    // update organization membership statuses that are
+    // invited to completed with user attached
+    await MembershipOrg.updateMany(
+      {
+        inviteEmail: email,
+        status: INVITED
+      },
+      {
+        user,
+        status: ACCEPTED
+      }
+    );
 
-		token = tokens.token;
+    // issue tokens
+    const tokens = await issueAuthTokens({
+      userId: user._id,
+      ip: req.realIP,
+      userAgent: req.headers["user-agent"] ?? ""
+    });
 
-		// sending a welcome email to new users
-		if (await getLoopsApiKey()) {
-			await standardRequest.post("https://app.loops.so/api/v1/events/send", {
-				"email": email,
-				"eventName": "Sign Up",
-				"firstName": firstName,
-				"lastName": lastName,
-			}, {
-				headers: {
-					"Accept": "application/json",
-					"Authorization": "Bearer " + (await getLoopsApiKey()),
-				},
-			});
-		}
+    token = tokens.token;
 
-		// store (refresh) token in httpOnly cookie
-		res.cookie("jid", tokens.refreshToken, {
-			httpOnly: true,
-			path: "/",
-			sameSite: "strict",
-			secure: await getHttpsEnabled(),
-		});
+    // sending a welcome email to new users
+    if (await getLoopsApiKey()) {
+      await standardRequest.post(
+        "https://app.loops.so/api/v1/events/send",
+        {
+          email: email,
+          eventName: "Sign Up",
+          firstName: firstName,
+          lastName: lastName
+        },
+        {
+          headers: {
+            Accept: "application/json",
+            Authorization: "Bearer " + (await getLoopsApiKey())
+          }
+        }
+      );
+    }
 
-		const postHogClient = await TelemetryService.getPostHogClient();
-		if (postHogClient) {
-			postHogClient.capture({
-				event: "User Signed Up",
-				distinctId: email,
-				properties: {
-					email,
-					...(attributionSource ? { attributionSource } : {})
-				},
-			});
-		}
-	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: "Failed to complete account setup",
-		});
-	}
+    // store (refresh) token in httpOnly cookie
+    res.cookie("jid", tokens.refreshToken, {
+      httpOnly: true,
+      path: "/",
+      sameSite: "strict",
+      secure: await getHttpsEnabled()
+    });
 
-	return res.status(200).send({
-		message: "Successfully set up account",
-		user,
-		token,
-	});
+    const postHogClient = await TelemetryService.getPostHogClient();
+    if (postHogClient) {
+      postHogClient.capture({
+        event: "User Signed Up",
+        distinctId: email,
+        properties: {
+          email,
+          ...(attributionSource ? { attributionSource } : {})
+        }
+      });
+    }
+  } catch (err) {
+    Sentry.setUser(null);
+    Sentry.captureException(err);
+    return res.status(400).send({
+      message: "Failed to complete account setup"
+    });
+  }
+
+  return res.status(200).send({
+    message: "Successfully set up account",
+    user,
+    token
+  });
 };

backend/src/controllers/v3/workspacesController.ts

@@ -1,90 +1,103 @@
 import { Request, Response } from "express";
 import { Types } from "mongoose";
+import { validateRequest } from "../../helpers/validation";
 import { Secret } from "../../models";
-import { SecretService } from"../../services";
+import { SecretService } from "../../services";
+import { getUserProjectPermissions } from "../../ee/services/ProjectRoleService";
+import { UnauthorizedRequestError } from "../../utils/errors";
+import * as reqValidator from "../../validation/workspace";
 
 /**
  * Return whether or not all secrets in workspace with id [workspaceId]
  * are blind-indexed
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const getWorkspaceBlindIndexStatus = async (req: Request, res: Response) => {
-    const { workspaceId } = req.params;
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetWorkspaceBlinkIndexStatusV3, req);
 
-    const secretsWithoutBlindIndex = await Secret.countDocuments({
-        workspace: new Types.ObjectId(workspaceId),
-        secretBlindIndex: {
-            $exists: false,
-        },
-    });
+  const { membership } = await getUserProjectPermissions(req.user._id, workspaceId);
+  if (membership.role !== "admin")
+    throw UnauthorizedRequestError({ message: "User must be an admin" });
 
-    return res.status(200).send(secretsWithoutBlindIndex === 0);
-}
+  const secretsWithoutBlindIndex = await Secret.countDocuments({
+    workspace: new Types.ObjectId(workspaceId),
+    secretBlindIndex: {
+      $exists: false
+    }
+  });
+
+  return res.status(200).send(secretsWithoutBlindIndex === 0);
+};
 
 /**
  * Get all secrets for workspace with id [workspaceId]
  */
 export const getWorkspaceSecrets = async (req: Request, res: Response) => {
-    const { workspaceId } = req.params;
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetWorkspaceSecretsV3, req);
 
-    const secrets = await Secret.find({
-        workspace: new Types.ObjectId (workspaceId),
-    });
-    
-    return res.status(200).send({
-        secrets,
-    });
-}
+  const { membership } = await getUserProjectPermissions(req.user._id, workspaceId);
+  if (membership.role !== "admin")
+    throw UnauthorizedRequestError({ message: "User must be an admin" });
+
+  const secrets = await Secret.find({
+    workspace: new Types.ObjectId(workspaceId)
+  });
+
+  return res.status(200).send({
+    secrets
+  });
+};
 
 /**
  * Update blind indices for secrets in workspace with id [workspaceId]
- * @param req 
- * @param res 
+ * @param req
+ * @param res
  */
 export const nameWorkspaceSecrets = async (req: Request, res: Response) => {
-    interface SecretToUpdate {
-        secretName: string;
-        _id: string;
-    }
+  const {
+    params: { workspaceId },
+    body: { secretsToUpdate }
+  } = await validateRequest(reqValidator.NameWorkspaceSecretsV3, req);
 
-    const { workspaceId } = req.params;
-    const { 
-        secretsToUpdate, 
-    }: {
-        secretsToUpdate: SecretToUpdate[];
-    } = req.body;
+  const { membership } = await getUserProjectPermissions(req.user._id, workspaceId);
+  if (membership.role !== "admin")
+    throw UnauthorizedRequestError({ message: "User must be an admin" });
 
-    // get secret blind index salt
-    const salt = await SecretService.getSecretBlindIndexSalt({
-        workspaceId: new Types.ObjectId(workspaceId),
-    });
+  // get secret blind index salt
+  const salt = await SecretService.getSecretBlindIndexSalt({
+    workspaceId: new Types.ObjectId(workspaceId)
+  });
 
-    // update secret blind indices
-    const operations = await Promise.all(
-        secretsToUpdate.map(async (secretToUpdate: SecretToUpdate) => {
-            const secretBlindIndex = await SecretService.generateSecretBlindIndexWithSalt({
-                secretName: secretToUpdate.secretName,
-                salt,
-            });
-    
-            return ({
-                updateOne: {
-                    filter: {
-                        _id: new Types.ObjectId(secretToUpdate._id),
-                    },
-                    update: {
-                        secretBlindIndex,
-                    },
-                },
-            });
-        })
-    );
+  // update secret blind indices
+  const operations = await Promise.all(
+    secretsToUpdate.map(async (secretToUpdate) => {
+      const secretBlindIndex = await SecretService.generateSecretBlindIndexWithSalt({
+        secretName: secretToUpdate.secretName,
+        salt
+      });
 
-    await Secret.bulkWrite(operations);
+      return {
+        updateOne: {
+          filter: {
+            _id: new Types.ObjectId(secretToUpdate._id)
+          },
+          update: {
+            secretBlindIndex
+          }
+        }
+      };
+    })
+  );
 
-    return res.status(200).send({
-        message: "Successfully named workspace secrets",
-    });
-}
+  await Secret.bulkWrite(operations);
+
+  return res.status(200).send({
+    message: "Successfully named workspace secrets"
+  });
+};

backend/src/ee/controllers/v1/actionController.ts

@@ -1,30 +1,32 @@
 import { Request, Response } from "express";
 import { Action } from "../../models";
 import { ActionNotFoundError } from "../../../utils/errors";
+import { validateRequest } from "../../../helpers/validation";
+import * as reqValidator from "../../../validation/action";
 
 export const getAction = async (req: Request, res: Response) => {
-    let action;
-    try {
-        const { actionId } = req.params;
-        
-        action = await Action
-            .findById(actionId)
-            .populate([
-                "payload.secretVersions.oldSecretVersion",
-                "payload.secretVersions.newSecretVersion",
-            ]);
-        
-        if (!action) throw ActionNotFoundError({
-            message: "Failed to find action",
-        });
+  let action;
+  try {
+    const {
+      params: { actionId }
+    } = await validateRequest(reqValidator.GetActionV1, req);
 
-    } catch (err) {
-        throw ActionNotFoundError({
-            message: "Failed to find action",
-        });
-    }
-    
-    return res.status(200).send({
-        action,
+    action = await Action.findById(actionId).populate([
+      "payload.secretVersions.oldSecretVersion",
+      "payload.secretVersions.newSecretVersion"
+    ]);
+
+    if (!action)
+      throw ActionNotFoundError({
+        message: "Failed to find action"
+      });
+  } catch (err) {
+    throw ActionNotFoundError({
+      message: "Failed to find action"
     });
-}
+  }
+
+  return res.status(200).send({
+    action
+  });
+};

backend/src/ee/controllers/v1/cloudProductsController.ts

@@ -2,27 +2,31 @@ import { Request, Response } from "express";
 import { EELicenseService } from "../../services";
 import { getLicenseServerUrl } from "../../../config";
 import { licenseServerKeyRequest } from "../../../config/request";
+import { validateRequest } from "../../../helpers/validation";
+import * as reqValidator from "../../../validation/cloudProducts";
 
 /**
  * Return available cloud product information.
  * Note: Nicely formatted to easily construct a table from
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const getCloudProducts = async (req: Request, res: Response) => {
-    const billingCycle = req.query["billing-cycle"] as string;
+  const {
+    query: { "billing-cycle": billingCycle }
+  } = await validateRequest(reqValidator.GetCloudProductsV1, req);
 
-    if (EELicenseService.instanceType === "cloud") {
-        const { data } = await licenseServerKeyRequest.get(
-            `${await getLicenseServerUrl()}/api/license-server/v1/cloud-products?billing-cycle=${billingCycle}`
-        ); 
+  if (EELicenseService.instanceType === "cloud") {
+    const { data } = await licenseServerKeyRequest.get(
+      `${await getLicenseServerUrl()}/api/license-server/v1/cloud-products?billing-cycle=${billingCycle}`
+    );
 
-        return res.status(200).send(data);
-    }
-    
-    return res.status(200).send({
-        head: [],
-        rows: [],
-    });
-}
+    return res.status(200).send(data);
+  }
+
+  return res.status(200).send({
+    head: [],
+    rows: []
+  });
+};

backend/src/ee/controllers/v1/index.ts

@@ -2,18 +2,22 @@ import * as secretController from "./secretController";
 import * as secretSnapshotController from "./secretSnapshotController";
 import * as organizationsController from "./organizationsController";
 import * as ssoController from "./ssoController";
+import * as usersController from "./usersController";
 import * as workspaceController from "./workspaceController";
 import * as actionController from "./actionController";
 import * as membershipController from "./membershipController";
 import * as cloudProductsController from "./cloudProductsController";
+import * as roleController from "./roleController";
 
 export {
-    secretController,
-    secretSnapshotController,
-    organizationsController,
-    ssoController,
-    workspaceController,
-    actionController,
-    membershipController,
-    cloudProductsController,
-}
+  secretController,
+  secretSnapshotController,
+  organizationsController,
+  ssoController,
+  usersController,
+  workspaceController,
+  actionController,
+  membershipController,
+  cloudProductsController,
+  roleController
+};

backend/src/ee/controllers/v1/membershipController.ts

@@ -1,10 +1,12 @@
 import { Request, Response } from "express";
-import { Membership, Workspace } from "../../../models";
+import { IUser, Membership, Workspace } from "../../../models";
+import { EventType } from "../../../ee/models";
 import { IMembershipPermission } from "../../../models/membership";
 import { BadRequestError, UnauthorizedRequestError } from "../../../utils/errors";
 import { ADMIN, MEMBER } from "../../../variables/organization";
 import { PERMISSION_READ_SECRETS, PERMISSION_WRITE_SECRETS } from "../../../variables";
 import _ from "lodash";
+import { EEAuditLogService } from "../../services";
 
 export const denyMembershipPermissions = async (req: Request, res: Response) => {
   const { membershipId } = req.params;
@@ -51,12 +53,33 @@ export const denyMembershipPermissions = async (req: Request, res: Response) =>
     { _id: membershipToModify._id },
     { $set: { deniedPermissions: sanitizedMembershipPermissionsUnique } },
     { new: true }
-  )
+  ).populate<{ user: IUser }>("user");
 
   if (!updatedMembershipWithPermissions) {
     throw BadRequestError({ message: "The resource has been removed before it can be modified" })
   }
 
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.UPDATE_USER_WORKSPACE_DENIED_PERMISSIONS,
+      metadata: {
+        userId: updatedMembershipWithPermissions.user._id.toString(),
+        email: updatedMembershipWithPermissions.user.email,
+        deniedPermissions: updatedMembershipWithPermissions.deniedPermissions.map(({
+          environmentSlug,
+          ability
+        }) => ({
+          environmentSlug,
+          ability
+        }))
+      }
+    },
+    {
+      workspaceId: updatedMembershipWithPermissions.workspace
+    }
+  );
+
   res.send({
     permissionsDenied: updatedMembershipWithPermissions.deniedPermissions,
   })

backend/src/ee/controllers/v1/organizationsController.ts

@@ -1,209 +1,505 @@
+import { Types } from "mongoose";
 import { Request, Response } from "express";
 import { getLicenseServerUrl } from "../../../config";
 import { licenseServerKeyRequest } from "../../../config/request";
 import { EELicenseService } from "../../services";
+import { validateRequest } from "../../../helpers/validation";
+import * as reqValidator from "../../../validation/organization";
+import {
+  OrgPermissionActions,
+  OrgPermissionSubjects,
+  getUserOrgPermissions
+} from "../../services/RoleService";
+import { ForbiddenError } from "@casl/ability";
+import { Organization } from "../../../models";
+import { OrganizationNotFoundError } from "../../../utils/errors";
 
 export const getOrganizationPlansTable = async (req: Request, res: Response) => {
-    const billingCycle = req.query.billingCycle as string;
-    
-    const { data } = await licenseServerKeyRequest.get(
-        `${await getLicenseServerUrl()}/api/license-server/v1/cloud-products?billing-cycle=${billingCycle}`
-    ); 
+  const {
+    query: { billingCycle },
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgPlansTablev1, req);
 
-    return res.status(200).send(data); 
-}
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Read,
+    OrgPermissionSubjects.Billing
+  );
+
+  const { data } = await licenseServerKeyRequest.get(
+    `${await getLicenseServerUrl()}/api/license-server/v1/cloud-products?billing-cycle=${billingCycle}`
+  );
+
+  return res.status(200).send(data);
+};
 
 /**
  * Return the organization current plan's feature set
  */
 export const getOrganizationPlan = async (req: Request, res: Response) => {
-    const { organizationId } = req.params;
-    const workspaceId = req.query.workspaceId as string;
+  const {
+    query: { workspaceId },
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgPlanv1, req);
 
-    const plan = await EELicenseService.getPlan(organizationId, workspaceId);
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Read,
+    OrgPermissionSubjects.Billing
+  );
 
-    return res.status(200).send({
-        plan,
-    });
-}
+  const plan = await EELicenseService.getPlan(
+    new Types.ObjectId(organizationId),
+    new Types.ObjectId(workspaceId)
+  );
+
+  return res.status(200).send({
+    plan
+  });
+};
 
 /**
  * Return checkout url for pro trial
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const startOrganizationTrial = async (req: Request, res: Response) => {
-    const { organizationId } = req.params;
-    const { success_url } = req.body;
+  const {
+    params: { organizationId },
+    body: { success_url }
+  } = await validateRequest(reqValidator.StartOrgTrailv1, req);
 
-    const { data: { url } } = await licenseServerKeyRequest.post(
-        `${await getLicenseServerUrl()}/api/license-server/v1/customers/${req.organization.customerId}/session/trial`,
-        {
-            success_url
-        }
-    ); 
-    
-    EELicenseService.delPlan(organizationId);
-    
-    return res.status(200).send({
-        url
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Create,
+    OrgPermissionSubjects.Billing
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Edit,
+    OrgPermissionSubjects.Billing
+  );
+
+  const organization = await Organization.findById(organizationId);
+  if (!organization) {
+    throw OrganizationNotFoundError({
+      message: "Failed to find organization"
     });
-}
+  }
+
+  const {
+    data: { url }
+  } = await licenseServerKeyRequest.post(
+    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
+      organization.customerId
+    }/session/trial`,
+    {
+      success_url
+    }
+  );
+
+  EELicenseService.delPlan(new Types.ObjectId(organizationId));
+
+  return res.status(200).send({
+    url
+  });
+};
 
 /**
  * Return the organization's current plan's billing info
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const getOrganizationPlanBillingInfo = async (req: Request, res: Response) => {
-    const { data } = await licenseServerKeyRequest.get(
-        `${await getLicenseServerUrl()}/api/license-server/v1/customers/${req.organization.customerId}/cloud-plan/billing`
-    ); 
-    
-    return res.status(200).send(data);
-}
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgPlanBillingInfov1, req);
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Read,
+    OrgPermissionSubjects.Billing
+  );
+
+  const organization = await Organization.findById(organizationId);
+  if (!organization) {
+    throw OrganizationNotFoundError({
+      message: "Failed to find organization"
+    });
+  }
+
+  const { data } = await licenseServerKeyRequest.get(
+    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
+      organization.customerId
+    }/cloud-plan/billing`
+  );
+
+  return res.status(200).send(data);
+};
 
 /**
  * Return the organization's current plan's feature table
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const getOrganizationPlanTable = async (req: Request, res: Response) => {
-    const { data } = await licenseServerKeyRequest.get(
-        `${await getLicenseServerUrl()}/api/license-server/v1/customers/${req.organization.customerId}/cloud-plan/table`
-    ); 
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgPlanTablev1, req);
 
-    return res.status(200).send(data);
-}
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Read,
+    OrgPermissionSubjects.Billing
+  );
+
+  const organization = await Organization.findById(organizationId);
+  if (!organization) {
+    throw OrganizationNotFoundError({
+      message: "Failed to find organization"
+    });
+  }
+
+  const { data } = await licenseServerKeyRequest.get(
+    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
+      organization.customerId
+    }/cloud-plan/table`
+  );
+
+  return res.status(200).send(data);
+};
 
 export const getOrganizationBillingDetails = async (req: Request, res: Response) => {
-    const { data  } = await licenseServerKeyRequest.get(
-        `${await getLicenseServerUrl()}/api/license-server/v1/customers/${req.organization.customerId}/billing-details`
-    ); 
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgBillingDetailsv1, req);
 
-    return res.status(200).send(data);
-}
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Read,
+    OrgPermissionSubjects.Billing
+  );
+
+  const organization = await Organization.findById(organizationId);
+  if (!organization) {
+    throw OrganizationNotFoundError({
+      message: "Failed to find organization"
+    });
+  }
+
+  const { data } = await licenseServerKeyRequest.get(
+    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
+      organization.customerId
+    }/billing-details`
+  );
+
+  return res.status(200).send(data);
+};
 
 export const updateOrganizationBillingDetails = async (req: Request, res: Response) => {
-    const {
-        name,
-        email
-    } = req.body;
+  const {
+    params: { organizationId },
+    body: { name, email }
+  } = await validateRequest(reqValidator.UpdateOrgBillingDetailsv1, req);
 
-    const { data } = await licenseServerKeyRequest.patch(
-        `${await getLicenseServerUrl()}/api/license-server/v1/customers/${req.organization.customerId}/billing-details`,
-        {
-            ...(name ? { name } : {}),
-            ...(email ? { email } : {})
-        }
-    ); 
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Edit,
+    OrgPermissionSubjects.Billing
+  );
 
-    return res.status(200).send(data); 
-}
+  const organization = await Organization.findById(organizationId);
+  if (!organization) {
+    throw OrganizationNotFoundError({
+      message: "Failed to find organization"
+    });
+  }
+
+  const { data } = await licenseServerKeyRequest.patch(
+    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
+      organization.customerId
+    }/billing-details`,
+    {
+      ...(name ? { name } : {}),
+      ...(email ? { email } : {})
+    }
+  );
+
+  return res.status(200).send(data);
+};
 
 /**
  * Return the organization's payment methods on file
  */
 export const getOrganizationPmtMethods = async (req: Request, res: Response) => {
-    const { data: { pmtMethods } } = await licenseServerKeyRequest.get(
-        `${await getLicenseServerUrl()}/api/license-server/v1/customers/${req.organization.customerId}/billing-details/payment-methods`
-    );
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgPmtMethodsv1, req);
 
-    return res.status(200).send(pmtMethods); 
-}
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Read,
+    OrgPermissionSubjects.Billing
+  );
+
+  const organization = await Organization.findById(organizationId);
+  if (!organization) {
+    throw OrganizationNotFoundError({
+      message: "Failed to find organization"
+    });
+  }
+
+  const {
+    data: { pmtMethods }
+  } = await licenseServerKeyRequest.get(
+    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
+      organization.customerId
+    }/billing-details/payment-methods`
+  );
+
+  return res.status(200).send(pmtMethods);
+};
 
 /**
  * Return URL to add payment method for organization
  */
 export const addOrganizationPmtMethod = async (req: Request, res: Response) => {
-    const {
-        success_url,
-        cancel_url,
-    } = req.body;
-    
-    const { data: { url } } = await licenseServerKeyRequest.post(
-        `${await getLicenseServerUrl()}/api/license-server/v1/customers/${req.organization.customerId}/billing-details/payment-methods`,
-        {
-            success_url,
-            cancel_url,
-        }
-    );
-    
-    return res.status(200).send({
-        url,
-    }); 
-}
+  const {
+    params: { organizationId },
+    body: { success_url, cancel_url }
+  } = await validateRequest(reqValidator.CreateOrgPmtMethodv1, req);
 
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Create,
+    OrgPermissionSubjects.Billing
+  );
+
+  const organization = await Organization.findById(organizationId);
+  if (!organization) {
+    throw OrganizationNotFoundError({
+      message: "Failed to find organization"
+    });
+  }
+
+  const {
+    data: { url }
+  } = await licenseServerKeyRequest.post(
+    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
+      organization.customerId
+    }/billing-details/payment-methods`,
+    {
+      success_url,
+      cancel_url
+    }
+  );
+
+  return res.status(200).send({
+    url
+  });
+};
+
+/**
+ * Delete payment method with id [pmtMethodId] for organization
+ * @param req
+ * @param res
+ * @returns
+ */
 export const deleteOrganizationPmtMethod = async (req: Request, res: Response) => {
-    const { pmtMethodId } = req.params;
+  const {
+    params: { organizationId, pmtMethodId }
+  } = await validateRequest(reqValidator.DelOrgPmtMethodv1, req);
 
-    const { data } = await licenseServerKeyRequest.delete(
-        `${await getLicenseServerUrl()}/api/license-server/v1/customers/${req.organization.customerId}/billing-details/payment-methods/${pmtMethodId}`,
-    );
-        
-    return res.status(200).send(data);
-}
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Delete,
+    OrgPermissionSubjects.Billing
+  );
+
+  const organization = await Organization.findById(organizationId);
+  if (!organization) {
+    throw OrganizationNotFoundError({
+      message: "Failed to find organization"
+    });
+  }
+
+  const { data } = await licenseServerKeyRequest.delete(
+    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
+      organization.customerId
+    }/billing-details/payment-methods/${pmtMethodId}`
+  );
+
+  return res.status(200).send(data);
+};
 
 /**
  * Return the organization's tax ids on file
  */
 export const getOrganizationTaxIds = async (req: Request, res: Response) => {
-    const { data: { tax_ids } } = await licenseServerKeyRequest.get(
-        `${await getLicenseServerUrl()}/api/license-server/v1/customers/${req.organization.customerId}/billing-details/tax-ids`
-    );
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgTaxIdsv1, req);
 
-    return res.status(200).send(tax_ids); 
-}
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Read,
+    OrgPermissionSubjects.Billing
+  );
+
+  const organization = await Organization.findById(organizationId);
+  if (!organization) {
+    throw OrganizationNotFoundError({
+      message: "Failed to find organization"
+    });
+  }
+
+  const {
+    data: { tax_ids }
+  } = await licenseServerKeyRequest.get(
+    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
+      organization.customerId
+    }/billing-details/tax-ids`
+  );
+
+  return res.status(200).send(tax_ids);
+};
 
 /**
  * Add tax id to organization
  */
 export const addOrganizationTaxId = async (req: Request, res: Response) => {
-    const {
-        type,
-        value
-    } = req.body;
+  const {
+    params: { organizationId },
+    body: { type, value }
+  } = await validateRequest(reqValidator.CreateOrgTaxId, req);
 
-    const { data } = await licenseServerKeyRequest.post(
-        `${await getLicenseServerUrl()}/api/license-server/v1/customers/${req.organization.customerId}/billing-details/tax-ids`,
-        {
-            type,
-            value
-        }
-    );
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Create,
+    OrgPermissionSubjects.Billing
+  );
 
-    return res.status(200).send(data); 
-}
+  const organization = await Organization.findById(organizationId);
+  if (!organization) {
+    throw OrganizationNotFoundError({
+      message: "Failed to find organization"
+    });
+  }
+
+  const { data } = await licenseServerKeyRequest.post(
+    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
+      organization.customerId
+    }/billing-details/tax-ids`,
+    {
+      type,
+      value
+    }
+  );
+
+  return res.status(200).send(data);
+};
 
 /**
  * Delete tax id with id [taxId] from organization tax ids on file
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const deleteOrganizationTaxId = async (req: Request, res: Response) => {
-    const { taxId } = req.params;
+  const {
+    params: { organizationId, taxId }
+  } = await validateRequest(reqValidator.DelOrgTaxIdv1, req);
 
-    const { data } = await licenseServerKeyRequest.delete(
-        `${await getLicenseServerUrl()}/api/license-server/v1/customers/${req.organization.customerId}/billing-details/tax-ids/${taxId}`,
-    );
-        
-    return res.status(200).send(data); 
-}
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Delete,
+    OrgPermissionSubjects.Billing
+  );
+
+  const organization = await Organization.findById(organizationId);
+  if (!organization) {
+    throw OrganizationNotFoundError({
+      message: "Failed to find organization"
+    });
+  }
+
+  const { data } = await licenseServerKeyRequest.delete(
+    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
+      organization.customerId
+    }/billing-details/tax-ids/${taxId}`
+  );
+
+  return res.status(200).send(data);
+};
 
 /**
  * Return organization's invoices on file
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const getOrganizationInvoices = async (req: Request, res: Response) => {
-    const { data: { invoices } } = await licenseServerKeyRequest.get(
-        `${await getLicenseServerUrl()}/api/license-server/v1/customers/${req.organization.customerId}/invoices`
-    );
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgInvoicesv1, req);
 
-    return res.status(200).send(invoices); 
-}
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Read,
+    OrgPermissionSubjects.Billing
+  );
+
+  const organization = await Organization.findById(organizationId);
+  if (!organization) {
+    throw OrganizationNotFoundError({
+      message: "Failed to find organization"
+    });
+  }
+
+  const {
+    data: { invoices }
+  } = await licenseServerKeyRequest.get(
+    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
+      organization.customerId
+    }/invoices`
+  );
+
+  return res.status(200).send(invoices);
+};
+
+/**
+ * Return organization's licenses on file
+ * @param req
+ * @param res
+ * @returns
+ */
+export const getOrganizationLicenses = async (req: Request, res: Response) => {
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgLicencesv1, req);
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Read,
+    OrgPermissionSubjects.Billing
+  );
+
+  const organization = await Organization.findById(organizationId);
+  if (!organization) {
+    throw OrganizationNotFoundError({
+      message: "Failed to find organization"
+    });
+  }
+
+  const {
+    data: { licenses }
+  } = await licenseServerKeyRequest.get(
+    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
+      organization.customerId
+    }/licenses`
+  );
+
+  return res.status(200).send(licenses);
+};

backend/src/ee/controllers/v1/roleController.ts

@@ -0,0 +1,235 @@
+import { Request, Response } from "express";
+import {
+  CreateRoleSchema,
+  DeleteRoleSchema,
+  GetRoleSchema,
+  GetUserPermission,
+  GetUserProjectPermission,
+  UpdateRoleSchema
+} from "../../validation/role";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  adminProjectPermissions,
+  getUserProjectPermissions,
+  memberProjectPermissions,
+  viewerProjectPermission
+} from "../../services/ProjectRoleService";
+import {
+  OrgPermissionActions,
+  OrgPermissionSubjects,
+  adminPermissions,
+  getUserOrgPermissions,
+  memberPermissions
+} from "../../services/RoleService";
+import { BadRequestError } from "../../../utils/errors";
+import Role from "../../models/role";
+import { validateRequest } from "../../../helpers/validation";
+import { packRules } from "@casl/ability/extra";
+
+export const createRole = async (req: Request, res: Response) => {
+  const {
+    body: { workspaceId, name, description, slug, permissions, orgId }
+  } = await validateRequest(CreateRoleSchema, req);
+
+  const isOrgRole = !workspaceId; // if workspaceid is provided then its a workspace rule
+  if (isOrgRole) {
+    const { permission } = await getUserOrgPermissions(req.user.id, orgId);
+    if (permission.cannot(OrgPermissionActions.Create, OrgPermissionSubjects.Role)) {
+      throw BadRequestError({ message: "user doesn't have the permission." });
+    }
+  } else {
+    const { permission } = await getUserProjectPermissions(req.user.id, workspaceId);
+    if (permission.cannot(ProjectPermissionActions.Create, ProjectPermissionSub.Role)) {
+      throw BadRequestError({ message: "User doesn't have the permission." });
+    }
+  }
+
+  const existingRole = await Role.findOne({ organization: orgId, workspace: workspaceId, slug });
+  if (existingRole) {
+    throw BadRequestError({ message: "Role already exist" });
+  }
+
+  const role = new Role({
+    organization: orgId,
+    workspace: workspaceId,
+    isOrgRole,
+    name,
+    slug,
+    permissions,
+    description
+  });
+  await role.save();
+
+  res.status(200).json({
+    message: "Successfully created role",
+    data: {
+      role
+    }
+  });
+};
+
+export const updateRole = async (req: Request, res: Response) => {
+  const {
+    params: { id },
+    body: { name, description, slug, permissions, workspaceId, orgId }
+  } = await validateRequest(UpdateRoleSchema, req);
+  const isOrgRole = !workspaceId; // if workspaceid is provided then its a workspace rule
+
+  if (isOrgRole) {
+    const { permission } = await getUserOrgPermissions(req.user.id, orgId);
+    if (permission.cannot(OrgPermissionActions.Edit, OrgPermissionSubjects.Role)) {
+      throw BadRequestError({ message: "User doesn't have the org permission." });
+    }
+  } else {
+    const { permission } = await getUserProjectPermissions(req.user.id, workspaceId);
+    if (permission.cannot(ProjectPermissionActions.Edit, ProjectPermissionSub.Role)) {
+      throw BadRequestError({ message: "User doesn't have the workspace permission." });
+    }
+  }
+
+  if (slug) {
+    const existingRole = await Role.findOne({
+      organization: orgId,
+      slug,
+      isOrgRole,
+      workspace: workspaceId
+    });
+    if (existingRole && existingRole.id !== id) {
+      throw BadRequestError({ message: "Role already exist" });
+    }
+  }
+
+  const role = await Role.findByIdAndUpdate(
+    id,
+    { name, description, slug, permissions },
+    { returnDocument: "after" }
+  );
+
+  if (!role) {
+    throw BadRequestError({ message: "Role not found" });
+  }
+  res.status(200).json({
+    message: "Successfully updated role",
+    data: {
+      role
+    }
+  });
+};
+
+export const deleteRole = async (req: Request, res: Response) => {
+  const {
+    params: { id }
+  } = await validateRequest(DeleteRoleSchema, req);
+
+  const role = await Role.findById(id);
+  if (!role) {
+    throw BadRequestError({ message: "Role not found" });
+  }
+
+  const isOrgRole = !role.workspace;
+  if (isOrgRole) {
+    const { permission } = await getUserOrgPermissions(req.user.id, role.organization.toString());
+    if (permission.cannot(OrgPermissionActions.Delete, OrgPermissionSubjects.Role)) {
+      throw BadRequestError({ message: "User doesn't have the org permission." });
+    }
+  } else {
+    const { permission } = await getUserProjectPermissions(req.user.id, role.workspace.toString());
+    if (permission.cannot(ProjectPermissionActions.Delete, ProjectPermissionSub.Role)) {
+      throw BadRequestError({ message: "User doesn't have the workspace permission." });
+    }
+  }
+
+  await Role.findByIdAndDelete(role.id);
+
+  res.status(200).json({
+    message: "Successfully deleted role",
+    data: {
+      role
+    }
+  });
+};
+
+export const getRoles = async (req: Request, res: Response) => {
+  const {
+    query: { workspaceId, orgId }
+  } = await validateRequest(GetRoleSchema, req);
+
+  const isOrgRole = !workspaceId;
+  if (isOrgRole) {
+    const { permission } = await getUserOrgPermissions(req.user.id, orgId);
+    if (permission.cannot(OrgPermissionActions.Read, OrgPermissionSubjects.Role)) {
+      throw BadRequestError({ message: "User doesn't have the org permission." });
+    }
+  } else {
+    const { permission } = await getUserProjectPermissions(req.user.id, workspaceId);
+    if (permission.cannot(ProjectPermissionActions.Read, ProjectPermissionSub.Role)) {
+      throw BadRequestError({ message: "User doesn't have the workspace permission." });
+    }
+  }
+
+  const customRoles = await Role.find({ organization: orgId, isOrgRole, workspace: workspaceId });
+  // as this is shared between org and workspace switch the rule set based on it
+  const roles = [
+    {
+      _id: "admin",
+      name: "Admin",
+      slug: "admin",
+      description: "Complete administration access over the organization",
+      permissions: isOrgRole ? adminPermissions.rules : adminProjectPermissions.rules
+    },
+    {
+      _id: "member",
+      name: isOrgRole ? "Member" : "Developer",
+      slug: "member",
+      description: "Non-administrative role in an organization",
+      permissions: isOrgRole ? memberPermissions.rules : memberProjectPermissions.rules
+    },
+    // viewer role only for project level
+    ...(isOrgRole
+      ? []
+      : [
+          {
+            _id: "viewer",
+            name: "Viewer",
+            slug: "viewer",
+            description: "Non-administrative role in an organization",
+            permissions: viewerProjectPermission.rules
+          }
+        ]),
+    ...customRoles
+  ];
+
+  res.status(200).json({
+    message: "Successfully fetched role list",
+    data: {
+      roles
+    }
+  });
+};
+
+export const getUserPermissions = async (req: Request, res: Response) => {
+  const {
+    params: { orgId }
+  } = await validateRequest(GetUserPermission, req);
+  const { permission } = await getUserOrgPermissions(req.user._id, orgId);
+
+  res.status(200).json({
+    data: {
+      permissions: packRules(permission.rules)
+    }
+  });
+};
+
+export const getUserWorkspacePermissions = async (req: Request, res: Response) => {
+  const {
+    params: { workspaceId }
+  } = await validateRequest(GetUserProjectPermission, req);
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+
+  res.status(200).json({
+    data: {
+      permissions: packRules(permission.rules)
+    }
+  });
+};

backend/src/ee/controllers/v1/secretController.ts

@@ -1,7 +1,17 @@
+import { ForbiddenError, subject } from "@casl/ability";
 import { Request, Response } from "express";
-import { Secret } from "../../../models";
+import { validateRequest } from "../../../helpers/validation";
+import { Folder, Secret } from "../../../models";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../services/ProjectRoleService";
+import { BadRequestError } from "../../../utils/errors";
+import * as reqValidator from "../../../validation";
 import { SecretVersion } from "../../models";
 import { EESecretService } from "../../services";
+import { getFolderWithPathFromId } from "../../../services/FolderService";
 
 /**
  * Return secret versions for secret with id [secretId]
@@ -54,10 +64,21 @@ export const getSecretVersions = async (req: Request, res: Response) => {
         }
     }   
     */
-  const { secretId } = req.params;
+  const {
+    params: { secretId },
+    query: { offset, limit }
+  } = await validateRequest(reqValidator.GetSecretVersionsV1, req);
 
-  const offset: number = parseInt(req.query.offset as string);
-  const limit: number = parseInt(req.query.limit as string);
+  const secret = await Secret.findById(secretId);
+  if (!secret) {
+    throw BadRequestError({ message: "Failed to find secret" });
+  }
+
+  const { permission } = await getUserProjectPermissions(req.user._id, secret.workspace.toString());
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.SecretRollback
+  );
 
   const secretVersions = await SecretVersion.find({
     secret: secretId
@@ -126,8 +147,24 @@ export const rollbackSecretVersion = async (req: Request, res: Response) => {
         }
     }   
     */
-  const { secretId } = req.params;
-  const { version } = req.body;
+
+  const {
+    params: { secretId },
+    body: { version }
+  } = await validateRequest(reqValidator.RollbackSecretVersionV1, req);
+
+  const toBeUpdatedSec = await Secret.findById(secretId);
+  if (!toBeUpdatedSec) {
+    throw BadRequestError({ message: "Failed to find secret" });
+  }
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    toBeUpdatedSec.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Create,
+    ProjectPermissionSub.SecretRollback
+  );
 
   // validate secret version
   const oldSecretVersion = await SecretVersion.findOne({
@@ -154,6 +191,15 @@ export const rollbackSecretVersion = async (req: Request, res: Response) => {
     keyEncoding
   } = oldSecretVersion;
 
+  let secretPath = "/";
+  const folders = await Folder.findOne({ workspace, environment });
+  if (folders)
+    secretPath = getFolderWithPathFromId(folders.nodes, folder || "root")?.folderPath || "/";
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Edit,
+    subject(ProjectPermissionSub.Secrets, { environment: toBeUpdatedSec.environment, secretPath })
+  );
+
   // update secret
   const secret = await Secret.findByIdAndUpdate(
     secretId,

backend/src/ee/controllers/v1/secretSnapshotController.ts

@@ -1,9 +1,13 @@
+import { ForbiddenError } from "@casl/ability";
 import { Request, Response } from "express";
+import { validateRequest } from "../../../helpers/validation";
 import {
-  ISecretVersion,
-  SecretSnapshot,
-  TFolderRootVersionSchema,
-} from "../../models";
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../services/ProjectRoleService";
+import * as reqValidator from "../../../validation/secretSnapshot";
+import { ISecretVersion, SecretSnapshot, TFolderRootVersionSchema } from "../../models";
 
 /**
  * Return secret snapshot with id [secretSnapshotId]
@@ -12,7 +16,9 @@ import {
  * @returns
  */
 export const getSecretSnapshot = async (req: Request, res: Response) => {
-  const { secretSnapshotId } = req.params;
+  const {
+    params: { secretSnapshotId }
+  } = await validateRequest(reqValidator.GetSecretSnapshotV1, req);
 
   const secretSnapshot = await SecretSnapshot.findById(secretSnapshotId)
     .lean()
@@ -20,26 +26,36 @@ export const getSecretSnapshot = async (req: Request, res: Response) => {
       path: "secretVersions",
       populate: {
         path: "tags",
-        model: "Tag",
-      },
+        model: "Tag"
+      }
     })
     .populate<{ folderVersion: TFolderRootVersionSchema }>("folderVersion");
-  
+
   if (!secretSnapshot) throw new Error("Failed to find secret snapshot");
-  
+
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    secretSnapshot.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.SecretRollback
+  );
+
   const folderId = secretSnapshot.folderId;
   // to show only the folder required secrets
   secretSnapshot.secretVersions = secretSnapshot.secretVersions.filter(
     ({ folder }) => folder === folderId
   );
 
-  secretSnapshot.folderVersion =
-    secretSnapshot?.folderVersion?.nodes?.children?.map(({ id, name }) => ({
+  secretSnapshot.folderVersion = secretSnapshot?.folderVersion?.nodes?.children?.map(
+    ({ id, name }) => ({
       id,
-      name,
-    })) as any;
+      name
+    })
+  ) as any;
 
   return res.status(200).send({
-    secretSnapshot,
+    secretSnapshot
   });
 };

backend/src/ee/controllers/v1/ssoController.ts

@@ -2,253 +2,258 @@ import { Request, Response } from "express";
 import { Types } from "mongoose";
 import { BotOrgService } from "../../../services";
 import { SSOConfig } from "../../models";
-import { 
-    MembershipOrg,
-    User
-} from "../../../models";
+import { AuthMethod, MembershipOrg, User } from "../../../models";
 import { getSSOConfigHelper } from "../../helpers/organizations";
 import { client } from "../../../config";
 import { ResourceNotFoundError } from "../../../utils/errors";
 import { getSiteURL } from "../../../config";
+import { EELicenseService } from "../../services";
+import * as reqValidator from "../../../validation/sso";
+import { validateRequest } from "../../../helpers/validation";
+import {
+  OrgPermissionActions,
+  OrgPermissionSubjects,
+  getUserOrgPermissions
+} from "../../services/RoleService";
+import { ForbiddenError } from "@casl/ability";
 
 /**
  * Redirect user to appropriate SSO endpoint after successful authentication
  * to finish inputting their master key for logging in or signing up
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const redirectSSO = async (req: Request, res: Response) => {
-    if (req.isUserCompleted) {
-      return res.redirect(`${await getSiteURL()}/login/sso?token=${encodeURIComponent(req.providerAuthToken)}`);
-    }
-    
-    return res.redirect(`${await getSiteURL()}/signup/sso?token=${encodeURIComponent(req.providerAuthToken)}`);
-}
+  if (req.isUserCompleted) {
+    return res.redirect(
+      `${await getSiteURL()}/login/sso?token=${encodeURIComponent(req.providerAuthToken)}`
+    );
+  }
+
+  return res.redirect(
+    `${await getSiteURL()}/signup/sso?token=${encodeURIComponent(req.providerAuthToken)}`
+  );
+};
 
 /**
  * Return organization SAML SSO configuration
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const getSSOConfig = async (req: Request, res: Response) => {
-    const organizationId = req.query.organizationId as string;
-    
-    const data = await getSSOConfigHelper({
-        organizationId: new Types.ObjectId(organizationId)
-    });
+  const {
+    query: { organizationId }
+  } = await validateRequest(reqValidator.GetSsoConfigv1, req);
 
-    return res.status(200).send(data);
-}
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Read,
+    OrgPermissionSubjects.Sso
+  );
+
+  const data = await getSSOConfigHelper({
+    organizationId: new Types.ObjectId(organizationId)
+  });
+
+  return res.status(200).send(data);
+};
 
 /**
  * Update organization SAML SSO configuration
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const updateSSOConfig = async (req: Request, res: Response) => {
-    const {
-        organizationId,
-        authProvider,
-        isActive,
-        entryPoint,
-        issuer,
-        cert,
-        audience
-    } = req.body;
-    
-    interface PatchUpdate {
-        authProvider?: string;
-        isActive?: boolean;
-        encryptedEntryPoint?: string;
-        entryPointIV?: string;
-        entryPointTag?: string;
-        encryptedIssuer?: string;
-        issuerIV?: string;
-        issuerTag?: string;
-        encryptedCert?: string;
-        certIV?: string;
-        certTag?: string;
-        encryptedAudience?: string;
-        audienceIV?: string;
-        audienceTag?: string;
-    }
-    
-    const update: PatchUpdate = {};
-    
-    if (authProvider) {
-        update.authProvider = authProvider;
-    }
-    
-    if (isActive !== undefined) {
-        update.isActive = isActive;
-    }
-    
-    const key = await BotOrgService.getSymmetricKey(
-        new Types.ObjectId(organizationId)
-    );
-    
-    if (entryPoint) {
-        const {
-            ciphertext: encryptedEntryPoint,
-            iv: entryPointIV,
-            tag: entryPointTag
-        } = client.encryptSymmetric(entryPoint, key);
-        
-        update.encryptedEntryPoint = encryptedEntryPoint;
-        update.entryPointIV = entryPointIV;
-        update.entryPointTag = entryPointTag;
-    }
+  const {
+    body: { organizationId, authProvider, isActive, entryPoint, issuer, cert }
+  } = await validateRequest(reqValidator.UpdateSsoConfigv1, req);
 
-    if (issuer) {
-        const {
-            ciphertext: encryptedIssuer,
-            iv: issuerIV,
-            tag: issuerTag
-        } = client.encryptSymmetric(issuer, key);
-        
-        update.encryptedIssuer = encryptedIssuer;
-        update.issuerIV = issuerIV;
-        update.issuerTag = issuerTag;
-    }
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Edit,
+    OrgPermissionSubjects.Sso
+  );
 
-    if (cert) {
-        const {
-            ciphertext: encryptedCert,
-            iv: certIV,
-            tag: certTag
-        } = client.encryptSymmetric(cert, key);
-        
-        update.encryptedCert = encryptedCert;
-        update.certIV = certIV;
-        update.certTag = certTag;
-    }
+  const plan = await EELicenseService.getPlan(new Types.ObjectId(organizationId));
 
-    if (audience) {
-        const {
-            ciphertext: encryptedAudience,
-            iv: audienceIV,
-            tag: audienceTag
-        } = client.encryptSymmetric(audience, key);
-        
-        update.encryptedAudience = encryptedAudience;
-        update.audienceIV = audienceIV;
-        update.audienceTag = audienceTag;
-    }
-    
-    const ssoConfig = await SSOConfig.findOneAndUpdate(
-        {
-            organization: new Types.ObjectId(organizationId)
-        },
-        update,
-        {
-            new: true
-        }
-    );
-    
-    if (!ssoConfig) throw ResourceNotFoundError({
-        message: "Failed to find SSO config to update"
+  if (!plan.samlSSO)
+    return res.status(400).send({
+      message:
+        "Failed to update SAML SSO configuration due to plan restriction. Upgrade plan to update SSO configuration."
     });
-    
-    if (update.isActive !== undefined) {
-        const membershipOrgs = await MembershipOrg.find({
-            organization: new Types.ObjectId(organizationId)
-        }).select("user");
-        
-        if (update.isActive) {
-            await User.updateMany(
-                {
-                    _id: {
-                        $in: membershipOrgs.map((membershipOrg) => membershipOrg.user)
-                    }
-                },
-                {
-                    authProvider: ssoConfig.authProvider
-                }
-            );
-        } else {
-            await User.updateMany(
-                {
-                    _id: {
-                        $in: membershipOrgs.map((membershipOrg) => membershipOrg.user)
-                    }
-                },
-                {
-                    $unset: {
-                        authProvider: 1
-                    }
-                }
-            );
-        }
+
+  interface PatchUpdate {
+    authProvider?: string;
+    isActive?: boolean;
+    encryptedEntryPoint?: string;
+    entryPointIV?: string;
+    entryPointTag?: string;
+    encryptedIssuer?: string;
+    issuerIV?: string;
+    issuerTag?: string;
+    encryptedCert?: string;
+    certIV?: string;
+    certTag?: string;
+  }
+
+  const update: PatchUpdate = {};
+
+  if (authProvider) {
+    update.authProvider = authProvider;
+  }
+
+  if (isActive !== undefined) {
+    update.isActive = isActive;
+  }
+
+  const key = await BotOrgService.getSymmetricKey(new Types.ObjectId(organizationId));
+
+  if (entryPoint) {
+    const {
+      ciphertext: encryptedEntryPoint,
+      iv: entryPointIV,
+      tag: entryPointTag
+    } = client.encryptSymmetric(entryPoint, key);
+
+    update.encryptedEntryPoint = encryptedEntryPoint;
+    update.entryPointIV = entryPointIV;
+    update.entryPointTag = entryPointTag;
+  }
+
+  if (issuer) {
+    const {
+      ciphertext: encryptedIssuer,
+      iv: issuerIV,
+      tag: issuerTag
+    } = client.encryptSymmetric(issuer, key);
+
+    update.encryptedIssuer = encryptedIssuer;
+    update.issuerIV = issuerIV;
+    update.issuerTag = issuerTag;
+  }
+
+  if (cert) {
+    const {
+      ciphertext: encryptedCert,
+      iv: certIV,
+      tag: certTag
+    } = client.encryptSymmetric(cert, key);
+
+    update.encryptedCert = encryptedCert;
+    update.certIV = certIV;
+    update.certTag = certTag;
+  }
+
+  const ssoConfig = await SSOConfig.findOneAndUpdate(
+    {
+      organization: new Types.ObjectId(organizationId)
+    },
+    update,
+    {
+      new: true
     }
-    
-    return res.status(200).send(ssoConfig);
-}
+  );
+
+  if (!ssoConfig)
+    throw ResourceNotFoundError({
+      message: "Failed to find SSO config to update"
+    });
+
+  if (update.isActive !== undefined) {
+    const membershipOrgs = await MembershipOrg.find({
+      organization: new Types.ObjectId(organizationId)
+    }).select("user");
+
+    if (update.isActive) {
+      await User.updateMany(
+        {
+          _id: {
+            $in: membershipOrgs.map((membershipOrg) => membershipOrg.user)
+          }
+        },
+        {
+          authMethods: [ssoConfig.authProvider]
+        }
+      );
+    } else {
+      await User.updateMany(
+        {
+          _id: {
+            $in: membershipOrgs.map((membershipOrg) => membershipOrg.user)
+          }
+        },
+        {
+          authMethods: [AuthMethod.EMAIL]
+        }
+      );
+    }
+  }
+
+  return res.status(200).send(ssoConfig);
+};
 
 /**
  * Create organization SAML SSO configuration
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const createSSOConfig = async (req: Request, res: Response) => {
-    const {
-        organizationId,
-        authProvider,
-        isActive,
-        entryPoint,
-        issuer,
-        cert,
-        audience
-    } = req.body;
-    
-    const key = await BotOrgService.getSymmetricKey(
-        new Types.ObjectId(organizationId)
-    );
+  const {
+    body: { organizationId, authProvider, isActive, entryPoint, issuer, cert }
+  } = await validateRequest(reqValidator.CreateSsoConfigv1, req);
 
-    const {
-        ciphertext: encryptedEntryPoint,
-        iv: entryPointIV,
-        tag: entryPointTag
-    } = client.encryptSymmetric(entryPoint, key);
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    OrgPermissionActions.Create,
+    OrgPermissionSubjects.Sso
+  );
 
-    const {
-        ciphertext: encryptedIssuer,
-        iv: issuerIV,
-        tag: issuerTag
-    } = client.encryptSymmetric(issuer, key);
+  const plan = await EELicenseService.getPlan(new Types.ObjectId(organizationId));
 
-    const {
-        ciphertext: encryptedCert,
-        iv: certIV,
-        tag: certTag
-    } = client.encryptSymmetric(cert, key);
+  if (!plan.samlSSO)
+    return res.status(400).send({
+      message:
+        "Failed to create SAML SSO configuration due to plan restriction. Upgrade plan to add SSO configuration."
+    });
 
-    const {
-        ciphertext: encryptedAudience,
-        iv: audienceIV,
-        tag: audienceTag
-    } = client.encryptSymmetric(audience, key);
-    
-    const ssoConfig = await new SSOConfig({
-        organization: new Types.ObjectId(organizationId),
-        authProvider,
-        isActive,
-        encryptedEntryPoint,
-        entryPointIV,
-        entryPointTag,
-        encryptedIssuer,
-        issuerIV,
-        issuerTag,
-        encryptedCert,
-        certIV,
-        certTag,
-        encryptedAudience,
-        audienceIV,
-        audienceTag
-    }).save();
+  const key = await BotOrgService.getSymmetricKey(new Types.ObjectId(organizationId));
 
-    return res.status(200).send(ssoConfig);
-}
+  const {
+    ciphertext: encryptedEntryPoint,
+    iv: entryPointIV,
+    tag: entryPointTag
+  } = client.encryptSymmetric(entryPoint, key);
+
+  const {
+    ciphertext: encryptedIssuer,
+    iv: issuerIV,
+    tag: issuerTag
+  } = client.encryptSymmetric(issuer, key);
+
+  const {
+    ciphertext: encryptedCert,
+    iv: certIV,
+    tag: certTag
+  } = client.encryptSymmetric(cert, key);
+
+  const ssoConfig = await new SSOConfig({
+    organization: new Types.ObjectId(organizationId),
+    authProvider,
+    isActive,
+    encryptedEntryPoint,
+    entryPointIV,
+    entryPointTag,
+    encryptedIssuer,
+    issuerIV,
+    issuerTag,
+    encryptedCert,
+    certIV,
+    certTag
+  }).save();
+
+  return res.status(200).send(ssoConfig);
+};

backend/src/ee/controllers/v1/usersController.ts

@@ -0,0 +1,13 @@
+import { Request, Response } from "express";
+
+/**
+ * Return the ip address of the current user
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const getMyIp = (req: Request, res: Response) => {
+    return res.status(200).send({
+        ip: req.authData.ipAddress
+    });
+}

backend/src/ee/controllers/v1/workspaceController.ts

@@ -1,28 +1,62 @@
 import { Request, Response } from "express";
 import { PipelineStage, Types } from "mongoose";
-import { Secret } from "../../../models";
 import {
+  Folder,
+  Membership,
+  Secret,
+  ServiceTokenData,
+  TFolderSchema,
+  User,
+  Workspace
+} from "../../../models";
+import {
+  ActorType,
+  AuditLog,
+  EventType,
   FolderVersion,
+  IPType,
   ISecretVersion,
   Log,
   SecretSnapshot,
   SecretVersion,
+  ServiceActor,
   TFolderRootVersionSchema,
+  TrustedIP,
+  UserActor
 } from "../../models";
 import { EESecretService } from "../../services";
 import { getLatestSecretVersionIds } from "../../helpers/secretVersion";
-import Folder, { TFolderSchema } from "../../../models/folder";
+// import Folder, { TFolderSchema } from "../../../models/folder";
 import { searchByFolderId } from "../../../services/FolderService";
+import { EEAuditLogService, EELicenseService } from "../../services";
+import { extractIPDetails, isValidIpOrCidr } from "../../../utils/ip";
+import { validateRequest } from "../../../helpers/validation";
+import {
+  AddWorkspaceTrustedIpV1,
+  DeleteWorkspaceTrustedIpV1,
+  GetWorkspaceAuditLogActorFilterOptsV1,
+  GetWorkspaceAuditLogsV1,
+  GetWorkspaceLogsV1,
+  GetWorkspaceSecretSnapshotsCountV1,
+  GetWorkspaceSecretSnapshotsV1,
+  GetWorkspaceTrustedIpsV1,
+  RollbackWorkspaceSecretSnapshotV1,
+  UpdateWorkspaceTrustedIpV1
+} from "../../../validation";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../services/ProjectRoleService";
+import { ForbiddenError } from "@casl/ability";
+import { BadRequestError } from "../../../utils/errors";
 
 /**
  * Return secret snapshots for workspace with id [workspaceId]
  * @param req
  * @param res
  */
-export const getWorkspaceSecretSnapshots = async (
-  req: Request,
-  res: Response
-) => {
+export const getWorkspaceSecretSnapshots = async (req: Request, res: Response) => {
   /* 
     #swagger.summary = 'Return project secret snapshot ids'
     #swagger.description = 'Return project secret snapshots ids'
@@ -68,23 +102,28 @@ export const getWorkspaceSecretSnapshots = async (
         }
     }
     */
-  const { workspaceId } = req.params;
-  const { environment, folderId } = req.query;
+  const {
+    params: { workspaceId },
+    query: { environment, folderId, offset, limit }
+  } = await validateRequest(GetWorkspaceSecretSnapshotsV1, req);
 
-  const offset: number = parseInt(req.query.offset as string);
-  const limit: number = parseInt(req.query.limit as string);
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.SecretRollback
+  );
 
   const secretSnapshots = await SecretSnapshot.find({
     workspace: workspaceId,
     environment,
-    folderId: folderId || "root",
+    folderId: folderId || "root"
   })
     .sort({ createdAt: -1 })
     .skip(offset)
     .limit(limit);
 
   return res.status(200).send({
-    secretSnapshots,
+    secretSnapshots
   });
 };
 
@@ -93,21 +132,26 @@ export const getWorkspaceSecretSnapshots = async (
  * @param req
  * @param res
  */
-export const getWorkspaceSecretSnapshotsCount = async (
-  req: Request,
-  res: Response
-) => {
-  const { workspaceId } = req.params;
-  const { environment, folderId } = req.query;
+export const getWorkspaceSecretSnapshotsCount = async (req: Request, res: Response) => {
+  const {
+    params: { workspaceId },
+    query: { environment, folderId }
+  } = await validateRequest(GetWorkspaceSecretSnapshotsCountV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.SecretRollback
+  );
 
   const count = await SecretSnapshot.countDocuments({
     workspace: workspaceId,
     environment,
-    folderId: folderId || "root",
+    folderId: folderId || "root"
   });
 
   return res.status(200).send({
-    count,
+    count
   });
 };
 
@@ -117,10 +161,7 @@ export const getWorkspaceSecretSnapshotsCount = async (
  * @param res
  * @returns
  */
-export const rollbackWorkspaceSecretSnapshot = async (
-  req: Request,
-  res: Response
-) => {
+export const rollbackWorkspaceSecretSnapshot = async (req: Request, res: Response) => {
   /* 
     #swagger.summary = 'Roll back project secrets to those captured in a secret snapshot version.'
     #swagger.description = 'Roll back project secrets to those captured in a secret snapshot version.'
@@ -172,19 +213,27 @@ export const rollbackWorkspaceSecretSnapshot = async (
     }   
     */
 
-  const { workspaceId } = req.params;
-  const { version, environment, folderId = "root" } = req.body;
+  const {
+    params: { workspaceId },
+    body: { folderId, environment, version }
+  } = await validateRequest(RollbackWorkspaceSecretSnapshotV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Create,
+    ProjectPermissionSub.SecretRollback
+  );
 
   // validate secret snapshot
   const secretSnapshot = await SecretSnapshot.findOne({
     workspace: workspaceId,
     version,
     environment,
-    folderId: folderId,
+    folderId: folderId
   })
     .populate<{ secretVersions: ISecretVersion[] }>({
       path: "secretVersions",
-      select: "+secretBlindIndex",
+      select: "+secretBlindIndex"
     })
     .populate<{ folderVersion: TFolderRootVersionSchema }>("folderVersion");
 
@@ -193,13 +242,13 @@ export const rollbackWorkspaceSecretSnapshot = async (
   const snapshotFolderTree = secretSnapshot.folderVersion;
   const latestFolderTree = await Folder.findOne({
     workspace: workspaceId,
-    environment,
+    environment
   });
 
   const latestFolderVersion = await FolderVersion.findOne({
     environment,
     workspace: workspaceId,
-    "nodes.id": folderId,
+    "nodes.id": folderId
   }).sort({ "nodes.version": -1 });
 
   const oldSecretVersionsObj: Record<string, ISecretVersion> = {};
@@ -213,8 +262,7 @@ export const rollbackWorkspaceSecretSnapshot = async (
 
   // the parent node from current latest one
   // this will be modified according to the snapshot and latest snapshots
-  const newFolderTree =
-    latestFolderTree && searchByFolderId(latestFolderTree.nodes, folderId);
+  const newFolderTree = latestFolderTree && searchByFolderId(latestFolderTree.nodes, folderId);
 
   if (newFolderTree) {
     newFolderTree.children = snapshotFolderTree?.nodes?.children || [];
@@ -243,43 +291,43 @@ export const rollbackWorkspaceSecretSnapshot = async (
           workspace: new Types.ObjectId(workspaceId),
           environment,
           folderId: {
-            $in: Object.keys(groupByFolderId),
-          },
-        },
+            $in: Object.keys(groupByFolderId)
+          }
+        }
       };
       const sortByFolderIdAndVersion: PipelineStage = {
-        $sort: { folderId: 1, version: -1 },
+        $sort: { folderId: 1, version: -1 }
       };
       const pickLatestVersionOfEachFolder = {
         $group: {
           _id: "$folderId",
           latestVersion: { $first: "$version" },
           doc: {
-            $first: "$$ROOT",
-          },
-        },
+            $first: "$$ROOT"
+          }
+        }
       };
       const populateSecVersion = {
         $lookup: {
           from: SecretVersion.collection.name,
           localField: "doc.secretVersions",
           foreignField: "_id",
-          as: "doc.secretVersions",
-        },
+          as: "doc.secretVersions"
+        }
       };
       const populateFolderVersion = {
         $lookup: {
           from: FolderVersion.collection.name,
           localField: "doc.folderVersion",
           foreignField: "_id",
-          as: "doc.folderVersion",
-        },
+          as: "doc.folderVersion"
+        }
       };
       const unwindFolderVerField = {
         $unwind: {
           path: "$doc.folderVersion",
-          preserveNullAndEmptyArrays: true,
-        },
+          preserveNullAndEmptyArrays: true
+        }
       };
       const latestSnapshotsByFolders: Array<{ doc: typeof secretSnapshot }> =
         await SecretSnapshot.aggregate([
@@ -288,7 +336,7 @@ export const rollbackWorkspaceSecretSnapshot = async (
           pickLatestVersionOfEachFolder,
           populateSecVersion,
           populateFolderVersion,
-          unwindFolderVerField,
+          unwindFolderVerField
         ]);
 
       // recursive snapshotting each level
@@ -318,7 +366,7 @@ export const rollbackWorkspaceSecretSnapshot = async (
 
   // TODO: fix any
   const latestSecretVersionIds = await getLatestSecretVersionIds({
-    secretIds,
+    secretIds
   });
 
   // TODO: fix any
@@ -326,32 +374,31 @@ export const rollbackWorkspaceSecretSnapshot = async (
     await SecretVersion.find(
       {
         _id: {
-          $in: latestSecretVersionIds.map((s) => s.versionId),
-        },
+          $in: latestSecretVersionIds.map((s) => s.versionId)
+        }
       },
       "secret version"
     )
   ).reduce(
     (accumulator, s) => ({
       ...accumulator,
-      [`${s.secret.toString()}`]: s,
+      [`${s.secret.toString()}`]: s
     }),
     {}
   );
 
   const secDelQuery: Record<string, unknown> = {
     workspace: workspaceId,
-    environment,
+    environment
     // undefined means root thus collect all secrets
   };
-  if (folderId !== "root" && folderIds.length)
-    secDelQuery.folder = { $in: folderIds };
+  if (folderId !== "root" && folderIds.length) secDelQuery.folder = { $in: folderIds };
 
   // delete existing secrets
   await Secret.deleteMany(secDelQuery);
   await Folder.deleteOne({
     workspace: workspaceId,
-    environment,
+    environment
   });
 
   // add secrets
@@ -373,7 +420,7 @@ export const rollbackWorkspaceSecretSnapshot = async (
         createdAt,
         algorithm,
         keyEncoding,
-        folder: secFolderId,
+        folder: secFolderId
       } = oldSecretVersionsObj[sv];
 
       return {
@@ -396,7 +443,7 @@ export const rollbackWorkspaceSecretSnapshot = async (
         createdAt,
         algorithm,
         keyEncoding,
-        folder: secFolderId,
+        folder: secFolderId
       };
     })
   );
@@ -420,7 +467,7 @@ export const rollbackWorkspaceSecretSnapshot = async (
         secretValueTag,
         algorithm,
         keyEncoding,
-        folder: secFolderId,
+        folder: secFolderId
       }) => ({
         _id: new Types.ObjectId(),
         secret: _id,
@@ -439,7 +486,7 @@ export const rollbackWorkspaceSecretSnapshot = async (
         secretValueTag,
         algorithm,
         keyEncoding,
-        folder: secFolderId,
+        folder: secFolderId
       })
     )
   );
@@ -455,7 +502,7 @@ export const rollbackWorkspaceSecretSnapshot = async (
     const newFolderVersion = new FolderVersion({
       workspace: workspaceId,
       environment,
-      nodes: newFolderTree,
+      nodes: newFolderTree
     });
     await newFolderVersion.save();
   }
@@ -464,13 +511,11 @@ export const rollbackWorkspaceSecretSnapshot = async (
   await SecretVersion.updateMany(
     {
       secret: {
-        $in: Object.keys(oldSecretVersionsObj).map(
-          (sv) => oldSecretVersionsObj[sv].secret
-        ),
-      },
+        $in: Object.keys(oldSecretVersionsObj).map((sv) => oldSecretVersionsObj[sv].secret)
+      }
     },
     {
-      isDeleted: false,
+      isDeleted: false
     }
   );
 
@@ -478,11 +523,11 @@ export const rollbackWorkspaceSecretSnapshot = async (
   await EESecretService.takeSecretSnapshot({
     workspaceId: new Types.ObjectId(workspaceId),
     environment,
-    folderId,
+    folderId
   });
 
   return res.status(200).send({
-    secrets,
+    secrets
   });
 };
 
@@ -559,13 +604,16 @@ export const getWorkspaceLogs = async (req: Request, res: Response) => {
         }
     }   
     */
-  const { workspaceId } = req.params;
+  const {
+    query: { limit, offset, userId, sortBy, actionNames },
+    params: { workspaceId }
+  } = await validateRequest(GetWorkspaceLogsV1, req);
 
-  const offset: number = parseInt(req.query.offset as string);
-  const limit: number = parseInt(req.query.limit as string);
-  const sortBy: string = req.query.sortBy as string;
-  const userId: string = req.query.userId as string;
-  const actionNames: string = req.query.actionNames as string;
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.AuditLogs
+  );
 
   const logs = await Log.find({
     workspace: workspaceId,
@@ -573,10 +621,10 @@ export const getWorkspaceLogs = async (req: Request, res: Response) => {
     ...(actionNames
       ? {
           actionNames: {
-            $in: actionNames.split(","),
-          },
+            $in: actionNames.split(",")
+          }
         }
-      : {}),
+      : {})
   })
     .sort({ createdAt: sortBy === "recent" ? -1 : 1 })
     .skip(offset)
@@ -585,6 +633,358 @@ export const getWorkspaceLogs = async (req: Request, res: Response) => {
     .populate("user serviceAccount serviceTokenData");
 
   return res.status(200).send({
-    logs,
+    logs
+  });
+};
+
+/**
+ * Return audit logs for workspace with id [workspaceId]
+ * @param req
+ * @param res
+ */
+export const getWorkspaceAuditLogs = async (req: Request, res: Response) => {
+  const {
+    query: { limit, offset, endDate, eventType, startDate, userAgentType, actor },
+    params: { workspaceId }
+  } = await validateRequest(GetWorkspaceAuditLogsV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.AuditLogs
+  );
+
+  const query = {
+    workspace: new Types.ObjectId(workspaceId),
+    ...(eventType
+      ? {
+          "event.type": eventType
+        }
+      : {}),
+    ...(userAgentType
+      ? {
+          userAgentType
+        }
+      : {}),
+    ...(actor
+      ? {
+          "actor.type": actor.split("-", 2)[0],
+          ...(actor.split("-", 2)[0] === ActorType.USER
+            ? {
+                "actor.metadata.userId": actor.split("-", 2)[1]
+              }
+            : {
+                "actor.metadata.serviceId": actor.split("-", 2)[1]
+              })
+        }
+      : {}),
+    ...(startDate || endDate
+      ? {
+          createdAt: {
+            ...(startDate && { $gte: new Date(startDate) }),
+            ...(endDate && { $lte: new Date(endDate) })
+          }
+        }
+      : {})
+  };
+
+  const auditLogs = await AuditLog.find(query).sort({ createdAt: -1 }).skip(offset).limit(limit);
+
+  const totalCount = await AuditLog.countDocuments(query);
+
+  return res.status(200).send({
+    auditLogs,
+    totalCount
+  });
+};
+
+/**
+ * Return audit log actor filter options for workspace with id [workspaceId]
+ * @param req
+ * @param res
+ */
+export const getWorkspaceAuditLogActorFilterOpts = async (req: Request, res: Response) => {
+  const {
+    params: { workspaceId }
+  } = await validateRequest(GetWorkspaceAuditLogActorFilterOptsV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.AuditLogs
+  );
+
+  const userIds = await Membership.distinct("user", {
+    workspace: new Types.ObjectId(workspaceId)
+  });
+  const userActors: UserActor[] = (
+    await User.find({
+      _id: {
+        $in: userIds
+      }
+    }).select("email")
+  ).map((user) => ({
+    type: ActorType.USER,
+    metadata: {
+      userId: user._id.toString(),
+      email: user.email
+    }
+  }));
+
+  const serviceActors: ServiceActor[] = (
+    await ServiceTokenData.find({
+      workspace: new Types.ObjectId(workspaceId)
+    }).select("name")
+  ).map((serviceTokenData) => ({
+    type: ActorType.SERVICE,
+    metadata: {
+      serviceId: serviceTokenData._id.toString(),
+      name: serviceTokenData.name
+    }
+  }));
+
+  return res.status(200).send({
+    actors: [...userActors, ...serviceActors]
+  });
+};
+
+/**
+ * Return trusted ips for workspace with id [workspaceId]
+ * @param req
+ * @param res
+ */
+export const getWorkspaceTrustedIps = async (req: Request, res: Response) => {
+  const {
+    params: { workspaceId }
+  } = await validateRequest(GetWorkspaceTrustedIpsV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.IpAllowList
+  );
+
+  const trustedIps = await TrustedIP.find({
+    workspace: new Types.ObjectId(workspaceId)
+  });
+
+  return res.status(200).send({
+    trustedIps
+  });
+};
+
+/**
+ * Add a trusted ip to workspace with id [workspaceId]
+ * @param req
+ * @param res
+ */
+export const addWorkspaceTrustedIp = async (req: Request, res: Response) => {
+  const {
+    params: { workspaceId },
+    body: { comment, isActive, ipAddress: ip }
+  } = await validateRequest(AddWorkspaceTrustedIpV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Create,
+    ProjectPermissionSub.IpAllowList
+  );
+
+  const workspace = await Workspace.findById(workspaceId);
+  if (!workspace) throw BadRequestError({ message: "Workspace not found" });
+
+  const plan = await EELicenseService.getPlan(workspace.organization);
+
+  if (!plan.ipAllowlisting)
+    return res.status(400).send({
+      message:
+        "Failed to add IP access range due to plan restriction. Upgrade plan to add IP access range."
+    });
+
+  const isValidIPOrCidr = isValidIpOrCidr(ip);
+
+  if (!isValidIPOrCidr)
+    return res.status(400).send({
+      message: "The IP is not a valid IPv4, IPv6, or CIDR block"
+    });
+
+  const { ipAddress, type, prefix } = extractIPDetails(ip);
+
+  const trustedIp = await new TrustedIP({
+    workspace: new Types.ObjectId(workspaceId),
+    ipAddress,
+    type,
+    prefix,
+    isActive,
+    comment
+  }).save();
+
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.ADD_TRUSTED_IP,
+      metadata: {
+        trustedIpId: trustedIp._id.toString(),
+        ipAddress: trustedIp.ipAddress,
+        prefix: trustedIp.prefix
+      }
+    },
+    {
+      workspaceId: trustedIp.workspace
+    }
+  );
+
+  return res.status(200).send({
+    trustedIp
+  });
+};
+
+/**
+ * Update trusted ip with id [trustedIpId] workspace with id [workspaceId]
+ * @param req
+ * @param res
+ */
+export const updateWorkspaceTrustedIp = async (req: Request, res: Response) => {
+  const {
+    params: { workspaceId, trustedIpId },
+    body: { ipAddress: ip, comment }
+  } = await validateRequest(UpdateWorkspaceTrustedIpV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Edit,
+    ProjectPermissionSub.IpAllowList
+  );
+
+  const workspace = await Workspace.findById(workspaceId);
+  if (!workspace) throw BadRequestError({ message: "Workspace not found" });
+
+  const plan = await EELicenseService.getPlan(workspace.organization);
+
+  if (!plan.ipAllowlisting)
+    return res.status(400).send({
+      message:
+        "Failed to update IP access range due to plan restriction. Upgrade plan to update IP access range."
+    });
+
+  const isValidIPOrCidr = isValidIpOrCidr(ip);
+
+  if (!isValidIPOrCidr)
+    return res.status(400).send({
+      message: "The IP is not a valid IPv4, IPv6, or CIDR block"
+    });
+
+  const { ipAddress, type, prefix } = extractIPDetails(ip);
+
+  const updateObject: {
+    ipAddress: string;
+    type: IPType;
+    comment: string;
+    prefix?: number;
+    $unset?: {
+      prefix: number;
+    };
+  } = {
+    ipAddress,
+    type,
+    comment
+  };
+
+  if (prefix !== undefined) {
+    updateObject.prefix = prefix;
+  } else {
+    updateObject.$unset = { prefix: 1 };
+  }
+
+  const trustedIp = await TrustedIP.findOneAndUpdate(
+    {
+      _id: new Types.ObjectId(trustedIpId),
+      workspace: new Types.ObjectId(workspaceId)
+    },
+    updateObject,
+    {
+      new: true
+    }
+  );
+
+  if (!trustedIp)
+    return res.status(400).send({
+      message: "Failed to update trusted IP"
+    });
+
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.UPDATE_TRUSTED_IP,
+      metadata: {
+        trustedIpId: trustedIp._id.toString(),
+        ipAddress: trustedIp.ipAddress,
+        prefix: trustedIp.prefix
+      }
+    },
+    {
+      workspaceId: trustedIp.workspace
+    }
+  );
+
+  return res.status(200).send({
+    trustedIp
+  });
+};
+
+/**
+ * Delete IP access range from workspace with id [workspaceId]
+ * @param req
+ * @param res
+ */
+export const deleteWorkspaceTrustedIp = async (req: Request, res: Response) => {
+  const {
+    params: { workspaceId, trustedIpId }
+  } = await validateRequest(DeleteWorkspaceTrustedIpV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Delete,
+    ProjectPermissionSub.IpAllowList
+  );
+
+  const workspace = await Workspace.findById(workspaceId);
+  if (!workspace) throw BadRequestError({ message: "Workspace not found" });
+
+  const plan = await EELicenseService.getPlan(workspace.organization);
+
+  if (!plan.ipAllowlisting)
+    return res.status(400).send({
+      message:
+        "Failed to delete IP access range due to plan restriction. Upgrade plan to delete IP access range."
+    });
+
+  const trustedIp = await TrustedIP.findOneAndDelete({
+    _id: new Types.ObjectId(trustedIpId),
+    workspace: new Types.ObjectId(workspaceId)
+  });
+
+  if (!trustedIp)
+    return res.status(400).send({
+      message: "Failed to delete trusted IP"
+    });
+
+  await EEAuditLogService.createAuditLog(
+    req.authData,
+    {
+      type: EventType.DELETE_TRUSTED_IP,
+      metadata: {
+        trustedIpId: trustedIp._id.toString(),
+        ipAddress: trustedIp.ipAddress,
+        prefix: trustedIp.prefix
+      }
+    },
+    {
+      workspaceId: trustedIp.workspace
+    }
+  );
+
+  return res.status(200).send({
+    trustedIp
   });
 };

backend/src/ee/helpers/organizations.ts

@@ -51,13 +51,6 @@ export const getSSOConfigHelper = async ({
         ssoConfig.certIV,
         ssoConfig.certTag
     );
-
-    const audience = client.decryptSymmetric(
-        ssoConfig.encryptedAudience,
-        key,
-        ssoConfig.audienceIV,
-        ssoConfig.audienceTag
-    );
     
     return ({
         _id: ssoConfig._id,
@@ -66,7 +59,6 @@ export const getSSOConfigHelper = async ({
         isActive: ssoConfig.isActive,
         entryPoint,
         issuer,
-        cert,
-        audience
+        cert
     });
 }

backend/src/ee/models/action.ts

@@ -66,6 +66,4 @@ const actionSchema = new Schema<IAction>(
     }
 );
 
-const Action = model<IAction>("Action", actionSchema);
-
-export default Action;
+export const Action = model<IAction>("Action", actionSchema);

backend/src/ee/models/auditLog/auditLog.ts

@@ -0,0 +1,76 @@
+import { Schema, Types, model } from "mongoose";
+import {
+    ActorType,
+    EventType,
+    UserAgentType
+} from "./enums";
+import {
+    Actor,
+    Event
+} from "./types";
+
+export interface IAuditLog {
+    actor: Actor;
+    organization: Types.ObjectId;
+    workspace: Types.ObjectId;
+    ipAddress: string;
+    event: Event;
+    userAgent: string;
+    userAgentType: UserAgentType;
+    expiresAt: Date;
+}
+
+const auditLogSchema = new Schema<IAuditLog>(
+    {
+        actor: {
+            type: {
+                type: String,
+                enum: ActorType,
+                required: true
+            },
+            metadata: {
+                type: Schema.Types.Mixed
+            }
+        },
+        organization: {
+            type: Schema.Types.ObjectId,
+            required: false
+        },
+        workspace: {
+            type: Schema.Types.ObjectId,
+            required: false
+        },
+        ipAddress: {
+            type: String,
+            required: true
+        },
+        event: {
+            type: {
+                type: String,
+                enum: EventType,
+                required: true
+            },
+            metadata: {
+                type: Schema.Types.Mixed
+            }
+        },
+        userAgent: {
+            type: String,
+            required: true
+        },
+        userAgentType: {
+            type: String,
+            enum: UserAgentType,
+            required: true
+        },
+        expiresAt: {
+            type: Date,
+            expires: 0
+        }
+    },
+    {
+        timestamps: true
+    }
+);
+
+export const AuditLog = model<IAuditLog>("AuditLog", auditLogSchema); 

backend/src/ee/models/auditLog/enums.ts

@@ -0,0 +1,47 @@
+export enum ActorType {
+    USER = "user",
+    SERVICE = "service"
+}
+
+export enum UserAgentType {
+    WEB = "web",
+    CLI = "cli",
+    K8_OPERATOR = "k8-operator",
+    OTHER = "other"
+}
+
+export enum EventType {
+    GET_SECRETS = "get-secrets",
+    GET_SECRET = "get-secret",
+    REVEAL_SECRET = "reveal-secret",
+    CREATE_SECRET = "create-secret",
+    UPDATE_SECRET = "update-secret",
+    DELETE_SECRET = "delete-secret",
+    GET_WORKSPACE_KEY = "get-workspace-key",
+    AUTHORIZE_INTEGRATION = "authorize-integration",
+    UNAUTHORIZE_INTEGRATION = "unauthorize-integration",
+    CREATE_INTEGRATION = "create-integration",
+    DELETE_INTEGRATION = "delete-integration",
+    ADD_TRUSTED_IP = "add-trusted-ip",
+    UPDATE_TRUSTED_IP = "update-trusted-ip",
+    DELETE_TRUSTED_IP = "delete-trusted-ip",
+    CREATE_SERVICE_TOKEN = "create-service-token",
+    DELETE_SERVICE_TOKEN = "delete-service-token",
+    CREATE_ENVIRONMENT = "create-environment",
+    UPDATE_ENVIRONMENT = "update-environment",
+    DELETE_ENVIRONMENT = "delete-environment",
+    ADD_WORKSPACE_MEMBER = "add-workspace-member",
+    REMOVE_WORKSPACE_MEMBER = "remove-workspace-member",
+    CREATE_FOLDER = "create-folder",
+    UPDATE_FOLDER = "update-folder",
+    DELETE_FOLDER = "delete-folder",
+    CREATE_WEBHOOK = "create-webhook",
+    UPDATE_WEBHOOK_STATUS = "update-webhook-status",
+    DELETE_WEBHOOK = "delete-webhook",
+    GET_SECRET_IMPORTS = "get-secret-imports",
+    CREATE_SECRET_IMPORT = "create-secret-import",
+    UPDATE_SECRET_IMPORT = "update-secret-import",
+    DELETE_SECRET_IMPORT = "delete-secret-import",
+    UPDATE_USER_WORKSPACE_ROLE = "update-user-workspace-role",
+    UPDATE_USER_WORKSPACE_DENIED_PERMISSIONS = "update-user-workspace-denied-permissions"
+}

backend/src/ee/models/auditLog/index.ts

@@ -0,0 +1,3 @@
+export * from "./auditLog";
+export * from "./enums";
+export * from "./types";

backend/src/ee/models/auditLog/types.ts

@@ -0,0 +1,403 @@
+import {
+    ActorType,
+    EventType
+} from "./enums";
+
+interface UserActorMetadata {
+    userId: string;
+    email: string;
+}
+
+interface ServiceActorMetadata {
+    serviceId: string;
+    name: string;
+}
+
+export interface UserActor {
+    type: ActorType.USER;
+    metadata: UserActorMetadata;
+}
+
+export interface ServiceActor {
+    type: ActorType.SERVICE;
+    metadata: ServiceActorMetadata;
+}
+
+export type Actor = 
+    | UserActor
+    | ServiceActor;
+
+interface GetSecretsEvent {
+    type: EventType.GET_SECRETS;
+    metadata: {
+        environment: string;
+        secretPath: string;
+        numberOfSecrets: number;
+    };
+}
+
+interface GetSecretEvent {
+    type: EventType.GET_SECRET;
+    metadata: {
+        environment: string;
+        secretPath: string;
+        secretId: string;
+        secretKey: string;
+        secretVersion: number;
+    };
+}
+
+interface CreateSecretEvent {
+    type: EventType.CREATE_SECRET;
+    metadata: {
+        environment: string;
+        secretPath: string;
+        secretId: string;
+        secretKey: string;
+        secretVersion: number;
+    }
+}
+
+interface UpdateSecretEvent {
+    type: EventType.UPDATE_SECRET;
+    metadata: {
+        environment: string;
+        secretPath: string;
+        secretId: string;
+        secretKey: string;
+        secretVersion: number;
+    }
+}
+
+interface DeleteSecretEvent {
+    type: EventType.DELETE_SECRET;
+    metadata: {
+        environment: string;
+        secretPath: string;
+        secretId: string;
+        secretKey: string;
+        secretVersion: number;
+    }
+}
+
+interface GetWorkspaceKeyEvent {
+    type: EventType.GET_WORKSPACE_KEY,
+    metadata: {
+        keyId: string;
+    }
+}
+
+interface AuthorizeIntegrationEvent {
+    type: EventType.AUTHORIZE_INTEGRATION;
+    metadata: {
+        integration: string;
+    }
+}
+
+interface UnauthorizeIntegrationEvent {
+    type: EventType.UNAUTHORIZE_INTEGRATION;
+    metadata: {
+        integration: string;
+    }
+}
+
+interface CreateIntegrationEvent {
+    type: EventType.CREATE_INTEGRATION;
+    metadata: {
+        integrationId: string;
+        integration: string; // TODO: fix type
+        environment: string;
+        secretPath: string;
+        url?: string;
+        app?: string;
+        appId?: string;
+        targetEnvironment?: string;
+        targetEnvironmentId?: string;
+        targetService?: string;
+        targetServiceId?: string;
+        path?: string;
+        region?: string;
+    }
+}
+
+interface DeleteIntegrationEvent {
+    type: EventType.DELETE_INTEGRATION;
+    metadata: {
+        integrationId: string;
+        integration: string; // TODO: fix type
+        environment: string;
+        secretPath: string;
+        url?: string;
+        app?: string;
+        appId?: string;
+        targetEnvironment?: string;
+        targetEnvironmentId?: string;
+        targetService?: string;
+        targetServiceId?: string;
+        path?: string;
+        region?: string;
+    }
+}
+
+interface AddTrustedIPEvent {
+    type: EventType.ADD_TRUSTED_IP;
+    metadata: {
+        trustedIpId: string;
+        ipAddress: string;
+        prefix?: number;
+    }
+}
+
+interface UpdateTrustedIPEvent {
+    type: EventType.UPDATE_TRUSTED_IP;
+    metadata: {
+        trustedIpId: string;
+        ipAddress: string;
+        prefix?: number;
+    }
+}
+
+interface DeleteTrustedIPEvent {
+    type: EventType.DELETE_TRUSTED_IP;
+    metadata: {
+        trustedIpId: string;
+        ipAddress: string;
+        prefix?: number;
+    }
+}
+
+interface CreateServiceTokenEvent {
+    type: EventType.CREATE_SERVICE_TOKEN;
+    metadata: {
+        name: string;
+        scopes: Array<{
+            environment: string;
+            secretPath: string;
+        }>;
+    }
+}
+
+interface DeleteServiceTokenEvent {
+    type: EventType.DELETE_SERVICE_TOKEN;
+    metadata: {
+        name: string;
+        scopes: Array<{
+            environment: string;
+            secretPath: string;
+        }>;
+    }
+}
+
+interface CreateEnvironmentEvent {
+    type: EventType.CREATE_ENVIRONMENT;
+    metadata: {
+        name: string;
+        slug: string;
+    }
+}
+
+interface UpdateEnvironmentEvent {
+    type: EventType.UPDATE_ENVIRONMENT;
+    metadata: {
+        oldName: string;
+        newName: string;
+        oldSlug: string;
+        newSlug: string;
+    }
+}
+
+interface DeleteEnvironmentEvent {
+    type: EventType.DELETE_ENVIRONMENT;
+    metadata: {
+        name: string;
+        slug: string;
+    }
+}
+
+interface AddWorkspaceMemberEvent {
+    type: EventType.ADD_WORKSPACE_MEMBER;
+    metadata: {
+        userId: string;
+        email: string;
+    }
+}
+
+interface RemoveWorkspaceMemberEvent {
+    type: EventType.REMOVE_WORKSPACE_MEMBER;
+    metadata: {
+        userId: string;
+        email: string;
+    }
+}
+
+interface CreateFolderEvent {
+    type: EventType.CREATE_FOLDER;
+    metadata: {
+        environment: string;
+        folderId: string;
+        folderName: string;
+        folderPath: string;
+    }
+}
+
+interface UpdateFolderEvent {
+    type: EventType.UPDATE_FOLDER;
+    metadata: {
+        environment: string;
+        folderId: string;
+        oldFolderName: string;
+        newFolderName: string;
+        folderPath: string;
+    }
+}
+
+interface DeleteFolderEvent {
+    type: EventType.DELETE_FOLDER;
+    metadata: {
+        environment: string;
+        folderId: string;
+        folderName: string;
+        folderPath: string;
+    }
+}
+
+interface CreateWebhookEvent {
+    type: EventType.CREATE_WEBHOOK,
+    metadata: {
+        webhookId: string;
+        environment: string;
+        secretPath: string;
+        webhookUrl: string;
+        isDisabled: boolean;
+    }
+}
+
+interface UpdateWebhookStatusEvent {
+    type: EventType.UPDATE_WEBHOOK_STATUS,
+    metadata: {
+        webhookId: string;
+        environment: string;
+        secretPath: string;
+        webhookUrl: string;
+        isDisabled: boolean;
+    }
+}
+
+interface DeleteWebhookEvent {
+    type: EventType.DELETE_WEBHOOK,
+    metadata: {
+        webhookId: string;
+        environment: string;
+        secretPath: string;
+        webhookUrl: string;
+        isDisabled: boolean;
+    }
+}
+
+interface GetSecretImportsEvent {
+    type: EventType.GET_SECRET_IMPORTS,
+    metadata: {
+        environment: string;
+        secretImportId: string;
+        folderId: string;
+        numberOfImports: number;
+    }
+}
+
+interface CreateSecretImportEvent {
+    type: EventType.CREATE_SECRET_IMPORT,
+    metadata: {
+        secretImportId: string;
+        folderId: string;
+        importFromEnvironment: string;
+        importFromSecretPath: string;
+        importToEnvironment: string;
+        importToSecretPath: string;
+    }
+}
+
+interface UpdateSecretImportEvent {
+    type: EventType.UPDATE_SECRET_IMPORT,
+    metadata: {
+        secretImportId: string;
+        folderId: string;
+        importToEnvironment: string;
+        importToSecretPath: string;
+        orderBefore: {
+          environment: string;
+          secretPath: string;
+        }[],
+        orderAfter: {
+          environment: string;
+          secretPath: string;
+        }[]
+    }
+}
+
+interface DeleteSecretImportEvent {
+    type: EventType.DELETE_SECRET_IMPORT,
+    metadata: {
+        secretImportId: string;
+        folderId: string;
+        importFromEnvironment: string;
+        importFromSecretPath: string;
+        importToEnvironment: string;
+        importToSecretPath: string;
+    }
+}
+
+interface UpdateUserRole {
+    type: EventType.UPDATE_USER_WORKSPACE_ROLE,
+    metadata: {
+        userId: string;
+        email: string;
+        oldRole: string;
+        newRole: string;
+    }
+}
+
+interface UpdateUserDeniedPermissions {
+    type: EventType.UPDATE_USER_WORKSPACE_DENIED_PERMISSIONS,
+    metadata: {
+        userId: string;
+        email: string;
+        deniedPermissions: {
+            environmentSlug: string;
+            ability: string;
+        }[]
+    }
+}
+
+export type Event = 
+    | GetSecretsEvent
+    | GetSecretEvent
+    | CreateSecretEvent
+    | UpdateSecretEvent
+    | DeleteSecretEvent
+    | GetWorkspaceKeyEvent
+    | AuthorizeIntegrationEvent
+    | UnauthorizeIntegrationEvent
+    | CreateIntegrationEvent
+    | DeleteIntegrationEvent
+    | AddTrustedIPEvent
+    | UpdateTrustedIPEvent
+    | DeleteTrustedIPEvent
+    | CreateServiceTokenEvent
+    | DeleteServiceTokenEvent
+    | CreateEnvironmentEvent
+    | UpdateEnvironmentEvent
+    | DeleteEnvironmentEvent
+    | AddWorkspaceMemberEvent
+    | RemoveWorkspaceMemberEvent
+    | CreateFolderEvent
+    | UpdateFolderEvent
+    | DeleteFolderEvent
+    | CreateWebhookEvent
+    | UpdateWebhookStatusEvent
+    | DeleteWebhookEvent
+    | GetSecretImportsEvent
+    | CreateSecretImportEvent
+    | UpdateSecretImportEvent
+    | DeleteSecretImportEvent
+    | UpdateUserRole
+    | UpdateUserDeniedPermissions;

backend/src/ee/models/folderVersion.ts

@@ -52,9 +52,7 @@ const folderRootVersionSchema = new Schema<TFolderRootVersionSchema>(
   }
 );
 
-const FolderVersion = model<TFolderRootVersionSchema>(
+export const FolderVersion = model<TFolderRootVersionSchema>(
   "FolderVersion",
   folderRootVersionSchema
-);
-
-export default FolderVersion;
+);

backend/src/ee/models/index.ts

@@ -1,21 +1,11 @@
-import SecretSnapshot, { ISecretSnapshot } from "./secretSnapshot";
-import SecretVersion, { ISecretVersion } from "./secretVersion";
-import FolderVersion, { TFolderRootVersionSchema } from "./folderVersion";
-import Log, { ILog } from "./log";
-import Action, { IAction } from "./action";
-import SSOConfig, { ISSOConfig } from "./ssoConfig";
-
-export {
-  SecretSnapshot,
-  ISecretSnapshot,
-  SecretVersion,
-  ISecretVersion,
-  FolderVersion,
-  TFolderRootVersionSchema,
-  Log,
-  ILog,
-  Action,
-  IAction,
-  SSOConfig,
-  ISSOConfig
-};
+export * from "./secretSnapshot";
+export * from "./secretVersion";
+export * from "./folderVersion";
+export * from "./log";
+export * from "./action";
+export * from "./ssoConfig";
+export * from "./trustedIp";
+export * from "./auditLog";
+export * from  "./gitRisks";
+export * from  "./gitAppOrganizationInstallation";
+export * from  "./gitAppInstallationSession";

backend/src/ee/models/log.ts

@@ -69,6 +69,4 @@ const logSchema = new Schema<ILog>(
     }
 );
 
-const Log = model<ILog>("Log", logSchema);
-
-export default Log;
+export const Log = model<ILog>("Log", logSchema);

backend/src/ee/models/role.ts

@@ -0,0 +1,55 @@
+import { Schema, Types, model } from "mongoose";
+
+export interface IRole {
+  _id: Types.ObjectId;
+  name: string;
+  description: string;
+  slug: string;
+  permissions: Array<unknown>;
+  workspace: Types.ObjectId;
+  organization: Types.ObjectId;
+  isOrgRole: boolean;
+}
+
+const roleSchema = new Schema<IRole>(
+  {
+    name: {
+      type: String,
+      required: true
+    },
+    organization: {
+      type: Schema.Types.ObjectId,
+      ref: "Organization",
+      required: true
+    },
+    workspace: {
+      type: Schema.Types.ObjectId,
+      ref: "Workspace"
+    },
+    isOrgRole: {
+      type: Boolean,
+      required: true,
+      select: false
+    },
+    description: {
+      type: String
+    },
+    slug: {
+      type: String,
+      required: true
+    },
+    permissions: {
+      type: Array,
+      required: true
+    }
+  },
+  {
+    timestamps: true
+  }
+);
+
+roleSchema.index({ organization: 1, workspace: 1 });
+
+const Role = model<IRole>("Role", roleSchema);
+
+export default Role;

backend/src/ee/models/secretSnapshot.ts

@@ -46,9 +46,7 @@ const secretSnapshotSchema = new Schema<ISecretSnapshot>(
   }
 );
 
-const SecretSnapshot = model<ISecretSnapshot>(
+export const SecretSnapshot = model<ISecretSnapshot>(
   "SecretSnapshot",
   secretSnapshotSchema
-);
-
-export default SecretSnapshot;
+);

backend/src/ee/models/secretVersion.ts

@@ -117,16 +117,14 @@ const secretVersionSchema = new Schema<ISecretVersion>(
       ref: "Tag",
       type: [Schema.Types.ObjectId],
       default: [],
-    },
+    }
   },
   {
     timestamps: true,
   }
 );
 
-const SecretVersion = model<ISecretVersion>(
+export const SecretVersion = model<ISecretVersion>(
   "SecretVersion",
   secretVersionSchema
-);
-
-export default SecretVersion;
+);

backend/src/ee/models/ssoConfig.ts

@@ -1,8 +1,14 @@
 import { Schema, Types, model } from "mongoose";
 
+export enum AuthProvider {
+    OKTA_SAML = "okta-saml",
+    AZURE_SAML = "azure-saml",
+    JUMPCLOUD_SAML = "jumpcloud-saml"
+}
+
 export interface ISSOConfig {
     organization: Types.ObjectId;
-    authProvider: "okta-saml"
+    authProvider: AuthProvider;
     isActive: boolean;
     encryptedEntryPoint: string;
     entryPointIV: string;
@@ -13,9 +19,6 @@ export interface ISSOConfig {
     encryptedCert: string;
     certIV: string;
     certTag: string;
-    encryptedAudience: string;
-    audienceIV: string;
-    audienceTag: string;
 }
 
 const ssoConfigSchema = new Schema<ISSOConfig>(
@@ -26,9 +29,7 @@ const ssoConfigSchema = new Schema<ISSOConfig>(
         },
         authProvider: {
             type: String,
-            enum: [
-                "okta-saml"
-            ],
+            enum: AuthProvider,
             required: true
         },
         isActive: {
@@ -61,15 +62,6 @@ const ssoConfigSchema = new Schema<ISSOConfig>(
         },
         certTag: {
             type: String
-        },
-        encryptedAudience: {
-            type: String
-        },
-        audienceIV: {
-            type: String
-        },
-        audienceTag: {
-            type: String
         }
     },
     {
@@ -77,6 +69,4 @@ const ssoConfigSchema = new Schema<ISSOConfig>(
     }
 );
 
-const SSOConfig = model<ISSOConfig>("SSOConfig", ssoConfigSchema);
-
-export default SSOConfig;
+export const SSOConfig = model<ISSOConfig>("SSOConfig", ssoConfigSchema);

backend/src/ee/models/trustedIp.ts

@@ -0,0 +1,54 @@
+import { Schema, Types, model } from "mongoose";
+
+export enum IPType {
+    IPV4 = "ipv4",
+    IPV6 = "ipv6"
+}
+
+export interface ITrustedIP {
+    _id: Types.ObjectId;
+    workspace: Types.ObjectId;
+    ipAddress: string;
+    type: "ipv4" | "ipv6", // either IPv4/IPv6 address or network IPv4/IPv6 address
+    isActive: boolean;
+    comment: string;
+    prefix?: number; // CIDR
+}
+
+const trustedIpSchema = new Schema<ITrustedIP>(
+    {
+        workspace: {
+            type: Schema.Types.ObjectId,
+            ref: "Workspace",
+            required: true
+        },
+        ipAddress: {
+            type: String,
+            required: true
+        },
+        type: {
+            type: String,
+            enum: [
+                IPType.IPV4,
+                IPType.IPV6
+            ],
+            required: true
+        },
+        prefix: {
+            type: Number,
+            required: false
+        },
+        isActive: {
+            type: Boolean,
+            required: true
+        },
+        comment: {
+            type: String
+        }
+    },
+    {
+        timestamps: true
+    }
+);
+
+export const TrustedIP = model<ITrustedIP>("TrustedIP", trustedIpSchema);

backend/src/ee/routes/v1/action.ts

@@ -1,17 +1,8 @@
 import express from "express";
 const router = express.Router();
-import {
-    validateRequest,
-} from "../../../middleware";
-import { param } from "express-validator";
 import { actionController } from "../../controllers/v1";
 
 // TODO: put into action controller
-router.get(
-    "/:actionId",
-    param("actionId").exists().trim(),
-    validateRequest,
-    actionController.getAction
-);
+router.get("/:actionId", actionController.getAction);
 
-export default router;
+export default router;

backend/src/ee/routes/v1/cloudProducts.ts

@@ -1,20 +1,16 @@
 import express from "express";
 const router = express.Router();
-import {
-    requireAuth,
-    validateRequest,
-} from "../../../middleware";
-import { query } from "express-validator";
+import { requireAuth, validateRequest } from "../../../middleware";
 import { cloudProductsController } from "../../controllers/v1";
+import { AuthMode } from "../../../variables";
 
 router.get(
-    "/",
-    requireAuth({
-		acceptedAuthModes: ["jwt", "apiKey"],
-	}),
-    query("billing-cycle").exists().isIn(["monthly", "yearly"]),
-    validateRequest,
-    cloudProductsController.getCloudProducts 
+  "/",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  validateRequest,
+  cloudProductsController.getCloudProducts
 );
 
-export default router;
+export default router;

backend/src/ee/routes/v1/index.ts

@@ -2,16 +2,22 @@ import secret from "./secret";
 import secretSnapshot from "./secretSnapshot";
 import organizations from "./organizations";
 import sso from "./sso";
+import users from "./users";
 import workspace from "./workspace";
 import action from "./action";
 import cloudProducts from "./cloudProducts";
+import secretScanning from "./secretScanning";
+import roles from "./role";
 
 export {
-    secret,
-    secretSnapshot,
-    organizations,
-    sso,
-    workspace,
-    action,
-    cloudProducts,
-}
+  secret,
+  secretSnapshot,
+  organizations,
+  sso,
+  users,
+  workspace,
+  action,
+  cloudProducts,
+  secretScanning,
+  roles
+};

backend/src/ee/routes/v1/organizations.ts

@@ -1,223 +1,127 @@
 import express from "express";
 const router = express.Router();
-import {
-    requireAuth,
-    requireOrganizationAuth,
-    validateRequest,
-} from "../../../middleware";
-import { body, param, query } from "express-validator";
+import { requireAuth } from "../../../middleware";
 import { organizationsController } from "../../controllers/v1";
-import {
-    ACCEPTED, ADMIN, MEMBER, OWNER,
-} from "../../../variables";
+import { AuthMode } from "../../../variables";
 
 router.get(
-    "/:organizationId/plans/table",
-    requireAuth({
-		acceptedAuthModes: ["jwt"],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    query("billingCycle").exists().isString().isIn(["monthly", "yearly"]),
-    validateRequest,
-    organizationsController.getOrganizationPlansTable
+  "/:organizationId/plans/table",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.getOrganizationPlansTable
 );
 
 router.get(
-    "/:organizationId/plan",
-    requireAuth({
-		acceptedAuthModes: ["jwt"],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    query("workspaceId").optional().isString(),
-    validateRequest,
-    organizationsController.getOrganizationPlan
+  "/:organizationId/plan",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.getOrganizationPlan
 );
 
 router.post(
-    "/:organizationId/session/trial",
-    requireAuth({
-		acceptedAuthModes: ["jwt"],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    body("success_url").exists().trim(),
-    validateRequest,
-    organizationsController.startOrganizationTrial
+  "/:organizationId/session/trial",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.startOrganizationTrial
 );
 
 router.get(
-    "/:organizationId/plan/billing",
-    requireAuth({
-		acceptedAuthModes: ["jwt"],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    query("workspaceId").optional().isString(),
-    validateRequest,
-    organizationsController.getOrganizationPlanBillingInfo
+  "/:organizationId/plan/billing",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.getOrganizationPlanBillingInfo
 );
 
 router.get(
-    "/:organizationId/plan/table",
-    requireAuth({
-		acceptedAuthModes: ["jwt"],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    query("workspaceId").optional().isString(),
-    validateRequest,
-    organizationsController.getOrganizationPlanTable
+  "/:organizationId/plan/table",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.getOrganizationPlanTable
 );
 
 router.get(
-    "/:organizationId/billing-details",
-    requireAuth({
-		acceptedAuthModes: ["jwt"],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    validateRequest,
-    organizationsController.getOrganizationBillingDetails
+  "/:organizationId/billing-details",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.getOrganizationBillingDetails
 );
 
 router.patch(
-    "/:organizationId/billing-details",
-    requireAuth({
-		acceptedAuthModes: ["jwt"],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    body("email").optional().isString().trim(),
-    body("name").optional().isString().trim(),
-    validateRequest,
-    organizationsController.updateOrganizationBillingDetails
+  "/:organizationId/billing-details",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.updateOrganizationBillingDetails
 );
 
 router.get(
-    "/:organizationId/billing-details/payment-methods",
-    requireAuth({
-		acceptedAuthModes: ["jwt"],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    validateRequest,
-    organizationsController.getOrganizationPmtMethods
+  "/:organizationId/billing-details/payment-methods",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.getOrganizationPmtMethods
 );
 
 router.post(
-    "/:organizationId/billing-details/payment-methods",
-    requireAuth({
-		acceptedAuthModes: ["jwt"],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    body("success_url").exists().isString(),
-    body("cancel_url").exists().isString(),
-    validateRequest,
-    organizationsController.addOrganizationPmtMethod
+  "/:organizationId/billing-details/payment-methods",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.addOrganizationPmtMethod
 );
 
 router.delete(
-    "/:organizationId/billing-details/payment-methods/:pmtMethodId",
-    requireAuth({
-		acceptedAuthModes: ["jwt"],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    param("pmtMethodId").exists().trim(),
-    validateRequest,
-    organizationsController.deleteOrganizationPmtMethod
+  "/:organizationId/billing-details/payment-methods/:pmtMethodId",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.deleteOrganizationPmtMethod
 );
 
 router.get(
-    "/:organizationId/billing-details/tax-ids",
-    requireAuth({
-		acceptedAuthModes: ["jwt"],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    validateRequest,
-    organizationsController.getOrganizationTaxIds
+  "/:organizationId/billing-details/tax-ids",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.getOrganizationTaxIds
 );
 
 router.post(
-    "/:organizationId/billing-details/tax-ids",
-    requireAuth({
-		acceptedAuthModes: ["jwt"],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    body("type").exists().isString(),
-    body("value").exists().isString(),
-    validateRequest,
-    organizationsController.addOrganizationTaxId
+  "/:organizationId/billing-details/tax-ids",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.addOrganizationTaxId
 );
 
 router.delete(
-    "/:organizationId/billing-details/tax-ids/:taxId",
-    requireAuth({
-		acceptedAuthModes: ["jwt"],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    param("taxId").exists().trim(),
-    validateRequest,
-    organizationsController.deleteOrganizationTaxId
+  "/:organizationId/billing-details/tax-ids/:taxId",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.deleteOrganizationTaxId
 );
 
 router.get(
-    "/:organizationId/invoices",
-    requireAuth({
-		acceptedAuthModes: ["jwt"],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    validateRequest,
-    organizationsController.getOrganizationInvoices
+  "/:organizationId/invoices",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.getOrganizationInvoices
 );
 
-export default router;
+router.get(
+  "/:organizationId/licenses",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.getOrganizationLicenses
+);
+
+export default router;

backend/src/ee/routes/v1/role.ts

@@ -0,0 +1,33 @@
+import express from "express";
+import { roleController } from "../../controllers/v1";
+import { requireAuth } from "../../../middleware";
+import { AuthMode } from "../../../variables";
+
+const router = express.Router();
+
+router.post("/", requireAuth({ acceptedAuthModes: [AuthMode.JWT] }), roleController.createRole);
+
+router.patch("/:id", requireAuth({ acceptedAuthModes: [AuthMode.JWT] }), roleController.updateRole);
+
+router.delete(
+  "/:id",
+  requireAuth({ acceptedAuthModes: [AuthMode.JWT] }),
+  roleController.deleteRole
+);
+
+router.get("/", requireAuth({ acceptedAuthModes: [AuthMode.JWT] }), roleController.getRoles);
+
+// get a user permissions in an org
+router.get(
+  "/organization/:orgId/permissions",
+  requireAuth({ acceptedAuthModes: [AuthMode.JWT] }),
+  roleController.getUserPermissions
+);
+
+router.get(
+  "/workspace/:workspaceId/permissions",
+  requireAuth({ acceptedAuthModes: [AuthMode.JWT] }),
+  roleController.getUserWorkspacePermissions
+);
+
+export default router;

backend/src/ee/routes/v1/secret.ts

@@ -1,47 +1,25 @@
 import express from "express";
 const router = express.Router();
-import {
-    requireAuth,
-	requireSecretAuth,
-    validateRequest,
-} from "../../../middleware";
-import { body, param, query } from "express-validator";
+import { requireAuth } from "../../../middleware";
 import { secretController } from "../../controllers/v1";
 import {
-	ADMIN, 
-	MEMBER,
-	PERMISSION_READ_SECRETS,
-	PERMISSION_WRITE_SECRETS,
+  AuthMode
 } from "../../../variables";
 
 router.get(
-	"/:secretId/secret-versions",
-	requireAuth({
-		acceptedAuthModes: ["jwt", "apiKey"],
-	}),
-	requireSecretAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		requiredPermissions: [PERMISSION_READ_SECRETS],
-	}),
-	param("secretId").exists().trim(),
-	query("offset").exists().isInt(),
-	query("limit").exists().isInt(),
-	validateRequest,
-	secretController.getSecretVersions
+  "/:secretId/secret-versions",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  secretController.getSecretVersions
 );
 
 router.post(
-	"/:secretId/secret-versions/rollback",
-	requireAuth({
-		acceptedAuthModes: ["jwt", "apiKey"],
-	}),
-	requireSecretAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		requiredPermissions: [PERMISSION_READ_SECRETS, PERMISSION_WRITE_SECRETS],
-	}),
-	param("secretId").exists().trim(),
-	body("version").exists().isInt(),
-	secretController.rollbackSecretVersion
+  "/:secretId/secret-versions/rollback",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  secretController.rollbackSecretVersion
 );
 
-export default router;
+export default router;

backend/src/ee/routes/v1/secretScanning.ts

@@ -0,0 +1,53 @@
+import express from "express";
+const router = express.Router();
+import { requireAuth } from "../../../middleware";
+import {
+  createInstallationSession,
+  getCurrentOrganizationInstallationStatus,
+  getRisksForOrganization,
+  linkInstallationToOrganization,
+  updateRisksStatus
+} from "../../../controllers/v1/secretScanningController";
+import { AuthMode } from "../../../variables";
+
+router.post(
+  "/create-installation-session/organization/:organizationId",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  createInstallationSession
+);
+
+router.post(
+  "/link-installation",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  linkInstallationToOrganization
+);
+
+router.get(
+  "/installation-status/organization/:organizationId",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  getCurrentOrganizationInstallationStatus
+);
+
+router.get(
+  "/organization/:organizationId/risks",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  getRisksForOrganization
+);
+
+router.post(
+  "/organization/:organizationId/risks/:riskId/status",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  updateRisksStatus
+);
+
+export default router;

backend/src/ee/routes/v1/secretSnapshot.ts

@@ -1,27 +1,15 @@
 import express from "express";
 const router = express.Router();
-import {
-    requireSecretSnapshotAuth,
-} from "../../middleware";
-import {
-    requireAuth,
-    validateRequest,
-} from "../../../middleware";
-import { param } from "express-validator";
-import { ADMIN, MEMBER } from "../../../variables";
+import { requireAuth } from "../../../middleware";
+import { AuthMode } from "../../../variables";
 import { secretSnapshotController } from "../../controllers/v1";
 
 router.get(
-    "/:secretSnapshotId",
-    requireAuth({
-		acceptedAuthModes: ["jwt"],
-	}),
-    requireSecretSnapshotAuth({
-        acceptedRoles: [ADMIN, MEMBER],
-    }),
-    param("secretSnapshotId").exists().trim(),
-    validateRequest,
-    secretSnapshotController.getSecretSnapshot
+  "/:secretSnapshotId",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  secretSnapshotController.getSecretSnapshot
 );
 
-export default router;
+export default router;

backend/src/ee/routes/v1/sso.ts

@@ -1,110 +1,95 @@
 import express from "express";
 const router = express.Router();
 import passport from "passport";
-import {
-    requireAuth,
-    requireOrganizationAuth,
-    validateRequest,
-} from "../../../middleware";
-import { body, query } from "express-validator";
+import { requireAuth } from "../../../middleware";
 import { ssoController } from "../../controllers/v1";
 import { authLimiter } from "../../../helpers/rateLimiter";
-import {
-    ACCEPTED,
-    ADMIN,
-    OWNER
-} from "../../../variables";
+import { AuthMode } from "../../../variables";
 
-router.get(
-  "/redirect/google",
-  authLimiter,
+router.get("/redirect/google", authLimiter, (req, res, next) => {
   passport.authenticate("google", {
     scope: ["profile", "email"],
     session: false,
-  })
-);
+    ...(req.query.callback_port
+      ? {
+          state: req.query.callback_port as string
+        }
+      : {})
+  })(req, res, next);
+});
 
 router.get(
   "/google",
-  passport.authenticate("google", { 
-    failureRedirect: "/login/provider/error", 
-    session: false 
+  passport.authenticate("google", {
+    failureRedirect: "/login/provider/error",
+    session: false
   }),
   ssoController.redirectSSO
 );
 
+router.get("/redirect/github", authLimiter, (req, res, next) => {
+  passport.authenticate("github", {
+    session: false,
+    ...(req.query.callback_port
+      ? {
+          state: req.query.callback_port as string
+        }
+      : {})
+  })(req, res, next);
+});
+
 router.get(
-  "/redirect/saml2/:ssoIdentifier",
+  "/github",
   authLimiter,
-  passport.authenticate("saml", {
-    failureRedirect: "/login/fail"
-  })
+  passport.authenticate("github", {
+    failureRedirect: "/login/provider/error",
+    session: false
+  }),
+  ssoController.redirectSSO
 );
 
-router.post("/saml2/:ssoIdentifier",
-  passport.authenticate("saml", { 
-    failureRedirect: "/login/provider/error", 
-    failureFlash: true, 
-    session: false 
+router.get("/redirect/saml2/:ssoIdentifier", authLimiter, (req, res, next) => {
+  const options = {
+    failureRedirect: "/",
+    additionalParams: {
+      RelayState: req.query.callback_port ?? ""
+    }
+  };
+  passport.authenticate("saml", options)(req, res, next);
+});
+
+router.post(
+  "/saml2/:ssoIdentifier",
+  passport.authenticate("saml", {
+    failureRedirect: "/login/provider/error",
+    failureFlash: true,
+    session: false
   }),
   ssoController.redirectSSO
 );
 
 router.get(
-    "/config",
-    requireAuth({
-		acceptedAuthModes: ["jwt"],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN],
-        acceptedStatuses: [ACCEPTED],
-        locationOrganizationId: "query"
-    }),
-    query("organizationId").exists().trim(),
-    validateRequest,
-    ssoController.getSSOConfig
+  "/config",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  ssoController.getSSOConfig
 );
 
 router.post(
-    "/config",
-    requireAuth({
-		acceptedAuthModes: ["jwt"],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN],
-        acceptedStatuses: [ACCEPTED],
-        locationOrganizationId: "body"
-    }),
-    body("organizationId").exists().trim(),
-    body("authProvider").exists().isString(),
-    body("isActive").exists().isBoolean(),
-    body("entryPoint").exists().isString(),
-    body("issuer").exists().isString(),
-    body("cert").exists().isString(),
-    body("audience").exists().isString(),
-    validateRequest,
-    ssoController.createSSOConfig
+  "/config",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  ssoController.createSSOConfig
 );
 
 router.patch(
-    "/config",
-    requireAuth({
-		acceptedAuthModes: ["jwt"],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN],
-        acceptedStatuses: [ACCEPTED],
-        locationOrganizationId: "body"
-    }),
-    body("organizationId").exists().trim(),
-    body("authProvider").optional().isString(),
-    body("isActive").optional().isBoolean(),
-    body("entryPoint").optional().isString(),
-    body("issuer").optional().isString(),
-    body("cert").optional().isString(),
-    body("audience").optional().isString(),
-    validateRequest,
-    ssoController.updateSSOConfig
+  "/config",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  ssoController.updateSSOConfig
 );
 
-export default router;
+export default router;

backend/src/ee/routes/v1/users.ts

@@ -0,0 +1,17 @@
+import express from "express";
+const router = express.Router();
+import {
+    requireAuth
+} from "../../../middleware";
+import { AuthMode } from "../../../variables";
+import { usersController } from "../../controllers/v1";
+
+router.get(
+    "/me/ip",
+    requireAuth({
+        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
+    }),
+    usersController.getMyIp
+);
+
+export default router;

backend/src/ee/routes/v1/workspace.ts

@@ -1,82 +1,87 @@
 import express from "express";
 const router = express.Router();
-import {
-  requireAuth,
-  requireWorkspaceAuth,
-  validateRequest,
-} from "../../../middleware";
-import { body, param, query } from "express-validator";
-import { ADMIN, MEMBER } from "../../../variables";
+import { requireAuth } from "../../../middleware";
+import { AuthMode } from "../../../variables";
 import { workspaceController } from "../../controllers/v1";
 
 router.get(
   "/:workspaceId/secret-snapshots",
   requireAuth({
-    acceptedAuthModes: ["jwt", "apiKey"],
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "params",
-  }),
-  param("workspaceId").exists().trim(),
-  query("environment").isString().exists().trim(),
-  query("folderId").default("root").isString().trim(),
-  query("offset").exists().isInt(),
-  query("limit").exists().isInt(),
-  validateRequest,
   workspaceController.getWorkspaceSecretSnapshots
 );
 
 router.get(
   "/:workspaceId/secret-snapshots/count",
   requireAuth({
-    acceptedAuthModes: ["jwt"],
+    acceptedAuthModes: [AuthMode.JWT]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "params",
-  }),
-  param("workspaceId").exists().trim(),
-  query("environment").isString().exists().trim(),
-  query("folderId").default("root").isString().trim(),
-  validateRequest,
   workspaceController.getWorkspaceSecretSnapshotsCount
 );
 
 router.post(
   "/:workspaceId/secret-snapshots/rollback",
   requireAuth({
-    acceptedAuthModes: ["jwt", "apiKey"],
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "params",
-  }),
-  param("workspaceId").exists().trim(),
-  body("environment").isString().exists().trim(),
-  query("folderId").default("root").isString().exists().trim(),
-  body("version").exists().isInt(),
-  validateRequest,
   workspaceController.rollbackWorkspaceSecretSnapshot
 );
 
 router.get(
   "/:workspaceId/logs",
   requireAuth({
-    acceptedAuthModes: ["jwt", "apiKey"],
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "params",
-  }),
-  param("workspaceId").exists().trim(),
-  query("offset").exists().isInt(),
-  query("limit").exists().isInt(),
-  query("sortBy"),
-  query("userId"),
-  query("actionNames"),
-  validateRequest,
   workspaceController.getWorkspaceLogs
 );
 
+router.get(
+  "/:workspaceId/audit-logs",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  workspaceController.getWorkspaceAuditLogs
+);
+
+router.get(
+  "/:workspaceId/audit-logs/filters/actors",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  workspaceController.getWorkspaceAuditLogActorFilterOpts
+);
+
+router.get(
+  "/:workspaceId/trusted-ips",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  workspaceController.getWorkspaceTrustedIps
+);
+
+router.post(
+  "/:workspaceId/trusted-ips",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  workspaceController.addWorkspaceTrustedIp
+);
+
+router.patch(
+  "/:workspaceId/trusted-ips/:trustedIpId",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  workspaceController.updateWorkspaceTrustedIp
+);
+
+router.delete(
+  "/:workspaceId/trusted-ips/:trustedIpId",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  workspaceController.deleteWorkspaceTrustedIp
+);
+
 export default router;

backend/src/ee/services/EEAuditLogService.ts

@@ -0,0 +1,50 @@
+import { Types } from "mongoose";
+import { AuditLog, Event } from "../models";
+import { AuthData } from "../../interfaces/middleware";
+import EELicenseService from "./EELicenseService";
+import { Workspace } from "../../models";
+import { OrganizationNotFoundError } from "../../utils/errors";
+
+interface EventScope {
+    workspaceId?: Types.ObjectId;
+    organizationId?: Types.ObjectId;
+}
+
+type ValidEventScope = 
+    | Required<Pick<EventScope, "workspaceId">>
+    | Required<Pick<EventScope, "organizationId">>
+    | Required<EventScope>
+
+export default class EEAuditLogService {
+    static async createAuditLog(authData: AuthData, event: Event, eventScope: ValidEventScope, shouldSave = true) {
+        
+        const MS_IN_DAY = 24 * 60 * 60 * 1000;
+        
+        const organizationId = ("organizationId" in eventScope)
+            ? eventScope.organizationId
+            : (await Workspace.findById(eventScope.workspaceId).select("organization").lean())?.organization;
+        
+        if (!organizationId) throw OrganizationNotFoundError({
+            message: "createAuditLog: Failed to create audit log due to missing organizationId"
+        });
+
+        const ttl = (await EELicenseService.getPlan(organizationId)).auditLogsRetentionDays * MS_IN_DAY;
+        
+        const auditLog = await new AuditLog({
+            actor: authData.actor,
+            organization: organizationId,
+            workspace: ("workspaceId" in eventScope) ? eventScope.workspaceId : undefined,
+            ipAddress: authData.ipAddress,
+            event,
+            userAgent: authData.userAgent,
+            userAgentType: authData.userAgentType,
+            expiresAt: new Date(Date.now() + ttl)
+        });
+        
+        if (shouldSave) {
+            await auditLog.save();
+        }
+        
+        return auditLog;
+    }
+}

backend/src/ee/services/EELicenseService.ts

@@ -1,3 +1,4 @@
+import { Types } from "mongoose";
 import * as Sentry from "@sentry/node";
 import NodeCache from "node-cache";
 import { 
@@ -26,10 +27,12 @@ interface FeatureSet {
     environmentsUsed: number;
     secretVersioning: boolean;
     pitRecovery: boolean;
+    ipAllowlisting: boolean;
     rbac: boolean;
     customRateLimits: boolean;
     customAlerts: boolean;
     auditLogs: boolean;
+    auditLogsRetentionDays: number;
     samlSSO: boolean;
     status: "incomplete" | "incomplete_expired" | "trialing" | "active" | "past_due" | "canceled" | "unpaid" | null;
     trial_end: number | null;
@@ -60,10 +63,12 @@ class EELicenseService {
         environmentsUsed: 0,
         secretVersioning: true,
         pitRecovery: false,
+        ipAllowlisting: false,
         rbac: true,
-        customRateLimits: true,
-        customAlerts: true,
+        customRateLimits: false,
+        customAlerts: false,
         auditLogs: false,
+        auditLogsRetentionDays: 0,
         samlSSO: false,
         status: null,
         trial_end: null,
@@ -79,10 +84,10 @@ class EELicenseService {
         });
     }
     
-    public async getPlan(organizationId: string, workspaceId?: string): Promise<FeatureSet> {
+    public async getPlan(organizationId: Types.ObjectId, workspaceId?: Types.ObjectId): Promise<FeatureSet> {
         try {
             if (this.instanceType === "cloud") {
-                const cachedPlan = this.localFeatureSet.get<FeatureSet>(`${organizationId}-${workspaceId ?? ""}`);
+                const cachedPlan = this.localFeatureSet.get<FeatureSet>(`${organizationId.toString()}-${workspaceId?.toString() ?? ""}`);
                 if (cachedPlan) {
                     return cachedPlan;
                 }
@@ -99,7 +104,7 @@ class EELicenseService {
                 const { data: { currentPlan } } = await licenseServerKeyRequest.get(url);
 
                 // cache fetched plan for organization
-                this.localFeatureSet.set(`${organizationId}-${workspaceId ?? ""}`, currentPlan);
+                this.localFeatureSet.set(`${organizationId.toString()}-${workspaceId?.toString() ?? ""}`, currentPlan);
 
                 return currentPlan;
             }
@@ -110,16 +115,16 @@ class EELicenseService {
         return this.globalFeatureSet;
     }
     
-    public async refreshPlan(organizationId: string, workspaceId?: string) {
+    public async refreshPlan(organizationId: Types.ObjectId, workspaceId?: Types.ObjectId) {
         if (this.instanceType === "cloud") {
-            this.localFeatureSet.del(`${organizationId}-${workspaceId ?? ""}`);
+            this.localFeatureSet.del(`${organizationId.toString()}-${workspaceId?.toString() ?? ""}`);
             await this.getPlan(organizationId, workspaceId);
         }
     }
     
-    public async delPlan(organizationId: string) {
+    public async delPlan(organizationId: Types.ObjectId) {
         if (this.instanceType === "cloud") {
-            this.localFeatureSet.del(`${organizationId}-`);
+            this.localFeatureSet.del(`${organizationId.toString()}-`);
         }
     }
 

backend/src/ee/services/EESecretService.ts

@@ -10,7 +10,7 @@ import EELicenseService from "./EELicenseService";
 /**
  * Class to handle Enterprise Edition secret actions
  */
-class EESecretService {
+export default class EESecretService {
   /**
    * Save a secret snapshot that is a copy of the current state of secrets in workspace with id
    * [workspaceId] under a new snapshot with incremented version under the
@@ -71,5 +71,3 @@ class EESecretService {
     });
   }
 }
-
-export default EESecretService;

backend/src/ee/services/GithubSecretScanning/GithubSecretScanningService.ts

@@ -0,0 +1,45 @@
+import { Probot } from "probot";
+import GitRisks from "../../models/gitRisks";
+import GitAppOrganizationInstallation from "../../models/gitAppOrganizationInstallation";
+import { scanGithubPushEventForSecretLeaks } from "../../../queues/secret-scanning/githubScanPushEvent";
+export default async (app: Probot) => {
+  app.on("installation.deleted", async (context) => {
+    const { payload } = context;
+    const { installation, repositories } = payload;
+    if (repositories) {
+      for (const repository of repositories) {
+        await GitRisks.deleteMany({ repositoryId: repository.id })
+      }
+      await GitAppOrganizationInstallation.deleteOne({ installationId: installation.id })
+    }
+  })
+
+  app.on("installation", async (context) => {
+    const { payload } = context;
+    payload.repositories
+    const { installation, repositories } = payload;
+    // TODO: start full repo scans 
+  })
+
+  app.on("push", async (context) => {
+    const { payload } = context;
+    const { commits, repository, installation, pusher } = payload;
+
+    if (!commits || !repository || !installation || !pusher) {
+      return
+    }
+
+    const installationLinkToOrgExists = await GitAppOrganizationInstallation.findOne({ installationId: installation?.id }).lean()
+    if (!installationLinkToOrgExists) {
+      return
+    }
+
+    scanGithubPushEventForSecretLeaks({
+      commits: commits,
+      pusher: { name: pusher.name, email: pusher.email },
+      repository: { fullName: repository.full_name, id: repository.id },
+      organizationId: installationLinkToOrgExists.organizationId,
+      installationId: installation.id
+    })
+  });
+};

backend/src/ee/services/GithubSecretScanning/helper.ts

@@ -0,0 +1,142 @@
+import { exec } from "child_process";
+import { mkdir, readFile, rm, writeFile } from "fs";
+import { tmpdir } from "os";
+import { join } from "path"
+import { SecretMatch } from "./types";
+
+export async function scanFullRepoContentAndGetFindings(octokit: any, installationId: number, repositoryFullName: string): Promise<SecretMatch[]> {
+  const tempFolder = await createTempFolder();
+  const findingsPath = join(tempFolder, "findings.json");
+  const repoPath = join(tempFolder, "repo.git")
+  try {
+    const { data: { token }} = await octokit.apps.createInstallationAccessToken({installation_id: installationId})
+    await cloneRepo(token, repositoryFullName, repoPath)
+    await runInfisicalScanOnRepo(repoPath, findingsPath);
+    const findingsData = await readFindingsFile(findingsPath);
+    return JSON.parse(findingsData);
+  } finally {
+    await deleteTempFolder(tempFolder);
+  }
+}
+
+export async function scanContentAndGetFindings(textContent: string): Promise<SecretMatch[]> {
+  const tempFolder = await createTempFolder();
+  const filePath = join(tempFolder, "content.txt");
+  const findingsPath = join(tempFolder, "findings.json");
+
+  try {
+    await writeTextToFile(filePath, textContent);
+    await runInfisicalScan(filePath, findingsPath);
+    const findingsData = await readFindingsFile(findingsPath);
+    return JSON.parse(findingsData);
+  } finally {
+    await deleteTempFolder(tempFolder);
+  }
+}
+
+export function createTempFolder(): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const tempDir = tmpdir()
+    const tempFolderName = Math.random().toString(36).substring(2);
+    const tempFolderPath = join(tempDir, tempFolderName);
+
+    mkdir(tempFolderPath, (err: any) => {
+      if (err) {
+        reject(err);
+      } else {
+        resolve(tempFolderPath);
+      }
+    });
+  });
+}
+
+
+
+export function writeTextToFile(filePath: string, content: string): Promise<void> {
+  return new Promise((resolve, reject) => {
+    writeFile(filePath, content, (err) => {
+      if (err) {
+        reject(err);
+      } else {
+        resolve();
+      }
+    });
+  });
+}
+
+export async function cloneRepo(installationAcccessToken: string, repositoryFullName: string, repoPath: string): Promise<void> {
+  const cloneUrl = `https://x-access-token:${installationAcccessToken}@github.com/${repositoryFullName}.git`;
+  const command = `git clone ${cloneUrl} ${repoPath} --bare`
+  return new Promise((resolve, reject) => {
+    exec(command, (error) => {
+      if (error) {
+        reject(error);
+      } else {
+        resolve();
+      }
+    });
+  }) 
+}
+
+export function runInfisicalScanOnRepo(repoPath: string, outputPath: string): Promise<void> {
+  return new Promise((resolve, reject) => {
+    const command = `cd ${repoPath} && infisical scan --exit-code=77 -r "${outputPath}"`;
+    exec(command, (error) => {
+      if (error && error.code != 77) {
+        reject(error);
+      } else {
+        resolve();
+      }
+    });
+  });
+}
+
+export function runInfisicalScan(inputPath: string, outputPath: string): Promise<void> {
+  return new Promise((resolve, reject) => {
+    const command = `cat "${inputPath}" | infisical scan --exit-code=77 --pipe -r "${outputPath}"`;
+    exec(command, (error) => {
+      if (error && error.code != 77) {
+        reject(error);
+      } else {
+        resolve();
+      }
+    });
+  });
+}
+
+export function readFindingsFile(filePath: string): Promise<string> {
+  return new Promise((resolve, reject) => {
+    readFile(filePath, "utf8", (err, data) => {
+      if (err) {
+        reject(err);
+      } else {
+        resolve(data);
+      }
+    });
+  });
+}
+
+export function deleteTempFolder(folderPath: string): Promise<void> {
+  return new Promise((resolve, reject) => {
+    rm(folderPath, { recursive: true }, (err) => {
+      if (err) {
+        reject(err);
+      } else {
+        resolve();
+      }
+    });
+  });
+}
+
+export function convertKeysToLowercase<T>(obj: T): T {
+  const convertedObj = {} as T;
+
+  for (const key in obj) {
+    if (Object.prototype.hasOwnProperty.call(obj, key)) {
+      const lowercaseKey = key.charAt(0).toLowerCase() + key.slice(1);
+      convertedObj[lowercaseKey as keyof T] = obj[key];
+    }
+  }
+
+  return convertedObj;
+}

backend/src/ee/services/GithubSecretScanning/types.ts

@@ -0,0 +1,21 @@
+export type SecretMatch = {
+  Description: string;
+  StartLine: number;
+  EndLine: number;
+  StartColumn: number;
+  EndColumn: number;
+  Match: string;
+  Secret: string;
+  File: string;
+  SymlinkFile: string;
+  Commit: string;
+  Entropy: number;
+  Author: string;
+  Email: string;
+  Date: string;
+  Message: string;
+  Tags: string[];
+  RuleID: string;
+  Fingerprint: string;
+  FingerPrintWithoutCommitId: string
+};

backend/src/ee/services/ProjectRoleService.ts

@@ -0,0 +1,250 @@
+import {
+  AbilityBuilder,
+  ForcedSubject,
+  MongoAbility,
+  RawRuleOf,
+  buildMongoQueryMatcher,
+  createMongoAbility
+} from "@casl/ability";
+import { Membership } from "../../models";
+import { IRole } from "../models/role";
+import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
+import { FieldCondition, FieldInstruction, JsInterpreter } from "@ucast/mongo2js";
+import picomatch from "picomatch";
+
+const $glob: FieldInstruction<string> = {
+  type: "field",
+  validate(instruction, value) {
+    if (typeof value !== "string") {
+      throw new Error(`"${instruction.name}" expects value to be a string`);
+    }
+  }
+};
+
+const glob: JsInterpreter<FieldCondition<string>> = (node, object, context) => {
+  const secretPath = context.get(object, node.field);
+  const permissionSecretGlobPath = node.value;
+  return picomatch.isMatch(secretPath, permissionSecretGlobPath, { strictSlashes: false });
+};
+
+export const conditionsMatcher = buildMongoQueryMatcher({ $glob }, { glob });
+
+export enum ProjectPermissionActions {
+  Read = "read",
+  Create = "create",
+  Edit = "edit",
+  Delete = "delete"
+}
+
+export enum ProjectPermissionSub {
+  Role = "role",
+  Member = "member",
+  Settings = "settings",
+  Integrations = "integrations",
+  Webhooks = "webhooks",
+  ServiceTokens = "service-tokens",
+  Environments = "environments",
+  Tags = "tags",
+  AuditLogs = "audit-logs",
+  IpAllowList = "ip-allowlist",
+  Workspace = "workspace",
+  Secrets = "secrets",
+  SecretRollback = "secret-rollback"
+}
+
+type SubjectFields = {
+  environment: string;
+  secretPath: string;
+};
+
+export type ProjectPermissionSet =
+  | [
+      ProjectPermissionActions,
+      ProjectPermissionSub.Secrets | (ForcedSubject<ProjectPermissionSub.Secrets> & SubjectFields)
+    ]
+  | [ProjectPermissionActions, ProjectPermissionSub.Role]
+  | [ProjectPermissionActions, ProjectPermissionSub.Tags]
+  | [ProjectPermissionActions, ProjectPermissionSub.Member]
+  | [ProjectPermissionActions, ProjectPermissionSub.Integrations]
+  | [ProjectPermissionActions, ProjectPermissionSub.Webhooks]
+  | [ProjectPermissionActions, ProjectPermissionSub.AuditLogs]
+  | [ProjectPermissionActions, ProjectPermissionSub.Environments]
+  | [ProjectPermissionActions, ProjectPermissionSub.IpAllowList]
+  | [ProjectPermissionActions, ProjectPermissionSub.Settings]
+  | [ProjectPermissionActions, ProjectPermissionSub.ServiceTokens]
+  | [ProjectPermissionActions.Delete, ProjectPermissionSub.Workspace]
+  | [ProjectPermissionActions.Edit, ProjectPermissionSub.Workspace]
+  | [ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback]
+  | [ProjectPermissionActions.Create, ProjectPermissionSub.SecretRollback];
+
+const buildAdminPermission = () => {
+  const { can, build } = new AbilityBuilder<MongoAbility<ProjectPermissionSet>>(createMongoAbility);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Secrets);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.Secrets);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Secrets);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Secrets);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.SecretRollback);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Member);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.Member);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Member);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Member);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Role);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.Role);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Role);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Role);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.Integrations);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Integrations);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Integrations);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Webhooks);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.Webhooks);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Webhooks);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Webhooks);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.ServiceTokens);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.ServiceTokens);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.ServiceTokens);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.ServiceTokens);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Settings);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.Settings);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Settings);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Settings);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Environments);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.Environments);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Environments);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Environments);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Tags);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.Tags);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Tags);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Tags);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.AuditLogs);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.AuditLogs);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.AuditLogs);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.AuditLogs);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.IpAllowList);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.IpAllowList);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.IpAllowList);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.IpAllowList);
+
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Workspace);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Workspace);
+
+  return build({ conditionsMatcher });
+};
+
+export const adminProjectPermissions = buildAdminPermission();
+
+const buildMemberPermission = () => {
+  const { can, build } = new AbilityBuilder<MongoAbility<ProjectPermissionSet>>(createMongoAbility);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Secrets);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.Secrets);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Secrets);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Secrets);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.SecretRollback);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Member);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.Member);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.Integrations);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Integrations);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Integrations);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Webhooks);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.Webhooks);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Webhooks);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Webhooks);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.ServiceTokens);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.ServiceTokens);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.ServiceTokens);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.ServiceTokens);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Settings);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.Settings);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Settings);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Settings);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Environments);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.Environments);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Environments);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Environments);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Tags);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.Tags);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Tags);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Tags);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Role);
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.AuditLogs);
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.IpAllowList);
+
+  return build({ conditionsMatcher });
+};
+
+export const memberProjectPermissions = buildMemberPermission();
+
+const buildViewerPermission = () => {
+  const { can, build } = new AbilityBuilder<MongoAbility<ProjectPermissionSet>>(createMongoAbility);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Secrets);
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Member);
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Role);
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Webhooks);
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.ServiceTokens);
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Settings);
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Environments);
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Tags);
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.AuditLogs);
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.IpAllowList);
+
+  return build({ conditionsMatcher });
+};
+
+export const viewerProjectPermission = buildViewerPermission();
+
+export const getUserProjectPermissions = async (userId: string, workspaceId: string) => {
+  // TODO(akhilmhdh): speed this up by pulling from cache later
+  const membership = await Membership.findOne({
+    user: userId,
+    workspace: workspaceId
+  })
+    .populate<{
+      customRole: IRole & { permissions: RawRuleOf<MongoAbility<ProjectPermissionSet>>[] };
+    }>("customRole")
+    .exec();
+
+  if (!membership || (membership.role === "custom" && !membership.customRole)) {
+    throw UnauthorizedRequestError({ message: "User doesn't belong to organization" });
+  }
+
+  if (membership.role === "admin") return { permission: adminProjectPermissions, membership };
+  if (membership.role === "member") return { permission: memberProjectPermissions, membership };
+  if (membership.role === "viewer") return { permission: viewerProjectPermission, membership };
+
+  if (membership.role === "custom") {
+    const permission = createMongoAbility<ProjectPermissionSet>(membership.customRole.permissions, {
+      conditionsMatcher
+    });
+    return { permission, membership };
+  }
+
+  throw BadRequestError({ message: "User role not found" });
+};

backend/src/ee/services/RoleService.ts

@@ -0,0 +1,134 @@
+import { AbilityBuilder, MongoAbility, RawRuleOf, createMongoAbility } from "@casl/ability";
+import { MembershipOrg } from "../../models";
+import { IRole } from "../models/role";
+import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
+import { ACCEPTED } from "../../variables";
+import { conditionsMatcher } from "./ProjectRoleService";
+
+export enum OrgPermissionActions {
+  Read = "read",
+  Create = "create",
+  Edit = "edit",
+  Delete = "delete"
+}
+
+export enum OrgPermissionSubjects {
+  Workspace = "workspace",
+  Role = "role",
+  Member = "member",
+  Settings = "settings",
+  IncidentAccount = "incident-contact",
+  Sso = "sso",
+  Billing = "billing",
+  SecretScanning = "secret-scanning"
+}
+
+export type OrgPermissionSet =
+  | [OrgPermissionActions.Read, OrgPermissionSubjects.Workspace]
+  | [OrgPermissionActions.Create, OrgPermissionSubjects.Workspace]
+  | [OrgPermissionActions, OrgPermissionSubjects.Role]
+  | [OrgPermissionActions, OrgPermissionSubjects.Member]
+  | [OrgPermissionActions, OrgPermissionSubjects.Settings]
+  | [OrgPermissionActions, OrgPermissionSubjects.IncidentAccount]
+  | [OrgPermissionActions, OrgPermissionSubjects.Sso]
+  | [OrgPermissionActions, OrgPermissionSubjects.SecretScanning]
+  | [OrgPermissionActions, OrgPermissionSubjects.Billing];
+
+const buildAdminPermission = () => {
+  const { can, build } = new AbilityBuilder<MongoAbility<OrgPermissionSet>>(createMongoAbility);
+  // ws permissions
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Workspace);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Workspace);
+  // role permission
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Role);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Role);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.Role);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.Role);
+
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Member);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Member);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.Member);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.Member);
+
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.SecretScanning);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.SecretScanning);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.SecretScanning);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.SecretScanning);
+
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Settings);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Settings);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.Settings);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.Settings);
+
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.IncidentAccount);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.IncidentAccount);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.IncidentAccount);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.IncidentAccount);
+
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Sso);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Sso);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.Sso);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.Sso);
+
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Billing);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Billing);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.Billing);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.Billing);
+
+  return build({ conditionsMatcher });
+};
+
+export const adminPermissions = buildAdminPermission();
+
+const buildMemberPermission = () => {
+  const { can, build } = new AbilityBuilder<MongoAbility<OrgPermissionSet>>(createMongoAbility);
+
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Workspace);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Workspace);
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Member);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Member);
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Role);
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Settings);
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Billing);
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Sso);
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.IncidentAccount);
+
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.SecretScanning);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.SecretScanning);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.SecretScanning);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.SecretScanning);
+
+  return build({ conditionsMatcher });
+};
+
+export const memberPermissions = buildMemberPermission();
+
+export const getUserOrgPermissions = async (userId: string, orgId: string) => {
+  // TODO(akhilmhdh): speed this up by pulling from cache later
+  const membership = await MembershipOrg.findOne({
+    user: userId,
+    organization: orgId,
+    status: ACCEPTED
+  })
+    .populate<{ customRole: IRole & { permissions: RawRuleOf<MongoAbility<OrgPermissionSet>>[] } }>(
+      "customRole"
+    )
+    .exec();
+
+  if (!membership || (membership.role === "custom" && !membership.customRole)) {
+    throw UnauthorizedRequestError({ message: "User doesn't belong to organization" });
+  }
+
+  if (membership.role === "admin") return { permission: adminPermissions, membership };
+
+  if (membership.role === "member") return { permission: memberPermissions, membership };
+
+  if (membership.role === "custom") {
+    const permission = createMongoAbility<OrgPermissionSet>(membership.customRole.permissions, {
+      conditionsMatcher
+    });
+    return { permission, membership };
+  }
+
+  throw BadRequestError({ message: "User role not found" });
+};

backend/src/ee/services/index.ts

@@ -1,9 +1,13 @@
 import EELicenseService from "./EELicenseService";
 import EESecretService from "./EESecretService";
 import EELogService from "./EELogService";
+import EEAuditLogService from "./EEAuditLogService";
+import GithubSecretScanningService from "./GithubSecretScanning/GithubSecretScanningService"
 
 export {
     EELicenseService,
     EESecretService,
     EELogService,
+    EEAuditLogService,
+    GithubSecretScanningService
 }

backend/src/ee/validation/role.ts

@@ -0,0 +1,68 @@
+import { z } from "zod";
+
+export const CreateRoleSchema = z.object({
+  body: z.object({
+    slug: z.string().trim(),
+    name: z.string().trim(),
+    description: z.string().trim().optional(),
+    workspaceId: z.string().trim().optional(),
+    orgId: z.string().trim(),
+    permissions: z
+      .object({
+        subject: z.string().trim(),
+        action: z.string().trim(),
+        conditions: z
+          .record(z.union([z.string().trim(), z.number(), z.object({ $glob: z.string() })]))
+          .optional()
+      })
+      .array()
+  })
+});
+
+export const UpdateRoleSchema = z.object({
+  params: z.object({
+    id: z.string().trim()
+  }),
+  body: z.object({
+    slug: z.string().trim().optional(),
+    name: z.string().trim().optional(),
+    description: z.string().trim().optional(),
+    workspaceId: z.string().trim().optional(),
+    orgId: z.string().trim(),
+    permissions: z
+      .object({
+        subject: z.string().trim(),
+        action: z.string().trim(),
+        conditions: z
+          .record(z.union([z.string().trim(), z.number(), z.object({ $glob: z.string() })]))
+          .optional()
+      })
+      .array()
+      .optional()
+  })
+});
+
+export const DeleteRoleSchema = z.object({
+  params: z.object({
+    id: z.string().trim()
+  })
+});
+
+export const GetRoleSchema = z.object({
+  query: z.object({
+    workspaceId: z.string().trim().optional(),
+    orgId: z.string().trim()
+  })
+});
+
+export const GetUserPermission = z.object({
+  params: z.object({
+    orgId: z.string().trim()
+  })
+});
+
+export const GetUserProjectPermission = z.object({
+  params: z.object({
+    workspaceId: z.string().trim()
+  })
+});

backend/src/helpers/auth.ts

@@ -1,3 +1,4 @@
+import { Request } from "express";
 import { Types } from "mongoose";
 import jwt from "jsonwebtoken";
 import bcrypt from "bcrypt";
@@ -5,7 +6,6 @@ import {
 	APIKeyData,
 	ITokenVersion,
 	IUser,
-	ServiceAccount,
 	ServiceTokenData,
 	TokenVersion,
 	User,
@@ -14,7 +14,6 @@ import {
 	APIKeyDataNotFoundError,
 	AccountNotFoundError,
 	BadRequestError,
-	ServiceAccountNotFoundError,
 	ServiceTokenDataNotFoundError,
 	UnauthorizedRequestError,
 } from "../utils/errors";
@@ -26,11 +25,15 @@ import {
 	getJwtRefreshSecret,
 } from "../config";
 import {
-	AUTH_MODE_API_KEY,
-	AUTH_MODE_JWT,
-	AUTH_MODE_SERVICE_ACCOUNT,
-	AUTH_MODE_SERVICE_TOKEN,
+	AuthMode
 } from "../variables";
+import {
+	ServiceTokenAuthData,
+	UserAuthData
+} from "../interfaces/middleware";
+
+import { ActorType } from "../ee/models";
+import { getUserAgentType } from "../utils/posthog";
 
 /**
  * 
@@ -42,7 +45,7 @@ export const validateAuthMode = ({
 	acceptedAuthModes,
 }: {
 	headers: { [key: string]: string | string[] | undefined },
-	acceptedAuthModes: string[]
+	acceptedAuthModes: AuthMode[]
 }) => {
 	const apiKey = headers["x-api-key"];
 	const authHeader = headers["authorization"];
@@ -55,7 +58,7 @@ export const validateAuthMode = ({
 
 	if (typeof apiKey === "string") {
 		// case: treat request authentication type as via X-API-KEY (i.e. API Key)
-		authMode = AUTH_MODE_API_KEY;
+		authMode = AuthMode.API_KEY;
 		authTokenValue = apiKey;
 	}
 
@@ -71,13 +74,10 @@ export const validateAuthMode = ({
 
 		switch (tokenValue.split(".", 1)[0]) {
 			case "st":
-				authMode = AUTH_MODE_SERVICE_TOKEN;
-				break;
-			case "sa":
-				authMode = AUTH_MODE_SERVICE_ACCOUNT;
+				authMode = AuthMode.SERVICE_TOKEN;
 				break;
 			default:
-				authMode = AUTH_MODE_JWT;
+				authMode = AuthMode.JWT;
 		}
 
 		authTokenValue = tokenValue;
@@ -100,10 +100,12 @@ export const validateAuthMode = ({
  * @returns {User} user - user corresponding to JWT token
  */
 export const getAuthUserPayload = async ({
+	req,
 	authTokenValue,
 }: {
+	req: Request,
 	authTokenValue: string;
-}) => {
+}): Promise<UserAuthData> => {
 	const decodedToken = <jwt.UserIDJwtPayload>(
 		jwt.verify(authTokenValue, await getJwtAuthSecret())
 	);
@@ -122,19 +124,33 @@ export const getAuthUserPayload = async ({
 	}, {
 		lastUsed: new Date(),
 	});
-	
+
 	if (!tokenVersion) throw UnauthorizedRequestError({
 		message: "Failed to validate access token",
 	});
-	
+
 	if (decodedToken.accessVersion !== tokenVersion.accessVersion) throw UnauthorizedRequestError({
 		message: "Failed to validate access token",
 	});
-
-	return ({
-		user,
-		tokenVersionId: tokenVersion._id,
-	});
+	
+	return {
+		actor: {
+			type: ActorType.USER,
+			metadata: {
+				userId: user._id.toString(),
+				email: user.email
+			}
+		},
+		authPayload: user,
+		ipAddress: req.realIP,
+		userAgent: req.headers["user-agent"] ?? "",
+		userAgentType: getUserAgentType(req.headers["user-agent"])
+	}
+	
+	// return ({
+	// 	user,
+	// 	tokenVersionId: tokenVersion._id, // what to do with this? // move this out
+	// });
 }
 
 /**
@@ -144,14 +160,16 @@ export const getAuthUserPayload = async ({
  * @returns {ServiceTokenData} serviceTokenData - service token data
  */
 export const getAuthSTDPayload = async ({
+	req,
 	authTokenValue,
 }: {
+	req: Request,
 	authTokenValue: string;
-}) => {
+}): Promise<ServiceTokenAuthData> => {
 	const [_, TOKEN_IDENTIFIER, TOKEN_SECRET] = <[string, string, string]>authTokenValue.split(".", 3);
 
-	let serviceTokenData = await ServiceTokenData
-		.findById(TOKEN_IDENTIFIER, "+secretHash +expiresAt");
+	const serviceTokenData = await ServiceTokenData
+		.findById(TOKEN_IDENTIFIER, "+secretHash +expiresAt")
 
 	if (!serviceTokenData) {
 		throw ServiceTokenDataNotFoundError({ message: "Failed to find service token data" });
@@ -168,7 +186,7 @@ export const getAuthSTDPayload = async ({
 		message: "Failed to authenticate service token",
 	});
 
-	serviceTokenData = await ServiceTokenData
+	const serviceTokenDataToReturn = await ServiceTokenData
 		.findOneAndUpdate({
 			_id: new Types.ObjectId(TOKEN_IDENTIFIER),
 		}, {
@@ -176,40 +194,25 @@ export const getAuthSTDPayload = async ({
 		}, {
 			new: true,
 		})
-		.select("+encryptedKey +iv +tag");
+		.select("+encryptedKey +iv +tag")
 
-	if (!serviceTokenData) throw ServiceTokenDataNotFoundError({ message: "Failed to find service token data" });
+	if (!serviceTokenDataToReturn) throw ServiceTokenDataNotFoundError({ message: "Failed to find service token data" });
 
-	return serviceTokenData;
-}
-
-/**
- * Return service account access key payload
- * @param {Object} obj
- * @param {String} obj.authTokenValue - service account access token value
- * @returns {ServiceAccount} serviceAccount
- */
-export const getAuthSAAKPayload = async ({
-	authTokenValue,
-}: {
-	authTokenValue: string;
-}) => {
-	const [_, TOKEN_IDENTIFIER, TOKEN_SECRET] = <[string, string, string]>authTokenValue.split(".", 3);
-
-	const serviceAccount = await ServiceAccount.findById(
-		Buffer.from(TOKEN_IDENTIFIER, "base64").toString("hex")
-	).select("+secretHash");
-
-	if (!serviceAccount) {
-		throw ServiceAccountNotFoundError({ message: "Failed to find service account" });
+	return {
+		actor: {
+			type: ActorType.SERVICE,
+			metadata: {
+				serviceId: serviceTokenDataToReturn._id.toString(),
+				name: serviceTokenDataToReturn.name
+			}
+		},
+		authPayload: serviceTokenDataToReturn,
+		ipAddress: req.realIP,
+		userAgent: req.headers["user-agent"] ?? "",
+		userAgentType: getUserAgentType(req.headers["user-agent"])
 	}
 
-	const result = await bcrypt.compare(TOKEN_SECRET, serviceAccount.secretHash);
-	if (!result) throw UnauthorizedRequestError({
-		message: "Failed to authenticate service account access key",
-	});
-
-	return serviceAccount;
+	// return serviceTokenDataToReturn;
 }
 
 /**
@@ -219,10 +222,12 @@ export const getAuthSAAKPayload = async ({
  * @returns {APIKeyData} apiKeyData - API key data
  */
 export const getAuthAPIKeyPayload = async ({
+	req,
 	authTokenValue,
 }: {
+	req: Request,
 	authTokenValue: string;
-}) => {
+}): Promise<UserAuthData> => {
 	const [_, TOKEN_IDENTIFIER, TOKEN_SECRET] = <[string, string, string]>authTokenValue.split(".", 3);
 
 	let apiKeyData = await APIKeyData
@@ -264,7 +269,19 @@ export const getAuthAPIKeyPayload = async ({
 		});
 	}
 
-	return user;
+	return {
+		actor: {
+			type: ActorType.USER,
+			metadata: {
+				userId: user._id.toString(),
+				email: user.email
+			}
+		},
+		authPayload: user,
+		ipAddress: req.realIP,
+		userAgent: req.headers["user-agent"] ?? "",
+		userAgentType: getUserAgentType(req.headers["user-agent"])
+	}
 }
 
 /**
@@ -275,11 +292,11 @@ export const getAuthAPIKeyPayload = async ({
  * @return {String} obj.token - issued JWT token
  * @return {String} obj.refreshToken - issued refresh token
  */
-export const issueAuthTokens = async ({ 
+export const issueAuthTokens = async ({
 	userId,
 	ip,
 	userAgent,
-}: { 
+}: {
 	userId: Types.ObjectId;
 	ip: string;
 	userAgent: string;
@@ -292,7 +309,7 @@ export const issueAuthTokens = async ({
 		ip,
 		userAgent,
 	});
-	
+
 	if (!tokenVersion) {
 		// case: no existing ip and user agent exists
 		// -> create new (session) token version for ip and user agent
@@ -375,11 +392,9 @@ export const createToken = ({
 
 export const validateProviderAuthToken = async ({
 	email,
-	user,
 	providerAuthToken,
 }: {
 	email: string;
-	user: IUser,
 	providerAuthToken?: string;
 }) => {
 	if (!providerAuthToken) {
@@ -389,11 +404,8 @@ export const validateProviderAuthToken = async ({
 	const decodedToken = <jwt.ProviderAuthJwtPayload>(
 		jwt.verify(providerAuthToken, await getJwtProviderAuthSecret())
 	);
-	
-	if (
-		decodedToken.authProvider !== user.authProvider ||
-		decodedToken.email !== email
-	) {
+
+	if (decodedToken.email !== email) {
 		throw new Error("Invalid authentication credentials.")
 	}
-}
+}

backend/src/helpers/bot.ts

@@ -4,18 +4,20 @@ import {
   decryptAsymmetric,
   decryptSymmetric128BitHexKeyUTF8,
   encryptSymmetric128BitHexKeyUTF8,
-  generateKeyPair,
+  generateKeyPair
 } from "../utils/crypto";
 import {
   ALGORITHM_AES_256_GCM,
   ENCODING_SCHEME_BASE64,
   ENCODING_SCHEME_UTF8,
-  SECRET_SHARED,
+  SECRET_SHARED
 } from "../variables";
 import { client, getEncryptionKey, getRootEncryptionKey } from "../config";
 import { InternalServerError } from "../utils/errors";
-import Folder from "../models/folder";
+import { Folder } from "../models";
 import { getFolderByPath } from "../services/FolderService";
+import { getAllImportedSecrets } from "../services/SecretImportService";
+import { expandSecrets } from "./secrets";
 
 /**
  * Create an inactive bot with name [name] for workspace with id [workspaceId]
@@ -25,7 +27,7 @@ import { getFolderByPath } from "../services/FolderService";
  */
 export const createBot = async ({
   name,
-  workspaceId,
+  workspaceId
 }: {
   name: string;
   workspaceId: Types.ObjectId;
@@ -36,10 +38,7 @@ export const createBot = async ({
   const { publicKey, privateKey } = generateKeyPair();
 
   if (rootEncryptionKey) {
-    const { ciphertext, iv, tag } = client.encryptSymmetric(
-      privateKey,
-      rootEncryptionKey
-    );
+    const { ciphertext, iv, tag } = client.encryptSymmetric(privateKey, rootEncryptionKey);
 
     return await new Bot({
       name,
@@ -50,12 +49,12 @@ export const createBot = async ({
       iv,
       tag,
       algorithm: ALGORITHM_AES_256_GCM,
-      keyEncoding: ENCODING_SCHEME_BASE64,
+      keyEncoding: ENCODING_SCHEME_BASE64
     }).save();
   } else if (encryptionKey) {
     const { ciphertext, iv, tag } = encryptSymmetric128BitHexKeyUTF8({
       plaintext: privateKey,
-      key: await getEncryptionKey(),
+      key: await getEncryptionKey()
     });
 
     return await new Bot({
@@ -67,12 +66,12 @@ export const createBot = async ({
       iv,
       tag,
       algorithm: ALGORITHM_AES_256_GCM,
-      keyEncoding: ENCODING_SCHEME_UTF8,
+      keyEncoding: ENCODING_SCHEME_UTF8
     }).save();
   }
 
   throw InternalServerError({
-    message: "Failed to create new bot due to missing encryption key",
+    message: "Failed to create new bot due to missing encryption key"
   });
 };
 
@@ -82,7 +81,7 @@ export const createBot = async ({
  */
 export const getIsWorkspaceE2EEHelper = async (workspaceId: Types.ObjectId) => {
   const botKey = await BotKey.exists({
-    workspace: workspaceId,
+    workspace: workspaceId
   });
 
   return botKey ? false : true;
@@ -98,19 +97,19 @@ export const getIsWorkspaceE2EEHelper = async (workspaceId: Types.ObjectId) => {
 export const getSecretsBotHelper = async ({
   workspaceId,
   environment,
-  secretPath,
+  secretPath
 }: {
   workspaceId: Types.ObjectId;
   environment: string;
   secretPath: string;
 }) => {
-  const content = {} as any;
+  const content: Record<string, { value: string; comment?: string }> = {};
   const key = await getKey({ workspaceId: workspaceId });
 
   let folderId = "root";
   const folders = await Folder.findOne({
     workspace: workspaceId,
-    environment,
+    environment
   });
 
   if (!folders && secretPath !== "/") {
@@ -129,7 +128,44 @@ export const getSecretsBotHelper = async ({
     workspace: workspaceId,
     environment,
     type: SECRET_SHARED,
-    folder: folderId,
+    folder: folderId
+  });
+
+  const importedSecrets = await getAllImportedSecrets(
+    workspaceId.toString(),
+    environment,
+    folderId,
+    () => true // integrations are setup to read all the ones
+  );
+
+  importedSecrets.forEach(({ secrets }) => {
+    secrets.forEach((secret) => {
+      const secretKey = decryptSymmetric128BitHexKeyUTF8({
+        ciphertext: secret.secretKeyCiphertext,
+        iv: secret.secretKeyIV,
+        tag: secret.secretKeyTag,
+        key
+      });
+
+      const secretValue = decryptSymmetric128BitHexKeyUTF8({
+        ciphertext: secret.secretValueCiphertext,
+        iv: secret.secretValueIV,
+        tag: secret.secretValueTag,
+        key
+      });
+
+      content[secretKey] = { value: secretValue };
+
+      if (secret.secretCommentCiphertext && secret.secretCommentIV && secret.secretCommentTag) {
+        const commentValue = decryptSymmetric128BitHexKeyUTF8({
+          ciphertext: secret.secretCommentCiphertext,
+          iv: secret.secretCommentIV,
+          tag: secret.secretCommentTag,
+          key
+        });
+        content[secretKey].comment = commentValue;
+      }
+    });
   });
 
   secrets.forEach((secret: ISecret) => {
@@ -137,19 +173,31 @@ export const getSecretsBotHelper = async ({
       ciphertext: secret.secretKeyCiphertext,
       iv: secret.secretKeyIV,
       tag: secret.secretKeyTag,
-      key,
+      key
     });
 
     const secretValue = decryptSymmetric128BitHexKeyUTF8({
       ciphertext: secret.secretValueCiphertext,
       iv: secret.secretValueIV,
       tag: secret.secretValueTag,
-      key,
+      key
     });
 
-    content[secretKey] = secretValue;
+    content[secretKey] = { value: secretValue };
+
+    if (secret.secretCommentCiphertext && secret.secretCommentIV && secret.secretCommentTag) {
+      const commentValue = decryptSymmetric128BitHexKeyUTF8({
+        ciphertext: secret.secretCommentCiphertext,
+        iv: secret.secretCommentIV,
+        tag: secret.secretCommentTag,
+        key
+      });
+      content[secretKey].comment = commentValue;
+    }
   });
 
+  await expandSecrets(workspaceId.toString(), key, content);
+
   return content;
 };
 
@@ -160,22 +208,18 @@ export const getSecretsBotHelper = async ({
  * @param {String} obj.workspaceId - id of workspace
  * @returns {String} key - decrypted workspace key
  */
-export const getKey = async ({
-  workspaceId,
-}: {
-  workspaceId: Types.ObjectId;
-}) => {
+export const getKey = async ({ workspaceId }: { workspaceId: Types.ObjectId }) => {
   const encryptionKey = await getEncryptionKey();
   const rootEncryptionKey = await getRootEncryptionKey();
 
   const botKey = await BotKey.findOne({
-    workspace: workspaceId,
+    workspace: workspaceId
   }).populate<{ sender: IUser }>("sender", "publicKey");
 
   if (!botKey) throw new Error("Failed to find bot key");
 
   const bot = await Bot.findOne({
-    workspace: workspaceId,
+    workspace: workspaceId
   }).select("+encryptedPrivateKey +iv +tag +algorithm +keyEncoding");
 
   if (!bot) throw new Error("Failed to find bot");
@@ -194,7 +238,7 @@ export const getKey = async ({
       ciphertext: botKey.encryptedKey,
       nonce: botKey.nonce,
       publicKey: botKey.sender.publicKey as string,
-      privateKey: privateKeyBot,
+      privateKey: privateKeyBot
     });
   } else if (encryptionKey && bot.keyEncoding === ENCODING_SCHEME_UTF8) {
     // case: encoding scheme is utf8
@@ -202,20 +246,19 @@ export const getKey = async ({
       ciphertext: bot.encryptedPrivateKey,
       iv: bot.iv,
       tag: bot.tag,
-      key: encryptionKey,
+      key: encryptionKey
     });
 
     return decryptAsymmetric({
       ciphertext: botKey.encryptedKey,
       nonce: botKey.nonce,
       publicKey: botKey.sender.publicKey as string,
-      privateKey: privateKeyBot,
+      privateKey: privateKeyBot
     });
   }
 
   throw InternalServerError({
-    message:
-      "Failed to obtain bot's copy of workspace key needed for bot operations",
+    message: "Failed to obtain bot's copy of workspace key needed for bot operations"
   });
 };
 
@@ -228,7 +271,7 @@ export const getKey = async ({
  */
 export const encryptSymmetricHelper = async ({
   workspaceId,
-  plaintext,
+  plaintext
 }: {
   workspaceId: Types.ObjectId;
   plaintext: string;
@@ -236,13 +279,13 @@ export const encryptSymmetricHelper = async ({
   const key = await getKey({ workspaceId: workspaceId });
   const { ciphertext, iv, tag } = encryptSymmetric128BitHexKeyUTF8({
     plaintext,
-    key,
+    key
   });
 
   return {
     ciphertext,
     iv,
-    tag,
+    tag
   };
 };
 /**
@@ -258,7 +301,7 @@ export const decryptSymmetricHelper = async ({
   workspaceId,
   ciphertext,
   iv,
-  tag,
+  tag
 }: {
   workspaceId: Types.ObjectId;
   ciphertext: string;
@@ -270,8 +313,75 @@ export const decryptSymmetricHelper = async ({
     ciphertext,
     iv,
     tag,
-    key,
+    key
   });
 
   return plaintext;
 };
+
+/**
+ * Return decrypted comments for workspace secrets with id [workspaceId]
+ * and [envionment] using bot
+ * @param {Object} obj
+ * @param {String} obj.workspaceId - id of workspace
+ * @param {String} obj.environment - environment
+ */
+export const getSecretsCommentBotHelper = async ({
+  workspaceId,
+  environment,
+  secretPath
+}: {
+  workspaceId: Types.ObjectId;
+  environment: string;
+  secretPath: string;
+}) => {
+  const content = {} as any;
+  const key = await getKey({ workspaceId: workspaceId });
+
+  let folderId = "root";
+  const folders = await Folder.findOne({
+    workspace: workspaceId,
+    environment
+  });
+
+  if (!folders && secretPath !== "/") {
+    throw InternalServerError({ message: "Folder not found" });
+  }
+
+  if (folders) {
+    const folder = getFolderByPath(folders.nodes, secretPath);
+    if (!folder) {
+      throw InternalServerError({ message: "Folder not found" });
+    }
+    folderId = folder.id;
+  }
+
+  const secrets = await Secret.find({
+    workspace: workspaceId,
+    environment,
+    type: SECRET_SHARED,
+    folder: folderId
+  });
+
+  secrets.forEach((secret: ISecret) => {
+    if (secret.secretCommentCiphertext && secret.secretCommentIV && secret.secretCommentTag) {
+      const secretKey = decryptSymmetric128BitHexKeyUTF8({
+        ciphertext: secret.secretKeyCiphertext,
+        iv: secret.secretKeyIV,
+        tag: secret.secretKeyTag,
+        key
+      });
+
+      const commentValue = decryptSymmetric128BitHexKeyUTF8({
+        ciphertext: secret.secretCommentCiphertext,
+        iv: secret.secretCommentIV,
+        tag: secret.secretCommentTag,
+        key
+      });
+
+      content[secretKey] = commentValue;
+    }
+  });
+
+  return content;
+};