fix: upgrade @emotion/css from 11.10.6 to 11.10.8

Snyk has created this PR to upgrade @emotion/css from 11.10.6 to 11.10.8.

See this package in npm:
https://www.npmjs.com/package/@emotion/css

See this project in Snyk:
https://app.snyk.io/org/maidul98/project/53d4ecb6-6cc1-4918-aa73-bf9cae4ffd13?utm_source=github&utm_medium=referral&page=upgrade-pr

.dockerignore

@@ -1,2 +0,0 @@
-backend/node_modules
-frontend/node_modules

.env.example

@@ -9,7 +9,6 @@ JWT_SIGNUP_SECRET=3679e04ca949f914c03332aaaeba805a
 JWT_REFRESH_SECRET=5f2f3c8f0159068dc2bbb3a652a716ff
 JWT_AUTH_SECRET=4be6ba5602e0fa0ac6ac05c3cd4d247f
 JWT_SERVICE_SECRET=f32f716d70a42c5703f4656015e76200
-JWT_PROVIDER_AUTH_SECRET=f32f716d70a42c5703f4656015e76201
 
 # JWT lifetime
 # Optional lifetimes for JWT tokens expressed in seconds or a string 
@@ -17,7 +16,6 @@ JWT_PROVIDER_AUTH_SECRET=f32f716d70a42c5703f4656015e76201
 JWT_AUTH_LIFETIME=
 JWT_REFRESH_LIFETIME=
 JWT_SIGNUP_LIFETIME=
-JWT_PROVIDER_AUTH_LIFETIME=
 
 # MongoDB
 # Backend will connect to the MongoDB instance at connection string MONGO_URL which can either be a ref
@@ -68,6 +66,3 @@ STRIPE_PRODUCT_STARTER=
 STRIPE_PRODUCT_TEAM=
 STRIPE_PRODUCT_PRO=
 NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=
-
-CLIENT_ID_GOOGLE=
-CLIENT_SECRET_GOOGLE=

.github/resources/docker-compose.be-test.yml

@@ -13,7 +13,6 @@ services:
       - MONGO_URL=mongodb://test:example@mongo:27017/?authSource=admin
       - MONGO_USERNAME=test
       - MONGO_PASSWORD=example
-      - ENCRYPTION_KEY=a984ecdf82ec779e55dbcc21303a900f
     networks:
       - infisical-test
 

.github/workflows/check-be-pull-request.yml

@@ -13,7 +13,6 @@ jobs:
   check-be-pr:
     name: Check
     runs-on: ubuntu-latest
-    timeout-minutes: 15
 
     steps:
       - name: ☁️ Checkout source
@@ -27,17 +26,17 @@ jobs:
       - name: 📦 Install dependencies
         run: npm ci --only-production
         working-directory: backend
-      # - name: 🧪 Run tests
-      #   run: npm run test:ci
-      #   working-directory: backend
-      # - name: 📁 Upload test results
-      #   uses: actions/upload-artifact@v3
-      #   if: always()
-      #   with:
-      #     name: be-test-results
-      #     path: |
-      #       ./backend/reports
-      #       ./backend/coverage
+      - name: 🧪 Run tests
+        run: npm run test:ci
+        working-directory: backend
+      - name: 📁 Upload test results
+        uses: actions/upload-artifact@v3
+        if: always()
+        with:
+          name: be-test-results
+          path: |
+            ./backend/reports
+            ./backend/coverage
       - name: 🏗️ Run build
         run: npm run build
         working-directory: backend

.github/workflows/check-fe-pull-request.yml

@@ -2,35 +2,40 @@ name: Check Frontend Pull Request
 
 on:
   pull_request:
-    types: [opened, synchronize]
+    types: [ opened, synchronize ]
     paths:
-      - "frontend/**"
-      - "!frontend/README.md"
-      - "!frontend/.*"
-      - "frontend/.eslintrc.js"
+      - 'frontend/**'
+      - '!frontend/README.md'
+      - '!frontend/.*'
+      - 'frontend/.eslintrc.js'
+
 
 jobs:
+
   check-fe-pr:
     name: Check
     runs-on: ubuntu-latest
-    timeout-minutes: 15
 
     steps:
-      - name: ☁️ Checkout source
+      -
+        name: ☁️ Checkout source
         uses: actions/checkout@v3
-      - name: 🔧 Setup Node 16
+      -
+        name: 🔧 Setup Node 16
         uses: actions/setup-node@v3
         with:
-          node-version: "16"
-          cache: "npm"
+          node-version: '16'
+          cache: 'npm'
           cache-dependency-path: frontend/package-lock.json
-      - name: 📦 Install dependencies
+      -
+        name: 📦 Install dependencies
         run: npm ci --only-production --ignore-scripts
         working-directory: frontend
       # -
       #   name: 🧪 Run tests
       #   run: npm run test:ci
       #   working-directory: frontend
-      - name: 🏗️ Run build
+      -
+        name: 🏗️ Run build
         run: npm run build
         working-directory: frontend

.goreleaser.yaml

@@ -15,12 +15,13 @@ monorepo:
   tag_prefix: infisical-cli/
   dir: cli
 
+env:
+  - POSTHOG_API_KEY_FOR_CLI={{ .Env.POSTHOG_API_KEY_FOR_CLI }}
+
 builds:
   - id: darwin-build
     binary: infisical
-    ldflags:
-      - -X github.com/Infisical/infisical-merge/packages/util.CLI_VERSION={{ .Version }}
-      - -X github.com/Infisical/infisical-merge/packages/telemetry.POSTHOG_API_KEY_FOR_CLI={{ .Env.POSTHOG_API_KEY_FOR_CLI }}
+    ldflags: -X github.com/Infisical/infisical-merge/packages/util.CLI_VERSION={{ .Version }}
     flags:
       - -trimpath
     env:
@@ -38,9 +39,7 @@ builds:
     env:
       - CGO_ENABLED=0
     binary: infisical
-    ldflags:
-      - -X github.com/Infisical/infisical-merge/packages/util.CLI_VERSION={{ .Version }}
-      - -X github.com/Infisical/infisical-merge/packages/telemetry.POSTHOG_API_KEY_FOR_CLI={{ .Env.POSTHOG_API_KEY_FOR_CLI }}
+    ldflags: -X github.com/Infisical/infisical-merge/packages/util.CLI_VERSION={{ .Version }}
     flags:
       - -trimpath
     goos:

.husky/pre-commit

@@ -3,5 +3,3 @@
 . "$(dirname -- "$0")/_/husky.sh"
 
 npx lint-staged
-
-infisical scan git-changes --staged -v

.infisicalignore

@@ -1 +0,0 @@
-.github/resources/docker-compose.be-test.yml:generic-api-key:16

Dockerfile.standalone-infisical

@@ -77,7 +77,7 @@ RUN npm ci --only-production
 COPY --from=backend-build /app .
 
 # Production stage
-FROM node:16-alpine AS production
+FROM node:14-alpine AS production
 
 WORKDIR / 
 

README.md

@@ -7,7 +7,7 @@
 </p>
 
 <h4 align="center">
-  <a href="https://join.slack.com/t/infisical-users/shared_invite/zt-1wehzfnzn-1aMo5JcGENJiNAC2SD8Jlg">Slack</a> |
+  <a href="https://join.slack.com/t/infisical-users/shared_invite/zt-1kdbk07ro-RtoyEt_9E~fyzGo_xQYP6g">Slack</a> |
   <a href="https://infisical.com/">Infisical Cloud</a> |
   <a href="https://infisical.com/docs/self-hosting/overview">Self-Hosting</a> |
   <a href="https://infisical.com/docs/documentation/getting-started/introduction">Docs</a> |
@@ -25,9 +25,9 @@
     <img src="https://img.shields.io/github/commit-activity/m/infisical/infisical" alt="git commit activity" />
   </a>
   <a href="https://cloudsmith.io/~infisical/repos/">
-    <img src="https://img.shields.io/badge/Downloads-240.2k-orange" alt="Cloudsmith downloads" />
+    <img src="https://img.shields.io/badge/Downloads-150.8k-orange" alt="Cloudsmith downloads" />
   </a>
-  <a href="https://join.slack.com/t/infisical-users/shared_invite/zt-1wehzfnzn-1aMo5JcGENJiNAC2SD8Jlg">
+  <a href="https://join.slack.com/t/infisical-users/shared_invite/zt-1kdbk07ro-RtoyEt_9E~fyzGo_xQYP6g">
     <img src="https://img.shields.io/badge/chat-on%20Slack-blueviolet" alt="Slack community channel" />
   </a>
   <a href="https://twitter.com/infisical">
@@ -55,7 +55,7 @@ We're on a mission to make secret management more accessible to everyone, not ju
 -   **[Audit logs](https://infisical.com/docs/documentation/platform/audit-logs)** to record every action taken in a project
 -   **Role-based Access Controls** per environment
 -   [**Simple on-premise deployments** to AWS and Digital Ocean](https://infisical.com/docs/self-hosting/overview)
--   [**Secret Scanning**](https://infisical.com/docs/cli/scanning-overview)
+- [**2FA**](https://infisical.com/docs/documentation/platform/mfa) with more options coming soon
 
 And much more.
 
@@ -69,9 +69,7 @@ The fastest and most reliable way to get started with Infisical is signing up fo
 
 ### Deploy Infisical on premise
 
-<a href="https://infisical.com/docs/self-hosting/deployment-options/digital-ocean-marketplace"><img src=".github/images/do-k8-install-btn.png" width="200"/></a> <a href="https://infisical.com/docs/self-hosting/deployment-options/aws-ec2"><img src=".github/images/deploy-aws-button.png" width="150" width="300" /></a>
-
-View all [deployment options](https://infisical.com/docs/self-hosting/overview)
+Deployment options: [AWS EC2](https://infisical.com/docs/self-hosting/overview), [Kubernetes](https://infisical.com/docs/self-hosting/overview), and [more](https://infisical.com/docs/self-hosting/overview).
 
 ### Run Infisical locally
 
@@ -100,10 +98,16 @@ To scan your full git history, run:
 infisical scan --verbose
 ```
 
-Install pre commit hook to scan each commit before you push to your repository 
+To scan your uncommitted git changes, run:
 
 ```
-infisical scan install --pre-commit-hook
+infisical scan git-changes --verbose
+```
+
+You can also scan your uncommited but staged changes by running the command below. This command can also be used as a pre-commit hook to prevent secret leak.
+
+```
+infisical scan git-changes --staged --verbose
 ```
 
 Lean about Infisical's code scanning feature [here](https://infisical.com/docs/cli/scanning-overview) 
@@ -128,12 +132,12 @@ Whether it's big or small, we love contributions. Check out our guide to see how
 Not sure where to get started? You can:
 
 -   [Book a free, non-pressure pairing sessions with one of our teammates](mailto:tony@infisical.com?subject=Pairing%20session&body=I'd%20like%20to%20do%20a%20pairing%20session!)!
--   Join our <a href="https://join.slack.com/t/infisical-users/shared_invite/zt-1wehzfnzn-1aMo5JcGENJiNAC2SD8Jlg">Slack</a>, and ask us any questions there.
+-   Join our <a href="https://join.slack.com/t/infisical-users/shared_invite/zt-1kdbk07ro-RtoyEt_9E~fyzGo_xQYP6g">Slack</a>, and ask us any questions there.
 
 ## Resources
 
 - [Docs](https://infisical.com/docs/documentation/getting-started/introduction) for comprehensive documentation and guides
-- [Slack](https://join.slack.com/t/infisical-users/shared_invite/zt-1wehzfnzn-1aMo5JcGENJiNAC2SD8Jlg) for discussion with the community and Infisical team.
+- [Slack](https://join.slack.com/t/infisical-users/shared_invite/zt-1kdbk07ro-RtoyEt_9E~fyzGo_xQYP6g) for discussion with the community and Infisical team.
 - [GitHub](https://github.com/Infisical/infisical) for code, issues, and pull requests
 - [Twitter](https://twitter.com/infisical) for fast news
 - [YouTube](https://www.youtube.com/@infisical5306) for videos on secret management

backend/package.json

@@ -20,25 +20,20 @@
     "crypto-js": "^4.1.1",
     "dotenv": "^16.0.1",
     "express": "^4.18.1",
-    "express-async-errors": "^3.1.1",
     "express-rate-limit": "^6.7.0",
     "express-validator": "^6.14.2",
     "handlebars": "^4.7.7",
     "helmet": "^5.1.1",
-    "infisical-node": "^1.2.1",
+    "infisical-node": "^1.1.3",
     "js-yaml": "^4.1.0",
     "jsonwebtoken": "^9.0.0",
     "jsrp": "^0.2.4",
     "libsodium-wrappers": "^0.7.10",
     "lodash": "^4.17.21",
     "mongoose": "^6.10.5",
-    "node-cache": "^5.1.2",
     "nodemailer": "^6.8.0",
-    "passport": "^0.6.0",
-    "passport-google-oauth20": "^2.0.0",
     "posthog-node": "^2.6.0",
     "query-string": "^7.1.3",
-    "rate-limit-mongo": "^2.3.2",
     "request-ip": "^3.3.0",
     "rimraf": "^3.0.2",
     "stripe": "^10.7.0",
@@ -91,7 +86,6 @@
     "@types/lodash": "^4.14.191",
     "@types/node": "^18.11.3",
     "@types/nodemailer": "^6.4.6",
-    "@types/passport": "^1.0.12",
     "@types/supertest": "^2.0.12",
     "@types/swagger-jsdoc": "^6.0.1",
     "@types/swagger-ui-express": "^4.1.3",

backend/src/config/index.ts

@@ -1,19 +1,12 @@
 import InfisicalClient from 'infisical-node';
 
-export const client = new InfisicalClient({
+const client = new InfisicalClient({
   token: process.env.INFISICAL_TOKEN!
 });
 
 export const getPort = async () => (await client.getSecret('PORT')).secretValue || 4000;
-export const getEncryptionKey = async () => {
-  const secretValue = (await client.getSecret('ENCRYPTION_KEY')).secretValue;
-  return secretValue === '' ? undefined : secretValue;
-}
-export const getRootEncryptionKey = async () => {
-  const secretValue = (await client.getSecret('ROOT_ENCRYPTION_KEY')).secretValue; 
-  return secretValue === '' ? undefined : secretValue;
-}
-export const getInviteOnlySignup = async () => (await client.getSecret('INVITE_ONLY_SIGNUP')).secretValue === 'true'
+export const getInviteOnlySignup = async () => (await client.getSecret('INVITE_ONLY_SIGNUP')).secretValue == undefined ? false : (await client.getSecret('INVITE_ONLY_SIGNUP')).secretValue;
+export const getEncryptionKey = async () => (await client.getSecret('ENCRYPTION_KEY')).secretValue;
 export const getSaltRounds = async () => parseInt((await client.getSecret('SALT_ROUNDS')).secretValue) || 10;
 export const getJwtAuthLifetime = async () => (await client.getSecret('JWT_AUTH_LIFETIME')).secretValue || '10d';
 export const getJwtAuthSecret = async () => (await client.getSecret('JWT_AUTH_SECRET')).secretValue;
@@ -23,8 +16,6 @@ export const getJwtRefreshLifetime = async () => (await client.getSecret('JWT_RE
 export const getJwtRefreshSecret = async () => (await client.getSecret('JWT_REFRESH_SECRET')).secretValue;
 export const getJwtServiceSecret = async () => (await client.getSecret('JWT_SERVICE_SECRET')).secretValue;
 export const getJwtSignupLifetime = async () => (await client.getSecret('JWT_SIGNUP_LIFETIME')).secretValue || '15m';
-export const getJwtProviderAuthSecret = async () => (await client.getSecret('JWT_PROVIDER_AUTH_SECRET')).secretValue;
-export const getJwtProviderAuthLifetime = async () => (await client.getSecret('JWT_PROVIDER_AUTH_LIFETIME')).secretValue || '15m';
 export const getJwtSignupSecret = async () => (await client.getSecret('JWT_SIGNUP_SECRET')).secretValue;
 export const getMongoURL = async () => (await client.getSecret('MONGO_URL')).secretValue;
 export const getNodeEnv = async () => (await client.getSecret('NODE_ENV')).secretValue || 'production';
@@ -36,14 +27,12 @@ export const getClientIdVercel = async () => (await client.getSecret('CLIENT_ID_
 export const getClientIdNetlify = async () => (await client.getSecret('CLIENT_ID_NETLIFY')).secretValue;
 export const getClientIdGitHub = async () => (await client.getSecret('CLIENT_ID_GITHUB')).secretValue;
 export const getClientIdGitLab = async () => (await client.getSecret('CLIENT_ID_GITLAB')).secretValue;
-export const getClientIdGoogle = async () => (await client.getSecret('CLIENT_ID_GOOGLE')).secretValue;
 export const getClientSecretAzure = async () => (await client.getSecret('CLIENT_SECRET_AZURE')).secretValue;
 export const getClientSecretHeroku = async () => (await client.getSecret('CLIENT_SECRET_HEROKU')).secretValue;
 export const getClientSecretVercel = async () => (await client.getSecret('CLIENT_SECRET_VERCEL')).secretValue;
 export const getClientSecretNetlify = async () => (await client.getSecret('CLIENT_SECRET_NETLIFY')).secretValue;
 export const getClientSecretGitHub = async () => (await client.getSecret('CLIENT_SECRET_GITHUB')).secretValue;
 export const getClientSecretGitLab = async () => (await client.getSecret('CLIENT_SECRET_GITLAB')).secretValue;
-export const getClientSecretGoogle = async () => (await client.getSecret('CLIENT_SECRET_GOOGLE')).secretValue;
 export const getClientSlugVercel = async () => (await client.getSecret('CLIENT_SLUG_VERCEL')).secretValue;
 export const getPostHogHost = async () => (await client.getSecret('POSTHOG_HOST')).secretValue || 'https://app.posthog.com';
 export const getPostHogProjectApiKey = async () => (await client.getSecret('POSTHOG_PROJECT_API_KEY')).secretValue || 'phc_nSin8j5q2zdhpFDI1ETmFNUIuTG4DwKVyIigrY10XiE';
@@ -56,25 +45,12 @@ export const getSmtpUsername = async () => (await client.getSecret('SMTP_USERNAM
 export const getSmtpPassword = async () => (await client.getSecret('SMTP_PASSWORD')).secretValue;
 export const getSmtpFromAddress = async () => (await client.getSecret('SMTP_FROM_ADDRESS')).secretValue;
 export const getSmtpFromName = async () => (await client.getSecret('SMTP_FROM_NAME')).secretValue || 'Infisical';
-
-export const getLicenseKey = async () => {
-  const secretValue = (await client.getSecret('LICENSE_KEY')).secretValue;
-  return secretValue === '' ? undefined : secretValue;
-}
-export const getLicenseServerKey = async () => {
-  const secretValue = (await client.getSecret('LICENSE_SERVER_KEY')).secretValue;
-  return secretValue === '' ? undefined : secretValue;
-}
-export const getLicenseServerUrl = async () => (await client.getSecret('LICENSE_SERVER_URL')).secretValue || 'https://portal.infisical.com';
-
-// TODO: deprecate from here
 export const getStripeProductStarter = async () => (await client.getSecret('STRIPE_PRODUCT_STARTER')).secretValue;
 export const getStripeProductPro = async () => (await client.getSecret('STRIPE_PRODUCT_PRO')).secretValue;
 export const getStripeProductTeam = async () => (await client.getSecret('STRIPE_PRODUCT_TEAM')).secretValue;
 export const getStripePublishableKey = async () => (await client.getSecret('STRIPE_PUBLISHABLE_KEY')).secretValue;
 export const getStripeSecretKey = async () => (await client.getSecret('STRIPE_SECRET_KEY')).secretValue;
 export const getStripeWebhookSecret = async () => (await client.getSecret('STRIPE_WEBHOOK_SECRET')).secretValue;
-
 export const getTelemetryEnabled = async () => (await client.getSecret('TELEMETRY_ENABLED')).secretValue !== 'false' && true;
 export const getLoopsApiKey = async () => (await client.getSecret('LOOPS_API_KEY')).secretValue;
 export const getSmtpConfigured = async () => (await client.getSecret('SMTP_HOST')).secretValue == '' || (await client.getSecret('SMTP_HOST')).secretValue == undefined ? false : true

backend/src/config/request.ts

@@ -1,24 +1,10 @@
 import axios from 'axios';
 import axiosRetry from 'axios-retry';
-import {
-  getLicenseServerKeyAuthToken,
-  setLicenseServerKeyAuthToken,
-  getLicenseKeyAuthToken,
-  setLicenseKeyAuthToken
-} from './storage';
-import {
-  getLicenseKey,
-  getLicenseServerKey, 
-  getLicenseServerUrl
-} from './index';
 
-// should have JWT to interact with the license server
-export const licenseServerKeyRequest = axios.create();
-export const licenseKeyRequest = axios.create();
-export const standardRequest = axios.create();
+const axiosInstance = axios.create();
 
 // add retry functionality to the axios instance
-axiosRetry(standardRequest, {
+axiosRetry(axiosInstance, {
   retries: 3,
   retryDelay: axiosRetry.exponentialDelay, // exponential back-off delay between retries
   retryCondition: (error) => {
@@ -27,98 +13,4 @@ axiosRetry(standardRequest, {
   },
 });
 
-export const refreshLicenseServerKeyToken = async () => {
-  const licenseServerKey = await getLicenseServerKey();
-  const licenseServerUrl = await getLicenseServerUrl();
-
-  const { data: { token } } = await standardRequest.post(
-    `${licenseServerUrl}/api/auth/v1/license-server-login`, {},
-    {
-      headers: {
-        'X-API-KEY': licenseServerKey
-      }
-    }
-  );
-
-  setLicenseServerKeyAuthToken(token);
-
-  return token;
-}
-
-export const refreshLicenseKeyToken = async () => {
-  const licenseKey = await getLicenseKey();
-  const licenseServerUrl = await getLicenseServerUrl();
-
-  const { data: { token } } = await standardRequest.post(
-    `${licenseServerUrl}/api/auth/v1/license-login`, {},
-    {
-      headers: {
-        'X-API-KEY': licenseKey
-      }
-    }
-  );
-
-  setLicenseKeyAuthToken(token);
-
-  return token;
-}
-
-licenseServerKeyRequest.interceptors.request.use((config) => {
-  const token = getLicenseServerKeyAuthToken();
-
-  if (token && config.headers) {
-      // eslint-disable-next-line no-param-reassign
-      config.headers.Authorization = `Bearer ${token}`;
-  }
-  return config;
-}, (err) => {
-  return Promise.reject(err);
-});
-
-licenseServerKeyRequest.interceptors.response.use((response) => {
-  return response
-}, async function (err) {
-  const originalRequest = err.config;
-  
-  if (err.response.status === 401 && !originalRequest._retry) {
-    originalRequest._retry = true;
-    
-    // refresh
-    const token = await refreshLicenseServerKeyToken();            
-    
-    axios.defaults.headers.common['Authorization'] = 'Bearer ' + token;
-    return licenseServerKeyRequest(originalRequest);
-  }
-
-  return Promise.reject(err);
-});
-
-licenseKeyRequest.interceptors.request.use((config) => {
-  const token = getLicenseKeyAuthToken();
-
-  if (token && config.headers) {
-      // eslint-disable-next-line no-param-reassign
-      config.headers.Authorization = `Bearer ${token}`;
-  }
-  return config;
-}, (err) => {
-  return Promise.reject(err);
-});
-
-licenseKeyRequest.interceptors.response.use((response) => {
-  return response
-}, async function (err) {
-  const originalRequest = err.config;
-  
-  if (err.response.status === 401 && !originalRequest._retry) {
-    originalRequest._retry = true;
-    
-    // refresh
-    const token = await refreshLicenseKeyToken();            
-    
-    axios.defaults.headers.common['Authorization'] = 'Bearer ' + token;
-    return licenseKeyRequest(originalRequest);
-  }
-
-  return Promise.reject(err);
-});
+export default axiosInstance;

backend/src/config/storage.ts

@@ -1,30 +0,0 @@
-const MemoryLicenseServerKeyTokenStorage = () => {
-    let authToken: string;
-  
-    return {
-      setToken: (token: string) => {
-        authToken = token;
-      },
-      getToken: () => authToken
-    };
-};
-
-const MemoryLicenseKeyTokenStorage = () => {
-    let authToken: string;
-  
-    return {
-      setToken: (token: string) => {
-        authToken = token;
-      },
-      getToken: () => authToken
-    };
-};
-
-const licenseServerTokenStorage = MemoryLicenseServerKeyTokenStorage();
-const licenseTokenStorage = MemoryLicenseKeyTokenStorage();
-
-export const getLicenseServerKeyAuthToken = licenseServerTokenStorage.getToken;
-export const setLicenseServerKeyAuthToken = licenseServerTokenStorage.setToken;
-
-export const getLicenseKeyAuthToken = licenseTokenStorage.getToken;
-export const setLicenseKeyAuthToken = licenseTokenStorage.setToken;

backend/src/controllers/v1/authController.ts

@@ -267,7 +267,3 @@ export const getNewToken = async (req: Request, res: Response) => {
     });
   }
 };
-
-export const handleAuthProviderCallback = (req: Request, res: Response) => {
-  res.redirect(`/login/provider/success?token=${encodeURIComponent(req.providerAuthToken)}`);
-}

backend/src/controllers/v1/integrationAuthController.ts

@@ -5,7 +5,7 @@ import {
 	IntegrationAuth,
 	Bot 
 } from '../../models';
-import { ALGORITHM_AES_256_GCM, ENCODING_SCHEME_UTF8, INTEGRATION_SET, getIntegrationOptions as getIntegrationOptionsFunc } from '../../variables';
+import { INTEGRATION_SET, getIntegrationOptions as getIntegrationOptionsFunc } from '../../variables';
 import { IntegrationService } from '../../services';
 import {
 	getApps, 
@@ -16,7 +16,7 @@ import {
 	INTEGRATION_VERCEL_API_URL,
 	INTEGRATION_RAILWAY_API_URL
 } from '../../variables';
-import { standardRequest } from '../../config/request';
+import request from '../../config/request';
 
 /***
  * Return integration authorization with id [integrationAuthId]
@@ -129,9 +129,7 @@ export const saveIntegrationAccessToken = async (
             integration
         }, {
             workspace: new Types.ObjectId(workspaceId),
-            integration,
-			algorithm: ALGORITHM_AES_256_GCM,
-			keyEncoding: ENCODING_SCHEME_UTF8
+            integration
 		}, {
             new: true,
             upsert: true
@@ -231,7 +229,7 @@ export const getIntegrationAuthVercelBranches = async (req: Request, res: Respon
 	let branches: string[] = [];
 	
 	if (appId && appId !== '') {
-		const { data }: { data: VercelBranch[] } = await standardRequest.get(
+		const { data }: { data: VercelBranch[] } = await request.get(
 			`${INTEGRATION_VERCEL_API_URL}/v1/integrations/git-branches`,
 			{
 				params,
@@ -294,7 +292,7 @@ export const getIntegrationAuthRailwayEnvironments = async (req: Request, res: R
 			projectId: appId
 		}
 		
-		const { data: { data: { environments: { edges } } } } = await standardRequest.post(INTEGRATION_RAILWAY_API_URL, {
+		const { data: { data: { environments: { edges } } } } = await request.post(INTEGRATION_RAILWAY_API_URL, {
 			query,
 			variables,
 		}, {
@@ -374,7 +372,7 @@ export const getIntegrationAuthRailwayServices = async (req: Request, res: Respo
 			id: appId
 		}
 		
-		const { data: { data: { project: { services: { edges } } } } } = await standardRequest.post(INTEGRATION_RAILWAY_API_URL, {
+		const { data: { data: { project: { services: { edges } } } } } = await request.post(INTEGRATION_RAILWAY_API_URL, {
 			query,
 			variables
 		}, {

backend/src/controllers/v1/membershipOrgController.ts

@@ -135,7 +135,6 @@ export const inviteUserToOrganization = async (req: Request, res: Response) => {
 			}
 
 			if (!inviteeMembershipOrg) {
-				
 				await new MembershipOrg({
 					user: invitee,
 					inviteEmail: inviteeEmail,
@@ -247,10 +246,6 @@ export const verifyUserToOrganization = async (req: Request, res: Response) => {
 			// membership can be approved and redirected to login/dashboard
 			membershipOrg.status = ACCEPTED;
 			await membershipOrg.save();
-			
-			await updateSubscriptionOrgQuantity({
-				organizationId
-			});
 
 			return res.status(200).send({
 				message: 'Successfully verified email',

backend/src/controllers/v1/signupController.ts

@@ -21,6 +21,14 @@ export const beginEmailSignup = async (req: Request, res: Response) => {
 	try {
 		email = req.body.email;
 
+		if (await getInviteOnlySignup()) {
+			// Only one user can create an account without being invited. The rest need to be invited in order to make an account
+			const userCount = await User.countDocuments({})
+			if (userCount != 0) {
+				throw BadRequestError({ message: "New user sign ups are not allowed at this time. You must be invited to sign up." })
+			}
+		}
+
 		const user = await User.findOne({ email }).select('+publicKey');
 		if (user && user?.publicKey) {
 			// case: user has already completed account
@@ -39,7 +47,7 @@ export const beginEmailSignup = async (req: Request, res: Response) => {
 			error: 'Failed to send email verification code'
 		});
 	}
-	
+
 	return res.status(200).send({
 		message: `Sent an email verification code to ${email}`
 	});
@@ -66,14 +74,6 @@ export const verifyEmailSignup = async (req: Request, res: Response) => {
 			});
 		}
 
-		if (await getInviteOnlySignup()) {
-			// Only one user can create an account without being invited. The rest need to be invited in order to make an account
-			const userCount = await User.countDocuments({})
-			if (userCount != 0) {
-				throw BadRequestError({ message: "New user sign ups are not allowed at this time. You must be invited to sign up." })
-			}
-		}
-
 		// verify email
 		if (await getSmtpConfigured()) {
 			await checkEmailVerification({

backend/src/controllers/v2/authController.ts

@@ -288,8 +288,6 @@ export const verifyMfaToken = async (req: Request, res: Response) => {
 
   if (!user) throw new Error('Failed to find user');
 
-  await LoginSRPDetail.deleteOne({ userId: user.id })
-
   await checkUserDevice({
     user,
     ip: req.ip,

backend/src/controllers/v2/secretController.ts

@@ -6,7 +6,7 @@ import { CreateSecretRequestBody, ModifySecretRequestBody, SanitizedSecretForCre
 const { ValidationError } = mongoose.Error;
 import { BadRequestError, InternalServerError, UnauthorizedRequestError, ValidationError as RouteValidationError } from '../../utils/errors';
 import { AnyBulkWriteOperation } from 'mongodb';
-import { ALGORITHM_AES_256_GCM, ENCODING_SCHEME_UTF8, SECRET_PERSONAL, SECRET_SHARED } from "../../variables";
+import { SECRET_PERSONAL, SECRET_SHARED } from "../../variables";
 import { TelemetryService } from '../../services';
 import { User } from "../../models";
 import { AccountNotFoundError } from '../../utils/errors';
@@ -36,9 +36,7 @@ export const createSecret = async (req: Request, res: Response) => {
     workspace: new Types.ObjectId(workspaceId),
     environment,
     type: secretToCreate.type,
-    user: new Types.ObjectId(req.user._id),
-    algorithm: ALGORITHM_AES_256_GCM,
-    keyEncoding: ENCODING_SCHEME_UTF8
+    user: new Types.ObjectId(req.user._id)
   }
 
 
@@ -94,9 +92,7 @@ export const createSecrets = async (req: Request, res: Response) => {
       workspace: new Types.ObjectId(workspaceId),
       environment,
       type: rawSecret.type,
-      user: new Types.ObjectId(req.user._id),
-      algorithm: ALGORITHM_AES_256_GCM,
-      keyEncoding: ENCODING_SCHEME_UTF8
+      user: new Types.ObjectId(req.user._id)
     }
 
     sanitizedSecretesToCreate.push(safeUpdateFields)

backend/src/controllers/v2/secretsController.ts

@@ -1,26 +1,26 @@
+import to from 'await-to-js';
 import { Types } from 'mongoose';
 import { Request, Response } from 'express';
-import { ISecret, Secret, Workspace } from '../../models';
+import { ISecret, Secret } from '../../models';
 import { IAction, SecretVersion } from '../../ee/models';
 import {
     SECRET_PERSONAL,
+    SECRET_SHARED,
     ACTION_ADD_SECRETS,
     ACTION_READ_SECRETS,
     ACTION_UPDATE_SECRETS,
-    ACTION_DELETE_SECRETS,
-    ALGORITHM_AES_256_GCM,
-    ENCODING_SCHEME_UTF8
+    ACTION_DELETE_SECRETS
 } from '../../variables';
-import { UnauthorizedRequestError, WorkspaceNotFoundError } from '../../utils/errors';
+import { UnauthorizedRequestError, ValidationError } from '../../utils/errors';
 import { EventService } from '../../services';
 import { eventPushSecrets } from '../../events';
-import { EESecretService, EELogService, EELicenseService } from '../../ee/services';
+import { EESecretService, EELogService } from '../../ee/services';
 import { TelemetryService, SecretService } from '../../services';
 import { getChannelFromUserAgent } from '../../utils/posthog';
 import { PERMISSION_WRITE_SECRETS } from '../../variables';
 import { userHasNoAbility, userHasWorkspaceAccess, userHasWriteOnlyAbility } from '../../ee/helpers/checkMembershipPermissions';
 import Tag from '../../models/tag';
-import _ from 'lodash';
+import _, { eq } from 'lodash';
 import {
     BatchSecretRequest,
     BatchSecret
@@ -48,12 +48,6 @@ export const batchSecrets = async (req: Request, res: Response) => {
         environment: string;
         requests: BatchSecretRequest[];
     } = req.body;
-    
-    const workspace = await Workspace.findById(workspaceId);
-    if (!workspace) throw WorkspaceNotFoundError();
-    
-    const orgPlan = await EELicenseService.getOrganizationPlan(workspace.organization.toString());
-    const isPaid = orgPlan.tier >= 1;
 
     const createSecrets: BatchSecret[] = [];
     const updateSecrets: BatchSecret[] = [];
@@ -87,9 +81,7 @@ export const batchSecrets = async (req: Request, res: Response) => {
                     workspace: new Types.ObjectId(workspaceId),
                     path: fullFolderPath,
                     folder: folderId,
-                    secretBlindIndex,
-                    algorithm: ALGORITHM_AES_256_GCM,
-                    keyEncoding: ENCODING_SCHEME_UTF8
+                    secretBlindIndex
                 });
                 break;
             case 'PATCH':
@@ -104,8 +96,6 @@ export const batchSecrets = async (req: Request, res: Response) => {
                     secretBlindIndex,
                     folder: folderId,
                     path: fullFolderPath,
-                    algorithm: ALGORITHM_AES_256_GCM,
-                    keyEncoding: ENCODING_SCHEME_UTF8
                 });
                 break;
             case 'DELETE':
@@ -149,9 +139,7 @@ export const batchSecrets = async (req: Request, res: Response) => {
                     environment,
                     workspaceId,
                     channel,
-                    userAgent: req.headers?.['user-agent'],
-                    isPaid,
-                    email: req.user.email
+                    userAgent: req.headers?.['user-agent']
                 }
             });
         }
@@ -208,8 +196,6 @@ export const batchSecrets = async (req: Request, res: Response) => {
             secretCommentCiphertext: u.secretCommentCiphertext,
             secretCommentIV: u.secretCommentIV,
             secretCommentTag: u.secretCommentTag,
-            algorithm: ALGORITHM_AES_256_GCM,
-            keyEncoding: ENCODING_SCHEME_UTF8,
             tags: u.tags
         }));
 
@@ -240,9 +226,7 @@ export const batchSecrets = async (req: Request, res: Response) => {
                     environment,
                     workspaceId,
                     channel,
-                    userAgent: req.headers?.['user-agent'],
-                    isPaid,
-                    email: req.user.email
+                    userAgent: req.headers?.['user-agent']
                 }
             });
         }
@@ -277,9 +261,7 @@ export const batchSecrets = async (req: Request, res: Response) => {
                     environment,
                     workspaceId,
                     channel: channel,
-                    userAgent: req.headers?.['user-agent'],
-                    isPaid,
-                    email: req.user.email
+                    userAgent: req.headers?.['user-agent']
                 }
             });
         }
@@ -394,12 +376,6 @@ export const createSecrets = async (req: Request, res: Response) => {
         }
     }
 
-    const workspace = await Workspace.findById(workspaceId);
-    if (!workspace) throw WorkspaceNotFoundError();
-    
-    const orgPlan = await EELicenseService.getOrganizationPlan(workspace.organization.toString());
-    const isPaid = orgPlan.tier >= 1;
-
     let listOfSecretsToCreate;
     if (Array.isArray(req.body.secrets)) {
         // case: create multiple secrets
@@ -468,8 +444,6 @@ export const createSecrets = async (req: Request, res: Response) => {
                 secretCommentCiphertext,
                 secretCommentIV,
                 secretCommentTag,
-                algorithm: ALGORITHM_AES_256_GCM,
-                keyEncoding: ENCODING_SCHEME_UTF8,
                 tags
             });
         })
@@ -516,9 +490,7 @@ export const createSecrets = async (req: Request, res: Response) => {
             secretKeyTag,
             secretValueCiphertext,
             secretValueIV,
-            secretValueTag,
-            algorithm: ALGORITHM_AES_256_GCM,
-            keyEncoding: ENCODING_SCHEME_UTF8
+            secretValueTag
         }))
     });
 
@@ -559,11 +531,7 @@ export const createSecrets = async (req: Request, res: Response) => {
                 environment,
                 workspaceId,
                 channel: channel,
-                userAgent: req.headers?.['user-agent'],
-                isPaid,
-                email: await TelemetryService.getDistinctId({
-                    authData: req.authData
-                })
+                userAgent: req.headers?.['user-agent']
             }
         });
     }
@@ -627,12 +595,6 @@ export const getSecrets = async (req: Request, res: Response) => {
     const normalizedPath = normalizePath(secretsPath as string)
     const folders = await getFoldersInDirectory(workspaceId as string, environment as string, normalizedPath)
 
-    const workspace = await Workspace.findById(workspaceId);
-    if (!workspace) throw WorkspaceNotFoundError();
-    
-    const orgPlan = await EELicenseService.getOrganizationPlan(workspace.organization.toString());
-    const isPaid = orgPlan.tier >= 1;
-
     // secrets to return 
     let secrets: ISecret[] = [];
 
@@ -765,11 +727,7 @@ export const getSecrets = async (req: Request, res: Response) => {
                 environment,
                 workspaceId,
                 channel,
-                userAgent: req.headers?.['user-agent'],
-                isPaid,
-                email: await TelemetryService.getDistinctId({
-                    authData: req.authData
-                })
+                userAgent: req.headers?.['user-agent']
             }
         });
     }
@@ -873,8 +831,6 @@ export const updateSecrets = async (req: Request, res: Response) => {
                     secretValueCiphertext,
                     secretValueIV,
                     secretValueTag,
-                    algorithm: ALGORITHM_AES_256_GCM,
-                    keyEncoding: ENCODING_SCHEME_UTF8,
                     tags,
                     ...((
                         secretCommentCiphertext !== undefined &&
@@ -928,8 +884,6 @@ export const updateSecrets = async (req: Request, res: Response) => {
                 secretCommentCiphertext: secretCommentCiphertext ? secretCommentCiphertext : secret.secretCommentCiphertext,
                 secretCommentIV: secretCommentIV ? secretCommentIV : secret.secretCommentIV,
                 secretCommentTag: secretCommentTag ? secretCommentTag : secret.secretCommentTag,
-                algorithm: ALGORITHM_AES_256_GCM,
-                keyEncoding: ENCODING_SCHEME_UTF8,
                 tags: tags ? tags : secret.tags
             });
         })
@@ -984,12 +938,6 @@ export const updateSecrets = async (req: Request, res: Response) => {
             workspaceId: new Types.ObjectId(key)
         })
 
-        const workspace = await Workspace.findById(key);
-        if (!workspace) throw WorkspaceNotFoundError();
-        
-        const orgPlan = await EELicenseService.getOrganizationPlan(workspace.organization.toString());
-        const isPaid = orgPlan.tier >= 1;
-
         const postHogClient = await TelemetryService.getPostHogClient();
         if (postHogClient) {
             postHogClient.capture({
@@ -1002,11 +950,7 @@ export const updateSecrets = async (req: Request, res: Response) => {
                     environment: workspaceSecretObj[key][0].environment,
                     workspaceId: key,
                     channel: channel,
-                    userAgent: req.headers?.['user-agent'],
-                    isPaid,
-                    email: await TelemetryService.getDistinctId({
-                        authData: req.authData
-                    })
+                    userAgent: req.headers?.['user-agent']
                 }
             });
         }
@@ -1128,12 +1072,6 @@ export const deleteSecrets = async (req: Request, res: Response) => {
             workspaceId: new Types.ObjectId(key)
         });
 
-        const workspace = await Workspace.findById(key);
-        if (!workspace) throw WorkspaceNotFoundError();
-        
-        const orgPlan = await EELicenseService.getOrganizationPlan(workspace.organization.toString());
-        const isPaid = orgPlan.tier >= 1;
-
         const postHogClient = await TelemetryService.getPostHogClient();
         if (postHogClient) {
             postHogClient.capture({
@@ -1146,11 +1084,7 @@ export const deleteSecrets = async (req: Request, res: Response) => {
                     environment: workspaceSecretObj[key][0].environment,
                     workspaceId: key,
                     channel: channel,
-                    userAgent: req.headers?.['user-agent'],
-                    isPaid,
-                    email: await TelemetryService.getDistinctId({
-                        authData: req.authData
-                    })
+                    userAgent: req.headers?.['user-agent']
                 }
             });
         }

backend/src/controllers/v2/signupController.ts

@@ -7,9 +7,8 @@ import {
 } from '../../helpers/signup';
 import { issueAuthTokens } from '../../helpers/auth';
 import { INVITED, ACCEPTED } from '../../variables';
-import { standardRequest } from '../../config/request';
+import request from '../../config/request';
 import { getLoopsApiKey, getHttpsEnabled } from '../../config';
-import { updateSubscriptionOrgQuantity } from '../../helpers/organization';
 
 /**
  * Complete setting up user by adding their personal and auth information as part of the
@@ -88,19 +87,6 @@ export const completeAccountSignup = async (req: Request, res: Response) => {
 			user
 		});
 
-		// update organization membership statuses that are
-		// invited to completed with user attached
-		const membershipsToUpdate = await MembershipOrg.find({
-			inviteEmail: email,
-			status: INVITED
-		});
-		
-		membershipsToUpdate.forEach(async (membership) => {
-			await updateSubscriptionOrgQuantity({
-				organizationId: membership.organization.toString()
-			});
-		});
-
 		// update organization membership statuses that are
 		// invited to completed with user attached
 		await MembershipOrg.updateMany(
@@ -123,7 +109,7 @@ export const completeAccountSignup = async (req: Request, res: Response) => {
 
 		// sending a welcome email to new users
 		if (await getLoopsApiKey()) {
-			await standardRequest.post("https://app.loops.so/api/v1/events/send", {
+			await request.post("https://app.loops.so/api/v1/events/send", {
 				"email": email,
 				"eventName": "Sign Up",
 				"firstName": firstName,
@@ -220,20 +206,9 @@ export const completeAccountInvite = async (req: Request, res: Response) => {
 
 		if (!user)
 			throw new Error('Failed to complete account for non-existent user');
-		
+
 		// update organization membership statuses that are
 		// invited to completed with user attached
-		const membershipsToUpdate = await MembershipOrg.find({
-			inviteEmail: email,
-			status: INVITED
-		});
-		
-		membershipsToUpdate.forEach(async (membership) => {
-			await updateSubscriptionOrgQuantity({
-				organizationId: membership.organization.toString()
-			});
-		});
-
 		await MembershipOrg.updateMany(
 			{
 				inviteEmail: email,

backend/src/controllers/v3/authController.ts

@@ -1,260 +0,0 @@
-/* eslint-disable @typescript-eslint/no-var-requires */
-import { Request, Response } from 'express';
-import jwt from 'jsonwebtoken';
-import * as Sentry from '@sentry/node';
-import * as bigintConversion from 'bigint-conversion';
-const jsrp = require('jsrp');
-import { User, LoginSRPDetail } from '../../models';
-import { issueAuthTokens, createToken, validateProviderAuthToken } from '../../helpers/auth';
-import { checkUserDevice } from '../../helpers/user';
-import { sendMail } from '../../helpers/nodemailer';
-import { TokenService } from '../../services';
-import { EELogService } from '../../ee/services';
-import { BadRequestError, InternalServerError } from '../../utils/errors';
-import {
-    TOKEN_EMAIL_MFA,
-    ACTION_LOGIN
-} from '../../variables';
-import { getChannelFromUserAgent } from '../../utils/posthog'; // TODO: move this
-import {
-    getJwtMfaLifetime,
-    getJwtMfaSecret,
-    getHttpsEnabled,
-} from '../../config';
-import { AuthProvider } from '../../models/user';
-
-declare module 'jsonwebtoken' {
-    export interface ProviderAuthJwtPayload extends jwt.JwtPayload {
-        userId: string;
-        email: string;
-        authProvider: AuthProvider;
-        isUserCompleted: boolean,
-    }
-}
-
-/**
- * Log in user step 1: Return [salt] and [serverPublicKey] as part of step 1 of SRP protocol
- * @param req
- * @param res
- * @returns
- */
-export const login1 = async (req: Request, res: Response) => {
-    try {
-        const {
-            email,
-            providerAuthToken,
-            clientPublicKey
-        }: {
-            email: string;
-            clientPublicKey: string,
-            providerAuthToken?: string;
-        } = req.body;
-
-        const user = await User.findOne({
-            email,
-        }).select('+salt +verifier');
-
-        if (!user) throw new Error('Failed to find user');
-
-        if (user.authProvider) {
-            await validateProviderAuthToken({
-                email,
-                user,
-                providerAuthToken,
-            })
-        }
-
-        const server = new jsrp.server();
-        server.init(
-            {
-                salt: user.salt,
-                verifier: user.verifier
-            },
-            async () => {
-                // generate server-side public key
-                const serverPublicKey = server.getPublicKey();
-                await LoginSRPDetail.findOneAndReplace({
-                    email: email
-                }, {
-                    email,
-                    userId: user.id,
-                    clientPublicKey: clientPublicKey,
-                    serverBInt: bigintConversion.bigintToBuf(server.bInt),
-                }, { upsert: true, returnNewDocument: false });
-
-                return res.status(200).send({
-                    serverPublicKey,
-                    salt: user.salt
-                });
-            }
-        );
-    } catch (err) {
-        Sentry.setUser(null);
-        Sentry.captureException(err);
-        return res.status(400).send({
-            message: 'Failed to start authentication process'
-        });
-    }
-};
-
-/**
- * Log in user step 2: complete step 2 of SRP protocol and return token and their (encrypted)
- * private key
- * @param req
- * @param res
- * @returns
- */
-export const login2 = async (req: Request, res: Response) => {
-    try {
-
-        if (!req.headers['user-agent']) throw InternalServerError({ message: 'User-Agent header is required' });
-
-        const { email, clientProof, providerAuthToken } = req.body;
-
-        const user = await User.findOne({
-            email,
-        }).select('+salt +verifier +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag +publicKey +encryptedPrivateKey +iv +tag');
-
-        if (!user) throw new Error('Failed to find user');
-
-        if (user.authProvider) {
-            await validateProviderAuthToken({
-                email,
-                user,
-                providerAuthToken,
-            })
-        }
-
-        const loginSRPDetail = await LoginSRPDetail.findOneAndDelete({ email: email })
-
-        if (!loginSRPDetail) {
-            return BadRequestError(Error("Failed to find login details for SRP"))
-        }
-
-        const server = new jsrp.server();
-        server.init(
-            {
-                salt: user.salt,
-                verifier: user.verifier,
-                b: loginSRPDetail.serverBInt
-            },
-            async () => {
-                server.setClientPublicKey(loginSRPDetail.clientPublicKey);
-
-                // compare server and client shared keys
-                if (server.checkClientProof(clientProof)) {
-
-                    if (user.isMfaEnabled) {
-                        // case: user has MFA enabled
-
-                        // generate temporary MFA token
-                        const token = createToken({
-                            payload: {
-                                userId: user._id.toString()
-                            },
-                            expiresIn: await getJwtMfaLifetime(),
-                            secret: await getJwtMfaSecret()
-                        });
-
-                        const code = await TokenService.createToken({
-                            type: TOKEN_EMAIL_MFA,
-                            email
-                        });
-
-                        // send MFA code [code] to [email]
-                        await sendMail({
-                            template: 'emailMfa.handlebars',
-                            subjectLine: 'Infisical MFA code',
-                            recipients: [user.email],
-                            substitutions: {
-                                code
-                            }
-                        });
-
-                        return res.status(200).send({
-                            mfaEnabled: true,
-                            token
-                        });
-                    }
-
-                    await checkUserDevice({
-                        user,
-                        ip: req.ip,
-                        userAgent: req.headers['user-agent'] ?? ''
-                    });
-
-                    // issue tokens
-                    const tokens = await issueAuthTokens({ userId: user._id.toString() });
-
-                    // store (refresh) token in httpOnly cookie
-                    res.cookie('jid', tokens.refreshToken, {
-                        httpOnly: true,
-                        path: '/',
-                        sameSite: 'strict',
-                        secure: await getHttpsEnabled()
-                    });
-
-                    // case: user does not have MFA enablgged
-                    // return (access) token in response
-
-                    interface ResponseData {
-                        mfaEnabled: boolean;
-                        encryptionVersion: any;
-                        protectedKey?: string;
-                        protectedKeyIV?: string;
-                        protectedKeyTag?: string;
-                        token: string;
-                        publicKey?: string;
-                        encryptedPrivateKey?: string;
-                        iv?: string;
-                        tag?: string;
-                    }
-
-                    const response: ResponseData = {
-                        mfaEnabled: false,
-                        encryptionVersion: user.encryptionVersion,
-                        token: tokens.token,
-                        publicKey: user.publicKey,
-                        encryptedPrivateKey: user.encryptedPrivateKey,
-                        iv: user.iv,
-                        tag: user.tag
-                    }
-
-                    if (
-                        user?.protectedKey &&
-                        user?.protectedKeyIV &&
-                        user?.protectedKeyTag
-                    ) {
-                        response.protectedKey = user.protectedKey;
-                        response.protectedKeyIV = user.protectedKeyIV
-                        response.protectedKeyTag = user.protectedKeyTag;
-                    }
-
-                    const loginAction = await EELogService.createAction({
-                        name: ACTION_LOGIN,
-                        userId: user._id
-                    });
-
-                    loginAction && await EELogService.createLog({
-                        userId: user._id,
-                        actions: [loginAction],
-                        channel: getChannelFromUserAgent(req.headers['user-agent']),
-                        ipAddress: req.ip
-                    });
-
-                    return res.status(200).send(response);
-                }
-
-                return res.status(400).send({
-                    message: 'Failed to authenticate. Try again?'
-                });
-            }
-        );
-    } catch (err) {
-        Sentry.setUser(null);
-        Sentry.captureException(err);
-        return res.status(400).send({
-            message: 'Failed to authenticate. Try again?'
-        });
-    }
-};

backend/src/controllers/v3/index.ts

@@ -1,11 +1,7 @@
 import * as secretsController from './secretsController';
 import * as workspacesController from './workspacesController';
-import * as authController from './authController';
-import * as signupController from './signupController';
 
 export {
-    authController,
     secretsController,
-    signupController,
-    workspacesController,
-}
+    workspacesController
+}

backend/src/controllers/v3/signupController.ts

@@ -1,192 +0,0 @@
-import jwt from 'jsonwebtoken';
-import { Request, Response } from 'express';
-import * as Sentry from '@sentry/node';
-import { User, MembershipOrg } from '../../models';
-import { completeAccount } from '../../helpers/user';
-import {
-	initializeDefaultOrg
-} from '../../helpers/signup';
-import { issueAuthTokens, validateProviderAuthToken } from '../../helpers/auth';
-import { INVITED, ACCEPTED } from '../../variables';
-import { standardRequest } from '../../config/request';
-import { getLoopsApiKey, getHttpsEnabled, getJwtSignupSecret } from '../../config';
-import { BadRequestError } from '../../utils/errors';
-import { TelemetryService } from '../../services';
-
-/**
- * Complete setting up user by adding their personal and auth information as part of the
- * signup flow
- * @param req
- * @param res
- * @returns
- */
-export const completeAccountSignup = async (req: Request, res: Response) => {
-	let user, token, refreshToken;
-	try {
-		const {
-			email,
-			firstName,
-			lastName,
-			protectedKey,
-			protectedKeyIV,
-			protectedKeyTag,
-			publicKey,
-			encryptedPrivateKey,
-			encryptedPrivateKeyIV,
-			encryptedPrivateKeyTag,
-			salt,
-			verifier,
-			organizationName,
-			providerAuthToken,
-			attributionSource,
-		}: {
-			email: string;
-			firstName: string;
-			lastName: string;
-			protectedKey: string;
-			protectedKeyIV: string;
-			protectedKeyTag: string;
-			publicKey: string;
-			encryptedPrivateKey: string;
-			encryptedPrivateKeyIV: string;
-			encryptedPrivateKeyTag: string;
-			salt: string;
-			verifier: string;
-			organizationName: string;
-			providerAuthToken?: string;
-			attributionSource?: string;
-		} = req.body;
-
-		user = await User.findOne({ email });
-
-		if (!user || (user && user?.publicKey)) {
-			// case 1: user doesn't exist.
-			// case 2: user has already completed account
-			return res.status(403).send({
-				error: 'Failed to complete account for complete user'
-			});
-		}
-
-		if (providerAuthToken) {
-			await validateProviderAuthToken({
-				email,
-				providerAuthToken,
-				user,
-			});
-		} else {
-			const [AUTH_TOKEN_TYPE, AUTH_TOKEN_VALUE] = <[string, string]>req.headers['authorization']?.split(' ', 2) ?? [null, null]
-			if (AUTH_TOKEN_TYPE === null) {
-				throw BadRequestError({ message: `Missing Authorization Header in the request header.` });
-			}
-			if (AUTH_TOKEN_TYPE.toLowerCase() !== 'bearer') {
-				throw BadRequestError({ message: `The provided authentication type '${AUTH_TOKEN_TYPE}' is not supported.` })
-			}
-			if (AUTH_TOKEN_VALUE === null) {
-				throw BadRequestError({
-					message: 'Missing Authorization Body in the request header',
-				})
-			}
-
-			const decodedToken = <jwt.UserIDJwtPayload>(
-				jwt.verify(AUTH_TOKEN_VALUE, await getJwtSignupSecret())
-			);
-
-			if (decodedToken.userId !== user.id) {
-				throw BadRequestError();
-			}
-		}
-
-		// complete setting up user's account
-		user = await completeAccount({
-			userId: user._id.toString(),
-			firstName,
-			lastName,
-			encryptionVersion: 2,
-			protectedKey,
-			protectedKeyIV,
-			protectedKeyTag,
-			publicKey,
-			encryptedPrivateKey,
-			encryptedPrivateKeyIV,
-			encryptedPrivateKeyTag,
-			salt,
-			verifier
-		});
-
-		if (!user)
-			throw new Error('Failed to complete account for non-existent user'); // ensure user is non-null
-
-		// initialize default organization and workspace
-		await initializeDefaultOrg({
-			organizationName,
-			user
-		});
-
-		// update organization membership statuses that are
-		// invited to completed with user attached
-		await MembershipOrg.updateMany(
-			{
-				inviteEmail: email,
-				status: INVITED
-			},
-			{
-				user,
-				status: ACCEPTED
-			}
-		);
-
-		// issue tokens
-		const tokens = await issueAuthTokens({
-			userId: user._id.toString()
-		});
-
-		token = tokens.token;
-
-		// sending a welcome email to new users
-		if (await getLoopsApiKey()) {
-			await standardRequest.post("https://app.loops.so/api/v1/events/send", {
-				"email": email,
-				"eventName": "Sign Up",
-				"firstName": firstName,
-				"lastName": lastName
-			}, {
-				headers: {
-					"Accept": "application/json",
-					"Authorization": "Bearer " + (await getLoopsApiKey())
-				},
-			});
-		}
-
-		// store (refresh) token in httpOnly cookie
-		res.cookie('jid', tokens.refreshToken, {
-			httpOnly: true,
-			path: '/',
-			sameSite: 'strict',
-			secure: await getHttpsEnabled()
-		});
-
-		const postHogClient = await TelemetryService.getPostHogClient();
-		if (postHogClient) {
-			postHogClient.capture({
-				event: 'User Signed Up',
-				distinctId: email,
-				properties: {
-					email,
-					attributionSource
-				}
-			});
-		}
-	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to complete account setup'
-		});
-	}
-
-	return res.status(200).send({
-		message: 'Successfully set up account',
-		user,
-		token
-	});
-};

backend/src/ee/controllers/v1/cloudProductsController.ts

@@ -1,34 +0,0 @@
-import * as Sentry from '@sentry/node';
-import { Request, Response } from 'express';
-import { EELicenseService } from '../../services';
-import { getLicenseServerUrl } from '../../../config';
-import { licenseServerKeyRequest } from '../../../config/request';
-
-/**
- * Return available cloud product information.
- * Note: Nicely formatted to easily construct a table from
- * @param req 
- * @param res 
- * @returns 
- */
-export const getCloudProducts = async (req: Request, res: Response) => {
-    try {
-        const billingCycle = req.query['billing-cycle'] as string;
-
-        if (EELicenseService.instanceType === 'cloud') {
-            const { data } = await licenseServerKeyRequest.get(
-                `${await getLicenseServerUrl()}/api/license-server/v1/cloud-products?billing-cycle=${billingCycle}`
-            ); 
-
-            return res.status(200).send(data);
-        }
-    } catch (err) {
-        Sentry.setUser({ email: req.user.email });
-        Sentry.captureException(err);
-    }
-    
-    return res.status(200).send({
-        head: [],
-        rows: []
-    });
-}

backend/src/ee/controllers/v1/index.ts

@@ -1,19 +1,15 @@
 import * as stripeController from './stripeController';
 import * as secretController from './secretController';
 import * as secretSnapshotController from './secretSnapshotController';
-import * as organizationsController from './organizationsController';
 import * as workspaceController from './workspaceController';
 import * as actionController from './actionController';
 import * as membershipController from './membershipController';
-import * as cloudProductsController from './cloudProductsController';
 
 export {
     stripeController,
     secretController,
     secretSnapshotController,
-    organizationsController,
     workspaceController,
     actionController,
-    membershipController,
-    cloudProductsController
+    membershipController
 }

backend/src/ee/controllers/v1/organizationsController.ts

@@ -1,83 +0,0 @@
-import { Request, Response } from 'express';
-import { getLicenseServerUrl } from '../../../config';
-import { licenseServerKeyRequest } from '../../../config/request';
-import { EELicenseService } from '../../services';
-
-/**
- * Return the organization's current plan and allowed feature set
- */
-export const getOrganizationPlan = async (req: Request, res: Response) => {
-    const { organizationId } = req.params;
-
-    const plan = await EELicenseService.getOrganizationPlan(organizationId);
-
-    return res.status(200).send({
-        plan,
-    });
-}
-
-/**
- * Update the organization plan to product with id [productId]
- * @param req 
- * @param res 
- * @returns 
- */
-export const updateOrganizationPlan = async (req: Request, res: Response) => {
-    const {
-        productId
-    } = req.body;
-
-    const { data  } = await licenseServerKeyRequest.patch(
-        `${await getLicenseServerUrl()}/api/license-server/v1/customers/${req.organization.customerId}/cloud-plan`,
-        {
-            productId
-        }
-    ); 
-    
-    return res.status(200).send(data);
-}
-
-/**
- * Return the organization's payment methods on file
- */
-export const getOrganizationPmtMethods = async (req: Request, res: Response) => {
-    const { data: { pmtMethods } } = await licenseServerKeyRequest.get(
-        `${await getLicenseServerUrl()}/api/license-server/v1/customers/${req.organization.customerId}/billing-details/payment-methods`
-    );
-
-    return res.status(200).send({
-        pmtMethods
-    }); 
-}
-
-/**
- * Return a Stripe session URL to add payment method for organization
- */
-export const addOrganizationPmtMethod = async (req: Request, res: Response) => {
-    const {
-        success_url,
-        cancel_url
-    } = req.body;
-    
-    const { data: { url } } = await licenseServerKeyRequest.post(
-        `${await getLicenseServerUrl()}/api/license-server/v1/customers/${req.organization.customerId}/billing-details/payment-methods`,
-        {
-            success_url,
-            cancel_url
-        }
-    );
-    
-    return res.status(200).send({
-        url
-    }); 
-}
-
-export const deleteOrganizationPmtMethod = async (req: Request, res: Response) => {
-    const { pmtMethodId } = req.params;
-
-    const { data } = await licenseServerKeyRequest.delete(
-        `${await getLicenseServerUrl()}/api/license-server/v1/customers/${req.organization.customerId}/billing-details/payment-methods/${pmtMethodId}`,
-    );
-        
-    return res.status(200).send(data);
-}

backend/src/ee/controllers/v1/secretController.ts

@@ -162,8 +162,6 @@ export const rollbackSecretVersion = async (req: Request, res: Response) => {
 			secretValueCiphertext,
 			secretValueIV,
 			secretValueTag,
-			algorithm,
-			keyEncoding
 		} = oldSecretVersion;
 		
 		// update secret
@@ -184,8 +182,6 @@ export const rollbackSecretVersion = async (req: Request, res: Response) => {
 				secretValueCiphertext,
 				secretValueIV,
 				secretValueTag,
-				algorithm,
-				keyEncoding
 			},
 			{
 				new: true
@@ -209,9 +205,7 @@ export const rollbackSecretVersion = async (req: Request, res: Response) => {
 			secretKeyTag,
 			secretValueCiphertext,
 			secretValueIV,
-			secretValueTag,
-			algorithm,
-			keyEncoding
+			secretValueTag
 		}).save();
 		
 		// take secret snapshot

backend/src/ee/helpers/secret.ts

@@ -93,8 +93,52 @@ const markDeletedSecretVersionsHelper = async ({
   );
 };
 
+/**
+ * Initialize secret versioning by setting previously unversioned
+ * secrets to version 1 and begin populating secret versions.
+ */
+const initSecretVersioningHelper = async () => {
+  await Secret.updateMany(
+    { version: { $exists: false } },
+    { $set: { version: 1 } }
+  );
+
+  const unversionedSecrets: ISecret[] = await Secret.aggregate([
+    {
+      $lookup: {
+        from: "secretversions",
+        localField: "_id",
+        foreignField: "secret",
+        as: "versions",
+      },
+    },
+    {
+      $match: {
+        versions: { $size: 0 },
+      },
+    },
+  ]);
+
+  if (unversionedSecrets.length > 0) {
+    await addSecretVersionsHelper({
+      secretVersions: unversionedSecrets.map(
+        (s, idx) =>
+          new SecretVersion({
+            ...s,
+            secret: s._id,
+            version: s.version ? s.version : 1,
+            isDeleted: false,
+            workspace: s.workspace,
+            environment: s.environment,
+          })
+      ),
+    });
+  }
+};
+
 export {
   takeSecretSnapshotHelper,
   addSecretVersionsHelper,
-  markDeletedSecretVersionsHelper
+  markDeletedSecretVersionsHelper,
+  initSecretVersioningHelper,
 };

backend/src/ee/models/secretVersion.ts

@@ -2,9 +2,6 @@ import { Schema, model, Types } from 'mongoose';
 import {
 	SECRET_SHARED,
 	SECRET_PERSONAL,
-	ALGORITHM_AES_256_GCM,
-	ENCODING_SCHEME_UTF8,
-	ENCODING_SCHEME_BASE64
 } from '../../variables';
 
 export interface ISecretVersion {
@@ -23,8 +20,6 @@ export interface ISecretVersion {
 	secretValueCiphertext: string;
 	secretValueIV: string;
 	secretValueTag: string;
-	algorithm: 'aes-256-gcm';
-	keyEncoding: 'utf8' | 'base64';
 }
 
 const secretVersionSchema = new Schema<ISecretVersion>(
@@ -90,20 +85,7 @@ const secretVersionSchema = new Schema<ISecretVersion>(
 		secretValueTag: {
 			type: String, // symmetric
 			required: true
-		},
-		algorithm: { // the encryption algorithm used
-			type: String,
-			enum: [ALGORITHM_AES_256_GCM],
-			required: true
-		},
-		keyEncoding: {
-			type: String,
-			enum: [
-				ENCODING_SCHEME_UTF8,
-				ENCODING_SCHEME_BASE64
-			],
-			required: true
-		},
+		}
 	},
 	{
 		timestamps: true

backend/src/ee/routes/v1/cloudProducts.ts

@@ -1,20 +0,0 @@
-import express from 'express';
-const router = express.Router();
-import {
-    requireAuth,
-    validateRequest
-} from '../../../middleware';
-import { query } from 'express-validator';
-import { cloudProductsController } from '../../controllers/v1';
-
-router.get(
-    '/',
-    requireAuth({
-		acceptedAuthModes: ['jwt', 'apiKey']
-	}),
-    query('billing-cycle').exists().isIn(['monthly', 'yearly']),
-    validateRequest,
-    cloudProductsController.getCloudProducts 
-);
-
-export default router;

backend/src/ee/routes/v1/index.ts

@@ -1,15 +1,11 @@
 import secret from './secret';
 import secretSnapshot from './secretSnapshot';
-import organizations from './organizations';
 import workspace from './workspace';
 import action from './action';
-import cloudProducts from './cloudProducts';
 
 export {
     secret,
     secretSnapshot,
-    organizations,
     workspace,
-    action,
-    cloudProducts
+    action
 }

backend/src/ee/routes/v1/organizations.ts

@@ -1,87 +0,0 @@
-import express from 'express';
-const router = express.Router();
-import {
-    requireAuth,
-    requireOrganizationAuth,
-    validateRequest
-} from '../../../middleware';
-import { param, body } from 'express-validator';
-import { organizationsController } from '../../controllers/v1';
-import {
-    OWNER, ADMIN, MEMBER, ACCEPTED
-} from '../../../variables';
-
-router.get(
-    '/:organizationId/plan',
-    requireAuth({
-		acceptedAuthModes: ['jwt', 'apiKey']
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED]
-    }),
-    param('organizationId').exists().trim(),
-    validateRequest,
-    organizationsController.getOrganizationPlan
-);
-
-router.patch(
-    '/:organizationId/plan',
-    requireAuth({
-		acceptedAuthModes: ['jwt', 'apiKey']
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED]
-    }),
-    param('organizationId').exists().trim(),
-    body('productId').exists().isString(),
-    validateRequest,
-    organizationsController.updateOrganizationPlan
-);
-
-router.get(
-    '/:organizationId/billing-details/payment-methods',
-    requireAuth({
-		acceptedAuthModes: ['jwt', 'apiKey']
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED]
-    }),
-    param('organizationId').exists().trim(),
-    validateRequest,
-    organizationsController.getOrganizationPmtMethods
-);
-
-router.post(
-    '/:organizationId/billing-details/payment-methods',
-    requireAuth({
-		acceptedAuthModes: ['jwt', 'apiKey']
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED]
-    }),
-    param('organizationId').exists().trim(),
-    body('success_url').exists().isString(),
-    body('cancel_url').exists().isString(),
-    validateRequest,
-    organizationsController.addOrganizationPmtMethod
-);
-
-router.delete(
-    '/:organizationId/billing-details/payment-methods/:pmtMethodId',
-    requireAuth({
-		acceptedAuthModes: ['jwt', 'apiKey']
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED]
-    }),
-    param('organizationId').exists().trim(),
-    validateRequest,
-    organizationsController.deleteOrganizationPmtMethod
-);
-
-export default router;

backend/src/ee/routes/v1/secretSnapshot.ts

@@ -7,7 +7,7 @@ import {
     requireAuth,
     validateRequest
 } from '../../../middleware';
-import { param } from 'express-validator';
+import { param, body } from 'express-validator';
 import { ADMIN, MEMBER } from '../../../variables';
 import { secretSnapshotController } from '../../controllers/v1';
 

backend/src/ee/services/EELicenseService.ts

@@ -1,133 +1,12 @@
-import NodeCache from 'node-cache';
-import * as Sentry from '@sentry/node';
-import { 
-    getLicenseKey,
-    getLicenseServerKey,
-    getLicenseServerUrl
-} from '../../config';
-import { 
-    licenseKeyRequest,
-    licenseServerKeyRequest,
-    refreshLicenseServerKeyToken,
-    refreshLicenseKeyToken
-} from '../../config/request';
-import { Organization } from '../../models';
-import { OrganizationNotFoundError } from '../../utils/errors';
-
-interface FeatureSet {
-    _id: string | null;
-    slug: 'starter' | 'team' | 'pro' | 'enterprise' | null;
-    tier: number;
-    workspaceLimit: number | null;
-    workspacesUsed: number;
-    memberLimit: number | null;
-    membersUsed: number;
-    secretVersioning: boolean;
-    pitRecovery: boolean;
-    rbac: boolean;
-    customRateLimits: boolean;
-    customAlerts: boolean;
-    auditLogs: boolean;
-}
-
 /**
- * Class to handle license/plan configurations:
- * - Infisical Cloud: Fetch and cache customer plans in [localFeatureSet]
- * - Self-hosted regular: Use default global feature set
- * - Self-hosted enterprise: Fetch and update global feature set
+ * Class to handle Enterprise Edition license actions
  */
 class EELicenseService {
     
-    private readonly _isLicenseValid: boolean; // TODO: deprecate
-
-    public instanceType: 'self-hosted' | 'enterprise-self-hosted' | 'cloud' = 'self-hosted';
-
-    public globalFeatureSet: FeatureSet = {
-        _id: null,
-        slug: null,
-        tier: -1,
-        workspaceLimit: null,
-        workspacesUsed: 0,
-        memberLimit: null,
-        membersUsed: 0,
-        secretVersioning: true,
-        pitRecovery: true,
-        rbac: true,
-        customRateLimits: true,
-        customAlerts: true,
-        auditLogs: false
-    }
-
-    public localFeatureSet: NodeCache;
+    private readonly _isLicenseValid: boolean;
     
-    constructor() {
+    constructor(licenseKey: string) {
         this._isLicenseValid = true;
-        this.localFeatureSet = new NodeCache({
-            stdTTL: 300
-        });
-    }
-    
-    public async getOrganizationPlan(organizationId: string): Promise<FeatureSet> {
-        try {
-            if (this.instanceType === 'cloud') {
-                const cachedPlan = this.localFeatureSet.get<FeatureSet>(organizationId);
-                if (cachedPlan) {
-                    return cachedPlan;
-                }
-
-                const organization = await Organization.findById(organizationId);
-                if (!organization) throw OrganizationNotFoundError();
-
-                const { data: { currentPlan } } = await licenseServerKeyRequest.get(
-                    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${organization.customerId}/cloud-plan`
-                );
-
-                // cache fetched plan for organization
-                this.localFeatureSet.set(organizationId, currentPlan);
-
-                return currentPlan;
-            }
-        } catch (err) {
-            return this.globalFeatureSet;
-        }
-
-        return this.globalFeatureSet;
-    }
-
-    public async initGlobalFeatureSet() {
-        const licenseServerKey = await getLicenseServerKey();
-        const licenseKey = await getLicenseKey();
-
-        try {
-            if (licenseServerKey) {
-                // license server key is present -> validate it
-                const token = await refreshLicenseServerKeyToken()
-                    
-                if (token) {
-                    this.instanceType = 'cloud';
-                }
-                
-                return;
-            }
-            
-            if (licenseKey) {
-                // license key is present -> validate it
-                const token = await refreshLicenseKeyToken();
-                    
-                if (token) {
-                    const { data: { currentPlan } } = await licenseKeyRequest.get(
-                        `${await getLicenseServerUrl()}/api/license/v1/plan`
-                    );
-                    
-                    this.globalFeatureSet = currentPlan;
-                    this.instanceType = 'enterprise-self-hosted';
-                }
-            }
-        } catch (err) {
-            // case: self-hosted free
-            Sentry.setUser(null);
-            Sentry.captureException(err);
-        }
     }
 
     public get isLicenseValid(): boolean {
@@ -135,4 +14,4 @@ class EELicenseService {
     }
 }
 
-export default new EELicenseService();
+export default new EELicenseService('N/A');

backend/src/ee/services/EESecretService.ts

@@ -3,7 +3,8 @@ import { ISecretVersion } from '../models';
 import { 
     takeSecretSnapshotHelper,
     addSecretVersionsHelper,
-    markDeletedSecretVersionsHelper
+    markDeletedSecretVersionsHelper,
+    initSecretVersioningHelper
 } from '../helpers/secret';
 import EELicenseService from './EELicenseService';
 
@@ -63,6 +64,15 @@ class EESecretService {
             secretIds
         });
     }
+    
+    /**
+     * Initialize secret versioning by setting previously unversioned
+     * secrets to version 1 and begin populating secret versions.
+     */
+    static async initSecretVersioning() {
+        if (!EELicenseService.isLicenseValid) return; 
+        await initSecretVersioningHelper();
+    }
 }
 
 export default EESecretService;

backend/src/helpers/auth.ts

@@ -19,7 +19,6 @@ import {
 import {
 	getJwtAuthLifetime,
 	getJwtAuthSecret,
-	getJwtProviderAuthSecret,
 	getJwtRefreshLifetime,
 	getJwtRefreshSecret
 } from '../config';
@@ -42,9 +41,10 @@ const validateAuthMode = ({
 	headers: { [key: string]: string | string[] | undefined },
 	acceptedAuthModes: string[]
 }) => {
+	// TODO: refactor middleware
 	const apiKey = headers['x-api-key'];
 	const authHeader = headers['authorization'];
-	
+
 	let authMode, authTokenValue;
 	if (apiKey === undefined && authHeader === undefined) {
 		// case: no auth or X-API-KEY header present
@@ -318,34 +318,8 @@ const createToken = ({
 	});
 };
 
-const validateProviderAuthToken = async ({
-	email,
-	user,
-	providerAuthToken,
-}: {
-	email: string;
-	user: IUser,
-	providerAuthToken?: string;
-}) => {
-	if (!providerAuthToken) {
-		throw new Error('Invalid authentication request.');
-	}
-
-	const decodedToken = <jwt.ProviderAuthJwtPayload>(
-		jwt.verify(providerAuthToken, await getJwtProviderAuthSecret())
-	);
-	
-	if (
-		decodedToken.authProvider !== user.authProvider ||
-		decodedToken.email !== email
-	) {
-		throw new Error('Invalid authentication credentials.')
-	}
-}
-
 export {
 	validateAuthMode,
-	validateProviderAuthToken,
 	getAuthUserPayload,
 	getAuthSTDPayload,
 	getAuthSAAKPayload,

backend/src/helpers/bot.ts

@@ -4,26 +4,107 @@ import {
   BotKey,
   Secret,
   ISecret,
-  IUser
+  IUser,
+  User,
+  IServiceAccount,
+  ServiceAccount,
+  IServiceTokenData,
+  ServiceTokenData,
 } from "../models";
 import {
   generateKeyPair,
-  encryptSymmetric128BitHexKeyUTF8,
-  decryptSymmetric128BitHexKeyUTF8,
-  decryptAsymmetric
-} from '../utils/crypto';
+  encryptSymmetric,
+  decryptSymmetric,
+  decryptAsymmetric,
+} from "../utils/crypto";
 import {
   SECRET_SHARED,
-  ALGORITHM_AES_256_GCM,
-  ENCODING_SCHEME_UTF8,
-  ENCODING_SCHEME_BASE64
+  AUTH_MODE_JWT,
+  AUTH_MODE_SERVICE_ACCOUNT,
+  AUTH_MODE_SERVICE_TOKEN,
+  AUTH_MODE_API_KEY,
 } from "../variables";
-import { 
-  getEncryptionKey, 
-  getRootEncryptionKey,
-  client
-} from "../config";
-import { InternalServerError } from "../utils/errors";
+import { getEncryptionKey } from "../config";
+import { BotNotFoundError, UnauthorizedRequestError } from "../utils/errors";
+import { validateMembership } from "../helpers/membership";
+import { validateUserClientForWorkspace } from "../helpers/user";
+import { validateServiceAccountClientForWorkspace } from "../helpers/serviceAccount";
+
+/**
+ * Validate authenticated clients for bot with id [botId] based
+ * on any known permissions.
+ * @param {Object} obj
+ * @param {Object} obj.authData - authenticated client details
+ * @param {Types.ObjectId} obj.botId - id of bot to validate against
+ * @param {Array<'admin' | 'member'>} obj.acceptedRoles - accepted workspace roles
+ */
+const validateClientForBot = async ({
+  authData,
+  botId,
+  acceptedRoles,
+}: {
+  authData: {
+    authMode: string;
+    authPayload: IUser | IServiceAccount | IServiceTokenData;
+  };
+  botId: Types.ObjectId;
+  acceptedRoles: Array<"admin" | "member">;
+}) => {
+  const bot = await Bot.findById(botId);
+
+  if (!bot) throw BotNotFoundError();
+
+  if (
+    authData.authMode === AUTH_MODE_JWT &&
+    authData.authPayload instanceof User
+  ) {
+    await validateUserClientForWorkspace({
+      user: authData.authPayload,
+      workspaceId: bot.workspace,
+      acceptedRoles,
+    });
+
+    return bot;
+  }
+
+  if (
+    authData.authMode === AUTH_MODE_SERVICE_ACCOUNT &&
+    authData.authPayload instanceof ServiceAccount
+  ) {
+    await validateServiceAccountClientForWorkspace({
+      serviceAccount: authData.authPayload,
+      workspaceId: bot.workspace,
+    });
+
+    return bot;
+  }
+
+  if (
+    authData.authMode === AUTH_MODE_SERVICE_TOKEN &&
+    authData.authPayload instanceof ServiceTokenData
+  ) {
+    throw UnauthorizedRequestError({
+      message: "Failed service token authorization for bot",
+    });
+  }
+
+  if (
+    authData.authMode === AUTH_MODE_API_KEY &&
+    authData.authPayload instanceof User
+  ) {
+    await validateUserClientForWorkspace({
+      user: authData.authPayload,
+      workspaceId: bot.workspace,
+      acceptedRoles,
+    });
+
+    return bot;
+  }
+
+  throw BotNotFoundError({
+    message: "Failed client authorization for bot",
+  });
+};
 
 /**
  * Create an inactive bot with name [name] for workspace with id [workspaceId]
@@ -38,52 +119,23 @@ const createBot = async ({
   name: string;
   workspaceId: Types.ObjectId;
 }) => {
-  const encryptionKey = await getEncryptionKey();
-  const rootEncryptionKey = await getRootEncryptionKey();
-  
   const { publicKey, privateKey } = generateKeyPair();
-  
-  if (rootEncryptionKey) {
-    const { 
-      ciphertext, 
-      iv, 
-      tag 
-    } = client.encryptSymmetric(privateKey, rootEncryptionKey);
-
-    return await new Bot({
-      name,
-      workspace: workspaceId,
-      isActive: false,
-      publicKey,
-      encryptedPrivateKey: ciphertext,
-      iv,
-      tag,
-      algorithm: ALGORITHM_AES_256_GCM,
-      keyEncoding: ENCODING_SCHEME_BASE64
-    }).save();
-  
-  } else if (encryptionKey) {
-    const { ciphertext, iv, tag } = encryptSymmetric128BitHexKeyUTF8({
-      plaintext: privateKey,
-      key: await getEncryptionKey(),
-    });
-
-    return await new Bot({
-      name,
-      workspace: workspaceId,
-      isActive: false,
-      publicKey,
-      encryptedPrivateKey: ciphertext,
-      iv,
-      tag,
-      algorithm: ALGORITHM_AES_256_GCM,
-      keyEncoding: ENCODING_SCHEME_UTF8
-    }).save();
-  }
-
-  throw InternalServerError({
-    message: 'Failed to create new bot due to missing encryption key'
+  const { ciphertext, iv, tag } = encryptSymmetric({
+    plaintext: privateKey,
+    key: await getEncryptionKey(),
   });
+
+  const bot = await new Bot({
+    name,
+    workspace: workspaceId,
+    isActive: false,
+    publicKey,
+    encryptedPrivateKey: ciphertext,
+    iv,
+    tag,
+  }).save();
+
+  return bot;
 };
 
 /**
@@ -109,14 +161,14 @@ const getSecretsHelper = async ({
   });
 
   secrets.forEach((secret: ISecret) => {
-    const secretKey = decryptSymmetric128BitHexKeyUTF8({
+    const secretKey = decryptSymmetric({
       ciphertext: secret.secretKeyCiphertext,
       iv: secret.secretKeyIV,
       tag: secret.secretKeyTag,
       key,
     });
 
-    const secretValue = decryptSymmetric128BitHexKeyUTF8({
+    const secretValue = decryptSymmetric({
       ciphertext: secret.secretValueCiphertext,
       iv: secret.secretValueIV,
       tag: secret.secretValueTag,
@@ -137,54 +189,34 @@ const getSecretsHelper = async ({
  * @returns {String} key - decrypted workspace key
  */
 const getKey = async ({ workspaceId }: { workspaceId: string }) => {
-  const encryptionKey = await getEncryptionKey();
-  const rootEncryptionKey = await getRootEncryptionKey();
-
   const botKey = await BotKey.findOne({
     workspace: workspaceId,
-  })
-  .populate<{ sender: IUser }>("sender", "publicKey");
+  }).populate<{ sender: IUser }>("sender", "publicKey");
 
   if (!botKey) throw new Error("Failed to find bot key");
 
   const bot = await Bot.findOne({
     workspace: workspaceId,
-  }).select("+encryptedPrivateKey +iv +tag +algorithm +keyEncoding");
+  }).select("+encryptedPrivateKey +iv +tag");
 
   if (!bot) throw new Error("Failed to find bot");
   if (!bot.isActive) throw new Error("Bot is not active");
 
-  if (rootEncryptionKey && bot.keyEncoding === ENCODING_SCHEME_BASE64) {
-    // case: encoding scheme is base64
-    const privateKeyBot = client.decryptSymmetric(bot.encryptedPrivateKey, rootEncryptionKey, bot.iv, bot.tag);
-
-    return decryptAsymmetric({
-      ciphertext: botKey.encryptedKey,
-      nonce: botKey.nonce,
-      publicKey: botKey.sender.publicKey as string,
-      privateKey: privateKeyBot,
-    });
-  } else if (encryptionKey && bot.keyEncoding === ENCODING_SCHEME_UTF8) {
-    
-    // case: encoding scheme is utf8
-    const privateKeyBot = decryptSymmetric128BitHexKeyUTF8({
-      ciphertext: bot.encryptedPrivateKey,
-      iv: bot.iv,
-      tag: bot.tag,
-      key: encryptionKey
-    });
-    
-    return decryptAsymmetric({
-      ciphertext: botKey.encryptedKey,
-      nonce: botKey.nonce,
-      publicKey: botKey.sender.publicKey as string,
-      privateKey: privateKeyBot,
-    });
-  }
-
-  throw InternalServerError({
-    message: "Failed to obtain bot's copy of workspace key needed for bot operations"
+  const privateKeyBot = decryptSymmetric({
+    ciphertext: bot.encryptedPrivateKey,
+    iv: bot.iv,
+    tag: bot.tag,
+    key: await getEncryptionKey(),
   });
+
+  const key = decryptAsymmetric({
+    ciphertext: botKey.encryptedKey,
+    nonce: botKey.nonce,
+    publicKey: botKey.sender.publicKey as string,
+    privateKey: privateKeyBot,
+  });
+
+  return key;
 };
 
 /**
@@ -202,7 +234,7 @@ const encryptSymmetricHelper = async ({
   plaintext: string;
 }) => {
   const key = await getKey({ workspaceId: workspaceId.toString() });
-  const { ciphertext, iv, tag } = encryptSymmetric128BitHexKeyUTF8({
+  const { ciphertext, iv, tag } = encryptSymmetric({
     plaintext,
     key,
   });
@@ -234,7 +266,7 @@ const decryptSymmetricHelper = async ({
   tag: string;
 }) => {
   const key = await getKey({ workspaceId: workspaceId.toString() });
-  const plaintext = decryptSymmetric128BitHexKeyUTF8({
+  const plaintext = decryptSymmetric({
     ciphertext,
     iv,
     tag,
@@ -245,8 +277,9 @@ const decryptSymmetricHelper = async ({
 };
 
 export {
+  validateClientForBot,
   createBot,
   getSecretsHelper,
   encryptSymmetricHelper,
-  decryptSymmetricHelper
+  decryptSymmetricHelper,
 };

backend/src/helpers/database.ts

@@ -1,4 +1,6 @@
 import mongoose from 'mongoose';
+import { EESecretService } from '../ee/services';
+import { SecretService } from '../services';
 import { getLogger } from '../utils/logger';
 
 /**
@@ -19,7 +21,9 @@ const initDatabaseHelper = async ({
         mongoose.Schema.Types.String.checkRequired(v => typeof v === 'string');
 
         (await getLogger("database")).info("Database connection established");
-
+        
+        await EESecretService.initSecretVersioning();
+        await SecretService.initSecretBlindIndexDataHelper();
     } catch (err) {
         (await getLogger("database")).error(`Unable to establish Database connection due to the error.\n${err}`);
     }

backend/src/helpers/integration.ts

@@ -3,20 +3,40 @@ import { Types } from 'mongoose';
 import {
     Bot,
     Integration,
-    IntegrationAuth
+    IntegrationAuth,
+    IUser,
+    User,
+    IServiceAccount,
+    ServiceAccount,
+    IServiceTokenData,
+    ServiceTokenData
 } from '../models';
 import { exchangeCode, exchangeRefresh, syncSecrets } from '../integrations';
 import { BotService } from '../services';
 import {
+    AUTH_MODE_JWT,
+	AUTH_MODE_SERVICE_ACCOUNT,
+	AUTH_MODE_SERVICE_TOKEN,
+	AUTH_MODE_API_KEY,
     INTEGRATION_VERCEL,
-    INTEGRATION_NETLIFY,
-    ALGORITHM_AES_256_GCM,
-    ENCODING_SCHEME_UTF8
+    INTEGRATION_NETLIFY
 } from '../variables';
 import { 
     UnauthorizedRequestError,
+    IntegrationAuthNotFoundError,
+    IntegrationNotFoundError
 } from '../utils/errors';
 import RequestError from '../utils/requestError';
+import {
+    validateClientForIntegrationAuth 
+} from '../helpers/integrationAuth';
+import {
+    validateUserClientForWorkspace
+} from '../helpers/user';
+import {
+    validateServiceAccountClientForWorkspace
+} from '../helpers/serviceAccount';
+import { IntegrationService } from '../services';
 
 interface Update {
     workspace: string;
@@ -25,6 +45,84 @@ interface Update {
     accountId?: string;
 }
 
+/**
+ * Validate authenticated clients for integration with id [integrationId] based
+ * on any known permissions.
+ * @param {Object} obj
+ * @param {Object} obj.authData - authenticated client details
+ * @param {Types.ObjectId} obj.integrationId - id of integration to validate against
+ * @param {String} obj.environment - (optional) environment in workspace to validate against
+ * @param {Array<'admin' | 'member'>} obj.acceptedRoles - accepted workspace roles
+ * @param {String[]} obj.requiredPermissions - required permissions as part of the endpoint
+ */
+ const validateClientForIntegration = async ({
+    authData,
+    integrationId,
+    acceptedRoles
+}: {
+    authData: {
+		authMode: string;
+		authPayload: IUser | IServiceAccount | IServiceTokenData;
+	};
+    integrationId: Types.ObjectId;
+    acceptedRoles: Array<'admin' | 'member'>;
+}) => {
+    
+    const integration = await Integration.findById(integrationId);
+    if (!integration) throw IntegrationNotFoundError();
+
+    const integrationAuth = await IntegrationAuth
+        .findById(integration.integrationAuth)
+        .select(
+			'+refreshCiphertext +refreshIV +refreshTag +accessCiphertext +accessIV +accessTag +accessExpiresAt'
+        );
+    
+    if (!integrationAuth) throw IntegrationAuthNotFoundError();
+
+    const accessToken = (await IntegrationService.getIntegrationAuthAccess({
+        integrationAuthId: integrationAuth._id
+    })).accessToken;
+
+    if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
+        await validateUserClientForWorkspace({
+            user: authData.authPayload,
+            workspaceId: integration.workspace,
+            acceptedRoles
+        });
+        
+        return ({ integration, accessToken });
+    }
+    
+    if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
+        await validateServiceAccountClientForWorkspace({
+            serviceAccount: authData.authPayload,
+            workspaceId: integration.workspace
+        });
+        
+        return ({ integration, accessToken });
+    }
+
+    if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
+        throw UnauthorizedRequestError({
+            message: 'Failed service token authorization for integration'
+        });
+    }
+
+    if (authData.authMode === AUTH_MODE_API_KEY && authData.authPayload instanceof User) {
+        await validateUserClientForWorkspace({
+            user: authData.authPayload,
+            workspaceId: integration.workspace,
+            acceptedRoles
+        });
+        
+        return ({ integration, accessToken });
+    }
+    
+    throw UnauthorizedRequestError({
+        message: 'Failed client authorization for integration'
+    });
+}
+
 /**
  * Perform OAuth2 code-token exchange for workspace with id [workspaceId] and integration
  * named [integration]
@@ -302,9 +400,7 @@ const setIntegrationAuthRefreshHelper = async ({
         }, {
             refreshCiphertext: obj.ciphertext,
             refreshIV: obj.iv,
-            refreshTag: obj.tag,
-            algorithm: ALGORITHM_AES_256_GCM,
-            keyEncoding: ENCODING_SCHEME_UTF8
+            refreshTag: obj.tag
         }, {
             new: true
         });
@@ -365,9 +461,7 @@ const setIntegrationAuthAccessHelper = async ({
             accessCiphertext: encryptedAccessTokenObj.ciphertext,
             accessIV: encryptedAccessTokenObj.iv,
             accessTag: encryptedAccessTokenObj.tag,
-            accessExpiresAt,
-            algorithm: ALGORITHM_AES_256_GCM,
-            keyEncoding: ENCODING_SCHEME_UTF8
+            accessExpiresAt
         }, {
             new: true
         });
@@ -381,6 +475,7 @@ const setIntegrationAuthAccessHelper = async ({
 }
 
 export {
+    validateClientForIntegration,
     handleOAuthExchangeHelper,
     syncIntegrationsHelper,
     getIntegrationAuthRefreshHelper,

backend/src/helpers/integrationAuth.ts

@@ -20,8 +20,8 @@ import {
     UnauthorizedRequestError
 } from '../utils/errors';
 import { IntegrationService } from '../services';
-import { validateUserClientForWorkspace } from './user';
-import { validateServiceAccountClientForWorkspace } from './serviceAccount';
+import { validateUserClientForWorkspace } from '../helpers/user';
+import { validateServiceAccountClientForWorkspace } from '../helpers/serviceAccount';
 
 /**
  * Validate authenticated clients for integration authorization with id [integrationAuthId] based

backend/src/helpers/membership.ts

@@ -2,12 +2,105 @@ import * as Sentry from '@sentry/node';
 import { Types } from 'mongoose';
 import { 
 	Membership, 
-	Key
+	Key,
+	IUser,
+	User,
+	IServiceAccount,
+	ServiceAccount,
+	IServiceTokenData,
+	ServiceTokenData
 } from '../models';
 import {
 	MembershipNotFoundError,
-	BadRequestError
+	BadRequestError,
+	UnauthorizedRequestError
 } from '../utils/errors';
+import {
+	AUTH_MODE_JWT,
+	AUTH_MODE_SERVICE_ACCOUNT,
+	AUTH_MODE_SERVICE_TOKEN,
+	AUTH_MODE_API_KEY
+} from '../variables';
+import {
+	validateUserClientForWorkspace
+} from '../helpers/user';
+import {
+	validateServiceAccountClientForWorkspace
+} from '../helpers/serviceAccount';
+import {
+	validateServiceTokenDataClientForWorkspace
+} from '../helpers/serviceTokenData';
+
+/**
+ * Validate authenticated clients for membership with id [membershipId] based
+ * on any known permissions.
+ * @param {Object} obj
+ * @param {Object} obj.authData - authenticated client details
+ * @param {Types.ObjectId} obj.membershipId - id of membership to validate against
+ * @param {Array<'admin' | 'member'>} obj.acceptedRoles - accepted workspaceRoles
+ * @returns {Membership} - validated membership
+ */
+const validateClientForMembership = async ({
+	authData,
+	membershipId,
+	acceptedRoles
+}: {
+	authData: {
+		authMode: string;
+		authPayload: IUser | IServiceAccount | IServiceTokenData;
+	};
+	membershipId: Types.ObjectId;
+    acceptedRoles: Array<'admin' | 'member'>;
+}) => {
+	
+	const membership = await Membership.findById(membershipId);
+	
+	if (!membership) throw MembershipNotFoundError({
+		message: 'Failed to find membership'
+	});
+
+	if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
+		await validateUserClientForWorkspace({
+			user: authData.authPayload,
+			workspaceId: membership.workspace,
+			acceptedRoles
+		});
+		
+		return membership;
+	}
+	
+	if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
+		await validateServiceAccountClientForWorkspace({
+			serviceAccount: authData.authPayload,
+			workspaceId: membership.workspace
+		});
+
+		return membership;
+	}
+	
+	if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
+		await validateServiceTokenDataClientForWorkspace({
+			serviceTokenData: authData.authPayload,
+			workspaceId: new Types.ObjectId(membership.workspace)
+		});
+		
+		return membership;
+	}
+
+	if (authData.authMode == AUTH_MODE_API_KEY && authData.authPayload instanceof User) {
+		await validateUserClientForWorkspace({
+			user: authData.authPayload,
+			workspaceId: membership.workspace,
+			acceptedRoles 
+		});
+		
+		return membership;
+	}
+	
+	throw UnauthorizedRequestError({
+		message: 'Failed client authorization for membership'
+	});
+}
 
 /**
  * Validate that user with id [userId] is a member of workspace with id [workspaceId]
@@ -137,6 +230,7 @@ const deleteMembership = async ({ membershipId }: { membershipId: string }) => {
 };
 
 export { 
+	validateClientForMembership,
 	validateMembership,
 	addMemberships, 
 	findMembership, 

backend/src/helpers/membershipOrg.ts

@@ -3,12 +3,95 @@ import {
 	MembershipOrg, 
 	Workspace, 
 	Membership, 
-	Key
+	Key,
+	IUser,
+	User,
+	IServiceAccount,
+	ServiceAccount,
+	IServiceTokenData,
+	ServiceTokenData
 } from '../models';
 import {
 	MembershipOrgNotFoundError,
+	BadRequestError,
 	UnauthorizedRequestError
 } from '../utils/errors';
+import {
+	AUTH_MODE_JWT,
+	AUTH_MODE_SERVICE_ACCOUNT,
+	AUTH_MODE_SERVICE_TOKEN,
+	AUTH_MODE_API_KEY
+} from '../variables';
+
+/**
+ * Validate authenticated clients for organization membership with id [membershipOrgId] based
+ * on any known permissions.
+ * @param {Object} obj
+ * @param {Object} obj.authData - authenticated client details
+ * @param {Types.ObjectId} obj.membershipOrgId - id of organization membership to validate against
+ * @param {Array<'owner' | 'admin' | 'member'>} obj.acceptedRoles - accepted organization roles
+ * @param {MembershipOrg} - validated organization membership
+ */
+const validateClientForMembershipOrg = async ({
+	authData,
+	membershipOrgId,
+	acceptedRoles,
+	acceptedStatuses
+}: {
+	authData: {
+		authMode: string;
+		authPayload: IUser | IServiceAccount | IServiceTokenData;
+	};
+	membershipOrgId: Types.ObjectId;
+    acceptedRoles: Array<'owner' | 'admin' | 'member'>;
+    acceptedStatuses: Array<'invited' | 'accepted'>;
+}) => {
+	const membershipOrg = await MembershipOrg.findById(membershipOrgId);
+
+	if (!membershipOrg) throw MembershipOrgNotFoundError({
+		message: 'Failed to find organization membership '
+	});
+
+	if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
+		await validateMembershipOrg({
+			userId: authData.authPayload._id,
+			organizationId: membershipOrg.organization,
+			acceptedRoles,
+			acceptedStatuses
+		});
+		
+		return membershipOrg;
+	}
+
+	if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
+		if (!authData.authPayload.organization.equals(membershipOrg.organization)) throw UnauthorizedRequestError({
+			message: 'Failed service account client authorization for organization membership'
+		});
+		
+		return membershipOrg;
+	}
+
+	if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
+		throw UnauthorizedRequestError({
+			message: 'Failed service account client authorization for organization membership'
+		});
+	}
+	
+	if (authData.authMode === AUTH_MODE_API_KEY && authData.authPayload instanceof User) {
+		await validateMembershipOrg({
+			userId: authData.authPayload._id,
+			organizationId: membershipOrg.organization,
+			acceptedRoles,
+			acceptedStatuses
+		});
+		
+		return membershipOrg;
+	}
+	
+	throw UnauthorizedRequestError({
+		message: 'Failed client authorization for organization membership'
+	});
+}
 
 /**
  * Validate that user with id [userId] is a member of organization with id [organizationId]
@@ -151,6 +234,7 @@ const deleteMembershipOrg = async ({
 };
 
 export {
+	validateClientForMembershipOrg,
 	validateMembershipOrg,
 	findMembershipOrg,
 	addMembershipsOrg, 

backend/src/helpers/organization.ts

@@ -1,8 +1,21 @@
 import Stripe from "stripe";
 import { Types } from "mongoose";
+import {
+  IUser,
+  User,
+  IServiceAccount,
+  ServiceAccount,
+  IServiceTokenData,
+  ServiceTokenData,
+} from "../models";
 import { Organization, MembershipOrg } from "../models";
 import {
-  ACCEPTED
+  ACCEPTED,
+  AUTH_MODE_JWT,
+  AUTH_MODE_SERVICE_ACCOUNT,
+  AUTH_MODE_SERVICE_TOKEN,
+  AUTH_MODE_API_KEY,
+  OWNER,
 } from "../variables";
 import {
   getStripeSecretKey,
@@ -11,15 +24,93 @@ import {
   getStripeProductStarter,
 } from "../config";
 import {
-  EELicenseService
-} from '../ee/services';
-import {
-  getLicenseServerUrl
-} from '../config';
-import {
-  licenseServerKeyRequest,
-  licenseKeyRequest
-} from '../config/request';
+  UnauthorizedRequestError,
+  OrganizationNotFoundError,
+} from "../utils/errors";
+import { validateUserClientForOrganization } from "../helpers/user";
+import { validateServiceAccountClientForOrganization } from "../helpers/serviceAccount";
+
+/**
+ * Validate accepted clients for organization with id [organizationId]
+ * @param {Object} obj
+ * @param {Object} obj.authData - authenticated client details
+ * @param {Types.ObjectId} obj.organizationId - id of organization to validate against
+ */
+const validateClientForOrganization = async ({
+  authData,
+  organizationId,
+  acceptedRoles,
+  acceptedStatuses,
+}: {
+  authData: {
+    authMode: string;
+    authPayload: IUser | IServiceAccount | IServiceTokenData;
+  };
+  organizationId: Types.ObjectId;
+  acceptedRoles: Array<"owner" | "admin" | "member">;
+  acceptedStatuses: Array<"invited" | "accepted">;
+}) => {
+  const organization = await Organization.findById(organizationId);
+
+  if (!organization) {
+    throw OrganizationNotFoundError({
+      message: "Failed to find organization",
+    });
+  }
+
+  if (
+    authData.authMode === AUTH_MODE_JWT &&
+    authData.authPayload instanceof User
+  ) {
+    const membershipOrg = await validateUserClientForOrganization({
+      user: authData.authPayload,
+      organization,
+      acceptedRoles,
+      acceptedStatuses,
+    });
+
+    return { organization, membershipOrg };
+  }
+
+  if (
+    authData.authMode === AUTH_MODE_SERVICE_ACCOUNT &&
+    authData.authPayload instanceof ServiceAccount
+  ) {
+    await validateServiceAccountClientForOrganization({
+      serviceAccount: authData.authPayload,
+      organization,
+    });
+
+    return { organization };
+  }
+
+  if (
+    authData.authMode === AUTH_MODE_SERVICE_TOKEN &&
+    authData.authPayload instanceof ServiceTokenData
+  ) {
+    throw UnauthorizedRequestError({
+      message: "Failed service token authorization for organization",
+    });
+  }
+
+  if (
+    authData.authMode === AUTH_MODE_API_KEY &&
+    authData.authPayload instanceof User
+  ) {
+    const membershipOrg = await validateUserClientForOrganization({
+      user: authData.authPayload,
+      organization,
+      acceptedRoles,
+      acceptedStatuses,
+    });
+
+    return { organization, membershipOrg };
+  }
+
+  throw UnauthorizedRequestError({
+    message: "Failed client authorization for organization",
+  });
+};
 
 /**
  * Create an organization with name [name]
@@ -137,44 +228,38 @@ const updateSubscriptionOrgQuantity = async ({
   });
 
   if (organization && organization.customerId) {
-    if (EELicenseService.instanceType === 'cloud') {
-      // instance of Infisical is a cloud instance
-      const quantity = await MembershipOrg.countDocuments({
-        organization: new Types.ObjectId(organizationId),
-        status: ACCEPTED,
-      });
-      
-      await licenseServerKeyRequest.patch(
-        `${await getLicenseServerUrl()}/api/license-server/v1/customers/${organization.customerId}/cloud-plan`,
-        {
-          quantity
-        }
-      );
+    const quantity = await MembershipOrg.countDocuments({
+      organization: organizationId,
+      status: ACCEPTED,
+    });
 
-      EELicenseService.localFeatureSet.del(organizationId);
-    }
-    
-    if (EELicenseService.instanceType === 'enterprise-self-hosted') {
-      // instance of Infisical is an enterprise self-hosted instance
-      
-      const usedSeats = await MembershipOrg.countDocuments({
-        status: ACCEPTED
-      });
+    const stripe = new Stripe(await getStripeSecretKey(), {
+      apiVersion: "2022-08-01",
+    });
 
-      await licenseKeyRequest.patch(
-        `${await getLicenseServerUrl()}/api/license/v1/license`,
+    const subscription = (
+      await stripe.subscriptions.list({
+        customer: organization.customerId,
+      })
+    ).data[0];
+
+    stripeSubscription = await stripe.subscriptions.update(subscription.id, {
+      items: [
         {
-          usedSeats
-        }
-      );
-    }
+          id: subscription.items.data[0].id,
+          price: subscription.items.data[0].price.id,
+          quantity,
+        },
+      ],
+    });
   }
 
   return stripeSubscription;
 };
 
 export {
+  validateClientForOrganization,
   createOrganization,
   initSubscriptionOrg,
-  updateSubscriptionOrgQuantity
+  updateSubscriptionOrgQuantity,
 };

backend/src/helpers/rateLimiter.ts

@@ -1,16 +1,9 @@
 import rateLimit from 'express-rate-limit';
-const MongoStore = require('rate-limit-mongo');
 
-// 200 per minute
+// 120 requests per minute
 const apiLimiter = rateLimit({
-  store: new MongoStore({
-    uri: process.env.MONGO_URL,
-    expireTimeMs: 1000 * 60,
-    collectionName: "expressRateRecords-apiLimiter",
-    errorHandler: console.error.bind(null, 'rate-limit-mongo')
-  }),
-  windowMs: 1000 * 60,
-  max: 200,
+  windowMs: 60 * 1000,
+  max: 240,
   standardHeaders: true,
   legacyHeaders: false,
   skip: (request) => {
@@ -21,16 +14,10 @@ const apiLimiter = rateLimit({
   }
 });
 
-// 50 requests per 1 hours
+// 10 requests per minute
 const authLimit = rateLimit({
-  store: new MongoStore({
-    uri: process.env.MONGO_URL,
-    expireTimeMs: 1000 * 60 * 60,
-    errorHandler: console.error.bind(null, 'rate-limit-mongo'),
-    collectionName: "expressRateRecords-authLimit",
-  }),
-  windowMs: 1000 * 60 * 60,
-  max: 50,
+  windowMs: 60 * 1000,
+  max: 10,
   standardHeaders: true,
   legacyHeaders: false,
   keyGenerator: (req, res) => {
@@ -38,16 +25,10 @@ const authLimit = rateLimit({
   }
 });
 
-// 50 requests per 1 hour
+// 10 requests per hour
 const passwordLimiter = rateLimit({
-  store: new MongoStore({
-    uri: process.env.MONGO_URL,
-    expireTimeMs: 1000 * 60 * 60,
-    errorHandler: console.error.bind(null, 'rate-limit-mongo'),
-    collectionName: "expressRateRecords-passwordLimiter",
-  }),
-  windowMs: 1000 * 60 * 60,
-  max: 50,
+  windowMs: 60 * 60 * 1000,
+  max: 10,
   standardHeaders: true,
   legacyHeaders: false,
   keyGenerator: (req, res) => {

backend/src/helpers/secret.ts

@@ -9,8 +9,6 @@ import {
   ACTION_UPDATE_SECRETS,
   ACTION_DELETE_SECRETS,
   ACTION_READ_SECRETS,
-  ALGORITHM_AES_256_GCM,
-  ENCODING_SCHEME_UTF8,
 } from "../variables";
 import _ from "lodash";
 import { BadRequestError, UnauthorizedRequestError } from "../utils/errors";
@@ -196,8 +194,6 @@ const v1PushSecrets = async ({
         secretValueIV: newSecret.ivValue,
         secretValueTag: newSecret.tagValue,
         secretValueHash: newSecret.hashValue,
-        algorithm: ALGORITHM_AES_256_GCM,
-        keyEncoding: ENCODING_SCHEME_UTF8
       });
     }),
   });
@@ -229,8 +225,6 @@ const v1PushSecrets = async ({
             secretCommentIV: s.ivComment,
             secretCommentTag: s.tagComment,
             secretCommentHash: s.hashComment,
-            algorithm: ALGORITHM_AES_256_GCM,
-            keyEncoding: ENCODING_SCHEME_UTF8
           };
 
           if (toAdd[idx].type === "personal") {
@@ -260,8 +254,6 @@ const v1PushSecrets = async ({
           secretValueIV,
           secretValueTag,
           secretValueHash,
-          algorithm,
-          keyEncoding
         }) =>
           new SecretVersion({
             secret: _id,
@@ -279,8 +271,6 @@ const v1PushSecrets = async ({
             secretValueIV,
             secretValueTag,
             secretValueHash,
-            algorithm,
-            keyEncoding
           })
       ),
     });
@@ -477,8 +467,6 @@ const v2PushSecrets = async ({
         workspace: workspaceId,
         type: toAdd[idx].type,
         environment,
-        algorithm: ALGORITHM_AES_256_GCM,
-        keyEncoding: ENCODING_SCHEME_UTF8,
         ...(toAdd[idx].type === "personal" ? { user: userId } : {}),
       }))
     );
@@ -490,8 +478,6 @@ const v2PushSecrets = async ({
           ...secretDocument,
           secret: secretDocument._id,
           isDeleted: false,
-          algorithm: ALGORITHM_AES_256_GCM,
-          keyEncoding: ENCODING_SCHEME_UTF8
         });
       }),
     });

backend/src/helpers/secrets.ts

@@ -7,35 +7,58 @@ import {
     DeleteSecretParams
 } from '../interfaces/services/SecretService';
 import {
+    AuthData
+} from '../interfaces/middleware';
+import {
+    User,
+    Workspace,
+    ServiceAccount,
+    ServiceTokenData,
     Secret,
     ISecret,
     SecretBlindIndexData,
 } from '../models';
 import { SecretVersion } from '../ee/models';
+import {
+    validateMembership
+} from '../helpers/membership';
+import {
+    validateUserClientForSecret,
+    validateUserClientForSecrets
+} from '../helpers/user';
+import {
+    validateServiceTokenDataClientForSecrets, 
+    validateServiceTokenDataClientForWorkspace
+} from '../helpers/serviceTokenData';
+import {
+    validateServiceAccountClientForSecrets,
+    validateServiceAccountClientForWorkspace
+} from '../helpers/serviceAccount';
 import { 
     BadRequestError, 
+    UnauthorizedRequestError,
     SecretNotFoundError,
-    SecretBlindIndexDataNotFoundError,
-    InternalServerError
+    SecretBlindIndexDataNotFoundError
 } from '../utils/errors';
 import {
+    AUTH_MODE_JWT,
+    AUTH_MODE_SERVICE_ACCOUNT,
+    AUTH_MODE_SERVICE_TOKEN,
+    AUTH_MODE_API_KEY,
     SECRET_PERSONAL,
     SECRET_SHARED,
     ACTION_ADD_SECRETS,
     ACTION_READ_SECRETS,
     ACTION_UPDATE_SECRETS,
-    ACTION_DELETE_SECRETS,
-    ALGORITHM_AES_256_GCM,
-    ENCODING_SCHEME_UTF8,
-    ENCODING_SCHEME_BASE64
+    ACTION_DELETE_SECRETS
 } from '../variables';
 import crypto from 'crypto';
 import * as argon2 from 'argon2';
-import {
-    encryptSymmetric128BitHexKeyUTF8,
-    decryptSymmetric128BitHexKeyUTF8
+import { 
+    encryptSymmetric,
+    decryptSymmetric
 } from '../utils/crypto';
-import { getEncryptionKey, client, getRootEncryptionKey } from '../config';
+import { getEncryptionKey } from '../config';
 import { TelemetryService } from '../services';
 import {
     EESecretService,
@@ -46,6 +69,199 @@ import {
     getAuthDataPayloadUserObj
 } from '../utils/auth';
 
+/**
+ * Validate authenticated clients for secrets with id [secretId] based
+ * on any known permissions.
+ * @param {Object} obj
+ * @param {Object} obj.authData - authenticated client details
+ * @param {Types.ObjectId} obj.secretId - id of secret to validate against
+ * @param {Array<'admin' | 'member'>} obj.acceptedRoles - accepted workspace roles
+ * @param {String[]} obj.requiredPermissions - required permissions as part of the endpoint
+ */
+const validateClientForSecret = async ({
+    authData,
+    secretId,
+    acceptedRoles,
+    requiredPermissions
+}: {
+    authData: AuthData;
+    secretId: Types.ObjectId;
+    acceptedRoles: Array<'admin' | 'member'>;
+    requiredPermissions: string[];
+}) => {
+    const secret = await Secret.findById(secretId);
+
+    if (!secret) throw SecretNotFoundError({
+        message: 'Failed to find secret'
+    });
+
+    if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
+        await validateUserClientForSecret({
+            user: authData.authPayload,
+            secret,
+            acceptedRoles,
+            requiredPermissions
+        });
+
+        return secret;
+    }
+
+    if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
+        await validateServiceAccountClientForWorkspace({
+            serviceAccount: authData.authPayload,
+            workspaceId: secret.workspace,
+            environment: secret.environment,
+            requiredPermissions
+        });
+        
+        return secret;
+    }
+
+    if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
+        await validateServiceTokenDataClientForWorkspace({
+            serviceTokenData: authData.authPayload,
+            workspaceId: secret.workspace,
+            environment: secret.environment
+        });
+    
+        return secret;
+    }
+    
+    if (authData.authMode === AUTH_MODE_API_KEY && authData.authPayload instanceof User) {
+        await validateUserClientForSecret({
+            user: authData.authPayload,
+            secret,
+            acceptedRoles,
+            requiredPermissions
+        });
+
+        return secret;
+    }
+    
+    throw UnauthorizedRequestError({
+        message: 'Failed client authorization for secret'
+    });
+}
+
+/**
+ * Validate authenticated clients for secrets with ids [secretIds] based
+ * on any known permissions.
+ * @param {Object} obj
+ * @param {Object} obj.authData - authenticated client details
+ * @param {Types.ObjectId[]} obj.secretIds - id of workspace to validate against
+ * @param {String} obj.environment - (optional) environment in workspace to validate against
+ * @param {Array<'admin' | 'member'>} obj.acceptedRoles - accepted workspace roles
+ * @param {String[]} obj.requiredPermissions - required permissions as part of the endpoint
+ */
+const validateClientForSecrets = async ({
+    authData,
+    secretIds,
+    requiredPermissions
+}: {
+    authData: AuthData;
+    secretIds: Types.ObjectId[];
+    requiredPermissions: string[];
+}) => {
+
+    let secrets: ISecret[] = [];
+    
+    secrets = await Secret.find({
+        _id: {
+            $in: secretIds
+        }
+    });
+
+    if (secrets.length != secretIds.length) {
+        throw BadRequestError({ message: 'Failed to validate non-existent secrets' })
+    }
+
+    if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
+        await validateUserClientForSecrets({
+            user: authData.authPayload,
+            secrets,
+            requiredPermissions
+        });
+        
+        return secrets;
+    }
+    
+    if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
+        await validateServiceAccountClientForSecrets({
+            serviceAccount: authData.authPayload,
+            secrets,
+            requiredPermissions
+        });
+        
+        return secrets;
+    }
+        
+    if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
+        await validateServiceTokenDataClientForSecrets({
+            serviceTokenData: authData.authPayload,
+            secrets,
+            requiredPermissions
+        });
+        
+        return secrets;
+    }
+
+    if (authData.authMode === AUTH_MODE_API_KEY && authData.authPayload instanceof User) {
+        await validateUserClientForSecrets({
+            user: authData.authPayload,
+            secrets,
+            requiredPermissions
+        });
+        
+        return secrets;
+    }
+
+    throw UnauthorizedRequestError({
+        message: 'Failed client authorization for secrets resource'
+    });
+}
+
+/**
+ * Initialize secret blind index data by setting previously
+ * un-initialized projects to have secret blind index data
+ * (Ensures that all projects have associated blind index data)
+ */
+const initSecretBlindIndexDataHelper = async () => {
+    const workspaceIdsBlindIndexed = await SecretBlindIndexData.distinct('workspace');
+    const workspaceIdsToBlindIndex = await Workspace.distinct('_id', {
+        _id: {
+            $nin: workspaceIdsBlindIndexed
+        }
+    });
+    
+    const secretBlindIndexDataToInsert = await Promise.all(
+        workspaceIdsToBlindIndex.map(async (workspaceToBlindIndex) => {
+            const salt = crypto.randomBytes(16).toString('base64');
+
+            const { 
+                ciphertext: encryptedSaltCiphertext,
+                iv: saltIV,
+                tag: saltTag
+            } = encryptSymmetric({
+                plaintext: salt,
+                key: await getEncryptionKey()
+            });
+
+            const secretBlindIndexData = new SecretBlindIndexData({
+                workspace: workspaceToBlindIndex,
+                encryptedSaltCiphertext,
+                saltIV,
+                saltTag
+            })
+            
+            return secretBlindIndexData;
+        })
+    );
+    
+    if (secretBlindIndexDataToInsert.length > 0) {
+        await SecretBlindIndexData.insertMany(secretBlindIndexDataToInsert);
+    }
+}
+
 /**
  * Create secret blind index data containing encrypted blind index [salt]
  * for workspace with id [workspaceId]
@@ -57,47 +273,26 @@ const createSecretBlindIndexDataHelper = async ({
 }: {
     workspaceId: Types.ObjectId;
 }) => {
-
     // initialize random blind index salt for workspace
     const salt = crypto.randomBytes(16).toString('base64');
-
-    const encryptionKey = await getEncryptionKey();
-    const rootEncryptionKey = await getRootEncryptionKey();
-
-    if (rootEncryptionKey) {
-        const { 
-            ciphertext: encryptedSaltCiphertext,
-            iv: saltIV,
-            tag: saltTag
-        } = client.encryptSymmetric(salt, rootEncryptionKey);
-        
-        return await new SecretBlindIndexData({
-            workspace: workspaceId,
-            encryptedSaltCiphertext,
-            saltIV,
-            saltTag,
-            algorithm: ALGORITHM_AES_256_GCM,
-            keyEncoding: ENCODING_SCHEME_BASE64
-        }).save();
-    } else {
-        const { 
-            ciphertext: encryptedSaltCiphertext,
-            iv: saltIV,
-            tag: saltTag
-        } = encryptSymmetric128BitHexKeyUTF8({
-            plaintext: salt,
-            key: encryptionKey
-        });
-        
-        return await new SecretBlindIndexData({
-            workspace: workspaceId,
-            encryptedSaltCiphertext,
-            saltIV,
-            saltTag,
-            algorithm: ALGORITHM_AES_256_GCM,
-            keyEncoding: ENCODING_SCHEME_UTF8
-        }).save();
-    }
+    
+    const { 
+        ciphertext: encryptedSaltCiphertext,
+        iv: saltIV,
+        tag: saltTag
+    } = encryptSymmetric({
+        plaintext: salt,
+        key: await getEncryptionKey()
+    });
+    
+    const secretBlindIndexData = await new SecretBlindIndexData({
+        workspace: workspaceId,
+        encryptedSaltCiphertext,
+        saltIV,
+        saltTag
+    }).save();
+    
+    return secretBlindIndexData;
 }
 
 /**
@@ -111,36 +306,22 @@ const getSecretBlindIndexSaltHelper = async ({
 }: {
     workspaceId: Types.ObjectId;
 }) => {
-    
-    const encryptionKey = await getEncryptionKey();
-    const rootEncryptionKey = await getRootEncryptionKey();
-
+    // check if workspace blind index data exists
     const secretBlindIndexData = await SecretBlindIndexData.findOne({
         workspace: workspaceId
-    }).select('+algorithm +keyEncoding');
+    });
     
     if (!secretBlindIndexData) throw SecretBlindIndexDataNotFoundError();
-
-    if (rootEncryptionKey && secretBlindIndexData.keyEncoding === ENCODING_SCHEME_BASE64) {
-        return client.decryptSymmetric(
-            secretBlindIndexData.encryptedSaltCiphertext, 
-            rootEncryptionKey, 
-            secretBlindIndexData.saltIV, 
-            secretBlindIndexData.saltTag
-        );
-    } else if (encryptionKey && secretBlindIndexData.keyEncoding === ENCODING_SCHEME_UTF8) {
-        // decrypt workspace salt
-        return decryptSymmetric128BitHexKeyUTF8({
-            ciphertext: secretBlindIndexData.encryptedSaltCiphertext,
-            iv: secretBlindIndexData.saltIV,
-            tag: secretBlindIndexData.saltTag,
-            key: encryptionKey
-        });
-    }
-
-    throw InternalServerError({
-        message: 'Failed to obtain workspace salt needed for secret blind indexing'
+    
+    // decrypt workspace salt
+    const salt = decryptSymmetric({
+        ciphertext: secretBlindIndexData.encryptedSaltCiphertext,
+        iv: secretBlindIndexData.saltIV,
+        tag: secretBlindIndexData.saltTag,
+        key: await getEncryptionKey()
     });
+    
+    return salt;
 }
 
 /**
@@ -195,7 +376,7 @@ const generateSecretBlindIndexHelper = async ({
     if (!secretBlindIndexData) throw SecretBlindIndexDataNotFoundError();
     
     // decrypt workspace salt
-    const salt = decryptSymmetric128BitHexKeyUTF8({
+    const salt = decryptSymmetric({
         ciphertext: secretBlindIndexData.encryptedSaltCiphertext,
         iv: secretBlindIndexData.saltIV,
         tag: secretBlindIndexData.saltTag,
@@ -283,9 +464,7 @@ const createSecretHelper = async ({
         secretValueTag,
         secretCommentCiphertext,
         secretCommentIV,
-        secretCommentTag,
-        algorithm: ALGORITHM_AES_256_GCM,
-        keyEncoding: ENCODING_SCHEME_UTF8
+        secretCommentTag
     }).save();
     
     const secretVersion = new SecretVersion({
@@ -302,9 +481,7 @@ const createSecretHelper = async ({
         secretKeyTag,
         secretValueCiphertext,
         secretValueIV,
-        secretValueTag,
-        algorithm: ALGORITHM_AES_256_GCM,
-        keyEncoding: ENCODING_SCHEME_UTF8
+        secretValueTag
     });
 
     // // (EE) add version for new secret
@@ -594,9 +771,7 @@ const updateSecretHelper = async ({
         secretKeyTag: secret.secretKeyTag,
         secretValueCiphertext,
         secretValueIV,
-        secretValueTag,
-        algorithm: ALGORITHM_AES_256_GCM,
-        keyEncoding: ENCODING_SCHEME_UTF8
+        secretValueTag
     });
 
     // (EE) add version for new secret
@@ -757,6 +932,9 @@ const deleteSecretHelper = async ({
 }
 
 export {
+    validateClientForSecret,
+    validateClientForSecrets,
+    initSecretBlindIndexDataHelper,
     createSecretBlindIndexDataHelper,
     getSecretBlindIndexSaltHelper,
     generateSecretBlindIndexWithSaltHelper,

backend/src/helpers/serviceAccount.ts

@@ -9,9 +9,9 @@ import {
 	IServiceTokenData,
 	ISecret,
 	IOrganization,
+	IServiceAccountWorkspacePermission,
 	ServiceAccountWorkspacePermission
 } from '../models';
-import { validateUserClientForServiceAccount } from './user';
 import { 
 	BadRequestError, 
 	UnauthorizedRequestError,
@@ -25,8 +25,11 @@ import {
 	AUTH_MODE_SERVICE_TOKEN,
 	AUTH_MODE_API_KEY
 } from '../variables';
+import {
+	validateUserClientForServiceAccount
+} from '../helpers/user';
 
-export const validateClientForServiceAccount = async ({
+const validateClientForServiceAccount = async ({
 	authData,
 	serviceAccountId,
 	requiredPermissions
@@ -97,7 +100,7 @@ export const validateClientForServiceAccount = async ({
  * @param {String} environment - (optional) environment in workspace to validate against
  * @param {String[]} requiredPermissions - required permissions as part of the endpoint
  */
-export const validateServiceAccountClientForWorkspace = async ({
+ const validateServiceAccountClientForWorkspace = async ({
     serviceAccount,
 	workspaceId,
 	environment,
@@ -166,7 +169,7 @@ export const validateServiceAccountClientForWorkspace = async ({
  * @param {Secret[]} secrets - secrets to validate against
  * @param {string[]} requiredPermissions - required permissions as part of the endpoint
  */
-export const validateServiceAccountClientForSecrets = async ({
+ const validateServiceAccountClientForSecrets = async ({
 	serviceAccount,
 	secrets,
 	requiredPermissions
@@ -223,7 +226,7 @@ export const validateServiceAccountClientForSecrets = async ({
  * @param {ServiceAccount} targetServiceAccount - target service account to validate against
  * @param {string[]} requiredPermissions - required permissions as part of the endpoint
  */
-export const validateServiceAccountClientForServiceAccount = ({
+const validateServiceAccountClientForServiceAccount = ({
 	serviceAccount,
 	targetServiceAccount,
 	requiredPermissions
@@ -245,7 +248,7 @@ export const validateServiceAccountClientForServiceAccount = ({
  * @param {User} obj.user - service account client
  * @param {Organization} obj.organization - organization to validate against
  */
-export const validateServiceAccountClientForOrganization = async ({
+const validateServiceAccountClientForOrganization = async ({
 	serviceAccount,
 	organization
 }: {
@@ -257,4 +260,12 @@ export const validateServiceAccountClientForOrganization = async ({
 			message: 'Failed service account authorization for the given organization'
 		});
 	}
+}
+
+export {
+	validateClientForServiceAccount,
+    validateServiceAccountClientForWorkspace,
+	validateServiceAccountClientForSecrets,
+	validateServiceAccountClientForServiceAccount,
+	validateServiceAccountClientForOrganization
 }

backend/src/helpers/serviceTokenData.ts

@@ -18,8 +18,8 @@ import {
 	AUTH_MODE_SERVICE_TOKEN,
 	AUTH_MODE_API_KEY
 } from '../variables';
-import { validateUserClientForWorkspace } from './user';
-import { validateServiceAccountClientForWorkspace } from './serviceAccount';
+import { validateUserClientForWorkspace } from '../helpers/user';
+import { validateServiceAccountClientForWorkspace } from '../helpers/serviceAccount';
 
 /**
  * Validate authenticated clients for service token with id [serviceTokenId] based
@@ -29,7 +29,7 @@ import { validateServiceAccountClientForWorkspace } from './serviceAccount';
  * @param {Types.ObjectId} obj.serviceTokenData - id of service token to validate against
  * @param {Array<'admin' | 'member'>} obj.acceptedRoles - accepted workspace roles
  */
-export const validateClientForServiceTokenData = async ({
+const validateClientForServiceTokenData = async ({
     authData,
     serviceTokenDataId,
     acceptedRoles
@@ -100,7 +100,7 @@ export const validateClientForServiceTokenData = async ({
  * @param {String} environment - (optional) environment in workspace to validate against
  * @param {String[]} requiredPermissions - required permissions as part of the endpoint
  */
-export const validateServiceTokenDataClientForWorkspace = async ({
+ const validateServiceTokenDataClientForWorkspace = async ({
     serviceTokenData,
 	workspaceId,
 	environment,
@@ -146,7 +146,7 @@ export const validateServiceTokenDataClientForWorkspace = async ({
  * @param {Secret[]} secrets - secrets to validate against
  * @param {string[]} requiredPermissions - required permissions as part of the endpoint
  */
-export const validateServiceTokenDataClientForSecrets = async ({
+ const validateServiceTokenDataClientForSecrets = async ({
     serviceTokenData,
     secrets,
 	requiredPermissions
@@ -179,4 +179,10 @@ export const validateServiceTokenDataClientForSecrets = async ({
             }
         });
     });
+}
+
+export {
+    validateClientForServiceTokenData,
+    validateServiceTokenDataClientForWorkspace,
+    validateServiceTokenDataClientForSecrets
 }

backend/src/helpers/user.ts

@@ -1,8 +1,24 @@
+import { Types } from 'mongoose';
 import {
 	IUser, 
+	ISecret,
+	IServiceAccount,
 	User,
+	Membership,
+	IOrganization,
+	Organization,
 } from '../models';
 import { sendMail } from './nodemailer';
+import { validateMembership } from './membership';
+import _ from 'lodash';
+import { BadRequestError, UnauthorizedRequestError } from '../utils/errors';
+import {
+	validateMembershipOrg
+} from '../helpers/membershipOrg';
+import {
+	PERMISSION_READ_SECRETS,
+	PERMISSION_WRITE_SECRETS
+} from '../variables';
 
 /**
  * Initialize a user under email [email]
@@ -10,7 +26,7 @@ import { sendMail } from './nodemailer';
  * @param {String} obj.email - email of user to initialize
  * @returns {Object} user - the initialized user
  */
-export const setupAccount = async ({ email }: { email: string }) => {
+const setupAccount = async ({ email }: { email: string }) => {
   const user = await new User({
     email
   }).save();
@@ -36,7 +52,7 @@ export const setupAccount = async ({ email }: { email: string }) => {
  * @param {String} obj.verifier - verifier for auth SRP
  * @returns {Object} user - the completed user
  */
-export const completeAccount = async ({
+const completeAccount = async ({
 	userId,
 	firstName,
 	lastName,
@@ -97,7 +113,7 @@ export const completeAccount = async ({
  * @param {String} obj.ip - login ip address
  * @param {String} obj.userAgent - login user-agent
  */
-export const checkUserDevice = async ({
+const checkUserDevice = async ({
 	user,
 	ip,
 	userAgent
@@ -132,4 +148,206 @@ export const checkUserDevice = async ({
 			}
 		}); 
 	}
-}
+}
+
+/**
+ * Validate that user (client) can access workspace
+ * with id [workspaceId] and its environment [environment] with required permissions
+ * [requiredPermissions]
+ * @param {Object} obj
+ * @param {User} obj.user - user client
+ * @param {Types.ObjectId} obj.workspaceId - id of workspace to validate against
+ * @param {String} environment - (optional) environment in workspace to validate against
+ * @param {String[]} requiredPermissions - required permissions as part of the endpoint
+ */
+const validateUserClientForWorkspace = async ({
+	user,
+	workspaceId,
+	environment,
+	acceptedRoles,
+	requiredPermissions
+}: {
+	user: IUser;
+	workspaceId: Types.ObjectId;
+	environment?: string;
+	acceptedRoles: Array<'admin' | 'member'>;
+	requiredPermissions?: string[];
+}) => {
+	
+	// validate user membership in workspace
+	const membership = await validateMembership({
+        userId: user._id,
+        workspaceId,
+		acceptedRoles
+    });
+	
+	let runningIsDisallowed = false;
+	requiredPermissions?.forEach((requiredPermission: string) => {
+		switch (requiredPermission) {
+			case PERMISSION_READ_SECRETS:
+				runningIsDisallowed = _.some(membership.deniedPermissions, { environmentSlug: environment, ability: PERMISSION_READ_SECRETS });
+				break;
+			case PERMISSION_WRITE_SECRETS:
+				runningIsDisallowed = _.some(membership.deniedPermissions, { environmentSlug: environment, ability: PERMISSION_WRITE_SECRETS });
+				break;
+			default:
+				break;
+		}
+		
+		if (runningIsDisallowed) {
+			throw UnauthorizedRequestError({
+				message: `Failed permissions authorization for workspace environment action : ${requiredPermission}`
+			});	
+		}
+	});
+	
+	return membership;
+}
+
+/**
+ * Validate that user (client) can access secret [secret]
+ * with required permissions [requiredPermissions]
+ * @param {Object} obj
+ * @param {User} obj.user - user client
+ * @param {Secret[]} obj.secrets - secrets to validate against
+ * @param {String[]} requiredPermissions - required permissions as part of the endpoint
+ */
+const validateUserClientForSecret = async ({
+	user,
+	secret,
+	acceptedRoles,
+	requiredPermissions
+}: {
+	user: IUser;
+	secret: ISecret;
+	acceptedRoles?: Array<'admin' | 'member'>;
+	requiredPermissions?: string[];
+}) => {
+	const membership = await validateMembership({
+		userId: user._id,
+		workspaceId: secret.workspace,
+		acceptedRoles
+	});
+	
+	if (requiredPermissions?.includes(PERMISSION_WRITE_SECRETS)) {
+		const isDisallowed = _.some(membership.deniedPermissions, { environmentSlug: secret.environment, ability: PERMISSION_WRITE_SECRETS });
+
+		if (isDisallowed) {
+			throw UnauthorizedRequestError({
+				message: 'You do not have the required permissions to perform this action' 
+			});
+		}
+	}
+}
+
+/**
+ * Validate that user (client) can access secrets [secrets]
+ * with required permissions [requiredPermissions]
+ * @param {Object} obj
+ * @param {User} obj.user - user client
+ * @param {Secret[]} obj.secrets - secrets to validate against
+ * @param {String[]} requiredPermissions - required permissions as part of the endpoint
+ */
+ const validateUserClientForSecrets = async ({
+	user,
+	secrets,
+	requiredPermissions
+}: {
+	user: IUser;
+	secrets: ISecret[];
+	requiredPermissions?: string[];
+}) => {
+	
+	// TODO: add acceptedRoles?
+
+	const userMemberships = await Membership.find({ user: user._id })
+	const userMembershipById = _.keyBy(userMemberships, 'workspace');
+	const workspaceIdsSet = new Set(userMemberships.map((m) => m.workspace.toString()));
+
+	// for each secret check if the secret belongs to a workspace the user is a member of
+	secrets.forEach((secret: ISecret) => {
+		if (!workspaceIdsSet.has(secret.workspace.toString())) {
+			throw BadRequestError({
+				message: 'Failed authorization for the secret'
+			});
+		}
+
+		if (requiredPermissions?.includes(PERMISSION_WRITE_SECRETS)) {
+			const deniedMembershipPermissions = userMembershipById[secret.workspace.toString()].deniedPermissions;
+			const isDisallowed = _.some(deniedMembershipPermissions, { environmentSlug: secret.environment, ability: PERMISSION_WRITE_SECRETS });
+
+			if (isDisallowed) {
+				throw UnauthorizedRequestError({
+					message: 'You do not have the required permissions to perform this action' 
+				});
+			}
+		}
+	});
+}
+
+/**
+ * Validate that user (client) can access service account [serviceAccount]
+ * with required permissions [requiredPermissions]
+ * @param {Object} obj
+ * @param {User} obj.user - user client
+ * @param {ServiceAccount} obj.serviceAccount - service account to validate against
+ * @param {String[]} requiredPermissions - required permissions as part of the endpoint
+ */
+const validateUserClientForServiceAccount = async ({
+	user,
+	serviceAccount,
+	requiredPermissions
+}: {
+	user: IUser;
+	serviceAccount: IServiceAccount;
+	requiredPermissions?: string[];
+}) => {
+	if (!serviceAccount.user.equals(user._id)) {
+		// case: user who created service account is not the
+		// same user that is on the request
+		await validateMembershipOrg({
+			userId: user._id,
+			organizationId: serviceAccount.organization,
+			acceptedRoles: [],
+			acceptedStatuses: []
+		});
+	}
+}
+
+/**
+ * Validate that user (client) can access organization [organization]
+ * @param {Object} obj
+ * @param {User} obj.user - user client
+ * @param {Organization} obj.organization - organization to validate against
+ */
+ const validateUserClientForOrganization = async ({
+	user,
+	organization,
+	acceptedRoles,
+	acceptedStatuses
+}: {
+	user: IUser;
+	organization: IOrganization;
+	acceptedRoles: Array<'owner' | 'admin' | 'member'>;
+	acceptedStatuses: Array<'invited' | 'accepted'>;
+}) => {
+	const membershipOrg = await validateMembershipOrg({
+		userId: user._id,
+		organizationId: organization._id,
+		acceptedRoles,
+		acceptedStatuses
+	});
+	
+	return membershipOrg;
+}
+
+export { 
+	setupAccount, 
+	completeAccount, 
+	checkUserDevice,
+	validateUserClientForWorkspace,
+	validateUserClientForSecrets,
+	validateUserClientForServiceAccount,
+	validateUserClientForOrganization,
+	validateUserClientForSecret
+};

backend/src/helpers/workspace.ts

@@ -1,14 +1,136 @@
 import * as Sentry from '@sentry/node';
+import crypto from 'crypto';
+import { Types } from 'mongoose';
 import {
 	Workspace,
 	Bot,
 	Membership,
 	Key,
-	Secret
+	Secret,
+	User,
+	IUser,
+	ServiceAccountWorkspacePermission,
+	ServiceAccount,
+	IServiceAccount,
+	ServiceTokenData,
+	IServiceTokenData,
+	SecretBlindIndexData
 } from '../models';
 import { createBot } from '../helpers/bot';
+import { validateUserClientForWorkspace } from '../helpers/user';
+import { validateServiceAccountClientForWorkspace } from '../helpers/serviceAccount';
+import { validateServiceTokenDataClientForWorkspace } from '../helpers/serviceTokenData';
+import { validateMembership } from '../helpers/membership';
+import { UnauthorizedRequestError, WorkspaceNotFoundError } from '../utils/errors';
+import {
+	AUTH_MODE_JWT,
+	AUTH_MODE_SERVICE_ACCOUNT,
+	AUTH_MODE_SERVICE_TOKEN,
+	AUTH_MODE_API_KEY
+} from '../variables';
+import { encryptSymmetric } from '../utils/crypto';
 import { SecretService } from '../services';
 
+/**
+ * Validate authenticated clients for workspace with id [workspaceId] based
+ * on any known permissions.
+ * @param {Object} obj
+ * @param {Object} obj.authData - authenticated client details
+ * @param {Types.ObjectId} obj.workspaceId - id of workspace to validate against
+ * @param {String} obj.environment - (optional) environment in workspace to validate against
+ * @param {Array<'admin' | 'member'>} obj.acceptedRoles - accepted workspace roles
+ * @param {String[]} obj.requiredPermissions - required permissions as part of the endpoint
+ */
+const validateClientForWorkspace = async ({
+	authData,
+	workspaceId,
+	environment,
+	acceptedRoles,
+	requiredPermissions,
+	requireBlindIndicesEnabled
+}: {
+	authData: {
+		authMode: string;
+		authPayload: IUser | IServiceAccount | IServiceTokenData;
+	};
+	workspaceId: Types.ObjectId;
+	environment?: string;
+	acceptedRoles: Array<'admin' | 'member'>;
+	requiredPermissions?: string[];
+	requireBlindIndicesEnabled: boolean;
+}) => {
+	
+	const workspace = await Workspace.findById(workspaceId);
+
+	if (!workspace) throw WorkspaceNotFoundError({
+		message: 'Failed to find workspace'
+	});
+
+	if (requireBlindIndicesEnabled) {
+		// case: blind indices are not enabled for secrets in this workspace
+		// (i.e. workspace was created before blind indices were introduced
+		// and no admin has enabled it)
+		
+		const secretBlindIndexData = await SecretBlindIndexData.exists({
+			workspace: new Types.ObjectId(workspaceId)
+		});
+		
+		if (!secretBlindIndexData) throw UnauthorizedRequestError({
+			message: 'Failed workspace authorization due to blind indices not being enabled'
+		});
+	}
+
+	if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
+		const membership = await validateUserClientForWorkspace({
+			user: authData.authPayload,
+			workspaceId,
+			environment,
+			acceptedRoles,
+			requiredPermissions
+		});
+		
+		return ({ membership });
+	}
+
+	if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
+		await validateServiceAccountClientForWorkspace({
+			serviceAccount: authData.authPayload,
+			workspaceId,
+			environment,
+			requiredPermissions
+		});
+		
+		return {};
+	}
+	
+	if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
+		await validateServiceTokenDataClientForWorkspace({
+			serviceTokenData: authData.authPayload,
+			workspaceId,
+			environment,
+			requiredPermissions
+		});
+
+		return {};
+	}
+
+	if (authData.authMode === AUTH_MODE_API_KEY && authData.authPayload instanceof User) {
+		const membership = await validateUserClientForWorkspace({
+			user: authData.authPayload,
+			workspaceId,
+			environment,
+			acceptedRoles,
+			requiredPermissions
+		});
+		
+		return ({ membership });
+	}
+	
+	throw UnauthorizedRequestError({
+		message: 'Failed client authorization for workspace'
+	});
+}
+
 /**
  * Create a workspace with name [name] in organization with id [organizationId]
  * and a bot for it.
@@ -81,6 +203,7 @@ const deleteWorkspace = async ({ id }: { id: string }) => {
 };
 
 export {
+	validateClientForWorkspace,
 	createWorkspace, 
 	deleteWorkspace 
 };

backend/src/index.ts

@@ -1,13 +1,19 @@
-import dotenv from "dotenv";
+import mongoose from 'mongoose';
+import dotenv from 'dotenv';
 dotenv.config();
 import express from 'express';
-// eslint-disable-next-line @typescript-eslint/no-var-requires
-require('express-async-errors');
 import helmet from 'helmet';
 import cors from 'cors';
+import * as Sentry from '@sentry/node';
 import { DatabaseService } from './services';
-import { EELicenseService } from './ee/services';
 import { setUpHealthEndpoint } from './services/health';
+import { initSmtp } from './services/smtp';
+import { TelemetryService } from './services';
+import { setTransporter } from './helpers/nodemailer';
+import { createTestUserForDevelopment } from './utils/addDevelopmentUser';
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const { patchRouterParam } = require('./utils/patchAsyncRoutes');
+
 import cookieParser from 'cookie-parser';
 import swaggerUi = require('swagger-ui-express');
 // eslint-disable-next-line @typescript-eslint/no-var-requires
@@ -16,165 +22,168 @@ const swaggerFile = require('../spec.json');
 const requestIp = require('request-ip');
 import { apiLimiter } from './helpers/rateLimiter';
 import {
-  workspace as eeWorkspaceRouter,
-  secret as eeSecretRouter,
-  secretSnapshot as eeSecretSnapshotRouter,
-  action as eeActionRouter,
-  organizations as eeOrganizationsRouter,
-  cloudProducts as eeCloudProductsRouter
+    workspace as eeWorkspaceRouter,
+    secret as eeSecretRouter,
+    secretSnapshot as eeSecretSnapshotRouter,
+    action as eeActionRouter
 } from './ee/routes/v1';
 import {
-  signup as v1SignupRouter,
-  auth as v1AuthRouter,
-  bot as v1BotRouter,
-  organization as v1OrganizationRouter,
-  workspace as v1WorkspaceRouter,
-  membershipOrg as v1MembershipOrgRouter,
-  membership as v1MembershipRouter,
-  key as v1KeyRouter,
-  inviteOrg as v1InviteOrgRouter,
-  user as v1UserRouter,
-  userAction as v1UserActionRouter,
-  secret as v1SecretRouter,
-  serviceToken as v1ServiceTokenRouter,
-  password as v1PasswordRouter,
-  stripe as v1StripeRouter,
-  integration as v1IntegrationRouter,
-  integrationAuth as v1IntegrationAuthRouter,
-  secretsFolder as v1SecretsFolder
+    signup as v1SignupRouter,
+    auth as v1AuthRouter,
+    bot as v1BotRouter,
+    organization as v1OrganizationRouter,
+    workspace as v1WorkspaceRouter,
+    membershipOrg as v1MembershipOrgRouter,
+    membership as v1MembershipRouter,
+    key as v1KeyRouter,
+    inviteOrg as v1InviteOrgRouter,
+    user as v1UserRouter,
+    userAction as v1UserActionRouter,
+    secret as v1SecretRouter,
+    serviceToken as v1ServiceTokenRouter,
+    password as v1PasswordRouter,
+    stripe as v1StripeRouter,
+    integration as v1IntegrationRouter,
+    integrationAuth as v1IntegrationAuthRouter,
+    secretsFolder as v1SecretsFolder
 } from './routes/v1';
 import {
-  signup as v2SignupRouter,
-  auth as v2AuthRouter,
-  users as v2UsersRouter,
-  organizations as v2OrganizationsRouter,
-  workspace as v2WorkspaceRouter,
-  secret as v2SecretRouter, // begin to phase out
-  secrets as v2SecretsRouter,
-  serviceTokenData as v2ServiceTokenDataRouter,
-  serviceAccounts as v2ServiceAccountsRouter,
-  apiKeyData as v2APIKeyDataRouter,
-  environment as v2EnvironmentRouter,
-  tags as v2TagsRouter,
+    signup as v2SignupRouter,
+    auth as v2AuthRouter,
+    users as v2UsersRouter,
+    organizations as v2OrganizationsRouter,
+    workspace as v2WorkspaceRouter,
+    secret as v2SecretRouter, // begin to phase out
+    secrets as v2SecretsRouter,
+    serviceTokenData as v2ServiceTokenDataRouter,
+    serviceAccounts as v2ServiceAccountsRouter,
+    apiKeyData as v2APIKeyDataRouter,
+    environment as v2EnvironmentRouter,
+    tags as v2TagsRouter,
 } from './routes/v2';
 import {
-  auth as v3AuthRouter,
-  secrets as v3SecretsRouter,
-  signup as v3SignupRouter,
-  workspaces as v3WorkspacesRouter
+    secrets as v3SecretsRouter,
+    workspaces as v3WorkspacesRouter
 } from './routes/v3';
 import { healthCheck } from './routes/status';
 import { getLogger } from './utils/logger';
 import { RouteNotFoundError } from './utils/errors';
 import { requestErrorHandler } from './middleware/requestErrorHandler';
 import {
-  getNodeEnv,
-  getPort,
-  getSiteURL
+    getMongoURL,
+    getNodeEnv,
+    getPort,
+    getSentryDSN,
+    getSiteURL,
+    getSmtpHost
 } from './config';
-import { setup } from './utils/setup';
 
 const main = async () => {
-  await setup();
+    TelemetryService.logTelemetryMessage();
+    setTransporter(await initSmtp());
 
-  await EELicenseService.initGlobalFeatureSet();
+    await DatabaseService.initDatabase(await getMongoURL());
+    if ((await getNodeEnv()) !== 'test') {
+        Sentry.init({
+            dsn: await getSentryDSN(),
+            tracesSampleRate: 1.0,
+            debug: await getNodeEnv() === 'production' ? false : true,
+            environment: await getNodeEnv()
+        });
+    }
 
-  const app = express();
-  app.enable('trust proxy');
-  app.use(express.json());
-  app.use(cookieParser());
-  app.use(
-    cors({
-      credentials: true,
-      origin: await getSiteURL()
-    })
-  );
-
-  app.use(requestIp.mw());
-
-  if ((await getNodeEnv()) === 'production') {
-    // enable app-wide rate-limiting + helmet security
-    // in production
-    app.disable('x-powered-by');
-    app.use(apiLimiter);
-    app.use(helmet());
-  }
-
-  // (EE) routes
-  app.use('/api/v1/secret', eeSecretRouter);
-  app.use('/api/v1/secret-snapshot', eeSecretSnapshotRouter);
-  app.use('/api/v1/workspace', eeWorkspaceRouter);
-  app.use('/api/v1/action', eeActionRouter);
-  app.use('/api/v1/organizations', eeOrganizationsRouter);
-  app.use('/api/v1/cloud-products', eeCloudProductsRouter);
-
-  // v1 routes (default)
-  app.use('/api/v1/signup', v1SignupRouter);
-  app.use('/api/v1/auth', v1AuthRouter);
-  app.use('/api/v1/bot', v1BotRouter);
-  app.use('/api/v1/user', v1UserRouter);
-  app.use('/api/v1/user-action', v1UserActionRouter);
-  app.use('/api/v1/organization', v1OrganizationRouter);
-  app.use('/api/v1/workspace', v1WorkspaceRouter);
-  app.use('/api/v1/membership-org', v1MembershipOrgRouter);
-  app.use('/api/v1/membership', v1MembershipRouter);
-  app.use('/api/v1/key', v1KeyRouter);
-  app.use('/api/v1/invite-org', v1InviteOrgRouter);
-  app.use('/api/v1/secret', v1SecretRouter); // deprecate
-  app.use('/api/v1/service-token', v1ServiceTokenRouter); // deprecate
-  app.use('/api/v1/password', v1PasswordRouter);
-  app.use('/api/v1/stripe', v1StripeRouter);
-  app.use('/api/v1/integration', v1IntegrationRouter);
-  app.use('/api/v1/integration-auth', v1IntegrationAuthRouter);
-  app.use('/api/v1/folder', v1SecretsFolder)
-
-  // v2 routes (improvements)
-  app.use('/api/v2/signup', v2SignupRouter);
-  app.use('/api/v2/auth', v2AuthRouter);
-  app.use('/api/v2/users', v2UsersRouter);
-  app.use('/api/v2/organizations', v2OrganizationsRouter);
-  app.use('/api/v2/workspace', v2EnvironmentRouter);
-  app.use('/api/v2/workspace', v2TagsRouter);
-  app.use('/api/v2/workspace', v2WorkspaceRouter);
-  app.use('/api/v2/secret', v2SecretRouter); // deprecate
-  app.use('/api/v2/secrets', v2SecretsRouter); // note: in the process of moving to v3/secrets
-  app.use('/api/v2/service-token', v2ServiceTokenDataRouter);
-  app.use('/api/v2/service-accounts', v2ServiceAccountsRouter); // new
-  app.use('/api/v2/api-key', v2APIKeyDataRouter);
-
-  // v3 routes (experimental)
-  app.use("/api/v3/auth", v3AuthRouter);
-  app.use('/api/v3/secrets', v3SecretsRouter);
-  app.use('/api/v3/workspaces', v3WorkspacesRouter);
-  app.use("/api/v3/signup", v3SignupRouter);
-
-  // api docs 
-  app.use('/api-docs', swaggerUi.serve, swaggerUi.setup(swaggerFile))
-
-  // server status
-  app.use('/api', healthCheck)
-
-  //* Handle unrouted requests and respond with proper error message as well as status code
-  app.use((req, res, next) => {
-    if (res.headersSent) return next();
-    next(RouteNotFoundError({ message: `The requested source '(${req.method})${req.url}' was not found` }))
-  })
-
-  app.use(requestErrorHandler);
-
-  const server = app.listen(await getPort(), async () => {
-    (await getLogger("backend-main")).info(
-      `Server started listening at port ${await getPort()}`
+    patchRouterParam();
+    const app = express();
+    app.enable('trust proxy');
+    app.use(express.json());
+    app.use(cookieParser());
+    app.use(
+        cors({
+            credentials: true,
+            origin: await getSiteURL()
+        })
     );
-  });
 
-  setUpHealthEndpoint(server);
+    app.use(requestIp.mw());
 
-  server.on("close", async () => {
-    await DatabaseService.closeDatabase();
-  });
+    if ((await getNodeEnv()) === 'production') {
+        // enable app-wide rate-limiting + helmet security
+        // in production
+        app.disable('x-powered-by');
+        app.use(apiLimiter);
+        app.use(helmet());
+    }
 
-  return server;
-};
+    // (EE) routes
+    app.use('/api/v1/secret', eeSecretRouter);
+    app.use('/api/v1/secret-snapshot', eeSecretSnapshotRouter);
+    app.use('/api/v1/workspace', eeWorkspaceRouter);
+    app.use('/api/v1/action', eeActionRouter);
 
-export default main();
+    // v1 routes (default)
+    app.use('/api/v1/signup', v1SignupRouter);
+    app.use('/api/v1/auth', v1AuthRouter);
+    app.use('/api/v1/bot', v1BotRouter);
+    app.use('/api/v1/user', v1UserRouter);
+    app.use('/api/v1/user-action', v1UserActionRouter);
+    app.use('/api/v1/organization', v1OrganizationRouter);
+    app.use('/api/v1/workspace', v1WorkspaceRouter);
+    app.use('/api/v1/membership-org', v1MembershipOrgRouter);
+    app.use('/api/v1/membership', v1MembershipRouter);
+    app.use('/api/v1/key', v1KeyRouter);
+    app.use('/api/v1/invite-org', v1InviteOrgRouter);
+    app.use('/api/v1/secret', v1SecretRouter);
+    app.use('/api/v1/service-token', v1ServiceTokenRouter); // deprecated
+    app.use('/api/v1/password', v1PasswordRouter);
+    app.use('/api/v1/stripe', v1StripeRouter);
+    app.use('/api/v1/integration', v1IntegrationRouter);
+    app.use('/api/v1/integration-auth', v1IntegrationAuthRouter);
+    app.use('/api/v1/folder', v1SecretsFolder)
+
+    // v2 routes (improvements)
+    app.use('/api/v2/signup', v2SignupRouter);
+    app.use('/api/v2/auth', v2AuthRouter);
+    app.use('/api/v2/users', v2UsersRouter);
+    app.use('/api/v2/organizations', v2OrganizationsRouter);
+    app.use('/api/v2/workspace', v2EnvironmentRouter);
+    app.use('/api/v2/workspace', v2TagsRouter);
+    app.use('/api/v2/workspace', v2WorkspaceRouter);
+    app.use('/api/v2/secret', v2SecretRouter); // deprecated
+    app.use('/api/v2/secrets', v2SecretsRouter);
+    app.use('/api/v2/service-token', v2ServiceTokenDataRouter); // TODO: turn into plural route
+    app.use('/api/v2/service-accounts', v2ServiceAccountsRouter); // new
+    app.use('/api/v2/api-key', v2APIKeyDataRouter);
+
+    // v3 routes (experimental)
+    app.use('/api/v3/secrets', v3SecretsRouter);
+    app.use('/api/v3/workspaces', v3WorkspacesRouter);
+
+    // api docs 
+    app.use('/api-docs', swaggerUi.serve, swaggerUi.setup(swaggerFile))
+
+    // Server status
+    app.use('/api', healthCheck)
+
+    //* Handle unrouted requests and respond with proper error message as well as status code
+    app.use((req, res, next) => {
+        if (res.headersSent) return next();
+        next(RouteNotFoundError({ message: `The requested source '(${req.method})${req.url}' was not found` }))
+    })
+
+    app.use(requestErrorHandler)
+
+    const server = app.listen(await getPort(), async () => {
+        (await getLogger("backend-main")).info(`Server started listening at port ${await getPort()}`)
+    });
+
+    await createTestUserForDevelopment();
+    setUpHealthEndpoint(server);
+
+    server.on('close', async () => {
+        await DatabaseService.closeDatabase();
+    })
+
+    return server;
+}
+
+export default main();

backend/src/integrations/apps.ts

@@ -1,6 +1,6 @@
 import { Octokit } from "@octokit/rest";
 import { IIntegrationAuth } from "../models";
-import { standardRequest } from "../config/request";
+import request from "../config/request";
 import {
   INTEGRATION_AZURE_KEY_VAULT,
   INTEGRATION_AWS_PARAMETER_STORE,
@@ -134,7 +134,7 @@ const getApps = async ({
  */
 const getAppsHeroku = async ({ accessToken }: { accessToken: string }) => {
   const res = (
-    await standardRequest.get(`${INTEGRATION_HEROKU_API_URL}/apps`, {
+    await request.get(`${INTEGRATION_HEROKU_API_URL}/apps`, {
       headers: {
         Accept: "application/vnd.heroku+json; version=3",
         Authorization: `Bearer ${accessToken}`,
@@ -164,7 +164,7 @@ const getAppsVercel = async ({
   accessToken: string;
 }) => {
   const res = (
-    await standardRequest.get(`${INTEGRATION_VERCEL_API_URL}/v9/projects`, {
+    await request.get(`${INTEGRATION_VERCEL_API_URL}/v9/projects`, {
       headers: {
         Authorization: `Bearer ${accessToken}`,
         "Accept-Encoding": "application/json",
@@ -208,7 +208,7 @@ const getAppsNetlify = async ({ accessToken }: { accessToken: string }) => {
       filter: 'all'
     });
 
-    const { data } = await standardRequest.get(
+    const { data } = await request.get(
       `${INTEGRATION_NETLIFY_API_URL}/api/v1/sites`,
       {
         params,
@@ -310,7 +310,7 @@ const getAppsGithub = async ({ accessToken }: { accessToken: string }) => {
  */
 const getAppsRender = async ({ accessToken }: { accessToken: string }) => {
   const res = (
-    await standardRequest.get(`${INTEGRATION_RENDER_API_URL}/v1/services`, {
+    await request.get(`${INTEGRATION_RENDER_API_URL}/v1/services`, {
       headers: {
         Authorization: `Bearer ${accessToken}`,
         Accept: "application/json",
@@ -358,7 +358,7 @@ const getAppsRailway = async ({ accessToken }: { accessToken: string }) => {
         projects: { edges },
       },
     },
-  } = await standardRequest.post(
+  } = await request.post(
     INTEGRATION_RAILWAY_API_URL,
     {
       query,
@@ -402,7 +402,7 @@ const getAppsFlyio = async ({ accessToken }: { accessToken: string }) => {
   `;
 
   const res = (
-    await standardRequest.post(
+    await request.post(
       INTEGRATION_FLYIO_API_URL,
       {
         query,
@@ -436,7 +436,7 @@ const getAppsFlyio = async ({ accessToken }: { accessToken: string }) => {
  */
 const getAppsCircleCI = async ({ accessToken }: { accessToken: string }) => {
   const res = (
-    await standardRequest.get(`${INTEGRATION_CIRCLECI_API_URL}/v1.1/projects`, {
+    await request.get(`${INTEGRATION_CIRCLECI_API_URL}/v1.1/projects`, {
       headers: {
         "Circle-Token": accessToken,
         "Accept-Encoding": "application/json",
@@ -455,7 +455,7 @@ const getAppsCircleCI = async ({ accessToken }: { accessToken: string }) => {
 
 const getAppsTravisCI = async ({ accessToken }: { accessToken: string }) => {
   const res = (
-    await standardRequest.get(`${INTEGRATION_TRAVISCI_API_URL}/repos`, {
+    await request.get(`${INTEGRATION_TRAVISCI_API_URL}/repos`, {
       headers: {
         Authorization: `token ${accessToken}`,
         "Accept-Encoding": "application/json",
@@ -502,7 +502,7 @@ const getAppsGitlab = async ({
         per_page: String(perPage),
       });
 
-      const { data } = await standardRequest.get(
+      const { data } = await request.get(
         `${INTEGRATION_GITLAB_API_URL}/v4/groups/${teamId}/projects`,
         {
           params,
@@ -530,7 +530,7 @@ const getAppsGitlab = async ({
     // case: fetch projects for individual in GitLab
 
     const { id } = (
-      await standardRequest.get(`${INTEGRATION_GITLAB_API_URL}/v4/user`, {
+      await request.get(`${INTEGRATION_GITLAB_API_URL}/v4/user`, {
         headers: {
           Authorization: `Bearer ${accessToken}`,
           "Accept-Encoding": "application/json",
@@ -544,7 +544,7 @@ const getAppsGitlab = async ({
         per_page: String(perPage),
       });
 
-      const { data } = await standardRequest.get(
+      const { data } = await request.get(
         `${INTEGRATION_GITLAB_API_URL}/v4/users/${id}/projects`,
         {
           params,
@@ -581,7 +581,7 @@ const getAppsGitlab = async ({
  * @returns {String} apps.name - name of Supabase app
  */
 const getAppsSupabase = async ({ accessToken }: { accessToken: string }) => {
-  const { data } = await standardRequest.get(
+  const { data } = await request.get(
     `${INTEGRATION_SUPABASE_API_URL}/v1/projects`,
     {
       headers: {

backend/src/integrations/exchange.ts

@@ -1,4 +1,4 @@
-import { standardRequest } from "../config/request";
+import request from "../config/request";
 import {
   INTEGRATION_AZURE_KEY_VAULT,
   INTEGRATION_HEROKU,
@@ -142,7 +142,7 @@ const exchangeCodeAzure = async ({ code }: { code: string }) => {
   const accessExpiresAt = new Date();
 
   const res: ExchangeCodeAzureResponse = (
-    await standardRequest.post(
+    await request.post(
       INTEGRATION_AZURE_TOKEN_URL,
       new URLSearchParams({
         grant_type: "authorization_code",
@@ -178,7 +178,7 @@ const exchangeCodeHeroku = async ({ code }: { code: string }) => {
   const accessExpiresAt = new Date();
 
   const res: ExchangeCodeHerokuResponse = (
-    await standardRequest.post(
+    await request.post(
       INTEGRATION_HEROKU_TOKEN_URL,
       new URLSearchParams({
         grant_type: "authorization_code",
@@ -209,7 +209,7 @@ const exchangeCodeHeroku = async ({ code }: { code: string }) => {
  */
 const exchangeCodeVercel = async ({ code }: { code: string }) => {
   const res: ExchangeCodeVercelResponse = (
-    await standardRequest.post(
+    await request.post(
       INTEGRATION_VERCEL_TOKEN_URL,
       new URLSearchParams({
         code: code,
@@ -240,7 +240,7 @@ const exchangeCodeVercel = async ({ code }: { code: string }) => {
  */
 const exchangeCodeNetlify = async ({ code }: { code: string }) => {
   const res: ExchangeCodeNetlifyResponse = (
-    await standardRequest.post(
+    await request.post(
       INTEGRATION_NETLIFY_TOKEN_URL,
       new URLSearchParams({
         grant_type: "authorization_code",
@@ -252,14 +252,14 @@ const exchangeCodeNetlify = async ({ code }: { code: string }) => {
     )
   ).data;
 
-  const res2 = await standardRequest.get("https://api.netlify.com/api/v1/sites", {
+  const res2 = await request.get("https://api.netlify.com/api/v1/sites", {
     headers: {
       Authorization: `Bearer ${res.access_token}`,
     },
   });
 
   const res3 = (
-    await standardRequest.get("https://api.netlify.com/api/v1/accounts", {
+    await request.get("https://api.netlify.com/api/v1/accounts", {
       headers: {
         Authorization: `Bearer ${res.access_token}`,
       },
@@ -287,7 +287,7 @@ const exchangeCodeNetlify = async ({ code }: { code: string }) => {
  */
 const exchangeCodeGithub = async ({ code }: { code: string }) => {
   const res: ExchangeCodeGithubResponse = (
-    await standardRequest.get(INTEGRATION_GITHUB_TOKEN_URL, {
+    await request.get(INTEGRATION_GITHUB_TOKEN_URL, {
       params: {
         client_id: await getClientIdGitHub(),
         client_secret: await getClientSecretGitHub(),
@@ -321,7 +321,7 @@ const exchangeCodeGithub = async ({ code }: { code: string }) => {
 const exchangeCodeGitlab = async ({ code }: { code: string }) => {
   const accessExpiresAt = new Date();
   const res: ExchangeCodeGitlabResponse = (
-    await standardRequest.post(
+    await request.post(
       INTEGRATION_GITLAB_TOKEN_URL,
       new URLSearchParams({
         grant_type: "authorization_code",

backend/src/integrations/refresh.ts

@@ -1,4 +1,4 @@
-import { standardRequest } from "../config/request";
+import request from "../config/request";
 import { IIntegrationAuth } from "../models";
 import {
   INTEGRATION_AZURE_KEY_VAULT,
@@ -121,7 +121,7 @@ const exchangeRefreshAzure = async ({
   refreshToken: string;
 }) => {
   const accessExpiresAt = new Date();
-  const { data }: { data: RefreshTokenAzureResponse } = await standardRequest.post(
+  const { data }: { data: RefreshTokenAzureResponse } = await request.post(
     INTEGRATION_AZURE_TOKEN_URL,
     new URLSearchParams({
       client_id: await getClientIdAzure(),
@@ -158,7 +158,7 @@ const exchangeRefreshHeroku = async ({
     data,
   }: {
     data: RefreshTokenHerokuResponse;
-  } = await standardRequest.post(
+  } = await request.post(
     INTEGRATION_HEROKU_TOKEN_URL,
     new URLSearchParams({
       grant_type: "refresh_token",
@@ -193,7 +193,7 @@ const exchangeRefreshGitLab = async ({
     data,
   }: {
     data: RefreshTokenGitLabResponse;
-  } = await standardRequest.post(
+  } = await request.post(
     INTEGRATION_GITLAB_TOKEN_URL,
     new URLSearchParams({
       grant_type: "refresh_token",

backend/src/integrations/sync.ts

@@ -37,7 +37,8 @@ import {
   INTEGRATION_TRAVISCI_API_URL,
   INTEGRATION_SUPABASE_API_URL
 } from "../variables";
-import { standardRequest} from '../config/request';
+import request from '../config/request';
+import axios from "axios";
 
 /**
  * Sync/push [secrets] to [app] in integration named [integration]
@@ -214,7 +215,7 @@ const syncSecretsAzureKeyVault = async ({
       let result: GetAzureKeyVaultSecret[] = [];
       try {
         while (url) {
-          const res = await standardRequest.get(url, {
+          const res = await request.get(url, {
             headers: {
               Authorization: `Bearer ${accessToken}`
             }
@@ -241,7 +242,7 @@ const syncSecretsAzureKeyVault = async ({
         lastSlashIndex = getAzureKeyVaultSecret.id.lastIndexOf('/');
       }
       
-      const azureKeyVaultSecret = await standardRequest.get(`${getAzureKeyVaultSecret.id}?api-version=7.3`, {
+      const azureKeyVaultSecret = await request.get(`${getAzureKeyVaultSecret.id}?api-version=7.3`, {
         headers: {
           'Authorization': `Bearer ${accessToken}`
         }
@@ -307,7 +308,7 @@ const syncSecretsAzureKeyVault = async ({
       while (!isSecretSet && maxTries > 0) {
         // try to set secret
         try {
-          await standardRequest.put(
+          await request.put(
             `${integration.app}/secrets/${key}?api-version=7.3`,
             {
               value
@@ -324,7 +325,7 @@ const syncSecretsAzureKeyVault = async ({
         } catch (err) {
           const error: any = err;
           if (error?.response?.data?.error?.innererror?.code === 'ObjectIsDeletedButRecoverable') {
-            await standardRequest.post(
+            await request.post(
               `${integration.app}/deletedsecrets/${key}/recover?api-version=7.3`, {},
               {
                 headers: {
@@ -354,7 +355,7 @@ const syncSecretsAzureKeyVault = async ({
     
     for await (const deleteSecret of deleteSecrets) {
       const { key } = deleteSecret;
-      await standardRequest.delete(`${integration.app}/secrets/${key}?api-version=7.3`, {
+      await request.delete(`${integration.app}/secrets/${key}?api-version=7.3`, {
         headers: {
           'Authorization': `Bearer ${accessToken}`
         }
@@ -567,7 +568,7 @@ const syncSecretsHeroku = async ({
 }) => {
   try {
     const herokuSecrets = (
-      await standardRequest.get(
+      await request.get(
         `${INTEGRATION_HEROKU_API_URL}/apps/${integration.app}/config-vars`,
         {
           headers: {
@@ -585,7 +586,7 @@ const syncSecretsHeroku = async ({
       }
     });
 
-    await standardRequest.patch(
+    await request.patch(
       `${INTEGRATION_HEROKU_API_URL}/apps/${integration.app}/config-vars`,
       secrets,
       {
@@ -641,7 +642,7 @@ const syncSecretsVercel = async ({
         : {}),
     };
       
-    const vercelSecrets: VercelSecret[] = (await standardRequest.get(
+    const vercelSecrets: VercelSecret[] = (await request.get(
       `${INTEGRATION_VERCEL_API_URL}/v9/projects/${integration.app}/env`,
       {
         params,
@@ -674,7 +675,7 @@ const syncSecretsVercel = async ({
     for await (const vercelSecret of vercelSecrets) {
       if (vercelSecret.type === 'encrypted') {
         // case: secret is encrypted -> need to decrypt
-        const decryptedSecret = (await standardRequest.get(
+        const decryptedSecret = (await request.get(
             `${INTEGRATION_VERCEL_API_URL}/v9/projects/${integration.app}/env/${vercelSecret.id}`,
             {
               params,
@@ -746,7 +747,7 @@ const syncSecretsVercel = async ({
 
     // Sync/push new secrets
     if (newSecrets.length > 0) {
-      await standardRequest.post(
+      await request.post(
         `${INTEGRATION_VERCEL_API_URL}/v10/projects/${integration.app}/env`,
         newSecrets,
         {
@@ -762,7 +763,7 @@ const syncSecretsVercel = async ({
     for await (const secret of updateSecrets) {
       if (secret.type !== 'sensitive') {
         const { id, ...updatedSecret } = secret;
-        await standardRequest.patch(
+        await request.patch(
           `${INTEGRATION_VERCEL_API_URL}/v9/projects/${integration.app}/env/${secret.id}`,
           updatedSecret,
           {
@@ -777,7 +778,7 @@ const syncSecretsVercel = async ({
     }
 
     for await (const secret of deleteSecrets) {
-      await standardRequest.delete(
+      await request.delete(
         `${INTEGRATION_VERCEL_API_URL}/v9/projects/${integration.app}/env/${secret.id}`,
         {
           params,
@@ -836,7 +837,7 @@ const syncSecretsNetlify = async ({
     });
 
     const res = (
-      await standardRequest.get(
+      await request.get(
         `${INTEGRATION_NETLIFY_API_URL}/api/v1/accounts/${integrationAuth.accountId}/env`,
         {
           params: getParams,
@@ -950,7 +951,7 @@ const syncSecretsNetlify = async ({
     });
 
     if (newSecrets.length > 0) {
-      await standardRequest.post(
+      await request.post(
         `${INTEGRATION_NETLIFY_API_URL}/api/v1/accounts/${integrationAuth.accountId}/env`,
         newSecrets,
         {
@@ -965,7 +966,7 @@ const syncSecretsNetlify = async ({
 
     if (updateSecrets.length > 0) {
       updateSecrets.forEach(async (secret: NetlifySecret) => {
-        await standardRequest.patch(
+        await request.patch(
           `${INTEGRATION_NETLIFY_API_URL}/api/v1/accounts/${integrationAuth.accountId}/env/${secret.key}`,
           {
             context: secret.values[0].context,
@@ -984,7 +985,7 @@ const syncSecretsNetlify = async ({
 
     if (deleteSecrets.length > 0) {
       deleteSecrets.forEach(async (key: string) => {
-        await standardRequest.delete(
+        await request.delete(
           `${INTEGRATION_NETLIFY_API_URL}/api/v1/accounts/${integrationAuth.accountId}/env/${key}`,
           {
             params: syncParams,
@@ -999,7 +1000,7 @@ const syncSecretsNetlify = async ({
 
     if (deleteSecretValues.length > 0) {
       deleteSecretValues.forEach(async (secret: NetlifySecret) => {
-        await standardRequest.delete(
+        await request.delete(
           `${INTEGRATION_NETLIFY_API_URL}/api/v1/accounts/${integrationAuth.accountId}/env/${secret.key}/value/${secret.values[0].id}`,
           {
             params: syncParams,
@@ -1150,7 +1151,7 @@ const syncSecretsRender = async ({
   accessToken: string;
 }) => {
   try {
-    await standardRequest.put(
+    await request.put(
       `${INTEGRATION_RENDER_API_URL}/v1/services/${integration.appId}/env-vars`,
       Object.keys(secrets).map((key) => ({
         key,
@@ -1202,7 +1203,7 @@ const syncSecretsRailway = async ({
       variables: secrets
     };
 
-    await standardRequest.post(INTEGRATION_RAILWAY_API_URL, {
+    await request.post(INTEGRATION_RAILWAY_API_URL, {
       query,
       variables: {
         input,
@@ -1260,7 +1261,7 @@ const syncSecretsFlyio = async ({
       }
     `;
 
-    await standardRequest.post(INTEGRATION_FLYIO_API_URL, {
+    await request.post(INTEGRATION_FLYIO_API_URL, {
       query: SetSecrets,
       variables: {
         input: {
@@ -1295,7 +1296,7 @@ const syncSecretsFlyio = async ({
         }
     }`;
 
-    const getSecretsRes = (await standardRequest.post(INTEGRATION_FLYIO_API_URL, {
+    const getSecretsRes = (await request.post(INTEGRATION_FLYIO_API_URL, {
       query: GetSecrets,
       variables: {
         appName: integration.app,
@@ -1331,7 +1332,7 @@ const syncSecretsFlyio = async ({
         }
     }`;
 
-    await standardRequest.post(INTEGRATION_FLYIO_API_URL, {
+    await request.post(INTEGRATION_FLYIO_API_URL, {
       query: DeleteSecrets,
       variables: {
         input: {
@@ -1372,7 +1373,7 @@ const syncSecretsCircleCI = async ({
 }) => {  
   try {
     const circleciOrganizationDetail = (
-      await standardRequest.get(`${INTEGRATION_CIRCLECI_API_URL}/v2/me/collaborations`, {
+      await request.get(`${INTEGRATION_CIRCLECI_API_URL}/v2/me/collaborations`, {
         headers: {
           "Circle-Token": accessToken,
           "Accept-Encoding": "application/json",
@@ -1385,7 +1386,7 @@ const syncSecretsCircleCI = async ({
     // sync secrets to CircleCI
     Object.keys(secrets).forEach(
       async (key) =>
-        await standardRequest.post(
+        await request.post(
           `${INTEGRATION_CIRCLECI_API_URL}/v2/project/${slug}/${integration.app}/envvar`,
           {
             name: key,
@@ -1402,7 +1403,7 @@ const syncSecretsCircleCI = async ({
 
     // get secrets from CircleCI
     const getSecretsRes = (
-      await standardRequest.get(
+      await request.get(
         `${INTEGRATION_CIRCLECI_API_URL}/v2/project/${slug}/${integration.app}/envvar`,
         {
           headers: {
@@ -1416,7 +1417,7 @@ const syncSecretsCircleCI = async ({
     // delete secrets from CircleCI
     getSecretsRes.forEach(async (sec: any) => {
       if (!(sec.name in secrets)) {
-        await standardRequest.delete(
+        await request.delete(
           `${INTEGRATION_CIRCLECI_API_URL}/v2/project/${slug}/${integration.app}/envvar/${sec.name}`,
           {
             headers: {
@@ -1453,7 +1454,7 @@ const syncSecretsTravisCI = async ({
   try {
     // get secrets from travis-ci  
     const getSecretsRes = (
-      await standardRequest.get(
+      await request.get(
         `${INTEGRATION_TRAVISCI_API_URL}/settings/env_vars?repository_id=${integration.appId}`,
         {
           headers: {
@@ -1475,7 +1476,7 @@ const syncSecretsTravisCI = async ({
       if (!(key in getSecretsRes)) {
         // case: secret does not exist in travis ci
         // -> add secret
-        await standardRequest.post(
+        await request.post(
           `${INTEGRATION_TRAVISCI_API_URL}/settings/env_vars?repository_id=${integration.appId}`,
           {
             env_var: {
@@ -1494,7 +1495,7 @@ const syncSecretsTravisCI = async ({
       } else {
         // case: secret exists in travis ci
         // -> update/set secret
-        await standardRequest.patch(
+        await request.patch(
           `${INTEGRATION_TRAVISCI_API_URL}/settings/env_vars/${getSecretsRes[key].id}?repository_id=${getSecretsRes[key].repository_id}`,
           {
             env_var: {
@@ -1516,7 +1517,7 @@ const syncSecretsTravisCI = async ({
     for await (const key of Object.keys(getSecretsRes)) {
       if (!(key in secrets)){
         // delete secret
-        await standardRequest.delete(
+        await request.delete(
           `${INTEGRATION_TRAVISCI_API_URL}/settings/env_vars/${getSecretsRes[key].id}?repository_id=${getSecretsRes[key].repository_id}`,
           {
             headers: {
@@ -1559,42 +1560,27 @@ const syncSecretsGitLab = async ({
       environment_scope: string;
     }
 
-    const getAllEnvVariables = async (integrationAppId: string, accessToken: string) => {
-      const gitLabApiUrl = `${INTEGRATION_GITLAB_API_URL}/v4/projects/${integrationAppId}/variables`;
-      const headers = {
-        "Authorization": `Bearer ${accessToken}`,
-        "Accept-Encoding": "application/json",
-      };
-    
-      let allEnvVariables: GitLabSecret[] = [];
-      let url: string | null = `${gitLabApiUrl}?per_page=100`;
-    
-      while (url) {
-        const response: any = await standardRequest.get(url, { headers });
-        allEnvVariables = [...allEnvVariables, ...response.data];
-    
-        const linkHeader = response.headers.link;
-        const nextLink = linkHeader?.split(',').find((part: string) => part.includes('rel="next"'));
-    
-        if (nextLink) {
-          url = nextLink.trim().split(';')[0].slice(1, -1);
-        } else {
-          url = null;
+    // get secrets from gitlab
+    const getSecretsRes: GitLabSecret[] = (
+      await request.get(
+        `${INTEGRATION_GITLAB_API_URL}/v4/projects/${integration?.appId}/variables`,
+        { 
+          headers: {
+            "Authorization": `Bearer ${accessToken}`,
+            "Accept-Encoding": "application/json",
+          },
         }
-      }
-    
-      return allEnvVariables;
-    };
-
-    const allEnvVariables = await getAllEnvVariables(integration?.appId, accessToken);
-    const getSecretsRes: GitLabSecret[] = allEnvVariables.filter((secret: GitLabSecret) => 
+      )
+    )
+    .data
+    .filter((secret: GitLabSecret) => 
       secret.environment_scope === integration.targetEnvironment
     );
 
     for await (const key of Object.keys(secrets)) {
       const existingSecret = getSecretsRes.find((s: any) => s.key == key);
       if (!existingSecret) {
-        await standardRequest.post(
+        await request.post(
           `${INTEGRATION_GITLAB_API_URL}/v4/projects/${integration?.appId}/variables`,
           {
             key: key,
@@ -1615,7 +1601,7 @@ const syncSecretsGitLab = async ({
       } else {
         // update secret 
         if (secrets[key] !== existingSecret.value) {
-          await standardRequest.put(
+          await request.put(
             `${INTEGRATION_GITLAB_API_URL}/v4/projects/${integration?.appId}/variables/${existingSecret.key}?filter[environment_scope]=${integration.targetEnvironment}`,
             {
               ...existingSecret,
@@ -1636,7 +1622,7 @@ const syncSecretsGitLab = async ({
     // delete secrets 
     for await (const sec of getSecretsRes) {
       if (!(sec.key in secrets)) {
-        await standardRequest.delete(
+        await request.delete(
           `${INTEGRATION_GITLAB_API_URL}/v4/projects/${integration?.appId}/variables/${sec.key}?filter[environment_scope]=${integration.targetEnvironment}`,
           {
             headers: {
@@ -1646,7 +1632,6 @@ const syncSecretsGitLab = async ({
         );
       }
     }
-
   } catch (err) {
     Sentry.setUser(null);
     Sentry.captureException(err);
@@ -1672,7 +1657,7 @@ const syncSecretsSupabase = async ({
   accessToken: string;
 }) => {
   try {
-    const { data: getSecretsRes } = await standardRequest.get(
+    const { data: getSecretsRes } = await request.get(
       `${INTEGRATION_SUPABASE_API_URL}/v1/projects/${integration.appId}/secrets`,
       {
         headers: {
@@ -1692,7 +1677,7 @@ const syncSecretsSupabase = async ({
       }
     );
 
-    await standardRequest.post(
+    await request.post(
       `${INTEGRATION_SUPABASE_API_URL}/v1/projects/${integration.appId}/secrets`,
       modifiedFormatForSecretInjection,
       {
@@ -1710,7 +1695,7 @@ const syncSecretsSupabase = async ({
       }
     });
 
-    await standardRequest.delete(
+    await request.delete(
       `${INTEGRATION_SUPABASE_API_URL}/v1/projects/${integration.appId}/secrets`,
       {
         headers: {

backend/src/integrations/teams.ts

@@ -5,7 +5,7 @@ import {
     INTEGRATION_GITLAB,
     INTEGRATION_GITLAB_API_URL
 } from '../variables';
-import { standardRequest } from '../config/request';
+import request from '../config/request';
 
 interface Team {
     name: string;
@@ -56,7 +56,7 @@ const getTeamsGitLab = async ({
     accessToken: string;
 }) => {
     let teams: Team[] = [];
-    const res = (await standardRequest.get(
+    const res = (await request.get(
         `${INTEGRATION_GITLAB_API_URL}/v4/groups`,
         {
             headers: {

backend/src/interfaces/utils/crypto.ts

@@ -1,41 +0,0 @@
-export interface IGenerateKeyPairOutput {
-    publicKey: string;
-    privateKey: string
-}
-
-export interface IEncryptAsymmetricInput {
-    plaintext: string;
-    publicKey: string;
-    privateKey: string;
-}
-
-export interface IEncryptAsymmetricOutput {
-    ciphertext: string;
-    nonce: string;
-}
-
-export interface IDecryptAsymmetricInput {
-    ciphertext: string;
-    nonce: string;
-    publicKey: string;
-    privateKey: string;
-}
-
-export interface IEncryptSymmetricInput {
-    plaintext: string;
-    key: string;
-}
-
-export interface IEncryptSymmetricOutput {
-    ciphertext: string;
-    iv: string;
-    tag: string;
-}
-
-export interface IDecryptSymmetricInput {
-    ciphertext: string;
-    iv: string;
-    tag: string;
-    key: string;
-}
-

backend/src/interfaces/utils/index.ts

@@ -1 +0,0 @@
-export * from './crypto';

backend/src/middleware/requestErrorHandler.ts

@@ -7,6 +7,11 @@ import { getNodeEnv } from '../config';
 
 export const requestErrorHandler: ErrorRequestHandler = async (error: RequestError | Error, req, res, next) => {
     if (res.headersSent) return next();
+    if ((await getNodeEnv()) !== "production") {
+        /* eslint-disable no-console */
+        console.log(error)
+        /* eslint-enable no-console */
+    }
 
     //TODO: Find better way to type check for error. In current setting you need to cast type to get the functions and variables from RequestError
     if (!(error instanceof RequestError)) {
@@ -16,7 +21,7 @@ export const requestErrorHandler: ErrorRequestHandler = async (error: RequestErr
 
     //* Set Sentry user identification if req.user is populated
     if (req.user !== undefined && req.user !== null) {
-        Sentry.setUser({ email: (req.user as any).email })
+        Sentry.setUser({ email: req.user.email })
     }
     //* Only sent error to Sentry if LogLevel is one of the following level 'ERROR', 'EMERGENCY' or 'CRITICAL'
     //* with this we will eliminate false-positive errors like 'BadRequestError', 'UnauthorizedRequestError' and so on

backend/src/middleware/requireAuth.ts

@@ -7,6 +7,9 @@ import {
 	getAuthAPIKeyPayload,
 	getAuthSAAKPayload
 } from '../helpers/auth';
+import { 
+	UnauthorizedRequestError
+} from '../utils/errors';
 import {
 	IUser,
 	IServiceAccount,
@@ -42,7 +45,7 @@ const requireAuth = ({
 	acceptedAuthModes: string[];
 }) => {
 	return async (req: Request, res: Response, next: NextFunction) => {
-
+		
 		// validate auth token against accepted auth modes [acceptedAuthModes]
 		// and return token type [authTokenType] and value [authTokenValue]
 		const { authMode, authTokenValue } = validateAuthMode({
@@ -77,13 +80,13 @@ const requireAuth = ({
 				req.user = authPayload;
 				break;
 		}
-
+		
 		req.requestData = {
 			...req.params,
 			...req.query,
 			...req.body,
 		}
-
+		
 		req.authData = {
 			authMode,
 			authPayload, // User, ServiceAccount, ServiceTokenData
@@ -91,7 +94,7 @@ const requireAuth = ({
 			authIP: req.ip,
 			authUserAgent: req.headers['user-agent'] ?? 'other'
 		}
-
+		
 		return next();
 	}
 }

backend/src/middleware/requireBotAuth.ts

@@ -1,6 +1,9 @@
 import { Request, Response, NextFunction } from 'express';
 import { Types } from 'mongoose';
-import { validateClientForBot } from '../validation';
+import { Bot } from '../models';
+import { validateMembership } from '../helpers/membership';
+import { validateClientForBot } from '../helpers/bot';
+import { AccountNotFoundError } from '../utils/errors';
 
 type req = 'params' | 'body' | 'query';
 

backend/src/middleware/requireIntegrationAuth.ts

@@ -1,6 +1,10 @@
 import { Request, Response, NextFunction } from 'express';
 import { Types } from 'mongoose';
-import { validateClientForIntegration } from '../validation';
+import { Integration, IntegrationAuth } from '../models';
+import { IntegrationService } from '../services';
+import { validateMembership } from '../helpers/membership';
+import { validateClientForIntegration } from '../helpers/integration';
+import { IntegrationNotFoundError, UnauthorizedRequestError } from '../utils/errors';
 
 /**
  * Validate if user on request is a member of workspace with proper roles associated

backend/src/middleware/requireIntegrationAuthorizationAuth.ts

@@ -1,6 +1,10 @@
 import { Types } from 'mongoose';
 import { Request, Response, NextFunction } from 'express';
-import { validateClientForIntegrationAuth } from '../validation';
+import { IntegrationAuth, IWorkspace } from '../models';
+import { IntegrationService } from '../services';
+import { validateClientForIntegrationAuth } from '../helpers/integrationAuth';
+import { validateMembership } from '../helpers/membership';
+import { UnauthorizedRequestError } from '../utils/errors';
 
 type req = 'params' | 'body' | 'query';
 

backend/src/middleware/requireMembershipAuth.ts

@@ -1,6 +1,13 @@
 import { Types } from 'mongoose';
 import { Request, Response, NextFunction } from 'express';
-import { validateClientForMembership } from '../validation';
+import { UnauthorizedRequestError } from '../utils/errors';
+import {
+    Membership,
+} from '../models';
+import {
+    validateClientForMembership,
+    validateMembership
+} from '../helpers/membership';
 
 type req = 'params' | 'body' | 'query';
 

backend/src/middleware/requireMembershipOrgAuth.ts

@@ -1,6 +1,16 @@
 import { Types } from 'mongoose';
 import { Request, Response, NextFunction } from 'express';
-import { validateClientForMembershipOrg } from '../validation';
+import { UnauthorizedRequestError } from '../utils/errors';
+import {
+    MembershipOrg
+} from '../models';
+import { 
+    validateClientForMembershipOrg,
+    validateMembershipOrg
+} from '../helpers/membershipOrg';
+
+
+// TODO: transform
 
 type req = 'params' | 'body' | 'query';
 

backend/src/middleware/requireOrganizationAuth.ts

@@ -1,6 +1,9 @@
 import { Request, Response, NextFunction } from 'express';
 import { Types } from 'mongoose';
-import { validateClientForOrganization } from '../validation';
+import { IOrganization, MembershipOrg } from '../models';
+import { UnauthorizedRequestError, ValidationError } from '../utils/errors';
+import { validateMembershipOrg } from '../helpers/membershipOrg';
+import { validateClientForOrganization } from '../helpers/organization';
 
 type req = 'params' | 'body' | 'query';
 

backend/src/middleware/requireSecretAuth.ts

@@ -1,6 +1,13 @@
 import { Request, Response, NextFunction } from 'express';
 import { Types } from 'mongoose';
-import { validateClientForSecret } from '../validation';
+import { UnauthorizedRequestError, SecretNotFoundError } from '../utils/errors';
+import { Secret } from '../models';
+import {
+    validateMembership
+} from '../helpers/membership';
+import {
+    validateClientForSecret
+} from '../helpers/secrets';
 
 // note: used for old /v1/secret and /v2/secret routes.
 // newer /v2/secrets routes use [requireSecretsAuth] middleware with the exception

backend/src/middleware/requireSecretsAuth.ts

@@ -1,6 +1,8 @@
 import { Request, Response, NextFunction } from 'express';
 import { Types } from 'mongoose';
-import { validateClientForSecrets } from '../validation';
+import { UnauthorizedRequestError } from '../utils/errors';
+import { Secret, Membership } from '../models';
+import { validateClientForSecrets } from '../helpers/secrets';
 
 const requireSecretsAuth = ({
     acceptedRoles,

backend/src/middleware/requireServiceAccountAuth.ts

@@ -1,6 +1,15 @@
 import { Request, Response, NextFunction } from 'express';
 import { Types } from 'mongoose';
-import { validateClientForServiceAccount } from '../validation';
+import { ServiceAccount } from '../models';
+import {
+    ServiceAccountNotFoundError
+} from '../utils/errors';
+import {
+    validateMembershipOrg
+} from '../helpers/membershipOrg';
+import {
+    validateClientForServiceAccount
+} from '../helpers/serviceAccount';
 
 type req = 'params' | 'body' | 'query';
 

backend/src/middleware/requireServiceTokenDataAuth.ts

@@ -1,6 +1,9 @@
 import { Request, Response, NextFunction } from 'express';
 import { Types } from 'mongoose';
-import { validateClientForServiceTokenData } from '../validation';
+import { ServiceToken, ServiceTokenData } from '../models';
+import { validateClientForServiceTokenData } from '../helpers/serviceTokenData';
+import { validateMembership } from '../helpers/membership';
+import { AccountNotFoundError, UnauthorizedRequestError } from '../utils/errors';
 
 type req = 'params' | 'body' | 'query';
 

backend/src/middleware/requireWorkspaceAuth.ts

@@ -1,6 +1,8 @@
 import { Request, Response, NextFunction } from 'express';
 import { Types } from 'mongoose';
-import { validateClientForWorkspace } from '../validation';
+import { validateMembership } from '../helpers/membership';
+import { validateClientForWorkspace } from '../helpers/workspace';
+import { UnauthorizedRequestError } from '../utils/errors';
 
 type req = 'params' | 'body' | 'query';
 
@@ -29,7 +31,7 @@ const requireWorkspaceAuth = ({
 		const environment = locationEnvironment ? req[locationEnvironment]?.environment : undefined;
 		
 		// validate clients
-		const { membership, workspace } = await validateClientForWorkspace({
+		const { membership } = await validateClientForWorkspace({
 			authData: req.authData,
 			workspaceId: new Types.ObjectId(workspaceId),
 			environment,
@@ -41,10 +43,6 @@ const requireWorkspaceAuth = ({
 		if (membership) {
 			req.membership = membership;
 		}
-		
-		if (workspace) {
-			req.workspace = workspace;
-		}
 
 		return next();
 	};

backend/src/models/backupPrivateKey.ts

@@ -1,9 +1,4 @@
 import { Schema, model, Types } from 'mongoose';
-import { 
-	ALGORITHM_AES_256_GCM,
-	ENCODING_SCHEME_UTF8,
-	ENCODING_SCHEME_BASE64
-} from '../variables';
 
 export interface IBackupPrivateKey {
 	_id: Types.ObjectId;
@@ -12,8 +7,6 @@ export interface IBackupPrivateKey {
 	iv: string;
 	tag: string;
 	salt: string;
-	algorithm: string;
-	keyEncoding: 'base64' | 'utf8';
 	verifier: string;
 }
 
@@ -39,19 +32,6 @@ const backupPrivateKeySchema = new Schema<IBackupPrivateKey>(
 			select: false,
 			required: true
 		},
-        algorithm: { // the encryption algorithm used
-            type: String,
-            enum: [ALGORITHM_AES_256_GCM],
-            required: true
-        },
-        keyEncoding: {
-            type: String,
-            enum: [
-                ENCODING_SCHEME_UTF8,
-                ENCODING_SCHEME_BASE64
-            ],
-			required: true
-        },
 		salt: {
 			type: String,
 			select: false,

backend/src/models/bot.ts

@@ -1,10 +1,4 @@
 import { Schema, model, Types } from 'mongoose';
-import { 
-    ALGORITHM_AES_256_GCM,
-    ENCODING_SCHEME_UTF8,
-    ENCODING_SCHEME_HEX,
-    ENCODING_SCHEME_BASE64
-} from '../variables';
 
 export interface IBot {
 	_id: Types.ObjectId;
@@ -15,8 +9,6 @@ export interface IBot {
     encryptedPrivateKey: string;
     iv: string;
     tag: string;
-    algorithm: 'aes-256-gcm';
-    keyEncoding: 'base64' | 'utf8';
 }
 
 const botSchema = new Schema<IBot>(
@@ -53,21 +45,6 @@ const botSchema = new Schema<IBot>(
             type: String,
             required: true,
             select: false
-        },
-        algorithm: { // the encryption algorithm used
-            type: String,
-            enum: [ALGORITHM_AES_256_GCM],
-            required: true,
-            select: false
-        },
-        keyEncoding: {
-            type: String,
-            enum: [
-                ENCODING_SCHEME_UTF8,
-                ENCODING_SCHEME_BASE64
-            ],
-            required: true,
-            select: false
         }
 	},
 	{

backend/src/models/index.ts

@@ -16,7 +16,7 @@ import ServiceAccountKey, { IServiceAccountKey } from './serviceAccountKey'; //
 import ServiceAccountOrganizationPermission, { IServiceAccountOrganizationPermission } from './serviceAccountOrganizationPermission'; // new
 import ServiceAccountWorkspacePermission, { IServiceAccountWorkspacePermission } from './serviceAccountWorkspacePermission'; // new
 import TokenData, { ITokenData } from './tokenData';
-import User,{ AuthProvider, IUser } from './user';
+import User, { IUser } from './user';
 import UserAction, { IUserAction } from './userAction';
 import Workspace, { IWorkspace } from './workspace';
 import ServiceTokenData, { IServiceTokenData } from './serviceTokenData';
@@ -24,7 +24,6 @@ import APIKeyData, { IAPIKeyData } from './apiKeyData';
 import LoginSRPDetail, { ILoginSRPDetail } from './loginSRPDetail';
 
 export {
-	AuthProvider,
 	BackupPrivateKey,
 	IBackupPrivateKey,
 	Bot,

backend/src/models/integration.ts

@@ -21,7 +21,6 @@ export interface IIntegration {
   workspace: Types.ObjectId;
   environment: string;
   isActive: boolean;
-  url: string;
   app: string;
   appId: string;
   owner: string;
@@ -64,11 +63,6 @@ const integrationSchema = new Schema<IIntegration>(
       type: Boolean,
       required: true,
     },
-    url: {
-      // for custom self-hosted integrations (e.g. self-hosted GitHub enterprise)
-      type: String,
-      default: null
-    },
     app: {
       // name of app in provider
       type: String,

backend/src/models/integrationAuth.ts

@@ -14,9 +14,6 @@ import {
   INTEGRATION_CIRCLECI,
   INTEGRATION_TRAVISCI,
   INTEGRATION_SUPABASE,
-  ALGORITHM_AES_256_GCM,
-  ENCODING_SCHEME_UTF8,
-  ENCODING_SCHEME_BASE64
 } from "../variables";
 
 export interface IIntegrationAuth extends Document {
@@ -34,8 +31,6 @@ export interface IIntegrationAuth extends Document {
   accessCiphertext?: string;
   accessIV?: string;
   accessTag?: string;
-  algorithm?: 'aes-256-gcm';
-  keyEncoding?: 'utf8' | 'base64';
   accessExpiresAt?: Date;
 }
 
@@ -114,19 +109,6 @@ const integrationAuthSchema = new Schema<IIntegrationAuth>(
       type: Date,
       select: false,
     },
-    algorithm: { // the encryption algorithm used
-      type: String,
-      enum: [ALGORITHM_AES_256_GCM],
-      required: true
-    },
-    keyEncoding: {
-        type: String,
-        enum: [
-            ENCODING_SCHEME_UTF8,
-            ENCODING_SCHEME_BASE64
-        ],
-        required: true
-    }
   },
   {
     timestamps: true,

backend/src/models/loginSRPDetail.ts

@@ -5,7 +5,6 @@ export interface ILoginSRPDetail {
 	clientPublicKey: string;
 	email: string;
 	serverBInt: mongoose.Schema.Types.Buffer;
-	userId: string;
 	expireAt: Date;
 }
 
@@ -17,6 +16,7 @@ const loginSRPDetailSchema = new Schema<ILoginSRPDetail>(
 		},
 		email: {
 			type: String,
+			required: true,
 			unique: true
 		},
 		serverBInt: { type: mongoose.Schema.Types.Buffer },

backend/src/models/secret.ts

@@ -2,9 +2,6 @@ import { Schema, model, Types } from 'mongoose';
 import {
 	SECRET_SHARED,
 	SECRET_PERSONAL,
-	ALGORITHM_AES_256_GCM,
-	ENCODING_SCHEME_UTF8,
-	ENCODING_SCHEME_BASE64
 } from '../variables';
 import { ROOT_FOLDER_PATH } from '../utils/folder';
 
@@ -28,8 +25,6 @@ export interface ISecret {
 	secretCommentIV?: string;
 	secretCommentTag?: string;
 	secretCommentHash?: string;
-	algorithm: 'aes-256-gcm';
-	keyEncoding: 'utf8' | 'base64';
 	tags?: string[];
 	path?: string;
 	folder?: Types.ObjectId;
@@ -116,19 +111,6 @@ const secretSchema = new Schema<ISecret>(
 			type: String,
 			required: false
 		},
-		algorithm: { // the encryption algorithm used
-			type: String,
-			enum: [ALGORITHM_AES_256_GCM],
-			required: true
-		},
-		keyEncoding: {
-			type: String,
-			enum: [
-				ENCODING_SCHEME_UTF8,
-				ENCODING_SCHEME_BASE64
-			],
-			required: true
-		},
 		// the full path to the secret in relation to folders
 		path: {
 			type: String,

backend/src/models/secretBlindIndexData.ts

@@ -1,9 +1,4 @@
 import { Schema, model, Types, Document } from 'mongoose';
-import { 
-    ALGORITHM_AES_256_GCM,
-    ENCODING_SCHEME_UTF8,
-    ENCODING_SCHEME_BASE64
-} from '../variables';
 
 export interface ISecretBlindIndexData extends Document {
     _id: Types.ObjectId;
@@ -11,8 +6,6 @@ export interface ISecretBlindIndexData extends Document {
     encryptedSaltCiphertext: string;
     saltIV: string;
     saltTag: string;
-    algorithm: 'aes-256-gcm';
-    keyEncoding: 'base64' | 'utf8'
 }
 
 const secretBlindIndexDataSchema = new Schema<ISecretBlindIndexData>(
@@ -22,7 +15,7 @@ const secretBlindIndexDataSchema = new Schema<ISecretBlindIndexData>(
             ref: 'Workspace',
             required: true
         },
-        encryptedSaltCiphertext: { // TODO: make these select: false
+        encryptedSaltCiphertext: {
             type: String,
             required: true
         },
@@ -33,23 +26,7 @@ const secretBlindIndexDataSchema = new Schema<ISecretBlindIndexData>(
         saltTag: {
             type: String,
             required: true
-        },
-        algorithm: {
-            type: String,
-            enum: [ALGORITHM_AES_256_GCM],
-            required: true,
-            select: false
-        },
-        keyEncoding: {
-            type: String,
-            enum: [
-                ENCODING_SCHEME_UTF8,
-                ENCODING_SCHEME_BASE64
-            ],
-            required: true,
-            select: false
         }
-
     }
 );
 

backend/src/models/user.ts

@@ -1,13 +1,7 @@
 import { Schema, model, Types, Document } from 'mongoose';
 
-export enum AuthProvider {
-	GOOGLE = 'google',
-}
-
 export interface IUser extends Document {
 	_id: Types.ObjectId;
-	authId?: string;
-	authProvider?: AuthProvider;
 	email: string;
 	firstName?: string;
 	lastName?: string;
@@ -32,17 +26,9 @@ export interface IUser extends Document {
 
 const userSchema = new Schema<IUser>(
 	{
-		authId: {
-			type: String,
-		},
-		authProvider: {
-			type: String,
-			enum: AuthProvider,
-		},
 		email: {
 			type: String,
-			required: true,
-			unique: true,
+			required: true
 		},
 		firstName: {
 			type: String

backend/src/routes/v1/auth.ts

@@ -1,7 +1,6 @@
 import express from 'express';
 const router = express.Router();
 import { body } from 'express-validator';
-import passport from 'passport';
 import { requireAuth, validateRequest } from '../../middleware';
 import { authController } from '../../controllers/v1';
 import { authLimiter } from '../../helpers/rateLimiter';
@@ -28,37 +27,20 @@ router.post( // deprecated (moved to api/v2/auth/login2)
 );
 
 router.post(
-  '/logout',
+  '/logout', 
   authLimiter,
   requireAuth({
     acceptedAuthModes: [AUTH_MODE_JWT]
-  }),
+  }), 
   authController.logout
 );
 
 router.post(
-  '/checkAuth',
+  '/checkAuth', 
   requireAuth({
     acceptedAuthModes: [AUTH_MODE_JWT]
-  }),
+  }), 
   authController.checkAuth
 );
 
-
-
-router.get(
-  '/redirect/google',
-  authLimiter,
-  passport.authenticate('google', {
-    scope: ['profile', 'email'],
-    session: false,
-  }),
-)
-
-router.get(
-  '/callback/google',
-  passport.authenticate('google', { failureRedirect: '/login/provider/error', session: false }),
-  authController.handleAuthProviderCallback,
-)
-
 export default router;

backend/src/routes/v1/index.ts

@@ -15,7 +15,7 @@ import password from './password';
 import stripe from './stripe';
 import integration from './integration';
 import integrationAuth from './integrationAuth';
-import secretsFolder from './secretsFolder';
+import secretsFolder from './secretsFolder'
 
 export {
 	signup,

backend/src/routes/v2/secrets.ts

@@ -7,9 +7,9 @@ import {
     requireSecretsAuth,
     validateRequest
 } from '../../middleware';
-import { validateClientForSecrets } from '../../validation';
 import { query, body } from 'express-validator';
 import { secretsController } from '../../controllers/v2';
+import { validateClientForSecrets } from '../../helpers/secrets';
 import {
     ADMIN,
     MEMBER,

backend/src/routes/v3/auth.ts

@@ -1,29 +0,0 @@
-import express from 'express';
-import { body } from 'express-validator';
-import { validateRequest } from '../../middleware';
-import { authController } from '../../controllers/v3';
-import { authLimiter } from '../../helpers/rateLimiter';
-
-const router = express.Router();
-
-router.post(
-    '/login1',
-    authLimiter,
-    body('email').isString().trim(),
-    body('providerAuthToken').isString().trim().optional({nullable: true}),
-    body('clientPublicKey').isString().trim().notEmpty(),
-    validateRequest,
-    authController.login1
-);
-
-router.post(
-    '/login2',
-    authLimiter,
-    body('email').isString().trim(),
-    body('providerAuthToken').isString().trim().optional({nullable: true}),
-    body('clientProof').isString().trim().notEmpty(),
-    validateRequest,
-    authController.login2
-);
-
-export default router;

backend/src/routes/v3/index.ts

@@ -1,11 +1,7 @@
-import auth from './auth';
 import secrets from './secrets';
 import workspaces from './workspaces';
-import signup from './signup';
 
 export {
-    auth,
     secrets,
-    signup,
-    workspaces,
-}
+    workspaces
+}

backend/src/routes/v3/signup.ts

@@ -1,29 +0,0 @@
-import express from 'express';
-const router = express.Router();
-import { body } from 'express-validator';
-import { signupController } from '../../controllers/v3';
-import { authLimiter } from '../../helpers/rateLimiter';
-import { validateRequest } from '../../middleware';
-
-router.post(
-    '/complete-account/signup',
-    authLimiter,
-    body('email').exists().isString().trim().notEmpty().isEmail(),
-	body('firstName').exists().isString().trim().notEmpty(),
-	body('lastName').exists().isString().trim().optional({nullable: true}),
-	body('protectedKey').exists().isString().trim().notEmpty(),
-	body('protectedKeyIV').exists().isString().trim().notEmpty(),
-	body('protectedKeyTag').exists().isString().trim().notEmpty(),
-	body('publicKey').exists().isString().trim().notEmpty(),
-	body('encryptedPrivateKey').exists().isString().trim().notEmpty(),
-	body('encryptedPrivateKeyIV').exists().isString().trim().notEmpty(),
-	body('encryptedPrivateKeyTag').exists().isString().trim().notEmpty(),
-	body('salt').exists().isString().trim().notEmpty(),
-	body('verifier').exists().isString().trim().notEmpty(),
-	body('organizationName').exists().isString().trim().notEmpty(),
-	body('providerAuthToken').isString().trim().optional({nullable: true}),
-    validateRequest,
-    signupController.completeAccountSignup,
-);
-
-export default router;

backend/src/services/SecretService.ts

@@ -1,3 +1,4 @@
+// WIP
 import { Types } from 'mongoose';
 import {
     ISecret
@@ -10,6 +11,7 @@ import {
     DeleteSecretParams
 } from '../interfaces/services/SecretService';
 import { 
+    initSecretBlindIndexDataHelper,
     createSecretBlindIndexDataHelper,
     getSecretBlindIndexSaltHelper,
     generateSecretBlindIndexWithSaltHelper,
@@ -22,6 +24,16 @@ import {
 } from '../helpers/secrets';
 
 class SecretService {
+    
+    /**
+     * 
+     * @param param0 h
+     * @returns 
+     */
+    
+    static async initSecretBlindIndexDataHelper() {
+        return await initSecretBlindIndexDataHelper();
+    }
 
     /**
      * Create secret blind index data containing encrypted blind index salt 

backend/src/types/express/index.d.ts

@@ -9,12 +9,6 @@ import {
 	AuthData
 } from '../../interfaces/middleware';
 
-declare module 'express' {
-	interface Request {
-		user?: any;
-	}
-}
-
 // TODO: fix (any) types
 declare global {
 	namespace Express {
@@ -24,7 +18,6 @@ declare global {
 			workspace: any;
 			membership: any;
 			targetMembership: any;
-			providerAuthToken: any;
 			organization: any;
 			membershipOrg: any;
 			integration: any;

backend/src/utils/addDevelopmentUser.ts

@@ -5,7 +5,6 @@
 ************************************************************************************************/
 
 import { Key, Membership, MembershipOrg, Organization, User, Workspace } from "../models";
-import { SecretService } from "../services";
 import { Types } from 'mongoose';
 import { getNodeEnv } from '../config';
 
@@ -120,12 +119,7 @@ export const createTestUserForDevelopment = async () => {
       // create workspace if not exist 
       const workspaceInDB = await Workspace.findById(testWorkspaceId)
       if (!workspaceInDB) {
-        const workspace = await Workspace.create(testWorkspace)
-        
-        // initialize blind index salt for workspace
-        await SecretService.createSecretBlindIndexData({
-          workspaceId: workspace._id
-        });
+        await Workspace.create(testWorkspace)
       }
 
       // create workspace key if not exist

backend/src/utils/auth.ts

@@ -1,22 +1,10 @@
-import express from 'express';
-import passport from 'passport';
 import { AuthData } from '../interfaces/middleware';
 import {
-  AuthProvider,
-  User,
-  ServiceAccount,
-  ServiceTokenData,
+    User,
+    ServiceAccount,
+    ServiceTokenData,
+    ServiceToken
 } from '../models';
-import { createToken } from '../helpers/auth';
-import {
-  getClientIdGoogle,
-  getClientSecretGoogle,
-  getJwtProviderAuthLifetime,
-  getJwtProviderAuthSecret
-} from '../config';
-
-// eslint-disable-next-line @typescript-eslint/no-var-requires
-const GoogleStrategy = require('passport-google-oauth20').Strategy;
 
 // TODO: find a more optimal folder structure to store these types of functions
 
@@ -26,17 +14,17 @@ const GoogleStrategy = require('passport-google-oauth20').Strategy;
  * @returns 
  */
 const getAuthDataPayloadIdObj = (authData: AuthData) => {
-  if (authData.authPayload instanceof User) {
-    return { userId: authData.authPayload._id };
-  }
+    if (authData.authPayload instanceof User) {
+        return { userId: authData.authPayload._id };
+    }
 
-  if (authData.authPayload instanceof ServiceAccount) {
-    return { serviceAccountId: authData.authPayload._id };
-  }
+    if (authData.authPayload instanceof ServiceAccount) {
+        return { serviceAccountId: authData.authPayload._id };
+    }
 
-  if (authData.authPayload instanceof ServiceTokenData) {
-    return { serviceTokenDataId: authData.authPayload._id };
-  }
+    if (authData.authPayload instanceof ServiceTokenData) {
+        return { serviceTokenDataId: authData.authPayload._id };
+    }
 };
 
 
@@ -47,72 +35,20 @@ const getAuthDataPayloadIdObj = (authData: AuthData) => {
  */
 const getAuthDataPayloadUserObj = (authData: AuthData) => {
 
-  if (authData.authPayload instanceof User) {
-    return { user: authData.authPayload._id };
-  }
-
-  if (authData.authPayload instanceof ServiceAccount) {
-    return { user: authData.authPayload.user };
-  }
-
-  if (authData.authPayload instanceof ServiceTokenData) {
-    return { user: authData.authPayload.user };
-  }
-}
-
-const initializePassport = async () => {
-  const googleClientSecret = await getClientSecretGoogle();
-  const googleClientId = await getClientIdGoogle();
-
-  passport.use(new GoogleStrategy({
-    passReqToCallback: true,
-    clientID: googleClientId,
-    clientSecret: googleClientSecret,
-    callbackURL: '/api/v1/auth/callback/google',
-    scope: ['profile', ' email'],
-  }, async (
-    req: express.Request,
-    accessToken: string,
-    refreshToken: string,
-    profile: any,
-    cb: any
-  ) => {
-    try {
-      const email = profile.emails[0].value;
-      let user = await User.findOne({
-        authProvider: AuthProvider.GOOGLE,
-        authId: profile.id,
-      }).select('+publicKey')
-
-      if (!user) {
-        user = await new User({
-          email,
-          authProvider: AuthProvider.GOOGLE,
-          authId: profile.id,
-        }).save();
-      }
-
-      const providerAuthToken = createToken({
-        payload: {
-          userId: user._id.toString(),
-          email: user.email,
-          authProvider: user.authProvider,
-          isUserCompleted: !!user.publicKey
-        },
-        expiresIn: await getJwtProviderAuthLifetime(),
-        secret: await getJwtProviderAuthSecret(),
-      });
-
-      req.providerAuthToken = providerAuthToken;
-      cb(null, profile);
-    } catch (err) {
-      cb(null, false);
+    if (authData.authPayload instanceof User) {
+        return { user: authData.authPayload._id };
+    }
+
+    if (authData.authPayload instanceof ServiceAccount) {
+        return { user: authData.authPayload.user };
+    }
+
+    if (authData.authPayload instanceof ServiceTokenData) {
+        return { user: authData.authPayload.user };
     }
-  }));
 }
 
 export {
-  getAuthDataPayloadIdObj,
-  getAuthDataPayloadUserObj,
-  initializePassport,
-}
+    getAuthDataPayloadIdObj,
+    getAuthDataPayloadUserObj
+}

backend/src/utils/crypto.ts

@@ -0,0 +1,139 @@
+import nacl from 'tweetnacl';
+import util from 'tweetnacl-util';
+import AesGCM from './aes-gcm';
+
+/**
+ * Return new base64, NaCl, public-private key pair.
+ * @returns {Object} obj
+ * @returns {String} obj.publicKey - base64, NaCl, public key
+ * @returns {String} obj.privateKey - base64, NaCl, private key
+ */
+const generateKeyPair = () => {
+	const pair = nacl.box.keyPair();
+	
+	return ({
+		publicKey: util.encodeBase64(pair.publicKey),
+		privateKey: util.encodeBase64(pair.secretKey)
+	});
+}
+
+/**
+ * Return assymmetrically encrypted [plaintext] using [publicKey] where
+ * [publicKey] likely belongs to the recipient.
+ * @param {Object} obj
+ * @param {String} obj.plaintext - plaintext to encrypt
+ * @param {String} obj.publicKey - public key of the recipient
+ * @param {String} obj.privateKey - private key of the sender (current user)
+ * @returns {Object} obj
+ * @returns {String} ciphertext - base64-encoded ciphertext
+ * @returns {String} nonce - base64-encoded nonce
+ */
+const encryptAsymmetric = ({
+	plaintext,
+	publicKey,
+	privateKey
+}: {
+	plaintext: string;
+	publicKey: string;
+	privateKey: string;
+}) => {
+  const nonce = nacl.randomBytes(24);
+  const ciphertext = nacl.box(
+    util.decodeUTF8(plaintext),
+    nonce,
+    util.decodeBase64(publicKey),
+    util.decodeBase64(privateKey)
+  );
+
+	return {
+		ciphertext: util.encodeBase64(ciphertext),
+		nonce: util.encodeBase64(nonce)
+	};
+};
+
+/**
+ * Return assymmetrically decrypted [ciphertext] using [privateKey] where
+ * [privateKey] likely belongs to the recipient.
+ * @param {Object} obj
+ * @param {String} obj.ciphertext - ciphertext to decrypt
+ * @param {String} obj.nonce - nonce
+ * @param {String} obj.publicKey - public key of the sender
+ * @param {String} obj.privateKey - private key of the receiver (current user)
+ * @param {String} plaintext - UTF8 plaintext
+ */
+const decryptAsymmetric = ({
+	ciphertext,
+	nonce,
+	publicKey,
+	privateKey
+}: {
+	ciphertext: string;
+	nonce: string;
+	publicKey: string;
+	privateKey: string;
+}): string => {
+  const plaintext: any = nacl.box.open(
+    util.decodeBase64(ciphertext),
+    util.decodeBase64(nonce),
+    util.decodeBase64(publicKey),
+    util.decodeBase64(privateKey)
+  );
+
+	return util.encodeUTF8(plaintext);
+};
+
+/**
+ * Return symmetrically encrypted [plaintext] using [key].
+ * @param {Object} obj
+ * @param {String} obj.plaintext - plaintext to encrypt
+ * @param {String} obj.key - hex key
+ */
+const encryptSymmetric = ({
+	plaintext,
+	key
+}: {
+	plaintext: string;
+	key: string;
+}) => {
+  const obj = AesGCM.encrypt(plaintext, key);
+  const { ciphertext, iv, tag } = obj;
+
+	return {
+		ciphertext,
+		iv,
+		tag
+	};
+};
+
+/**
+ * Return symmetrically decypted [ciphertext] using [iv], [tag],
+ * and [key].
+ * @param {Object} obj
+ * @param {String} obj.ciphertext - ciphertext to decrypt
+ * @param {String} obj.iv - iv
+ * @param {String} obj.tag - tag
+ * @param {String} obj.key - hex key
+ *
+ */
+const decryptSymmetric = ({
+	ciphertext,
+	iv,
+	tag,
+	key
+}: {
+	ciphertext: string;
+	iv: string;
+	tag: string;
+	key: string;
+}): string => {
+  const plaintext = AesGCM.decrypt(ciphertext, iv, tag, key);
+	return plaintext;
+};
+
+export {
+	generateKeyPair,
+	encryptAsymmetric,
+	decryptAsymmetric,
+	encryptSymmetric,
+	decryptSymmetric
+};

backend/src/utils/crypto/index.ts

@@ -1,166 +0,0 @@
-import crypto from 'crypto';
-import nacl from 'tweetnacl';
-import util from 'tweetnacl-util';
-import { 
-    IGenerateKeyPairOutput,
-    IEncryptAsymmetricInput,
-    IEncryptAsymmetricOutput,
-    IDecryptAsymmetricInput,
-    IEncryptSymmetricInput,
-    IDecryptSymmetricInput
-} from '../../interfaces/utils';
-import { BadRequestError } from '../errors';
-import { 
-    ALGORITHM_AES_256_GCM, 
-    NONCE_BYTES_SIZE,
-    BLOCK_SIZE_BYTES_16
-} from '../../variables';
-
-/**
- * Return new base64, NaCl, public-private key pair.
- * @returns {Object} obj
- * @returns {String} obj.publicKey - (base64) NaCl, public key
- * @returns {String} obj.privateKey - (base64), NaCl, private key
- */
-const generateKeyPair = (): IGenerateKeyPairOutput => {
-	const pair = nacl.box.keyPair();
-    
-	return ({
-		publicKey: util.encodeBase64(pair.publicKey),
-		privateKey: util.encodeBase64(pair.secretKey)
-	});
-}
-
-/**
- * Return assymmetrically encrypted [plaintext] using [publicKey] where
- * [publicKey] likely belongs to the recipient.
- * @param {Object} obj
- * @param {String} obj.plaintext - plaintext to encrypt
- * @param {String} obj.publicKey - (base64) Nacl public key of the recipient
- * @param {String} obj.privateKey - (base64) Nacl private key of the sender (current user)
- * @returns {Object} obj
- * @returns {String} obj.ciphertext - (base64) ciphertext
- * @returns {String} obj.nonce - (base64) nonce
- */
-const encryptAsymmetric = ({
-	plaintext,
-	publicKey,
-	privateKey
-}: IEncryptAsymmetricInput): IEncryptAsymmetricOutput => {
-  const nonce = nacl.randomBytes(24);
-  const ciphertext = nacl.box(
-    util.decodeUTF8(plaintext),
-    nonce,
-    util.decodeBase64(publicKey),
-    util.decodeBase64(privateKey)
-  );
-
-	return {
-		ciphertext: util.encodeBase64(ciphertext),
-		nonce: util.encodeBase64(nonce)
-	};
-};
-
-/**
- * Return assymmetrically decrypted [ciphertext] using [privateKey] where
- * [privateKey] likely belongs to the recipient.
- * @param {Object} obj
- * @param {String} obj.ciphertext - ciphertext to decrypt
- * @param {String} obj.nonce - (base64) nonce
- * @param {String} obj.publicKey - (base64) public key of the sender
- * @param {String} obj.privateKey - (base64) private key of the receiver (current user)
- * @returns {String} plaintext - (utf8) plaintext
- */
-const decryptAsymmetric = ({
-	ciphertext,
-	nonce,
-	publicKey,
-	privateKey
-}: IDecryptAsymmetricInput): string => {
-    const plaintext: Uint8Array | null = nacl.box.open(
-        util.decodeBase64(ciphertext),
-        util.decodeBase64(nonce),
-        util.decodeBase64(publicKey),
-        util.decodeBase64(privateKey)
-    );
-  
-    if (plaintext == null) throw BadRequestError({
-        message: 'Invalid ciphertext or keys'
-    });
-  
-    return util.encodeUTF8(plaintext);
-};
-
-/**
- * Return symmetrically encrypted [plaintext] using [key].
- * 
- * NOTE: THIS FUNCTION SHOULD NOT BE USED FOR ALL FUTURE
- * ENCRYPTION OPERATIONS UNLESS IT TOUCHES OLD FUNCTIONALITY
- * THAT USES IT. USE encryptSymmetric() instead
- * 
- * @param {Object} obj
- * @param {String} obj.plaintext - (utf8) plaintext to encrypt
- * @param {String} obj.key - (hex) 128-bit key
- * @returns {Object} obj
- * @returns {String} obj.ciphertext (base64) ciphertext
- * @returns {String} obj.iv (base64) iv
- * @returns {String} obj.tag (base64) tag
- */
-const encryptSymmetric128BitHexKeyUTF8 = ({
-    plaintext,
-    key
-}: IEncryptSymmetricInput) => {
-    const iv = crypto.randomBytes(BLOCK_SIZE_BYTES_16);
-    const cipher = crypto.createCipheriv(ALGORITHM_AES_256_GCM, key, iv);
-
-    let ciphertext = cipher.update(plaintext, 'utf8', 'base64');
-    ciphertext += cipher.final('base64');
-
-    return {
-        ciphertext,
-        iv: iv.toString('base64'),
-        tag: cipher.getAuthTag().toString('base64')
-    };
-}
-/**
- * Return symmetrically decrypted [ciphertext] using [iv], [tag],
- * and [key].
- * 
- * NOTE: THIS FUNCTION SHOULD NOT BE USED FOR ALL FUTURE
- * DECRYPTION OPERATIONS UNLESS IT TOUCHES OLD FUNCTIONALITY
- * THAT USES IT. USE decryptSymmetric() instead
- * 
- * @param {Object} obj
- * @param {String} obj.ciphertext - ciphertext to decrypt
- * @param {String} obj.iv - (base64) 256-bit iv
- * @param {String} obj.tag - (base64) tag
- * @param {String} obj.key - (hex) 128-bit key
- * @returns {String} cleartext - the deciphered ciphertext
- */
-const decryptSymmetric128BitHexKeyUTF8 = ({
-    ciphertext,
-    iv,
-    tag,
-    key
-}: IDecryptSymmetricInput) => {
-    const decipher = crypto.createDecipheriv(
-        ALGORITHM_AES_256_GCM,
-        key,
-        Buffer.from(iv, 'base64')
-    );
-
-    decipher.setAuthTag(Buffer.from(tag, 'base64'));
-
-    let cleartext = decipher.update(ciphertext, 'base64', 'utf8');
-    cleartext += decipher.final('utf8');
-    
-    return cleartext;
-}
-
-export {
-	generateKeyPair,
-	encryptAsymmetric,
-	decryptAsymmetric,
-    encryptSymmetric128BitHexKeyUTF8,
-    decryptSymmetric128BitHexKeyUTF8
-};

backend/src/utils/patchAsyncRoutes.js

@@ -0,0 +1,69 @@
+/*
+Original work Copyright (c) 2016, Nikolay Nemshilov <nemshilov@gmail.com>
+Modified work Copyright (c) 2016, David Banham <david@banham.id.au>
+
+Permission to use, copy, modify, and/or distribute this software for any purpose
+with or without fee is hereby granted, provided that the above copyright notice
+and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
+THIS SOFTWARE.
+
+*/
+
+/* eslint-disable @typescript-eslint/no-var-requires */
+/* eslint-env node */
+const Layer = require('express/lib/router/layer');
+const Router = require('express/lib/router');
+
+const last = (arr = []) => arr[arr.length - 1];
+const noop = Function.prototype;
+
+function copyFnProps(oldFn, newFn) {
+  Object.keys(oldFn).forEach((key) => {
+    newFn[key] = oldFn[key];
+  });
+  return newFn;
+}
+
+function wrap(fn) {
+  const newFn = function newFn(...args) {
+    const ret = fn.apply(this, args);
+    const next = (args.length === 5 ? args[2] : last(args)) || noop;
+    if (ret && ret.catch) ret.catch(err => next(err));
+    return ret;
+  };
+  Object.defineProperty(newFn, 'length', {
+    value: fn.length,
+    writable: false,
+  });
+  return copyFnProps(fn, newFn);
+}
+
+function patchRouterParam() {
+  const originalParam = Router.prototype.constructor.param;
+  Router.prototype.constructor.param = function param(name, fn) {
+    fn = wrap(fn);
+    return originalParam.call(this, name, fn);
+  };
+}
+
+Object.defineProperty(Layer.prototype, 'handle', {
+  enumerable: true,
+  get() {
+    return this.__handle;
+  },
+  set(fn) {
+    fn = wrap(fn);
+    this.__handle = fn;
+  },
+});
+
+module.exports = {
+  patchRouterParam
+};

backend/src/utils/setup/backfillData.ts

@@ -1,324 +0,0 @@
-import crypto from 'crypto';
-import { encryptSymmetric128BitHexKeyUTF8 } from '../crypto';
-import { EESecretService } from '../../ee/services';
-import { SecretVersion } from '../../ee/models';
-import {
-    Secret,
-    ISecret,
-    SecretBlindIndexData,
-    Workspace,
-    Bot,
-    BackupPrivateKey,
-    IntegrationAuth,
-} from '../../models';
-import {
-    generateKeyPair
-} from '../../utils/crypto';
-import { 
-    client,
-    getEncryptionKey, 
-    getRootEncryptionKey 
-} from '../../config';
-import { 
-    ALGORITHM_AES_256_GCM,
-    ENCODING_SCHEME_UTF8,
-    ENCODING_SCHEME_BASE64
-} from '../../variables';
-import { InternalServerError } from '../errors';
-
-/**
- * Backfill secrets to ensure that they're all versioned and have
- * corresponding secret versions
- */
-export const backfillSecretVersions = async () => {
-    await Secret.updateMany(
-        { version: { $exists: false } },
-        { $set: { version: 1 } }
-    );
-    
-    const unversionedSecrets: ISecret[] = await Secret.aggregate([
-        {
-            $lookup: {
-                from: "secretversions",
-                localField: "_id",
-                foreignField: "secret",
-                as: "versions",
-            },
-        },
-        {
-            $match: {
-                versions: { $size: 0 },
-            },
-        },
-    ]);
-
-    if (unversionedSecrets.length > 0) {
-        await EESecretService.addSecretVersions({
-            secretVersions: unversionedSecrets.map(
-            (s, idx) =>
-                new SecretVersion({
-                    ...s,
-                    secret: s._id,
-                    version: s.version ? s.version : 1,
-                    isDeleted: false,
-                    workspace: s.workspace,
-                    environment: s.environment,
-                    algorithm: ALGORITHM_AES_256_GCM,
-                    keyEncoding: ENCODING_SCHEME_UTF8
-                })
-            ),
-        });
-    }
-}
-
-/**
- * Backfill workspace bots to ensure that every workspace has a bot
- */
-export const backfillBots = async () => {
-    const encryptionKey = await getEncryptionKey();
-    const rootEncryptionKey = await getRootEncryptionKey();
-
-    const workspaceIdsWithBot = await Bot.distinct('workspace');
-    const workspaceIdsToAddBot = await Workspace.distinct('_id', {
-        _id: {
-            $nin: workspaceIdsWithBot
-        }
-    });
-
-    if (workspaceIdsToAddBot.length === 0) return;
-
-    const botsToInsert = await Promise.all(
-        workspaceIdsToAddBot.map(async (workspaceToAddBot) => {
-            const { publicKey, privateKey } = generateKeyPair();
-            
-            if (rootEncryptionKey) {
-                const {
-                    ciphertext: encryptedPrivateKey,
-                    iv,
-                    tag
-                } = client.encryptSymmetric(privateKey, rootEncryptionKey);
-
-                return new Bot({
-                    name: 'Infisical Bot',
-                    workspace: workspaceToAddBot,
-                    isActive: false,
-                    publicKey,
-                    encryptedPrivateKey,
-                    iv,
-                    tag,
-                    algorithm: ALGORITHM_AES_256_GCM,
-                    keyEncoding: ENCODING_SCHEME_BASE64
-                });
-            } else if (encryptionKey) {
-                const {
-                    ciphertext: encryptedPrivateKey,
-                    iv,
-                    tag
-                } = encryptSymmetric128BitHexKeyUTF8({
-                    plaintext: privateKey,
-                    key: encryptionKey
-                });
-
-                return new Bot({
-                    name: 'Infisical Bot',
-                    workspace: workspaceToAddBot,
-                    isActive: false,
-                    publicKey,
-                    encryptedPrivateKey,
-                    iv,
-                    tag,
-                    algorithm: ALGORITHM_AES_256_GCM,
-                    keyEncoding: ENCODING_SCHEME_UTF8
-                });
-            }
-
-            throw InternalServerError({
-                message: 'Failed to backfill workspace bots due to missing encryption key'
-            });
-        })
-    );
-    
-    await Bot.insertMany(botsToInsert);
-}
-
-/**
- * Backfill secret blind index data to ensure that every workspace
- * has a secret blind index data
- */
-export const backfillSecretBlindIndexData = async () => {
-
-    const encryptionKey = await getEncryptionKey();
-    const rootEncryptionKey = await getRootEncryptionKey();
-    
-    const workspaceIdsBlindIndexed = await SecretBlindIndexData.distinct('workspace');
-    const workspaceIdsToBlindIndex = await Workspace.distinct('_id', {
-        _id: {
-            $nin: workspaceIdsBlindIndexed
-        }
-    });
-
-    if (workspaceIdsToBlindIndex.length === 0) return;
-    
-    const secretBlindIndexDataToInsert = await Promise.all(
-        workspaceIdsToBlindIndex.map(async (workspaceToBlindIndex) => {
-            const salt = crypto.randomBytes(16).toString('base64');
-            
-            if (rootEncryptionKey) {
-                const { 
-                    ciphertext: encryptedSaltCiphertext,
-                    iv: saltIV,
-                    tag: saltTag
-                } = client.encryptSymmetric(salt, rootEncryptionKey)
-
-                return new SecretBlindIndexData({
-                    workspace: workspaceToBlindIndex,
-                    encryptedSaltCiphertext,
-                    saltIV,
-                    saltTag,
-                    algorithm: ALGORITHM_AES_256_GCM,
-                    keyEncoding: ENCODING_SCHEME_BASE64
-                });
-            } else if (encryptionKey) {
-                const { 
-                    ciphertext: encryptedSaltCiphertext,
-                    iv: saltIV,
-                    tag: saltTag
-                } = encryptSymmetric128BitHexKeyUTF8({
-                    plaintext: salt,
-                    key: encryptionKey
-                });
-
-                return new SecretBlindIndexData({
-                    workspace: workspaceToBlindIndex,
-                    encryptedSaltCiphertext,
-                    saltIV,
-                    saltTag,
-                    algorithm: ALGORITHM_AES_256_GCM,
-                    keyEncoding: ENCODING_SCHEME_UTF8
-                });
-            }
-            
-            throw InternalServerError({
-                message: 'Failed to backfill secret blind index data due to missing encryption key'
-            });
-        })
-    );
-    
-    SecretBlindIndexData.insertMany(secretBlindIndexDataToInsert);
-}
-
-/**
- * Backfill Secret, SecretVersion, SecretBlindIndexData, Bot,
- * BackupPrivateKey, IntegrationAuth collections to ensure that
- * they all have encryption metadata documented
- */
-export const backfillEncryptionMetadata = async () => {
-
-    // backfill secret encryption metadata
-    await Secret.updateMany(
-        {
-            algorithm: {
-                $exists: false
-            },
-            keyEncoding: {
-                $exists: false
-            }
-        },
-        {
-            $set: {
-                algorithm: ALGORITHM_AES_256_GCM,
-                keyEncoding: ENCODING_SCHEME_UTF8
-            }
-        }
-    );
-
-    // backfill secret version encryption metadata
-    await SecretVersion.updateMany(
-        {
-            algorithm: {
-                $exists: false
-            },
-            keyEncoding: {
-                $exists: false
-            }
-        },
-        {
-            $set: {
-                algorithm: ALGORITHM_AES_256_GCM,
-                keyEncoding: ENCODING_SCHEME_UTF8
-            }
-        }
-    );
-
-    // backfill secret blind index encryption metadata
-    await SecretBlindIndexData.updateMany(
-        {
-            algorithm: {
-                $exists: false
-            },
-            keyEncoding: {
-                $exists: false
-            }
-        },
-        {
-            $set: {
-                algorithm: ALGORITHM_AES_256_GCM,
-                keyEncoding: ENCODING_SCHEME_UTF8
-            }
-        }
-    );
-
-    // backfill bot encryption metadata
-    await Bot.updateMany(
-        {
-            algorithm: {
-                $exists: false
-            },
-            keyEncoding: {
-                $exists: false
-            }
-        },
-        {
-            $set: {
-                algorithm: ALGORITHM_AES_256_GCM,
-                keyEncoding: ENCODING_SCHEME_UTF8
-            }
-        }
-    );
-
-    // backfill backup private key encryption metadata
-    await BackupPrivateKey.updateMany(
-        {
-            algorithm: {
-                $exists: false
-            },
-            keyEncoding: {
-                $exists: false
-            }
-        },
-        {
-            $set: {
-                algorithm: ALGORITHM_AES_256_GCM,
-                keyEncoding: ENCODING_SCHEME_UTF8
-            }
-        }
-    );
-
-    // backfill integration auth encryption metadata
-    await IntegrationAuth.updateMany(
-        {
-            algorithm: {
-                $exists: false
-            },
-            keyEncoding: {
-                $exists: false
-            }
-        },
-        {
-            $set: {
-                algorithm: ALGORITHM_AES_256_GCM,
-                keyEncoding: ENCODING_SCHEME_UTF8
-            }
-        }
-    );
-}

backend/src/utils/setup/index.ts

@@ -1,85 +0,0 @@
-import * as Sentry from '@sentry/node';
-import { DatabaseService, TelemetryService } from '../../services';
-import { setTransporter } from '../../helpers/nodemailer';
-import { EELicenseService } from '../../ee/services';
-import { initSmtp } from '../../services/smtp';
-import { createTestUserForDevelopment } from '../addDevelopmentUser'
-import {
-    validateEncryptionKeysConfig
-} from './validateConfig';
-import {
-    backfillSecretVersions,
-    backfillBots,
-    backfillSecretBlindIndexData,
-    backfillEncryptionMetadata
-} from './backfillData';
-import {
-    reencryptBotPrivateKeys,
-    reencryptSecretBlindIndexDataSalts
-} from './reencryptData';
-import {
-    getNodeEnv,
-    getMongoURL,
-    getSentryDSN,
-    getClientSecretGoogle,
-    getClientIdGoogle
-} from '../../config';
-import { initializePassport } from '../auth';
-
-/**
- * Prepare Infisical upon startup. This includes tasks like:
- * - Log initial telemetry message
- * - Initializing SMTP configuration
- * - Initializing the instance global feature set (if applicable)
- * - Initializing the database connection
- * - Initializing Sentry
- * - Backfilling data
- * - Re-encrypting data
- */
-export const setup = async () => {
-    await validateEncryptionKeysConfig();
-    await TelemetryService.logTelemetryMessage();
-
-    // initializing SMTP configuration
-    setTransporter(await initSmtp());
-
-    // initializing global feature set
-    await EELicenseService.initGlobalFeatureSet();
-
-    // initializing the database connection
-    await DatabaseService.initDatabase(await getMongoURL());
-
-    const googleClientSecret: string = await getClientSecretGoogle();
-    const googleClientId: string = await getClientIdGoogle();
-
-    if (googleClientId && googleClientSecret) {
-        await initializePassport();
-    }
-
-    /**
-     * NOTE: the order in this setup function is critical.
-     * It is important to backfill data before performing any re-encryption functionality.
-     */
-
-    // backfilling data to catch up with new collections and updated fields
-    await backfillSecretVersions();
-    await backfillBots();
-    await backfillSecretBlindIndexData();
-    await backfillEncryptionMetadata();
-
-    // re-encrypt any data previously encrypted under server hex 128-bit ENCRYPTION_KEY
-    // to base64 256-bit ROOT_ENCRYPTION_KEY
-    // await reencryptBotPrivateKeys();
-    // await reencryptSecretBlindIndexDataSalts();
-
-    // initializing Sentry
-    Sentry.init({
-        dsn: await getSentryDSN(),
-        tracesSampleRate: 1.0,
-        debug: (await getNodeEnv()) === 'production' ? false : true,
-        environment: (await getNodeEnv())
-    });
-
-    await createTestUserForDevelopment();
-}
-