Comment out v4/environments v4/folders items

backend/package.json

@@ -8,14 +8,13 @@
     "@octokit/rest": "^19.0.5",
     "@sentry/node": "^7.77.0",
     "@sentry/tracing": "^7.48.0",
-    "@serdnam/pino-cloudwatch-transport": "^1.0.4",
     "@types/crypto-js": "^4.1.1",
     "@types/libsodium-wrappers": "^0.7.10",
     "@ucast/mongo2js": "^1.3.4",
     "ajv": "^8.12.0",
     "argon2": "^0.30.3",
     "aws-sdk": "^2.1364.0",
-    "axios": "^1.6.0",
+    "axios": "^1.3.5",
     "axios-retry": "^3.4.0",
     "bcrypt": "^5.1.0",
     "bigint-conversion": "^2.4.0",
@@ -72,7 +71,7 @@
   "main": "src/index.js",
   "scripts": {
     "start": "node build/index.js",
-    "dev": "nodemon index.js",
+    "dev": "nodemon index.js | pino-pretty --colorize",
     "swagger-autogen": "node ./swagger/index.ts",
     "build": "rimraf ./build && tsc && cp -R ./src/templates ./build && cp -R ./src/data ./build",
     "lint": "eslint . --ext .ts",
@@ -97,8 +96,6 @@
   "devDependencies": {
     "@jest/globals": "^29.3.1",
     "@posthog/plugin-scaffold": "^1.3.4",
-    "@swc/core": "^1.3.99",
-    "@swc/helpers": "^0.5.3",
     "@types/bcrypt": "^5.0.0",
     "@types/bcryptjs": "^2.4.2",
     "@types/bull": "^4.10.0",
@@ -129,7 +126,6 @@
     "nodemon": "^2.0.19",
     "npm": "^8.19.3",
     "pino-pretty": "^10.2.3",
-    "regenerator-runtime": "^0.14.0",
     "smee-client": "^1.2.3",
     "supertest": "^6.3.3",
     "swagger-autogen": "^2.23.5",

backend/spec.json

@@ -306,77 +306,12 @@
     },
     "/api/v1/workspace/{workspaceId}/audit-logs": {
       "get": {
-        "summary": "Return audit logs",
-        "description": "Return audit logs",
+        "description": "",
         "parameters": [
           {
             "name": "workspaceId",
             "in": "path",
             "required": true,
-            "schema": {
-              "type": "string"
-            },
-            "description": "ID of the workspace where to get folders from"
-          },
-          {
-            "name": "offset",
-            "description": "Number of logs to skip before starting to return logs for pagination",
-            "required": false,
-            "in": "query",
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "name": "limit",
-            "description": "Maximum number of logs to return for pagination",
-            "required": false,
-            "in": "query",
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "name": "startDate",
-            "description": "Filter logs from this date in ISO-8601 format",
-            "required": false,
-            "in": "query",
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "name": "endDate",
-            "description": "Filter logs till this date in ISO-8601 format",
-            "required": false,
-            "in": "query",
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "name": "eventType",
-            "description": "Filter by type of event such as get-secrets, get-secret, create-secret, update-secret, delete-secret, etc.",
-            "required": false,
-            "in": "query",
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "name": "userAgentType",
-            "description": "Filter by type of user agent such as web, cli, k8-operator, or other",
-            "required": false,
-            "in": "query",
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "name": "actor",
-            "description": "Filter by actor such as user or service",
-            "required": false,
-            "in": "query",
             "schema": {
               "type": "string"
             }
@@ -384,30 +319,9 @@
         ],
         "responses": {
           "200": {
-            "description": "OK",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "object",
-                  "properties": {
-                    "auditLogs": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/components/schemas/AuditLog"
-                      },
-                      "description": "List of audit log"
-                    }
-                  }
-                }
-              }
-            }
+            "description": "OK"
           }
-        },
-        "security": [
-          {
-            "apiKeyAuth": []
-          }
-        ]
+        }
       }
     },
     "/api/v1/workspace/{workspaceId}/audit-logs/filters/actors": {
@@ -1218,43 +1132,6 @@
         }
       }
     },
-    "/api/v1/admin/config": {
-      "get": {
-        "description": "",
-        "responses": {
-          "200": {
-            "description": "OK"
-          }
-        }
-      },
-      "patch": {
-        "description": "",
-        "responses": {
-          "200": {
-            "description": "OK"
-          }
-        }
-      }
-    },
-    "/api/v1/admin/signup": {
-      "post": {
-        "description": "",
-        "parameters": [
-          {
-            "name": "user-agent",
-            "in": "header",
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "OK"
-          }
-        }
-      }
-    },
     "/api/v1/bot/{workspaceId}": {
       "get": {
         "description": "",
@@ -4683,6 +4560,65 @@
             }
           }
         }
+      },
+      "get": {
+        "summary": "Get all accessible environments of a workspace",
+        "description": "Fetch all environments that the user has access to in a specified workspace",
+        "parameters": [
+          {
+            "name": "workspaceId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "ID of the workspace"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "accessibleEnvironments": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "example": "Development"
+                          },
+                          "slug": {
+                            "type": "string",
+                            "example": "development"
+                          },
+                          "isWriteDenied": {
+                            "type": "boolean",
+                            "example": false
+                          },
+                          "isReadDenied": {
+                            "type": "boolean",
+                            "example": false
+                          }
+                        }
+                      }
+                    }
+                  },
+                  "description": "List of environments the user has access to in the specified workspace"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "apiKeyAuth": []
+          }
+        ]
       }
     },
     "/api/v2/workspace/{workspaceId}/tags": {
@@ -6928,61 +6864,6 @@
             "example": "2023-01-13T14:16:12.210Z"
           }
         }
-      },
-      "AuditLog": {
-        "type": "object",
-        "properties": {
-          "actor": {
-            "type": "object",
-            "properties": {
-              "type": {
-                "type": "string",
-                "example": ""
-              },
-              "metadata": {
-                "type": "object",
-                "properties": {}
-              }
-            }
-          },
-          "organization": {
-            "type": "string",
-            "example": ""
-          },
-          "workspace": {
-            "type": "string",
-            "example": ""
-          },
-          "ipAddress": {
-            "type": "string",
-            "example": ""
-          },
-          "event": {
-            "type": "object",
-            "properties": {
-              "type": {
-                "type": "string",
-                "example": ""
-              },
-              "metadata": {
-                "type": "object",
-                "properties": {}
-              }
-            }
-          },
-          "userAgent": {
-            "type": "string",
-            "example": ""
-          },
-          "userAgentType": {
-            "type": "string",
-            "example": ""
-          },
-          "expiresAt": {
-            "type": "string",
-            "example": ""
-          }
-        }
       }
     },
     "securitySchemes": {

backend/src/config/index.ts

@@ -89,21 +89,6 @@ export const getClientSecretGitLabLogin = async () =>
 export const getUrlGitLabLogin = async () =>
   (await client.getSecret("URL_GITLAB_LOGIN")).secretValue || GITLAB_URL;
 
-export const getAwsCloudWatchLog = async () => {
-  const logGroupName =
-    (await client.getSecret("AWS_CLOUDWATCH_LOG_GROUP_NAME")).secretValue || "infisical-log-stream";
-  const region = (await client.getSecret("AWS_CLOUDWATCH_LOG_REGION")).secretValue;
-  const accessKeyId = (await client.getSecret("AWS_CLOUDWATCH_LOG_ACCESS_KEY_ID")).secretValue;
-  const accessKeySecret = (await client.getSecret("AWS_CLOUDWATCH_LOG_ACCESS_KEY_SECRET"))
-    .secretValue;
-  const interval = parseInt(
-    (await client.getSecret("AWS_CLOUDWATCH_LOG_INTERVAL")).secretValue || 1000,
-    10
-  );
-  if (!region || !accessKeyId || !accessKeySecret) return;
-  return { logGroupName, region, accessKeySecret, accessKeyId, interval };
-};
-
 export const getPostHogHost = async () =>
   (await client.getSecret("POSTHOG_HOST")).secretValue || "https://app.posthog.com";
 export const getPostHogProjectApiKey = async () =>

backend/src/controllers/v1/authController.ts

@@ -3,22 +3,15 @@ import jwt from "jsonwebtoken";
 import * as bigintConversion from "bigint-conversion";
 // eslint-disable-next-line @typescript-eslint/no-var-requires
 const jsrp = require("jsrp");
-import { 
-  LoginSRPDetail,
-  TokenVersion,
-  User
-} from "../../models";
+import { LoginSRPDetail, TokenVersion, User } from "../../models";
 import { clearTokens, createToken, issueAuthTokens } from "../../helpers/auth";
 import { checkUserDevice } from "../../helpers/user";
 import { AuthTokenType } from "../../variables";
-import { 
-  BadRequestError, 
-  UnauthorizedRequestError
-} from "../../utils/errors";
+import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
 import {
   getAuthSecret,
   getHttpsEnabled,
-  getJwtAuthLifetime,
+  getJwtAuthLifetime
 } from "../../config";
 import { ActorType } from "../../ee/models";
 import { validateRequest } from "../../helpers/validation";
@@ -32,11 +25,10 @@ declare module "jsonwebtoken" {
     userId: string;
     refreshVersion?: number;
   }
-  export interface IdentityAccessTokenJwtPayload extends jwt.JwtPayload {
-    _id: string;
-    clientSecretId: string;
-    identityAccessTokenId: string;
+  export interface ServiceRefreshTokenJwtPayload extends jwt.JwtPayload {
+    serviceTokenDataId: string;
     authTokenType: string;
+    tokenVersion: number;
   }
 }
 
@@ -274,4 +266,4 @@ export const getNewToken = async (req: Request, res: Response) => {
 
 export const handleAuthProviderCallback = (req: Request, res: Response) => {
   res.redirect(`/login/provider/success?token=${encodeURIComponent(req.providerAuthToken)}`);
-};
+};

backend/src/controllers/v1/botController.ts

@@ -7,7 +7,7 @@ import * as reqValidator from "../../validation/bot";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
 import { BadRequestError } from "../../utils/errors";
@@ -28,11 +28,7 @@ export const getBotByWorkspaceId = async (req: Request, res: Response) => {
   const {
     params: { workspaceId }
   } = await validateRequest(reqValidator.GetBotByWorkspaceIdV1, req);
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -74,11 +70,7 @@ export const setBotActiveState = async (req: Request, res: Response) => {
   }
   const userId = req.user._id;
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: bot.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(userId, bot.workspace.toString());
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.Integrations

backend/src/controllers/v1/index.ts

@@ -1,5 +1,4 @@
 import * as authController from "./authController";
-import * as universalAuthController from "./universalAuthController";
 import * as botController from "./botController";
 import * as integrationAuthController from "./integrationAuthController";
 import * as integrationController from "./integrationController";
@@ -21,7 +20,6 @@ import * as adminController from "./adminController";
 
 export {
   authController,
-  universalAuthController,
   botController,
   integrationAuthController,
   integrationController,

backend/src/controllers/v1/integrationAuthController.ts

@@ -25,7 +25,7 @@ import * as reqValidator from "../../validation/integrationAuth";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
 import { getIntegrationAuthAccessHelper } from "../../helpers";
@@ -40,15 +40,15 @@ export const getIntegrationAuth = async (req: Request, res: Response) => {
 
   const integrationAuth = await IntegrationAuth.findById(integrationAuthId);
 
-  if (!integrationAuth) return res.status(400).send({
-    message: "Failed to find integration authorization"
-  });
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
-  });
+  if (!integrationAuth)
+    return res.status(400).send({
+      message: "Failed to find integration authorization"
+    });
 
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -79,11 +79,7 @@ export const oAuthExchange = async (req: Request, res: Response) => {
   } = await validateRequest(reqValidator.OauthExchangeV1, req);
   if (!INTEGRATION_SET.has(integration)) throw new Error("Failed to validate integration");
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-  
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.Integrations
@@ -135,11 +131,7 @@ export const saveIntegrationToken = async (req: Request, res: Response) => {
     body: { workspaceId, integration, url, accessId, namespace, accessToken, refreshToken }
   } = await validateRequest(reqValidator.SaveIntegrationAccessTokenV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.Integrations
@@ -232,12 +224,11 @@ export const getIntegrationAuthApps = async (req: Request, res: Response) => {
   const { integrationAuth, accessToken, accessId } = await getIntegrationAuthAccessHelper({
     integrationAuthId: new Types.ObjectId(integrationAuthId)
   });
-  
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
-  });
 
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -272,11 +263,10 @@ export const getIntegrationAuthTeams = async (req: Request, res: Response) => {
     integrationAuthId: new Types.ObjectId(integrationAuthId)
   });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -309,11 +299,10 @@ export const getIntegrationAuthVercelBranches = async (req: Request, res: Respon
     integrationAuthId: new Types.ObjectId(integrationAuthId)
   });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
-  });
-  
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -371,11 +360,10 @@ export const getIntegrationAuthChecklyGroups = async (req: Request, res: Respons
     integrationAuthId: new Types.ObjectId(integrationAuthId)
   });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
-  });
-  
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -425,11 +413,10 @@ export const getIntegrationAuthQoveryOrgs = async (req: Request, res: Response)
     integrationAuthId: new Types.ObjectId(integrationAuthId)
   });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -478,11 +465,10 @@ export const getIntegrationAuthQoveryProjects = async (req: Request, res: Respon
     integrationAuthId: new Types.ObjectId(integrationAuthId)
   });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -540,11 +526,10 @@ export const getIntegrationAuthQoveryEnvironments = async (req: Request, res: Re
     integrationAuthId: new Types.ObjectId(integrationAuthId)
   });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -602,11 +587,10 @@ export const getIntegrationAuthQoveryApps = async (req: Request, res: Response)
     integrationAuthId: new Types.ObjectId(integrationAuthId)
   });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
-  });
-  
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -664,11 +648,10 @@ export const getIntegrationAuthQoveryContainers = async (req: Request, res: Resp
     integrationAuthId: new Types.ObjectId(integrationAuthId)
   });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
-  });
-  
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -726,11 +709,10 @@ export const getIntegrationAuthQoveryJobs = async (req: Request, res: Response)
     integrationAuthId: new Types.ObjectId(integrationAuthId)
   });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -789,11 +771,10 @@ export const getIntegrationAuthRailwayEnvironments = async (req: Request, res: R
     integrationAuthId: new Types.ObjectId(integrationAuthId)
   });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
-  });
-  
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -883,11 +864,10 @@ export const getIntegrationAuthRailwayServices = async (req: Request, res: Respo
     integrationAuthId: new Types.ObjectId(integrationAuthId)
   });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -1008,11 +988,10 @@ export const getIntegrationAuthBitBucketWorkspaces = async (req: Request, res: R
     integrationAuthId: new Types.ObjectId(integrationAuthId)
   });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -1065,11 +1044,10 @@ export const getIntegrationAuthNorthflankSecretGroups = async (req: Request, res
     integrationAuthId: new Types.ObjectId(integrationAuthId)
   });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
-  });
-  
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -1154,11 +1132,10 @@ export const getIntegrationAuthTeamCityBuildConfigs = async (req: Request, res:
     integrationAuthId: new Types.ObjectId(integrationAuthId)
   });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -1224,11 +1201,10 @@ export const deleteIntegrationAuth = async (req: Request, res: Response) => {
     integrationAuthId: new Types.ObjectId(integrationAuthId)
   });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace
-  });
-  
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Delete,
     ProjectPermissionSub.Integrations

backend/src/controllers/v1/integrationController.ts

@@ -13,7 +13,7 @@ import * as reqValidator from "../../validation/integration";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
 
@@ -51,12 +51,11 @@ export const createIntegration = async (req: Request, res: Response) => {
     );
 
   if (!integrationAuth) throw BadRequestError({ message: "Integration auth not found" });
-  
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integrationAuth.workspace._id
-  });
-  
+
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace._id.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.Integrations
@@ -165,11 +164,10 @@ export const updateIntegration = async (req: Request, res: Response) => {
   const integration = await Integration.findById(integrationId);
   if (!integration) throw BadRequestError({ message: "Integration not found" });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integration.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integration.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.Integrations
@@ -236,11 +234,10 @@ export const deleteIntegration = async (req: Request, res: Response) => {
   const integration = await Integration.findById(integrationId);
   if (!integration) throw BadRequestError({ message: "Integration not found" });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: integration.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integration.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Delete,
     ProjectPermissionSub.Integrations
@@ -288,11 +285,7 @@ export const manualSync = async (req: Request, res: Response) => {
     body: { workspaceId, environment }
   } = await validateRequest(reqValidator.ManualSyncV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-  
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.Integrations

backend/src/controllers/v1/keyController.ts

@@ -9,7 +9,7 @@ import * as reqValidator from "../../validation/key";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
 
@@ -26,11 +26,7 @@ export const uploadKey = async (req: Request, res: Response) => {
     body: { key }
   } = await validateRequest(reqValidator.UploadKeyV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-  
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.Member

backend/src/controllers/v1/membershipController.ts

@@ -4,15 +4,15 @@ import { IUser, Key, Membership, MembershipOrg, User, Workspace } from "../../mo
 import { EventType, Role } from "../../ee/models";
 import { deleteMembership as deleteMember, findMembership } from "../../helpers/membership";
 import { sendMail } from "../../helpers/nodemailer";
-import { ACCEPTED, ADMIN, CUSTOM, MEMBER, NO_ACCESS, VIEWER } from "../../variables";
+import { ACCEPTED, ADMIN, CUSTOM, MEMBER, VIEWER } from "../../variables";
 import { getSiteURL } from "../../config";
-import { EEAuditLogService, EELicenseService } from "../../ee/services";
+import { EEAuditLogService } from "../../ee/services";
 import { validateRequest } from "../../helpers/validation";
 import * as reqValidator from "../../validation/membership";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
 import { BadRequestError } from "../../utils/errors";
@@ -63,12 +63,11 @@ export const deleteMembership = async (req: Request, res: Response) => {
   if (!membershipToDelete) {
     throw new Error("Failed to delete workspace membership that doesn't exist");
   }
-  
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: membershipToDelete.workspace
-  });
-  
+
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    membershipToDelete.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Delete,
     ProjectPermissionSub.Member
@@ -119,17 +118,16 @@ export const changeMembershipRole = async (req: Request, res: Response) => {
     throw new Error("Failed to find membership to change role");
   }
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: membershipToChangeRole.workspace
-  });
-  
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    membershipToChangeRole.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.Member
   );
 
-  const isCustomRole = ![ADMIN, MEMBER, VIEWER, NO_ACCESS].includes(role);
+  const isCustomRole = ![ADMIN, MEMBER, VIEWER].includes(role);
   if (isCustomRole) {
     const wsRole = await Role.findOne({
       slug: role,
@@ -137,13 +135,6 @@ export const changeMembershipRole = async (req: Request, res: Response) => {
       workspace: membershipToChangeRole.workspace
     });
     if (!wsRole) throw BadRequestError({ message: "Role not found" });
-
-    const plan = await EELicenseService.getPlan(wsRole.organization);
-
-    if (!plan.rbac) return res.status(400).send({
-      message: "Failed to assign custom role due to RBAC restriction. Upgrade plan to assign custom role to member."
-    });
-
     const membership = await Membership.findByIdAndUpdate(membershipId, {
       role: CUSTOM,
       customRole: wsRole
@@ -200,12 +191,7 @@ export const inviteUserToWorkspace = async (req: Request, res: Response) => {
     params: { workspaceId },
     body: { email }
   } = await validateRequest(InviteUserToWorkspaceV1, req);
-  
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-  
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.Member

backend/src/controllers/v1/membershipOrgController.ts

@@ -21,7 +21,7 @@ import { validateRequest } from "../../helpers/validation";
 import {
   OrgPermissionActions,
   OrgPermissionSubjects,
-  getAuthDataOrgPermissions
+  getUserOrgPermissions
 } from "../../ee/services/RoleService";
 import { ForbiddenError } from "@casl/ability";
 
@@ -44,12 +44,11 @@ export const deleteMembershipOrg = async (req: Request, _res: Response) => {
   if (!membershipOrgToDelete) {
     throw new Error("Failed to delete organization membership that doesn't exist");
   }
-  
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: membershipOrgToDelete.organization
-  });
 
+  const { permission, membership: membershipOrg } = await getUserOrgPermissions(
+    req.user._id,
+    membershipOrgToDelete.organization.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Delete,
     OrgPermissionSubjects.Member
@@ -61,7 +60,7 @@ export const deleteMembershipOrg = async (req: Request, _res: Response) => {
   });
 
   await updateSubscriptionOrgQuantity({
-    organizationId: membershipOrgToDelete.organization.toString()
+    organizationId: membershipOrg.organization.toString()
   });
 
   return membershipOrgToDelete;
@@ -97,11 +96,7 @@ export const inviteUserToOrganization = async (req: Request, res: Response) => {
     body: { inviteeEmail, organizationId }
   } = await validateRequest(reqValidator.InviteUserToOrgv1, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
-  
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Create,
     OrgPermissionSubjects.Member

backend/src/controllers/v1/organizationController.ts

@@ -1,5 +1,4 @@
 import { Request, Response } from "express";
-import { Types } from "mongoose";
 import {
   IncidentContactOrg,
   Membership,
@@ -15,7 +14,7 @@ import { ACCEPTED } from "../../variables";
 import {
   OrgPermissionActions,
   OrgPermissionSubjects,
-  getAuthDataOrgPermissions
+  getUserOrgPermissions
 } from "../../ee/services/RoleService";
 import { OrganizationNotFoundError } from "../../utils/errors";
 import { ForbiddenError } from "@casl/ability";
@@ -45,10 +44,7 @@ export const getOrganization = async (req: Request, res: Response) => {
   } = await validateRequest(reqValidator.GetOrgv1, req);
 
   // ensure user has membership
-  await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  })
+  await getUserOrgPermissions(req.user._id, organizationId);
 
   const organization = await Organization.findById(organizationId);
   if (!organization) {
@@ -72,12 +68,8 @@ export const getOrganizationMembers = async (req: Request, res: Response) => {
   const {
     params: { organizationId }
   } = await validateRequest(reqValidator.GetOrgMembersv1, req);
-  
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
-  
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Read,
     OrgPermissionSubjects.Member
@@ -103,10 +95,7 @@ export const getOrganizationWorkspaces = async (req: Request, res: Response) =>
     params: { organizationId }
   } = await validateRequest(reqValidator.GetOrgWorkspacesv1, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  })
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Read,
     OrgPermissionSubjects.Workspace
@@ -148,10 +137,7 @@ export const changeOrganizationName = async (req: Request, res: Response) => {
     body: { name }
   } = await validateRequest(reqValidator.ChangeOrgNamev1, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Edit,
     OrgPermissionSubjects.Settings
@@ -186,10 +172,7 @@ export const getOrganizationIncidentContacts = async (req: Request, res: Respons
     params: { organizationId }
   } = await validateRequest(reqValidator.GetOrgIncidentContactv1, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Read,
     OrgPermissionSubjects.IncidentAccount
@@ -216,10 +199,7 @@ export const addOrganizationIncidentContact = async (req: Request, res: Response
     body: { email }
   } = await validateRequest(reqValidator.CreateOrgIncideContact, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Create,
     OrgPermissionSubjects.IncidentAccount
@@ -248,10 +228,7 @@ export const deleteOrganizationIncidentContact = async (req: Request, res: Respo
     body: { email }
   } = await validateRequest(reqValidator.DelOrgIncideContact, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Delete,
     OrgPermissionSubjects.IncidentAccount
@@ -280,10 +257,7 @@ export const createOrganizationPortalSession = async (req: Request, res: Respons
     params: { organizationId }
   } = await validateRequest(reqValidator.GetOrgPlanBillingInfov1, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Edit,
     OrgPermissionSubjects.Billing
@@ -347,10 +321,7 @@ export const getOrganizationMembersAndTheirWorkspaces = async (req: Request, res
     params: { organizationId }
   } = await validateRequest(reqValidator.GetOrgMembersv1, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Read,
     OrgPermissionSubjects.Member

backend/src/controllers/v1/secretImpsController.ts

@@ -1,6 +1,4 @@
-
 import { Request, Response } from "express";
-import { Types } from "mongoose";
 import { isValidScope } from "../../helpers";
 import { Folder, IServiceTokenData, SecretImport, ServiceTokenData } from "../../models";
 import { getAllImportedSecrets } from "../../services/SecretImportService";
@@ -17,7 +15,7 @@ import * as reqValidator from "../../validation/secretImports";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError, subject } from "@casl/ability";
 
@@ -107,11 +105,7 @@ export const createSecretImp = async (req: Request, res: Response) => {
       throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
     }
   } else {
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: new Types.ObjectId(workspaceId)
-    });
-    
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Create,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: directory })
@@ -319,11 +313,10 @@ export const updateSecretImport = async (req: Request, res: Response) => {
     }
   } else {
     // non token entry check
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: importSecDoc.workspace
-    });
-    
+    const { permission } = await getUserProjectPermissions(
+      req.user._id,
+      importSecDoc.workspace.toString()
+    );
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Edit,
       subject(ProjectPermissionSub.Secrets, {
@@ -449,11 +442,10 @@ export const deleteSecretImport = async (req: Request, res: Response) => {
       throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
     }
   } else {
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: importSecDoc.workspace
-    });
-    
+    const { permission } = await getUserProjectPermissions(
+      req.user._id,
+      importSecDoc.workspace.toString()
+    );
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Delete,
       subject(ProjectPermissionSub.Secrets, {
@@ -558,11 +550,7 @@ export const getSecretImports = async (req: Request, res: Response) => {
       throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
     }
   } else {
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: new Types.ObjectId(workspaceId)
-    });
-
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Read,
       subject(ProjectPermissionSub.Secrets, {
@@ -616,11 +604,7 @@ export const getAllSecretsFromImport = async (req: Request, res: Response) => {
       throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
     }
   } else {
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: new Types.ObjectId(workspaceId)
-    });
-    
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Read,
       subject(ProjectPermissionSub.Secrets, {
@@ -673,11 +657,10 @@ export const getAllSecretsFromImport = async (req: Request, res: Response) => {
     permissionCheckFn = (env: string, secPath: string) =>
       isValidScope(req.authData.authPayload as IServiceTokenData, env, secPath);
   } else {
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: importSecDoc.workspace
-    });
-    
+    const { permission } = await getUserProjectPermissions(
+      req.user._id,
+      importSecDoc.workspace.toString()
+    );
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Read,
       subject(ProjectPermissionSub.Secrets, {

backend/src/controllers/v1/secretScanningController.ts

@@ -21,7 +21,7 @@ import * as reqValidator from "../../validation/secretScanning";
 import {
   OrgPermissionActions,
   OrgPermissionSubjects,
-  getAuthDataOrgPermissions
+  getUserOrgPermissions
 } from "../../ee/services/RoleService";
 import { ForbiddenError } from "@casl/ability";
 
@@ -37,11 +37,8 @@ export const createInstallationSession = async (req: Request, res: Response) =>
       message: "Failed to find organization"
     });
   }
-  
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Create,
     OrgPermissionSubjects.SecretScanning
@@ -73,12 +70,11 @@ export const linkInstallationToOrganization = async (req: Request, res: Response
   if (!installationSession) {
     throw UnauthorizedRequestError();
   }
-  
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: installationSession.organization
-  });
 
+  const { permission } = await getUserOrgPermissions(
+    req.user._id,
+    installationSession.organization.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Edit,
     OrgPermissionSubjects.SecretScanning
@@ -146,10 +142,7 @@ export const getRisksForOrganization = async (req: Request, res: Response) => {
     params: { organizationId }
   } = await validateRequest(reqValidator.GetOrgRisksv1, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Read,
     OrgPermissionSubjects.SecretScanning
@@ -169,10 +162,7 @@ export const updateRisksStatus = async (req: Request, res: Response) => {
     body: { status }
   } = await validateRequest(reqValidator.UpdateRiskStatusv1, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Edit,
     OrgPermissionSubjects.SecretScanning

backend/src/controllers/v1/secretsFolderController.ts

@@ -17,7 +17,7 @@ import {
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
 import * as reqValidator from "../../validation/folders";
@@ -125,11 +125,7 @@ export const createFolder = async (req: Request, res: Response) => {
     }
   } else {
     // user check
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: new Types.ObjectId(workspaceId)
-    });
-
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Create,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: directory })
@@ -336,11 +332,7 @@ export const updateFolderById = async (req: Request, res: Response) => {
       throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
     }
   } else {
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: new Types.ObjectId(workspaceId)
-    });
-  
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Edit,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: directory })
@@ -510,11 +502,7 @@ export const deleteFolder = async (req: Request, res: Response) => {
     }
   } else {
     // check that user is a member of the workspace
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: new Types.ObjectId(workspaceId)
-    });
-
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Delete,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: directory })
@@ -661,10 +649,7 @@ export const getFolders = async (req: Request, res: Response) => {
     }
   } else {
     // check that user is a member of the workspace
-    await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: new Types.ObjectId(workspaceId)
-    });
+    await getUserProjectPermissions(req.user._id, workspaceId);
   }
 
   const folders = await Folder.findOne({ workspace: workspaceId, environment });

backend/src/controllers/v1/universalAuthController.ts

@@ -1,790 +0,0 @@
-import { Request, Response } from "express";
-import { Types } from "mongoose";
-import jwt from "jsonwebtoken";
-import crypto from "crypto";
-import bcrypt from "bcrypt";
-import {
-    IIdentity,
-    IIdentityTrustedIp,
-    IIdentityUniversalAuthClientSecret,
-    Identity,
-    IdentityAccessToken,
-    IdentityAuthMethod,
-    IdentityMembershipOrg,
-    IdentityUniversalAuth,
-    IdentityUniversalAuthClientSecret,
-} from "../../models";
-import { createToken } from "../../helpers/auth";
-import { AuthTokenType } from "../../variables";
-import {
-    BadRequestError,
-    ForbiddenRequestError,
-    ResourceNotFoundError,
-    UnauthorizedRequestError
-} from "../../utils/errors";
-import {
-    getAuthSecret,
-    getSaltRounds
-} from "../../config";
-import { ActorType, EventType, IRole } from "../../ee/models";
-import { validateRequest } from "../../helpers/validation";
-import * as reqValidator from "../../validation/auth";
-import { checkIPAgainstBlocklist, extractIPDetails, isValidIpOrCidr } from "../../utils/ip";
-import { getUserAgentType } from "../../utils/posthog";
-import { EEAuditLogService, EELicenseService } from "../../ee/services";
-import {
-    OrgPermissionActions,
-    OrgPermissionSubjects,
-    getAuthDataOrgPermissions,
-    getOrgRolePermissions,
-    isAtLeastAsPrivilegedOrg
-} from "../../ee/services/RoleService";
-import { ForbiddenError } from "@casl/ability";
-
-const packageUniversalAuthClientSecretData = (identityUniversalAuthClientSecret: IIdentityUniversalAuthClientSecret) => ({
-    _id: identityUniversalAuthClientSecret._id,
-    identityUniversalAuth: identityUniversalAuthClientSecret.identityUniversalAuth,
-    isClientSecretRevoked: identityUniversalAuthClientSecret.isClientSecretRevoked,
-    description: identityUniversalAuthClientSecret.description,
-    clientSecretPrefix: identityUniversalAuthClientSecret.clientSecretPrefix,
-    clientSecretNumUses: identityUniversalAuthClientSecret.clientSecretNumUses,
-    clientSecretNumUsesLimit: identityUniversalAuthClientSecret.clientSecretNumUsesLimit,
-    clientSecretTTL: identityUniversalAuthClientSecret.clientSecretTTL,
-    createdAt: identityUniversalAuthClientSecret.createdAt,
-    updatedAt: identityUniversalAuthClientSecret.updatedAt
-});
-
-/**
- * Renews an access token by its TTL
- * @param req 
- * @param res 
- */
-export const renewAccessToken = async (req: Request, res: Response) => {
-    const {
-        body: {
-            accessToken
-        }
-    } = await validateRequest(reqValidator.RenewAccessTokenV1, req);
-
-    const decodedToken = <jwt.IdentityAccessTokenJwtPayload>(
-        jwt.verify(accessToken, await getAuthSecret())
-    );
-
-    if (decodedToken.authTokenType !== AuthTokenType.IDENTITY_ACCESS_TOKEN) throw UnauthorizedRequestError();
-
-    const identityAccessToken = await IdentityAccessToken.findOne({
-        _id: decodedToken.identityAccessTokenId,
-        isAccessTokenRevoked: false
-    });
-
-    if (!identityAccessToken) throw UnauthorizedRequestError();
-
-    const {
-        accessTokenTTL,
-        accessTokenLastRenewedAt,
-        accessTokenMaxTTL,
-        createdAt: accessTokenCreatedAt
-    } = identityAccessToken;
-
-
-    // ttl check
-    if (accessTokenTTL > 0) {
-        const currentDate = new Date();
-        if (accessTokenLastRenewedAt) {
-            // access token has been renewed
-            const accessTokenRenewed = new Date(accessTokenLastRenewedAt);
-            const ttlInMilliseconds = accessTokenTTL * 1000;
-            const expirationDate = new Date(accessTokenRenewed.getTime() + ttlInMilliseconds);
-
-            if (currentDate > expirationDate) throw UnauthorizedRequestError({
-                message: "Failed to renew MI access token due to TTL expiration"
-            });
-        } else {
-            // access token has never been renewed
-            const accessTokenCreated = new Date(accessTokenCreatedAt);
-            const ttlInMilliseconds = accessTokenTTL * 1000;
-            const expirationDate = new Date(accessTokenCreated.getTime() + ttlInMilliseconds);
-
-            if (currentDate > expirationDate) throw UnauthorizedRequestError({
-                message: "Failed to renew MI access token due to TTL expiration"
-            });
-        }
-    }
-
-    // max ttl checks
-    if (accessTokenMaxTTL > 0) {
-        const accessTokenCreated = new Date(accessTokenCreatedAt);
-        const ttlInMilliseconds = accessTokenMaxTTL * 1000;
-        const currentDate = new Date();
-        const expirationDate = new Date(accessTokenCreated.getTime() + ttlInMilliseconds);
-
-        if (currentDate > expirationDate) throw UnauthorizedRequestError({
-            message: "Failed to renew MI access token due to Max TTL expiration"
-        });
-
-        const extendToDate = new Date(currentDate.getTime() + accessTokenTTL);
-        if (extendToDate > expirationDate) throw UnauthorizedRequestError({
-            message: "Failed to renew MI access token past its Max TTL expiration"
-        });
-    }
-
-    await IdentityAccessToken.findByIdAndUpdate(
-        identityAccessToken._id,
-        {
-            accessTokenLastRenewedAt: new Date()
-        }
-    );
-
-    return res.status(200).send({
-        accessToken,
-        expiresIn: identityAccessToken.accessTokenTTL,
-        accessTokenMaxTTL: identityAccessToken.accessTokenMaxTTL,
-        tokenType: "Bearer"
-    });
-}
-
-/**
- * Return access token for identity with client id [clientId]
- * and client secret [clientSecret]
- * @param req 
- * @param res 
- */
-export const loginIdentityUniversalAuth = async (req: Request, res: Response) => {
-    const {
-        body: {
-            clientId,
-            clientSecret
-        }
-    } = await validateRequest(reqValidator.LoginUniversalAuthV1, req);
-
-    const identityUniversalAuth = await IdentityUniversalAuth.findOne({
-        clientId
-    }).populate<{ identity: IIdentity }>("identity");
-
-    if (!identityUniversalAuth) throw UnauthorizedRequestError();
-
-    checkIPAgainstBlocklist({
-        ipAddress: req.realIP,
-        trustedIps: identityUniversalAuth.clientSecretTrustedIps
-    });
-
-    const clientSecretData = await IdentityUniversalAuthClientSecret.find({
-        identity: identityUniversalAuth.identity,
-        isClientSecretRevoked: false
-    });
-
-    let validatedClientSecretDatum: IIdentityUniversalAuthClientSecret | undefined;
-
-    for (const clientSecretDatum of clientSecretData) {
-        const isSecretValid = await bcrypt.compare(
-            clientSecret,
-            clientSecretDatum.clientSecretHash
-        );
-
-        if (isSecretValid) {
-            validatedClientSecretDatum = clientSecretDatum;
-            break;
-        }
-    }
-
-    if (!validatedClientSecretDatum) throw UnauthorizedRequestError();
-
-    const {
-        clientSecretTTL,
-        clientSecretNumUses,
-        clientSecretNumUsesLimit,
-    } = validatedClientSecretDatum;
-
-    if (clientSecretTTL > 0) {
-        const clientSecretCreated = new Date(validatedClientSecretDatum.createdAt)
-        const ttlInMilliseconds = clientSecretTTL * 1000;
-        const currentDate = new Date();
-        const expirationTime = new Date(clientSecretCreated.getTime() + ttlInMilliseconds);
-
-        if (currentDate > expirationTime) {
-            await IdentityUniversalAuthClientSecret.findByIdAndUpdate(
-                validatedClientSecretDatum._id,
-                {
-                    isClientSecretRevoked: true
-                }
-            );
-
-            throw UnauthorizedRequestError({
-                message: "Failed to authenticate identity credentials due to expired client secret"
-            });
-        }
-    }
-
-    if (clientSecretNumUsesLimit > 0 && clientSecretNumUses === clientSecretNumUsesLimit) {
-        // number of times client secret can be used for 
-        // a login operation reached
-        await IdentityUniversalAuthClientSecret.findByIdAndUpdate(
-            validatedClientSecretDatum._id,
-            {
-                isClientSecretRevoked: true
-            },
-            {
-                new: true
-            }
-        );
-
-        throw UnauthorizedRequestError({
-            message: "Failed to authenticate identity credentials due to client secret number of uses limit reached"
-        });
-    }
-
-    // increment usage count by 1
-    await IdentityUniversalAuthClientSecret
-        .findByIdAndUpdate(
-            validatedClientSecretDatum._id,
-            {
-                clientSecretLastUsedAt: new Date(),
-                $inc: { clientSecretNumUses: 1 }
-            },
-            {
-                new: true
-            }
-        );
-
-    const identityAccessToken = await new IdentityAccessToken({
-        identity: identityUniversalAuth.identity,
-        identityUniversalAuthClientSecret: validatedClientSecretDatum._id,
-        accessTokenNumUses: 0,
-        accessTokenNumUsesLimit: identityUniversalAuth.accessTokenNumUsesLimit,
-        accessTokenTTL: identityUniversalAuth.accessTokenTTL,
-        accessTokenMaxTTL: identityUniversalAuth.accessTokenMaxTTL,
-        accessTokenTrustedIps: identityUniversalAuth.accessTokenTrustedIps,
-        isAccessTokenRevoked: false
-    }).save();
-
-    // token version
-    const accessToken = createToken({
-        payload: {
-            identityId: identityUniversalAuth.identity.toString(),
-            clientSecretId: validatedClientSecretDatum._id.toString(),
-            identityAccessTokenId: identityAccessToken._id.toString(),
-            authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
-        },
-        secret: await getAuthSecret()
-    });
-
-    const userAgent = req.headers["user-agent"] ?? "";
-
-    await EEAuditLogService.createAuditLog(
-        {
-            actor: {
-                type: ActorType.IDENTITY,
-                metadata: {
-                    identityId: identityUniversalAuth.identity._id.toString(),
-                    name: identityUniversalAuth.identity.name
-                }
-            },
-            authPayload: identityUniversalAuth.identity,
-            ipAddress: req.realIP,
-            userAgent,
-            userAgentType: getUserAgentType(userAgent)
-        },
-        {
-            type: EventType.LOGIN_IDENTITY_UNIVERSAL_AUTH,
-            metadata: {
-                identityId: identityUniversalAuth.identity._id.toString(),
-                identityUniversalAuthId: identityUniversalAuth._id.toString(),
-                clientSecretId: validatedClientSecretDatum._id.toString(),
-                identityAccessTokenId: identityAccessToken._id.toString()
-            }
-        }
-    );
-
-    return res.status(200).send({
-        accessToken,
-        expiresIn: identityUniversalAuth.accessTokenTTL,
-        accessTokenMaxTTL: identityUniversalAuth.accessTokenMaxTTL,
-        tokenType: "Bearer",
-    });
-}
-
-export const addIdentityUniversalAuth = async (req: Request, res: Response) => {
-    const {
-        params: { identityId },
-        body: {
-            clientSecretTrustedIps,
-            accessTokenTTL,
-            accessTokenMaxTTL,
-            accessTokenNumUsesLimit,
-            accessTokenTrustedIps,
-        }
-    } = await validateRequest(reqValidator.AddUniversalAuthToIdentityV1, req);
-
-    const identityMembershipOrg = await IdentityMembershipOrg
-        .findOne({
-            identity: new Types.ObjectId(identityId)
-        })
-        .populate<{
-            identity: IIdentity,
-            customRole: IRole
-        }>("identity customRole");
-
-    if (!identityMembershipOrg) throw ResourceNotFoundError({
-        message: `Failed to find identity with id ${identityId}`
-    });
-
-    if (identityMembershipOrg.identity?.authMethod) throw BadRequestError({
-        message: "Failed to add universal auth to already-configured identity"
-    });
-
-    if (accessTokenMaxTTL > 0 && accessTokenTTL > accessTokenMaxTTL) {
-        throw BadRequestError({ message: "Access token TTL cannot be greater than max TTL" })
-    }
-
-    const { permission } = await getAuthDataOrgPermissions({
-        authData: req.authData,
-        organizationId: identityMembershipOrg.organization
-    });
-
-    ForbiddenError.from(permission).throwUnlessCan(
-        OrgPermissionActions.Create,
-        OrgPermissionSubjects.Identity
-    );
-
-    const plan = await EELicenseService.getPlan(identityMembershipOrg.organization);
-
-    // validate trusted ips
-    const reformattedClientSecretTrustedIps = clientSecretTrustedIps.map((clientSecretTrustedIp) => {
-        if (!plan.ipAllowlisting && clientSecretTrustedIp.ipAddress !== "0.0.0.0/0") return res.status(400).send({
-            message: "Failed to add IP access range to service token due to plan restriction. Upgrade plan to add IP access range."
-        });
-
-        const isValidIPOrCidr = isValidIpOrCidr(clientSecretTrustedIp.ipAddress);
-
-        if (!isValidIPOrCidr) return res.status(400).send({
-            message: "The IP is not a valid IPv4, IPv6, or CIDR block"
-        });
-
-        return extractIPDetails(clientSecretTrustedIp.ipAddress);
-    });
-
-    const reformattedAccessTokenTrustedIps = accessTokenTrustedIps.map((accessTokenTrustedIp) => {
-        if (!plan.ipAllowlisting && accessTokenTrustedIp.ipAddress !== "0.0.0.0/0") return res.status(400).send({
-            message: "Failed to add IP access range to service token due to plan restriction. Upgrade plan to add IP access range."
-        });
-
-        const isValidIPOrCidr = isValidIpOrCidr(accessTokenTrustedIp.ipAddress);
-
-        if (!isValidIPOrCidr) return res.status(400).send({
-            message: "The IP is not a valid IPv4, IPv6, or CIDR block"
-        });
-
-        return extractIPDetails(accessTokenTrustedIp.ipAddress);
-    });
-
-    const identityUniversalAuth = await new IdentityUniversalAuth({
-        identity: identityMembershipOrg.identity._id,
-        clientId: crypto.randomUUID(),
-        clientSecretTrustedIps: reformattedClientSecretTrustedIps,
-        accessTokenTTL,
-        accessTokenMaxTTL,
-        accessTokenNumUsesLimit,
-        accessTokenTrustedIps: reformattedAccessTokenTrustedIps,
-    }).save();
-
-    await Identity.findByIdAndUpdate(
-        identityMembershipOrg.identity._id,
-        {
-            authMethod: IdentityAuthMethod.UNIVERSAL_AUTH
-        }
-    );
-
-    await EEAuditLogService.createAuditLog(
-        req.authData,
-        {
-            type: EventType.ADD_IDENTITY_UNIVERSAL_AUTH,
-            metadata: {
-                identityId: identityMembershipOrg.identity._id.toString(),
-                clientSecretTrustedIps: reformattedClientSecretTrustedIps as Array<IIdentityTrustedIp>,
-                accessTokenTTL,
-                accessTokenMaxTTL,
-                accessTokenNumUsesLimit,
-                accessTokenTrustedIps: reformattedAccessTokenTrustedIps as Array<IIdentityTrustedIp>
-            }
-        }
-    );
-
-    return res.status(200).send({
-        identityUniversalAuth
-    });
-}
-
-export const updateIdentityUniversalAuth = async (req: Request, res: Response) => {
-    const {
-        params: { identityId },
-        body: {
-            clientSecretTrustedIps,
-            accessTokenTTL, // TODO: validate this and max TTL
-            accessTokenMaxTTL,
-            accessTokenNumUsesLimit,
-            accessTokenTrustedIps,
-        }
-    } = await validateRequest(reqValidator.UpdateUniversalAuthToIdentityV1, req);
-
-    const identityMembershipOrg = await IdentityMembershipOrg
-        .findOne({
-            identity: new Types.ObjectId(identityId)
-        })
-        .populate<{
-            identity: IIdentity,
-            customRole: IRole
-        }>("identity customRole");
-
-    if (!identityMembershipOrg) throw ResourceNotFoundError({
-        message: `Failed to find identity with id ${identityId}`
-    });
-
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.UNIVERSAL_AUTH) throw BadRequestError({
-        message: "Failed to add universal auth to already-configured identity"
-    });
-
-    const { permission } = await getAuthDataOrgPermissions({
-        authData: req.authData,
-        organizationId: identityMembershipOrg.organization
-    });
-
-    ForbiddenError.from(permission).throwUnlessCan(
-        OrgPermissionActions.Edit,
-        OrgPermissionSubjects.Identity
-    );
-
-    const plan = await EELicenseService.getPlan(identityMembershipOrg.organization);
-
-    // validate trusted ips
-    let reformattedClientSecretTrustedIps;
-    if (clientSecretTrustedIps) {
-        reformattedClientSecretTrustedIps = clientSecretTrustedIps.map((clientSecretTrustedIp) => {
-            if (!plan.ipAllowlisting && clientSecretTrustedIp.ipAddress !== "0.0.0.0/0") return res.status(400).send({
-                message: "Failed to add IP access range to service token due to plan restriction. Upgrade plan to add IP access range."
-            });
-
-            const isValidIPOrCidr = isValidIpOrCidr(clientSecretTrustedIp.ipAddress);
-
-            if (!isValidIPOrCidr) return res.status(400).send({
-                message: "The IP is not a valid IPv4, IPv6, or CIDR block"
-            });
-
-            return extractIPDetails(clientSecretTrustedIp.ipAddress);
-        });
-    }
-
-    let reformattedAccessTokenTrustedIps;
-    if (accessTokenTrustedIps) {
-        reformattedAccessTokenTrustedIps = accessTokenTrustedIps.map((accessTokenTrustedIp) => {
-            if (!plan.ipAllowlisting && accessTokenTrustedIp.ipAddress !== "0.0.0.0/0") return res.status(400).send({
-                message: "Failed to add IP access range to service token due to plan restriction. Upgrade plan to add IP access range."
-            });
-
-            const isValidIPOrCidr = isValidIpOrCidr(accessTokenTrustedIp.ipAddress);
-
-            if (!isValidIPOrCidr) return res.status(400).send({
-                message: "The IP is not a valid IPv4, IPv6, or CIDR block"
-            });
-
-            return extractIPDetails(accessTokenTrustedIp.ipAddress);
-        });
-    }
-
-    const identityUniversalAuth = await IdentityUniversalAuth.findOneAndUpdate(
-        {
-            identity: identityMembershipOrg.identity._id,
-        },
-        {
-            clientSecretTrustedIps: reformattedClientSecretTrustedIps,
-            accessTokenTTL,
-            accessTokenMaxTTL,
-            accessTokenNumUsesLimit,
-            accessTokenTrustedIps: reformattedAccessTokenTrustedIps,
-        },
-        {
-            new: true
-        }
-    );
-
-    await EEAuditLogService.createAuditLog(
-        req.authData,
-        {
-            type: EventType.UPDATE_IDENTITY_UNIVERSAL_AUTH,
-            metadata: {
-                identityId: identityMembershipOrg.identity._id.toString(),
-                clientSecretTrustedIps: reformattedClientSecretTrustedIps as Array<IIdentityTrustedIp>,
-                accessTokenTTL,
-                accessTokenMaxTTL,
-                accessTokenNumUsesLimit,
-                accessTokenTrustedIps: reformattedAccessTokenTrustedIps as Array<IIdentityTrustedIp>
-            }
-        }
-    );
-
-    return res.status(200).send({
-        identityUniversalAuth
-    });
-}
-
-export const getIdentityUniversalAuth = async (req: Request, res: Response) => {
-    const {
-        params: { identityId }
-    } = await validateRequest(reqValidator.GetUniversalAuthForIdentityV1, req);
-
-    const identityMembershipOrg = await IdentityMembershipOrg
-        .findOne({
-            identity: new Types.ObjectId(identityId)
-        })
-        .populate<{
-            identity: IIdentity,
-            customRole: IRole
-        }>("identity customRole");
-
-    if (!identityMembershipOrg) throw ResourceNotFoundError({
-        message: `Failed to find identity with id ${identityId}`
-    });
-
-    const { permission } = await getAuthDataOrgPermissions({
-        authData: req.authData,
-        organizationId: identityMembershipOrg.organization
-    });
-
-    ForbiddenError.from(permission).throwUnlessCan(
-        OrgPermissionActions.Read,
-        OrgPermissionSubjects.Identity
-    );
-
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.UNIVERSAL_AUTH) throw BadRequestError({
-        message: "The identity does not have universal auth configured"
-    });
-
-    const identityUniversalAuth = await IdentityUniversalAuth.findOne({
-        identity: identityMembershipOrg.identity._id,
-    });
-
-    await EEAuditLogService.createAuditLog(
-        req.authData,
-        {
-            type: EventType.GET_IDENTITY_UNIVERSAL_AUTH,
-            metadata: {
-                identityId: identityMembershipOrg.identity._id.toString(),
-            }
-        }
-    );
-
-    return res.status(200).send({
-        identityUniversalAuth
-    });
-}
-
-export const createUniversalAuthClientSecret = async (req: Request, res: Response) => {
-    const {
-        params: { identityId },
-        body: {
-            description,
-            numUsesLimit,
-            ttl
-        }
-    } = await validateRequest(reqValidator.CreateUniversalAuthClientSecretV1, req);
-
-    const identityMembershipOrg = await IdentityMembershipOrg.findOne({
-        identity: new Types.ObjectId(identityId)
-    }).populate<{
-        identity: IIdentity,
-        customRole: IRole
-    }>("identity customRole");
-
-    if (!identityMembershipOrg) throw ResourceNotFoundError({
-        message: `Failed to find identity with id ${identityId}`
-    });
-
-    const { permission } = await getAuthDataOrgPermissions({
-        authData: req.authData,
-        organizationId: identityMembershipOrg.organization
-    });
-
-    ForbiddenError.from(permission).throwUnlessCan(
-        OrgPermissionActions.Create,
-        OrgPermissionSubjects.Identity
-    );
-
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.UNIVERSAL_AUTH) throw BadRequestError({
-        message: "The identity does not have universal auth configured"
-    });
-
-    const rolePermission = await getOrgRolePermissions(
-        identityMembershipOrg?.customRole?.slug ?? identityMembershipOrg.role,
-        identityMembershipOrg.organization.toString()
-    );
-    const hasRequiredPrivileges = isAtLeastAsPrivilegedOrg(permission, rolePermission);
-
-    if (!hasRequiredPrivileges) throw ForbiddenRequestError({
-        message: "Failed to create client secret for more privileged identity"
-    });
-
-    const clientSecret = crypto.randomBytes(32).toString("hex");
-    const clientSecretHash = await bcrypt.hash(clientSecret, await getSaltRounds());
-
-    const identityUniversalAuth = await IdentityUniversalAuth.findOne({
-        identity: identityMembershipOrg.identity._id
-    });
-
-    if (!identityUniversalAuth) throw ResourceNotFoundError();
-
-    const identityUniversalAuthClientSecret = await new IdentityUniversalAuthClientSecret({
-        identity: identityMembershipOrg.identity._id,
-        identityUniversalAuth: identityUniversalAuth._id,
-        description,
-        clientSecretPrefix: clientSecret.slice(0, 4),
-        clientSecretHash,
-        clientSecretNumUses: 0,
-        clientSecretNumUsesLimit: numUsesLimit,
-        clientSecretTTL: ttl,
-        isClientSecretRevoked: false
-    }).save();
-
-    await EEAuditLogService.createAuditLog(
-        req.authData,
-        {
-            type: EventType.CREATE_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRET,
-            metadata: {
-                identityId: identityMembershipOrg.identity._id.toString(),
-                clientSecretId: identityUniversalAuthClientSecret._id.toString()
-            }
-        }
-    );
-
-    return res.status(200).send({
-        clientSecret,
-        clientSecretData: packageUniversalAuthClientSecretData(identityUniversalAuthClientSecret)
-    });
-}
-
-export const getUniversalAuthClientSecrets = async (req: Request, res: Response) => {
-    const {
-        params: { identityId }
-    } = await validateRequest(reqValidator.GetUniversalAuthClientSecretsV1, req);
-
-    const identityMembershipOrg = await IdentityMembershipOrg.findOne({
-        identity: new Types.ObjectId(identityId)
-    }).populate<{
-        identity: IIdentity,
-        customRole: IRole
-    }>("identity customRole");
-
-    if (!identityMembershipOrg) throw ResourceNotFoundError();
-
-    const { permission } = await getAuthDataOrgPermissions({
-        authData: req.authData,
-        organizationId: identityMembershipOrg.organization
-    });
-    ForbiddenError.from(permission).throwUnlessCan(
-        OrgPermissionActions.Read,
-        OrgPermissionSubjects.Identity
-    );
-
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.UNIVERSAL_AUTH) throw BadRequestError({
-        message: "The identity does not have universal auth configured"
-    });
-
-    const rolePermission = await getOrgRolePermissions(
-        identityMembershipOrg?.customRole?.slug ?? identityMembershipOrg.role,
-        identityMembershipOrg.organization.toString()
-    );
-    const hasRequiredPrivileges = isAtLeastAsPrivilegedOrg(permission, rolePermission);
-
-    if (!hasRequiredPrivileges) throw ForbiddenRequestError({
-        message: "Failed to get client secrets for more privileged MI"
-    });
-
-    const clientSecretData = await IdentityUniversalAuthClientSecret
-        .find({
-            identity: identityMembershipOrg.identity,
-            isClientSecretRevoked: false
-        })
-        .sort({ createdAt: -1 })
-        .limit(5);
-
-    await EEAuditLogService.createAuditLog(
-        req.authData,
-        {
-            type: EventType.GET_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRETS,
-            metadata: {
-                identityId: identityMembershipOrg.identity._id.toString()
-            }
-        }
-    );
-
-    return res.status(200).send({
-        clientSecretData: clientSecretData.map((clientSecretDatum) => packageUniversalAuthClientSecretData(clientSecretDatum))
-    });
-}
-
-export const revokeUniversalAuthClientSecret = async (req: Request, res: Response) => {
-    const {
-        params: { identityId, clientSecretId }
-    } = await validateRequest(reqValidator.RevokeUniversalAuthClientSecretV1, req);
-
-    const identityMembershipOrg = await IdentityMembershipOrg
-        .findOne({
-            identity: new Types.ObjectId(identityId)
-        })
-        .populate<{
-            identity: IIdentity,
-            customRole: IRole
-        }>("identity customRole");
-
-    if (!identityMembershipOrg) throw ResourceNotFoundError({
-        message: `Failed to find identity with id ${identityId}`
-    });
-
-    const { permission } = await getAuthDataOrgPermissions({
-        authData: req.authData,
-        organizationId: identityMembershipOrg.organization
-    });
-
-    ForbiddenError.from(permission).throwUnlessCan(
-        OrgPermissionActions.Delete,
-        OrgPermissionSubjects.Identity
-    );
-
-    const rolePermission = await getOrgRolePermissions(
-        identityMembershipOrg?.customRole?.slug ?? identityMembershipOrg.role,
-        identityMembershipOrg.organization.toString()
-    );
-    const hasRequiredPrivileges = isAtLeastAsPrivilegedOrg(permission, rolePermission);
-
-    if (!hasRequiredPrivileges) throw ForbiddenRequestError({
-        message: "Failed to delete client secrets for more privileged identity"
-    });
-
-    const clientSecretData = await IdentityUniversalAuthClientSecret.findOneAndUpdate(
-        {
-            _id: new Types.ObjectId(clientSecretId),
-            identity: identityMembershipOrg.identity._id
-        },
-        {
-            isClientSecretRevoked: true
-        },
-        {
-            new: true
-        }
-    );
-
-    if (!clientSecretData) throw ResourceNotFoundError();
-
-    await EEAuditLogService.createAuditLog(
-        req.authData,
-        {
-            type: EventType.REVOKE_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRET,
-            metadata: {
-                identityId: identityMembershipOrg.identity._id.toString(),
-                clientSecretId: clientSecretId
-            }
-        }
-    );
-
-    return res.status(200).send({
-        clientSecretData: packageUniversalAuthClientSecretData(clientSecretData)
-    })
-}

backend/src/controllers/v1/webhookController.ts

@@ -16,7 +16,7 @@ import * as reqValidator from "../../validation/webhooks";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
 import { encryptSymmetric128BitHexKeyUTF8 } from "../../utils/crypto";
@@ -26,11 +26,7 @@ export const createWebhook = async (req: Request, res: Response) => {
     body: { webhookUrl, webhookSecretKey, environment, workspaceId, secretPath }
   } = await validateRequest(reqValidator.CreateWebhookV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-  
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.Webhooks
@@ -102,11 +98,11 @@ export const updateWebhook = async (req: Request, res: Response) => {
   if (!webhook) {
     throw BadRequestError({ message: "Webhook not found!!" });
   }
-  
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: webhook.workspace
-  });
+
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    webhook.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.Webhooks
@@ -150,11 +146,10 @@ export const deleteWebhook = async (req: Request, res: Response) => {
     throw ResourceNotFoundError({ message: "Webhook not found!!" });
   }
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: webhook.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    webhook.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Delete,
     ProjectPermissionSub.Webhooks
@@ -198,11 +193,10 @@ export const testWebhook = async (req: Request, res: Response) => {
     throw BadRequestError({ message: "Webhook not found!!" });
   }
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: webhook.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    webhook.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Webhooks
@@ -242,12 +236,8 @@ export const listWebhooks = async (req: Request, res: Response) => {
   const {
     query: { environment, workspaceId, secretPath }
   } = await validateRequest(reqValidator.ListWebhooksV1, req);
-  
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-  
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Webhooks

backend/src/controllers/v1/workspaceController.ts

@@ -17,7 +17,7 @@ import { OrganizationNotFoundError } from "../../utils/errors";
 import {
   OrgPermissionActions,
   OrgPermissionSubjects,
-  getAuthDataOrgPermissions
+  getUserOrgPermissions
 } from "../../ee/services/RoleService";
 import { ForbiddenError } from "@casl/ability";
 import { validateRequest } from "../../helpers/validation";
@@ -25,7 +25,7 @@ import * as reqValidator from "../../validation";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 
 /**
@@ -39,11 +39,7 @@ export const getWorkspacePublicKeys = async (req: Request, res: Response) => {
     params: { workspaceId }
   } = await validateRequest(reqValidator.GetWorkspacePublicKeysV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-  
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Member
@@ -76,11 +72,7 @@ export const getWorkspaceMemberships = async (req: Request, res: Response) => {
     params: { workspaceId }
   } = await validateRequest(reqValidator.GetWorkspaceMembershipsV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Member
@@ -152,10 +144,7 @@ export const createWorkspace = async (req: Request, res: Response) => {
     });
   }
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Create,
     OrgPermissionSubjects.Workspace
@@ -206,11 +195,7 @@ export const deleteWorkspace = async (req: Request, res: Response) => {
     params: { workspaceId }
   } = await validateRequest(reqValidator.DeleteWorkspaceV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-  
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Delete,
     ProjectPermissionSub.Workspace
@@ -238,11 +223,7 @@ export const changeWorkspaceName = async (req: Request, res: Response) => {
     body: { name }
   } = await validateRequest(reqValidator.ChangeWorkspaceNameV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.Workspace
@@ -276,12 +257,7 @@ export const getWorkspaceIntegrations = async (req: Request, res: Response) => {
   const {
     params: { workspaceId }
   } = await validateRequest(reqValidator.GetWorkspaceIntegrationsV1, req);
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -307,11 +283,7 @@ export const getWorkspaceIntegrationAuthorizations = async (req: Request, res: R
     params: { workspaceId }
   } = await validateRequest(reqValidator.GetWorkspaceIntegrationAuthorizationsV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Integrations
@@ -337,11 +309,7 @@ export const getWorkspaceServiceTokens = async (req: Request, res: Response) =>
     params: { workspaceId }
   } = await validateRequest(reqValidator.GetWorkspaceServiceTokensV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.ServiceTokens

backend/src/controllers/v2/authController.ts

@@ -204,16 +204,20 @@ export const login2 = async (req: Request, res: Response) => {
  * @param res
  */
 export const sendMfaToken = async (req: Request, res: Response) => {
+  const {
+    body: { email }
+  } = await validateRequest(reqValidator.SendMfaTokenV2, req);
+
   const code = await TokenService.createToken({
     type: TOKEN_EMAIL_MFA,
-    email: req.user.email
+    email
   });
 
   // send MFA code [code] to [email]
   await sendMail({
     template: "emailMfa.handlebars",
     subjectLine: "Infisical MFA code",
-    recipients: [req.user.email],
+    recipients: [email],
     substitutions: {
       code
     }
@@ -232,17 +236,17 @@ export const sendMfaToken = async (req: Request, res: Response) => {
  */
 export const verifyMfaToken = async (req: Request, res: Response) => {
   const {
-    body: { mfaToken }
+    body: { email, mfaToken }
   } = await validateRequest(reqValidator.VerifyMfaTokenV2, req);
 
   await TokenService.validateToken({
     type: TOKEN_EMAIL_MFA,
-    email: req.user.email,
+    email,
     token: mfaToken
   });
 
   const user = await User.findOne({
-    email: req.user.email
+    email
   }).select(
     "+salt +verifier +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag +publicKey +encryptedPrivateKey +iv +tag +devices"
   );

backend/src/controllers/v2/environmentController.ts

@@ -12,12 +12,14 @@ import {
 import { EventType, SecretVersion } from "../../ee/models";
 import { EEAuditLogService, EELicenseService } from "../../ee/services";
 import { BadRequestError, WorkspaceNotFoundError } from "../../utils/errors";
+import _ from "lodash";
+import { PERMISSION_READ_SECRETS, PERMISSION_WRITE_SECRETS } from "../../variables";
 import { validateRequest } from "../../helpers/validation";
 import * as reqValidator from "../../validation/environments";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
 import { SecretImport } from "../../models";
@@ -112,11 +114,7 @@ export const createWorkspaceEnvironment = async (req: Request, res: Response) =>
     body: { environmentName, environmentSlug }
   } = await validateRequest(reqValidator.CreateWorkspaceEnvironmentV2, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-  
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.Environments
@@ -193,11 +191,7 @@ export const reorderWorkspaceEnvironments = async (req: Request, res: Response)
     body: { environmentName, environmentSlug, otherEnvironmentSlug, otherEnvironmentName }
   } = await validateRequest(reqValidator.ReorderWorkspaceEnvironmentsV2, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.Environments
@@ -328,11 +322,7 @@ export const renameWorkspaceEnvironment = async (req: Request, res: Response) =>
     body: { environmentName, environmentSlug, oldEnvironmentSlug }
   } = await validateRequest(reqValidator.UpdateWorkspaceEnvironmentV2, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.Environments
@@ -521,11 +511,7 @@ export const deleteWorkspaceEnvironment = async (req: Request, res: Response) =>
     body: { environmentSlug }
   } = await validateRequest(reqValidator.DeleteWorkspaceEnvironmentV2, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Delete,
     ProjectPermissionSub.Environments
@@ -601,4 +587,98 @@ export const deleteWorkspaceEnvironment = async (req: Request, res: Response) =>
     workspace: workspaceId,
     environment: environmentSlug
   });
-};
+};
+
+// TODO(akhilmhdh) after rbac this can be completely removed
+export const getAllAccessibleEnvironmentsOfWorkspace = async (req: Request, res: Response) => {
+  /*
+    #swagger.summary = 'Get all accessible environments of a workspace'
+    #swagger.description = 'Fetch all environments that the user has access to in a specified workspace'
+
+    #swagger.security = [{
+        "apiKeyAuth": []
+    }]
+
+    #swagger.parameters['workspaceId'] = {
+		"description": "ID of the workspace",
+		"required": true,
+		"type": "string",
+        "in": "path"
+	}
+
+    #swagger.responses[200] = {
+        content: {
+            "application/json": {
+                "schema": {
+                    "type": "object",
+                    "properties": {
+                        "accessibleEnvironments": {
+                            "type": "array",
+                            "items": {
+                                "type": "object",
+                                "properties": {
+                                    "name": {
+                                        "type": "string",
+                                        "example": "Development"
+                                    },
+                                    "slug": {
+                                        "type": "string",
+                                        "example": "development"
+                                    },
+                                    "isWriteDenied": {
+                                        "type": "boolean",
+                                        "example": false
+                                    },
+                                    "isReadDenied": {
+                                        "type": "boolean",
+                                        "example": false
+                                    }
+                                }
+                            }
+                        }
+                    },
+                    "description": "List of environments the user has access to in the specified workspace"
+                }
+            }
+        }
+    }
+  */
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetAllAccessibileEnvironmentsOfWorkspaceV2, req);
+
+  const { membership: workspacesUserIsMemberOf } = await getUserProjectPermissions(
+    req.user._id,
+    workspaceId
+  );
+
+  const accessibleEnvironments: any = [];
+  const deniedPermission = workspacesUserIsMemberOf.deniedPermissions;
+
+  const relatedWorkspace = await Workspace.findById(workspaceId);
+  if (!relatedWorkspace) {
+    throw BadRequestError();
+  }
+  relatedWorkspace.environments.forEach((environment) => {
+    const isReadBlocked = _.some(deniedPermission, {
+      environmentSlug: environment.slug,
+      ability: PERMISSION_READ_SECRETS
+    });
+    const isWriteBlocked = _.some(deniedPermission, {
+      environmentSlug: environment.slug,
+      ability: PERMISSION_WRITE_SECRETS
+    });
+    if (isReadBlocked && isWriteBlocked) {
+      return;
+    } else {
+      accessibleEnvironments.push({
+        name: environment.name,
+        slug: environment.slug,
+        isWriteDenied: isWriteBlocked,
+        isReadDenied: isReadBlocked
+      });
+    }
+  });
+
+  res.json({ accessibleEnvironments });
+};

backend/src/controllers/v2/membershipController.ts

@@ -8,7 +8,7 @@ import { EEAuditLogService } from "../../ee/services";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import { sendMail } from "../../helpers";
 import { validateRequest } from "../../helpers/validation";
@@ -27,11 +27,7 @@ export const addUserToWorkspace = async (req: Request, res: Response) => {
   if (!workspace) throw new Error("Failed to find workspace");
 
   // check permission
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-  
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.Member

backend/src/controllers/v2/organizationsController.ts

@@ -1,29 +1,31 @@
 import { Request, Response } from "express";
 import { Types } from "mongoose";
 import { 
-  IdentityMembershipOrg,
   Membership, 
-  MembershipOrg,
-  Workspace
+  MembershipOrg, 
+  Workspace 
 } from "../../models";
 import { Role } from "../../ee/models";
 import { deleteMembershipOrg } from "../../helpers/membershipOrg";
-import {
+import { 
   createOrganization as create,
   deleteOrganization,
   updateSubscriptionOrgQuantity
 } from "../../helpers/organization";
 import { addMembershipsOrg } from "../../helpers/membershipOrg";
-import { BadRequestError, ResourceNotFoundError, UnauthorizedRequestError } from "../../utils/errors";
-import { ACCEPTED, ADMIN, CUSTOM, MEMBER, NO_ACCESS } from "../../variables";
+import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
+import {
+  ACCEPTED,
+  ADMIN,
+  CUSTOM 
+} from "../../variables";
 import * as reqValidator from "../../validation/organization";
 import { validateRequest } from "../../helpers/validation";
 import {
   OrgPermissionActions,
   OrgPermissionSubjects,
-  getAuthDataOrgPermissions
+  getUserOrgPermissions
 } from "../../ee/services/RoleService";
-import { EELicenseService } from "../../ee/services";
 import { ForbiddenError } from "@casl/ability";
 
 /**
@@ -69,10 +71,7 @@ export const getOrganizationMemberships = async (req: Request, res: Response) =>
     params: { organizationId }
   } = await validateRequest(reqValidator.GetOrgMembersv2, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Read,
     OrgPermissionSubjects.Member
@@ -150,32 +149,16 @@ export const updateOrganizationMembership = async (req: Request, res: Response)
     params: { organizationId, membershipId },
     body: { role }
   } = await validateRequest(reqValidator.UpdateOrgMemberv2, req);
-
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Edit,
     OrgPermissionSubjects.Member
   );
 
-  const isCustomRole = ![ADMIN, MEMBER, NO_ACCESS].includes(role);
+  const isCustomRole = !["admin", "member", "owner"].includes(role);
   if (isCustomRole) {
-    const orgRole = await Role.findOne({ 
-      slug: role, 
-      isOrgRole: true,
-      organization: new Types.ObjectId(organizationId)
-    });
-
+    const orgRole = await Role.findOne({ slug: role, isOrgRole: true });
     if (!orgRole) throw BadRequestError({ message: "Role not found" });
-    
-    const plan = await EELicenseService.getPlan(new Types.ObjectId(organizationId));
-    
-    if (!plan.rbac) return res.status(400).send({
-      message:
-        "Failed to assign custom role due to RBAC restriction. Upgrade plan to assign custom role to member."
-    });
 
     const membership = await MembershipOrg.findByIdAndUpdate(membershipId, {
       role: CUSTOM,
@@ -252,18 +235,7 @@ export const deleteOrganizationMembership = async (req: Request, res: Response)
   const {
     params: { organizationId, membershipId }
   } = await validateRequest(reqValidator.DeleteOrgMemberv2, req);
-  
-  const membershipOrg = await MembershipOrg.findOne({
-    _id: new Types.ObjectId(membershipId),
-    organization: new Types.ObjectId(organizationId)
-  });
-  
-  if (!membershipOrg) throw ResourceNotFoundError();
-  
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: membershipOrg.organization
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Delete,
     OrgPermissionSubjects.Member
@@ -327,11 +299,7 @@ export const getOrganizationWorkspaces = async (req: Request, res: Response) =>
     params: { organizationId }
   } = await validateRequest(reqValidator.GetOrgWorkspacesv2, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
-
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Read,
     OrgPermissionSubjects.Workspace
@@ -368,7 +336,7 @@ export const getOrganizationWorkspaces = async (req: Request, res: Response) =>
  * @param res
  * @returns
  */
-export const createOrganization = async (req: Request, res: Response) => {
+ export const createOrganization = async (req: Request, res: Response) => {
   const {
     body: { name }
   } = await validateRequest(reqValidator.CreateOrgv2, req);
@@ -393,56 +361,27 @@ export const createOrganization = async (req: Request, res: Response) => {
 
 /**
  * Delete organization with id [organizationId]
- * @param req
- * @param res
+ * @param req 
+ * @param res 
  */
 export const deleteOrganizationById = async (req: Request, res: Response) => {
   const {
     params: { organizationId }
   } = await validateRequest(reqValidator.DeleteOrgv2, req);
-
+  
   const membershipOrg = await MembershipOrg.findOne({
     user: req.user._id,
     organization: new Types.ObjectId(organizationId),
     role: ADMIN
   });
-
+  
   if (!membershipOrg) throw UnauthorizedRequestError();
-
+  
   const organization = await deleteOrganization({
     organizationId: new Types.ObjectId(organizationId)
   });
-
+  
   return res.status(200).send({
     organization
   });
-};
-
-/**
- * Return list of identity memberships for organization with id [organizationId]
- * @param req
- * @param res 
- * @returns 
- */
- export const getOrganizationIdentityMemberships = async (req: Request, res: Response) => {
-  const {
-    params: { organizationId }
-  } = await validateRequest(reqValidator.GetOrgIdentityMembershipsV2, req);
-
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
-  ForbiddenError.from(permission).throwUnlessCan(
-    OrgPermissionActions.Read,
-    OrgPermissionSubjects.Identity
-  );
- 
-  const identityMemberships = await IdentityMembershipOrg.find({
-    organization: new Types.ObjectId(organizationId)
-  }).populate("identity customRole");
-  
-  return res.status(200).send({
-    identityMemberships
-  });
 }

backend/src/controllers/v2/secretsController.ts

@@ -39,7 +39,7 @@ import {
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError, subject } from "@casl/ability";
 
@@ -159,11 +159,7 @@ export const batchSecrets = async (req: Request, res: Response) => {
   }
   // not using service token  using auth
   if (!(req.authData.authPayload instanceof ServiceTokenData)) {
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: new Types.ObjectId(workspaceId)
-    });
-
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
     if (createSecrets.length)
       ForbiddenError.from(permission).throwUnlessCan(
         ProjectPermissionActions.Create,

backend/src/controllers/v2/serviceTokenDataController.ts

@@ -11,7 +11,7 @@ import * as reqValidator from "../../validation/serviceTokenData";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
 import { Types } from "mongoose";
@@ -75,12 +75,7 @@ export const createServiceTokenData = async (req: Request, res: Response) => {
   const {
     body: { workspaceId, permissions, tag, encryptedKey, scopes, name, expiresIn, iv }
   } = await validateRequest(reqValidator.CreateServiceTokenV2, req);
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.ServiceTokens
@@ -156,11 +151,10 @@ export const deleteServiceTokenData = async (req: Request, res: Response) => {
   let serviceTokenData = await ServiceTokenData.findById(serviceTokenDataId);
   if (!serviceTokenData) throw BadRequestError({ message: "Service token not found" });
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: serviceTokenData.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    serviceTokenData.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Delete,
     ProjectPermissionSub.ServiceTokens

backend/src/controllers/v2/tagController.ts

@@ -7,7 +7,7 @@ import { validateRequest } from "../../helpers/validation";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import * as reqValidator from "../../validation/tags";
 
@@ -17,11 +17,7 @@ export const createWorkspaceTag = async (req: Request, res: Response) => {
     params: { workspaceId }
   } = await validateRequest(reqValidator.CreateWorkspaceTagsV2, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.Tags
@@ -49,11 +45,10 @@ export const deleteWorkspaceTag = async (req: Request, res: Response) => {
     throw BadRequestError();
   }
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: tagFromDB.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    tagFromDB.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Delete,
     ProjectPermissionSub.Tags
@@ -71,12 +66,7 @@ export const getWorkspaceTags = async (req: Request, res: Response) => {
   const {
     params: { workspaceId }
   } = await validateRequest(reqValidator.GetWorkspaceTagsV2, req);
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Tags

backend/src/controllers/v2/workspaceController.ts

@@ -1,15 +1,6 @@
 import { Request, Response } from "express";
 import { Types } from "mongoose";
-import {
-  IIdentity,
-  IdentityMembership,
-  IdentityMembershipOrg,
-  Key,
-  Membership,
-  ServiceTokenData,
-  Workspace
-} from "../../models";
-import { IRole, Role } from "../../ee/models";
+import { Key, Membership, ServiceTokenData, Workspace } from "../../models";
 import {
   pullSecrets as pull,
   v2PushSecrets as push,
@@ -25,13 +16,9 @@ import * as reqValidator from "../../validation";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions,
-  getWorkspaceRolePermissions,
-  isAtLeastAsPrivilegedWorkspace
+  getUserProjectPermissions
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
-import { BadRequestError, ForbiddenRequestError, ResourceNotFoundError } from "../../utils/errors";
-import { ADMIN, CUSTOM, MEMBER, NO_ACCESS, VIEWER } from "../../variables";
 
 interface V2PushSecret {
   type: string; // personal or shared
@@ -182,11 +169,11 @@ export const getWorkspaceKey = async (req: Request, res: Response) => {
         "apiKeyAuth": []
     }]
 
-  #swagger.parameters['workspaceId'] = {
-    "description": "ID of project",
-    "required": true,
-    "type": "string"
-  } 
+	#swagger.parameters['workspaceId'] = {
+		"description": "ID of project",
+		"required": true,
+		"type": "string"
+	} 
 
     #swagger.responses[200] = {
         content: {
@@ -211,7 +198,7 @@ export const getWorkspaceKey = async (req: Request, res: Response) => {
     receiver: req.user._id
   }).populate("sender", "+publicKey");
 
-  if (!key) throw new Error(`getWorkspaceKey: Failed to find workspace key [workspaceId=${workspaceId}] [receiver=${req.user._id}]`);
+  if (!key) throw new Error("Failed to find workspace key");
 
   await EEAuditLogService.createAuditLog(
     req.authData,
@@ -256,26 +243,26 @@ export const getWorkspaceMemberships = async (req: Request, res: Response) => {
         "apiKeyAuth": []
     }]
 
-  #swagger.parameters['workspaceId'] = {
-    "description": "ID of project",
-    "required": true,
-    "type": "string"
-  } 
+	#swagger.parameters['workspaceId'] = {
+		"description": "ID of project",
+		"required": true,
+		"type": "string"
+	} 
 
     #swagger.responses[200] = {
         content: {
             "application/json": {
                 "schema": { 
                     "type": "object",
-          "properties": {
-            "memberships": {
-              "type": "array",
-              "items": {
-                $ref: "#/components/schemas/Membership" 
-              },
-              "description": "Memberships of project"
-            }
-          }
+					"properties": {
+						"memberships": {
+							"type": "array",
+							"items": {
+								$ref: "#/components/schemas/Membership" 
+							},
+							"description": "Memberships of project"
+						}
+					}
                 }
             }           
         }
@@ -285,11 +272,7 @@ export const getWorkspaceMemberships = async (req: Request, res: Response) => {
     params: { workspaceId }
   } = await validateRequest(reqValidator.GetWorkspaceMembershipsV2, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.Member
@@ -319,19 +302,19 @@ export const updateWorkspaceMembership = async (req: Request, res: Response) =>
         "apiKeyAuth": []
     }]
 
-  #swagger.parameters['workspaceId'] = {
-    "description": "ID of project",
-    "required": true,
-    "type": "string"
-  } 
+	#swagger.parameters['workspaceId'] = {
+		"description": "ID of project",
+		"required": true,
+		"type": "string"
+	} 
 
-  #swagger.parameters['membershipId'] = {
-    "description": "ID of project membership to update",
-    "required": true,
-    "type": "string"
-  } 
+	#swagger.parameters['membershipId'] = {
+		"description": "ID of project membership to update",
+		"required": true,
+		"type": "string"
+	} 
 
-  #swagger.requestBody = {
+	#swagger.requestBody = {
       "required": true,
       "content": {
         "application/json": {
@@ -352,13 +335,13 @@ export const updateWorkspaceMembership = async (req: Request, res: Response) =>
         content: {
             "application/json": {
                 "schema": { 
-          "type": "object",
-          "properties": {
-            "membership": {
-              $ref: "#/components/schemas/Membership",
-              "description": "Updated membership"
-            }
-          }
+					"type": "object",
+					"properties": {
+						"membership": {
+							$ref: "#/components/schemas/Membership",
+							"description": "Updated membership"
+						}
+					}
                 }
             }           
         }
@@ -369,11 +352,7 @@ export const updateWorkspaceMembership = async (req: Request, res: Response) =>
     body: { role }
   } = await validateRequest(reqValidator.UpdateWorkspaceMembershipsV2, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.Member
@@ -409,29 +388,29 @@ export const deleteWorkspaceMembership = async (req: Request, res: Response) =>
         "apiKeyAuth": []
     }]
 
-  #swagger.parameters['workspaceId'] = {
-    "description": "ID of project",
-    "required": true,
-    "type": "string"
-  } 
+	#swagger.parameters['workspaceId'] = {
+		"description": "ID of project",
+		"required": true,
+		"type": "string"
+	} 
 
-  #swagger.parameters['membershipId'] = {
-    "description": "ID of project membership to delete",
-    "required": true,
-    "type": "string"
-  } 
+	#swagger.parameters['membershipId'] = {
+		"description": "ID of project membership to delete",
+		"required": true,
+		"type": "string"
+	} 
 
     #swagger.responses[200] = {
         content: {
             "application/json": {
                 "schema": { 
-          "type": "object",
-          "properties": {
-            "membership": {
-              $ref: "#/components/schemas/Membership",
-              "description": "Deleted membership"
-            }
-          }
+					"type": "object",
+					"properties": {
+						"membership": {
+							$ref: "#/components/schemas/Membership",
+							"description": "Deleted membership"
+						}
+					}
                 }
             }           
         }
@@ -441,11 +420,7 @@ export const deleteWorkspaceMembership = async (req: Request, res: Response) =>
     params: { workspaceId, membershipId }
   } = await validateRequest(reqValidator.DeleteWorkspaceMembershipsV2, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Delete,
     ProjectPermissionSub.Member
@@ -477,11 +452,7 @@ export const toggleAutoCapitalization = async (req: Request, res: Response) => {
     body: { autoCapitalization }
   } = await validateRequest(reqValidator.ToggleAutoCapitalizationV2, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.Settings
@@ -504,254 +475,3 @@ export const toggleAutoCapitalization = async (req: Request, res: Response) => {
     workspace
   });
 };
-
-/**
- * Add identity with id [identityId] to workspace
- * with id [workspaceId]
- * @param req 
- * @param res 
- */
-export const addIdentityToWorkspace = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId, identityId },
-    body: {
-      role
-    }
-  } = await validateRequest(reqValidator.AddIdentityToWorkspaceV2, req);
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Create,
-    ProjectPermissionSub.Identity
-  );
-
-  let identityMembership = await IdentityMembership.findOne({
-    identity: new Types.ObjectId(identityId),
-    workspace: new Types.ObjectId(workspaceId)
-  });
-
-  if (identityMembership) throw BadRequestError({
-    message: `Identity with id ${identityId} already exists in project with id ${workspaceId}`
-  });
-
-
-  const workspace = await Workspace.findById(workspaceId);
-  if (!workspace) throw ResourceNotFoundError();
-
-  const identityMembershipOrg = await IdentityMembershipOrg.findOne({
-    identity: new Types.ObjectId(identityId),
-    organization: workspace.organization
-  });
-
-  if (!identityMembershipOrg) throw ResourceNotFoundError({
-    message: `Failed to find identity with id ${identityId}`
-  });
-
-  if (!identityMembershipOrg.organization.equals(workspace.organization)) throw BadRequestError({
-    message: "Failed to add identity to project in another organization"
-  });
-
-  const rolePermission = await getWorkspaceRolePermissions(role, workspaceId);
-  const isAsPrivilegedAsIntendedRole = isAtLeastAsPrivilegedWorkspace(permission, rolePermission);
-
-  if (!isAsPrivilegedAsIntendedRole) throw ForbiddenRequestError({
-    message: "Failed to add identity to project with more privileged role"
-  });
-
-  let customRole;
-  if (role) {
-    const isCustomRole = ![ADMIN, MEMBER, VIEWER, NO_ACCESS].includes(role);
-    if (isCustomRole) {
-      customRole = await Role.findOne({
-        slug: role,
-        isOrgRole: false,
-        workspace: new Types.ObjectId(workspaceId)
-      });
-
-      if (!customRole) throw BadRequestError({ message: "Role not found" });
-    }
-  }
-
-  identityMembership = await new IdentityMembership({
-    identity: identityMembershipOrg.identity,
-    workspace: new Types.ObjectId(workspaceId),
-    role: customRole ? CUSTOM : role,
-    customRole
-  }).save();
-
-  return res.status(200).send({
-    identityMembership
-  });
-}
-
-/**
- * Update role of identity with id [identityId] in workspace
- * with id [workspaceId] to [role]
- * @param req 
- * @param res 
- */
-export const updateIdentityWorkspaceRole = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId, identityId },
-    body: {
-      role
-    }
-  } = await validateRequest(reqValidator.UpdateIdentityWorkspaceRoleV2, req);
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Edit,
-    ProjectPermissionSub.Identity
-  );
-
-  let identityMembership = await IdentityMembership
-    .findOne({
-      identity: new Types.ObjectId(identityId),
-      workspace: new Types.ObjectId(workspaceId)
-    })
-    .populate<{
-      identity: IIdentity,
-      customRole: IRole
-    }>("identity customRole");
-
-  if (!identityMembership) throw BadRequestError({
-    message: `Identity with id ${identityId} does not exist in project with id ${workspaceId}`
-  });
-
-  const identityRolePermission = await getWorkspaceRolePermissions(
-    identityMembership?.customRole?.slug ?? identityMembership.role,
-    identityMembership.workspace.toString()
-  );
-  const isAsPrivilegedAsIdentity = isAtLeastAsPrivilegedWorkspace(permission, identityRolePermission);
-  if (!isAsPrivilegedAsIdentity) throw ForbiddenRequestError({
-    message: "Failed to update role of more privileged identity"
-  });
-
-  const rolePermission = await getWorkspaceRolePermissions(role, workspaceId);
-  const isAsPrivilegedAsIntendedRole = isAtLeastAsPrivilegedWorkspace(permission, rolePermission);
-
-  if (!isAsPrivilegedAsIntendedRole) throw ForbiddenRequestError({
-    message: "Failed to update identity to a more privileged role"
-  });
-
-  let customRole;
-  if (role) {
-    const isCustomRole = ![ADMIN, MEMBER, VIEWER, NO_ACCESS].includes(role);
-    if (isCustomRole) {
-      customRole = await Role.findOne({
-        slug: role,
-        isOrgRole: false,
-        workspace: new Types.ObjectId(workspaceId)
-      });
-
-      if (!customRole) throw BadRequestError({ message: "Role not found" });
-    }
-  }
-
-  identityMembership = await IdentityMembership.findOneAndUpdate(
-    {
-      identity: identityMembership.identity._id,
-      workspace: new Types.ObjectId(workspaceId),
-    },
-    {
-      role: customRole ? CUSTOM : role,
-      customRole
-    },
-    {
-      new: true
-    }
-  );
-
-  return res.status(200).send({
-    identityMembership
-  });
-}
-
-/**
- * Delete identity with id [identityId] to workspace
- * with id [workspaceId]
- * @param req 
- * @param res 
- */
-export const deleteIdentityFromWorkspace = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId, identityId }
-  } = await validateRequest(reqValidator.DeleteIdentityFromWorkspaceV2, req);
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Delete,
-    ProjectPermissionSub.Identity
-  );
-
-  const identityMembership = await IdentityMembership
-    .findOne({
-      identity: new Types.ObjectId(identityId),
-      workspace: new Types.ObjectId(workspaceId)
-    })
-    .populate<{
-      identity: IIdentity,
-      customRole: IRole
-    }>("identity customRole");
-
-  if (!identityMembership) throw ResourceNotFoundError({
-    message: `Identity with id ${identityId} does not exist in project with id ${workspaceId}`
-  });
-
-  const identityRolePermission = await getWorkspaceRolePermissions(
-    identityMembership?.customRole?.slug ?? identityMembership.role,
-    identityMembership.workspace.toString()
-  );
-  const isAsPrivilegedAsIdentity = isAtLeastAsPrivilegedWorkspace(permission, identityRolePermission);
-  if (!isAsPrivilegedAsIdentity) throw ForbiddenRequestError({
-    message: "Failed to remove more privileged identity from project"
-  });
-
-  await IdentityMembership.findByIdAndDelete(identityMembership._id);
-
-  return res.status(200).send({
-    identityMembership
-  });
-}
-
-/**
- * Return list of identity memberships for workspace with id [workspaceId]
- * @param req
- * @param res 
- * @returns 
- */
-export const getWorkspaceIdentityMemberships = async (req: Request, res: Response) => {
-  const {
-    params: { workspaceId }
-  } = await validateRequest(reqValidator.GetWorkspaceIdentityMembersV2, req);
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
-  ForbiddenError.from(permission).throwUnlessCan(
-    ProjectPermissionActions.Read,
-    ProjectPermissionSub.Identity
-  );
-
-  const identityMemberships = await IdentityMembership.find({
-    workspace: new Types.ObjectId(workspaceId)
-  }).populate("identity customRole");
-
-  return res.status(200).send({
-    identityMemberships
-  });
-}

backend/src/controllers/v3/secretsController.ts

@@ -3,123 +3,24 @@ import { Types } from "mongoose";
 import { EventService, SecretService } from "../../services";
 import { eventPushSecrets } from "../../events";
 import { BotService } from "../../services";
-import { containsGlobPatterns, repackageSecretToRaw } from "../../helpers/secrets";
+import { 
+  checkSecretsPermission, 
+  containsGlobPatterns,
+  repackageSecretV3ToRaw
+} from "../../helpers/secrets";
 import { encryptSymmetric128BitHexKeyUTF8 } from "../../utils/crypto";
 import { getAllImportedSecrets } from "../../services/SecretImportService";
-import { Folder, IServiceTokenData, Membership, ServiceTokenData, User } from "../../models";
+import { Folder, IServiceTokenData } from "../../models";
 import { getFolderByPath } from "../../services/FolderService";
 import { BadRequestError } from "../../utils/errors";
 import { validateRequest } from "../../helpers/validation";
 import * as reqValidator from "../../validation/secrets";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSub,
-  getAuthDataProjectPermissions
-} from "../../ee/services/ProjectRoleService";
-import { ForbiddenError, subject } from "@casl/ability";
-import { validateServiceTokenDataClientForWorkspace } from "../../validation";
-import { PERMISSION_READ_SECRETS, PERMISSION_WRITE_SECRETS } from "../../variables";
-import { ActorType } from "../../ee/models";
-import { UnauthorizedRequestError } from "../../utils/errors";
-import { AuthData } from "../../interfaces/middleware";
+import { ProjectPermissionActions } from "../../ee/services/ProjectRoleService";
 import {
   generateSecretApprovalRequest,
   getSecretPolicyOfBoard
 } from "../../ee/services/SecretApprovalService";
 import { CommitType } from "../../ee/models/secretApprovalRequest";
-import { logger } from "../../utils/logging";
-import { createReminder, deleteReminder } from "../../helpers/reminder";
-
-const checkSecretsPermission = async ({
-  authData,
-  workspaceId,
-  environment,
-  secretPath,
-  secretAction
-}: {
-  authData: AuthData;
-  workspaceId: string;
-  environment: string;
-  secretPath: string;
-  secretAction: ProjectPermissionActions; // CRUD
-}): Promise<{
-  authVerifier: (env: string, secPath: string) => boolean;
-}> => {
-  let STV2RequiredPermissions = [];
-
-  switch (secretAction) {
-    case ProjectPermissionActions.Create:
-      STV2RequiredPermissions = [PERMISSION_WRITE_SECRETS];
-      break;
-    case ProjectPermissionActions.Read:
-      STV2RequiredPermissions = [PERMISSION_READ_SECRETS];
-      break;
-    case ProjectPermissionActions.Edit:
-      STV2RequiredPermissions = [PERMISSION_WRITE_SECRETS];
-      break;
-    case ProjectPermissionActions.Delete:
-      STV2RequiredPermissions = [PERMISSION_WRITE_SECRETS];
-      break;
-  }
-
-  switch (authData.actor.type) {
-    case ActorType.USER: {
-      const { permission } = await getAuthDataProjectPermissions({
-        authData,
-        workspaceId: new Types.ObjectId(workspaceId)
-      });
-
-      ForbiddenError.from(permission).throwUnlessCan(
-        secretAction,
-        subject(ProjectPermissionSub.Secrets, { environment, secretPath })
-      );
-      return {
-        authVerifier: (env: string, secPath: string) =>
-          permission.can(
-            secretAction,
-            subject(ProjectPermissionSub.Secrets, {
-              environment: env,
-              secretPath: secPath
-            })
-          )
-      };
-    }
-    case ActorType.SERVICE: {
-      await validateServiceTokenDataClientForWorkspace({
-        serviceTokenData: authData.authPayload as IServiceTokenData,
-        workspaceId: new Types.ObjectId(workspaceId),
-        environment,
-        secretPath,
-        requiredPermissions: STV2RequiredPermissions
-      });
-      return { authVerifier: () => true };
-    }
-    case ActorType.IDENTITY: {
-      const { permission } = await getAuthDataProjectPermissions({
-        authData,
-        workspaceId: new Types.ObjectId(workspaceId)
-      });
-
-      ForbiddenError.from(permission).throwUnlessCan(
-        secretAction,
-        subject(ProjectPermissionSub.Secrets, { environment, secretPath })
-      );
-      return {
-        authVerifier: (env: string, secPath: string) =>
-          permission.can(
-            secretAction,
-            subject(ProjectPermissionSub.Secrets, {
-              environment: env,
-              secretPath: secPath
-            })
-          )
-      };
-    }
-    default: {
-      throw UnauthorizedRequestError();
-    }
-  }
-};
 
 /**
  * Return secrets for workspace with id [workspaceId] and environment
@@ -192,23 +93,17 @@ export const getSecretsRaw = async (req: Request, res: Response) => {
     query: { include_imports: includeImports }
   } = validatedData;
 
-  logger.info(
-    `getSecretsRaw: fetch raw secrets [environment=${environment}] [workspaceId=${workspaceId}] [secretPath=${secretPath}] [includeImports=${includeImports}]`
-  );
-
-  if (req.authData.authPayload instanceof ServiceTokenData) {
-    // if the service token has single scope, it will get all secrets for that scope by default
-    const serviceTokenDetails: IServiceTokenData = req?.serviceTokenData;
-    if (
-      serviceTokenDetails &&
-      serviceTokenDetails.scopes.length == 1 &&
-      !containsGlobPatterns(serviceTokenDetails.scopes[0].secretPath)
-    ) {
-      const scope = serviceTokenDetails.scopes[0];
-      secretPath = scope.secretPath;
-      environment = scope.environment;
-      workspaceId = serviceTokenDetails.workspace.toString();
-    }
+  // if the service token has single scope, it will get all secrets for that scope by default
+  const serviceTokenDetails: IServiceTokenData = req?.serviceTokenData;
+  if (
+    serviceTokenDetails &&
+    serviceTokenDetails.scopes.length == 1 &&
+    !containsGlobPatterns(serviceTokenDetails.scopes[0].secretPath)
+  ) {
+    const scope = serviceTokenDetails.scopes[0];
+    secretPath = scope.secretPath;
+    environment = scope.environment;
+    workspaceId = serviceTokenDetails.workspace.toString();
   }
 
   if (!environment || !workspaceId)
@@ -252,21 +147,21 @@ export const getSecretsRaw = async (req: Request, res: Response) => {
     );
     return res.status(200).send({
       secrets: secrets.map((secret) =>
-        repackageSecretToRaw({
+      repackageSecretV3ToRaw({
           secret,
           key
         })
       ),
       imports: importedSecrets.map((el) => ({
         ...el,
-        secrets: el.secrets.map((secret) => repackageSecretToRaw({ secret, key }))
+        secrets: el.secrets.map((secret) => repackageSecretV3ToRaw({ secret, key }))
       }))
     });
   }
 
   return res.status(200).send({
     secrets: secrets.map((secret) => {
-      const rep = repackageSecretToRaw({
+      const rep = repackageSecretV3ToRaw({
         secret,
         key
       });
@@ -352,10 +247,6 @@ export const getSecretByNameRaw = async (req: Request, res: Response) => {
     params: { secretName }
   } = await validateRequest(reqValidator.GetSecretByNameRawV3, req);
 
-  logger.info(
-    `getSecretByNameRaw: fetch raw secret by name [environment=${environment}] [workspaceId=${workspaceId}] [secretPath=${secretPath}] [type=${type}] [include_imports=${include_imports}]`
-  );
-
   await checkSecretsPermission({
     authData: req.authData,
     workspaceId,
@@ -379,7 +270,7 @@ export const getSecretByNameRaw = async (req: Request, res: Response) => {
   });
 
   return res.status(200).send({
-    secret: repackageSecretToRaw({
+    secret: repackageSecretV3ToRaw({
       secret,
       key
     })
@@ -479,10 +370,6 @@ export const createSecretRaw = async (req: Request, res: Response) => {
     }
   } = await validateRequest(reqValidator.CreateSecretRawV3, req);
 
-  logger.info(
-    `createSecretRaw: create a secret raw by name and value [environment=${environment}] [workspaceId=${workspaceId}] [secretPath=${secretPath}] [type=${type}] [skipMultilineEncoding=${skipMultilineEncoding}]`
-  );
-
   await checkSecretsPermission({
     authData: req.authData,
     workspaceId,
@@ -529,19 +416,11 @@ export const createSecretRaw = async (req: Request, res: Response) => {
     skipMultilineEncoding
   });
 
-  await EventService.handleEvent({
-    event: eventPushSecrets({
-      workspaceId: new Types.ObjectId(workspaceId),
-      environment,
-      secretPath
-    })
-  });
-
   const secretWithoutBlindIndex = secret.toObject();
   delete secretWithoutBlindIndex.secretBlindIndex;
 
   return res.status(200).send({
-    secret: repackageSecretToRaw({
+    secret: repackageSecretV3ToRaw({
       secret: secretWithoutBlindIndex,
       key
     })
@@ -628,10 +507,6 @@ export const updateSecretByNameRaw = async (req: Request, res: Response) => {
     body: { workspaceId, environment, secretValue, secretPath, type, skipMultilineEncoding }
   } = await validateRequest(reqValidator.UpdateSecretByNameRawV3, req);
 
-  logger.info(
-    `updateSecretByNameRaw: update raw secret by name [environment=${environment}] [workspaceId=${workspaceId}] [secretPath=${secretPath}] [type=${type}] [skipMultilineEncoding=${skipMultilineEncoding}]`
-  );
-
   await checkSecretsPermission({
     authData: req.authData,
     workspaceId,
@@ -662,16 +537,8 @@ export const updateSecretByNameRaw = async (req: Request, res: Response) => {
     skipMultilineEncoding
   });
 
-  await EventService.handleEvent({
-    event: eventPushSecrets({
-      workspaceId: new Types.ObjectId(workspaceId),
-      environment,
-      secretPath
-    })
-  });
-
   return res.status(200).send({
-    secret: repackageSecretToRaw({
+    secret: repackageSecretV3ToRaw({
       secret,
       key
     })
@@ -754,10 +621,6 @@ export const deleteSecretByNameRaw = async (req: Request, res: Response) => {
     body: { environment, secretPath, type, workspaceId }
   } = await validateRequest(reqValidator.DeleteSecretByNameRawV3, req);
 
-  logger.info(
-    `deleteSecretByNameRaw: delete a secret by name [environment=${environment}] [workspaceId=${workspaceId}] [secretPath=${secretPath}] [type=${type}]`
-  );
-
   await checkSecretsPermission({
     authData: req.authData,
     workspaceId,
@@ -788,7 +651,7 @@ export const deleteSecretByNameRaw = async (req: Request, res: Response) => {
   });
 
   return res.status(200).send({
-    secret: repackageSecretToRaw({
+    secret: repackageSecretV3ToRaw({
       secret,
       key
     })
@@ -811,10 +674,6 @@ export const getSecrets = async (req: Request, res: Response) => {
     query: { secretPath }
   } = validatedData;
 
-  logger.info(
-    `getSecrets: fetch encrypted secrets [environment=${environment}] [workspaceId=${workspaceId}] [includeImports=${includeImports}]`
-  );
-
   const { authVerifier: permissionCheckFn } = await checkSecretsPermission({
     authData: req.authData,
     workspaceId,
@@ -869,10 +728,6 @@ export const getSecretByName = async (req: Request, res: Response) => {
     params: { secretName }
   } = await validateRequest(reqValidator.GetSecretByNameV3, req);
 
-  logger.info(
-    `getSecretByName: get a single secret by name [environment=${environment}] [workspaceId=${workspaceId}] [include_imports=${include_imports}] [type=${type}]`
-  );
-
   await checkSecretsPermission({
     authData: req.authData,
     workspaceId,
@@ -923,11 +778,7 @@ export const createSecret = async (req: Request, res: Response) => {
     params: { secretName }
   } = await validateRequest(reqValidator.CreateSecretV3, req);
 
-  logger.info(
-    `createSecret: create an encrypted secret [environment=${environment}] [workspaceId=${workspaceId}] [skipMultilineEncoding=${skipMultilineEncoding}] [type=${type}]`
-  );
-
-  await checkSecretsPermission({
+  const { membership } = await checkSecretsPermission({
     authData: req.authData,
     workspaceId,
     environment,
@@ -935,46 +786,35 @@ export const createSecret = async (req: Request, res: Response) => {
     secretAction: ProjectPermissionActions.Create
   });
 
-  if (req.authData.authPayload instanceof User) {
-    const membership = await Membership.findOne({
-      user: req.authData.authPayload._id,
-      workspace: new Types.ObjectId(workspaceId)
-    });
-
-    if (membership && type !== "personal") {
-      const secretApprovalPolicy = await getSecretPolicyOfBoard(
+  if (membership && type !== "personal") {
+    const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
+    if (secretApprovalPolicy) {
+      const secretApprovalRequest = await generateSecretApprovalRequest({
         workspaceId,
         environment,
-        secretPath
-      );
-      if (secretApprovalPolicy) {
-        const secretApprovalRequest = await generateSecretApprovalRequest({
-          workspaceId,
-          environment,
-          secretPath,
-          policy: secretApprovalPolicy,
-          commiterMembershipId: membership._id.toString(),
-          authData: req.authData,
-          data: {
-            [CommitType.CREATE]: [
-              {
-                secretName,
-                secretValueCiphertext,
-                secretValueIV,
-                secretValueTag,
-                secretCommentIV,
-                secretCommentTag,
-                secretCommentCiphertext,
-                skipMultilineEncoding,
-                secretKeyTag,
-                secretKeyCiphertext,
-                secretKeyIV
-              }
-            ]
-          }
-        });
-        return res.send({ approval: secretApprovalRequest });
-      }
+        secretPath,
+        policy: secretApprovalPolicy,
+        commiterMembershipId: membership._id.toString(),
+        authData: req.authData,
+        data: {
+          [CommitType.CREATE]: [
+            {
+              secretName,
+              secretValueCiphertext,
+              secretValueIV,
+              secretValueTag,
+              secretCommentIV,
+              secretCommentTag,
+              secretCommentCiphertext,
+              skipMultilineEncoding,
+              secretKeyTag,
+              secretKeyCiphertext,
+              secretKeyIV
+            }
+          ]
+        }
+      });
+      return res.send({ approval: secretApprovalRequest });
     }
   }
 
@@ -998,14 +838,6 @@ export const createSecret = async (req: Request, res: Response) => {
     skipMultilineEncoding
   });
 
-  await EventService.handleEvent({
-    event: eventPushSecrets({
-      workspaceId: new Types.ObjectId(workspaceId),
-      environment,
-      secretPath
-    })
-  });
-
   const secretWithoutBlindIndex = secret.toObject();
   delete secretWithoutBlindIndex.secretBlindIndex;
 
@@ -1038,22 +870,16 @@ export const updateSecretByName = async (req: Request, res: Response) => {
       secretKeyIV,
       secretKeyTag,
       secretKeyCiphertext,
-      skipMultilineEncoding,
-      secretReminderRepeatDays,
-      secretReminderNote
+      skipMultilineEncoding
     },
     params: { secretName }
   } = await validateRequest(reqValidator.UpdateSecretByNameV3, req);
 
-  logger.info(
-    `updateSecretByName: update a encrypted secret by name [environment=${environment}] [workspaceId=${workspaceId}] [skipMultilineEncoding=${skipMultilineEncoding}] [type=${type}]`
-  );
-
   if (newSecretName && (!secretKeyIV || !secretKeyTag || !secretKeyCiphertext)) {
     throw BadRequestError({ message: "Missing encrypted key" });
   }
 
-  await checkSecretsPermission({
+  const { membership } = await checkSecretsPermission({
     authData: req.authData,
     workspaceId,
     environment,
@@ -1061,83 +887,37 @@ export const updateSecretByName = async (req: Request, res: Response) => {
     secretAction: ProjectPermissionActions.Edit
   });
 
-  if (req.authData.authPayload instanceof User) {
-    const membership = await Membership.findOne({
-      user: req.authData.authPayload._id,
-      workspace: new Types.ObjectId(workspaceId)
-    });
-
-    if (membership && type !== "personal") {
-      const secretApprovalPolicy = await getSecretPolicyOfBoard(
+  if (membership && type !== "personal") {
+    const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
+    if (secretApprovalPolicy) {
+      const secretApprovalRequest = await generateSecretApprovalRequest({
         workspaceId,
         environment,
-        secretPath
-      );
-      if (secretApprovalPolicy) {
-        const secretApprovalRequest = await generateSecretApprovalRequest({
-          workspaceId,
-          environment,
-          secretPath,
-          policy: secretApprovalPolicy,
-          commiterMembershipId: membership._id.toString(),
-          authData: req.authData,
-          data: {
-            [CommitType.UPDATE]: [
-              {
-                secretName,
-                newSecretName,
-                secretValueCiphertext,
-                secretValueIV,
-                secretValueTag,
-                tags,
-                secretCommentIV,
-                secretCommentTag,
-                secretCommentCiphertext,
-                skipMultilineEncoding,
-                secretKeyTag,
-                secretKeyCiphertext,
-                secretKeyIV
-              }
-            ]
-          }
-        });
-        return res.send({ approval: secretApprovalRequest });
-      }
-    }
-  }
-
-  if (type !== "personal") {
-    const existingSecret = await SecretService.getSecret({
-      secretName,
-      workspaceId: new Types.ObjectId(workspaceId),
-      environment,
-      type,
-      secretPath,
-      authData: req.authData
-    });
-
-    if (secretReminderRepeatDays !== undefined) {
-      if (
-        (secretReminderRepeatDays &&
-          existingSecret.secretReminderRepeatDays !== secretReminderRepeatDays) ||
-        (secretReminderNote && existingSecret.secretReminderNote !== secretReminderNote)
-      ) {
-        await createReminder(existingSecret, {
-          _id: existingSecret._id,
-          secretReminderRepeatDays,
-          secretReminderNote,
-          workspace: existingSecret.workspace
-        });
-      } else if (
-        secretReminderRepeatDays === null &&
-        secretReminderNote === null &&
-        existingSecret.secretReminderRepeatDays
-      ) {
-        await deleteReminder({
-          _id: existingSecret._id,
-          secretReminderRepeatDays: existingSecret.secretReminderRepeatDays
-        });
-      }
+        secretPath,
+        policy: secretApprovalPolicy,
+        commiterMembershipId: membership._id.toString(),
+        authData: req.authData,
+        data: {
+          [CommitType.UPDATE]: [
+            {
+              secretName,
+              newSecretName,
+              secretValueCiphertext,
+              secretValueIV,
+              secretValueTag,
+              tags,
+              secretCommentIV,
+              secretCommentTag,
+              secretCommentCiphertext,
+              skipMultilineEncoding,
+              secretKeyTag,
+              secretKeyCiphertext,
+              secretKeyIV
+            }
+          ]
+        }
+      });
+      return res.send({ approval: secretApprovalRequest });
     }
   }
 
@@ -1151,8 +931,6 @@ export const updateSecretByName = async (req: Request, res: Response) => {
     newSecretName,
     secretValueCiphertext,
     secretValueIV,
-    secretReminderRepeatDays,
-    secretReminderNote,
     secretValueTag,
     secretPath,
     tags,
@@ -1165,14 +943,6 @@ export const updateSecretByName = async (req: Request, res: Response) => {
     secretKeyIV
   });
 
-  await EventService.handleEvent({
-    event: eventPushSecrets({
-      workspaceId: new Types.ObjectId(workspaceId),
-      environment,
-      secretPath
-    })
-  });
-
   return res.status(200).send({
     secret
   });
@@ -1189,11 +959,7 @@ export const deleteSecretByName = async (req: Request, res: Response) => {
     params: { secretName }
   } = await validateRequest(reqValidator.DeleteSecretByNameV3, req);
 
-  logger.info(
-    `deleteSecretByName: delete a encrypted secret by name [environment=${environment}] [workspaceId=${workspaceId}] [type=${type}]`
-  );
-
-  await checkSecretsPermission({
+  const { membership } = await checkSecretsPermission({
     authData: req.authData,
     workspaceId,
     environment,
@@ -1201,36 +967,25 @@ export const deleteSecretByName = async (req: Request, res: Response) => {
     secretAction: ProjectPermissionActions.Delete
   });
 
-  if (req.authData.authPayload instanceof User) {
-    const membership = await Membership.findOne({
-      user: req.authData.authPayload._id,
-      workspace: new Types.ObjectId(workspaceId)
-    });
-
-    if (membership && type !== "personal") {
-      const secretApprovalPolicy = await getSecretPolicyOfBoard(
+  if (membership && type !== "personal") {
+    const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
+    if (secretApprovalPolicy) {
+      const secretApprovalRequest = await generateSecretApprovalRequest({
         workspaceId,
         environment,
-        secretPath
-      );
-      if (secretApprovalPolicy) {
-        const secretApprovalRequest = await generateSecretApprovalRequest({
-          workspaceId,
-          environment,
-          secretPath,
-          authData: req.authData,
-          policy: secretApprovalPolicy,
-          commiterMembershipId: membership._id.toString(),
-          data: {
-            [CommitType.DELETE]: [
-              {
-                secretName
-              }
-            ]
-          }
-        });
-        return res.send({ approval: secretApprovalRequest });
-      }
+        secretPath,
+        authData: req.authData,
+        policy: secretApprovalPolicy,
+        commiterMembershipId: membership._id.toString(),
+        data: {
+          [CommitType.DELETE]: [
+            {
+              secretName
+            }
+          ]
+        }
+      });
+      return res.send({ approval: secretApprovalRequest });
     }
   }
 
@@ -1244,14 +999,6 @@ export const deleteSecretByName = async (req: Request, res: Response) => {
     secretPath
   });
 
-  await EventService.handleEvent({
-    event: eventPushSecrets({
-      workspaceId: new Types.ObjectId(workspaceId),
-      environment,
-      secretPath
-    })
-  });
-
   return res.status(200).send({
     secret
   });
@@ -1262,11 +1009,7 @@ export const createSecretByNameBatch = async (req: Request, res: Response) => {
     body: { secrets, secretPath, environment, workspaceId }
   } = await validateRequest(reqValidator.CreateSecretByNameBatchV3, req);
 
-  logger.info(
-    `createSecretByNameBatch: create a list of secrets by their names [environment=${environment}] [workspaceId=${workspaceId}] [secretsLength=${secrets?.length}]`
-  );
-
-  await checkSecretsPermission({
+  const { membership } = await checkSecretsPermission({
     authData: req.authData,
     workspaceId,
     environment,
@@ -1274,32 +1017,21 @@ export const createSecretByNameBatch = async (req: Request, res: Response) => {
     secretAction: ProjectPermissionActions.Create
   });
 
-  if (req.authData.authPayload instanceof User) {
-    const membership = await Membership.findOne({
-      user: req.authData.authPayload._id,
-      workspace: new Types.ObjectId(workspaceId)
-    });
-
-    if (membership) {
-      const secretApprovalPolicy = await getSecretPolicyOfBoard(
+  if (membership) {
+    const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
+    if (secretApprovalPolicy) {
+      const secretApprovalRequest = await generateSecretApprovalRequest({
         workspaceId,
         environment,
-        secretPath
-      );
-      if (secretApprovalPolicy) {
-        const secretApprovalRequest = await generateSecretApprovalRequest({
-          workspaceId,
-          environment,
-          secretPath,
-          authData: req.authData,
-          policy: secretApprovalPolicy,
-          commiterMembershipId: membership._id.toString(),
-          data: {
-            [CommitType.CREATE]: secrets.filter(({ type }) => type === "shared")
-          }
-        });
-        return res.send({ approval: secretApprovalRequest });
-      }
+        secretPath,
+        authData: req.authData,
+        policy: secretApprovalPolicy,
+        commiterMembershipId: membership._id.toString(),
+        data: {
+          [CommitType.CREATE]: secrets.filter(({ type }) => type === "shared")
+        }
+      });
+      return res.send({ approval: secretApprovalRequest });
     }
   }
 
@@ -1311,14 +1043,6 @@ export const createSecretByNameBatch = async (req: Request, res: Response) => {
     authData: req.authData
   });
 
-  await EventService.handleEvent({
-    event: eventPushSecrets({
-      workspaceId: new Types.ObjectId(workspaceId),
-      environment,
-      secretPath
-    })
-  });
-
   return res.status(200).send({
     secrets: createdSecrets
   });
@@ -1329,11 +1053,7 @@ export const updateSecretByNameBatch = async (req: Request, res: Response) => {
     body: { secrets, secretPath, environment, workspaceId }
   } = await validateRequest(reqValidator.UpdateSecretByNameBatchV3, req);
 
-  logger.info(
-    `updateSecretByNameBatch: update a list of secrets by their names [environment=${environment}] [workspaceId=${workspaceId}] [secretsLength=${secrets?.length}]`
-  );
-
-  await checkSecretsPermission({
+  const { membership } = await checkSecretsPermission({
     authData: req.authData,
     workspaceId,
     environment,
@@ -1341,32 +1061,21 @@ export const updateSecretByNameBatch = async (req: Request, res: Response) => {
     secretAction: ProjectPermissionActions.Edit
   });
 
-  if (req.authData.authPayload instanceof User) {
-    const membership = await Membership.findOne({
-      user: req.authData.authPayload._id,
-      workspace: new Types.ObjectId(workspaceId)
-    });
-
-    if (membership) {
-      const secretApprovalPolicy = await getSecretPolicyOfBoard(
+  if (membership) {
+    const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
+    if (secretApprovalPolicy) {
+      const secretApprovalRequest = await generateSecretApprovalRequest({
         workspaceId,
         environment,
-        secretPath
-      );
-      if (secretApprovalPolicy) {
-        const secretApprovalRequest = await generateSecretApprovalRequest({
-          workspaceId,
-          environment,
-          secretPath,
-          policy: secretApprovalPolicy,
-          commiterMembershipId: membership._id.toString(),
-          data: {
-            [CommitType.UPDATE]: secrets.filter(({ type }) => type === "shared")
-          },
-          authData: req.authData
-        });
-        return res.send({ approval: secretApprovalRequest });
-      }
+        secretPath,
+        policy: secretApprovalPolicy,
+        commiterMembershipId: membership._id.toString(),
+        data: {
+          [CommitType.UPDATE]: secrets.filter(({ type }) => type === "shared")
+        },
+        authData: req.authData
+      });
+      return res.send({ approval: secretApprovalRequest });
     }
   }
 
@@ -1378,14 +1087,6 @@ export const updateSecretByNameBatch = async (req: Request, res: Response) => {
     authData: req.authData
   });
 
-  await EventService.handleEvent({
-    event: eventPushSecrets({
-      workspaceId: new Types.ObjectId(workspaceId),
-      environment,
-      secretPath
-    })
-  });
-
   return res.status(200).send({
     secrets: updatedSecrets
   });
@@ -1396,11 +1097,7 @@ export const deleteSecretByNameBatch = async (req: Request, res: Response) => {
     body: { secrets, secretPath, environment, workspaceId }
   } = await validateRequest(reqValidator.DeleteSecretByNameBatchV3, req);
 
-  logger.info(
-    `deleteSecretByNameBatch: delete a list of secrets by their names [environment=${environment}] [workspaceId=${workspaceId}] [secretsLength=${secrets?.length}]`
-  );
-
-  await checkSecretsPermission({
+  const { membership } = await checkSecretsPermission({
     authData: req.authData,
     workspaceId,
     environment,
@@ -1408,32 +1105,21 @@ export const deleteSecretByNameBatch = async (req: Request, res: Response) => {
     secretAction: ProjectPermissionActions.Delete
   });
 
-  if (req.authData.authPayload instanceof User) {
-    const membership = await Membership.findOne({
-      user: req.authData.authPayload._id,
-      workspace: new Types.ObjectId(workspaceId)
-    });
-
-    if (membership) {
-      const secretApprovalPolicy = await getSecretPolicyOfBoard(
+  if (membership) {
+    const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
+    if (secretApprovalPolicy) {
+      const secretApprovalRequest = await generateSecretApprovalRequest({
         workspaceId,
         environment,
-        secretPath
-      );
-      if (secretApprovalPolicy) {
-        const secretApprovalRequest = await generateSecretApprovalRequest({
-          workspaceId,
-          environment,
-          secretPath,
-          policy: secretApprovalPolicy,
-          commiterMembershipId: membership._id.toString(),
-          data: {
-            [CommitType.DELETE]: secrets.filter(({ type }) => type === "shared")
-          },
-          authData: req.authData
-        });
-        return res.send({ approval: secretApprovalRequest });
-      }
+        secretPath,
+        policy: secretApprovalPolicy,
+        commiterMembershipId: membership._id.toString(),
+        data: {
+          [CommitType.DELETE]: secrets.filter(({ type }) => type === "shared")
+        },
+        authData: req.authData
+      });
+      return res.send({ approval: secretApprovalRequest });
     }
   }
 
@@ -1445,15 +1131,7 @@ export const deleteSecretByNameBatch = async (req: Request, res: Response) => {
     authData: req.authData
   });
 
-  await EventService.handleEvent({
-    event: eventPushSecrets({
-      workspaceId: new Types.ObjectId(workspaceId),
-      environment,
-      secretPath
-    })
-  });
-
   return res.status(200).send({
     secrets: deletedSecrets
   });
-};
+};

backend/src/controllers/v3/workspacesController.ts

@@ -1,9 +1,9 @@
 import { Request, Response } from "express";
 import { Types } from "mongoose";
 import { validateRequest } from "../../helpers/validation";
-import { Membership, Secret, User } from "../../models";
+import { Secret, ServiceTokenDataV3 } from "../../models";
 import { SecretService } from "../../services";
-import { getAuthDataProjectPermissions } from "../../ee/services/ProjectRoleService";
+import { getUserProjectPermissions } from "../../ee/services/ProjectRoleService";
 import { UnauthorizedRequestError } from "../../utils/errors";
 import * as reqValidator from "../../validation/workspace";
 
@@ -19,22 +19,9 @@ export const getWorkspaceBlindIndexStatus = async (req: Request, res: Response)
     params: { workspaceId }
   } = await validateRequest(reqValidator.GetWorkspaceBlinkIndexStatusV3, req);
 
-  await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
-  if (req.authData.authPayload instanceof User) {
-    const membership = await Membership.findOne({
-      user: req.authData.authPayload._id,
-      workspace: new Types.ObjectId(workspaceId)
-    });
-    
-    if (!membership) throw UnauthorizedRequestError();
-
-    if (membership.role !== "admin")
-      throw UnauthorizedRequestError({ message: "User must be an admin" });
-  }
+  const { membership } = await getUserProjectPermissions(req.user._id, workspaceId);
+  if (membership.role !== "admin")
+    throw UnauthorizedRequestError({ message: "User must be an admin" });
 
   const secretsWithoutBlindIndex = await Secret.countDocuments({
     workspace: new Types.ObjectId(workspaceId),
@@ -54,22 +41,9 @@ export const getWorkspaceSecrets = async (req: Request, res: Response) => {
     params: { workspaceId }
   } = await validateRequest(reqValidator.GetWorkspaceSecretsV3, req);
 
-  await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
-  if (req.authData.authPayload instanceof User) {
-    const membership = await Membership.findOne({
-      user: req.authData.authPayload._id,
-      workspace: new Types.ObjectId(workspaceId)
-    });
-    
-    if (!membership) throw UnauthorizedRequestError();
-
-    if (membership.role !== "admin")
-      throw UnauthorizedRequestError({ message: "User must be an admin" });
-  }
+  const { membership } = await getUserProjectPermissions(req.user._id, workspaceId);
+  if (membership.role !== "admin")
+    throw UnauthorizedRequestError({ message: "User must be an admin" });
 
   const secrets = await Secret.find({
     workspace: new Types.ObjectId(workspaceId)
@@ -91,22 +65,9 @@ export const nameWorkspaceSecrets = async (req: Request, res: Response) => {
     body: { secretsToUpdate }
   } = await validateRequest(reqValidator.NameWorkspaceSecretsV3, req);
 
-  await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
-  if (req.authData.authPayload instanceof User) {
-    const membership = await Membership.findOne({
-      user: req.authData.authPayload._id,
-      workspace: new Types.ObjectId(workspaceId)
-    });
-    
-    if (!membership) throw UnauthorizedRequestError();
-
-    if (membership.role !== "admin")
-      throw UnauthorizedRequestError({ message: "User must be an admin" });
-  }
+  const { membership } = await getUserProjectPermissions(req.user._id, workspaceId);
+  if (membership.role !== "admin")
+    throw UnauthorizedRequestError({ message: "User must be an admin" });
 
   // get secret blind index salt
   const salt = await SecretService.getSecretBlindIndexSalt({
@@ -140,3 +101,17 @@ export const nameWorkspaceSecrets = async (req: Request, res: Response) => {
     message: "Successfully named workspace secrets"
   });
 };
+
+export const getWorkspaceServiceTokenData = async (req: Request, res: Response) => {
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetWorkspaceServiceTokenDataV3, req);
+  
+  const serviceTokenData = await ServiceTokenDataV3.find({
+    workspace: new Types.ObjectId(workspaceId)
+  });
+  
+  return res.status(200).send({
+    serviceTokenData
+  });
+}

backend/src/controllers/v4/environmentsController.ts

@@ -0,0 +1,42 @@
+import { Request, Response } from "express";
+// import { validateRequest } from "../../helpers/validation";
+// import * as reqValidator from "../../validation/environments";
+
+/**
+ * Create environment with name [environmentName] and slug [environmentSlug]
+ * in project with id [projectId]
+ * @param req 
+ * @param res 
+ */
+export const createEnvironment = async (req: Request, res: Response) => {
+    // TODO
+}
+
+/**
+ * Return list of environments in project with id [projectId]
+ * @param req 
+ * @param res 
+ */
+export const getEnvironments = async (req: Request, res: Response) => {
+    // TODO
+}
+
+/**
+ * Delete environment with name [environmentName] and slug [environmentSlug]
+ * in project with id [projectId]
+ * @param req 
+ * @param res 
+ */
+export const updateEnvironment = async (req: Request, res: Response) => {
+    // TODO
+}
+
+/**
+ * Delete environment with name [environmentName] and slug [environmentSlug]
+ * in project with id [projectId]
+ * @param req 
+ * @param res 
+ */
+export const deleteEnvironment = async (req: Request, res: Response) => {
+    // TODO
+}

backend/src/controllers/v4/foldersController.ts

@@ -0,0 +1,87 @@
+import { Request, Response } from "express";
+// import { Types } from "mongoose";
+// import { FolderVersion } from "../../ee/models";
+// import { Folder } from "../../models";
+// import { appendFolder } from "../../services/FolderService";
+// import { validateRequest } from "../../helpers/validation";
+// import * as reqValidator from "../../validation/folders";
+// import { ResourceNotFoundError } from "../../utils/errors";
+
+/**
+ * 
+ * Return list of folders in project with id [projectId]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const getFolders = async (req: Request, res: Response) => {
+    // TODO
+}
+
+/**
+ * 
+ * Create folder with name [folderName] in project with id [projectId]
+ * under path [path]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const createFolder = async (req: Request, res: Response) => {
+    // TODO
+    
+    // const {
+    //     body: {
+    //         folderName,
+    //         projectId,
+    //         environmentSlug,
+    //         path
+    //     }
+    // } = await validateRequest(reqValidator.CreateFolderV2, req);
+    
+    // // get folder
+
+    // const folders = await Folder.findOne({
+    //     workspace: new Types.ObjectId(projectId),
+    //     environment: environmentSlug
+    // });
+    
+    // if (!folders) throw ResourceNotFoundError();
+
+    // const { parent, child: folder, hasCreated } = appendFolder(folders.nodes, { folderName, directory: path });
+
+    // if (!hasCreated) return res.json({ folder });
+
+    // await Folder.findByIdAndUpdate(folders._id, folders);
+    
+    // await new FolderVersion({
+    //     project: new Types.ObjectId(projectId),
+    //     nodes: parent
+    // }).save();
+
+    // return res.status(200).send({
+    //     folder
+    // });
+}
+
+/**
+ * 
+ * Update folder with name [folderName] in project with id [projectId]
+ * under path [path]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const updateFolder = async (req: Request, res: Response) => {
+    // TODO
+}
+
+/**
+ * Delete folder with name [folderName] in project with id [projectId]
+ * under path [path]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const deleteFolder = async (req: Request, res: Response) => {
+    // TODO
+}

backend/src/controllers/v4/index.ts

@@ -0,0 +1,9 @@
+import * as secretsController from "./secretsController";
+import * as environmentsController from "./environmentsController";
+import * as foldersController from "./foldersController";
+
+export {
+    secretsController,
+    environmentsController,
+    foldersController
+}

backend/src/controllers/v4/secretsController.ts

@@ -0,0 +1,353 @@
+import { Request, Response } from "express";
+import { Types } from "mongoose";
+import { BotService, SecretService } from "../../services";
+import { getAllImportedSecrets } from "../../services/SecretImportService";
+import { encryptSymmetric128BitHexKeyUTF8 } from "../../utils/crypto";
+import { ProjectPermissionActions } from "../../ee/services/ProjectRoleService";
+import { checkSecretsPermission, packageSecretV4 } from "../../helpers";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/secrets";
+import { getFolderIdFromServiceToken } from "../../services/FolderService";
+
+/**
+ * Get secrets in project with id
+ * [projectId]under path [path]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const getSecrets = async (req: Request, res: Response) => {
+    const {
+        query: {
+            projectId,
+            environmentSlug,
+            path,
+            includeImports
+        }
+    } = await validateRequest(reqValidator.GetSecretsV4, req);
+
+    await checkSecretsPermission({
+        authData: req.authData,
+        workspaceId: projectId,
+        environment: environmentSlug,
+        secretPath: path,
+        secretAction: ProjectPermissionActions.Read
+    });
+
+    const secrets = await SecretService.getSecrets({
+        workspaceId: new Types.ObjectId(projectId),
+        environment: environmentSlug,
+        secretPath: path,
+        authData: req.authData
+    });
+
+    const key = await BotService.getWorkspaceKeyWithBot({
+        workspaceId: new Types.ObjectId(projectId)
+    });
+
+    let packagedSecrets = secrets.map((secret) => packageSecretV4({
+        secret,
+        key
+    }));
+    
+    const folderId = await getFolderIdFromServiceToken(projectId, environmentSlug, path);
+    
+    if (includeImports) {
+        const importGroups = await getAllImportedSecrets(
+            projectId,
+            environmentSlug,
+            folderId,
+            () => true
+        );
+        
+        importGroups.forEach((importGroup) => {
+            packagedSecrets = packagedSecrets.concat(
+                importGroup.secrets.map((secret) => packageSecretV4({ secret, key }))
+            );
+        });
+    }
+
+    return res.status(200).send({
+        secrets: packagedSecrets
+    });
+}
+
+/**
+ * Get secret named [secretName] in project with id
+ * [projectId]under path [path]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const getSecret = async (req: Request, res: Response) => {
+    const {
+        params: {
+            secretName
+        },
+        query: {
+            projectId,
+            environmentSlug,
+            path,
+            type,
+            includeImports
+        }
+    } = await validateRequest(reqValidator.GetSecretV4, req);
+
+    await checkSecretsPermission({
+        authData: req.authData,
+        workspaceId: projectId,
+        environment: environmentSlug,
+        secretPath: path,
+        secretAction: ProjectPermissionActions.Read
+    });
+    
+    const secret = await SecretService.getSecret({
+        secretName,
+        workspaceId: new Types.ObjectId(projectId),
+        environment: environmentSlug,
+        type,
+        secretPath: path,
+        authData: req.authData,
+        include_imports: includeImports
+    });
+
+    const key = await BotService.getWorkspaceKeyWithBot({
+        workspaceId: new Types.ObjectId(projectId)
+    });
+    
+    const packagedSecret = packageSecretV4({
+        secret,
+        key
+    });
+
+    return res.status(200).send({
+        secret: packagedSecret
+    });
+}
+
+/**
+ * Create secret named [secretName] in project with id
+ * [projectId]under path [path]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const createSecret = async (req: Request, res: Response) =>{
+    const {
+        params: {
+            secretName
+        },
+        body: {
+            projectId,
+            environmentSlug,
+            path,
+            type,
+            secretValue,
+            secretComment,
+            skipMultilineEncoding
+        }
+    } = await validateRequest(reqValidator.CreateSecretV4, req);
+    
+    await checkSecretsPermission({
+        authData: req.authData,
+        workspaceId: projectId,
+        environment: environmentSlug,
+        secretPath: path,
+        secretAction: ProjectPermissionActions.Create
+    });
+
+    const key = await BotService.getWorkspaceKeyWithBot({
+        workspaceId: new Types.ObjectId(projectId)
+    });
+
+    const { 
+        ciphertext: secretKeyCiphertext,
+        iv: secretKeyIV, 
+        tag: secretKeyTag
+    } = encryptSymmetric128BitHexKeyUTF8({
+        plaintext: secretName,
+        key
+    });
+
+    const { 
+        ciphertext: secretValueCiphertext,
+        iv: secretValueIV,
+        tag: secretValueTag
+    } = encryptSymmetric128BitHexKeyUTF8({
+        plaintext: secretValue,
+        key
+    });
+
+    const { 
+        ciphertext: secretCommentCiphertext,
+        iv: secretCommentIV,
+        tag: secretCommentTag
+    } = encryptSymmetric128BitHexKeyUTF8({
+        plaintext: secretComment,
+        key
+    });
+
+    const secret = await SecretService.createSecret({
+        secretName,
+        workspaceId: new Types.ObjectId(projectId),
+        environment: environmentSlug,
+        type,
+        authData: req.authData,
+        secretKeyCiphertext,
+        secretKeyIV,
+        secretKeyTag,
+        secretValueCiphertext,
+        secretValueIV,
+        secretValueTag,
+        secretPath: path,
+        secretCommentCiphertext,
+        secretCommentIV,
+        secretCommentTag,
+        skipMultilineEncoding
+    });
+
+    const packagedSecret = packageSecretV4({
+        secret,
+        key
+    });
+
+    return res.status(200).send({
+        secret: packagedSecret
+    });
+}
+
+/**
+ * Create secret named [secretName] in project with id
+ * [projectId]under path [path]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const updateSecret = async (req: Request, res: Response) => {
+    const {
+        params: {
+            secretName
+        },
+        body: {
+            projectId,
+            environmentSlug,
+            path,
+            type,
+            secretValue,
+            secretComment,
+            skipMultilineEncoding
+        }
+    } = await validateRequest(reqValidator.UpdateSecretV4, req);
+
+    await checkSecretsPermission({
+        authData: req.authData,
+        workspaceId: projectId,
+        environment: environmentSlug,
+        secretPath: path,
+        secretAction: ProjectPermissionActions.Edit
+    });
+
+    const key = await BotService.getWorkspaceKeyWithBot({
+        workspaceId: new Types.ObjectId(projectId)
+    });
+    
+    let secretValueCiphertext, secretValueIV, secretValueTag;
+    if (secretValue) {
+        const { ciphertext, iv, tag } = encryptSymmetric128BitHexKeyUTF8({
+            plaintext: secretValue,
+            key
+        });
+
+        secretValueCiphertext = ciphertext;
+        secretValueIV = iv;
+        secretValueTag = tag;
+    }
+
+    let secretCommentCiphertext, secretCommentIV, secretCommentTag;
+    if (secretComment) {
+        const { ciphertext, iv, tag } = encryptSymmetric128BitHexKeyUTF8({
+            plaintext: secretComment,
+            key
+        });
+
+        secretCommentCiphertext = ciphertext;
+        secretCommentIV = iv;
+        secretCommentTag = tag;
+    }
+
+    const secret = await SecretService.updateSecret({
+        secretName,
+        workspaceId: new Types.ObjectId(projectId),
+        environment: environmentSlug,
+        type,
+        authData: req.authData,
+        secretValueCiphertext,
+        secretValueIV,
+        secretValueTag,
+        secretCommentCiphertext,
+        secretCommentIV,
+        secretCommentTag,
+        secretPath: path,
+        skipMultilineEncoding
+    });
+
+    const packagedSecret = packageSecretV4({
+        secret,
+        key
+    });
+
+    return res.status(200).send({
+        secret: packagedSecret
+    });
+}
+
+/**
+ * Delete secret named [secretName] in project with id
+ * [projectId]under path [path]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const deleteSecret = async (req: Request, res: Response) => {
+    const {
+        params: {
+            secretName
+        },
+        body: {
+            projectId,
+            environmentSlug,
+            path,
+            type
+        }
+    } = await validateRequest(reqValidator.DeleteSecretV4, req);
+
+    await checkSecretsPermission({
+        authData: req.authData,
+        workspaceId: projectId,
+        environment: environmentSlug,
+        secretPath: path,
+        secretAction: ProjectPermissionActions.Delete
+    });
+    
+    const key = await BotService.getWorkspaceKeyWithBot({
+        workspaceId: new Types.ObjectId(projectId)
+    });
+
+    const { secret } = await SecretService.deleteSecret({
+        secretName,
+        workspaceId: new Types.ObjectId(projectId),
+        environment: environmentSlug,
+        type,
+        authData: req.authData,
+        secretPath: path
+    });
+    
+    const packagedSecret = packageSecretV4({
+        secret,
+        key
+    });
+
+    return res.status(200).send({
+        secret: packagedSecret
+    });
+}

backend/src/ee/controllers/v1/identitiesController.ts

@@ -1,324 +0,0 @@
-import { Request, Response } from "express";
-import { Types } from "mongoose";
-import {
-    IIdentity,
-    Identity,
-    IdentityAccessToken,
-    IdentityMembership,
-    IdentityMembershipOrg,
-    IdentityUniversalAuth,
-    IdentityUniversalAuthClientSecret,
-    Organization
-} from "../../../models";
-import {
-    EventType,
-    IRole,
-    Role
-} from "../../models";
-import { validateRequest } from "../../../helpers/validation";
-import * as reqValidator from "../../../validation/identities";
-import {
-    getAuthDataOrgPermissions,
-    getOrgRolePermissions,
-    isAtLeastAsPrivilegedOrg
-} from "../../services/RoleService";
-import {
-    BadRequestError,
-    ForbiddenRequestError,
-    ResourceNotFoundError,
-} from "../../../utils/errors";
-import { ADMIN, CUSTOM, MEMBER, NO_ACCESS } from "../../../variables";
-import {
-    OrgPermissionActions,
-    OrgPermissionSubjects
-} from "../../services/RoleService";
-import { EEAuditLogService } from "../../services";
-import { ForbiddenError } from "@casl/ability";
-
-/**
- * Create identity
- * @param req 
- * @param res 
- * @returns 
- */
-export const createIdentity = async (req: Request, res: Response) => {
-    const {
-        body: {
-            name,
-            organizationId,
-            role
-        }
-    } = await validateRequest(reqValidator.CreateIdentityV1, req);
-
-    const { permission } = await getAuthDataOrgPermissions({
-        authData: req.authData,
-        organizationId: new Types.ObjectId(organizationId)
-    });
-
-    ForbiddenError.from(permission).throwUnlessCan(
-        OrgPermissionActions.Create,
-        OrgPermissionSubjects.Identity
-    );
-
-    const rolePermission = await getOrgRolePermissions(role, organizationId);
-    const hasRequiredPrivileges = isAtLeastAsPrivilegedOrg(permission, rolePermission);
-
-    if (!hasRequiredPrivileges) throw ForbiddenRequestError({
-        message: "Failed to create a more privileged identity"
-    });
-
-    const organization = await Organization.findById(organizationId);
-    if (!organization) throw BadRequestError({ message: `Organization with id ${organizationId} not found` });
-
-    const isCustomRole = ![ADMIN, MEMBER, NO_ACCESS].includes(role);
-
-    let customRole;
-    if (isCustomRole) {
-        customRole = await Role.findOne({
-            slug: role,
-            isOrgRole: true,
-            organization: new Types.ObjectId(organizationId)
-        });
-
-        if (!customRole) throw BadRequestError({ message: "Role not found" });
-    }
-    
-    const identity = await new Identity({
-        name
-    }).save();
-
-    await new IdentityMembershipOrg({
-        identity: identity._id,
-        organization: new Types.ObjectId(organizationId),
-        role: isCustomRole ? CUSTOM : role,
-        customRole
-    }).save();
-
-    await EEAuditLogService.createAuditLog(
-        req.authData,
-        {
-            type: EventType.CREATE_IDENTITY,
-            metadata: {
-                identityId: identity._id.toString(),
-                name
-            }
-        },
-        {
-            organizationId: new Types.ObjectId(organizationId)
-        }
-    );
-
-    return res.status(200).send({
-        identity
-    });
-}
-
-/**
- * Update identity with id [identityId]
- * @param req 
- * @param res 
- * @returns 
- */
- export const updateIdentity = async (req: Request, res: Response) => {
-    const {
-        params: { identityId  },
-        body: {
-            name,
-            role
-        }
-    } = await validateRequest(reqValidator.UpdateIdentityV1, req);
-
-    const identityMembershipOrg = await IdentityMembershipOrg
-        .findOne({
-            identity: new Types.ObjectId(identityId)
-        })
-        .populate<{
-            identity: IIdentity,
-            customRole: IRole
-        }>("identity customRole");
-
-    if (!identityMembershipOrg) throw ResourceNotFoundError({
-        message: `Failed to find identity with id ${identityId}`
-    });
-
-    const { permission } = await getAuthDataOrgPermissions({
-        authData: req.authData,
-        organizationId: identityMembershipOrg.organization
-    });
-    ForbiddenError.from(permission).throwUnlessCan(
-        OrgPermissionActions.Edit,
-        OrgPermissionSubjects.Identity
-    );
-
-    const identityRolePermission = await getOrgRolePermissions(
-        identityMembershipOrg?.customRole?.slug ?? identityMembershipOrg.role,
-        identityMembershipOrg.organization.toString()
-    );
-    const hasRequiredPrivileges = isAtLeastAsPrivilegedOrg(permission, identityRolePermission);
-    if (!hasRequiredPrivileges) throw ForbiddenRequestError({
-        message: "Failed to update more privileged identity"
-    });
-
-    if (role) {
-        const rolePermission = await getOrgRolePermissions(role, identityMembershipOrg.organization.toString());
-        const hasRequiredPrivileges = isAtLeastAsPrivilegedOrg(permission, rolePermission);
-
-        if (!hasRequiredPrivileges) throw ForbiddenRequestError({
-            message: "Failed to update identity to a more privileged role"
-        });
-    }
-
-    let customRole;
-    if (role) {
-        const isCustomRole = ![ADMIN, MEMBER, NO_ACCESS].includes(role);
-        if (isCustomRole) {
-            customRole = await Role.findOne({
-                slug: role,
-                isOrgRole: true,
-                organization: identityMembershipOrg.organization
-            });
-
-            if (!customRole) throw BadRequestError({ message: "Role not found" });
-        }
-    }
-
-    const identity = await Identity.findByIdAndUpdate(
-        identityId,
-        {
-            name,
-        },
-        {
-            new: true
-        }
-    );
-
-    if (!identity) throw BadRequestError({
-        message: `Failed to update identity with id ${identityId}`
-    });
-
-    await IdentityMembershipOrg.findOneAndUpdate(
-        {
-            identity: identity._id
-        },
-        {
-            role: customRole ? CUSTOM : role,
-            ...(customRole ? {
-                customRole
-            } : {}),
-            ...(role && !customRole ? { // non-custom role
-                $unset: {
-                    customRole: 1
-                }
-            } : {})
-        },
-        {
-            new: true
-        }
-    );
-
-    await EEAuditLogService.createAuditLog(
-        req.authData,
-        {
-            type: EventType.UPDATE_IDENTITY,
-            metadata: {
-                identityId: identity._id.toString(),
-                name: identity.name,
-            }
-        },
-        {
-            organizationId: identityMembershipOrg.organization
-        }
-    );
-
-    return res.status(200).send({
-        identity
-    });
-}
-
-/**
- * Delete identity with id [identityId]
- * @param req 
- * @param res 
- * @returns 
- */
- export const deleteIdentity = async (req: Request, res: Response) => {
-    const {
-        params: { identityId }
-    } = await validateRequest(reqValidator.DeleteIdentityV1, req);
-    
-    const identityMembershipOrg = await IdentityMembershipOrg
-        .findOne({
-            identity: new Types.ObjectId(identityId)
-        })
-        .populate<{
-            identity: IIdentity,
-            customRole: IRole
-        }>("identity customRole");
-
-    if (!identityMembershipOrg) throw ResourceNotFoundError({
-        message: `Failed to find identity with id ${identityId}`
-    });
-
-    const { permission } = await getAuthDataOrgPermissions({
-        authData: req.authData,
-        organizationId: identityMembershipOrg.organization
-    });
-    ForbiddenError.from(permission).throwUnlessCan(
-        OrgPermissionActions.Delete,
-        OrgPermissionSubjects.Identity
-    );
-
-    const identityRolePermission = await getOrgRolePermissions(
-        identityMembershipOrg?.customRole?.slug ?? identityMembershipOrg.role,
-        identityMembershipOrg.organization.toString()
-    );
-    const hasRequiredPrivileges = isAtLeastAsPrivilegedOrg(permission, identityRolePermission);
-    if (!hasRequiredPrivileges) throw ForbiddenRequestError({
-        message: "Failed to delete more privileged identity"
-    });
-
-    const identity = await Identity.findByIdAndDelete(identityMembershipOrg.identity);
-    if (!identity) throw ResourceNotFoundError({
-        message: `Identity with id ${identityId} not found`
-    });
-
-    await IdentityMembershipOrg.findByIdAndDelete(identityMembershipOrg._id);
-
-    await IdentityMembership.deleteMany({
-        identity: identityMembershipOrg.identity
-    });
-    
-    await IdentityUniversalAuth.deleteMany({
-        identity: identityMembershipOrg.identity
-    });
-    
-    await IdentityUniversalAuthClientSecret.deleteMany({
-        identity: identityMembershipOrg.identity
-    });
-    
-    await IdentityAccessToken.deleteMany({
-        identity: identityMembershipOrg.identity
-    });
-
-    await EEAuditLogService.createAuditLog(
-        req.authData,
-        {
-            type: EventType.DELETE_IDENTITY,
-            metadata: {
-                identityId: identity._id.toString()
-            }
-        },
-        {
-            organizationId: identityMembershipOrg.organization
-        }
-    );
-
-    return res.status(200).send({
-        identity
-    });
-}
-
-
-
-
-

backend/src/ee/controllers/v1/index.ts

@@ -1,4 +1,3 @@
-import * as identitiesController from "./identitiesController";
 import * as secretController from "./secretController";
 import * as secretSnapshotController from "./secretSnapshotController";
 import * as organizationsController from "./organizationsController";
@@ -14,7 +13,6 @@ import * as secretRotationProviderController from "./secretRotationProviderContr
 import * as secretRotationController from "./secretRotationController";
 
 export {
-  identitiesController,
   secretController,
   secretSnapshotController,
   organizationsController,

backend/src/ee/controllers/v1/organizationsController.ts

@@ -8,7 +8,7 @@ import * as reqValidator from "../../../validation/organization";
 import {
   OrgPermissionActions,
   OrgPermissionSubjects,
-  getAuthDataOrgPermissions,
+  getUserOrgPermissions
 } from "../../services/RoleService";
 import { ForbiddenError } from "@casl/ability";
 import { Organization } from "../../../models";
@@ -20,10 +20,7 @@ export const getOrganizationPlansTable = async (req: Request, res: Response) =>
     params: { organizationId }
   } = await validateRequest(reqValidator.GetOrgPlansTablev1, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Read,
     OrgPermissionSubjects.Billing
@@ -45,10 +42,7 @@ export const getOrganizationPlan = async (req: Request, res: Response) => {
     params: { organizationId }
   } = await validateRequest(reqValidator.GetOrgPlanv1, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Read,
     OrgPermissionSubjects.Billing
@@ -76,10 +70,7 @@ export const startOrganizationTrial = async (req: Request, res: Response) => {
     body: { success_url }
   } = await validateRequest(reqValidator.StartOrgTrailv1, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Create,
     OrgPermissionSubjects.Billing
@@ -125,10 +116,7 @@ export const getOrganizationPlanBillingInfo = async (req: Request, res: Response
     params: { organizationId }
   } = await validateRequest(reqValidator.GetOrgPlanBillingInfov1, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Read,
     OrgPermissionSubjects.Billing
@@ -161,10 +149,7 @@ export const getOrganizationPlanTable = async (req: Request, res: Response) => {
     params: { organizationId }
   } = await validateRequest(reqValidator.GetOrgPlanTablev1, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Read,
     OrgPermissionSubjects.Billing
@@ -191,10 +176,7 @@ export const getOrganizationBillingDetails = async (req: Request, res: Response)
     params: { organizationId }
   } = await validateRequest(reqValidator.GetOrgBillingDetailsv1, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Read,
     OrgPermissionSubjects.Billing
@@ -222,10 +204,7 @@ export const updateOrganizationBillingDetails = async (req: Request, res: Respon
     body: { name, email }
   } = await validateRequest(reqValidator.UpdateOrgBillingDetailsv1, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Edit,
     OrgPermissionSubjects.Billing
@@ -259,10 +238,7 @@ export const getOrganizationPmtMethods = async (req: Request, res: Response) =>
     params: { organizationId }
   } = await validateRequest(reqValidator.GetOrgPmtMethodsv1, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Read,
     OrgPermissionSubjects.Billing
@@ -295,10 +271,7 @@ export const addOrganizationPmtMethod = async (req: Request, res: Response) => {
     body: { success_url, cancel_url }
   } = await validateRequest(reqValidator.CreateOrgPmtMethodv1, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Create,
     OrgPermissionSubjects.Billing
@@ -339,10 +312,7 @@ export const deleteOrganizationPmtMethod = async (req: Request, res: Response) =
     params: { organizationId, pmtMethodId }
   } = await validateRequest(reqValidator.DelOrgPmtMethodv1, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Delete,
     OrgPermissionSubjects.Billing
@@ -372,10 +342,7 @@ export const getOrganizationTaxIds = async (req: Request, res: Response) => {
     params: { organizationId }
   } = await validateRequest(reqValidator.GetOrgTaxIdsv1, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Read,
     OrgPermissionSubjects.Billing
@@ -408,10 +375,7 @@ export const addOrganizationTaxId = async (req: Request, res: Response) => {
     body: { type, value }
   } = await validateRequest(reqValidator.CreateOrgTaxId, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Create,
     OrgPermissionSubjects.Billing
@@ -448,10 +412,7 @@ export const deleteOrganizationTaxId = async (req: Request, res: Response) => {
     params: { organizationId, taxId }
   } = await validateRequest(reqValidator.DelOrgTaxIdv1, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Delete,
     OrgPermissionSubjects.Billing
@@ -484,10 +445,7 @@ export const getOrganizationInvoices = async (req: Request, res: Response) => {
     params: { organizationId }
   } = await validateRequest(reqValidator.GetOrgInvoicesv1, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Read,
     OrgPermissionSubjects.Billing
@@ -522,10 +480,7 @@ export const getOrganizationLicenses = async (req: Request, res: Response) => {
     params: { organizationId }
   } = await validateRequest(reqValidator.GetOrgLicencesv1, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Read,
     OrgPermissionSubjects.Billing

backend/src/ee/controllers/v1/roleController.ts

@@ -1,6 +1,4 @@
 import { Request, Response } from "express";
-import { Types } from "mongoose";
-import { Membership, User } from "../../../models";
 import {
   CreateRoleSchema,
   DeleteRoleSchema,
@@ -13,19 +11,16 @@ import {
   ProjectPermissionActions,
   ProjectPermissionSub,
   adminProjectPermissions,
-  getAuthDataProjectPermissions,
+  getUserProjectPermissions,
   memberProjectPermissions,
-  noAccessProjectPermissions,
   viewerProjectPermission
 } from "../../services/ProjectRoleService";
 import {
   OrgPermissionActions,
   OrgPermissionSubjects,
   adminPermissions,
-  getAuthDataOrgPermissions,
   getUserOrgPermissions,
-  memberPermissions,
-  noAccessPermissions
+  memberPermissions
 } from "../../services/RoleService";
 import { BadRequestError } from "../../../utils/errors";
 import { Role } from "../../models";
@@ -39,19 +34,12 @@ export const createRole = async (req: Request, res: Response) => {
 
   const isOrgRole = !workspaceId; // if workspaceid is provided then its a workspace rule
   if (isOrgRole) {
-    const { permission } = await getAuthDataOrgPermissions({
-      authData: req.authData,
-      organizationId: new Types.ObjectId(orgId)
-    });
-    
+    const { permission } = await getUserOrgPermissions(req.user.id, orgId);
     if (permission.cannot(OrgPermissionActions.Create, OrgPermissionSubjects.Role)) {
       throw BadRequestError({ message: "user doesn't have the permission." });
     }
   } else {
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: new Types.ObjectId(workspaceId)
-    });
+    const { permission } = await getUserProjectPermissions(req.user.id, workspaceId);
     if (permission.cannot(ProjectPermissionActions.Create, ProjectPermissionSub.Role)) {
       throw BadRequestError({ message: "User doesn't have the permission." });
     }
@@ -87,21 +75,14 @@ export const updateRole = async (req: Request, res: Response) => {
     body: { name, description, slug, permissions, workspaceId, orgId }
   } = await validateRequest(UpdateRoleSchema, req);
   const isOrgRole = !workspaceId; // if workspaceid is provided then its a workspace rule
-  
+
   if (isOrgRole) {
-    const { permission } = await getAuthDataOrgPermissions({
-      authData: req.authData,
-      organizationId: new Types.ObjectId(orgId)
-    });
+    const { permission } = await getUserOrgPermissions(req.user.id, orgId);
     if (permission.cannot(OrgPermissionActions.Edit, OrgPermissionSubjects.Role)) {
       throw BadRequestError({ message: "User doesn't have the org permission." });
     }
   } else {
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: new Types.ObjectId(workspaceId)
-    });
-
+    const { permission } = await getUserProjectPermissions(req.user.id, workspaceId);
     if (permission.cannot(ProjectPermissionActions.Edit, ProjectPermissionSub.Role)) {
       throw BadRequestError({ message: "User doesn't have the workspace permission." });
     }
@@ -148,19 +129,12 @@ export const deleteRole = async (req: Request, res: Response) => {
 
   const isOrgRole = !role.workspace;
   if (isOrgRole) {
-    const { permission } = await getAuthDataOrgPermissions({
-      authData: req.authData,
-      organizationId: role.organization
-    });
+    const { permission } = await getUserOrgPermissions(req.user.id, role.organization.toString());
     if (permission.cannot(OrgPermissionActions.Delete, OrgPermissionSubjects.Role)) {
       throw BadRequestError({ message: "User doesn't have the org permission." });
     }
   } else {
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: role.workspace
-    });
-
+    const { permission } = await getUserProjectPermissions(req.user.id, role.workspace.toString());
     if (permission.cannot(ProjectPermissionActions.Delete, ProjectPermissionSub.Role)) {
       throw BadRequestError({ message: "User doesn't have the workspace permission." });
     }
@@ -183,19 +157,12 @@ export const getRoles = async (req: Request, res: Response) => {
 
   const isOrgRole = !workspaceId;
   if (isOrgRole) {
-    const { permission } = await getAuthDataOrgPermissions({
-      authData: req.authData,
-      organizationId: new Types.ObjectId(orgId)
-    });
+    const { permission } = await getUserOrgPermissions(req.user.id, orgId);
     if (permission.cannot(OrgPermissionActions.Read, OrgPermissionSubjects.Role)) {
       throw BadRequestError({ message: "User doesn't have the org permission." });
     }
   } else {
-    const { permission } = await getAuthDataProjectPermissions({
-      authData: req.authData,
-      workspaceId: new Types.ObjectId(workspaceId)
-    });
-
+    const { permission } = await getUserProjectPermissions(req.user.id, workspaceId);
     if (permission.cannot(ProjectPermissionActions.Read, ProjectPermissionSub.Role)) {
       throw BadRequestError({ message: "User doesn't have the workspace permission." });
     }
@@ -211,13 +178,6 @@ export const getRoles = async (req: Request, res: Response) => {
       description: "Complete administration access over the organization",
       permissions: isOrgRole ? adminPermissions.rules : adminProjectPermissions.rules
     },
-    {
-      _id: "no-access",
-      name: "No Access",
-      slug: "no-access",
-      description: "No access to any resources in the organization",
-      permissions: isOrgRole ? noAccessPermissions.rules : noAccessProjectPermissions.rules
-    },
     {
       _id: "member",
       name: isOrgRole ? "Member" : "Developer",
@@ -252,7 +212,7 @@ export const getUserPermissions = async (req: Request, res: Response) => {
   const {
     params: { orgId }
   } = await validateRequest(GetUserPermission, req);
-  
+
   const { permission, membership } = await getUserOrgPermissions(req.user._id, orgId);
 
   res.status(200).json({
@@ -267,19 +227,7 @@ export const getUserWorkspacePermissions = async (req: Request, res: Response) =
   const {
     params: { workspaceId }
   } = await validateRequest(GetUserProjectPermission, req);
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-  
-  let membership;
-  if (req.authData.authPayload instanceof User) {
-    membership = await Membership.findOne({
-      user: req.authData.authPayload._id,
-      workspace: new Types.ObjectId(workspaceId)
-    })
-  }
+  const { permission, membership } = await getUserProjectPermissions(req.user._id, workspaceId);
 
   res.status(200).json({
     data: {

backend/src/ee/controllers/v1/secretApprovalPolicyController.ts

@@ -1,11 +1,10 @@
-import { Types } from "mongoose";
 import { ForbiddenError, subject } from "@casl/ability";
 import { Request, Response } from "express";
 import { nanoid } from "nanoid";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../services/ProjectRoleService";
 import { validateRequest } from "../../../helpers/validation";
 import { SecretApprovalPolicy } from "../../models/secretApprovalPolicy";
@@ -20,11 +19,7 @@ export const createSecretApprovalPolicy = async (req: Request, res: Response) =>
     body: { approvals, secretPath, approvers, environment, workspaceId, name }
   } = await validateRequest(reqValidator.CreateSecretApprovalRule, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.SecretApproval
@@ -54,11 +49,10 @@ export const updateSecretApprovalPolicy = async (req: Request, res: Response) =>
   const secretApproval = await SecretApprovalPolicy.findById(id);
   if (!secretApproval) throw ERR_SECRET_APPROVAL_NOT_FOUND;
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: secretApproval.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    secretApproval.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.SecretApproval
@@ -84,11 +78,10 @@ export const deleteSecretApprovalPolicy = async (req: Request, res: Response) =>
   const secretApproval = await SecretApprovalPolicy.findById(id);
   if (!secretApproval) throw ERR_SECRET_APPROVAL_NOT_FOUND;
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: secretApproval.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    secretApproval.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Delete,
     ProjectPermissionSub.SecretApproval
@@ -106,11 +99,7 @@ export const getSecretApprovalPolicy = async (req: Request, res: Response) => {
     query: { workspaceId }
   } = await validateRequest(reqValidator.GetSecretApprovalRuleList, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.SecretApproval
@@ -128,11 +117,7 @@ export const getSecretApprovalPolicyOfBoard = async (req: Request, res: Response
     query: { workspaceId, environment, secretPath }
   } = await validateRequest(reqValidator.GetSecretApprovalPolicyOfABoard, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     subject(ProjectPermissionSub.Secrets, { secretPath, environment })

backend/src/ee/controllers/v1/secretApprovalRequestsController.ts

@@ -1,6 +1,7 @@
 import { Request, Response } from "express";
+import { getUserProjectPermissions } from "../../services/ProjectRoleService";
 import { validateRequest } from "../../../helpers/validation";
-import { Folder, Membership, User } from "../../../models";
+import { Folder } from "../../../models";
 import { ApprovalStatus, SecretApprovalRequest } from "../../models/secretApprovalRequest";
 import * as reqValidator from "../../validation/secretApprovalRequest";
 import { getFolderWithPathFromId } from "../../../services/FolderService";
@@ -16,15 +17,7 @@ export const getSecretApprovalRequestCount = async (req: Request, res: Response)
     query: { workspaceId }
   } = await validateRequest(reqValidator.getSecretApprovalRequestCount, req);
 
-  if (!(req.authData.authPayload instanceof User)) return;
-  
-  const membership = await Membership.findOne({
-    user: req.authData.authPayload._id,
-    workspace: new Types.ObjectId(workspaceId)
-  });
-  
-  if (!membership) throw UnauthorizedRequestError();
-
+  const { membership } = await getUserProjectPermissions(req.user._id, workspaceId);
   const approvalRequestCount = await SecretApprovalRequest.aggregate([
     {
       $match: {
@@ -72,14 +65,7 @@ export const getSecretApprovalRequests = async (req: Request, res: Response) =>
     query: { status, committer, workspaceId, environment, limit, offset }
   } = await validateRequest(reqValidator.getSecretApprovalRequests, req);
 
-  if (!(req.authData.authPayload instanceof User)) return;
-  
-  const membership = await Membership.findOne({
-    user: req.authData.authPayload._id,
-    workspace: new Types.ObjectId(workspaceId)
-  });
-  
-  if (!membership) throw UnauthorizedRequestError();
+  const { membership } = await getUserProjectPermissions(req.user._id, workspaceId);
 
   const query = {
     workspace: new Types.ObjectId(workspaceId),
@@ -162,15 +148,10 @@ export const getSecretApprovalRequestDetails = async (req: Request, res: Respons
   if (!secretApprovalRequest)
     throw BadRequestError({ message: "Secret approval request not found" });
 
-  if (!(req.authData.authPayload instanceof User)) return;
-
-  const membership = await Membership.findOne({
-    user: req.authData.authPayload._id,
-    workspace: secretApprovalRequest.workspace
-  });
-  
-  if (!membership) throw UnauthorizedRequestError();
-
+  const { membership } = await getUserProjectPermissions(
+    req.user._id,
+    secretApprovalRequest.workspace.toString()
+  );
   // allow to fetch only if its admin or is the committer or approver
   if (
     membership.role !== "admin" &&
@@ -209,15 +190,10 @@ export const updateSecretApprovalReviewStatus = async (req: Request, res: Respon
   if (!secretApprovalRequest)
     throw BadRequestError({ message: "Secret approval request not found" });
 
-  if (!(req.authData.authPayload instanceof User)) return;
-
-  const membership = await Membership.findOne({
-    user: req.authData.authPayload._id,
-    workspace: secretApprovalRequest.workspace
-  });
-  
-  if (!membership) throw UnauthorizedRequestError();
-
+  const { membership } = await getUserProjectPermissions(
+    req.user._id,
+    secretApprovalRequest.workspace.toString()
+  );
   if (
     membership.role !== "admin" &&
     secretApprovalRequest.committer !== membership.id &&
@@ -251,15 +227,10 @@ export const mergeSecretApprovalRequest = async (req: Request, res: Response) =>
   if (!secretApprovalRequest)
     throw BadRequestError({ message: "Secret approval request not found" });
 
-  if (!(req.authData.authPayload instanceof User)) return;
-
-  const membership = await Membership.findOne({
-    user: req.authData.authPayload._id,
-    workspace: secretApprovalRequest.workspace
-  });
-  
-  if (!membership) throw UnauthorizedRequestError();
-
+  const { membership } = await getUserProjectPermissions(
+    req.user._id,
+    secretApprovalRequest.workspace.toString()
+  );
   if (
     membership.role !== "admin" &&
     secretApprovalRequest.committer !== membership.id &&
@@ -301,14 +272,10 @@ export const updateSecretApprovalRequestStatus = async (req: Request, res: Respo
   if (!secretApprovalRequest)
     throw BadRequestError({ message: "Secret approval request not found" });
 
-  if (!(req.authData.authPayload instanceof User)) return;
-
-  const membership = await Membership.findOne({
-    user: req.authData.authPayload._id,
-    workspace: secretApprovalRequest.workspace
-  });
-  
-  if (!membership) throw UnauthorizedRequestError();
+  const { membership } = await getUserProjectPermissions(
+    req.user._id,
+    secretApprovalRequest.workspace.toString()
+  );
 
   if (
     membership.role !== "admin" &&

backend/src/ee/controllers/v1/secretController.ts

@@ -5,7 +5,7 @@ import { Folder, Secret } from "../../../models";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../services/ProjectRoleService";
 import { BadRequestError } from "../../../utils/errors";
 import * as reqValidator from "../../../validation";
@@ -74,11 +74,7 @@ export const getSecretVersions = async (req: Request, res: Response) => {
     throw BadRequestError({ message: "Failed to find secret" });
   }
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: secret.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, secret.workspace.toString());
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.SecretRollback
@@ -161,12 +157,10 @@ export const rollbackSecretVersion = async (req: Request, res: Response) => {
   if (!toBeUpdatedSec) {
     throw BadRequestError({ message: "Failed to find secret" });
   }
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: toBeUpdatedSec.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    toBeUpdatedSec.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.SecretRollback

backend/src/ee/controllers/v1/secretRotationController.ts

@@ -1,12 +1,11 @@
 import { Request, Response } from "express";
-import { Types } from "mongoose";
 import { validateRequest } from "../../../helpers/validation";
 import * as reqValidator from "../../validation/secretRotation";
 import * as secretRotationService from "../../secretRotation/service";
 import {
+  getUserProjectPermissions,
   ProjectPermissionActions,
-  ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  ProjectPermissionSub
 } from "../../services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
 
@@ -24,11 +23,7 @@ export const createSecretRotation = async (req: Request, res: Response) => {
     }
   } = await validateRequest(reqValidator.createSecretRotationV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.SecretRotation
@@ -54,12 +49,7 @@ export const restartSecretRotations = async (req: Request, res: Response) => {
   } = await validateRequest(reqValidator.restartSecretRotationV1, req);
 
   const doc = await secretRotationService.getSecretRotationById({ id });
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: doc.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, doc.workspace.toString());
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.SecretRotation
@@ -75,12 +65,7 @@ export const deleteSecretRotations = async (req: Request, res: Response) => {
   } = await validateRequest(reqValidator.removeSecretRotationV1, req);
 
   const doc = await secretRotationService.getSecretRotationById({ id });
-
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: doc.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, doc.workspace.toString());
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Delete,
     ProjectPermissionSub.SecretRotation
@@ -95,11 +80,7 @@ export const getSecretRotations = async (req: Request, res: Response) => {
     query: { workspaceId }
   } = await validateRequest(reqValidator.getSecretRotationV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.SecretRotation

backend/src/ee/controllers/v1/secretRotationProviderController.ts

@@ -1,12 +1,11 @@
 import { Request, Response } from "express";
-import { Types } from "mongoose";
 import { validateRequest } from "../../../helpers/validation";
 import * as reqValidator from "../../validation/secretRotationProvider";
 import * as secretRotationProviderService from "../../secretRotation/service";
 import {
+  getUserProjectPermissions,
   ProjectPermissionActions,
-  ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  ProjectPermissionSub
 } from "../../services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
 
@@ -15,11 +14,7 @@ export const getProviderTemplates = async (req: Request, res: Response) => {
     params: { workspaceId }
   } = await validateRequest(reqValidator.getSecretRotationProvidersV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.SecretRotation

backend/src/ee/controllers/v1/secretSnapshotController.ts

@@ -4,7 +4,7 @@ import { validateRequest } from "../../../helpers/validation";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../services/ProjectRoleService";
 import * as reqValidator from "../../../validation/secretSnapshot";
 import { ISecretVersion, SecretSnapshot, TFolderRootVersionSchema } from "../../models";
@@ -33,11 +33,10 @@ export const getSecretSnapshot = async (req: Request, res: Response) => {
 
   if (!secretSnapshot) throw new Error("Failed to find secret snapshot");
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: secretSnapshot.workspace
-  });
-
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    secretSnapshot.workspace.toString()
+  );
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.SecretRollback

backend/src/ee/controllers/v1/ssoController.ts

@@ -13,7 +13,7 @@ import { validateRequest } from "../../../helpers/validation";
 import {
   OrgPermissionActions,
   OrgPermissionSubjects,
-  getAuthDataOrgPermissions
+  getUserOrgPermissions
 } from "../../services/RoleService";
 import { ForbiddenError } from "@casl/ability";
 
@@ -47,10 +47,7 @@ export const getSSOConfig = async (req: Request, res: Response) => {
     query: { organizationId }
   } = await validateRequest(reqValidator.GetSsoConfigv1, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Read,
     OrgPermissionSubjects.Sso
@@ -74,10 +71,7 @@ export const updateSSOConfig = async (req: Request, res: Response) => {
     body: { organizationId, authProvider, isActive, entryPoint, issuer, cert }
   } = await validateRequest(reqValidator.UpdateSsoConfigv1, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Edit,
     OrgPermissionSubjects.Sso
@@ -212,10 +206,7 @@ export const createSSOConfig = async (req: Request, res: Response) => {
     body: { organizationId, authProvider, isActive, entryPoint, issuer, cert }
   } = await validateRequest(reqValidator.CreateSsoConfigv1, req);
 
-  const { permission } = await getAuthDataOrgPermissions({
-    authData: req.authData,
-    organizationId: new Types.ObjectId(organizationId)
-  });
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
   ForbiddenError.from(permission).throwUnlessCan(
     OrgPermissionActions.Create,
     OrgPermissionSubjects.Sso

backend/src/ee/controllers/v1/workspaceController.ts

@@ -2,11 +2,10 @@ import { Request, Response } from "express";
 import { PipelineStage, Types } from "mongoose";
 import {
   Folder,
-  Identity,
-  IdentityMembership,
   Membership,
   Secret,
   ServiceTokenData,
+  ServiceTokenDataV3,
   TFolderSchema,
   User,
   Workspace
@@ -18,16 +17,17 @@ import {
   FolderVersion,
   IPType,
   ISecretVersion,
-  IdentityActor,
   SecretSnapshot,
   SecretVersion,
   ServiceActor,
+  ServiceActorV3,
   TFolderRootVersionSchema,
   TrustedIP,
   UserActor
 } from "../../models";
 import { EESecretService } from "../../services";
 import { getLatestSecretVersionIds } from "../../helpers/secretVersion";
+// import Folder, { TFolderSchema } from "../../../models/folder";
 import { getFolderByPath, searchByFolderId } from "../../../services/FolderService";
 import { EEAuditLogService, EELicenseService } from "../../services";
 import { extractIPDetails, isValidIpOrCidr } from "../../../utils/ip";
@@ -46,7 +46,7 @@ import {
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  getAuthDataProjectPermissions
+  getUserProjectPermissions
 } from "../../services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
 import { BadRequestError } from "../../../utils/errors";
@@ -107,11 +107,7 @@ export const getWorkspaceSecretSnapshots = async (req: Request, res: Response) =
     query: { environment, directory, offset, limit }
   } = await validateRequest(GetWorkspaceSecretSnapshotsV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.SecretRollback
@@ -152,11 +148,7 @@ export const getWorkspaceSecretSnapshotsCount = async (req: Request, res: Respon
     query: { environment, directory }
   } = await validateRequest(GetWorkspaceSecretSnapshotsCountV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.SecretRollback
@@ -246,11 +238,7 @@ export const rollbackWorkspaceSecretSnapshot = async (req: Request, res: Respons
     body: { directory, environment, version }
   } = await validateRequest(RollbackWorkspaceSecretSnapshotV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.SecretRollback
@@ -579,112 +567,17 @@ export const rollbackWorkspaceSecretSnapshot = async (req: Request, res: Respons
  * @param res
  */
 export const getWorkspaceAuditLogs = async (req: Request, res: Response) => {
-  /* 
-    #swagger.summary = 'Return audit logs'
-    #swagger.description = 'Return audit logs'
-    
-    #swagger.security = [{
-      "apiKeyAuth": []
-    }]
-
-    #swagger.parameters['workspaceId'] = {
-      "description": "ID of the workspace where to get folders from",
-      "required": true,
-      "type": "string",
-      "in": "path"
-    }
-
-    #swagger.parameters['offset'] = {
-      "description": "Number of logs to skip before starting to return logs for pagination",
-      "required": false,
-      "type": "string"
-    }
-
-    #swagger.parameters['limit'] = {
-      "description": "Maximum number of logs to return for pagination",
-      "required": false,
-      "type": "string"
-    }
-
-   #swagger.parameters['startDate'] = {
-      "description": "Filter logs from this date in ISO-8601 format",
-      "required": false,
-      "type": "string"
-    }
-
-   #swagger.parameters['endDate'] = {
-      "description": "Filter logs till this date in ISO-8601 format",
-      "required": false,
-      "type": "string"
-    }
-
-    #swagger.parameters['eventType'] = {
-      "description": "Filter by type of event such as get-secrets, get-secret, create-secret, update-secret, delete-secret, etc.",
-      "required": false,
-      "type": "string",
-    }
-
-    #swagger.parameters['userAgentType'] = {
-      "description": "Filter by type of user agent such as web, cli, k8-operator, or other",
-      "required": false,
-      "type": "string",
-    }
-
-    #swagger.parameters['actor'] = {
-      "description": "Filter by actor such as user or service",
-      "required": false,
-      "type": "string"
-    }
-
-    #swagger.responses[200] = {
-        content: {
-            "application/json": {
-                schema: { 
-                  "type": "object",
-                  "properties": {
-                        "auditLogs": {
-                            "type": "array",
-                            "items": {
-			      $ref: "#/components/schemas/AuditLog",
-                            },
-                            "description": "List of audit log"                        
-                          },
-                  }
-                }
-            }           
-        }
-    }   
-    */
   const {
     query: { limit, offset, endDate, eventType, startDate, userAgentType, actor },
     params: { workspaceId }
   } = await validateRequest(GetWorkspaceAuditLogsV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.AuditLogs
   );
-
-  let actorMetadataQuery = "";
-  if (actor) {
-    switch (actor?.split("-", 2)[0]) {
-      case ActorType.USER:
-        actorMetadataQuery = "actor.metadata.userId";
-        break;
-      case ActorType.SERVICE:
-        actorMetadataQuery = "actor.metadata.serviceId";
-        break;
-      case ActorType.IDENTITY:
-        actorMetadataQuery = "actor.metadata.identityId";
-        break;
-    }
-  }
-
+  
   const query = {
     workspace: new Types.ObjectId(workspaceId),
     ...(eventType
@@ -700,9 +593,13 @@ export const getWorkspaceAuditLogs = async (req: Request, res: Response) => {
     ...(actor
       ? {
           "actor.type": actor.substring(0, actor.lastIndexOf("-")),
-          ...({
-            [actorMetadataQuery]: actor.substring(actor.lastIndexOf("-") + 1)
-          })
+          ...(actor.split("-", 2)[0] === ActorType.USER
+            ? {
+                "actor.metadata.userId": actor.substring(actor.lastIndexOf("-") + 1)
+              }
+            : {
+                "actor.metadata.serviceId": actor.substring(actor.lastIndexOf("-") + 1)
+              })
         }
       : {}),
     ...(startDate || endDate
@@ -714,11 +611,14 @@ export const getWorkspaceAuditLogs = async (req: Request, res: Response) => {
         }
       : {})
   };
-  
+
   const auditLogs = await AuditLog.find(query).sort({ createdAt: -1 }).skip(offset).limit(limit);
-  
+
+  const totalCount = await AuditLog.countDocuments(query);
+
   return res.status(200).send({
-    auditLogs
+    auditLogs,
+    totalCount
   });
 };
 
@@ -732,11 +632,7 @@ export const getWorkspaceAuditLogActorFilterOpts = async (req: Request, res: Res
     params: { workspaceId }
   } = await validateRequest(GetWorkspaceAuditLogActorFilterOptsV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.AuditLogs
@@ -745,7 +641,6 @@ export const getWorkspaceAuditLogActorFilterOpts = async (req: Request, res: Res
   const userIds = await Membership.distinct("user", {
     workspace: new Types.ObjectId(workspaceId)
   });
-  
   const userActors: UserActor[] = (
     await User.find({
       _id: {
@@ -771,26 +666,24 @@ export const getWorkspaceAuditLogActorFilterOpts = async (req: Request, res: Res
       name: serviceTokenData.name
     }
   }));
-
-  const identityIds = await IdentityMembership.distinct("identity", {
-    workspace: new Types.ObjectId(workspaceId)
-  });
   
-  const identityActors: IdentityActor[] = (
-    await Identity.find({
-      _id: {
-        $in: identityIds
-      }
+  const serviceV3Actors: ServiceActorV3[] = (
+    await ServiceTokenDataV3.find({
+      workspace: new Types.ObjectId(workspaceId)
     })
-  ).map((identity) => ({
-    type: ActorType.IDENTITY,
+  ).map((serviceTokenData) => ({
+    type: ActorType.SERVICE_V3,
     metadata: {
-      identityId: identity._id.toString(),
-      name: identity.name
+      serviceId: serviceTokenData._id.toString(),
+      name: serviceTokenData.name
     }
   }));
-
-  const actors = [...userActors, ...serviceActors, ...identityActors];
+  
+  const actors = [
+    ...userActors, 
+    ...serviceActors,
+    ...serviceV3Actors
+  ];
 
   return res.status(200).send({
     actors
@@ -807,11 +700,7 @@ export const getWorkspaceTrustedIps = async (req: Request, res: Response) => {
     params: { workspaceId }
   } = await validateRequest(GetWorkspaceTrustedIpsV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.IpAllowList
@@ -837,11 +726,7 @@ export const addWorkspaceTrustedIp = async (req: Request, res: Response) => {
     body: { comment, isActive, ipAddress: ip }
   } = await validateRequest(AddWorkspaceTrustedIpV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Create,
     ProjectPermissionSub.IpAllowList
@@ -907,11 +792,7 @@ export const updateWorkspaceTrustedIp = async (req: Request, res: Response) => {
     body: { ipAddress: ip, comment }
   } = await validateRequest(UpdateWorkspaceTrustedIpV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.IpAllowList
@@ -1003,11 +884,7 @@ export const deleteWorkspaceTrustedIp = async (req: Request, res: Response) => {
     params: { workspaceId, trustedIpId }
   } = await validateRequest(DeleteWorkspaceTrustedIpV1, req);
 
-  const { permission } = await getAuthDataProjectPermissions({
-    authData: req.authData,
-    workspaceId: new Types.ObjectId(workspaceId)
-  });
-
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
   ForbiddenError.from(permission).throwUnlessCan(
     ProjectPermissionActions.Delete,
     ProjectPermissionSub.IpAllowList

backend/src/ee/controllers/v3/index.ts

@@ -1,5 +1,7 @@
+import * as serviceTokenDataController from "./serviceTokenDataController";
 import * as apiKeyDataController from "./apiKeyDataController";
 
 export {
+    serviceTokenDataController,
     apiKeyDataController
 }

backend/src/ee/controllers/v3/serviceTokenDataController.ts

@@ -0,0 +1,431 @@
+import jwt from "jsonwebtoken";
+import { Request, Response } from "express";
+import { Types } from "mongoose";
+import { 
+    IServiceTokenDataV3,
+    IUser,
+    ServiceTokenDataV3,
+    ServiceTokenDataV3Key,
+    Workspace
+} from "../../../models";
+import {
+    IServiceTokenV3Scope, 
+    IServiceTokenV3TrustedIp 
+} from "../../../models/serviceTokenDataV3";
+import {
+    ActorType,
+    EventType
+} from "../../models";
+import { validateRequest } from "../../../helpers/validation";
+import * as reqValidator from "../../../validation/serviceTokenDataV3";
+import { createToken } from "../../../helpers/auth";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../services/ProjectRoleService";
+import { ForbiddenError } from "@casl/ability"; 
+import { BadRequestError, ResourceNotFoundError, UnauthorizedRequestError } from "../../../utils/errors";
+import { extractIPDetails, isValidIpOrCidr } from "../../../utils/ip";
+import { EEAuditLogService, EELicenseService } from "../../services";
+import { getAuthSecret } from "../../../config";
+import { AuthTokenType } from "../../../variables";
+
+/**
+ * Return project key for service token V3
+ * @param req 
+ * @param res 
+ */
+export const getServiceTokenDataKey = async (req: Request, res: Response) => {
+    const key = await ServiceTokenDataV3Key.findOne({
+        serviceTokenData: (req.authData.authPayload as IServiceTokenDataV3)._id
+    }).populate<{ sender: IUser }>("sender", "publicKey");
+    
+    if (!key) throw ResourceNotFoundError({
+        message: "Failed to find project key for service token"
+    });
+    
+    const { _id, workspace, encryptedKey, nonce, sender: { publicKey } } = key;
+    
+    return res.status(200).send({
+        key: {
+            _id,
+            workspace,
+            encryptedKey,
+            publicKey,
+            nonce
+        }
+    });
+}
+
+/**
+ * Return access and refresh token as per refresh operation
+ * @param req 
+ * @param res 
+ */
+ export const refreshToken = async (req: Request, res: Response) => {
+    const {
+        body: {
+            refresh_token
+        }
+    } = await validateRequest(reqValidator.RefreshTokenV3, req);
+
+    const decodedToken = <jwt.ServiceRefreshTokenJwtPayload>(
+		jwt.verify(refresh_token, await getAuthSecret())
+	);
+    
+    if (decodedToken.authTokenType !== AuthTokenType.SERVICE_REFRESH_TOKEN) throw UnauthorizedRequestError();
+    
+    let serviceTokenData = await ServiceTokenDataV3.findOne({
+        _id: new Types.ObjectId(decodedToken.serviceTokenDataId),
+        isActive: true
+    });
+    
+    if (!serviceTokenData) throw UnauthorizedRequestError();
+
+    if (decodedToken.tokenVersion !== serviceTokenData.tokenVersion) {
+        // raise alarm
+        throw UnauthorizedRequestError();
+    }
+    
+    const response: {
+        refresh_token?: string;
+        access_token: string;
+        expires_in: number;
+        token_type: string;
+    } = {
+        refresh_token,
+        access_token: "",
+        expires_in: 0,
+        token_type: "Bearer"
+    };
+
+    if (serviceTokenData.isRefreshTokenRotationEnabled) {
+        serviceTokenData = await ServiceTokenDataV3.findByIdAndUpdate(
+            serviceTokenData._id,
+            {
+                $inc: {
+                    tokenVersion: 1
+                }
+            },
+            {
+                new: true
+            }
+        );
+        
+        if (!serviceTokenData) throw BadRequestError();
+        
+        response.refresh_token = createToken({
+            payload: {
+                serviceTokenDataId: serviceTokenData._id.toString(),
+                authTokenType: AuthTokenType.SERVICE_REFRESH_TOKEN,
+                tokenVersion: serviceTokenData.tokenVersion
+            },
+            secret: await getAuthSecret()
+        });
+    }
+
+    response.access_token = createToken({
+        payload: {
+            serviceTokenDataId: serviceTokenData._id.toString(),
+            authTokenType: AuthTokenType.SERVICE_ACCESS_TOKEN,
+            tokenVersion: serviceTokenData.tokenVersion
+        },
+        expiresIn: serviceTokenData.accessTokenTTL,
+        secret: await getAuthSecret()
+    });
+
+    response.expires_in = serviceTokenData.accessTokenTTL;
+
+    await ServiceTokenDataV3.findByIdAndUpdate(
+        serviceTokenData._id,
+        {
+            refreshTokenLastUsed: new Date(),
+            $inc: { refreshTokenUsageCount: 1 }
+        },
+        {
+            new: true
+        }
+    );
+    
+    return res.status(200).send(response);
+}
+
+/**
+ * Create service token data V3
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const createServiceTokenData = async (req: Request, res: Response) => {
+    const {
+        body: { 
+            name, 
+            workspaceId, 
+            publicKey, 
+            scopes,
+            trustedIps,
+            expiresIn, 
+            accessTokenTTL,
+            isRefreshTokenRotationEnabled,
+            encryptedKey, // for ServiceTokenDataV3Key
+            nonce, // for ServiceTokenDataV3Key
+        }
+    } = await validateRequest(reqValidator.CreateServiceTokenV3, req);
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    ForbiddenError.from(permission).throwUnlessCan(
+        ProjectPermissionActions.Create,
+        ProjectPermissionSub.ServiceTokens
+    );
+    
+    const workspace = await Workspace.findById(workspaceId);
+    if (!workspace) throw BadRequestError({ message: "Workspace not found" });
+
+    const plan = await EELicenseService.getPlan(workspace.organization);
+    
+    // validate trusted ips
+    const reformattedTrustedIps = trustedIps.map((trustedIp) => {
+        if (!plan.ipAllowlisting && trustedIp.ipAddress !== "0.0.0.0/0") return res.status(400).send({
+            message: "Failed to add IP access range to service token due to plan restriction. Upgrade plan to add IP access range."
+        });
+
+        const isValidIPOrCidr = isValidIpOrCidr(trustedIp.ipAddress);
+        
+        if (!isValidIPOrCidr) return res.status(400).send({
+            message: "The IP is not a valid IPv4, IPv6, or CIDR block"
+        });
+        
+        return extractIPDetails(trustedIp.ipAddress);
+    });
+    
+    let expiresAt;
+    if (expiresIn) {
+        expiresAt = new Date();
+        expiresAt.setSeconds(expiresAt.getSeconds() + expiresIn);
+    }
+    
+    let user;
+    if (req.authData.actor.type === ActorType.USER) {
+        user = req.authData.authPayload._id;
+    }
+    
+    const isActive = true;
+    const serviceTokenData = await new ServiceTokenDataV3({
+        name,
+        user,
+        workspace: new Types.ObjectId(workspaceId),
+        publicKey,
+        refreshTokenUsageCount: 0,
+        accessTokenUsageCount: 0,
+        tokenVersion: 1,
+        trustedIps: reformattedTrustedIps,
+        scopes,
+        isActive,
+        expiresAt,
+        accessTokenTTL,
+        isRefreshTokenRotationEnabled
+    }).save();
+    
+    await new ServiceTokenDataV3Key({
+        encryptedKey,
+        nonce,
+        sender: req.user._id,
+        serviceTokenData: serviceTokenData._id,
+        workspace: new Types.ObjectId(workspaceId)
+    }).save();
+    
+    const refreshToken = createToken({
+        payload: {
+            serviceTokenDataId: serviceTokenData._id.toString(),
+            authTokenType: AuthTokenType.SERVICE_REFRESH_TOKEN,
+            tokenVersion: serviceTokenData.tokenVersion
+        },
+        secret: await getAuthSecret()
+    });
+    
+    await EEAuditLogService.createAuditLog(
+        req.authData,
+        {
+            type: EventType.CREATE_SERVICE_TOKEN_V3, // TODO: update
+            metadata: {
+                name,
+                isActive,
+                scopes: scopes as Array<IServiceTokenV3Scope>,
+                trustedIps: reformattedTrustedIps as Array<IServiceTokenV3TrustedIp>,
+                expiresAt
+            }
+        },
+        {
+            workspaceId: new Types.ObjectId(workspaceId)
+        }
+    );
+    
+    return res.status(200).send({
+        serviceTokenData,
+        refreshToken
+    });
+}
+
+/**
+ * Update service token V3 data with id [serviceTokenDataId]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const updateServiceTokenData = async (req: Request, res: Response) => {
+    const {
+        params: { serviceTokenDataId },
+        body: { 
+            name, 
+            isActive,
+            scopes,
+            trustedIps,
+            expiresIn,
+            accessTokenTTL,
+            isRefreshTokenRotationEnabled
+        }
+    } = await validateRequest(reqValidator.UpdateServiceTokenV3, req);
+
+    let serviceTokenData = await ServiceTokenDataV3.findById(serviceTokenDataId);
+    if (!serviceTokenData) throw ResourceNotFoundError({ 
+        message: "Service token not found" 
+    });
+    
+    const { permission } = await getUserProjectPermissions(
+        req.user._id,
+        serviceTokenData.workspace.toString()
+    );
+    
+    ForbiddenError.from(permission).throwUnlessCan(
+        ProjectPermissionActions.Edit,
+        ProjectPermissionSub.ServiceTokens
+    );
+
+    const workspace = await Workspace.findById(serviceTokenData.workspace);
+    if (!workspace) throw BadRequestError({ message: "Workspace not found" });
+
+    const plan = await EELicenseService.getPlan(workspace.organization);
+
+    // validate trusted ips
+    let reformattedTrustedIps;
+    if (trustedIps) {
+        reformattedTrustedIps = trustedIps.map((trustedIp) => {
+            if (!plan.ipAllowlisting && trustedIp.ipAddress !== "0.0.0.0/0") return res.status(400).send({
+                message: "Failed to update IP access range to service token due to plan restriction. Upgrade plan to update IP access range."
+            });
+
+            const isValidIPOrCidr = isValidIpOrCidr(trustedIp.ipAddress);
+            
+            if (!isValidIPOrCidr) return res.status(400).send({
+                message: "The IP is not a valid IPv4, IPv6, or CIDR block"
+            });
+            
+            return extractIPDetails(trustedIp.ipAddress);
+        });
+    }
+
+    let expiresAt;
+    if (expiresIn) {
+        expiresAt = new Date();
+        expiresAt.setSeconds(expiresAt.getSeconds() + expiresIn);
+    }
+    
+    serviceTokenData = await ServiceTokenDataV3.findByIdAndUpdate(
+        serviceTokenDataId,
+        {
+            name,
+            isActive,
+            scopes,
+            trustedIps: reformattedTrustedIps,
+            expiresAt,
+            accessTokenTTL,
+            isRefreshTokenRotationEnabled
+        },
+        {
+            new: true
+        }
+    );
+
+    if (!serviceTokenData) throw BadRequestError({
+        message: "Failed to update service token"
+    });
+
+    await EEAuditLogService.createAuditLog(
+        req.authData,
+        {
+            type: EventType.UPDATE_SERVICE_TOKEN_V3,
+            metadata: {
+                name: serviceTokenData.name,
+                isActive,
+                scopes: scopes as Array<IServiceTokenV3Scope>,
+                trustedIps: reformattedTrustedIps as Array<IServiceTokenV3TrustedIp>,
+                expiresAt
+            }
+        },
+        {
+            workspaceId: serviceTokenData.workspace
+        }
+    );
+
+    return res.status(200).send({
+        serviceTokenData
+    }); 
+}
+
+/**
+ * Delete service token data with id [serviceTokenDataId]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const deleteServiceTokenData = async (req: Request, res: Response) => {
+    const {
+        params: { serviceTokenDataId }
+    } = await validateRequest(reqValidator.DeleteServiceTokenV3, req);
+    
+    let serviceTokenData = await ServiceTokenDataV3.findById(serviceTokenDataId);
+    if (!serviceTokenData) throw ResourceNotFoundError({ 
+        message: "Service token not found" 
+    });
+    
+    const { permission } = await getUserProjectPermissions(
+        req.user._id,
+        serviceTokenData.workspace.toString()
+    );
+    
+    ForbiddenError.from(permission).throwUnlessCan(
+        ProjectPermissionActions.Delete,
+        ProjectPermissionSub.ServiceTokens
+    );
+    
+    serviceTokenData = await ServiceTokenDataV3.findByIdAndDelete(serviceTokenDataId);
+    
+    if (!serviceTokenData) throw BadRequestError({
+        message: "Failed to delete service token"
+    });
+    
+    await ServiceTokenDataV3Key.findOneAndDelete({
+        serviceTokenData: serviceTokenData._id
+    });
+    
+    await EEAuditLogService.createAuditLog(
+        req.authData,
+        {
+            type: EventType.DELETE_SERVICE_TOKEN_V3,
+            metadata: {
+                name: serviceTokenData.name,
+                isActive: serviceTokenData.isActive,
+                scopes: serviceTokenData.scopes as Array<IServiceTokenV3Scope>,
+                trustedIps: serviceTokenData.trustedIps as Array<IServiceTokenV3TrustedIp>,
+                expiresAt: serviceTokenData.expiresAt
+            }
+        },
+        {
+            workspaceId: serviceTokenData.workspace
+        }
+    );
+
+    return res.status(200).send({
+        serviceTokenData
+    }); 
+}

backend/src/ee/models/auditLog/auditLog.ts

@@ -1,70 +1,76 @@
 import { Schema, Types, model } from "mongoose";
-import { ActorType, EventType, UserAgentType } from "./enums";
-import { Actor, Event } from "./types";
+import {
+    ActorType,
+    EventType,
+    UserAgentType
+} from "./enums";
+import {
+    Actor,
+    Event
+} from "./types";
 
 export interface IAuditLog {
-  actor: Actor;
-  organization: Types.ObjectId;
-  workspace: Types.ObjectId;
-  ipAddress: string;
-  event: Event;
-  userAgent: string;
-  userAgentType: UserAgentType;
-  expiresAt?: Date;
+    actor: Actor;
+    organization: Types.ObjectId;
+    workspace: Types.ObjectId;
+    ipAddress: string;
+    event: Event;
+    userAgent: string;
+    userAgentType: UserAgentType;
+    expiresAt: Date;
 }
 
 const auditLogSchema = new Schema<IAuditLog>(
-  {
-    actor: {
-      type: {
-        type: String,
-        enum: ActorType,
-        required: true
-      },
-      metadata: {
-        type: Schema.Types.Mixed
-      }
+    {
+        actor: {
+            type: {
+                type: String,
+                enum: ActorType,
+                required: true
+            },
+            metadata: {
+                type: Schema.Types.Mixed
+            }
+        },
+        organization: {
+            type: Schema.Types.ObjectId,
+            required: false
+        },
+        workspace: {
+            type: Schema.Types.ObjectId,
+            required: false
+        },
+        ipAddress: {
+            type: String,
+            required: true
+        },
+        event: {
+            type: {
+                type: String,
+                enum: EventType,
+                required: true
+            },
+            metadata: {
+                type: Schema.Types.Mixed
+            }
+        },
+        userAgent: {
+            type: String,
+            required: true
+        },
+        userAgentType: {
+            type: String,
+            enum: UserAgentType,
+            required: true
+        },
+        expiresAt: {
+            type: Date,
+            expires: 0
+        }
     },
-    organization: {
-      type: Schema.Types.ObjectId,
-      required: false
-    },
-    workspace: {
-      type: Schema.Types.ObjectId,
-      required: false,
-      index: true
-    },
-    ipAddress: {
-      type: String,
-      required: true
-    },
-    event: {
-      type: {
-        type: String,
-        enum: EventType,
-        required: true
-      },
-      metadata: {
-        type: Schema.Types.Mixed
-      }
-    },
-    userAgent: {
-      type: String,
-      required: true
-    },
-    userAgentType: {
-      type: String,
-      enum: UserAgentType,
-      required: true
-    },
-    expiresAt: {
-      type: Date,
-      expires: 0
+    {
+        timestamps: true
     }
-  },
-  {
-    timestamps: true
-  }
 );
 
-export const AuditLog = model<IAuditLog>("AuditLog", auditLogSchema);
+export const AuditLog = model<IAuditLog>("AuditLog", auditLogSchema); 

backend/src/ee/models/auditLog/enums.ts

@@ -1,7 +1,8 @@
-export enum ActorType { // would extend to AWS, Azure, ...
-    USER = "user", // userIdentity
-    SERVICE = "service",
-    IDENTITY = "identity"
+export enum ActorType {
+  USER = "user",
+  SERVICE = "service",
+  SERVICE_V3 = "service-v3",
+  Machine = "machine"
 }
 
 export enum UserAgentType {
@@ -31,16 +32,9 @@ export enum EventType {
   DELETE_TRUSTED_IP = "delete-trusted-ip",
   CREATE_SERVICE_TOKEN = "create-service-token", // v2
   DELETE_SERVICE_TOKEN = "delete-service-token", // v2
-  CREATE_IDENTITY = "create-identity",
-  UPDATE_IDENTITY = "update-identity",
-  DELETE_IDENTITY = "delete-identity",
-  LOGIN_IDENTITY_UNIVERSAL_AUTH = "login-identity-universal-auth",
-  ADD_IDENTITY_UNIVERSAL_AUTH = "add-identity-universal-auth",
-  UPDATE_IDENTITY_UNIVERSAL_AUTH = "update-identity-universal-auth",
-  GET_IDENTITY_UNIVERSAL_AUTH = "get-identity-universal-auth",
-  CREATE_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRET = "create-identity-universal-auth-client-secret",
-  REVOKE_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRET =  "revoke-identity-universal-auth-client-secret",
-  GET_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRETS = "get-identity-universal-auth-client-secret",
+  CREATE_SERVICE_TOKEN_V3 = "create-service-token-v3", // v3
+  UPDATE_SERVICE_TOKEN_V3 = "update-service-token-v3", // v3
+  DELETE_SERVICE_TOKEN_V3 = "delete-service-token-v3", // v3
   CREATE_ENVIRONMENT = "create-environment",
   UPDATE_ENVIRONMENT = "update-environment",
   DELETE_ENVIRONMENT = "delete-environment",

backend/src/ee/models/auditLog/types.ts

@@ -1,5 +1,5 @@
 import { ActorType, EventType } from "./enums";
-import { IIdentityTrustedIp } from "../../../models";
+import { IServiceTokenV3Scope, IServiceTokenV3TrustedIp } from "../../../models/serviceTokenDataV3";
 
 interface UserActorMetadata {
   userId: string;
@@ -11,11 +11,6 @@ interface ServiceActorMetadata {
   name: string;
 }
 
-interface IdentityActorMetadata {
-  identityId: string;
-  name: string;
-}
-
 export interface UserActor {
   type: ActorType.USER;
   metadata: UserActorMetadata;
@@ -26,12 +21,16 @@ export interface ServiceActor {
   metadata: ServiceActorMetadata;
 }
 
-export interface IdentityActor {
-  type: ActorType.IDENTITY;
-  metadata: IdentityActorMetadata;
+export interface ServiceActorV3 {
+  type: ActorType.SERVICE_V3;
+  metadata: ServiceActorMetadata;
 }
 
-export type Actor = UserActor | ServiceActor | IdentityActor;
+export interface MachineActor {
+  type: ActorType.Machine;
+}
+
+export type Actor = UserActor | ServiceActor | ServiceActorV3 | MachineActor;
 
 interface GetSecretsEvent {
   type: EventType.GET_SECRETS;
@@ -221,91 +220,36 @@ interface DeleteServiceTokenEvent {
   };
 }
 
-interface CreateIdentityEvent { // note: currently not logging org-role
-  type: EventType.CREATE_IDENTITY;
+interface CreateServiceTokenV3Event {
+  type: EventType.CREATE_SERVICE_TOKEN_V3;
   metadata: {
-    identityId: string;
     name: string;
+    isActive: boolean;
+    scopes: Array<IServiceTokenV3Scope>;
+    trustedIps: Array<IServiceTokenV3TrustedIp>;
+    expiresAt?: Date;
   };
 }
 
-interface UpdateIdentityEvent {
-  type: EventType.UPDATE_IDENTITY;
+interface UpdateServiceTokenV3Event {
+  type: EventType.UPDATE_SERVICE_TOKEN_V3;
   metadata: {
-    identityId: string;
     name?: string;
+    isActive?: boolean;
+    scopes?: Array<IServiceTokenV3Scope>;
+    trustedIps?: Array<IServiceTokenV3TrustedIp>;
+    expiresAt?: Date;
   };
 }
 
-interface DeleteIdentityEvent {
-  type: EventType.DELETE_IDENTITY;
+interface DeleteServiceTokenV3Event {
+  type: EventType.DELETE_SERVICE_TOKEN_V3;
   metadata: {
-    identityId: string;
-  };
-}
-
-interface LoginIdentityUniversalAuthEvent {
-  type: EventType.LOGIN_IDENTITY_UNIVERSAL_AUTH ;
-  metadata: {
-    identityId: string;
-    identityUniversalAuthId: string;
-    clientSecretId: string;
-    identityAccessTokenId: string;
-  };
-}
-
-interface AddIdentityUniversalAuthEvent {
-  type: EventType.ADD_IDENTITY_UNIVERSAL_AUTH;
-  metadata: {
-    identityId: string;
-    clientSecretTrustedIps: Array<IIdentityTrustedIp>;
-    accessTokenTTL: number;
-    accessTokenMaxTTL: number;
-    accessTokenNumUsesLimit: number;
-    accessTokenTrustedIps: Array<IIdentityTrustedIp>;
-  };
-}
-
-interface UpdateIdentityUniversalAuthEvent {
-  type: EventType.UPDATE_IDENTITY_UNIVERSAL_AUTH;
-  metadata: {
-    identityId: string;
-    clientSecretTrustedIps?: Array<IIdentityTrustedIp>;
-    accessTokenTTL?: number;
-    accessTokenMaxTTL?: number;
-    accessTokenNumUsesLimit?: number;
-    accessTokenTrustedIps?: Array<IIdentityTrustedIp>;
-  };
-}
-
-interface GetIdentityUniversalAuthEvent {
-  type: EventType.GET_IDENTITY_UNIVERSAL_AUTH;
-  metadata: {
-    identityId: string;
-  };
-}
-
-interface CreateIdentityUniversalAuthClientSecretEvent {
-  type: EventType.CREATE_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRET ;
-  metadata: {
-    identityId: string;
-    clientSecretId: string;
-  };
-}
-
-interface GetIdentityUniversalAuthClientSecretsEvent {
-  type: EventType.GET_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRETS;
-  metadata: {
-    identityId: string;
-  };
-}
-
-
-interface RevokeIdentityUniversalAuthClientSecretEvent {
-  type: EventType.REVOKE_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRET ;
-  metadata: {
-    identityId: string;
-    clientSecretId: string;
+    name: string;
+    isActive: boolean;
+    scopes: Array<IServiceTokenV3Scope>;
+    expiresAt?: Date;
+    trustedIps: Array<IServiceTokenV3TrustedIp>;
   };
 }
 
@@ -551,16 +495,9 @@ export type Event =
   | DeleteTrustedIPEvent
   | CreateServiceTokenEvent
   | DeleteServiceTokenEvent
-  | CreateIdentityEvent
-  | UpdateIdentityEvent
-  | DeleteIdentityEvent
-  | LoginIdentityUniversalAuthEvent
-  | AddIdentityUniversalAuthEvent
-  | UpdateIdentityUniversalAuthEvent
-  | GetIdentityUniversalAuthEvent
-  | CreateIdentityUniversalAuthClientSecretEvent
-  | GetIdentityUniversalAuthClientSecretsEvent
-  | RevokeIdentityUniversalAuthClientSecretEvent
+  | CreateServiceTokenV3Event
+  | UpdateServiceTokenV3Event
+  | DeleteServiceTokenV3Event
   | CreateEnvironmentEvent
   | UpdateEnvironmentEvent
   | DeleteEnvironmentEvent

backend/src/ee/routes/v1/identities.ts

@@ -1,31 +0,0 @@
-import express from "express";
-const router = express.Router();
-import { requireAuth } from "../../../middleware";
-import { AuthMode } from "../../../variables";
-import { identitiesController } from "../../controllers/v1";
-
-router.post(
-  "/",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]
-  }),
-  identitiesController.createIdentity
-);
-
-router.patch(
-  "/:identityId",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
-  }),
-  identitiesController.updateIdentity
-);
-
-router.delete(
-  "/:identityId",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
-  }),
-  identitiesController.deleteIdentity
-);
-
-export default router;

backend/src/ee/routes/v1/index.ts

@@ -1,4 +1,3 @@
-import identities from "./identities";
 import secret from "./secret";
 import secretSnapshot from "./secretSnapshot";
 import organizations from "./organizations";
@@ -14,7 +13,6 @@ import secretRotationProvider from "./secretRotationProvider";
 import secretRotation from "./secretRotation";
 
 export {
-  identities,
   secret,
   secretSnapshot,
   organizations,

backend/src/ee/routes/v3/index.ts

@@ -1,5 +1,7 @@
+import serviceTokenData from "./serviceTokenData";
 import apiKeyData from "./apiKeyData";
 
 export {
+    serviceTokenData,
     apiKeyData
 }

backend/src/ee/routes/v3/serviceTokenData.ts

@@ -0,0 +1,44 @@
+import express from "express";
+const router = express.Router();
+import { requireAuth } from "../../../middleware";
+import { AuthMode } from "../../../variables";
+import { serviceTokenDataController } from "../../controllers/v3";
+
+router.get(
+  "/me/key",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.SERVICE_ACCESS_TOKEN]
+  }),
+  serviceTokenDataController.getServiceTokenDataKey
+);
+
+router.post(
+  "/me/token",
+  serviceTokenDataController.refreshToken
+);
+
+router.post(
+    "/",
+    requireAuth({
+      acceptedAuthModes: [AuthMode.JWT]
+    }),
+    serviceTokenDataController.createServiceTokenData
+);
+
+router.patch(
+    "/:serviceTokenDataId",
+    requireAuth({
+      acceptedAuthModes: [AuthMode.JWT]
+    }),
+    serviceTokenDataController.updateServiceTokenData
+);
+
+router.delete(
+  "/:serviceTokenDataId",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  serviceTokenDataController.deleteServiceTokenData
+);
+
+export default router;

backend/src/ee/services/EEAuditLogService.ts

@@ -3,6 +3,7 @@ import { AuditLog, Event } from "../models";
 import { AuthData } from "../../interfaces/middleware";
 import EELicenseService from "./EELicenseService";
 import { Workspace } from "../../models";
+import { OrganizationNotFoundError } from "../../utils/errors";
 
 interface EventScope {
     workspaceId?: Types.ObjectId;
@@ -13,42 +14,31 @@ type ValidEventScope =
     | Required<Pick<EventScope, "workspaceId">>
     | Required<Pick<EventScope, "organizationId">>
     | Required<EventScope>
-    | Record<string, never>;
 
 export default class EEAuditLogService {
-    static async createAuditLog(authData: AuthData, event: Event, eventScope: ValidEventScope = {}, shouldSave = true) {
+    static async createAuditLog(authData: AuthData, event: Event, eventScope: ValidEventScope, shouldSave = true) {
         
         const MS_IN_DAY = 24 * 60 * 60 * 1000;
         
-        let organizationId;
-        if ("organizationId" in eventScope) {
-            organizationId = eventScope.organizationId;
-        } 
+        const organizationId = ("organizationId" in eventScope)
+            ? eventScope.organizationId
+            : (await Workspace.findById(eventScope.workspaceId).select("organization").lean())?.organization;
         
-        let workspaceId;
-        if ("workspaceId" in eventScope) {
-            workspaceId = eventScope.workspaceId;
-            
-            if (!organizationId) {
-                organizationId = (await Workspace.findById(workspaceId).select("organization").lean())?.organization;
-            }
-        }
-        
-        let expiresAt;
-        if (organizationId) {
-            const ttl = (await EELicenseService.getPlan(organizationId)).auditLogsRetentionDays * MS_IN_DAY;
-            expiresAt = new Date(Date.now() + ttl);
-        }
+        if (!organizationId) throw OrganizationNotFoundError({
+            message: "createAuditLog: Failed to create audit log due to missing organizationId"
+        });
+
+        const ttl = (await EELicenseService.getPlan(organizationId)).auditLogsRetentionDays * MS_IN_DAY;
         
         const auditLog = await new AuditLog({
             actor: authData.actor,
             organization: organizationId,
-            workspace: workspaceId,
+            workspace: ("workspaceId" in eventScope) ? eventScope.workspaceId : undefined,
             ipAddress: authData.ipAddress,
             event,
             userAgent: authData.userAgent,
             userAgentType: authData.userAgentType,
-            expiresAt
+            expiresAt: new Date(Date.now() + ttl)
         });
         
         if (shouldSave) {

backend/src/ee/services/ProjectRoleService.ts

@@ -1,4 +1,3 @@
-import { Types } from "mongoose";
 import {
   AbilityBuilder,
   ForcedSubject,
@@ -7,19 +6,11 @@ import {
   buildMongoQueryMatcher,
   createMongoAbility
 } from "@casl/ability";
-import { UnauthorizedRequestError } from "../../utils/errors";
+import { Membership } from "../../models";
+import { IRole } from "../models/role";
+import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
 import { FieldCondition, FieldInstruction, JsInterpreter } from "@ucast/mongo2js";
 import picomatch from "picomatch";
-import { AuthData } from "../../interfaces/middleware";
-import { ActorType, IRole, Role } from "../models";
-import { 
-  IIdentity,
-  IdentityMembership,
-  Membership,
-  ServiceTokenData
-} from "../../models";
-import { ADMIN, CUSTOM, MEMBER, NO_ACCESS, VIEWER } from "../../variables";
-import { BadRequestError } from "../../utils/errors";
 
 const $glob: FieldInstruction<string> = {
   type: "field",
@@ -60,8 +51,7 @@ export enum ProjectPermissionSub {
   Secrets = "secrets",
   SecretRollback = "secret-rollback",
   SecretApproval = "secret-approval",
-  SecretRotation = "secret-rotation",
-  Identity = "identity"
+  SecretRotation = "secret-rotation"
 }
 
 type SubjectFields = {
@@ -86,7 +76,6 @@ export type ProjectPermissionSet =
   | [ProjectPermissionActions, ProjectPermissionSub.ServiceTokens]
   | [ProjectPermissionActions, ProjectPermissionSub.SecretApproval]
   | [ProjectPermissionActions, ProjectPermissionSub.SecretRotation]
-  | [ProjectPermissionActions, ProjectPermissionSub.Identity]
   | [ProjectPermissionActions.Delete, ProjectPermissionSub.Workspace]
   | [ProjectPermissionActions.Edit, ProjectPermissionSub.Workspace]
   | [ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback]
@@ -133,11 +122,6 @@ const buildAdminPermission = () => {
   can(ProjectPermissionActions.Edit, ProjectPermissionSub.Webhooks);
   can(ProjectPermissionActions.Delete, ProjectPermissionSub.Webhooks);
 
-  can(ProjectPermissionActions.Read, ProjectPermissionSub.Identity);
-  can(ProjectPermissionActions.Create, ProjectPermissionSub.Identity);
-  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Identity);
-  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Identity);
-
   can(ProjectPermissionActions.Read, ProjectPermissionSub.ServiceTokens);
   can(ProjectPermissionActions.Create, ProjectPermissionSub.ServiceTokens);
   can(ProjectPermissionActions.Edit, ProjectPermissionSub.ServiceTokens);
@@ -203,11 +187,6 @@ const buildMemberPermission = () => {
   can(ProjectPermissionActions.Edit, ProjectPermissionSub.Webhooks);
   can(ProjectPermissionActions.Delete, ProjectPermissionSub.Webhooks);
 
-  can(ProjectPermissionActions.Read, ProjectPermissionSub.Identity);
-  can(ProjectPermissionActions.Create, ProjectPermissionSub.Identity);
-  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Identity);
-  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Identity);
-
   can(ProjectPermissionActions.Read, ProjectPermissionSub.ServiceTokens);
   can(ProjectPermissionActions.Create, ProjectPermissionSub.ServiceTokens);
   can(ProjectPermissionActions.Edit, ProjectPermissionSub.ServiceTokens);
@@ -248,7 +227,6 @@ const buildViewerPermission = () => {
   can(ProjectPermissionActions.Read, ProjectPermissionSub.Role);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.Webhooks);
-  can(ProjectPermissionActions.Read, ProjectPermissionSub.Identity);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.ServiceTokens);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.Settings);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.Environments);
@@ -261,155 +239,31 @@ const buildViewerPermission = () => {
 
 export const viewerProjectPermission = buildViewerPermission();
 
-const buildNoAccessProjectPermission = () => {
-  const { build } = new AbilityBuilder<MongoAbility<ProjectPermissionSet>>(createMongoAbility);
-  return build({ conditionsMatcher });
-}
+export const getUserProjectPermissions = async (userId: string, workspaceId: string) => {
+  // TODO(akhilmhdh): speed this up by pulling from cache later
+  const membership = await Membership.findOne({
+    user: userId,
+    workspace: workspaceId
+  })
+    .populate<{
+      customRole: IRole & { permissions: RawRuleOf<MongoAbility<ProjectPermissionSet>>[] };
+    }>("customRole")
+    .exec();
 
-export const noAccessProjectPermissions = buildNoAccessProjectPermission();
-
-/**
- * Return permissions for user/service pertaining to workspace with id [workspaceId]
- * 
- * Note: should not rely on this function for ST V2 authorization logic
- * b/c ST V2 does not support role-based access control
- */
-export const getAuthDataProjectPermissions = async ({
-  authData,
-  workspaceId
-}: {
-  authData: AuthData;
-  workspaceId: Types.ObjectId;
-}) => {
-  let role: "admin" | "member" | "viewer" | "no-access" | "custom";
-  let customRole;
-  
-  switch (authData.actor.type) {
-    case ActorType.USER: {
-      const membership = await Membership.findOne({
-        user: authData.authPayload._id,
-        workspace: workspaceId
-      })
-      .populate<{
-        customRole: IRole & { permissions: RawRuleOf<MongoAbility<ProjectPermissionSet>>[] };
-      }>("customRole")
-      .exec();
-    
-      if (!membership || (membership.role === "custom" && !membership.customRole)) {
-        throw UnauthorizedRequestError();
-      }
-      
-      role = membership.role;
-      customRole = membership.customRole;
-      break;
-    }
-    case ActorType.SERVICE: {
-      const serviceTokenData = await ServiceTokenData.findById(authData.authPayload._id);
-      if (!serviceTokenData || !serviceTokenData.workspace.equals(workspaceId)) throw UnauthorizedRequestError();
-      role = "viewer";
-      break;
-    }
-    case ActorType.IDENTITY: {
-      const identityMembership = await IdentityMembership.findOne({
-        identity: authData.authPayload._id,
-        workspace: workspaceId
-      })
-      .populate<{
-        customRole: IRole & { permissions: RawRuleOf<MongoAbility<ProjectPermissionSet>>[] };
-        identity: IIdentity
-      }>("customRole identity")
-      .exec();
-      
-      if (!identityMembership || (identityMembership.role === "custom" && !identityMembership.customRole)) {
-        throw UnauthorizedRequestError();
-      }
-    
-      role = identityMembership.role;
-      customRole = identityMembership.customRole;
-
-      break;
-    }
-    default:
-      throw UnauthorizedRequestError();
+  if (!membership || (membership.role === "custom" && !membership.customRole)) {
+    throw UnauthorizedRequestError({ message: "User doesn't belong to organization" });
   }
 
-  switch (role) {
-    case ADMIN:
-      return { permission: adminProjectPermissions };
-    case MEMBER:
-      return { permission: memberProjectPermissions };
-    case VIEWER:
-      return { permission: viewerProjectPermission };
-    case NO_ACCESS:
-      return { permission: noAccessProjectPermissions };
-    case CUSTOM: {
-      if (!customRole) throw UnauthorizedRequestError();
-      return { 
-        permission: createMongoAbility<ProjectPermissionSet>(
-          customRole.permissions, 
-          { conditionsMatcher }
-        )
-      };
-    }
-    default:
-      throw UnauthorizedRequestError();
-  }
-}
+  if (membership.role === "admin") return { permission: adminProjectPermissions, membership };
+  if (membership.role === "member") return { permission: memberProjectPermissions, membership };
+  if (membership.role === "viewer") return { permission: viewerProjectPermission, membership };
 
-export const getWorkspaceRolePermissions = async (role: string, workspaceId: string) => {
-  const isCustomRole = ![ADMIN, MEMBER, VIEWER, NO_ACCESS].includes(role);
-  if (isCustomRole) {
-    const workspaceRole = await Role.findOne({
-      slug: role,
-      isOrgRole: false,
-      workspace: new Types.ObjectId(workspaceId)
-    });
-
-    if (!workspaceRole) throw BadRequestError({ message: "Role not found" });
-    
-    return createMongoAbility<ProjectPermissionSet>(workspaceRole.permissions as RawRuleOf<MongoAbility<ProjectPermissionSet>>[], {
+  if (membership.role === "custom") {
+    const permission = createMongoAbility<ProjectPermissionSet>(membership.customRole.permissions, {
       conditionsMatcher
     });
+    return { permission, membership };
   }
 
-  switch (role) {
-    case ADMIN:
-      return adminProjectPermissions;
-    case MEMBER:
-      return memberProjectPermissions;
-    case VIEWER:
-      return viewerProjectPermission;
-    case NO_ACCESS:
-      return noAccessProjectPermissions;
-    default:
-      throw BadRequestError({ message: "Role not found" });
-  }
-}
-
-/**
- * Extracts and formats permissions from a CASL Ability object or a raw permission set. 
- * @param ability
- * @returns 
- */
- const extractPermissions = (ability: any) => {
-  return ability.A.map((permission: any) => `${permission.action}_${permission.subject}`);
-}
-
-/**
- * Compares two sets of permissions to determine if the first set is at least as privileged as the second set.
- * The function checks if all permissions in the second set are contained within the first set and if the first set has equal or more permissions.
- * 
-*/
-export const isAtLeastAsPrivilegedWorkspace = (permissions1: MongoAbility<ProjectPermissionSet> | ProjectPermissionSet, permissions2: MongoAbility<ProjectPermissionSet> | ProjectPermissionSet) => {
-
-  const set1 = new Set(extractPermissions(permissions1));
-  const set2 = new Set(extractPermissions(permissions2));
-  
-  for (const perm of set2) {
-    if (!set1.has(perm)) {
-      return false;
-    }
-  }
-
-  return set1.size >= set2.size;
-}
+  throw BadRequestError({ message: "User role not found" });
+};

backend/src/ee/services/RoleService.ts

@@ -1,15 +1,9 @@
-import { Types } from "mongoose";
 import { AbilityBuilder, MongoAbility, RawRuleOf, createMongoAbility } from "@casl/ability";
-import { 
-  IIdentity,
-  IdentityMembershipOrg,
-  MembershipOrg
-} from "../../models";
-import { ActorType, IRole, Role } from "../models";
+import { MembershipOrg } from "../../models";
+import { IRole } from "../models/role";
 import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
-import { ACCEPTED, ADMIN, CUSTOM, MEMBER, NO_ACCESS} from "../../variables";
+import { ACCEPTED } from "../../variables";
 import { conditionsMatcher } from "./ProjectRoleService";
-import { AuthData } from "../../interfaces/middleware";
 
 export enum OrgPermissionActions {
   Read = "read",
@@ -26,8 +20,7 @@ export enum OrgPermissionSubjects {
   IncidentAccount = "incident-contact",
   Sso = "sso",
   Billing = "billing",
-  SecretScanning = "secret-scanning",
-  Identity = "identity"
+  SecretScanning = "secret-scanning"
 }
 
 export type OrgPermissionSet =
@@ -39,8 +32,7 @@ export type OrgPermissionSet =
   | [OrgPermissionActions, OrgPermissionSubjects.IncidentAccount]
   | [OrgPermissionActions, OrgPermissionSubjects.Sso]
   | [OrgPermissionActions, OrgPermissionSubjects.SecretScanning]
-  | [OrgPermissionActions, OrgPermissionSubjects.Billing]
-  | [OrgPermissionActions, OrgPermissionSubjects.Identity];
+  | [OrgPermissionActions, OrgPermissionSubjects.Billing];
 
 const buildAdminPermission = () => {
   const { can, build } = new AbilityBuilder<MongoAbility<OrgPermissionSet>>(createMongoAbility);
@@ -83,11 +75,6 @@ const buildAdminPermission = () => {
   can(OrgPermissionActions.Edit, OrgPermissionSubjects.Billing);
   can(OrgPermissionActions.Delete, OrgPermissionSubjects.Billing);
 
-  can(OrgPermissionActions.Read, OrgPermissionSubjects.Identity);
-  can(OrgPermissionActions.Create, OrgPermissionSubjects.Identity);
-  can(OrgPermissionActions.Edit, OrgPermissionSubjects.Identity);
-  can(OrgPermissionActions.Delete, OrgPermissionSubjects.Identity);
-
   return build({ conditionsMatcher });
 };
 
@@ -111,26 +98,13 @@ const buildMemberPermission = () => {
   can(OrgPermissionActions.Edit, OrgPermissionSubjects.SecretScanning);
   can(OrgPermissionActions.Delete, OrgPermissionSubjects.SecretScanning);
 
-  can(OrgPermissionActions.Read, OrgPermissionSubjects.Identity);
-  can(OrgPermissionActions.Create, OrgPermissionSubjects.Identity);
-  can(OrgPermissionActions.Edit, OrgPermissionSubjects.Identity);
-  can(OrgPermissionActions.Delete, OrgPermissionSubjects.Identity);
-
   return build({ conditionsMatcher });
 };
 
 export const memberPermissions = buildMemberPermission();
 
-const buildNoAccessPermission = () => {
-  const { build } = new AbilityBuilder<MongoAbility<OrgPermissionSet>>(createMongoAbility);
-  return build({ conditionsMatcher });
-}
-
-export const noAccessPermissions = buildNoAccessPermission();
-
 export const getUserOrgPermissions = async (userId: string, orgId: string) => {
   // TODO(akhilmhdh): speed this up by pulling from cache later
-  
   const membership = await MembershipOrg.findOne({
     user: userId,
     organization: orgId,
@@ -145,13 +119,11 @@ export const getUserOrgPermissions = async (userId: string, orgId: string) => {
     throw UnauthorizedRequestError({ message: "User doesn't belong to organization" });
   }
 
-  if (membership.role === ADMIN) return { permission: adminPermissions, membership };
+  if (membership.role === "admin") return { permission: adminPermissions, membership };
 
-  if (membership.role === MEMBER) return { permission: memberPermissions, membership };
-  
-  if (membership.role === NO_ACCESS) return { permission: noAccessPermissions, membership }
+  if (membership.role === "member") return { permission: memberPermissions, membership };
 
-  if (membership.role === CUSTOM) {
+  if (membership.role === "custom") {
     const permission = createMongoAbility<OrgPermissionSet>(membership.customRole.permissions, {
       conditionsMatcher
     });
@@ -160,142 +132,3 @@ export const getUserOrgPermissions = async (userId: string, orgId: string) => {
 
   throw BadRequestError({ message: "User role not found" });
 };
-
-/**
- * Return permissions for user/service pertaining to organization with id [organizationId]
- * 
- * Note: should not rely on this function for ST V2 authorization logic
- * b/c ST V2 does not support role-based access control but also not organization-level resources
- */
- export const getAuthDataOrgPermissions = async ({
-  authData,
-  organizationId
-}: {
-  authData: AuthData;
-  organizationId: Types.ObjectId;
-}) => {
-  let role: "admin" | "member" | "no-access" | "custom";
-  let customRole;
-  
-  switch (authData.actor.type) {
-    case ActorType.USER: {
-      const membershipOrg = await MembershipOrg.findOne({
-        user: authData.authPayload._id,
-        organization: organizationId,
-        status: ACCEPTED
-      })
-      .populate<{ customRole: IRole & { permissions: RawRuleOf<MongoAbility<OrgPermissionSet>>[] } }>(
-        "customRole"
-      )
-      .exec();
-      
-      if (!membershipOrg || (membershipOrg.role === "custom" && !membershipOrg.customRole)) {
-        throw UnauthorizedRequestError({ message: "User doesn't belong to organization" });
-      }
-      
-      role = membershipOrg.role;
-      customRole = membershipOrg.customRole;
-      break;
-    }
-    case ActorType.SERVICE: {
-      throw UnauthorizedRequestError({
-        message: "Failed to access organization-level resources with service token"
-      });
-    }
-    case ActorType.IDENTITY: {
-      const identityMembershipOrg = await IdentityMembershipOrg.findOne({
-        identity: authData.authPayload._id,
-        organization: organizationId
-      })
-      .populate<{
-        customRole: IRole & { permissions: RawRuleOf<MongoAbility<OrgPermissionSet>>[] };
-        identity: IIdentity
-      }>("customRole identity")
-      .exec();
-      
-      if (!identityMembershipOrg || (identityMembershipOrg.role === "custom" && !identityMembershipOrg.customRole)) {
-        throw UnauthorizedRequestError();
-      }
-      
-      role = identityMembershipOrg.role;
-      customRole = identityMembershipOrg.customRole;
-      break;
-    }
-    default:
-      throw UnauthorizedRequestError();
-  }
-
-  switch (role) {
-    case ADMIN:
-      return { permission: adminPermissions };
-    case MEMBER:
-      return { permission: memberPermissions };
-    case NO_ACCESS:
-      return { permission: noAccessPermissions };
-    case CUSTOM: {
-      if (!customRole) throw UnauthorizedRequestError();
-      return {
-        permission: createMongoAbility<OrgPermissionSet>(
-          customRole.permissions, 
-          { conditionsMatcher }
-        )
-      };
-    }
-  }
-}
-
-export const getOrgRolePermissions = async (role: string, orgId: string) => {
-  const isCustomRole = ![ADMIN, MEMBER, NO_ACCESS].includes(role);
-  if (isCustomRole) {
-    const orgRole = await Role.findOne({
-      slug: role,
-      isOrgRole: true,
-      organization: new Types.ObjectId(orgId)
-    });
-
-    if (!orgRole) throw BadRequestError({ message: "Org Role not found" });
-    
-    return createMongoAbility<OrgPermissionSet>(orgRole.permissions as RawRuleOf<MongoAbility<OrgPermissionSet>>[], {
-      conditionsMatcher
-    });
-  }
-
-  switch (role) {
-    case ADMIN:
-      return adminPermissions;
-    case MEMBER:
-      return memberPermissions;
-    case NO_ACCESS:
-      return noAccessPermissions;
-    default:
-      throw BadRequestError({ message: "User org role not found" });
-  }
-}
-
-/**
- * Extracts and formats permissions from a CASL Ability object or a raw permission set. 
- * @param ability
- * @returns 
- */
-const extractPermissions = (ability: any) => {
-  return ability.A.map((permission: any) => `${permission.action}_${permission.subject}`);
-}
-
-/**
- * Compares two sets of permissions to determine if the first set is at least as privileged as the second set.
- * The function checks if all permissions in the second set are contained within the first set and if the first set has equal or more permissions.
- * 
-*/
-export const isAtLeastAsPrivilegedOrg = (permissions1: MongoAbility<OrgPermissionSet> | OrgPermissionSet, permissions2: MongoAbility<OrgPermissionSet> | OrgPermissionSet) => {
-
-  const set1 = new Set(extractPermissions(permissions1));
-  const set2 = new Set(extractPermissions(permissions2));
-  
-  for (const perm of set2) {
-    if (!set1.has(perm)) {
-      return false;
-    }
-  }
-
-  return set1.size >= set2.size;
-}

backend/src/events/secret.ts

@@ -1,5 +1,5 @@
 import { Types } from "mongoose";
-import { EVENT_PULL_SECRETS, EVENT_PUSH_SECRETS } from "../variables";
+import { EVENT_PUSH_SECRETS } from "../variables";
 
 interface PushSecret {
   ciphertextKey: string;
@@ -37,18 +37,4 @@ const eventPushSecrets = ({
   };
 };
 
-/**
- * Return event for pulling secrets
- * @param {Object} obj
- * @param {String} obj.workspaceId - id of workspace to pull secrets from
- * @returns
- */
-const eventPullSecrets = ({ workspaceId }: { workspaceId: string }) => {
-  return {
-    name: EVENT_PULL_SECRETS,
-    workspaceId,
-    payload: {}
-  };
-};
-
 export { eventPushSecrets };

backend/src/helpers/membership.ts

@@ -17,7 +17,7 @@ export const validateMembership = async ({
 }: {
   userId: Types.ObjectId | string;
   workspaceId: Types.ObjectId | string;
-  acceptedRoles?: Array<"admin" | "member" | "custom" | "viewer" | "no-access">;
+  acceptedRoles?: Array<"admin" | "member" | "custom" | "viewer">;
 }) => {
   const membership = await Membership.findOne({
     user: userId,

backend/src/helpers/membershipOrg.ts

@@ -18,7 +18,7 @@ export const validateMembershipOrg = async ({
 }: {
   userId: Types.ObjectId;
   organizationId: Types.ObjectId;
-  acceptedRoles?: Array<"owner" | "admin" | "member" | "custom" | "no-access">;
+  acceptedRoles?: Array<"owner" | "admin" | "member" | "custom">;
   acceptedStatuses?: Array<"invited" | "accepted">;
 }) => {
   const membershipOrg = await MembershipOrg.findOne({

backend/src/helpers/organization.ts

@@ -4,11 +4,6 @@ import {
   BotKey,
   BotOrg,
   Folder,
-  Identity,
-  IdentityMembership,
-  IdentityMembershipOrg,
-  IdentityUniversalAuth,
-  IdentityUniversalAuthClientSecret,
   IncidentContactOrg,
   Integration,
   IntegrationAuth,
@@ -21,6 +16,8 @@ import {
   SecretImport,
   ServiceToken,
   ServiceTokenData,
+  ServiceTokenDataV3,
+  ServiceTokenDataV3Key,
   Tag,
   Webhook,
   Workspace
@@ -126,32 +123,6 @@ export const deleteOrganization = async ({
   await MembershipOrg.deleteMany({
     organization: organization._id
   });
-
-  const identityIds = await IdentityMembershipOrg.distinct("identity", {
-    organization: organization._id
-  });
-  
-  await IdentityMembershipOrg.deleteMany({
-    organization: organization._id
-  });
-  
-  await Identity.deleteMany({
-    _id: {
-      $in: identityIds
-    }
-  });
-  
-  await IdentityUniversalAuth.deleteMany({
-    identity: {
-      $in: identityIds
-    }
-  });
-
-  await IdentityUniversalAuthClientSecret.deleteMany({
-    identity: {
-      $in: identityIds
-    }
-  });
   
   await BotOrg.deleteMany({
     organization: organization._id
@@ -297,7 +268,13 @@ export const deleteOrganization = async ({
     }
   });
 
-  await IdentityMembership.deleteMany({
+  await ServiceTokenDataV3.deleteMany({
+    workspace: {
+      $in: workspaceIds
+    }
+  });
+  
+  await ServiceTokenDataV3Key.deleteMany({
     workspace: {
       $in: workspaceIds
     }

backend/src/helpers/reminder.ts

@@ -1,58 +0,0 @@
-import { ISecret } from "../models";
-import {
-  createRecurringSecretReminder,
-  deleteRecurringSecretReminder,
-  updateRecurringSecretReminder
-} from "../queues/reminders/sendSecretReminders";
-
-type TPartialSecret = Pick<
-  ISecret,
-  "_id" | "secretReminderRepeatDays" | "secretReminderNote" | "workspace"
->;
-type TPartialSecretDeleteReminder = Pick<ISecret, "_id" | "secretReminderRepeatDays">;
-
-export const createReminder = async (oldSecret: TPartialSecret, newSecret: TPartialSecret) => {
-  if (oldSecret._id !== newSecret._id) {
-    throw new Error("Secret id's don't match");
-  }
-
-  if (!newSecret.secretReminderRepeatDays) {
-    throw new Error("No repeat days provided");
-  }
-
-  const secretId = oldSecret._id.toString();
-  const workspaceId = oldSecret.workspace.toString();
-
-  if (oldSecret.secretReminderRepeatDays) {
-    // This will first delete the existing recurring job, and then create a new one.
-    await updateRecurringSecretReminder({
-      workspaceId,
-      secretId,
-      repeatDays: newSecret.secretReminderRepeatDays,
-      note: newSecret.secretReminderNote
-    });
-  } else {
-    // This will create a new recurring job.
-    await createRecurringSecretReminder({
-      workspaceId,
-      secretId,
-      repeatDays: newSecret.secretReminderRepeatDays,
-      note: newSecret.secretReminderNote
-    });
-  }
-};
-
-export const deleteReminder = async (secret: TPartialSecretDeleteReminder) => {
-  if (!secret._id) {
-    throw new Error("No secret id provided");
-  }
-
-  if (!secret.secretReminderRepeatDays) {
-    throw new Error("No repeat days provided");
-  }
-
-  await deleteRecurringSecretReminder({
-    secretId: secret._id.toString(),
-    repeatDays: secret.secretReminderRepeatDays
-  });
-};

backend/src/helpers/secrets.ts

@@ -11,14 +11,17 @@ import {
 } from "../interfaces/services/SecretService";
 import {
   Folder,
+  IMembership,
   ISecret,
   IServiceTokenData,
+  IServiceTokenDataV3,
   Secret,
   SecretBlindIndexData,
   ServiceTokenData,
   TFolderRootSchema
 } from "../models";
-import { EventType, SecretVersion } from "../ee/models";
+import { Permission } from "../models/serviceTokenDataV3";
+import { ActorType, EventType, IRole, SecretVersion } from "../ee/models";
 import {
   BadRequestError,
   InternalServerError,
@@ -31,6 +34,8 @@ import {
   ENCODING_SCHEME_BASE64,
   ENCODING_SCHEME_UTF8,
   K8_USER_AGENT_NAME,
+  PERMISSION_READ_SECRETS,
+  PERMISSION_WRITE_SECRETS,
   SECRET_PERSONAL,
   SECRET_SHARED
 } from "../variables";
@@ -40,7 +45,8 @@ import {
   decryptSymmetric128BitHexKeyUTF8,
   encryptSymmetric128BitHexKeyUTF8
 } from "../utils/crypto";
-import { TelemetryService } from "../services";
+import { EventService, TelemetryService } from "../services";
+import { eventPushSecrets } from "../events";
 import { client, getEncryptionKey, getRootEncryptionKey } from "../config";
 import { EEAuditLogService, EESecretService } from "../ee/services";
 import { getAuthDataPayloadUserObj } from "../utils/authn/helpers";
@@ -48,6 +54,148 @@ import { getFolderByPath, getFolderIdFromServiceToken } from "../services/Folder
 import picomatch from "picomatch";
 import path from "path";
 import { getAnImportedSecret } from "../services/SecretImportService";
+import { AuthData } from "../interfaces/middleware";
+import { 
+  ProjectPermissionActions, 
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../ee/services/ProjectRoleService";
+import { ForbiddenError, subject } from "@casl/ability";
+import { 
+  validateServiceTokenDataClientForWorkspace,
+  validateServiceTokenDataV3ClientForWorkspace
+} from "../validation";
+
+export const checkSecretsPermission = async ({
+  authData,
+  workspaceId,
+  environment,
+  secretPath,
+  secretAction
+}: {
+  authData: AuthData;
+  workspaceId: string;
+  environment: string;
+  secretPath: string;
+  secretAction: ProjectPermissionActions; // CRUD
+}): Promise<{
+  authVerifier: (env: string, secPath: string) => boolean;
+  membership?: Omit<IMembership, "customRole"> & { customRole: IRole };
+}> => {
+  let STV2RequiredPermissions = [];
+  let STV3RequiredPermissions: Permission[] = [];
+
+  switch (secretAction) {
+    case ProjectPermissionActions.Create:
+      STV2RequiredPermissions = [PERMISSION_WRITE_SECRETS];
+      STV3RequiredPermissions = [Permission.WRITE];
+      break;
+    case ProjectPermissionActions.Read:
+      STV2RequiredPermissions = [PERMISSION_READ_SECRETS];
+      STV3RequiredPermissions = [Permission.READ];
+      break;
+    case ProjectPermissionActions.Edit:
+      STV2RequiredPermissions = [PERMISSION_WRITE_SECRETS];
+      STV3RequiredPermissions = [Permission.WRITE];
+      break;
+    case ProjectPermissionActions.Delete:
+      STV2RequiredPermissions = [PERMISSION_WRITE_SECRETS];
+      STV3RequiredPermissions = [Permission.WRITE];
+      break;
+  }
+
+  switch (authData.actor.type) {
+    case ActorType.USER: {
+      const { permission, membership } = await getUserProjectPermissions(
+        authData.actor.metadata.userId,
+        workspaceId
+      );
+      ForbiddenError.from(permission).throwUnlessCan(
+        secretAction,
+        subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      );
+      return {
+        authVerifier: (env: string, secPath: string) =>
+          permission.can(
+            secretAction,
+            subject(ProjectPermissionSub.Secrets, {
+              environment: env,
+              secretPath: secPath
+            })
+          ),
+        membership
+      };
+    }
+    case ActorType.SERVICE: {
+      await validateServiceTokenDataClientForWorkspace({
+        serviceTokenData: authData.authPayload as IServiceTokenData,
+        workspaceId: new Types.ObjectId(workspaceId),
+        environment,
+        secretPath,
+        requiredPermissions: STV2RequiredPermissions
+      });
+      return { authVerifier: () => true };
+    }
+    case ActorType.SERVICE_V3: {
+      await validateServiceTokenDataV3ClientForWorkspace({
+        authData,
+        serviceTokenData: authData.authPayload as IServiceTokenDataV3,
+        workspaceId: new Types.ObjectId(workspaceId),
+        environment,
+        secretPath,
+        requiredPermissions: STV3RequiredPermissions
+      });
+      return {
+        authVerifier: (env: string, secPath: string) =>
+          isValidScopeV3({
+            authPayload: authData.authPayload as IServiceTokenDataV3,
+            environment: env,
+            secretPath: secPath,
+            requiredPermissions: STV3RequiredPermissions
+          })
+      };
+    }
+    default: {
+      throw UnauthorizedRequestError();
+    }
+  }
+};
+
+/**
+ * Validate scope for service token v3
+ * @param authPayload
+ * @param environment
+ * @param secretPath
+ * @returns
+ */
+export const isValidScopeV3 = ({
+  authPayload,
+  environment,
+  secretPath,
+  requiredPermissions
+}: {
+  authPayload: IServiceTokenDataV3;
+  environment: string;
+  secretPath: string;
+  requiredPermissions: Permission[];
+}) => {
+  const { scopes } = authPayload;
+
+  const validScope = scopes.find(
+    (scope) =>
+      picomatch.isMatch(secretPath, scope.secretPath, { strictSlashes: false }) &&
+      scope.environment === environment
+  );
+
+  if (
+    validScope &&
+    !requiredPermissions.every((permission) => validScope.permissions.includes(permission))
+  ) {
+    return false;
+  }
+
+  return Boolean(validScope);
+};
 
 /**
  * Validate scope for service token v2
@@ -81,13 +229,12 @@ const ERR_FOLDER_NOT_FOUND = BadRequestError({ message: "Folder not found" });
 
 /**
  * Returns an object containing secret [secret] but with its value, key, comment decrypted.
- *
  * Precondition: the workspace for secret [secret] must have E2EE disabled
  * @param {ISecret} secret - secret to repackage to raw
  * @param {String} key - symmetric key to use to decrypt secret
  * @returns
  */
-export const repackageSecretToRaw = ({ secret, key }: { secret: ISecret; key: string }) => {
+export const repackageSecretV3ToRaw = ({ secret, key }: { secret: ISecret; key: string }) => {
   const secretKey = decryptSymmetric128BitHexKeyUTF8({
     ciphertext: secret.secretKeyCiphertext,
     iv: secret.secretKeyIV,
@@ -122,7 +269,8 @@ export const repackageSecretToRaw = ({ secret, key }: { secret: ISecret; key: st
     user: secret.user,
     secretKey,
     secretValue,
-    secretComment
+    secretComment,
+    skipMultilineEncoding: secret.skipMultilineEncoding
   };
 };
 
@@ -479,6 +627,14 @@ export const createSecretHelper = async ({
     });
   }
 
+  await EventService.handleEvent({
+    event: eventPushSecrets({
+      workspaceId: new Types.ObjectId(workspaceId),
+      environment,
+      secretPath
+    })
+  });
+
   return secret;
 };
 
@@ -574,20 +730,18 @@ export const getSecretsHelper = async ({
     const approximateForNoneCapturedEvents = secrets.length * 10;
 
     if (shouldCapture) {
-      if (workspaceId.toString() != "650e71fbae3e6c8572f436d4") {
-        postHogClient.capture({
-          event: "secrets pulled",
-          distinctId: await TelemetryService.getDistinctId({ authData }),
-          properties: {
-            numberOfSecrets: shouldRecordK8Event ? approximateForNoneCapturedEvents : secrets.length,
-            environment,
-            workspaceId,
-            folderId,
-            channel: authData.userAgentType,
-            userAgent: authData.userAgent
-          }
-        });
-      }
+      postHogClient.capture({
+        event: "secrets pulled",
+        distinctId: await TelemetryService.getDistinctId({ authData }),
+        properties: {
+          numberOfSecrets: shouldRecordK8Event ? approximateForNoneCapturedEvents : secrets.length,
+          environment,
+          workspaceId,
+          folderId,
+          channel: authData.userAgentType,
+          userAgent: authData.userAgent
+        }
+      });
     }
   }
 
@@ -719,9 +873,7 @@ export const updateSecretHelper = async ({
   secretValueIV,
   secretValueTag,
   secretPath,
-  secretReminderRepeatDays,
-  secretReminderNote,
-  tags,
+  tags, // maybe this can accept just a secretComment?
   secretCommentCiphertext,
   secretCommentIV,
   secretCommentTag,
@@ -785,10 +937,6 @@ export const updateSecretHelper = async ({
         secretCommentIV,
         secretCommentTag,
         secretCommentCiphertext,
-
-        secretReminderRepeatDays,
-        secretReminderNote,
-
         skipMultilineEncoding,
         secretBlindIndex: newSecretNameBlindIndex,
         secretKeyIV,
@@ -820,6 +968,9 @@ export const updateSecretHelper = async ({
         secretKeyIV,
         secretKeyTag,
         secretKeyCiphertext,
+        secretCommentCiphertext,
+        secretCommentIV,
+        secretCommentTag,
         tags,
         skipMultilineEncoding,
         secretBlindIndex: newSecretNameBlindIndex,
@@ -847,9 +998,12 @@ export const updateSecretHelper = async ({
     secretKeyCiphertext: secret.secretKeyCiphertext,
     secretKeyIV: secret.secretKeyIV,
     secretKeyTag: secret.secretKeyTag,
-    secretValueCiphertext,
-    secretValueIV,
-    secretValueTag,
+    secretValueCiphertext: secret.secretValueCiphertext,
+    secretValueIV: secret.secretValueIV,
+    secretValueTag: secret.secretValueTag,
+    secretCommentCiphertext: secret.secretCommentCiphertext,
+    secretCommentIV: secret.secretCommentIV,
+    secretCommentTag: secret.secretCommentTag,
     skipMultilineEncoding,
     algorithm: ALGORITHM_AES_256_GCM,
     keyEncoding: ENCODING_SCHEME_UTF8
@@ -903,6 +1057,14 @@ export const updateSecretHelper = async ({
     });
   }
 
+  await EventService.handleEvent({
+    event: eventPushSecrets({
+      workspaceId: new Types.ObjectId(workspaceId),
+      environment,
+      secretPath
+    })
+  });
+
   return secret;
 };
 
@@ -1030,6 +1192,14 @@ export const deleteSecretHelper = async ({
     });
   }
 
+  await EventService.handleEvent({
+    event: eventPushSecrets({
+      workspaceId: new Types.ObjectId(workspaceId),
+      environment,
+      secretPath
+    })
+  });
+
   return {
     secrets,
     secret
@@ -1377,6 +1547,14 @@ export const createSecretBatchHelper = async ({
     });
   }
 
+  await EventService.handleEvent({
+    event: eventPushSecrets({
+      workspaceId: new Types.ObjectId(workspaceId),
+      environment,
+      secretPath
+    })
+  });
+
   return newlyCreatedSecrets;
 };
 
@@ -1572,6 +1750,14 @@ export const updateSecretBatchHelper = async ({
     });
   }
 
+  await EventService.handleEvent({
+    event: eventPushSecrets({
+      workspaceId: new Types.ObjectId(workspaceId),
+      environment,
+      secretPath
+    })
+  });
+
   return;
 };
 
@@ -1695,7 +1881,54 @@ export const deleteSecretBatchHelper = async ({
     });
   }
 
+  await EventService.handleEvent({
+    event: eventPushSecrets({
+      workspaceId: new Types.ObjectId(workspaceId),
+      environment,
+      secretPath
+    })
+  });
+
   return {
     secrets: deletedSecrets
   };
 };
+
+// --- v4/secrets helpers
+export const packageSecretV4 = ({
+  secret,
+  key
+}: {
+  secret: ISecret;
+  key: string;
+}) => {
+
+  const {
+    _id,
+    version,
+    workspace,
+    type,
+    environment,
+    user,
+    secretKey,
+    secretValue,
+    secretComment,
+    skipMultilineEncoding
+  } = repackageSecretV3ToRaw({
+    secret,
+    key
+  });
+
+  return ({
+    _id,
+    version,
+    projectId: workspace,
+    environmentSlug: environment,
+    type,
+    user,
+    secretName: secretKey,
+    secretValue,
+    secretComment,
+    skipMultilineEncoding
+  });
+}

backend/src/helpers/workspace.ts

@@ -3,7 +3,6 @@ import {
 	Bot,
 	BotKey,
 	Folder,
-	IdentityMembership,
 	Integration,
 	IntegrationAuth,
 	Key,
@@ -13,6 +12,8 @@ import {
 	SecretImport,
 	ServiceToken,
 	ServiceTokenData,
+	ServiceTokenDataV3,
+	ServiceTokenDataV3Key,
 	Tag,
 	Webhook,
 	Workspace
@@ -177,8 +178,12 @@ export const deleteWorkspace = async ({
 	await ServiceTokenData.deleteMany({
 		workspace: workspace._id
 	});
-	
-	await IdentityMembership.deleteMany({
+
+	await ServiceTokenDataV3.deleteMany({
+		workspace: workspace._id
+	});
+
+	await ServiceTokenDataV3Key.deleteMany({
 		workspace: workspace._id
 	});
 

backend/src/index.ts

@@ -2,10 +2,10 @@ import dotenv from "dotenv";
 dotenv.config();
 import express from "express";
 // eslint-disable-next-line @typescript-eslint/no-var-requires
-import "express-async-errors";
+require("express-async-errors");
 import helmet from "helmet";
 import cors from "cors";
-import { initLogger, logger } from "./utils/logging";
+import { logger } from "./utils/logging";
 import httpLogger from "pino-http";
 import { DatabaseService } from "./services";
 import { EELicenseService, GithubSecretScanningService } from "./ee/services";
@@ -25,7 +25,6 @@ import {
   secretSnapshot as eeSecretSnapshotRouter,
   users as eeUsersRouter,
   workspace as eeWorkspaceRouter,
-  identities as v1IdentitiesRouter,
   roles as v1RoleRouter,
   secretApprovalPolicy as v1SecretApprovalPolicyRouter,
   secretApprovalRequest as v1SecretApprovalRequestRouter,
@@ -34,6 +33,7 @@ import {
   secretScanning as v1SecretScanningRouter
 } from "./ee/routes/v1";
 import { apiKeyData as v3apiKeyDataRouter } from "./ee/routes/v3";
+import { serviceTokenData as v3ServiceTokenDataRouter } from "./ee/routes/v3";
 import {
   admin as v1AdminRouter,
   auth as v1AuthRouter,
@@ -52,7 +52,6 @@ import {
   secretsFolder as v1SecretsFolder,
   serviceToken as v1ServiceTokenRouter,
   signup as v1SignupRouter,
-  universalAuth as v1UniversalAuthRouter,
   userAction as v1UserActionRouter,
   user as v1UserRouter,
   webhooks as v1WebhooksRouter,
@@ -78,6 +77,9 @@ import {
   users as v3UsersRouter,
   workspaces as v3WorkspacesRouter
 } from "./routes/v3";
+import {
+  secrets as v4SecretsRouter
+} from "./routes/v4";
 import { healthCheck } from "./routes/status";
 // import { getLogger } from "./utils/logger";
 import { RouteNotFoundError } from "./utils/errors";
@@ -98,17 +100,13 @@ import { githubPushEventSecretScan } from "./queues/secret-scanning/githubScanPu
 const SmeeClient = require("smee-client"); // eslint-disable-line
 import path from "path";
 import { serverConfigInit } from "./config/serverConfig";
-import { initRedis } from "./services/RedisService";
 
 let handler: null | any = null;
 
 const main = async () => {
-  await initLogger();
-
   const port = await getPort();
 
-  // initializing the database connection + redis 
-  await initRedis()
+  // initializing the database connection
   await DatabaseService.initDatabase(await getMongoURL());
   const serverCfg = await serverConfigInit();
   await setup();
@@ -199,7 +197,6 @@ const main = async () => {
   }
 
   // (EE) routes
-  app.use("/api/v1/identities", v1IdentitiesRouter);
   app.use("/api/v1/secret", eeSecretRouter);
   app.use("/api/v1/secret-snapshot", eeSecretSnapshotRouter);
   app.use("/api/v1/users", eeUsersRouter);
@@ -207,14 +204,14 @@ const main = async () => {
   app.use("/api/v1/organizations", eeOrganizationsRouter);
   app.use("/api/v1/sso", eeSSORouter);
   app.use("/api/v1/cloud-products", eeCloudProductsRouter);
-  app.use("/api/v3/api-key", v3apiKeyDataRouter);
+  app.use("/api/v3/api-key", v3apiKeyDataRouter); // new
+  app.use("/api/v3/service-token", v3ServiceTokenDataRouter); // new
   app.use("/api/v1/secret-rotation-providers", v1SecretRotationProviderRouter);
   app.use("/api/v1/secret-rotations", v1SecretRotation);
 
   // v1 routes
   app.use("/api/v1/signup", v1SignupRouter);
   app.use("/api/v1/auth", v1AuthRouter);
-  app.use("/api/v1/auth", v1UniversalAuthRouter); // new
   app.use("/api/v1/admin", v1AdminRouter);
   app.use("/api/v1/bot", v1BotRouter);
   app.use("/api/v1/user", v1UserRouter);
@@ -222,7 +219,7 @@ const main = async () => {
   app.use("/api/v1/organization", v1OrganizationRouter);
   app.use("/api/v1/workspace", v1WorkspaceRouter);
   app.use("/api/v1/membership-org", v1MembershipOrgRouter);
-  app.use("/api/v1/membership", v1MembershipRouter);
+  app.use("/api/v1/membership", v1MembershipRouter); //
   app.use("/api/v1/key", v1KeyRouter);
   app.use("/api/v1/invite-org", v1InviteOrgRouter);
   app.use("/api/v1/secret", v1SecretRouter); // deprecate
@@ -249,7 +246,7 @@ const main = async () => {
   app.use("/api/v2/workspace", v2TagsRouter);
   app.use("/api/v2/workspace", v2WorkspaceRouter);
   app.use("/api/v2/secret", v2SecretRouter); // deprecate
-  app.use("/api/v2/secrets", v2SecretsRouter);
+  app.use("/api/v2/secrets", v2SecretsRouter); // note: in the process of moving to v3/secrets
   app.use("/api/v2/service-token", v2ServiceTokenDataRouter);
 
   // v3 routes (experimental)
@@ -258,6 +255,9 @@ const main = async () => {
   app.use("/api/v3/workspaces", v3WorkspacesRouter);
   app.use("/api/v3/signup", v3SignupRouter);
   app.use("/api/v3/us", v3UsersRouter);
+  
+  // v4 routes (user-facing)
+  app.use("/api/v4/secrets", v4SecretsRouter);
 
   // api docs
   app.use("/api-docs", swaggerUi.serve, swaggerUi.setup(swaggerFile));

backend/src/integrations/apps.ts

@@ -10,8 +10,6 @@ import {
   INTEGRATION_CIRCLECI_API_URL,
   INTEGRATION_CLOUDFLARE_PAGES,
   INTEGRATION_CLOUDFLARE_PAGES_API_URL,
-  INTEGRATION_CLOUDFLARE_WORKERS,
-  INTEGRATION_CLOUDFLARE_WORKERS_API_URL,
   INTEGRATION_CLOUD_66,
   INTEGRATION_CLOUD_66_API_URL,
   INTEGRATION_CODEFRESH,
@@ -188,12 +186,6 @@ const getApps = async ({
         accountId: accessId
       });
       break;
-    case INTEGRATION_CLOUDFLARE_WORKERS:
-      apps = await getAppsCloudflareWorkers({
-        accessToken,
-        accountId: accessId
-      });
-      break;
     case INTEGRATION_NORTHFLANK:
       apps = await getAppsNorthflank({
         accessToken
@@ -976,40 +968,6 @@ const getAppsCloudflarePages = async ({
   return apps;
 };
 
-/**
- * Return list of projects for the Cloudflare Workers integration
- * @param {Object} obj
- * @param {String} obj.accessToken - api key for the Cloudflare API
- * @returns {Object[]} apps - Cloudflare Workers projects
- * @returns {String} apps.id - Id of Cloudflare Workers project
- * @returns {String} apps.name - Id of Cloudflare Workers project (Cloudflare workers API does not return the name)
- */
-const getAppsCloudflareWorkers = async ({
-  accessToken,
-  accountId
-}: {
-  accessToken: string;
-  accountId?: string;
-}) => {
-  const { data } = await standardRequest.get(
-    `${INTEGRATION_CLOUDFLARE_WORKERS_API_URL}/client/v4/accounts/${accountId}/workers/services`,
-    {
-      headers: {
-        Authorization: `Bearer ${accessToken}`,
-        Accept: "application/json"
-      }
-    }
-  );
-
-  const apps = data.result.map((a: any) => {
-    return {
-      name: a.id,
-      appId: a.id
-    };
-  });
-  return apps;
-};
-
 /**
  * Return list of repositories for the BitBucket integration based on provided BitBucket workspace
  * @param {Object} obj

backend/src/integrations/sync.ts

@@ -18,8 +18,6 @@ import {
   INTEGRATION_CIRCLECI_API_URL,
   INTEGRATION_CLOUDFLARE_PAGES,
   INTEGRATION_CLOUDFLARE_PAGES_API_URL,
-  INTEGRATION_CLOUDFLARE_WORKERS,
-  INTEGRATION_CLOUDFLARE_WORKERS_API_URL,
   INTEGRATION_CLOUD_66,
   INTEGRATION_CLOUD_66_API_URL,
   INTEGRATION_CODEFRESH,
@@ -264,14 +262,6 @@ const syncSecrets = async ({
         accessToken
       });
       break;
-    case INTEGRATION_CLOUDFLARE_WORKERS:
-      await syncSecretsCloudflareWorkers({
-        integration,
-        secrets,
-        accessId,
-        accessToken
-      });
-      break;
     case INTEGRATION_CODEFRESH:
       await syncSecretsCodefresh({
         integration,
@@ -2756,98 +2746,6 @@ const syncSecretsCloudflarePages = async ({
   );
 };
 
-/**
- * Sync/push [secrets] to Cloudflare Workers project with name [integration.app]
- * @param {Object} obj
- * @param {IIntegration} obj.integration - integration details
- * @param {Object} obj.secrets - secrets to push to integration (object where keys are secret keys and values are secret values)
- * @param {String} obj.accessToken - API token for Cloudflare workers
- */
-const syncSecretsCloudflareWorkers = async ({
-  integration,
-  secrets,
-  accessId,
-  accessToken
-}: {
-  integration: IIntegration;
-  secrets: Record<string, { value: string; comment?: string }>;
-  accessId: string | null;
-  accessToken: string;
-}) => {
-  // get secrets from cloudflare workers
-  const getSecretsRes = (
-    await standardRequest.get(
-      `${INTEGRATION_CLOUDFLARE_WORKERS_API_URL}/client/v4/accounts/${accessId}/workers/scripts/${integration.app}/secrets`,
-      {
-        headers: {
-          Authorization: `Bearer ${accessToken}`,
-          Accept: "application/json"
-        }
-      }
-    )
-  ).data.result;
-
-  const secretsObj: any = getSecretKeyValuePair(secrets);
-
-  for (const [key, val] of Object.entries(secretsObj)) {
-    secretsObj[key] = { type: "secret_text", value: val };
-  }
-
-  // get deleted secrets list
-  const deletedSecretKeys: string[] = [];
-  if (getSecretsRes) {
-    getSecretsRes.forEach((secretRes: any) => {
-      if (!(Object.keys(secrets).includes(secretRes.name))) {
-        deletedSecretKeys.push(secretRes.name);
-      }
-    })
-  }
-
-  deletedSecretKeys.forEach(async (secretKey) => {
-    await standardRequest.delete(
-      `${INTEGRATION_CLOUDFLARE_WORKERS_API_URL}/client/v4/accounts/${accessId}/workers/scripts/${integration.app}/secrets/${secretKey}`,
-      {
-        headers: {
-          Authorization: `Bearer ${accessToken}`,
-          Accept: "application/json"
-        }
-      }
-    );
-  });
-
-  interface ConvertedSecret {
-    name: string;
-    text: string;
-    type: string;
-  }
-
-  interface SecretsObj {
-    [key: string]: {
-      type: string;
-      value: string;
-    };
-  }
-
-  const data: ConvertedSecret[] = Object.entries(secretsObj as SecretsObj).map(([name, secret]) => ({
-    name,
-    text: secret.value,
-    type: "secret_text"
-  }));
-
-  data.forEach(async (secret) => {
-    await standardRequest.put(
-      `${INTEGRATION_CLOUDFLARE_WORKERS_API_URL}/client/v4/accounts/${accessId}/workers/scripts/${integration.app}/secrets`,
-      secret,
-      {
-        headers: {
-          Authorization: `Bearer ${accessToken}`,
-          Accept: "application/json"
-        }
-      }
-    );
-  })
-};
-
 /**
  * Sync/push [secrets] to BitBucket repo with name [integration.app]
  * @param {Object} obj

backend/src/interfaces/middleware/index.ts

@@ -1,6 +1,6 @@
 import { Types } from "mongoose";
-import { IIdentity, IServiceTokenData, IUser } from "../../models";
-import { IdentityActor, ServiceActor, UserActor, UserAgentType } from "../../ee/models";
+import { IServiceTokenData, IServiceTokenDataV3, IUser } from "../../models";
+import { ServiceActor, ServiceActorV3, UserActor, UserAgentType } from "../../ee/models";
 
 interface BaseAuthData {
   ipAddress: string;
@@ -14,9 +14,9 @@ export interface UserAuthData extends BaseAuthData {
   authPayload: IUser;
 }
 
-export interface IdentityAuthData extends BaseAuthData {
-  actor: IdentityActor;
-  authPayload: IIdentity;
+export interface ServiceTokenV3AuthData extends BaseAuthData {
+  actor: ServiceActorV3;
+  authPayload: IServiceTokenDataV3;
 }
 
 export interface ServiceTokenAuthData extends BaseAuthData {
@@ -24,4 +24,4 @@ export interface ServiceTokenAuthData extends BaseAuthData {
   authPayload: IServiceTokenData;
 }
 
-export type AuthData = UserAuthData | IdentityAuthData | ServiceTokenAuthData;
+export type AuthData = UserAuthData | ServiceTokenV3AuthData | ServiceTokenAuthData;

backend/src/interfaces/services/SecretService/index.ts

@@ -51,17 +51,13 @@ export interface UpdateSecretParams {
   environment: string;
   type: "shared" | "personal";
   authData: AuthData;
-  secretValueCiphertext: string;
-  secretValueIV: string;
-  secretValueTag: string;
+  secretValueCiphertext?: string;
+  secretValueIV?: string;
+  secretValueTag?: string;
   secretPath: string;
   secretCommentCiphertext?: string;
   secretCommentIV?: string;
   secretCommentTag?: string;
-
-  secretReminderRepeatDays?: number | null;
-  secretReminderNote?: string | null;
-
   skipMultilineEncoding?: boolean;
   tags?: string[];
 }

backend/src/middleware/requestErrorHandler.ts

@@ -15,7 +15,7 @@ export const requestErrorHandler: ErrorRequestHandler = async (
   if (res.headersSent) return next();
 
   let error: RequestError;
-
+  
   switch (true) {
     case err instanceof TokenExpiredError:
       error = UnauthorizedRequestError({ stack: err.stack, message: "Token expired" });
@@ -31,7 +31,7 @@ export const requestErrorHandler: ErrorRequestHandler = async (
       break;
   }
 
-  logger[mapToPinoLogLevel(error.level)]({ msg: error });
+  logger[mapToPinoLogLevel(error.level)](error);
 
   if (req.user) {
     Sentry.setUser({ email: (req.user as any).email });
@@ -39,9 +39,8 @@ export const requestErrorHandler: ErrorRequestHandler = async (
 
   Sentry.captureException(error);
 
-  res.status((<RequestError>error).statusCode).send(
-    await error.format(req)
-  );
+  delete (<any>error).stacktrace // remove stack trace from being sent to client
+  res.status((<RequestError>error).statusCode).json(error); // revise json part here
 
   next();
 };

backend/src/middleware/requireAuth.ts

@@ -50,7 +50,7 @@ const requireAuth = ({
 			case AuthMode.SERVICE_TOKEN:
 				req.serviceTokenData = authData.authPayload;
 				break;
-			case AuthMode.IDENTITY_ACCESS_TOKEN:
+			case AuthMode.SERVICE_ACCESS_TOKEN:
 				req.serviceTokenData = authData.authPayload;
 				break;
 			case AuthMode.API_KEY:

backend/src/models/identity.ts

@@ -1,38 +0,0 @@
-import { Document, Schema, Types, model } from "mongoose";
-import { IPType } from "../ee/models";
-
-export interface IIdentityTrustedIp {
-    ipAddress: string;
-    type: IPType;
-    prefix: number;
-}
-
-export enum IdentityAuthMethod {
-    UNIVERSAL_AUTH = "universal-auth"
-}
-
-export interface IIdentity extends Document {
-    _id: Types.ObjectId;
-    name: string;
-    authMethod?: IdentityAuthMethod;
-}
-
-const identitySchema = new Schema(
-    {
-        name: {
-            type: String,
-            required: true
-        },
-        authMethod: {
-            type: String,
-            enum: IdentityAuthMethod,
-            required: false,
-        },
-        
-    },
-    {
-        timestamps: true
-    }
-);
-
-export const Identity = model<IIdentity>("Identity", identitySchema);

backend/src/models/identityAccessToken.ts

@@ -1,104 +0,0 @@
-import { Document, Schema, Types, model } from "mongoose";
-import { IIdentityTrustedIp } from "./identity";
-import { IPType } from "../ee/models/trustedIp";
-
-export interface IIdentityAccessToken extends Document {
-    _id: Types.ObjectId;
-    identity: Types.ObjectId;
-    identityUniversalAuthClientSecret?: Types.ObjectId;
-    accessTokenLastUsedAt?: Date;
-    accessTokenLastRenewedAt?: Date;
-    accessTokenNumUses: number;
-    accessTokenNumUsesLimit: number;
-    accessTokenTTL: number;
-    accessTokenMaxTTL: number;
-    accessTokenTrustedIps: Array<IIdentityTrustedIp>;
-    isAccessTokenRevoked: boolean;
-    updatedAt: Date;
-    createdAt: Date;
-}
-
-const identityAccessTokenSchema = new Schema(
-    {
-        identity: {
-            type: Schema.Types.ObjectId,
-            ref: "Identity",
-            required: false
-        },
-        identityUniversalAuthClientSecret: {
-            type: Schema.Types.ObjectId,
-            ref: "IdentityUniversalAuthClientSecret",
-            required: false
-        },
-        accessTokenLastUsedAt: {
-            type: Date,
-            required: false
-        },
-        accessTokenLastRenewedAt: {
-            type: Date,
-            required: false
-        },
-        accessTokenNumUses: {
-            // number of times access token has been used
-            type: Number,
-            default: 0,
-            required: true
-        },
-        accessTokenNumUsesLimit: {
-            // number of times access token can be used for
-            type: Number,
-            default: 0, // default: used as many times as needed
-            required: true
-        },
-        accessTokenTTL: { // seconds
-            // incremental lifetime
-            type: Number,
-            default: 2592000, // 30 days
-            required: true
-        },
-        accessTokenMaxTTL: { // seconds
-            // max lifetime
-            type: Number,
-            default: 2592000, // 30 days 
-            required: true
-        },
-        accessTokenTrustedIps: {
-            type: [
-                {
-                    ipAddress: {
-                        type: String,
-                        required: true
-                    },
-                    type: {
-                        type: String,
-                        enum: [
-                            IPType.IPV4,
-                            IPType.IPV6
-                        ],
-                        required: true
-                    },
-                    prefix: {
-                        type: Number,
-                        required: false
-                    }
-                }
-            ],
-            default: [{
-                ipAddress: "0.0.0.0",
-                type: IPType.IPV4.toString(),
-                prefix: 0
-            }],
-            required: true
-        },
-        isAccessTokenRevoked: {
-            type: Boolean,
-            default: false,
-            required: true
-        },
-    },
-    {
-        timestamps: true
-    }
-);
-
-export const IdentityAccessToken = model<IIdentityAccessToken>("IdentityAccessToken", identityAccessTokenSchema);

backend/src/models/identityMembership.ts

@@ -1,39 +0,0 @@
-import { Schema, Types, model } from "mongoose";
-import { ADMIN, CUSTOM, MEMBER, NO_ACCESS, VIEWER } from "../variables";
-
-export interface IIdentityMembership {
-  _id: Types.ObjectId;
-  identity: Types.ObjectId;
-  workspace: Types.ObjectId;
-  role: "admin" | "member" | "viewer" | "no-access" | "custom";
-  customRole: Types.ObjectId;
-}
-
-const identityMembershipSchema = new Schema<IIdentityMembership>(
-  {
-    identity: {
-      type: Schema.Types.ObjectId,
-      ref: "Identity"
-    },
-    workspace: {
-      type: Schema.Types.ObjectId,
-      ref: "Workspace",
-      required: true,
-      index: true,
-    },
-    role: {
-      type: String,
-      enum: [ADMIN, MEMBER, VIEWER, CUSTOM, NO_ACCESS],
-      required: true
-    },
-    customRole: {
-      type: Schema.Types.ObjectId,
-      ref: "Role"
-    }
-  },
-  {
-    timestamps: true
-  }
-);
-
-export const IdentityMembership = model<IIdentityMembership>("IdentityMembership", identityMembershipSchema);

backend/src/models/identityMembershipOrg.ts

@@ -1,37 +0,0 @@
-import { Schema, Types, model } from "mongoose";
-import { ADMIN, CUSTOM, MEMBER, NO_ACCESS} from "../variables";
-
-export interface IIdentityMembershipOrg {
-  _id: Types.ObjectId;
-  identity: Types.ObjectId;
-  organization: Types.ObjectId;
-  role: "admin" | "member" | "no-access" | "custom";
-  customRole: Types.ObjectId;
-}
-
-const identityMembershipOrgSchema = new Schema<IIdentityMembershipOrg>(
-  {
-    identity: {
-      type: Schema.Types.ObjectId,
-      ref: "Identity"
-    },
-    organization: {
-      type: Schema.Types.ObjectId,
-      ref: "Organization"
-    },
-    role: {
-      type: String,
-      enum: [ADMIN, MEMBER, NO_ACCESS, CUSTOM],
-      required: true
-    },
-    customRole: {
-      type: Schema.Types.ObjectId,
-      ref: "Role"
-    }
-  },
-  {
-    timestamps: true
-  }
-);
-
-export const IdentityMembershipOrg = model<IIdentityMembershipOrg>("IdentityMembershipOrg", identityMembershipOrgSchema);

backend/src/models/identityUniversalAuth.ts

@@ -1,107 +0,0 @@
-import { Document, Schema, Types, model } from "mongoose";
-import { IPType } from "../ee/models";
-import { IIdentityTrustedIp } from "./identity";
-
-export interface IIdentityUniversalAuth extends Document {
-    _id: Types.ObjectId;
-    identity: Types.ObjectId;
-    clientId: string;
-    clientSecretTrustedIps: Array<IIdentityTrustedIp>;
-    accessTokenTTL: number;
-    accessTokenMaxTTL: number;
-    accessTokenNumUsesLimit: number;
-    accessTokenTrustedIps: Array<IIdentityTrustedIp>;
-}
-
-const identityUniversalAuthSchema = new Schema(
-    {
-        identity: {
-            type: Schema.Types.ObjectId,
-            ref: "Identity",
-            required: true
-        },
-        clientId: {
-            type: String,
-            required: true
-        },
-        clientSecretTrustedIps: {
-            type: [
-                {
-                    ipAddress: {
-                        type: String,
-                        required: true
-                    },
-                    type: {
-                        type: String,
-                        enum: [
-                            IPType.IPV4,
-                            IPType.IPV6
-                        ],
-                        required: true
-                    },
-                    prefix: {
-                        type: Number,
-                        required: false
-                    }
-                }
-            ],
-            default: [{
-                ipAddress: "0.0.0.0",
-                type: IPType.IPV4.toString(),
-                prefix: 0
-            }],
-            required: true
-        },
-        accessTokenTTL: { // seconds
-            // incremental lifetime
-            type: Number,
-            default: 7200,
-            required: true
-        },
-        accessTokenMaxTTL: { // seconds
-            // max lifetime
-            type: Number,
-            default: 7200,
-            required: true
-        },
-        accessTokenNumUsesLimit: {
-            // number of times access token can be used for
-            type: Number,
-            default: 0, // default: used as many times as needed
-            required: true
-        },
-        accessTokenTrustedIps: {
-            type: [
-                {
-                    ipAddress: {
-                        type: String,
-                        required: true
-                    },
-                    type: {
-                        type: String,
-                        enum: [
-                            IPType.IPV4,
-                            IPType.IPV6
-                        ],
-                        required: true
-                    },
-                    prefix: {
-                        type: Number,
-                        required: false
-                    }
-                }
-            ],
-            default: [{
-                ipAddress: "0.0.0.0",
-                type: IPType.IPV4.toString(),
-                prefix: 0
-            }],
-            required: true
-        }
-    },
-    {
-        timestamps: true
-    }
-);
-
-export const IdentityUniversalAuth = model<IIdentityUniversalAuth>("IdentityUniversalAuth", identityUniversalAuthSchema);

backend/src/models/identityUniversalAuthClientSecret.ts

@@ -1,81 +0,0 @@
-import { Document, Schema, Types, model } from "mongoose";
-
-export interface IIdentityUniversalAuthClientSecret extends Document {
-    _id: Types.ObjectId;
-    identity: Types.ObjectId;
-    identityUniversalAuth : Types.ObjectId;
-    description: string;
-    clientSecretPrefix: string;
-    clientSecretHash: string;
-    clientSecretLastUsedAt?: Date;
-    clientSecretNumUses: number;
-    clientSecretNumUsesLimit: number;
-    clientSecretTTL: number;
-    updatedAt: Date;
-    createdAt: Date;
-    isClientSecretRevoked: boolean;
-}
-
-const identityUniversalAuthClientSecretSchema = new Schema(
-    {
-        identity: {
-            type: Schema.Types.ObjectId,
-            ref: "Identity",
-            required: true
-        },
-        identityUniversalAuth: {
-            type: Schema.Types.ObjectId,
-            ref: "IdentityUniversalAuth",
-            required: true
-        },
-        description: {
-            type: String,
-            required: true
-        },
-        clientSecretPrefix: {
-            type: String,
-            required: true
-        },
-        clientSecretHash: {
-            type: String,
-            required: true
-        },
-        clientSecretLastUsedAt: {
-            type: Date,
-            required: false
-        },
-        clientSecretNumUses: {
-            // number of times client secret has been used
-            // in login operation
-            type: Number,
-            default: 0,
-            required: true
-        },
-        clientSecretNumUsesLimit: {
-            // number of times client secret can be used for
-            // a login operation
-            type: Number,
-            default: 0, // default: used as many times as needed
-            required: true
-        },
-        clientSecretTTL: {
-            type: Number,
-            default: 0, // default: does not expire
-            required: true
-        },
-        isClientSecretRevoked: {
-            type: Boolean,
-            default: false,
-            required: true
-        }
-    },
-    {
-        timestamps: true
-    }
-);
-
-identityUniversalAuthClientSecretSchema.index(
-    { identityUniversalAuth: 1, isClientSecretRevoked: 1 }
-);
-
-export const IdentityUniversalAuthClientSecret = model<IIdentityUniversalAuthClientSecret>("IdentityUniversalAuthClientSecret", identityUniversalAuthClientSecretSchema);

backend/src/models/index.ts

@@ -20,15 +20,8 @@ export * from "./user";
 export * from "./userAction";
 export * from "./workspace";
 export * from "./serviceTokenData"; // TODO: deprecate
-
-// new
-export * from "./identity";
-export * from "./identityMembership";
-export * from "./identityMembershipOrg";
-export * from "./identityUniversalAuth";
-export * from "./identityUniversalAuthClientSecret";
-export * from "./identityAccessToken";
-
+export * from "./serviceTokenDataV3";
+export * from "./serviceTokenDataV3Key";
 export * from "./apiKeyData"; // TODO: deprecate
 export * from "./apiKeyDataV2";
 export * from "./loginSRPDetail";

backend/src/models/integration/integration.ts

@@ -6,7 +6,6 @@ import {
   INTEGRATION_CHECKLY,
   INTEGRATION_CIRCLECI,
   INTEGRATION_CLOUDFLARE_PAGES,
-  INTEGRATION_CLOUDFLARE_WORKERS,
   INTEGRATION_CLOUD_66,
   INTEGRATION_CODEFRESH,
   INTEGRATION_DIGITAL_OCEAN_APP_PLATFORM,
@@ -72,7 +71,6 @@ export interface IIntegration {
     | "teamcity"
     | "hashicorp-vault"
     | "cloudflare-pages"
-    | "cloudflare-workers"
     | "bitbucket"
     | "codefresh"
     | "digital-ocean-app-platform"
@@ -181,7 +179,6 @@ const integrationSchema = new Schema<IIntegration>(
         INTEGRATION_TEAMCITY,
         INTEGRATION_HASHICORP_VAULT,
         INTEGRATION_CLOUDFLARE_PAGES,
-        INTEGRATION_CLOUDFLARE_WORKERS,
         INTEGRATION_CODEFRESH,
         INTEGRATION_WINDMILL,
         INTEGRATION_BITBUCKET,

backend/src/models/integrationAuth/integrationAuth.ts

@@ -8,7 +8,6 @@ import {
   INTEGRATION_BITBUCKET,
   INTEGRATION_CIRCLECI,
   INTEGRATION_CLOUDFLARE_PAGES,
-  INTEGRATION_CLOUDFLARE_WORKERS,
   INTEGRATION_CLOUD_66,
   INTEGRATION_CODEFRESH,
   INTEGRATION_DIGITAL_OCEAN_APP_PLATFORM,
@@ -56,7 +55,6 @@ export interface IIntegrationAuth extends Document {
     | "checkly"
     | "qovery"
     | "cloudflare-pages"
-    | "cloudflare-workers"
     | "codefresh"
     | "digital-ocean-app-platform"
     | "bitbucket"
@@ -115,7 +113,6 @@ const integrationAuthSchema = new Schema<IIntegrationAuth>(
         INTEGRATION_TERRAFORM_CLOUD,
         INTEGRATION_HASHICORP_VAULT,
         INTEGRATION_CLOUDFLARE_PAGES,
-        INTEGRATION_CLOUDFLARE_WORKERS,
         INTEGRATION_CODEFRESH,
         INTEGRATION_WINDMILL,
         INTEGRATION_BITBUCKET,

backend/src/models/membership.ts

@@ -1,5 +1,5 @@
 import { Schema, Types, model } from "mongoose";
-import { ADMIN, CUSTOM, MEMBER, NO_ACCESS, VIEWER } from "../variables";
+import { ADMIN, CUSTOM, MEMBER, VIEWER } from "../variables";
 
 export interface IMembershipPermission {
   environmentSlug: string;
@@ -11,7 +11,7 @@ export interface IMembership {
   user: Types.ObjectId;
   inviteEmail?: string;
   workspace: Types.ObjectId;
-  role: "admin" | "member" | "viewer" | "no-access" | "custom";
+  role: "admin" | "member" | "viewer" | "custom";
   customRole: Types.ObjectId;
   deniedPermissions: IMembershipPermission[];
 }
@@ -44,7 +44,7 @@ const membershipSchema = new Schema<IMembership>(
     },
     role: {
       type: String,
-      enum: [ADMIN, MEMBER, VIEWER, NO_ACCESS, CUSTOM],
+      enum: [ADMIN, MEMBER, VIEWER, CUSTOM],
       required: true
     },
     customRole: {

backend/src/models/membershipOrg.ts

@@ -1,12 +1,12 @@
 import { Document, Schema, Types, model } from "mongoose";
-import { ACCEPTED, ADMIN, CUSTOM, INVITED, MEMBER, NO_ACCESS } from "../variables";
+import { ACCEPTED, ADMIN, CUSTOM, INVITED, MEMBER } from "../variables";
 
 export interface IMembershipOrg extends Document {
   _id: Types.ObjectId;
   user: Types.ObjectId;
   inviteEmail: string;
   organization: Types.ObjectId;
-  role: "admin" | "member" | "no-access" | "custom";
+  role: "owner" | "admin" | "member" | "custom";
   customRole: Types.ObjectId;
   status: "invited" | "accepted";
 }
@@ -26,7 +26,7 @@ const membershipOrgSchema = new Schema(
     },
     role: {
       type: String,
-      enum: [ADMIN, MEMBER, NO_ACCESS, CUSTOM],
+      enum: [ADMIN, MEMBER, CUSTOM],
       required: true
     },
     status: {

backend/src/models/secret.ts

@@ -27,12 +27,6 @@ export interface ISecret {
   secretCommentIV?: string;
   secretCommentTag?: string;
   secretCommentHash?: string;
-
-  // ? NOTE: This works great for workspace-level reminders.
-  // ? If we want to do it on a user-basis, we should ideally have a seperate model for reminders.
-  secretReminderRepeatDays?: number | null;
-  secretReminderNote?: string | null;
-
   skipMultilineEncoding?: boolean;
   algorithm: "aes-256-gcm";
   keyEncoding: "utf8" | "base64";
@@ -124,23 +118,11 @@ const secretSchema = new Schema<ISecret>(
       type: String,
       required: false
     },
-
-    secretReminderRepeatDays: {
-      type: Number,
-      required: false,
-      default: null
-    },
-    secretReminderNote: {
-      type: String,
-      required: false,
-      default: null
-    },
-
     skipMultilineEncoding: {
       type: Boolean,
+      default: false,
       required: false
     },
-
     algorithm: {
       // the encryption algorithm used
       type: String,

backend/src/models/serviceTokenDataV3.ts

@@ -0,0 +1,159 @@
+import { Document, Schema, Types, model } from "mongoose";
+import { IPType } from "../ee/models";
+
+export enum Permission {
+    READ = "read",
+    WRITE = "write"
+}
+
+export interface IServiceTokenV3Scope {
+    environment: string;
+    secretPath: string;
+    permissions: Permission[];
+}
+
+export interface IServiceTokenV3TrustedIp {
+    ipAddress: string;
+    type: IPType;
+    prefix: number;
+}
+
+export interface IServiceTokenDataV3 extends Document {
+    _id: Types.ObjectId;
+    name: string;
+    workspace: Types.ObjectId;
+    user: Types.ObjectId;
+    publicKey: string;
+    isActive: boolean;
+    refreshTokenLastUsed?: Date;
+    accessTokenLastUsed?: Date;
+    refreshTokenUsageCount: number;
+    accessTokenUsageCount: number;
+    tokenVersion: number;
+    isRefreshTokenRotationEnabled: boolean;
+    expiresAt?: Date;
+    accessTokenTTL: number;
+    scopes: Array<IServiceTokenV3Scope>;
+    trustedIps: Array<IServiceTokenV3TrustedIp>;
+}
+
+const serviceTokenDataV3Schema = new Schema(
+    {
+        name: {
+            type: String,
+            required: true
+        },
+        workspace: {
+            type: Schema.Types.ObjectId,
+            ref: "Workspace",
+            required: true
+        },
+        user: {
+            type: Schema.Types.ObjectId,
+            ref: "User",
+            required: true
+        },
+        publicKey: {
+            type: String,
+            required: true
+        },
+        isActive: {
+            type: Boolean,
+            default: true,
+            required: true
+        },
+        refreshTokenLastUsed: {
+            type: Date,
+            required: false
+        },
+        accessTokenLastUsed: {
+            type: Date,
+            required: false
+        },
+        refreshTokenUsageCount: {
+            type: Number,
+            default: 0,
+            required: true
+        },
+        accessTokenUsageCount: {
+            type: Number,
+            default: 0,
+            required: true
+        },
+        tokenVersion: {
+            type: Number,
+            default: 1,
+            required: true
+        },
+        isRefreshTokenRotationEnabled: {
+            type: Boolean,
+            default: false,
+            required: true
+        },
+        expiresAt: { // consider revising field name
+            type: Date,
+            required: false,
+            // expires: 0
+        },
+        accessTokenTTL: { // seconds
+            type: Number,
+            default: 7200,
+            required: true
+        },
+        scopes: {
+            type: [
+                {
+                    environment: {
+                        type: String,
+                        required: true
+                    },
+                    secretPath: {
+                        type: String,
+                        default: "/",
+                        required: true
+                    },
+                    permissions: {
+                        type: [String],
+                        enum: [Permission.READ, Permission.WRITE],
+                        default: [Permission.READ],
+                        required: true
+                    }
+                }
+            ],
+            required: true
+        },
+        trustedIps: {
+            type: [
+                {
+                    ipAddress: {
+                        type: String,
+                        required: true
+                    },
+                    type: {
+                        type: String,
+                        enum: [
+                            IPType.IPV4,
+                            IPType.IPV6
+                        ],
+                        required: true
+                    },
+                    prefix: {
+                        type: Number,
+                        required: false
+                    }
+                }
+            ],
+            default: [{
+                ipAddress: "0.0.0.0",
+                type: IPType.IPV4.toString(),
+                prefix: 0
+            }],
+            required: true
+        }
+    },
+    {
+        timestamps: true
+    }
+);
+
+export const ServiceTokenDataV3 = model<IServiceTokenDataV3>("ServiceTokenDataV3", serviceTokenDataV3Schema);

backend/src/models/serviceTokenDataV3Key.ts

@@ -0,0 +1,43 @@
+import { Document, Schema, Types, model } from "mongoose";
+
+export interface IServiceTokenDataV3Key extends Document {
+	_id: Types.ObjectId;
+	encryptedKey: string;
+	nonce: string;
+    sender: Types.ObjectId;
+    serviceTokenData: Types.ObjectId;
+	workspace: Types.ObjectId;
+}
+
+const serviceTokenDataV3KeySchema = new Schema(
+    {
+        encryptedKey: {
+            type: String,
+            required: true
+        },
+        nonce: {
+            type: String,
+            required: true
+        },
+        sender: {
+            type: Schema.Types.ObjectId,
+            ref: "User",
+            required: true
+        },
+        serviceTokenData: {
+			type: Schema.Types.ObjectId,
+			ref: "ServiceTokenDataV3",
+			required: true,
+        },
+		workspace: {
+			type: Schema.Types.ObjectId,
+			ref: "Workspace",
+			required: true,
+		}
+    },
+    {
+        timestamps: true
+    }
+);
+
+export const ServiceTokenDataV3Key = model<IServiceTokenDataV3Key>("ServiceTokenDataV3Key", serviceTokenDataV3KeySchema);

backend/src/queues/reminders/sendSecretReminders.ts

@@ -1,83 +0,0 @@
-import Queue, { Job } from "bull";
-import { IUser, Membership, Organization, Workspace } from "../../models";
-import { Types } from "mongoose";
-import { sendMail } from "../../helpers";
-
-type TSendSecretReminders = {
-  workspaceId: string;
-  secretId: string;
-  repeatDays: number;
-  note: string | undefined | null;
-};
-
-type TDeleteSecretReminder = {
-  secretId: string;
-  repeatDays: number;
-};
-
-const DAY_IN_MS = 86400000;
-
-export const sendSecretReminders = new Queue(
-  "send-secret-reminders",
-  process.env.REDIS_URL as string
-);
-
-sendSecretReminders.process(async (job: Job<TSendSecretReminders>) => {
-  const { workspaceId }: TSendSecretReminders = job.data;
-
-  const workspace = await Workspace.findById(new Types.ObjectId(workspaceId));
-  const organization = await Organization.findById(new Types.ObjectId(workspace?.organization));
-
-  if (!workspace) {
-    throw new Error("Workspace for reminder not found");
-  }
-  if (!organization) {
-    throw new Error("Organization for reminder not found");
-  }
-
-  const memberships = await Membership.find({
-    workspace: workspaceId
-  }).populate<{ user: IUser }>("user");
-
-  await sendMail({
-    template: "secretReminder.handlebars",
-    subjectLine: "Infisical secret reminder",
-    recipients: [...memberships.map((membership) => membership.user.email)],
-    substitutions: {
-      reminderNote: job.data.note, // May not be present.
-      workspaceName: workspace.name,
-      organizationName: organization.name
-    }
-  });
-});
-
-export const createRecurringSecretReminder = (jobDetails: TSendSecretReminders) => {
-  const repeat = jobDetails.repeatDays * DAY_IN_MS;
-
-  return sendSecretReminders.add(jobDetails, {
-    delay: repeat,
-    repeat: {
-      every: repeat
-    },
-    jobId: `reminder-${jobDetails.secretId}`,
-    removeOnComplete: true,
-    removeOnFail: {
-      count: 20
-    }
-  });
-};
-
-export const deleteRecurringSecretReminder = (jobDetails: TDeleteSecretReminder) => {
-  const repeat = jobDetails.repeatDays * DAY_IN_MS;
-
-  return sendSecretReminders.removeRepeatable({
-    every: repeat,
-    jobId: `reminder-${jobDetails.secretId}`
-  });
-};
-
-export const updateRecurringSecretReminder = async (jobDetails: TSendSecretReminders) => {
-  // We need to delete the potentially existing reminder job first, or the new one won't be created.
-  await deleteRecurringSecretReminder(jobDetails);
-  await createRecurringSecretReminder(jobDetails);
-};

backend/src/routes/v1/index.ts

@@ -1,7 +1,6 @@
 import signup from "./signup";
 import bot from "./bot";
 import auth from "./auth";
-import universalAuth from "./universalAuth";
 import user from "./user";
 import userAction from "./userAction";
 import organization from "./organization";
@@ -24,7 +23,6 @@ import admin from "./admin";
 export {
   signup,
   auth,
-  universalAuth,
   bot,
   user,
   userAction,

backend/src/routes/v1/universalAuth.ts

@@ -1,66 +0,0 @@
-
-import express from "express";
-const router = express.Router();
-import { requireAuth } from "../../middleware";
-import { universalAuthController } from "../../controllers/v1";
-import { AuthMode } from "../../variables";
-
-router.post(
-    "/token/renew", 
-    universalAuthController.renewAccessToken
-);
-
-router.post(
-    "/universal-auth/login",
-    universalAuthController.loginIdentityUniversalAuth
-);
-
-router.post(
-    "/universal-auth/identities/:identityId",
-    requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
-    }),
-    universalAuthController.addIdentityUniversalAuth
-);
-
-router.patch(
-    "/universal-auth/identities/:identityId",
-    requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
-    }),
-    universalAuthController.updateIdentityUniversalAuth
-);
-
-router.get(
-    "/universal-auth/identities/:identityId",
-    requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
-    }),
-    universalAuthController.getIdentityUniversalAuth
-);
-
-router.post(
-    "/universal-auth/identities/:identityId/client-secrets",
-    requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
-    }),
-    universalAuthController.createUniversalAuthClientSecret
-);
-
-router.get(
-    "/universal-auth/identities/:identityId/client-secrets",
-    requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
-    }),
-    universalAuthController.getUniversalAuthClientSecrets
-);
-
-router.post(
-    "/universal-auth/identities/:identityId/client-secrets/:clientSecretId/revoke",
-    requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
-    }),
-    universalAuthController.revokeUniversalAuthClientSecret
-);
-
-export default router;

backend/src/routes/v2/auth.ts

@@ -26,7 +26,7 @@ router.post(
 );
 
 //remove above ones after depreciation
-router.post("/mfa/send", authLimiter, requireMfaAuth, authController.sendMfaToken);
+router.post("/mfa/send", authLimiter, authController.sendMfaToken);
 
 router.post("/mfa/verify", authLimiter, requireMfaAuth, authController.verifyMfaToken);
 

backend/src/routes/v2/environment.ts

@@ -36,4 +36,12 @@ router.delete(
   environmentController.deleteWorkspaceEnvironment
 );
 
+router.get(
+  "/:workspaceId/environments",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  environmentController.getAllAccessibleEnvironmentsOfWorkspace
+);
+
 export default router;

backend/src/routes/v2/organizations.ts

@@ -54,12 +54,4 @@ router.delete(
   organizationsController.deleteOrganizationById
 );
 
-router.get(
-  "/:organizationId/identity-memberships",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
-  }),
-  organizationsController.getOrganizationIdentityMemberships
-);
-
 export default router;

backend/src/routes/v2/serviceTokenData.ts

@@ -6,7 +6,7 @@ import {
 import { AuthMode } from "../../variables";
 import { serviceTokenDataController } from "../../controllers/v2";
 
-router.get( // TODO: deprecate (moving to identity)
+router.get( // TODO: deprecate (moving to ST V3)
   "/",
   requireAuth({
     acceptedAuthModes: [AuthMode.SERVICE_TOKEN]
@@ -14,7 +14,7 @@ router.get( // TODO: deprecate (moving to identity)
   serviceTokenDataController.getServiceTokenData
 );
 
-router.post( // TODO: deprecate (moving to identity)
+router.post( // TODO: deprecate (moving to ST V3)
   "/",
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT]
@@ -22,7 +22,7 @@ router.post( // TODO: deprecate (moving to identity)
   serviceTokenDataController.createServiceTokenData
 );
 
-router.delete( // TODO: deprecate (moving to identity)
+router.delete( // TODO: deprecate (moving to ST V3)
   "/:serviceTokenDataId",
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT]

backend/src/routes/v2/workspace.ts

@@ -93,37 +93,4 @@ router.patch(
   workspaceController.toggleAutoCapitalization
 );
 
-router.post(
-  "/:workspaceId/identity-memberships/:identityId",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
-  }),
-  workspaceController.addIdentityToWorkspace
-);
-
-router.patch(
-  "/:workspaceId/identity-memberships/:identityId",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
-  }),
-  workspaceController.updateIdentityWorkspaceRole
-);
-
-router.delete(
-  "/:workspaceId/identity-memberships/:identityId",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
-  }),
-  workspaceController.deleteIdentityFromWorkspace
-);
-
-router.get(
-  "/:workspaceId/identity-memberships",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
-  }),
-  workspaceController.getWorkspaceIdentityMemberships
-);
-
-
 export default router;

backend/src/routes/v3/secrets.ts

@@ -7,7 +7,7 @@ import { AuthMode } from "../../variables";
 router.get(
   "/raw",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.API_KEY_V2, AuthMode.SERVICE_TOKEN, AuthMode.IDENTITY_ACCESS_TOKEN]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.API_KEY_V2, AuthMode.SERVICE_TOKEN, AuthMode.SERVICE_ACCESS_TOKEN]
   }),
   secretsController.getSecretsRaw
 );
@@ -15,7 +15,7 @@ router.get(
 router.get(
   "/raw/:secretName",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.API_KEY_V2, AuthMode.SERVICE_TOKEN, AuthMode.IDENTITY_ACCESS_TOKEN]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.API_KEY_V2, AuthMode.SERVICE_TOKEN, AuthMode.SERVICE_ACCESS_TOKEN]
   }),
   requireBlindIndicesEnabled({
     locationWorkspaceId: "query"
@@ -29,7 +29,7 @@ router.get(
 router.post(
   "/raw/:secretName",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.API_KEY_V2, AuthMode.SERVICE_TOKEN, AuthMode.IDENTITY_ACCESS_TOKEN]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.API_KEY_V2, AuthMode.SERVICE_TOKEN, AuthMode.SERVICE_ACCESS_TOKEN]
   }),
   requireBlindIndicesEnabled({
     locationWorkspaceId: "body"
@@ -43,7 +43,7 @@ router.post(
 router.patch(
   "/raw/:secretName",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.API_KEY_V2, AuthMode.SERVICE_TOKEN, AuthMode.IDENTITY_ACCESS_TOKEN]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.API_KEY_V2, AuthMode.SERVICE_TOKEN, AuthMode.SERVICE_ACCESS_TOKEN]
   }),
   requireBlindIndicesEnabled({
     locationWorkspaceId: "body"
@@ -57,7 +57,7 @@ router.patch(
 router.delete(
   "/raw/:secretName",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.API_KEY_V2, AuthMode.SERVICE_TOKEN, AuthMode.IDENTITY_ACCESS_TOKEN]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.API_KEY_V2, AuthMode.SERVICE_TOKEN, AuthMode.SERVICE_ACCESS_TOKEN]
   }),
   requireBlindIndicesEnabled({
     locationWorkspaceId: "body"
@@ -71,7 +71,7 @@ router.delete(
 router.get(
   "/",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.API_KEY_V2, AuthMode.SERVICE_TOKEN]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.API_KEY_V2, AuthMode.SERVICE_TOKEN, AuthMode.SERVICE_ACCESS_TOKEN]
   }),
   requireBlindIndicesEnabled({
     locationWorkspaceId: "query"
@@ -116,7 +116,7 @@ router.delete(
 router.post(
   "/:secretName",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.API_KEY_V2, AuthMode.SERVICE_TOKEN]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.API_KEY_V2, AuthMode.SERVICE_TOKEN, AuthMode.SERVICE_ACCESS_TOKEN]
   }),
   requireBlindIndicesEnabled({
     locationWorkspaceId: "body"
@@ -127,7 +127,7 @@ router.post(
 router.get(
   "/:secretName",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.API_KEY_V2, AuthMode.SERVICE_TOKEN]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.API_KEY_V2, AuthMode.SERVICE_TOKEN, AuthMode.SERVICE_ACCESS_TOKEN]
   }),
   requireBlindIndicesEnabled({
     locationWorkspaceId: "query"
@@ -138,7 +138,7 @@ router.get(
 router.patch(
   "/:secretName",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.API_KEY_V2, AuthMode.SERVICE_TOKEN]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.API_KEY_V2, AuthMode.SERVICE_TOKEN, AuthMode.SERVICE_ACCESS_TOKEN]
   }),
   requireBlindIndicesEnabled({
     locationWorkspaceId: "body"
@@ -149,7 +149,7 @@ router.patch(
 router.delete(
   "/:secretName",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.API_KEY_V2, AuthMode.SERVICE_TOKEN]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.API_KEY_V2, AuthMode.SERVICE_TOKEN, AuthMode.SERVICE_ACCESS_TOKEN]
   }),
   requireBlindIndicesEnabled({
     locationWorkspaceId: "body"

backend/src/routes/v3/workspaces.ts

@@ -34,4 +34,12 @@ router.post(
 
 // --
 
+router.get(
+  "/:workspaceId/service-token",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  workspacesController.getWorkspaceServiceTokenData
+);
+
 export default router;

backend/src/routes/v4/environments.ts

@@ -0,0 +1,39 @@
+import express from "express";
+const router = express.Router();
+import { requireAuth } from "../../middleware";
+import { environmentsController } from "../../controllers/v4";
+// import { AuthMode } from "../../variables";
+
+router.post(
+    "/",
+    requireAuth({
+        acceptedAuthModes: []
+    }),
+    environmentsController.createEnvironment
+);
+
+router.get(
+    "/",
+    requireAuth({
+        acceptedAuthModes: []
+    }),
+    environmentsController.getEnvironments
+);
+
+router.patch(
+    "/:environmentSlug",
+    requireAuth({
+        acceptedAuthModes: []
+    }),
+    environmentsController.updateEnvironment
+);
+
+router.delete(
+    "/:environmentSlug",
+    requireAuth({
+        acceptedAuthModes: []
+    }),
+    environmentsController.deleteEnvironment
+)
+
+export default router;

backend/src/routes/v4/folders.ts

@@ -0,0 +1,39 @@
+import express from "express";
+const router = express.Router();
+import { requireAuth} from "../../middleware";
+import { foldersController } from "../../controllers/v4";
+// import { AuthMode } from "../../variables";
+
+router.post(
+    "/",
+    requireAuth({
+        acceptedAuthModes: []
+    }),
+    foldersController.createFolder
+);
+
+router.get(
+    "/",
+    requireAuth({
+        acceptedAuthModes: []
+    }),
+    foldersController.getFolders
+);
+
+router.patch(
+    ":/folderName",
+    requireAuth({
+        acceptedAuthModes: []
+    }),
+    foldersController.updateFolder
+);
+
+router.delete(
+    "/:folderName",
+    requireAuth({
+        acceptedAuthModes: []
+    }),
+    foldersController.deleteFolder
+);
+
+export default router;

backend/src/routes/v4/index.ts

@@ -0,0 +1,5 @@
+import secrets from "./secrets";
+
+export {
+    secrets
+}

backend/src/routes/v4/secrets.ts

@@ -0,0 +1,46 @@
+import express from "express";
+const router = express.Router();
+import { requireAuth} from "../../middleware";
+import { secretsController } from "../../controllers/v4";
+
+router.get(
+    "/",
+    requireAuth({
+        acceptedAuthModes: []
+    }),
+    secretsController.getSecrets
+);
+  
+router.get(
+    "/:secretName",
+    requireAuth({
+        acceptedAuthModes: []
+    }),
+    secretsController.getSecret
+);
+  
+router.post(
+    "/:secretName",
+    requireAuth({
+        acceptedAuthModes: []
+    }),
+    secretsController.createSecret
+);
+  
+router.patch(
+    "/:secretName",
+    requireAuth({
+        acceptedAuthModes: []
+    }),
+    secretsController.updateSecret
+);
+  
+router.delete(
+    "/:secretName",
+    requireAuth({
+        acceptedAuthModes: []
+    }),
+    secretsController.deleteSecret
+);
+
+export default router;

backend/src/services/RedisService.ts

@@ -3,14 +3,11 @@ import { logger } from "../utils/logging";
 
 let redisClient: TRedis | null;
 
-export const initRedis = async () => {
-  if (process.env.REDIS_URL) {
-    redisClient = new Redis(process.env.REDIS_URL as string);
-  } else {
-    logger.warn("Redis URL not set, skipping Redis initialization.");
-    redisClient = null;
-  }
+if (process.env.REDIS_URL) {
+  redisClient = new Redis(process.env.REDIS_URL as string);
+} else {
+  logger.warn("Redis URL not set, skipping Redis initialization.");
+  redisClient = null;
 }
 
-
 export { redisClient };