fix: frontend/package.json & frontend/package-lock.json to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-YAML-5458867

.env.example

@@ -31,12 +31,12 @@ MONGO_PASSWORD=example
 SITE_URL=http://localhost:8080
 
 # Mail/SMTP
-SMTP_HOST= # required
-SMTP_USERNAME= # required
-SMTP_PASSWORD= # required
+SMTP_HOST= 
+SMTP_USERNAME= 
+SMTP_PASSWORD= 
 SMTP_PORT=587
 SMTP_SECURE=false
-SMTP_FROM_ADDRESS= # required
+SMTP_FROM_ADDRESS= 
 SMTP_FROM_NAME=Infisical
 
 # Integration
@@ -66,4 +66,4 @@ STRIPE_WEBHOOK_SECRET=
 STRIPE_PRODUCT_STARTER=
 STRIPE_PRODUCT_TEAM=
 STRIPE_PRODUCT_PRO=
-NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=
+NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=

.github/workflows/docker-image.yml

@@ -9,6 +9,12 @@ jobs:
     steps:
       - name: ☁️ Checkout source
         uses: actions/checkout@v3
+      - name: 📦 Install dependencies to test all dependencies
+        run: npm ci --only-production
+        working-directory: backend
+      - name: 🧪 Run tests
+        run: npm run test:ci
+        working-directory: backend
       - name: Save commit hashes for tag
         id: commit
         uses: pr-mpt/actions-commit-hash@v2
@@ -45,8 +51,8 @@ jobs:
           token: ${{ secrets.DEPOT_PROJECT_TOKEN }}
           push: true
           context: backend
-          tags: infisical/backend:${{ steps.commit.outputs.short }}, 
-                infisical/backend:latest
+          tags: infisical/backend:${{ steps.commit.outputs.short }},
+            infisical/backend:latest
           platforms: linux/amd64,linux/arm64
 
   frontend-image:
@@ -94,8 +100,8 @@ jobs:
           push: true
           token: ${{ secrets.DEPOT_PROJECT_TOKEN }}
           context: frontend
-          tags: infisical/frontend:${{ steps.commit.outputs.short }}, 
-                infisical/frontend:latest
+          tags: infisical/frontend:${{ steps.commit.outputs.short }},
+            infisical/frontend:latest
           platforms: linux/amd64,linux/arm64
           build-args: |
             POSTHOG_API_KEY=${{ secrets.PUBLIC_POSTHOG_API_KEY }}
@@ -122,7 +128,7 @@ jobs:
           token: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}
       - name: Save DigitalOcean kubeconfig with short-lived credentials
         run: doctl kubernetes cluster kubeconfig save --expiry-seconds 600 k8s-1-25-4-do-0-nyc1-1670645170179
-      - name: switch to gamma namespace 
+      - name: switch to gamma namespace
         run: kubectl config set-context --current --namespace=gamma
       - name: test kubectl
         run: kubectl get ingress
@@ -135,4 +141,4 @@ jobs:
             exit 1
           else
             echo "Helm upgrade was successful"
-          fi
+          fi

backend/package.json

@@ -1,14 +1,16 @@
 {
   "dependencies": {
-    "@aws-sdk/client-secrets-manager": "^3.294.0",
+    "@aws-sdk/client-secrets-manager": "^3.303.0",
     "@godaddy/terminus": "^4.11.2",
     "@octokit/rest": "^19.0.5",
-    "@sentry/tracing": "^7.39.0",
-    "@sentry/node": "^7.40.0",
+    "@sentry/node": "^7.45.0",
+    "@sentry/tracing": "^7.46.0",
+    "@sentry/node": "^7.41.0",
     "@types/crypto-js": "^4.1.1",
     "@types/libsodium-wrappers": "^0.7.10",
+    "argon2": "^0.30.3",
     "await-to-js": "^3.0.0",
-    "aws-sdk": "^2.1331.0",
+    "aws-sdk": "^2.1338.0",
     "axios": "^1.1.3",
     "axios-retry": "^3.4.0",
     "bcrypt": "^5.1.0",
@@ -29,9 +31,9 @@
     "jsrp": "^0.2.4",
     "libsodium-wrappers": "^0.7.10",
     "lodash": "^4.17.21",
-    "mongoose": "^6.10.3",
+    "mongoose": "^6.10.4",
     "nodemailer": "^6.8.0",
-    "posthog-node": "^2.5.4",
+    "posthog-node": "^2.6.0",
     "query-string": "^7.1.3",
     "request-ip": "^3.3.0",
     "rimraf": "^3.0.2",
@@ -57,7 +59,7 @@
     "lint-and-fix": "eslint . --ext .ts --fix",
     "lint-staged": "lint-staged",
     "pretest": "docker compose -f test-resources/docker-compose.test.yml up -d",
-    "test": "cross-env NODE_ENV=test jest --verbose --testTimeout=10000 --detectOpenHandles",
+    "test": "cross-env NODE_ENV=test jest --verbose --testTimeout=10000 --detectOpenHandles; npm run posttest",
     "test:ci": "npm test -- --watchAll=false --ci --reporters=default --reporters=jest-junit --reporters=github-actions --coverage --testLocationInResults --json --outputFile=coverage/report.json",
     "posttest": "docker compose -f test-resources/docker-compose.test.yml down"
   },
@@ -80,7 +82,7 @@
     "@types/cookie-parser": "^1.4.3",
     "@types/cors": "^2.8.12",
     "@types/express": "^4.17.14",
-    "@types/jest": "^29.2.4",
+    "@types/jest": "^29.5.0",
     "@types/jsonwebtoken": "^8.5.9",
     "@types/lodash": "^4.14.191",
     "@types/node": "^18.11.3",

backend/spec.json

@@ -1532,7 +1532,15 @@
     "/api/v1/invite-org/signup": {
       "post": {
         "description": "",
-        "parameters": [],
+        "parameters": [
+          {
+            "name": "host",
+            "in": "header",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
           "200": {
             "description": "OK"
@@ -2071,6 +2079,15 @@
                   "targetEnvironment": {
                     "example": "any"
                   },
+                  "targetEnvironmentId": {
+                    "example": "any"
+                  },
+                  "targetService": {
+                    "example": "any"
+                  },
+                  "targetServiceId": {
+                    "example": "any"
+                  },
                   "owner": {
                     "example": "any"
                   },
@@ -2297,6 +2314,13 @@
             "schema": {
               "type": "string"
             }
+          },
+          {
+            "name": "teamId",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -2309,6 +2333,107 @@
         }
       }
     },
+    "/api/v1/integration-auth/{integrationAuthId}/teams": {
+      "get": {
+        "description": "",
+        "parameters": [
+          {
+            "name": "integrationAuthId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
+        }
+      }
+    },
+    "/api/v1/integration-auth/{integrationAuthId}/vercel/branches": {
+      "get": {
+        "description": "",
+        "parameters": [
+          {
+            "name": "integrationAuthId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "appId",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
+        }
+      }
+    },
+    "/api/v1/integration-auth/{integrationAuthId}/railway/environments": {
+      "get": {
+        "description": "",
+        "parameters": [
+          {
+            "name": "integrationAuthId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "appId",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
+        }
+      }
+    },
+    "/api/v1/integration-auth/{integrationAuthId}/railway/services": {
+      "get": {
+        "description": "",
+        "parameters": [
+          {
+            "name": "integrationAuthId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "appId",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
+        }
+      }
+    },
     "/api/v2/signup/complete-account/signup": {
       "post": {
         "description": "",
@@ -2870,9 +2995,6 @@
                 }
               }
             }
-          },
-          "400": {
-            "description": "Bad Request"
           }
         },
         "security": [
@@ -2882,6 +3004,26 @@
         ]
       }
     },
+    "/api/v2/organizations/{organizationId}/service-accounts": {
+      "get": {
+        "description": "",
+        "parameters": [
+          {
+            "name": "organizationId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
+        }
+      }
+    },
     "/api/v2/workspace/{workspaceId}/environments": {
       "post": {
         "description": "",
@@ -4018,9 +4160,6 @@
         "responses": {
           "200": {
             "description": "OK"
-          },
-          "400": {
-            "description": "Bad Request"
           }
         },
         "requestBody": {
@@ -4073,6 +4212,138 @@
             }
           }
         ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
+        }
+      }
+    },
+    "/api/v2/service-accounts/me": {
+      "get": {
+        "description": "",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
+        }
+      }
+    },
+    "/api/v2/service-accounts/{serviceAccountId}": {
+      "get": {
+        "description": "",
+        "parameters": [
+          {
+            "name": "serviceAccountId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
+        }
+      },
+      "delete": {
+        "description": "",
+        "parameters": [
+          {
+            "name": "serviceAccountId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
+        }
+      }
+    },
+    "/api/v2/service-accounts/": {
+      "post": {
+        "description": "",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
+        }
+      }
+    },
+    "/api/v2/service-accounts/{serviceAccountId}/name": {
+      "patch": {
+        "description": "",
+        "parameters": [
+          {
+            "name": "serviceAccountId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
+        },
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "example": "any"
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/api/v2/service-accounts/{serviceAccountId}/permissions/workspace": {
+      "get": {
+        "description": "",
+        "parameters": [
+          {
+            "name": "serviceAccountId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
+        }
+      },
+      "post": {
+        "description": "",
+        "parameters": [
+          {
+            "name": "serviceAccountId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
           "200": {
             "description": "OK"
@@ -4080,6 +4351,90 @@
           "400": {
             "description": "Bad Request"
           }
+        },
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "environment": {
+                    "example": "any"
+                  },
+                  "workspaceId": {
+                    "example": "any"
+                  },
+                  "read": {
+                    "example": "any"
+                  },
+                  "write": {
+                    "example": "any"
+                  },
+                  "encryptedKey": {
+                    "example": "any"
+                  },
+                  "nonce": {
+                    "example": "any"
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/api/v2/service-accounts/{serviceAccountId}/permissions/workspace/{serviceAccountWorkspacePermissionId}": {
+      "delete": {
+        "description": "",
+        "parameters": [
+          {
+            "name": "serviceAccountId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "serviceAccountWorkspacePermissionId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
+        }
+      }
+    },
+    "/api/v2/service-accounts/{serviceAccountId}/keys": {
+      "get": {
+        "description": "",
+        "parameters": [
+          {
+            "name": "serviceAccountId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "workspaceId",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
         }
       }
     },
@@ -4149,6 +4504,297 @@
         }
       }
     },
+    "/api/v3/secrets/": {
+      "get": {
+        "description": "",
+        "parameters": [
+          {
+            "name": "workspaceId",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "environment",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
+        }
+      }
+    },
+    "/api/v3/secrets/{secretName}": {
+      "post": {
+        "description": "",
+        "parameters": [
+          {
+            "name": "secretName",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
+        },
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "workspaceId": {
+                    "example": "any"
+                  },
+                  "environment": {
+                    "example": "any"
+                  },
+                  "type": {
+                    "example": "any"
+                  },
+                  "secretKeyCiphertext": {
+                    "example": "any"
+                  },
+                  "secretKeyIV": {
+                    "example": "any"
+                  },
+                  "secretKeyTag": {
+                    "example": "any"
+                  },
+                  "secretValueCiphertext": {
+                    "example": "any"
+                  },
+                  "secretValueIV": {
+                    "example": "any"
+                  },
+                  "secretValueTag": {
+                    "example": "any"
+                  },
+                  "secretCommentCiphertext": {
+                    "example": "any"
+                  },
+                  "secretCommentIV": {
+                    "example": "any"
+                  },
+                  "secretCommentTag": {
+                    "example": "any"
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      "get": {
+        "description": "",
+        "parameters": [
+          {
+            "name": "secretName",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "workspaceId",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "environment",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "type",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
+        }
+      },
+      "patch": {
+        "description": "",
+        "parameters": [
+          {
+            "name": "secretName",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
+        },
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "workspaceId": {
+                    "example": "any"
+                  },
+                  "environment": {
+                    "example": "any"
+                  },
+                  "type": {
+                    "example": "any"
+                  },
+                  "secretValueCiphertext": {
+                    "example": "any"
+                  },
+                  "secretValueIV": {
+                    "example": "any"
+                  },
+                  "secretValueTag": {
+                    "example": "any"
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      "delete": {
+        "description": "",
+        "parameters": [
+          {
+            "name": "secretName",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
+        },
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "workspaceId": {
+                    "example": "any"
+                  },
+                  "environment": {
+                    "example": "any"
+                  },
+                  "type": {
+                    "example": "any"
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/api/v3/workspaces/{workspaceId}/secrets/blind-index-status": {
+      "get": {
+        "description": "",
+        "parameters": [
+          {
+            "name": "workspaceId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
+        }
+      }
+    },
+    "/api/v3/workspaces/{workspaceId}/secrets": {
+      "get": {
+        "description": "",
+        "parameters": [
+          {
+            "name": "workspaceId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
+        }
+      }
+    },
+    "/api/v3/workspaces/{workspaceId}/secrets/names": {
+      "post": {
+        "description": "",
+        "parameters": [
+          {
+            "name": "workspaceId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
+        },
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "secretsToUpdate": {
+                    "example": "any"
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/api/status": {
       "get": {
         "description": "",

backend/src/config/index.ts

@@ -13,7 +13,7 @@ export const getJwtServiceSecret = () => infisical.get('JWT_SERVICE_SECRET')!;
 export const getJwtSignupLifetime = () => infisical.get('JWT_SIGNUP_LIFETIME')! || '15m';
 export const getJwtSignupSecret = () => infisical.get('JWT_SIGNUP_SECRET')!;
 export const getMongoURL = () => infisical.get('MONGO_URL')!;
-export const getNodeEnv = () => infisical.get('NODE_ENV')!;
+export const getNodeEnv = () => infisical.get('NODE_ENV')! || 'production';
 export const getVerboseErrorOutput = () => infisical.get('VERBOSE_ERROR_OUTPUT')! === 'true' && true;
 export const getLokiHost = () => infisical.get('LOKI_HOST')!;
 export const getClientIdAzure = () => infisical.get('CLIENT_ID_AZURE')!;
@@ -48,4 +48,17 @@ export const getStripeSecretKey = () => infisical.get('STRIPE_SECRET_KEY')!;
 export const getStripeWebhookSecret = () => infisical.get('STRIPE_WEBHOOK_SECRET')!;
 export const getTelemetryEnabled = () => infisical.get('TELEMETRY_ENABLED')! !== 'false' && true;
 export const getLoopsApiKey = () => infisical.get('LOOPS_API_KEY')!;
-export const getSmtpConfigured = () => infisical.get('SMTP_HOST') == '' || infisical.get('SMTP_HOST') == undefined ? false : true
+export const getSmtpConfigured = () => infisical.get('SMTP_HOST') == '' || infisical.get('SMTP_HOST') == undefined ? false : true
+export const getHttpsEnabled = () => {
+  if (getNodeEnv() != "production") {
+    // no https for anything other than prod
+    return false
+  }
+
+  if (infisical.get('HTTPS_ENABLED') == undefined || infisical.get('HTTPS_ENABLED') == "") {
+    // default when no value present
+    return true
+  }
+
+  return infisical.get('HTTPS_ENABLED') === 'true' && true
+}

backend/src/controllers/v1/authController.ts

@@ -15,10 +15,10 @@ import { BadRequestError } from '../../utils/errors';
 import { EELogService } from '../../ee/services';
 import { getChannelFromUserAgent } from '../../utils/posthog'; // TODO: move this
 import {
-  getNodeEnv,
   getJwtRefreshSecret,
   getJwtAuthLifetime,
-  getJwtAuthSecret
+  getJwtAuthSecret,
+  getHttpsEnabled
 } from '../../config';
 
 declare module 'jsonwebtoken' {
@@ -126,21 +126,21 @@ export const login2 = async (req: Request, res: Response) => {
             httpOnly: true,
             path: '/',
             sameSite: 'strict',
-            secure: getNodeEnv() === 'production' ? true : false
+            secure: getHttpsEnabled()
           });
 
           const loginAction = await EELogService.createAction({
             name: ACTION_LOGIN,
             userId: user._id
           });
-          
+
           loginAction && await EELogService.createLog({
             userId: user._id,
             actions: [loginAction],
             channel: getChannelFromUserAgent(req.headers['user-agent']),
             ipAddress: req.ip
           });
-          
+
           // return (access) token in response
           return res.status(200).send({
             token: tokens.token,
@@ -182,14 +182,14 @@ export const logout = async (req: Request, res: Response) => {
       httpOnly: true,
       path: '/',
       sameSite: 'strict',
-      secure: getNodeEnv() === 'production' ? true : false
+      secure: getHttpsEnabled() as boolean
     });
 
     const logoutAction = await EELogService.createAction({
       name: ACTION_LOGOUT,
       userId: req.user._id
     });
-    
+
     logoutAction && await EELogService.createLog({
       userId: req.user._id,
       actions: [logoutAction],

backend/src/controllers/v1/botController.ts

@@ -1,4 +1,5 @@
 import { Request, Response } from 'express';
+import { Types } from 'mongoose';
 import * as Sentry from '@sentry/node';
 import { Bot, BotKey } from '../../models';
 import { createBot } from '../../helpers/bot';
@@ -29,7 +30,7 @@ export const getBotByWorkspaceId = async (req: Request, res: Response) => {
             // -> create a new bot and return it
             bot = await createBot({
                 name: 'Infisical Bot',
-                workspaceId
+                workspaceId: new Types.ObjectId(workspaceId)
             });
         }
 	} catch (err) {

backend/src/controllers/v1/integrationAuthController.ts

@@ -13,7 +13,8 @@ import {
 	revokeAccess 
 } from '../../integrations';
 import {
-	INTEGRATION_VERCEL_API_URL
+	INTEGRATION_VERCEL_API_URL,
+	INTEGRATION_RAILWAY_API_URL
 } from '../../variables';
 import request from '../../config/request';
 
@@ -203,7 +204,8 @@ export const getIntegrationAuthTeams = async (req: Request, res: Response) => {
 }
 
 /**
- * Return list of available Vercel (preview) branches
+ * Return list of available Vercel (preview) branches for Vercel project with
+ * id [appId]
  * @param req 
  * @param res 
  */
@@ -246,6 +248,151 @@ export const getIntegrationAuthVercelBranches = async (req: Request, res: Respon
 	});
 }
 
+/**
+ * Return list of Railway environments for Railway project with
+ * id [appId]
+ * @param req 
+ * @param res 
+ */
+export const getIntegrationAuthRailwayEnvironments = async (req: Request, res: Response) => {
+	const { integrationAuthId } = req.params;
+	const appId = req.query.appId as string;
+	
+	interface RailwayEnvironment {
+		node: {
+			id: string;
+			name: string;
+			isEphemeral: boolean;
+		}
+	}
+	
+	interface Environment {
+		environmentId: string;
+		name: string;
+	}
+	
+	let environments: Environment[] = [];
+
+	if (appId && appId !== '') {
+		const query = `
+			query GetEnvironments($projectId: String!, $after: String, $before: String, $first: Int, $isEphemeral: Boolean, $last: Int) {
+				environments(projectId: $projectId, after: $after, before: $before, first: $first, isEphemeral: $isEphemeral, last: $last) {
+				edges {
+					node {
+					id
+					name
+					isEphemeral
+					}
+				}
+				}
+			}
+			`;
+		
+		const variables = {
+			projectId: appId
+		}
+		
+		const { data: { data: { environments: { edges } } } } = await request.post(INTEGRATION_RAILWAY_API_URL, {
+			query,
+			variables,
+		}, {
+			headers: {
+				'Authorization': `Bearer ${req.accessToken}`,
+				'Content-Type': 'application/json',
+			},
+		});
+		
+		environments = edges.map((e: RailwayEnvironment) => {
+			return ({
+				name: e.node.name,
+				environmentId: e.node.id
+			});
+		});
+	}
+	
+	return res.status(200).send({
+		environments
+	});
+}
+
+/**
+ * Return list of Railway services for Railway project with id
+ * [appId]
+ * @param req 
+ * @param res 
+ */
+export const getIntegrationAuthRailwayServices = async (req: Request, res: Response) => {
+	const { integrationAuthId } = req.params;
+	const appId = req.query.appId as string;
+	
+	interface RailwayService {
+		node: {
+			id: string;
+			name: string;
+		}
+	}
+	
+	interface Service {
+		name: string;
+		serviceId: string;
+	}
+	
+	let services: Service[] = [];
+	
+	const query = `
+      query project($id: String!) {
+        project(id: $id) {
+          createdAt
+          deletedAt
+          id
+          description
+          expiredAt
+          isPublic
+          isTempProject
+          isUpdatable
+          name
+          prDeploys
+          teamId
+          updatedAt
+          upstreamUrl
+		  services {
+			edges {
+				node {
+					id
+					name
+				}
+			}
+		  }
+        }
+      }
+    `;
+
+	if (appId && appId !== '') {
+		const variables = {
+			id: appId
+		}
+		
+		const { data: { data: { project: { services: { edges } } } } } = await request.post(INTEGRATION_RAILWAY_API_URL, {
+			query,
+			variables
+		}, {
+			headers: {
+				'Authorization': `Bearer ${req.accessToken}`,
+				'Content-Type': 'application/json',
+			},
+		});
+		
+		services = edges.map((e: RailwayService) => ({
+			name: e.node.name,
+			serviceId: e.node.id
+		}));
+	}
+	
+	return res.status(200).send({
+		services
+	});
+}
+
 /**
  * Delete integration authorization with id [integrationAuthId]
  * @param req

backend/src/controllers/v1/integrationController.ts

@@ -24,6 +24,9 @@ export const createIntegration = async (req: Request, res: Response) => {
 			isActive,
 			sourceEnvironment,
 			targetEnvironment,
+			targetEnvironmentId,
+      targetService,
+      targetServiceId,
 			owner,
 			path,
 			region
@@ -39,18 +42,22 @@ export const createIntegration = async (req: Request, res: Response) => {
       app,
 			appId,
 			targetEnvironment,
+			targetEnvironmentId,
+      targetService,
+      targetServiceId,
 			owner,
 			path,
 			region,
       integration: req.integrationAuth.integration,
       integrationAuth: new Types.ObjectId(integrationAuthId)
-      }).save();
+    }).save();
 		
 		if (integration) {
 			// trigger event - push secrets
 			EventService.handleEvent({
 				event: eventPushSecrets({
-					workspaceId: integration.workspace.toString()
+					workspaceId: integration.workspace,
+          environment: sourceEnvironment
 				})
 			});
 		}
@@ -111,7 +118,8 @@ export const updateIntegration = async (req: Request, res: Response) => {
       // trigger event - push secrets
       EventService.handleEvent({
         event: eventPushSecrets({
-          workspaceId: integration.workspace.toString(),
+          workspaceId: integration.workspace,
+          environment
         }),
       });
     }

backend/src/controllers/v1/secretController.ts

@@ -1,5 +1,6 @@
 import { Request, Response } from 'express';
 import * as Sentry from '@sentry/node';
+import { Types } from 'mongoose';
 import { Key, Secret } from '../../models';
 import {
 	v1PushSecrets as push,
@@ -9,7 +10,7 @@ import {
 import { pushKeys } from '../../helpers/key';
 import { eventPushSecrets } from '../../events';
 import { EventService } from '../../services';
-import { getPostHogClient } from '../../services';
+import { TelemetryService } from '../../services';
 
 interface PushSecret {
 	ciphertextKey: string;
@@ -38,7 +39,7 @@ export const pushSecrets = async (req: Request, res: Response) => {
 	// upload (encrypted) secrets to workspace with id [workspaceId]
 
 	try {
-		const postHogClient = getPostHogClient();
+		const postHogClient = TelemetryService.getPostHogClient();
 		let { secrets }: { secrets: PushSecret[] } = req.body;
 		const { keys, environment, channel } = req.body;
 		const { workspaceId } = req.params;
@@ -84,7 +85,8 @@ export const pushSecrets = async (req: Request, res: Response) => {
 		// trigger event - push secrets
 		EventService.handleEvent({
 			event: eventPushSecrets({
-				workspaceId
+				workspaceId: new Types.ObjectId(workspaceId),
+				environment
 			})
 		});
 
@@ -112,7 +114,7 @@ export const pullSecrets = async (req: Request, res: Response) => {
 	let secrets;
 	let key;
 	try {
-		const postHogClient = getPostHogClient();
+		const postHogClient = TelemetryService.getPostHogClient();
 		const environment: string = req.query.environment as string;
 		const channel: string = req.query.channel as string;
 		const { workspaceId } = req.params;
@@ -181,7 +183,7 @@ export const pullSecretsServiceToken = async (req: Request, res: Response) => {
 	let secrets;
 	let key;
 	try {
-		const postHogClient = getPostHogClient();
+		const postHogClient = TelemetryService.getPostHogClient();
 		const environment: string = req.query.environment as string;
 		const channel: string = req.query.channel as string;
 		const { workspaceId } = req.params;

backend/src/controllers/v2/apiKeyDataController.ts

@@ -50,6 +50,7 @@ export const createAPIKeyData = async (req: Request, res: Response) => {
         
         apiKeyData = await new APIKeyData({
             name,
+            lastUsed: new Date(),
             expiresAt,
             user: req.user._id,
             secretHash

backend/src/controllers/v2/authController.ts

@@ -17,9 +17,9 @@ import {
 } from '../../variables';
 import { getChannelFromUserAgent } from '../../utils/posthog'; // TODO: move this
 import {
-  getNodeEnv,
   getJwtMfaLifetime,
-  getJwtMfaSecret
+  getJwtMfaSecret,
+  getHttpsEnabled
 } from '../../config';
 
 declare module 'jsonwebtoken' {
@@ -163,7 +163,7 @@ export const login2 = async (req: Request, res: Response) => {
             httpOnly: true,
             path: '/',
             sameSite: 'strict',
-            secure: getNodeEnv() === 'production' ? true : false
+            secure: getHttpsEnabled()
           });
 
           // case: user does not have MFA enablgged
@@ -302,7 +302,7 @@ export const verifyMfaToken = async (req: Request, res: Response) => {
     httpOnly: true,
     path: '/',
     sameSite: 'strict',
-    secure: getNodeEnv() === 'production' ? true : false
+    secure: getHttpsEnabled()
   });
 
   interface VerifyMfaTokenRes {

backend/src/controllers/v2/environmentController.ts

@@ -11,7 +11,7 @@ import {
 import { SecretVersion } from '../../ee/models';
 import { BadRequestError } from '../../utils/errors';
 import _ from 'lodash';
-import { ABILITY_READ, ABILITY_WRITE } from '../../variables/organization';
+import { PERMISSION_READ_SECRETS, PERMISSION_WRITE_SECRETS } from '../../variables';
 
 /**
  * Create new workspace environment named [environmentName] under workspace with id
@@ -244,8 +244,8 @@ export const getAllAccessibleEnvironmentsOfWorkspace = async (
     throw BadRequestError()
   }
   relatedWorkspace.environments.forEach(environment => {
-    const isReadBlocked = _.some(deniedPermission, { environmentSlug: environment.slug, ability: ABILITY_READ })
-    const isWriteBlocked = _.some(deniedPermission, { environmentSlug: environment.slug, ability: ABILITY_WRITE })
+    const isReadBlocked = _.some(deniedPermission, { environmentSlug: environment.slug, ability: PERMISSION_READ_SECRETS })
+    const isWriteBlocked = _.some(deniedPermission, { environmentSlug: environment.slug, ability: PERMISSION_WRITE_SECRETS })
     if (isReadBlocked && isWriteBlocked) {
       return
     } else {

backend/src/controllers/v2/index.ts

@@ -7,6 +7,7 @@ import * as serviceTokenDataController from './serviceTokenDataController';
 import * as apiKeyDataController from './apiKeyDataController';
 import * as secretController from './secretController';
 import * as secretsController from './secretsController';
+import * as serviceAccountsController from './serviceAccountsController';
 import * as environmentController from './environmentController';
 import * as tagController from './tagController';
 
@@ -20,6 +21,7 @@ export {
     apiKeyDataController,
     secretController,
     secretsController,
+    serviceAccountsController,
     environmentController,
     tagController
 }

backend/src/controllers/v2/organizationsController.ts

@@ -1,9 +1,11 @@
 import { Request, Response } from 'express';
 import * as Sentry from '@sentry/node';
+import { Types } from 'mongoose';
 import { 
     MembershipOrg,
     Membership,
-    Workspace
+    Workspace,
+    ServiceAccount
 } from '../../models';
 import { deleteMembershipOrg } from '../../helpers/membershipOrg';
 import { updateSubscriptionOrgQuantity } from '../../helpers/organization';
@@ -260,37 +262,45 @@ export const getOrganizationWorkspaces = async (req: Request, res: Response) =>
         }
     }   
     */
-    let workspaces;
-    try {
-        const { organizationId } = req.params;
+    const { organizationId } = req.params;
 
-		const workspacesSet = new Set(
-			(
-				await Workspace.find(
-					{
-						organization: organizationId
-					},
-					'_id'
-				)
-			).map((w) => w._id.toString())
-		);
+    const workspacesSet = new Set(
+        (
+            await Workspace.find(
+                {
+                    organization: organizationId
+                },
+                '_id'
+            )
+        ).map((w) => w._id.toString())
+    );
 
-		workspaces = (
-			await Membership.find({
-				user: req.user._id
-			}).populate('workspace')
-		)
-			.filter((m) => workspacesSet.has(m.workspace._id.toString()))
-			.map((m) => m.workspace);
-    } catch (err) {
-        Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get organization workspaces'
-		});	
-    }
-    
-    return res.status(200).send({
+    const workspaces = (
+        await Membership.find({
+            user: req.user._id
+        }).populate('workspace')
+    )
+    .filter((m) => workspacesSet.has(m.workspace._id.toString()))
+    .map((m) => m.workspace);
+
+return res.status(200).send({
         workspaces
     });
+}
+
+/**
+ * Return service accounts for organization with id [organizationId]
+ * @param req 
+ * @param res 
+ */
+export const getOrganizationServiceAccounts = async (req: Request, res: Response) => {
+    const { organizationId } = req.params;
+    
+    const serviceAccounts = await ServiceAccount.find({
+        organization: new Types.ObjectId(organizationId)
+    });
+    
+    return res.status(200).send({
+        serviceAccounts
+    });
 }

backend/src/controllers/v2/secretController.ts

@@ -7,7 +7,9 @@ const { ValidationError } = mongoose.Error;
 import { BadRequestError, InternalServerError, UnauthorizedRequestError, ValidationError as RouteValidationError } from '../../utils/errors';
 import { AnyBulkWriteOperation } from 'mongodb';
 import { SECRET_PERSONAL, SECRET_SHARED } from "../../variables";
-import { getPostHogClient } from '../../services';
+import { TelemetryService } from '../../services';
+import { User } from "../../models";
+import { AccountNotFoundError } from '../../utils/errors';
 
 /**
  * Create secret for workspace with id [workspaceId] and environment [environment]
@@ -15,7 +17,7 @@ import { getPostHogClient } from '../../services';
  * @param res 
  */
 export const createSecret = async (req: Request, res: Response) => {
-  const postHogClient = getPostHogClient();
+  const postHogClient = TelemetryService.getPostHogClient();
   const secretToCreate: CreateSecretRequestBody = req.body.secret;
   const { workspaceId, environment } = req.params
   const sanitizedSecret: SanitizedSecretForCreate = {
@@ -68,7 +70,7 @@ export const createSecret = async (req: Request, res: Response) => {
  * @param res 
  */
 export const createSecrets = async (req: Request, res: Response) => {
-  const postHogClient = getPostHogClient();
+  const postHogClient = TelemetryService.getPostHogClient();
   const secretsToCreate: CreateSecretRequestBody[] = req.body.secrets;
   const { workspaceId, environment } = req.params
   const sanitizedSecretesToCreate: SanitizedSecretForCreate[] = []
@@ -130,7 +132,7 @@ export const createSecrets = async (req: Request, res: Response) => {
  * @param res 
  */
 export const deleteSecrets = async (req: Request, res: Response) => {
-  const postHogClient = getPostHogClient();
+  const postHogClient = TelemetryService.getPostHogClient();
   const { workspaceId, environmentName } = req.params
   const secretIdsToDelete: string[] = req.body.secretIds
 
@@ -184,7 +186,7 @@ export const deleteSecrets = async (req: Request, res: Response) => {
  * @param res
  */
 export const deleteSecret = async (req: Request, res: Response) => {
-  const postHogClient = getPostHogClient();
+  const postHogClient = TelemetryService.getPostHogClient();
   await Secret.findByIdAndDelete(req._secret._id)
 
   if (postHogClient) {
@@ -213,7 +215,7 @@ export const deleteSecret = async (req: Request, res: Response) => {
  * @returns 
  */
 export const updateSecrets = async (req: Request, res: Response) => {
-  const postHogClient = getPostHogClient();
+  const postHogClient = TelemetryService.getPostHogClient();
   const { workspaceId, environmentName } = req.params
   const secretsModificationsRequested: ModifySecretRequestBody[] = req.body.secrets;
   const [secretIdsUserCanModifyError, secretIdsUserCanModify] = await to(Secret.find({ workspace: workspaceId, environment: environmentName }, { _id: 1 }).then())
@@ -281,7 +283,7 @@ export const updateSecrets = async (req: Request, res: Response) => {
  * @returns 
  */
 export const updateSecret = async (req: Request, res: Response) => {
-  const postHogClient = getPostHogClient();
+  const postHogClient = TelemetryService.getPostHogClient();
   const { workspaceId, environmentName } = req.params
   const secretModificationsRequested: ModifySecretRequestBody = req.body.secret;
 
@@ -335,20 +337,23 @@ export const updateSecret = async (req: Request, res: Response) => {
  * @returns 
  */
 export const getSecrets = async (req: Request, res: Response) => {
-  const postHogClient = getPostHogClient();
+  const postHogClient = TelemetryService.getPostHogClient();
   const { environment } = req.query;
   const { workspaceId } = req.params;
 
   let userId: Types.ObjectId | undefined = undefined // used for getting personal secrets for user
-  let userEmail: Types.ObjectId | undefined = undefined // used for posthog 
+  let userEmail: string | undefined = undefined // used for posthog 
   if (req.user) {
     userId = req.user._id;
     userEmail = req.user.email;
   }
 
   if (req.serviceTokenData) {
-    userId = req.serviceTokenData.user._id
-    userEmail = req.serviceTokenData.user.email;
+    userId = req.serviceTokenData.user;
+    
+    const user = await User.findById(req.serviceTokenData.user, 'email');
+    if (!user) throw AccountNotFoundError();
+    userEmail = user.email;
   }
 
   const [err, secrets] = await to(Secret.find(

backend/src/controllers/v2/secretsController.ts

@@ -2,7 +2,7 @@ import to from 'await-to-js';
 import { Types } from 'mongoose';
 import { Request, Response } from 'express';
 import { ISecret, Secret } from '../../models';
-import { IAction } from '../../ee/models';
+import { IAction, SecretVersion } from '../../ee/models';
 import {
     SECRET_PERSONAL,
     SECRET_SHARED,
@@ -15,12 +15,12 @@ import { UnauthorizedRequestError, ValidationError } from '../../utils/errors';
 import { EventService } from '../../services';
 import { eventPushSecrets } from '../../events';
 import { EESecretService, EELogService } from '../../ee/services';
-import { getPostHogClient } from '../../services';
+import { TelemetryService, SecretService } from '../../services';
 import { getChannelFromUserAgent } from '../../utils/posthog';
-import { ABILITY_READ, ABILITY_WRITE } from '../../variables/organization';
+import { PERMISSION_WRITE_SECRETS } from '../../variables';
 import { userHasNoAbility, userHasWorkspaceAccess, userHasWriteOnlyAbility } from '../../ee/helpers/checkMembershipPermissions';
 import Tag from '../../models/tag';
-import _ from 'lodash';
+import _, { eq } from 'lodash';
 import {
     BatchSecretRequest,
     BatchSecret
@@ -28,12 +28,14 @@ import {
 
 /**
  * Peform a batch of any specified CUD secret operations
+ * (used by dashboard)
  * @param req 
  * @param res 
  */
 export const batchSecrets = async (req: Request, res: Response) => {
+
     const channel = getChannelFromUserAgent(req.headers['user-agent']);
-    const postHogClient = getPostHogClient();
+    const postHogClient = TelemetryService.getPostHogClient();
 
     const {
         workspaceId,
@@ -49,29 +51,47 @@ export const batchSecrets = async (req: Request, res: Response) => {
     const updateSecrets: BatchSecret[] = [];
     const deleteSecrets: Types.ObjectId[] = [];
     const actions: IAction[] = [];
+    
+    // get secret blind index salt
+    const salt = await SecretService.getSecretBlindIndexSalt({
+        workspaceId: new Types.ObjectId(workspaceId)
+    });
 
-    requests.forEach((request) => {
+    for await (const request of requests) {
+        let secretBlindIndex = '';
         switch (request.method) {
             case 'POST':
+                secretBlindIndex = await SecretService.generateSecretBlindIndexWithSalt({
+                    secretName: request.secret.secretName,
+                    salt
+                });
+
                 createSecrets.push({
                     ...request.secret,
                     version: 1,
                     user: request.secret.type === SECRET_PERSONAL ? req.user : undefined,
                     environment,
-                    workspace: new Types.ObjectId(workspaceId)
+                    workspace: new Types.ObjectId(workspaceId),
+                    secretBlindIndex
                 });
                 break;
             case 'PATCH':
+                secretBlindIndex = await SecretService.generateSecretBlindIndexWithSalt({
+                    secretName: request.secret.secretName,
+                    salt
+                });
+
                 updateSecrets.push({
                     ...request.secret,
-                    _id: new Types.ObjectId(request.secret._id)
+                    _id: new Types.ObjectId(request.secret._id),
+                    secretBlindIndex
                 });
                 break;
             case 'DELETE':
                 deleteSecrets.push(new Types.ObjectId(request.secret._id));
                 break;
         }
-    });
+    }
 
     // handle create secrets
     let createdSecrets: ISecret[] = [];
@@ -91,7 +111,9 @@ export const batchSecrets = async (req: Request, res: Response) => {
 
         const addAction = await EELogService.createAction({
             name: ACTION_ADD_SECRETS,
-            userId: req.user._id,
+            userId: req.user?._id,
+            serviceAccountId: req.serviceAccount?._id,
+            serviceTokenDataId: req.serviceTokenData?._id,
             workspaceId: new Types.ObjectId(workspaceId),
             secretIds: createdSecrets.map((n) => n._id)
         }) as IAction;
@@ -130,7 +152,10 @@ export const batchSecrets = async (req: Request, res: Response) => {
 
         const updateOperations = updateSecrets.map((u) => ({
             updateOne: {
-                filter: { _id: new Types.ObjectId(u._id) },
+                filter: {
+                    _id: new Types.ObjectId(u._id),
+                    workspace: new Types.ObjectId(workspaceId)
+                },
                 update: {
                     $inc: {
                         version: 1
@@ -143,13 +168,14 @@ export const batchSecrets = async (req: Request, res: Response) => {
 
         await Secret.bulkWrite(updateOperations);
 
-        const secretVersions = updateSecrets.map((u) => ({
+        const secretVersions = updateSecrets.map((u) => new SecretVersion({
             secret: new Types.ObjectId(u._id),
             version: listedSecretsObj[u._id.toString()].version,
             workspace: new Types.ObjectId(workspaceId),
             type: listedSecretsObj[u._id.toString()].type,
             environment,
             isDeleted: false,
+            secretBlindIndex: u.secretBlindIndex,
             secretKeyCiphertext: u.secretKeyCiphertext,
             secretKeyIV: u.secretKeyIV,
             secretKeyTag: u.secretKeyTag,
@@ -244,13 +270,13 @@ export const batchSecrets = async (req: Request, res: Response) => {
     // // trigger event - push secrets
     await EventService.handleEvent({
         event: eventPushSecrets({
-            workspaceId
+            workspaceId: new Types.ObjectId(workspaceId)
         })
     });
 
     // (EE) take a secret snapshot
     await EESecretService.takeSecretSnapshot({
-        workspaceId
+        workspaceId: new Types.ObjectId(workspaceId)
     });
 
     const resObj: { [key: string]: ISecret[] | string[] } = {}
@@ -328,14 +354,15 @@ export const createSecrets = async (req: Request, res: Response) => {
         }
     }   
     */
-   const postHogClient = getPostHogClient();
 
     const channel = getChannelFromUserAgent(req.headers['user-agent'])
     const { workspaceId, environment }: { workspaceId: string, environment: string } = req.body;
 
-    const hasAccess = await userHasWorkspaceAccess(req.user, workspaceId, environment, ABILITY_WRITE)
-    if (!hasAccess) {
-        throw UnauthorizedRequestError({ message: "You do not have the necessary permission(s) perform this action" })
+    if (req.user) {
+        const hasAccess = await userHasWorkspaceAccess(req.user, new Types.ObjectId(workspaceId), environment, PERMISSION_WRITE_SECRETS)
+        if (!hasAccess) {
+            throw UnauthorizedRequestError({ message: "You do not have the necessary permission(s) perform this action" })
+        }
     }
 
     let listOfSecretsToCreate;
@@ -347,8 +374,14 @@ export const createSecrets = async (req: Request, res: Response) => {
         listOfSecretsToCreate = [req.body.secrets];
     }
 
+    // get secret blind index salt
+    const salt = await SecretService.getSecretBlindIndexSalt({
+        workspaceId: new Types.ObjectId(workspaceId)
+    });
+
     type secretsToCreateType = {
         type: string;
+        secretName?: string;
         secretKeyCiphertext: string;
         secretKeyIV: string;
         secretKeyTag: string;
@@ -361,25 +394,10 @@ export const createSecrets = async (req: Request, res: Response) => {
         tags: string[]
     }
 
-    const secretsToInsert: ISecret[] = listOfSecretsToCreate.map(({
-        type,
-        secretKeyCiphertext,
-        secretKeyIV,
-        secretKeyTag,
-        secretValueCiphertext,
-        secretValueIV,
-        secretValueTag,
-        secretCommentCiphertext,
-        secretCommentIV,
-        secretCommentTag,
-        tags
-    }: secretsToCreateType) => {
-        return ({
-            version: 1,
-            workspace: new Types.ObjectId(workspaceId),
+    const secretsToInsert: ISecret[] = await Promise.all(
+        listOfSecretsToCreate.map(async ({
             type,
-            user: type === SECRET_PERSONAL ? req.user : undefined,
-            environment,
+            secretName,
             secretKeyCiphertext,
             secretKeyIV,
             secretKeyTag,
@@ -390,16 +408,43 @@ export const createSecrets = async (req: Request, res: Response) => {
             secretCommentIV,
             secretCommentTag,
             tags
-        });
-    })
+        }: secretsToCreateType) => {
+            let secretBlindIndex;
+            if (secretName) {
+                secretBlindIndex = await SecretService.generateSecretBlindIndexWithSalt({
+                    secretName,
+                    salt
+                });
+            }
 
+            return ({
+                version: 1,
+                workspace: new Types.ObjectId(workspaceId),
+                type,
+                ...(secretBlindIndex ? { secretBlindIndex } : {}),
+                user: (req.user && type === SECRET_PERSONAL) ? req.user : undefined,
+                environment,
+                secretKeyCiphertext,
+                secretKeyIV,
+                secretKeyTag,
+                secretValueCiphertext,
+                secretValueIV,
+                secretValueTag,
+                secretCommentCiphertext,
+                secretCommentIV,
+                secretCommentTag,
+                tags
+            });
+        })
+    );
+    
     const newlyCreatedSecrets: ISecret[] = (await Secret.insertMany(secretsToInsert)).map((insertedSecret) => insertedSecret.toObject());
-
+    
     setTimeout(async () => {
         // trigger event - push secrets
         await EventService.handleEvent({
             event: eventPushSecrets({
-                workspaceId
+                workspaceId: new Types.ObjectId(workspaceId)
             })
         });
     }, 5000);
@@ -413,48 +458,45 @@ export const createSecrets = async (req: Request, res: Response) => {
             type,
             user,
             environment,
+            secretBlindIndex,
             secretKeyCiphertext,
             secretKeyIV,
             secretKeyTag,
             secretValueCiphertext,
             secretValueIV,
-            secretValueTag,
-            secretCommentCiphertext,
-            secretCommentIV,
-            secretCommentTag,
-            tags
-        }) => ({
-            _id: new Types.ObjectId(),
+            secretValueTag
+        }) => new SecretVersion({
             secret: _id,
             version,
             workspace,
             type,
             user,
             environment,
+            secretBlindIndex,
             isDeleted: false,
             secretKeyCiphertext,
             secretKeyIV,
             secretKeyTag,
             secretValueCiphertext,
             secretValueIV,
-            secretValueTag,
-            secretCommentCiphertext,
-            secretCommentIV,
-            secretCommentTag,
-            tags
+            secretValueTag
         }))
     });
 
     const addAction = await EELogService.createAction({
         name: ACTION_ADD_SECRETS,
-        userId: req.user._id,
+        userId: req.user?._id,
+        serviceAccountId: req.serviceAccount?._id,
+        serviceTokenDataId: req.serviceTokenData?._id,
         workspaceId: new Types.ObjectId(workspaceId),
         secretIds: newlyCreatedSecrets.map((n) => n._id)
     });
 
     // (EE) create (audit) log
     addAction && await EELogService.createLog({
-        userId: req.user._id.toString(),
+        userId: req.user?._id,
+        serviceAccountId: req.serviceAccount?._id,
+        serviceTokenDataId: req.serviceTokenData?._id,
         workspaceId: new Types.ObjectId(workspaceId),
         actions: [addAction],
         channel,
@@ -463,13 +505,16 @@ export const createSecrets = async (req: Request, res: Response) => {
 
     // (EE) take a secret snapshot
     await EESecretService.takeSecretSnapshot({
-        workspaceId
+        workspaceId: new Types.ObjectId(workspaceId)
     });
 
+    const postHogClient = TelemetryService.getPostHogClient();
     if (postHogClient) {
         postHogClient.capture({
             event: 'secrets added',
-            distinctId: req.user.email,
+            distinctId: await TelemetryService.getDistinctId({
+                authData: req.authData
+            }),
             properties: {
                 numberOfSecrets: listOfSecretsToCreate.length,
                 environment,
@@ -533,91 +578,118 @@ export const getSecrets = async (req: Request, res: Response) => {
     }   
     */
 
-    const postHogClient = getPostHogClient();
+    const { tagSlugs } = req.query;
+    const workspaceId = req.query.workspaceId as string;
+    const environment = req.query.environment as string;
 
-    const { workspaceId, environment, tagSlugs } = req.query;
+    // secrets to return 
+    let secrets: ISecret[] = [];
+
+    // query tags table to get all tags ids for the tag names for the given workspace
+    let tagIds = [];
     const tagNamesList = typeof tagSlugs === 'string' && tagSlugs !== '' ? tagSlugs.split(',') : [];
-    let userId = "" // used for getting personal secrets for user
-    let userEmail = "" // used for posthog 
-    if (req.user) {
-        userId = req.user._id;
-        userEmail = req.user.email;
-    }
-
-    if (req.serviceTokenData) {
-        userId = req.serviceTokenData.user._id
-        userEmail = req.serviceTokenData.user.email;
-    }
-
-    // none service token case as service tokens are already scoped to env and project
-    let hasWriteOnlyAccess
-    if (!req.serviceTokenData) {
-        hasWriteOnlyAccess = await userHasWriteOnlyAbility(userId, workspaceId, environment)
-        const hasNoAccess = await userHasNoAbility(userId, workspaceId, environment)
-        if (hasNoAccess) {
-            throw UnauthorizedRequestError({ message: "You do not have the necessary permission(s) perform this action" })
-        }
-    }
-    let secrets: any
-    let secretQuery: any
-
     if (tagNamesList != undefined && tagNamesList.length != 0) {
-        const workspaceFromDB = await Tag.find({ workspace: workspaceId })
-
-        const tagIds = _.map(tagNamesList, (tagName) => {
+        const workspaceFromDB = await Tag.find({ workspace: workspaceId });
+        tagIds = _.map(tagNamesList, (tagName) => {
             const tag = _.find(workspaceFromDB, { slug: tagName });
             return tag ? tag.id : null;
         });
+    }
 
-        secretQuery = {
-            workspace: workspaceId,
-            environment,
-            $or: [
-                { user: userId },
-                { user: { $exists: false } }
-            ],
-            tags: { $in: tagIds },
-            type: { $in: [SECRET_SHARED, SECRET_PERSONAL] }
+    if (req.user) {
+        // case: client authorization is via JWT
+        const hasWriteOnlyAccess = await userHasWriteOnlyAbility(req.user._id, new Types.ObjectId(workspaceId), environment)
+        const hasNoAccess = await userHasNoAbility(req.user._id, new Types.ObjectId(workspaceId), environment)
+        if (hasNoAccess) {
+            throw UnauthorizedRequestError({ message: "You do not have the necessary permission(s) perform this action" })
         }
-    } else {
-        secretQuery = {
+
+        const secretQuery: any = {
             workspace: workspaceId,
             environment,
             $or: [
-                { user: userId },
-                { user: { $exists: false } }
-            ],
-            type: { $in: [SECRET_SHARED, SECRET_PERSONAL] }
+                { user: req.user._id }, // personal secrets for this user
+                { user: { $exists: false } } // shared secrets from workspace
+            ]
+        }
+
+        if (tagIds.length > 0) {
+            secretQuery.tags = { $in: tagIds };
+        }
+
+        if (hasWriteOnlyAccess) {
+            // only return the secret keys and not the values since user does not have right to see values
+            secrets = await Secret.find(secretQuery).select("secretKeyCiphertext secretKeyIV secretKeyTag").populate("tags")
+        } else {
+            secrets = await Secret.find(secretQuery).populate("tags")
         }
     }
 
-    if (hasWriteOnlyAccess) {
-        secrets = await Secret.find(secretQuery).select("secretKeyCiphertext secretKeyIV secretKeyTag")
-    } else {
-        secrets = await Secret.find(secretQuery).populate("tags")
+    // case: client authorization is via service token
+    if (req.serviceTokenData) {
+        const userId = req.serviceTokenData.user;
+
+        const secretQuery: any = {
+            workspace: workspaceId,
+            environment,
+            $or: [
+                { user: userId }, // personal secrets for this user
+                { user: { $exists: false } } // shared secrets from workspace
+            ]
+        }
+
+        if (tagIds.length > 0) {
+            secretQuery.tags = { $in: tagIds };
+        }
+
+        // TODO check if service token has write only permission 
+
+        secrets = await Secret.find(secretQuery).populate("tags");
+    }
+
+    // case: client authorization is via service account
+    if (req.serviceAccount) {
+        const secretQuery: any = {
+            workspace: workspaceId,
+            environment,
+            user: { $exists: false } // shared secrets only from workspace
+        }
+
+        if (tagIds.length > 0) {
+            secretQuery.tags = { $in: tagIds };
+        }
+
+        secrets = await Secret.find(secretQuery).populate("tags");
     }
 
     const channel = getChannelFromUserAgent(req.headers['user-agent'])
 
     const readAction = await EELogService.createAction({
         name: ACTION_READ_SECRETS,
-        userId: new Types.ObjectId(userId),
+        userId: req.user?._id,
+        serviceAccountId: req.serviceAccount?._id,
+        serviceTokenDataId: req.serviceTokenData?._id,
         workspaceId: new Types.ObjectId(workspaceId as string),
         secretIds: secrets.map((n: any) => n._id)
     });
 
     readAction && await EELogService.createLog({
-        userId: new Types.ObjectId(userId),
+        userId: req.user?._id,
+        serviceAccountId: req.serviceAccount?._id,
+        serviceTokenDataId: req.serviceTokenData?._id,
         workspaceId: new Types.ObjectId(workspaceId as string),
         actions: [readAction],
         channel,
         ipAddress: req.ip
     });
 
+    const postHogClient = TelemetryService.getPostHogClient();
     if (postHogClient) {
         postHogClient.capture({
             event: 'secrets pulled',
-            distinctId: userEmail,
+            distinctId: await TelemetryService.getDistinctId({
+                authData: req.authData
+            }),
             properties: {
                 numberOfSecrets: secrets.length,
                 environment,
@@ -633,59 +705,6 @@ export const getSecrets = async (req: Request, res: Response) => {
     });
 }
 
-
-export const getOnlySecretKeys = async (req: Request, res: Response) => {
-    const { workspaceId, environment } = req.query;
-
-    let userId = "" // used for getting personal secrets for user
-    let userEmail = "" // used for posthog 
-    if (req.user) {
-        userId = req.user._id;
-        userEmail = req.user.email;
-    }
-
-    if (req.serviceTokenData) {
-        userId = req.serviceTokenData.user._id
-        userEmail = req.serviceTokenData.user.email;
-    }
-
-    // none service token case as service tokens are already scoped
-    if (!req.serviceTokenData) {
-        const hasAccess = await userHasWorkspaceAccess(userId, workspaceId, environment, ABILITY_READ)
-        if (!hasAccess) {
-            throw UnauthorizedRequestError({ message: "You do not have the necessary permission(s) perform this action" })
-        }
-    }
-
-    const [err, secretKeys] = await to(Secret.find(
-        {
-            workspace: workspaceId,
-            environment,
-            $or: [
-                { user: userId },
-                { user: { $exists: false } }
-            ],
-            type: { $in: [SECRET_SHARED, SECRET_PERSONAL] }
-        }
-    )
-        .select("secretKeyIV secretKeyTag secretKeyCiphertext")
-        .then())
-
-    if (err) throw ValidationError({ message: 'Failed to get secrets', stack: err.stack });
-
-    // readAction && await EELogService.createLog({
-    //     userId: new Types.ObjectId(userId),
-    //     workspaceId: new Types.ObjectId(workspaceId as string),
-    //     actions: [readAction],
-    //     channel,
-    //     ipAddress: req.ip
-    // });
-
-    return res.status(200).send({
-        secretKeys
-    });
-}
-
 /**
  * Update secret(s)
  * @param req 
@@ -736,10 +755,8 @@ export const updateSecrets = async (req: Request, res: Response) => {
         }
     }
     */
-    const postHogClient = getPostHogClient();
     const channel = req.headers?.['user-agent']?.toLowerCase().includes('mozilla') ? 'web' : 'cli';
 
-    // TODO: move type
     interface PatchSecret {
         id: string;
         secretKeyCiphertext: string;
@@ -858,21 +875,25 @@ export const updateSecrets = async (req: Request, res: Response) => {
         setTimeout(async () => {
             await EventService.handleEvent({
                 event: eventPushSecrets({
-                    workspaceId: key
+                    workspaceId: new Types.ObjectId(key)
                 })
             });
         }, 10000);
 
         const updateAction = await EELogService.createAction({
             name: ACTION_UPDATE_SECRETS,
-            userId: req.user._id,
+            userId: req.user?._id,
+            serviceAccountId: req.serviceAccount?._id,
+            serviceTokenDataId: req.serviceTokenData?._id,
             workspaceId: new Types.ObjectId(key),
             secretIds: workspaceSecretObj[key].map((secret: ISecret) => secret._id)
         });
 
         // (EE) create (audit) log
         updateAction && await EELogService.createLog({
-            userId: req.user._id.toString(),
+            userId: req.user?._id,
+            serviceAccountId: req.serviceAccount?._id,
+            serviceTokenDataId: req.serviceTokenData?._id,
             workspaceId: new Types.ObjectId(key),
             actions: [updateAction],
             channel,
@@ -881,13 +902,16 @@ export const updateSecrets = async (req: Request, res: Response) => {
 
         // (EE) take a secret snapshot
         await EESecretService.takeSecretSnapshot({
-            workspaceId: key
+            workspaceId: new Types.ObjectId(key)
         })
 
+        const postHogClient = TelemetryService.getPostHogClient();
         if (postHogClient) {
             postHogClient.capture({
                 event: 'secrets modified',
-                distinctId: req.user.email,
+                distinctId: await TelemetryService.getDistinctId({
+                    authData: req.authData
+                }),
                 properties: {
                     numberOfSecrets: workspaceSecretObj[key].length,
                     environment: workspaceSecretObj[key][0].environment,
@@ -909,7 +933,7 @@ export const updateSecrets = async (req: Request, res: Response) => {
 }
 
 /**
- * Delete secret(s) with id [workspaceId] and environment [environment]
+ * Delete secret(s)
  * @param req 
  * @param res 
  */
@@ -958,7 +982,7 @@ export const deleteSecrets = async (req: Request, res: Response) => {
         }
     }   
     */
-    const postHogClient = getPostHogClient();
+
     const channel = getChannelFromUserAgent(req.headers['user-agent'])
     const toDelete = req.secrets.map((s: any) => s._id);
 
@@ -987,19 +1011,23 @@ export const deleteSecrets = async (req: Request, res: Response) => {
         // trigger event - push secrets
         await EventService.handleEvent({
             event: eventPushSecrets({
-                workspaceId: key
+                workspaceId: new Types.ObjectId(key)
             })
         });
         const deleteAction = await EELogService.createAction({
             name: ACTION_DELETE_SECRETS,
-            userId: req.user._id,
+            userId: req.user?._id,
+            serviceAccountId: req.serviceAccount?._id,
+            serviceTokenDataId: req.serviceTokenData?._id,
             workspaceId: new Types.ObjectId(key),
             secretIds: workspaceSecretObj[key].map((secret: ISecret) => secret._id)
         });
 
         // (EE) create (audit) log
         deleteAction && await EELogService.createLog({
-            userId: req.user._id.toString(),
+            userId: req.user?._id,
+            serviceAccountId: req.serviceAccount?._id,
+            serviceTokenDataId: req.serviceTokenData?._id,
             workspaceId: new Types.ObjectId(key),
             actions: [deleteAction],
             channel,
@@ -1008,13 +1036,16 @@ export const deleteSecrets = async (req: Request, res: Response) => {
 
         // (EE) take a secret snapshot
         await EESecretService.takeSecretSnapshot({
-            workspaceId: key
-        })
+            workspaceId: new Types.ObjectId(key)
+        });
 
+        const postHogClient = TelemetryService.getPostHogClient();
         if (postHogClient) {
             postHogClient.capture({
                 event: 'secrets deleted',
-                distinctId: req.user.email,
+                distinctId: await TelemetryService.getDistinctId({
+                    authData: req.authData
+                }),
                 properties: {
                     numberOfSecrets: workspaceSecretObj[key].length,
                     environment: workspaceSecretObj[key][0].environment,

backend/src/controllers/v2/serviceAccountsController.ts

@@ -0,0 +1,306 @@
+import { Request, Response } from 'express';
+import { Types } from 'mongoose';
+import crypto from 'crypto';
+import bcrypt from 'bcrypt';
+import { 
+    ServiceAccount,
+    ServiceAccountKey,
+    ServiceAccountOrganizationPermission,
+    ServiceAccountWorkspacePermission
+} from '../../models';
+import {
+    CreateServiceAccountDto
+} from '../../interfaces/serviceAccounts/dto';
+import { BadRequestError, ServiceAccountNotFoundError } from '../../utils/errors';
+import { getSaltRounds } from '../../config';
+
+/**
+ * Return service account tied to the request (service account) client
+ * @param req
+ * @param res
+ */
+export const getCurrentServiceAccount = async (req: Request, res: Response) => {
+    const serviceAccount = await ServiceAccount.findById(req.serviceAccount._id);
+    
+    if (!serviceAccount) {
+        throw ServiceAccountNotFoundError({ message: 'Failed to find service account' });
+    }
+    
+    return res.status(200).send({
+        serviceAccount
+    });
+}
+
+/**
+ * Return service account with id [serviceAccountId]
+ * @param req 
+ * @param res 
+ */
+export const getServiceAccountById = async (req: Request, res: Response) => {
+    const { serviceAccountId } = req.params;
+    
+    const serviceAccount = await ServiceAccount.findById(serviceAccountId);
+    
+    if (!serviceAccount) {
+        throw ServiceAccountNotFoundError({ message: 'Failed to find service account' });
+    }
+    
+    return res.status(200).send({
+        serviceAccount
+    });
+}
+
+/**
+ * Create a new service account under organization with id [organizationId]
+ * that has access to workspaces [workspaces]
+ * @param req 
+ * @param res 
+ * @returns
+ */
+export const createServiceAccount = async (req: Request, res: Response) => {
+    const {
+        name,
+        organizationId,
+        publicKey,
+        expiresIn,
+    }: CreateServiceAccountDto = req.body;
+
+    let expiresAt;
+    if (expiresIn) {
+        expiresAt = new Date();
+        expiresAt.setSeconds(expiresAt.getSeconds() + expiresIn);
+    }
+
+    const secret = crypto.randomBytes(16).toString('base64');
+    const secretHash = await bcrypt.hash(secret, getSaltRounds());
+    
+    // create service account
+    const serviceAccount = await new ServiceAccount({
+        name,
+        organization: new Types.ObjectId(organizationId),
+        user: req.user,
+        publicKey,
+        lastUsed: new Date(),
+        expiresAt,
+        secretHash
+    }).save();
+    
+    const serviceAccountObj = serviceAccount.toObject();
+    
+    delete serviceAccountObj.secretHash;
+
+    // provision default org-level permission for service account
+    await new ServiceAccountOrganizationPermission({
+        serviceAccount: serviceAccount._id
+    }).save();
+    
+    const secretId = Buffer.from(serviceAccount._id.toString(), 'hex').toString('base64');
+
+    return res.status(200).send({
+        serviceAccountAccessKey: `sa.${secretId}.${secret}`,
+        serviceAccount: serviceAccountObj
+    });
+}
+
+/**
+ * Change name of service account with id [serviceAccountId] to [name]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const changeServiceAccountName = async (req: Request, res: Response) => {
+    const { serviceAccountId } = req.params;
+    const { name } = req.body;
+    
+    const serviceAccount = await ServiceAccount.findOneAndUpdate(
+        {
+            _id: new Types.ObjectId(serviceAccountId)
+        },
+        {
+            name
+        },
+        {
+            new: true
+        }
+    );
+    
+    return res.status(200).send({
+        serviceAccount
+    });
+}
+
+/**
+ * Add a service account key to service account with id [serviceAccountId]
+ * for workspace with id [workspaceId]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const addServiceAccountKey = async (req: Request, res: Response) => {
+    const {
+        workspaceId,
+        encryptedKey,
+        nonce
+    } = req.body;
+    
+    const serviceAccountKey = await new ServiceAccountKey({
+        encryptedKey,
+        nonce,
+        sender: req.user._id,
+        serviceAccount: req.serviceAccount._d,
+        workspace: new Types.ObjectId(workspaceId)
+    }).save();
+
+    return serviceAccountKey;
+}
+
+/**
+ * Return workspace-level permission for service account with id [serviceAccountId]
+ * @param req 
+ * @param res 
+ */
+export const getServiceAccountWorkspacePermissions = async (req: Request, res: Response) => {
+    const serviceAccountWorkspacePermissions = await ServiceAccountWorkspacePermission.find({
+        serviceAccount: req.serviceAccount._id
+    }).populate('workspace');
+    
+    return res.status(200).send({
+        serviceAccountWorkspacePermissions
+    });
+}
+
+/**
+ * Add a workspace permission to service account with id [serviceAccountId]
+ * @param req 
+ * @param res 
+ */
+export const addServiceAccountWorkspacePermission = async (req: Request, res: Response) => {
+    const { serviceAccountId } = req.params;
+    const {
+        environment,
+        workspaceId,
+        read = false,
+        write = false,
+        encryptedKey,
+        nonce
+    } = req.body;
+    
+    if (!req.membership.workspace.environments.some((e: { name: string; slug: string }) => e.slug === environment)) {
+        return res.status(400).send({
+            message: 'Failed to validate workspace environment'
+        });
+    }
+    
+    const existingPermission = await ServiceAccountWorkspacePermission.findOne({
+        serviceAccount: new Types.ObjectId(serviceAccountId),
+        workspace: new Types.ObjectId(workspaceId),
+        environment
+    });
+    
+    if (existingPermission) throw BadRequestError({ message: 'Failed to add workspace permission to service account due to already-existing ' });
+
+    const serviceAccountWorkspacePermission = await new ServiceAccountWorkspacePermission({
+        serviceAccount: new Types.ObjectId(serviceAccountId),
+        workspace: new Types.ObjectId(workspaceId),
+        environment,
+        read,
+        write
+    }).save();
+    
+    const existingServiceAccountKey = await ServiceAccountKey.findOne({
+        serviceAccount: new Types.ObjectId(serviceAccountId),
+        workspace: new Types.ObjectId(workspaceId) 
+    });
+    
+    if (!existingServiceAccountKey) {
+        await new ServiceAccountKey({
+            encryptedKey,
+            nonce,
+            sender: req.user._id,
+            serviceAccount: new Types.ObjectId(serviceAccountId),
+            workspace: new Types.ObjectId(workspaceId)
+        }).save();
+    }
+
+    return res.status(200).send({
+        serviceAccountWorkspacePermission
+    });
+}
+
+/**
+ * Delete workspace permission from service account with id [serviceAccountId]
+ * @param req 
+ * @param res 
+ */
+export const deleteServiceAccountWorkspacePermission = async (req: Request, res: Response) => {
+    const { serviceAccountWorkspacePermissionId } = req.params;
+    const serviceAccountWorkspacePermission = await ServiceAccountWorkspacePermission.findByIdAndDelete(serviceAccountWorkspacePermissionId);
+
+    if (serviceAccountWorkspacePermission) {
+        const { serviceAccount, workspace } = serviceAccountWorkspacePermission;
+        const count = await ServiceAccountWorkspacePermission.countDocuments({
+            serviceAccount,
+            workspace
+        });
+        
+        if (count === 0) {
+            await ServiceAccountKey.findOneAndDelete({
+                serviceAccount,
+                workspace
+            });
+        }
+    }
+
+    return res.status(200).send({
+        serviceAccountWorkspacePermission
+    });
+}
+
+/**
+ * Delete service account with id [serviceAccountId]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const deleteServiceAccount = async (req: Request, res: Response) => {
+    const { serviceAccountId } = req.params;
+
+    const serviceAccount = await ServiceAccount.findByIdAndDelete(serviceAccountId);
+
+    if (serviceAccount) {
+        await ServiceAccountKey.deleteMany({
+            serviceAccount: serviceAccount._id
+        });
+
+        await ServiceAccountOrganizationPermission.deleteMany({
+            serviceAccount: new Types.ObjectId(serviceAccountId)
+        });
+
+        await ServiceAccountWorkspacePermission.deleteMany({
+            serviceAccount: new Types.ObjectId(serviceAccountId)
+        });
+    }
+
+    return res.status(200).send({
+        serviceAccount
+    });
+}
+
+/**
+ * Return service account keys for service account with id [serviceAccountId]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const getServiceAccountKeys = async (req: Request, res: Response) => {
+    const workspaceId = req.query.workspaceId as string;
+    
+    const serviceAccountKeys = await ServiceAccountKey.find({
+        serviceAccount: req.serviceAccount._id,
+        ...(workspaceId ? { workspace: new Types.ObjectId(workspaceId) } : {})
+    });
+    
+    return res.status(200).send({
+        serviceAccountKeys
+    });
+}

backend/src/controllers/v2/serviceTokenDataController.ts

@@ -3,11 +3,19 @@ import { Request, Response } from 'express';
 import crypto from 'crypto';
 import bcrypt from 'bcrypt';
 import {
+    User,
+    ServiceAccount,
     ServiceTokenData
 } from '../../models';
 import { userHasWorkspaceAccess } from '../../ee/helpers/checkMembershipPermissions';
-import { ABILITY_READ } from '../../variables/organization';
+import { 
+    PERMISSION_READ_SECRETS,
+    AUTH_MODE_JWT,
+    AUTH_MODE_SERVICE_ACCOUNT,
+    AUTH_MODE_SERVICE_TOKEN
+} from '../../variables';
 import { getSaltRounds } from '../../config';
+import { BadRequestError } from '../../utils/errors';
 
 /**
  * Return service token data associated with service token on request
@@ -42,7 +50,16 @@ export const getServiceTokenData = async (req: Request, res: Response) => {
     }   
     */
 
-    return res.status(200).json(req.serviceTokenData);
+    if (!(req.authData.authPayload instanceof ServiceTokenData)) throw BadRequestError({
+        message: 'Failed accepted client validation for service token data'
+    });
+
+    const serviceTokenData = await ServiceTokenData
+        .findById(req.authData.authPayload._id)
+        .select('+encryptedKey +iv +tag')
+        .populate('user');
+
+    return res.status(200).json(serviceTokenData);
 }
 
 /**
@@ -53,59 +70,60 @@ export const getServiceTokenData = async (req: Request, res: Response) => {
  * @returns 
  */
 export const createServiceTokenData = async (req: Request, res: Response) => {
-    let serviceToken, serviceTokenData;
+    let serviceTokenData;
 
-    try {
-        const {
-            name,
-            workspaceId,
-            environment,
-            encryptedKey,
-            iv,
-            tag,
-            expiresIn,
-            permissions
-        } = req.body;
+    const {
+        name,
+        workspaceId,
+        environment,
+        encryptedKey,
+        iv,
+        tag,
+        expiresIn,
+        permissions
+    } = req.body;
 
-        const hasAccess = await userHasWorkspaceAccess(req.user, workspaceId, environment, ABILITY_READ)
-        if (!hasAccess) {
-            throw UnauthorizedRequestError({ message: "You do not have the necessary permission(s) perform this action" })
-        }
+    const secret = crypto.randomBytes(16).toString('hex');
+    const secretHash = await bcrypt.hash(secret, getSaltRounds());
 
-        const secret = crypto.randomBytes(16).toString('hex');
-        const secretHash = await bcrypt.hash(secret, getSaltRounds());
-
-        const expiresAt = new Date();
+    let expiresAt; 
+    if (expiresIn) {
+        expiresAt = new Date()
         expiresAt.setSeconds(expiresAt.getSeconds() + expiresIn);
-
-        serviceTokenData = await new ServiceTokenData({
-            name,
-            workspace: workspaceId,
-            environment,
-            user: req.user._id,
-            expiresAt,
-            secretHash,
-            encryptedKey,
-            iv,
-            tag,
-            permissions
-        }).save();
-
-        // return service token data without sensitive data
-        serviceTokenData = await ServiceTokenData.findById(serviceTokenData._id);
-
-        if (!serviceTokenData) throw new Error('Failed to find service token data');
-
-        serviceToken = `st.${serviceTokenData._id.toString()}.${secret}`;
-
-    } catch (err) {
-        Sentry.setUser({ email: req.user.email });
-        Sentry.captureException(err);
-        return res.status(400).send({
-            message: 'Failed to create service token data'
-        });
     }
 
+    let user, serviceAccount;
+    
+    if (req.authData.authMode === AUTH_MODE_JWT && req.authData.authPayload instanceof User) {
+        user = req.authData.authPayload._id;
+    }
+
+    if (req.authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && req.authData.authPayload instanceof ServiceAccount) {
+        serviceAccount = req.authData.authPayload._id;
+    }
+        
+    serviceTokenData = await new ServiceTokenData({
+        name,
+        workspace: workspaceId,
+        environment,
+        user,
+        serviceAccount,
+        lastUsed: new Date(),
+        expiresAt,
+        secretHash,
+        encryptedKey,
+        iv,
+        tag,
+        permissions
+    }).save();
+
+    // return service token data without sensitive data
+    serviceTokenData = await ServiceTokenData.findById(serviceTokenData._id);
+
+    if (!serviceTokenData) throw new Error('Failed to find service token data');
+
+    const serviceToken = `st.${serviceTokenData._id.toString()}.${secret}`;
+
     return res.status(200).send({
         serviceToken,
         serviceTokenData
@@ -119,25 +137,11 @@ export const createServiceTokenData = async (req: Request, res: Response) => {
  * @returns 
  */
 export const deleteServiceTokenData = async (req: Request, res: Response) => {
-    let serviceTokenData;
-    try {
-        const { serviceTokenDataId } = req.params;
+    const { serviceTokenDataId } = req.params;
 
-        serviceTokenData = await ServiceTokenData.findByIdAndDelete(serviceTokenDataId);
-
-    } catch (err) {
-        Sentry.setUser({ email: req.user.email });
-        Sentry.captureException(err);
-        return res.status(400).send({
-            message: 'Failed to delete service token data'
-        });
-    }
+    const serviceTokenData = await ServiceTokenData.findByIdAndDelete(serviceTokenDataId);
 
     return res.status(200).send({
         serviceTokenData
     });
-}
-
-function UnauthorizedRequestError(arg0: { message: string; }) {
-    throw new Error('Function not implemented.');
 }

backend/src/controllers/v2/signupController.ts

@@ -8,7 +8,7 @@ import {
 import { issueAuthTokens } from '../../helpers/auth';
 import { INVITED, ACCEPTED } from '../../variables';
 import request from '../../config/request';
-import { getNodeEnv, getLoopsApiKey } from '../../config';
+import { getLoopsApiKey, getHttpsEnabled } from '../../config';
 
 /**
  * Complete setting up user by adding their personal and auth information as part of the
@@ -24,9 +24,9 @@ export const completeAccountSignup = async (req: Request, res: Response) => {
 			email,
 			firstName,
 			lastName,
-            protectedKey,
-            protectedKeyIV,
-            protectedKeyTag,
+			protectedKey,
+			protectedKeyIV,
+			protectedKeyTag,
 			publicKey,
 			encryptedPrivateKey,
 			encryptedPrivateKeyIV,
@@ -38,9 +38,9 @@ export const completeAccountSignup = async (req: Request, res: Response) => {
 			email: string;
 			firstName: string;
 			lastName: string;
-            protectedKey: string;
-            protectedKeyIV: string;
-            protectedKeyTag: string;
+			protectedKey: string;
+			protectedKeyIV: string;
+			protectedKeyTag: string;
 			publicKey: string;
 			encryptedPrivateKey: string;
 			encryptedPrivateKeyIV: string;
@@ -48,11 +48,11 @@ export const completeAccountSignup = async (req: Request, res: Response) => {
 			salt: string;
 			verifier: string;
 			organizationName: string;
-        } = req.body;
+		} = req.body;
 
 		// get user
 		user = await User.findOne({ email });
-		
+
 		if (!user || (user && user?.publicKey)) {
 			// case 1: user doesn't exist.
 			// case 2: user has already completed account
@@ -66,10 +66,10 @@ export const completeAccountSignup = async (req: Request, res: Response) => {
 			userId: user._id.toString(),
 			firstName,
 			lastName,
-            encryptionVersion: 2,
-            protectedKey,
-            protectedKeyIV,
-            protectedKeyTag,
+			encryptionVersion: 2,
+			protectedKey,
+			protectedKeyIV,
+			protectedKeyTag,
 			publicKey,
 			encryptedPrivateKey,
 			encryptedPrivateKeyIV,
@@ -127,7 +127,7 @@ export const completeAccountSignup = async (req: Request, res: Response) => {
 			httpOnly: true,
 			path: '/',
 			sameSite: 'strict',
-			secure: getNodeEnv() === 'production' ? true : false
+			secure: getHttpsEnabled()
 		});
 	} catch (err) {
 		Sentry.setUser(null);
@@ -158,9 +158,9 @@ export const completeAccountInvite = async (req: Request, res: Response) => {
 			email,
 			firstName,
 			lastName,
-            protectedKey,
-            protectedKeyIV,
-            protectedKeyTag,
+			protectedKey,
+			protectedKeyIV,
+			protectedKeyTag,
 			publicKey,
 			encryptedPrivateKey,
 			encryptedPrivateKeyIV,
@@ -192,10 +192,10 @@ export const completeAccountInvite = async (req: Request, res: Response) => {
 			userId: user._id.toString(),
 			firstName,
 			lastName,
-            encryptionVersion: 2,
-            protectedKey,
-            protectedKeyIV,
-            protectedKeyTag,
+			encryptionVersion: 2,
+			protectedKey,
+			protectedKeyIV,
+			protectedKeyTag,
 			publicKey,
 			encryptedPrivateKey,
 			encryptedPrivateKeyIV,
@@ -232,7 +232,7 @@ export const completeAccountInvite = async (req: Request, res: Response) => {
 			httpOnly: true,
 			path: '/',
 			sameSite: 'strict',
-			secure: getNodeEnv() === 'production' ? true : false
+			secure: getHttpsEnabled()
 		});
 	} catch (err) {
 		Sentry.setUser(null);
@@ -241,7 +241,7 @@ export const completeAccountInvite = async (req: Request, res: Response) => {
 			message: 'Failed to complete account setup'
 		});
 	}
-	
+
 	return res.status(200).send({
 		message: 'Successfully set up account',
 		user,

backend/src/controllers/v2/workspaceController.ts

@@ -19,7 +19,7 @@ import {
 	reformatPullSecrets
 } from '../../helpers/secret';
 import { pushKeys } from '../../helpers/key';
-import { getPostHogClient, EventService } from '../../services';
+import { TelemetryService, EventService } from '../../services';
 import { eventPushSecrets } from '../../events';
 
 interface V2PushSecret {
@@ -48,7 +48,7 @@ interface V2PushSecret {
 export const pushWorkspaceSecrets = async (req: Request, res: Response) => {
 	// upload (encrypted) secrets to workspace with id [workspaceId]
 	try {
-		const postHogClient = getPostHogClient();
+		const postHogClient = TelemetryService.getPostHogClient();
 		let { secrets }: { secrets: V2PushSecret[] } = req.body;
 		const { keys, environment, channel } = req.body;
 		const { workspaceId } = req.params;
@@ -95,7 +95,8 @@ export const pushWorkspaceSecrets = async (req: Request, res: Response) => {
 		// trigger event - push secrets
 		EventService.handleEvent({
 			event: eventPushSecrets({
-				workspaceId
+				workspaceId: new Types.ObjectId(workspaceId),
+				environment
 			})
 		});
 
@@ -122,7 +123,7 @@ export const pushWorkspaceSecrets = async (req: Request, res: Response) => {
 export const pullSecrets = async (req: Request, res: Response) => {
 	let secrets;
 	try {
-		const postHogClient = getPostHogClient();
+		const postHogClient = TelemetryService.getPostHogClient();
 		const environment: string = req.query.environment as string;
 		const channel: string = req.query.channel as string;
 		const { workspaceId } = req.params;
@@ -131,7 +132,7 @@ export const pullSecrets = async (req: Request, res: Response) => {
 		if (req.user) {
 			userId = req.user._id.toString();
 		} else if (req.serviceTokenData) {
-			userId = req.serviceTokenData.user._id
+			userId = req.serviceTokenData.user.toString();
 		}
 		// validate environment
 		const workspaceEnvs = req.membership.workspace.environments;
@@ -506,5 +507,4 @@ export const toggleAutoCapitalization = async (req: Request, res: Response) => {
 		message: 'Successfully changed autoCapitalization setting',
 		workspace
 	});
-};
-
+};

backend/src/controllers/v3/index.ts

@@ -0,0 +1,7 @@
+import * as secretsController from './secretsController';
+import * as workspacesController from './workspacesController';
+
+export {
+    secretsController,
+    workspacesController
+}

backend/src/controllers/v3/secretsController.ts

@@ -0,0 +1,183 @@
+import { Request, Response } from 'express';
+import { Types } from 'mongoose';
+import { 
+    SecretService, 
+    TelemetryService,
+    EventService
+} from '../../services';
+import { eventPushSecrets } from '../../events';
+import { getAuthDataPayloadIdObj } from '../../utils/auth';
+import { BadRequestError } from '../../utils/errors';
+
+/**
+ * Get secrets for workspace with id [workspaceId] and environment
+ * [environment]
+ * @param req 
+ * @param res 
+ */
+export const getSecrets = async (req: Request, res: Response) => {
+    const workspaceId = req.query.workspaceId as string;
+    const environment = req.query.environment as string;
+
+    const secrets = await SecretService.getSecrets({
+        workspaceId: new Types.ObjectId(workspaceId),
+        environment,
+        authData: req.authData
+    });
+
+    return res.status(200).send({
+        secrets
+    });
+}
+
+/**
+ * Get secret with name [secretName]
+ * @param req 
+ * @param res 
+ */
+export const getSecretByName = async (req: Request, res: Response) => {
+    const { secretName } = req.params;
+    const workspaceId = req.query.workspaceId as string;
+    const environment = req.query.environment as string;
+    const type = req.query.type as 'shared' | 'personal' | undefined;
+
+    const secret = await SecretService.getSecret({
+        secretName,
+        workspaceId: new Types.ObjectId(workspaceId),
+        environment,
+        type,
+        authData: req.authData
+    });
+    
+    return res.status(200).send({
+        secret
+    });
+}
+
+/**
+ * Create secret with name [secretName]
+ * @param req 
+ * @param res 
+ */
+export const createSecret = async (req: Request, res: Response) => {
+    const { secretName } = req.params;
+    const { 
+        workspaceId,
+        environment,
+        type,
+        secretKeyCiphertext,
+        secretKeyIV,
+        secretKeyTag,
+        secretValueCiphertext,
+        secretValueIV,
+        secretValueTag,
+        secretCommentCiphertext,
+        secretCommentIV,
+        secretCommentTag
+    } = req.body;
+    
+    const secret = await SecretService.createSecret({
+        secretName,
+        workspaceId: new Types.ObjectId(workspaceId),
+        environment,
+        type,
+        authData: req.authData,
+        secretKeyCiphertext,
+        secretKeyIV,
+        secretKeyTag,
+        secretValueCiphertext,
+        secretValueIV,
+        secretValueTag,
+        ...((secretCommentCiphertext && secretCommentIV && secretCommentTag) ? {
+            secretCommentCiphertext,
+            secretCommentIV,
+            secretCommentTag
+        } : {})
+    });
+
+    await EventService.handleEvent({
+        event: eventPushSecrets({
+            workspaceId: new Types.ObjectId(workspaceId),
+            environment
+        })
+    });
+
+    const secretWithoutBlindIndex = secret.toObject();
+    delete secretWithoutBlindIndex.secretBlindIndex;
+    
+    return res.status(200).send({
+        secret: secretWithoutBlindIndex
+    });
+}
+
+/**
+ * Update secret with name [secretName]
+ * @param req
+ * @param res 
+ */
+export const updateSecretByName = async (req: Request, res: Response) => {
+    const { secretName } = req.params;
+    const {
+        workspaceId,
+        environment,
+        type,
+        secretValueCiphertext,
+        secretValueIV,
+        secretValueTag
+    } = req.body;
+
+    const secret = await SecretService.updateSecret({
+        secretName,
+        workspaceId,
+        environment,
+        type,
+        authData: req.authData,
+        secretValueCiphertext,
+        secretValueIV,
+        secretValueTag
+    });
+    
+    await EventService.handleEvent({
+        event: eventPushSecrets({
+            workspaceId: new Types.ObjectId(workspaceId),
+            environment
+        })
+    });
+
+    return res.status(200).send({
+        secret
+    });
+}
+
+/**
+ * Delete secret with name [secretName]
+ * @param req 
+ * @param res 
+ */
+export const deleteSecretByName = async (req: Request, res: Response) => {
+    const { secretName } = req.params;
+    const {
+        workspaceId,
+        environment,
+        type
+    } = req.body;
+    
+    const { secret, secrets } = await SecretService.deleteSecret({
+        secretName,
+        workspaceId,
+        environment,
+        type,
+        authData: req.authData
+    });
+
+    await EventService.handleEvent({
+        event: eventPushSecrets({
+            workspaceId: new Types.ObjectId(workspaceId),
+            environment
+        })
+    });
+
+    return res.status(200).send({
+        secret
+    });
+}

backend/src/controllers/v3/workspacesController.ts

@@ -0,0 +1,90 @@
+import { Request, Response } from 'express';
+import { Types } from 'mongoose';
+import { Secret } from '../../models';
+import { SecretService } from'../../services';
+
+/**
+ * Return whether or not all secrets in workspace with id [workspaceId]
+ * are blind-indexed
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const getWorkspaceBlindIndexStatus = async (req: Request, res: Response) => {
+    const { workspaceId } = req.params;
+
+    const secretsWithoutBlindIndex = await Secret.countDocuments({
+        workspace: new Types.ObjectId(workspaceId),
+        secretBlindIndex: {
+            $exists: false
+        }
+    });
+
+    return res.status(200).send(secretsWithoutBlindIndex === 0);
+}
+
+/**
+ * Get all secrets for workspace with id [workspaceId]
+ */
+export const getWorkspaceSecrets = async (req: Request, res: Response) => {
+    const { workspaceId } = req.params;
+
+    const secrets = await Secret.find({
+        workspace: new Types.ObjectId (workspaceId)
+    });
+    
+    return res.status(200).send({
+        secrets
+    });
+}
+
+/**
+ * Update blind indices for secrets in workspace with id [workspaceId]
+ * @param req 
+ * @param res 
+ */
+export const nameWorkspaceSecrets = async (req: Request, res: Response) => {
+    interface SecretToUpdate {
+        secretName: string;
+        _id: string;
+    }
+
+    const { workspaceId } = req.params;
+    const { 
+        secretsToUpdate 
+    }: {
+        secretsToUpdate: SecretToUpdate[];
+    } = req.body;
+
+    // get secret blind index salt
+    const salt = await SecretService.getSecretBlindIndexSalt({
+        workspaceId: new Types.ObjectId(workspaceId)
+    });
+
+    // update secret blind indices
+    const operations = await Promise.all(
+        secretsToUpdate.map(async (secretToUpdate: SecretToUpdate) => {
+            const secretBlindIndex = await SecretService.generateSecretBlindIndexWithSalt({
+                secretName: secretToUpdate.secretName,
+                salt
+            });
+    
+            return ({
+                updateOne: {
+                    filter: {
+                        _id: new Types.ObjectId(secretToUpdate._id)
+                    },
+                    update: {
+                        secretBlindIndex
+                    }
+                }
+            });
+        })
+    );
+
+    await Secret.bulkWrite(operations);
+
+    return res.status(200).send({
+        message: 'Successfully named workspace secrets'
+    });
+}

backend/src/ee/controllers/v1/membershipController.ts

@@ -2,7 +2,8 @@ import { Request, Response } from "express";
 import { Membership, Workspace } from "../../../models";
 import { IMembershipPermission } from "../../../models/membership";
 import { BadRequestError, UnauthorizedRequestError } from "../../../utils/errors";
-import { ABILITY_READ, ABILITY_WRITE, ADMIN, MEMBER } from "../../../variables/organization";
+import { ADMIN, MEMBER } from "../../../variables/organization";
+import { PERMISSION_READ_SECRETS, PERMISSION_WRITE_SECRETS } from '../../../variables';
 import { Builder } from "builder-pattern"
 import _ from "lodash";
 
@@ -10,7 +11,7 @@ export const denyMembershipPermissions = async (req: Request, res: Response) =>
   const { membershipId } = req.params;
   const { permissions } = req.body;
   const sanitizedMembershipPermissions: IMembershipPermission[] = permissions.map((permission: IMembershipPermission) => {
-    if (!permission.ability || !permission.environmentSlug || ![ABILITY_READ, ABILITY_WRITE].includes(permission.ability)) {
+    if (!permission.ability || !permission.environmentSlug || ![PERMISSION_READ_SECRETS, PERMISSION_WRITE_SECRETS].includes(permission.ability)) {
       throw BadRequestError({ message: "One or more required fields are missing from the request or have incorrect type" })
     }
 

backend/src/ee/controllers/v1/secretController.ts

@@ -146,7 +146,7 @@ export const rollbackSecretVersion = async (req: Request, res: Response) => {
 		const oldSecretVersion = await SecretVersion.findOne({
 			secret: secretId,
 			version
-		});
+		}).select('+secretBlindIndex')
 		
 		if (!oldSecretVersion) throw new Error('Failed to find secret version');
 		
@@ -155,6 +155,7 @@ export const rollbackSecretVersion = async (req: Request, res: Response) => {
 			type,
 			user,
 			environment,
+			secretBlindIndex,
 			secretKeyCiphertext,
 			secretKeyIV,
 			secretKeyTag,
@@ -174,6 +175,7 @@ export const rollbackSecretVersion = async (req: Request, res: Response) => {
 				type,
 				user,
 				environment,
+				...(secretBlindIndex ? { secretBlindIndex } : {}),
 				secretKeyCiphertext,
 				secretKeyIV,
 				secretKeyTag,
@@ -197,6 +199,7 @@ export const rollbackSecretVersion = async (req: Request, res: Response) => {
 			user,
 			environment,
 			isDeleted: false,
+			...(secretBlindIndex ? { secretBlindIndex } : {}),
 			secretKeyCiphertext,
 			secretKeyIV,
 			secretKeyTag,
@@ -207,7 +210,7 @@ export const rollbackSecretVersion = async (req: Request, res: Response) => {
 		
 		// take secret snapshot
 		await EESecretService.takeSecretSnapshot({
-			workspaceId: secret.workspace.toString()
+			workspaceId: secret.workspace
 		});
 		
 	} catch (err) {

backend/src/ee/controllers/v1/secretSnapshotController.ts

@@ -15,16 +15,10 @@ export const getSecretSnapshot = async (req: Request, res: Response) => {
 
         secretSnapshot = await SecretSnapshot
             .findById(secretSnapshotId)
-            .populate({
-                path: 'secretVersions',
-                populate: {
-                    path: 'tags',
-                    model: 'Tag',
-                }
-            });
+            .populate('secretVersions');
         
         if (!secretSnapshot) throw new Error('Failed to find secret snapshot');
-        
+
     } catch (err) {
         Sentry.setUser({ email: req.user.email });
 		Sentry.captureException(err);

backend/src/ee/controllers/v1/workspaceController.ts

@@ -173,6 +173,7 @@ export const rollbackWorkspaceSecretSnapshot = async (req: Request, res: Respons
         }
     }   
     */
+	
 	let secrets;
     try {	
         const { workspaceId } = req.params;
@@ -182,7 +183,10 @@ export const rollbackWorkspaceSecretSnapshot = async (req: Request, res: Respons
 		const secretSnapshot = await SecretSnapshot.findOne({
 			workspace: workspaceId,
 			version
-		}).populate<{ secretVersions: ISecretVersion[]}>('secretVersions');
+		}).populate<{ secretVersions: ISecretVersion[]}>({
+			path: 'secretVersions',
+			select: '+secretBlindIndex'
+		});
         
         if (!secretSnapshot) throw new Error('Failed to find secret snapshot');
 
@@ -222,6 +226,7 @@ export const rollbackWorkspaceSecretSnapshot = async (req: Request, res: Respons
 					type,
 					user,
 					environment,
+					secretBlindIndex,
 					secretKeyCiphertext,
 					secretKeyIV,
 					secretKeyTag,
@@ -240,6 +245,7 @@ export const rollbackWorkspaceSecretSnapshot = async (req: Request, res: Respons
 					type,
 					user,
 					environment,
+					secretBlindIndex: secretBlindIndex ?? undefined,
 					secretKeyCiphertext,
 					secretKeyIV,
 					secretKeyTag,
@@ -257,7 +263,7 @@ export const rollbackWorkspaceSecretSnapshot = async (req: Request, res: Respons
 		);
 		
 		// add secret versions
-		await SecretVersion.insertMany(
+		const secretV = await SecretVersion.insertMany(
 			secrets.map(({
 				_id,
 				version,
@@ -265,6 +271,7 @@ export const rollbackWorkspaceSecretSnapshot = async (req: Request, res: Respons
 				type,
 				user,
 				environment,
+				secretBlindIndex,
 				secretKeyCiphertext,
 				secretKeyIV,
 				secretKeyTag,
@@ -282,6 +289,7 @@ export const rollbackWorkspaceSecretSnapshot = async (req: Request, res: Respons
 				user,
 				environment,
 				isDeleted: false,
+				secretBlindIndex: secretBlindIndex ?? undefined,
 				secretKeyCiphertext,
 				secretKeyIV,
 				secretKeyTag,
@@ -304,7 +312,7 @@ export const rollbackWorkspaceSecretSnapshot = async (req: Request, res: Respons
 		
         // take secret snapshot
 		await EESecretService.takeSecretSnapshot({
-			workspaceId
+			workspaceId: new Types.ObjectId(workspaceId)
 		});
     } catch (err) {
         Sentry.setUser({ email: req.user.email });
@@ -418,7 +426,7 @@ export const getWorkspaceLogs = async (req: Request, res: Response) => {
 		.skip(offset)
 		.limit(limit)
 		.populate('actions')
-		.populate('user');
+		.populate('user serviceAccount serviceTokenData');
 
 	} catch (err) {
 		Sentry.setUser({ email: req.user.email });

backend/src/ee/helpers/action.ts

@@ -24,11 +24,15 @@ import {
 const createActionUpdateSecret = async ({
     name,
     userId,
+    serviceAccountId,
+    serviceTokenDataId,
     workspaceId,
     secretIds
 }: {
     name: string;
-    userId: Types.ObjectId;
+    userId?: Types.ObjectId;
+    serviceAccountId?: Types.ObjectId;
+    serviceTokenDataId?: Types.ObjectId;
     workspaceId: Types.ObjectId;
     secretIds: Types.ObjectId[];
 }) => {
@@ -46,6 +50,8 @@ const createActionUpdateSecret = async ({
         action = await new Action({
             name,
             user: userId,
+            serviceAccount: serviceAccountId,
+            serviceTokenData: serviceTokenDataId,
             workspace: workspaceId,
             payload: {
                 secretVersions: latestSecretVersions
@@ -72,11 +78,15 @@ const createActionUpdateSecret = async ({
 const createActionSecret = async ({
     name,
     userId,
+    serviceAccountId,
+    serviceTokenDataId,
     workspaceId,
     secretIds
 }: {
     name: string;
-    userId: Types.ObjectId;
+    userId?: Types.ObjectId;
+    serviceAccountId?: Types.ObjectId;
+    serviceTokenDataId?: Types.ObjectId;
     workspaceId: Types.ObjectId;
     secretIds: Types.ObjectId[];
 }) => {
@@ -94,6 +104,8 @@ const createActionSecret = async ({
        action = await new Action({
             name,
             user: userId,
+            serviceAccount: serviceAccountId,
+            serviceTokenData: serviceTokenDataId,
             workspace: workspaceId,
             payload: {
                 secretVersions: latestSecretVersions
@@ -110,29 +122,36 @@ const createActionSecret = async ({
 }
 
 /**
- * Create an (audit) action for user with id [userId]
+ * Create an (audit) action for client with id [userId],
+ * [serviceAccountId], or [serviceTokenDataId]
  * @param {Object} obj 
  * @param {String} obj.name - name of action
  * @param {String} obj.userId - id of user associated with action
  * @returns 
  */
-const createActionUser = ({
+const createActionClient = ({
     name,
-    userId
+    userId,
+    serviceAccountId,
+    serviceTokenDataId
 }: {
     name: string;
-    userId: Types.ObjectId;
+    userId?: Types.ObjectId;
+    serviceAccountId?: Types.ObjectId;
+    serviceTokenDataId?: Types.ObjectId;
 }) => {
     let action;
     try {
         action = new Action({
             name,
-            user: userId
+            user: userId,
+            serviceAccount: serviceAccountId,
+            serviceTokenData: serviceTokenDataId
         }).save();
     } catch (err) {
         Sentry.setUser(null);
         Sentry.captureException(err);
-        throw new Error('Failed to create user action');
+        throw new Error('Failed to create client action');
     }
 
     return action; 
@@ -149,11 +168,15 @@ const createActionUser = ({
 const createActionHelper = async ({
     name,
     userId,
+    serviceAccountId,
+    serviceTokenDataId,
     workspaceId,
     secretIds,
 }: {
     name: string;
-    userId: Types.ObjectId;
+    userId?: Types.ObjectId;
+    serviceAccountId?: Types.ObjectId;
+    serviceTokenDataId?: Types.ObjectId;
     workspaceId?: Types.ObjectId;
     secretIds?: Types.ObjectId[];
 }) => {
@@ -162,7 +185,7 @@ const createActionHelper = async ({
         switch (name) {
             case ACTION_LOGIN:
             case ACTION_LOGOUT:
-                action = await createActionUser({
+                action = await createActionClient({
                     name,
                     userId
                 });

backend/src/ee/helpers/checkMembershipPermissions.ts

@@ -1,8 +1,9 @@
+import { Types } from 'mongoose';
 import _ from "lodash";
 import { Membership } from "../../models";
-import { ABILITY_READ, ABILITY_WRITE } from "../../variables/organization";
+import { PERMISSION_READ_SECRETS, PERMISSION_WRITE_SECRETS } from '../../variables';
 
-export const userHasWorkspaceAccess = async (userId: any, workspaceId: any, environment: any, action: any) => {
+export const userHasWorkspaceAccess = async (userId: Types.ObjectId, workspaceId: Types.ObjectId, environment: string, action: any) => {
   const membershipForWorkspace = await Membership.findOne({ workspace: workspaceId, user: userId })
   if (!membershipForWorkspace) {
     return false
@@ -18,15 +19,15 @@ export const userHasWorkspaceAccess = async (userId: any, workspaceId: any, envi
   return true
 }
 
-export const userHasWriteOnlyAbility = async (userId: any, workspaceId: any, environment: any) => {
+export const userHasWriteOnlyAbility = async (userId: Types.ObjectId, workspaceId: Types.ObjectId, environment: string) => {
   const membershipForWorkspace = await Membership.findOne({ workspace: workspaceId, user: userId })
   if (!membershipForWorkspace) {
     return false
   }
 
   const deniedMembershipPermissions = membershipForWorkspace.deniedPermissions;
-  const isWriteDisallowed = _.some(deniedMembershipPermissions, { environmentSlug: environment, ability: ABILITY_WRITE });
-  const isReadDisallowed = _.some(deniedMembershipPermissions, { environmentSlug: environment, ability: ABILITY_READ });
+  const isWriteDisallowed = _.some(deniedMembershipPermissions, { environmentSlug: environment, ability: PERMISSION_WRITE_SECRETS });
+  const isReadDisallowed = _.some(deniedMembershipPermissions, { environmentSlug: environment, ability: PERMISSION_READ_SECRETS });
 
   // case: you have write only if read is blocked and write is not
   if (isReadDisallowed && !isWriteDisallowed) {
@@ -36,15 +37,15 @@ export const userHasWriteOnlyAbility = async (userId: any, workspaceId: any, env
   return false
 }
 
-export const userHasNoAbility = async (userId: any, workspaceId: any, environment: any) => {
+export const userHasNoAbility = async (userId: Types.ObjectId, workspaceId: Types.ObjectId, environment: string) => {
   const membershipForWorkspace = await Membership.findOne({ workspace: workspaceId, user: userId })
   if (!membershipForWorkspace) {
     return true
   }
 
   const deniedMembershipPermissions = membershipForWorkspace.deniedPermissions;
-  const isWriteDisallowed = _.some(deniedMembershipPermissions, { environmentSlug: environment, ability: ABILITY_WRITE });
-  const isReadBlocked = _.some(deniedMembershipPermissions, { environmentSlug: environment, ability: ABILITY_READ });
+  const isWriteDisallowed = _.some(deniedMembershipPermissions, { environmentSlug: environment, ability: PERMISSION_WRITE_SECRETS });
+  const isReadBlocked = _.some(deniedMembershipPermissions, { environmentSlug: environment, ability: PERMISSION_READ_SECRETS });
 
   if (isReadBlocked && isWriteDisallowed) {
     return true

backend/src/ee/helpers/log.ts

@@ -4,6 +4,7 @@ import {
     Log,
     IAction
 } from '../models';
+
 /**
  * Create an (audit) log
  * @param {Object} obj
@@ -16,12 +17,16 @@ import {
  */
 const createLogHelper = async ({
     userId,
+    serviceAccountId,
+    serviceTokenDataId,
     workspaceId,
     actions,
     channel,
     ipAddress
 }: {
-    userId: Types.ObjectId;
+    userId?: Types.ObjectId;
+    serviceAccountId?: Types.ObjectId;
+    serviceTokenDataId?: Types.ObjectId;
     workspaceId?: Types.ObjectId;
     actions: IAction[];
     channel: string;
@@ -31,6 +36,8 @@ const createLogHelper = async ({
     try {
         log = await new Log({
             user: userId,
+            serviceAccount: serviceAccountId,
+            serviceTokenData: serviceTokenDataId,
             workspace: workspaceId ?? undefined,
             actionNames: actions.map((a) => a.name),
             actions,

backend/src/ee/helpers/secret.ts

@@ -2,7 +2,7 @@ import { Types } from 'mongoose';
 import * as Sentry from '@sentry/node';
 import {
 	Secret,
-	ISecret
+	ISecret,
 } from '../../models';
 import {
 	SecretSnapshot,
@@ -21,7 +21,7 @@ import {
 const takeSecretSnapshotHelper = async ({
 	workspaceId
 }: {
-	workspaceId: string;
+	workspaceId: Types.ObjectId;
 }) => {
 
 	let secretSnapshot;
@@ -143,7 +143,7 @@ const initSecretVersioningHelper = async () => {
 
 		if (unversionedSecrets.length > 0) {
 			await addSecretVersionsHelper({
-				secretVersions: unversionedSecrets.map((s, idx) => ({
+				secretVersions: unversionedSecrets.map((s, idx) => new SecretVersion({
 					...s,
 					secret: s._id,
 					version: s.version ? s.version : 1,

backend/src/ee/middleware/requireSecretSnapshotAuth.ts

@@ -15,32 +15,28 @@ import {
 const requireSecretSnapshotAuth = ({
     acceptedRoles,
 }: {
-    acceptedRoles: string[];
+    acceptedRoles: Array<'admin' | 'member'>;
 }) => {
     return async (req: Request, res: Response, next: NextFunction) => {
-        try {
-            const { secretSnapshotId } = req.params;
-            
-            const secretSnapshot = await SecretSnapshot.findById(secretSnapshotId);
-            
-            if (!secretSnapshot) {
-                return next(SecretSnapshotNotFoundError({
-                    message: 'Failed to find secret snapshot'
-                }));
-            }
-            
-            await validateMembership({
-                userId: req.user._id.toString(),
-                workspaceId: secretSnapshot.workspace.toString(),
-                acceptedRoles
-            });
-            
-            req.secretSnapshot = secretSnapshot as any;
-
-            next();
-        } catch (err) {
-            return next(UnauthorizedRequestError({ message: 'Unable to authenticate secret snapshot' }));
+        const { secretSnapshotId } = req.params;
+        
+        const secretSnapshot = await SecretSnapshot.findById(secretSnapshotId);
+        
+        if (!secretSnapshot) {
+            return next(SecretSnapshotNotFoundError({
+                message: 'Failed to find secret snapshot'
+            }));
         }
+        
+        await validateMembership({
+            userId: req.user._id,
+            workspaceId: secretSnapshot.workspace,
+            acceptedRoles
+        });
+        
+        req.secretSnapshot = secretSnapshot as any;
+
+        next();
     }
 }
 

backend/src/ee/models/action.ts

@@ -11,6 +11,8 @@ import {
 export interface IAction {
     name: string;
     user?: Types.ObjectId,
+    serviceAccount?: Types.ObjectId,
+    serviceTokenData?: Types.ObjectId,
     workspace?: Types.ObjectId,
     payload?: {
         secretVersions?: Types.ObjectId[]
@@ -33,8 +35,15 @@ const actionSchema = new Schema<IAction>(
         },
         user: {
             type: Schema.Types.ObjectId,
-            ref: 'User',
-            required: true
+            ref: 'User'
+        },
+        serviceAccount: {
+            type: Schema.Types.ObjectId,
+            ref: 'ServiceAccount'
+        },
+        serviceTokenData: {
+            type: Schema.Types.ObjectId,
+            ref: 'ServiceTokenData'
         },
         workspace: {
             type: Schema.Types.ObjectId,

backend/src/ee/models/log.ts

@@ -11,6 +11,8 @@ import {
 export interface ILog {
     _id: Types.ObjectId;
     user?: Types.ObjectId;
+    serviceAccount?: Types.ObjectId;
+    serviceTokenData?: Types.ObjectId;
     workspace?: Types.ObjectId;
     actionNames: string[];
     actions: Types.ObjectId[];
@@ -24,6 +26,14 @@ const logSchema = new Schema<ILog>(
             type: Schema.Types.ObjectId,
             ref: 'User'
         },
+        serviceAccount: {
+            type: Schema.Types.ObjectId,
+            ref: 'ServiceAccount'
+        },
+        serviceTokenData: {
+            type: Schema.Types.ObjectId,
+            ref: 'ServiceTokenData'
+        },
         workspace: {
             type: Schema.Types.ObjectId,
             ref: 'Workspace'

backend/src/ee/models/secretVersion.ts

@@ -5,6 +5,7 @@ import {
 } from '../../variables';
 
 export interface ISecretVersion {
+	_id: Types.ObjectId;
 	secret: Types.ObjectId;
 	version: number;
 	workspace: Types.ObjectId; // new
@@ -12,13 +13,13 @@ export interface ISecretVersion {
 	user?: Types.ObjectId; // new
 	environment: string; // new
 	isDeleted: boolean;
+	secretBlindIndex?: string;
 	secretKeyCiphertext: string;
 	secretKeyIV: string;
 	secretKeyTag: string;
 	secretValueCiphertext: string;
 	secretValueIV: string;
 	secretValueTag: string;
-	tags?: string[];
 }
 
 const secretVersionSchema = new Schema<ISecretVersion>(
@@ -57,6 +58,10 @@ const secretVersionSchema = new Schema<ISecretVersion>(
 			default: false,
 			required: true
 		},
+		secretBlindIndex: {
+			type: String,
+			select: false
+		},
 		secretKeyCiphertext: {
 			type: String,
 			required: true
@@ -80,12 +85,7 @@ const secretVersionSchema = new Schema<ISecretVersion>(
 		secretValueTag: {
 			type: String, // symmetric
 			required: true
-		},
-		tags: {
-			ref: 'Tag',
-			type: [Schema.Types.ObjectId],
-			default: []
-		},
+		}
 	},
 	{
 		timestamps: true

backend/src/ee/routes/v1/secret.ts

@@ -7,7 +7,12 @@ import {
 } from '../../../middleware';
 import { query, param, body } from 'express-validator';
 import { secretController } from '../../controllers/v1';
-import { ADMIN, MEMBER } from '../../../variables';
+import {
+	ADMIN, 
+	MEMBER,
+	PERMISSION_READ_SECRETS,
+	PERMISSION_WRITE_SECRETS
+} from '../../../variables';
 
 router.get(
 	'/:secretId/secret-versions',
@@ -15,7 +20,8 @@ router.get(
 		acceptedAuthModes: ['jwt', 'apiKey']
 	}),
 	requireSecretAuth({
-		acceptedRoles: [ADMIN, MEMBER]
+		acceptedRoles: [ADMIN, MEMBER],
+		requiredPermissions: [PERMISSION_READ_SECRETS]
 	}),
 	param('secretId').exists().trim(),
 	query('offset').exists().isInt(),
@@ -30,7 +36,8 @@ router.post(
 		acceptedAuthModes: ['jwt', 'apiKey']
 	}),
 	requireSecretAuth({
-		acceptedRoles: [ADMIN, MEMBER]
+		acceptedRoles: [ADMIN, MEMBER],
+		requiredPermissions: [PERMISSION_READ_SECRETS, PERMISSION_WRITE_SECRETS]
 	}),
 	param('secretId').exists().trim(),
 	body('version').exists().isInt(),

backend/src/ee/routes/v1/workspace.ts

@@ -15,7 +15,8 @@ router.get(
 		acceptedAuthModes: ['jwt', 'apiKey']
 	}),
 	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER]
+		acceptedRoles: [ADMIN, MEMBER],
+		locationWorkspaceId: 'params'
 	}),
 	param('workspaceId').exists().trim(),
 	query('offset').exists().isInt(),
@@ -30,7 +31,8 @@ router.get(
 		acceptedAuthModes: ['jwt']
 	}),
 	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER]
+		acceptedRoles: [ADMIN, MEMBER],
+		locationWorkspaceId: 'params'
 	}),
 	param('workspaceId').exists().trim(),
 	validateRequest,
@@ -43,7 +45,8 @@ router.post(
 		acceptedAuthModes: ['jwt', 'apiKey']
 	}),
 	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER]
+		acceptedRoles: [ADMIN, MEMBER],
+		locationWorkspaceId: 'params'
 	}),
 	param('workspaceId').exists().trim(),
 	body('version').exists().isInt(),
@@ -57,7 +60,8 @@ router.get(
 		acceptedAuthModes: ['jwt', 'apiKey']
 	}),
 	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER]
+		acceptedRoles: [ADMIN, MEMBER],
+		locationWorkspaceId: 'params'
 	}),
 	param('workspaceId').exists().trim(),
 	query('offset').exists().isInt(),

backend/src/ee/services/EELogService.ts

@@ -26,12 +26,16 @@ class EELogService {
      */
     static async createLog({
         userId,
+        serviceAccountId,
+        serviceTokenDataId,
         workspaceId,
         actions,
         channel,
         ipAddress
     }: {
-        userId: Types.ObjectId;
+        userId?: Types.ObjectId;
+        serviceAccountId?: Types.ObjectId;
+        serviceTokenDataId?: Types.ObjectId;
         workspaceId?: Types.ObjectId;
         actions: IAction[];
         channel: string;
@@ -40,6 +44,8 @@ class EELogService {
         if (!EELicenseService.isLicenseValid) return null;
         return await createLogHelper({
             userId,
+            serviceAccountId,
+            serviceTokenDataId,
             workspaceId,
             actions,
             channel,
@@ -59,17 +65,23 @@ class EELogService {
     static async createAction({
         name,
         userId,
+        serviceAccountId,
+        serviceTokenDataId,
         workspaceId,
         secretIds
     }: {
         name: string;
-        userId: Types.ObjectId;
+        userId?: Types.ObjectId;
+        serviceAccountId?: Types.ObjectId;
+        serviceTokenDataId?: Types.ObjectId;
         workspaceId?: Types.ObjectId;
         secretIds?: Types.ObjectId[];
     }) {
         return await createActionHelper({
             name,
             userId,
+            serviceAccountId,
+            serviceTokenDataId,
             workspaceId,
             secretIds
         });

backend/src/ee/services/EESecretService.ts

@@ -25,7 +25,7 @@ class EESecretService {
     static async takeSecretSnapshot({
         workspaceId
     }: {
-        workspaceId: string;
+        workspaceId: Types.ObjectId;
     }) {
         if (!EELicenseService.isLicenseValid) return;
         return await takeSecretSnapshotHelper({ workspaceId });

backend/src/events/secret.ts

@@ -1,3 +1,4 @@
+import { Types } from 'mongoose';
 import { 
     EVENT_PUSH_SECRETS, 
     EVENT_PULL_SECRETS 
@@ -22,13 +23,16 @@ interface PushSecret {
  * @returns 
  */
 const eventPushSecrets = ({
-    workspaceId
+    workspaceId,
+    environment
 }: {
-    workspaceId: string;
+    workspaceId: Types.ObjectId;
+    environment?: string;
 }) => {
     return ({
         name: EVENT_PUSH_SECRETS,
         workspaceId,
+        environment,
         payload: {
 
         }

backend/src/helpers/auth.ts

@@ -1,15 +1,18 @@
 import * as Sentry from '@sentry/node';
+import { Types } from 'mongoose';
 import jwt from 'jsonwebtoken';
 import bcrypt from 'bcrypt';
 import {
 	IUser,
 	User,
 	ServiceTokenData,
+	ServiceAccount,
 	APIKeyData
 } from '../models';
 import {
 	AccountNotFoundError,
 	ServiceTokenDataNotFoundError,
+	ServiceAccountNotFoundError,
 	APIKeyDataNotFoundError,
 	UnauthorizedRequestError,
 	BadRequestError
@@ -20,6 +23,12 @@ import {
 	getJwtRefreshLifetime,
 	getJwtRefreshSecret
 } from '../config';
+import {
+	AUTH_MODE_JWT,
+	AUTH_MODE_SERVICE_ACCOUNT,
+	AUTH_MODE_SERVICE_TOKEN,
+	AUTH_MODE_API_KEY
+} from '../variables';
 
 /**
  * 
@@ -37,7 +46,7 @@ const validateAuthMode = ({
 	const apiKey = headers['x-api-key'];
 	const authHeader = headers['authorization'];
 
-	let authTokenType, authTokenValue;
+	let authMode, authTokenValue;
 	if (apiKey === undefined && authHeader === undefined) {
 		// case: no auth or X-API-KEY header present
 		throw BadRequestError({ message: 'Missing Authorization or X-API-KEY in request header.' });
@@ -45,7 +54,7 @@ const validateAuthMode = ({
 
 	if (typeof apiKey === 'string') {
 		// case: treat request authentication type as via X-API-KEY (i.e. API Key)
-		authTokenType = 'apiKey';
+		authMode = AUTH_MODE_API_KEY;
 		authTokenValue = apiKey;
 	}
 
@@ -61,20 +70,24 @@ const validateAuthMode = ({
 
 		switch (tokenValue.split('.', 1)[0]) {
 			case 'st':
-				authTokenType = 'serviceToken';
+				authMode = AUTH_MODE_SERVICE_TOKEN;
+				break;
+			case 'sa':
+				authMode = AUTH_MODE_SERVICE_ACCOUNT;
 				break;
 			default:
-				authTokenType = 'jwt';
+				authMode = AUTH_MODE_JWT;
 		}
+
 		authTokenValue = tokenValue;
 	}
 
-	if (!authTokenType || !authTokenValue) throw BadRequestError({ message: 'Missing valid Authorization or X-API-KEY in request header.' });
+	if (!authMode || !authTokenValue) throw BadRequestError({ message: 'Missing valid Authorization or X-API-KEY in request header.' });
 
-	if (!acceptedAuthModes.includes(authTokenType)) throw BadRequestError({ message: 'The provided authentication type is not supported.' });
+	if (!acceptedAuthModes.includes(authMode)) throw BadRequestError({ message: 'The provided authentication type is not supported.' });
 
 	return ({
-		authTokenType,
+		authMode,
 		authTokenValue
 	});
 }
@@ -90,25 +103,17 @@ const getAuthUserPayload = async ({
 }: {
 	authTokenValue: string;
 }) => {
-	let user;
-	try {
-		const decodedToken = <jwt.UserIDJwtPayload>(
-			jwt.verify(authTokenValue, getJwtAuthSecret())
-		);
+	const decodedToken = <jwt.UserIDJwtPayload>(
+		jwt.verify(authTokenValue, getJwtAuthSecret())
+	);
 
-		user = await User.findOne({
-			_id: decodedToken.userId
-		}).select('+publicKey');
+	const user = await User.findOne({
+		_id: decodedToken.userId
+	}).select('+publicKey');
 
-		if (!user) throw AccountNotFoundError({ message: 'Failed to find User' });
+	if (!user) throw AccountNotFoundError({ message: 'Failed to find User' });
 
-		if (!user?.publicKey) throw UnauthorizedRequestError({ message: 'Failed to authenticate User with partially set up account' });
-
-	} catch (err) {
-		throw UnauthorizedRequestError({
-			message: 'Failed to authenticate JWT token'
-		});
-	}
+	if (!user?.publicKey) throw UnauthorizedRequestError({ message: 'Failed to authenticate User with partially set up account' });
 
 	return user;
 }
@@ -124,45 +129,70 @@ const getAuthSTDPayload = async ({
 }: {
 	authTokenValue: string;
 }) => {
-	let serviceTokenData;
-	try {
-		const [_, TOKEN_IDENTIFIER, TOKEN_SECRET] = <[string, string, string]>authTokenValue.split('.', 3);
+	const [_, TOKEN_IDENTIFIER, TOKEN_SECRET] = <[string, string, string]>authTokenValue.split('.', 3);
 
-		// TODO: optimize double query
-		serviceTokenData = await ServiceTokenData
-			.findById(TOKEN_IDENTIFIER, '+secretHash +expiresAt');
+	let serviceTokenData = await ServiceTokenData
+		.findById(TOKEN_IDENTIFIER, '+secretHash +expiresAt');
 
-		if (!serviceTokenData) {
-			throw ServiceTokenDataNotFoundError({ message: 'Failed to find service token data' });
-		} else if (serviceTokenData?.expiresAt && new Date(serviceTokenData.expiresAt) < new Date()) {
-			// case: service token expired
-			await ServiceTokenData.findByIdAndDelete(serviceTokenData._id);
-			throw UnauthorizedRequestError({
-				message: 'Failed to authenticate expired service token'
-			});
-		}
-
-		const isMatch = await bcrypt.compare(TOKEN_SECRET, serviceTokenData.secretHash);
-		if (!isMatch) throw UnauthorizedRequestError({
-			message: 'Failed to authenticate service token'
-		});
-
-		serviceTokenData = await ServiceTokenData
-			.findById(TOKEN_IDENTIFIER)
-			.select('+encryptedKey +iv +tag')
-			.populate<{user: IUser}>('user');
-		
-		if (!serviceTokenData) throw ServiceTokenDataNotFoundError({ message: 'Failed to find service token data' });
-
-	} catch (err) {
+	if (!serviceTokenData) {
+		throw ServiceTokenDataNotFoundError({ message: 'Failed to find service token data' });
+	} else if (serviceTokenData?.expiresAt && new Date(serviceTokenData.expiresAt) < new Date()) {
+		// case: service token expired
+		await ServiceTokenData.findByIdAndDelete(serviceTokenData._id);
 		throw UnauthorizedRequestError({
-			message: 'Failed to authenticate service token'
+			message: 'Failed to authenticate expired service token'
 		});
 	}
 
+	const isMatch = await bcrypt.compare(TOKEN_SECRET, serviceTokenData.secretHash);
+	if (!isMatch) throw UnauthorizedRequestError({
+		message: 'Failed to authenticate service token'
+	});
+
+	serviceTokenData = await ServiceTokenData
+		.findOneAndUpdate({
+			_id: new Types.ObjectId(TOKEN_IDENTIFIER)
+		}, {
+			lastUsed: new Date()
+		}, {
+			new: true
+		})
+		.select('+encryptedKey +iv +tag');
+
+	if (!serviceTokenData) throw ServiceTokenDataNotFoundError({ message: 'Failed to find service token data' });
+
 	return serviceTokenData;
 }
 
+/**
+ * Return service account access key payload
+ * @param {Object} obj
+ * @param {String} obj.authTokenValue - service account access token value
+ * @returns {ServiceAccount} serviceAccount
+ */
+const getAuthSAAKPayload = async ({
+	authTokenValue
+}: {
+	authTokenValue: string;
+}) => {
+	const [_, TOKEN_IDENTIFIER, TOKEN_SECRET] = <[string, string, string]>authTokenValue.split('.', 3);
+
+	const serviceAccount = await ServiceAccount.findById(
+		Buffer.from(TOKEN_IDENTIFIER, 'base64').toString('hex')
+	).select('+secretHash');
+
+	if (!serviceAccount) {
+		throw ServiceAccountNotFoundError({ message: 'Failed to find service account' });
+	}
+
+	const result = await bcrypt.compare(TOKEN_SECRET, serviceAccount.secretHash);
+	if (!result) throw UnauthorizedRequestError({
+		message: 'Failed to authenticate service account access key'
+	});
+
+	return serviceAccount;
+}
+
 /**
  * Return API key data payload corresponding to API key [authTokenValue]
  * @param {Object} obj
@@ -174,33 +204,44 @@ const getAuthAPIKeyPayload = async ({
 }: {
 	authTokenValue: string;
 }) => {
-	let user;
-	try {
-		const [_, TOKEN_IDENTIFIER, TOKEN_SECRET] = <[string, string, string]>authTokenValue.split('.', 3);
+	const [_, TOKEN_IDENTIFIER, TOKEN_SECRET] = <[string, string, string]>authTokenValue.split('.', 3);
 
-		const apiKeyData = await APIKeyData
-			.findById(TOKEN_IDENTIFIER, '+secretHash +expiresAt')
-			.populate('user', '+publicKey');
+	let apiKeyData = await APIKeyData
+		.findById(TOKEN_IDENTIFIER, '+secretHash +expiresAt')
+		.populate<{ user: IUser }>('user', '+publicKey');
 
-		if (!apiKeyData) {
-			throw APIKeyDataNotFoundError({ message: 'Failed to find API key data' });
-		} else if (apiKeyData?.expiresAt && new Date(apiKeyData.expiresAt) < new Date()) {
-			// case: API key expired
-			await APIKeyData.findByIdAndDelete(apiKeyData._id);
-			throw UnauthorizedRequestError({
-				message: 'Failed to authenticate expired API key'
-			});
-		}
-
-		const isMatch = await bcrypt.compare(TOKEN_SECRET, apiKeyData.secretHash);
-		if (!isMatch) throw UnauthorizedRequestError({
-			message: 'Failed to authenticate API key'
-		});
-
-		user = apiKeyData.user;
-	} catch (err) {
+	if (!apiKeyData) {
+		throw APIKeyDataNotFoundError({ message: 'Failed to find API key data' });
+	} else if (apiKeyData?.expiresAt && new Date(apiKeyData.expiresAt) < new Date()) {
+		// case: API key expired
+		await APIKeyData.findByIdAndDelete(apiKeyData._id);
 		throw UnauthorizedRequestError({
-			message: 'Failed to authenticate API key'
+			message: 'Failed to authenticate expired API key'
+		});
+	}
+
+	const isMatch = await bcrypt.compare(TOKEN_SECRET, apiKeyData.secretHash);
+	if (!isMatch) throw UnauthorizedRequestError({
+		message: 'Failed to authenticate API key'
+	});
+
+	apiKeyData = await APIKeyData.findOneAndUpdate({
+		_id: new Types.ObjectId(TOKEN_IDENTIFIER)
+	}, {
+		lastUsed: new Date()
+	}, {
+		new: true
+	});
+
+	if (!apiKeyData) {
+		throw APIKeyDataNotFoundError({ message: 'Failed to find API key data' });
+	}
+
+	const user = await User.findById(apiKeyData.user).select('+publicKey');
+
+	if (!user) {
+		throw AccountNotFoundError({
+			message: 'Failed to find user'
 		});
 	}
 
@@ -216,30 +257,23 @@ const getAuthAPIKeyPayload = async ({
  * @return {String} obj.refreshToken - issued refresh token
  */
 const issueAuthTokens = async ({ userId }: { userId: string }) => {
-	let token: string;
-	let refreshToken: string;
-	try {
-		// issue tokens
-		token = createToken({
-			payload: {
-				userId
-			},
-			expiresIn: getJwtAuthLifetime(),
-			secret: getJwtAuthSecret()
-		});
 
-		refreshToken = createToken({
-			payload: {
-				userId
-			},
-			expiresIn: getJwtRefreshLifetime(),
-			secret: getJwtRefreshSecret()
-		});
-	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-		throw new Error('Failed to issue tokens');
-	}
+	// issue tokens
+	const token = createToken({
+		payload: {
+			userId
+		},
+		expiresIn: getJwtAuthLifetime(),
+		secret: getJwtAuthSecret()
+	});
+
+	const refreshToken = createToken({
+		payload: {
+			userId
+		},
+		expiresIn: getJwtRefreshLifetime(),
+		secret: getJwtRefreshSecret()
+	});
 
 	return {
 		token,
@@ -253,19 +287,14 @@ const issueAuthTokens = async ({ userId }: { userId: string }) => {
  * @param {String} obj.userId - id of user whose tokens are cleared.
  */
 const clearTokens = async ({ userId }: { userId: string }): Promise<void> => {
-	try {
-		// increment refreshVersion on user by 1
-		User.findOneAndUpdate({
-			_id: userId
-		}, {
-			$inc: {
-				refreshVersion: 1
-			}
-		});
-	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-	}
+	// increment refreshVersion on user by 1
+	User.findOneAndUpdate({
+		_id: userId
+	}, {
+		$inc: {
+			refreshVersion: 1
+		}
+	});
 };
 
 /**
@@ -285,21 +314,16 @@ const createToken = ({
 	expiresIn: string | number;
 	secret: string;
 }) => {
-	try {
-		return jwt.sign(payload, secret, {
-			expiresIn
-		});
-	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-		throw new Error('Failed to create a token');
-	}
+	return jwt.sign(payload, secret, {
+		expiresIn
+	});
 };
 
 export {
 	validateAuthMode,
 	getAuthUserPayload,
 	getAuthSTDPayload,
+	getAuthSAAKPayload,
 	getAuthAPIKeyPayload,
 	createToken,
 	issueAuthTokens,

backend/src/helpers/bot.ts

@@ -1,10 +1,16 @@
 import * as Sentry from '@sentry/node';
+import { Types } from 'mongoose';
 import {
     Bot,
     BotKey,
     Secret,
     ISecret,
-    IUser
+    IUser,
+    User,
+    IServiceAccount,
+    ServiceAccount,
+    IServiceTokenData,
+    ServiceTokenData
 } from '../models';
 import { 
     generateKeyPair, 
@@ -12,8 +18,88 @@ import {
     decryptSymmetric,
     decryptAsymmetric
 } from '../utils/crypto';
-import { SECRET_SHARED } from '../variables';
+import {
+    SECRET_SHARED,
+    AUTH_MODE_JWT,
+    AUTH_MODE_SERVICE_ACCOUNT,
+    AUTH_MODE_SERVICE_TOKEN,
+    AUTH_MODE_API_KEY
+} from '../variables';
 import { getEncryptionKey } from '../config';
+import { BotNotFoundError, UnauthorizedRequestError } from '../utils/errors';
+import {
+    validateMembership
+} from '../helpers/membership';
+import {
+    validateUserClientForWorkspace
+} from '../helpers/user';
+import {
+    validateServiceAccountClientForWorkspace
+} from '../helpers/serviceAccount';
+
+/**
+ * Validate authenticated clients for bot with id [botId] based
+ * on any known permissions.
+ * @param {Object} obj
+ * @param {Object} obj.authData - authenticated client details
+ * @param {Types.ObjectId} obj.botId - id of bot to validate against
+ * @param {Array<'admin' | 'member'>} obj.acceptedRoles - accepted workspace roles
+ */
+const validateClientForBot = async ({
+    authData,
+    botId,
+    acceptedRoles
+}: {
+    authData: {
+		authMode: string;
+		authPayload: IUser | IServiceAccount | IServiceTokenData;
+	};
+    botId: Types.ObjectId;
+    acceptedRoles: Array<'admin' | 'member'>;
+}) => {
+    const bot = await Bot.findById(botId);
+    
+    if (!bot) throw BotNotFoundError();
+    
+    if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
+        await validateUserClientForWorkspace({
+            user: authData.authPayload,
+            workspaceId: bot.workspace,
+            acceptedRoles
+        });
+        
+        return bot;
+    }
+
+    if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
+        await validateServiceAccountClientForWorkspace({
+            serviceAccount: authData.authPayload,
+            workspaceId: bot.workspace
+        });
+
+        return bot;
+    }
+
+    if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
+        throw UnauthorizedRequestError({
+            message: 'Failed service token authorization for bot'
+        });
+    }
+
+    if (authData.authMode === AUTH_MODE_API_KEY && authData.authPayload instanceof User) {
+        await validateUserClientForWorkspace({
+            user: authData.authPayload,
+            workspaceId: bot.workspace,
+            acceptedRoles
+        });
+        
+        return bot;
+    }
+    
+    throw BotNotFoundError({
+        message: 'Failed client authorization for bot'
+    });
+}
 
 /**
  * Create an inactive bot with name [name] for workspace with id [workspaceId]
@@ -26,7 +112,7 @@ const createBot = async ({
     workspaceId,
 }: {
     name: string;
-    workspaceId: string;
+    workspaceId: Types.ObjectId;
 }) => {
     let bot;
     try {
@@ -65,7 +151,7 @@ const getSecretsHelper = async ({
     workspaceId,
     environment
 }: {
-    workspaceId: string;
+    workspaceId: Types.ObjectId;
     environment: string;
 }) => {
     const content = {} as any;
@@ -110,7 +196,7 @@ const getSecretsHelper = async ({
  * @param {String} obj.workspaceId - id of workspace
  * @returns {String} key - decrypted workspace key
  */
-const getKey = async ({ workspaceId }: { workspaceId: string }) => {
+const getKey = async ({ workspaceId }: { workspaceId: Types.ObjectId }) => {
     let key;
     try {
         const botKey = await BotKey.findOne({
@@ -159,7 +245,7 @@ const encryptSymmetricHelper = async ({
     workspaceId,
     plaintext
 }: {
-    workspaceId: string;
+    workspaceId: Types.ObjectId;
     plaintext: string;
 }) => {
     
@@ -196,7 +282,7 @@ const decryptSymmetricHelper = async ({
     iv,
     tag
 }: {
-    workspaceId: string;
+    workspaceId: Types.ObjectId;
     ciphertext: string;
     iv: string;
     tag: string;
@@ -222,6 +308,7 @@ const decryptSymmetricHelper = async ({
 }
 
 export {
+    validateClientForBot,
     createBot,
     getSecretsHelper,
     encryptSymmetricHelper,

backend/src/helpers/database.ts

@@ -1,5 +1,6 @@
 import mongoose from 'mongoose';
 import { EESecretService } from '../ee/services';
+import { SecretService } from '../services';
 import { getLogger } from '../utils/logger';
 
 /**
@@ -22,6 +23,7 @@ const initDatabaseHelper = async ({
         getLogger("database").info("Database connection established");
         
         await EESecretService.initSecretVersioning();
+        await SecretService.initSecretBlindIndexDataHelper();
     } catch (err) {
         getLogger("database").error(`Unable to establish Database connection due to the error.\n${err}`);
     }

backend/src/helpers/event.ts

@@ -1,11 +1,13 @@
-import { Bot, IBot } from '../models';
+import { Types } from 'mongoose';
 import * as Sentry from '@sentry/node';
+import { Bot, IBot } from '../models';
 import { EVENT_PUSH_SECRETS } from '../variables';
 import { IntegrationService } from '../services';
 
 interface Event {
     name: string;
-    workspaceId: string;
+    workspaceId: Types.ObjectId;
+    environment?: string;
     payload: any;
 }
 
@@ -22,7 +24,10 @@ const handleEventHelper = async ({
 }: {
     event: Event;
 }) => {
-    const { workspaceId } = event;
+    const { 
+        workspaceId,
+        environment
+    } = event;
     
     // TODO: moduralize bot check into separate function
     const bot = await Bot.findOne({
@@ -36,7 +41,8 @@ const handleEventHelper = async ({
         switch (event.name) {
             case EVENT_PUSH_SECRETS:
                 IntegrationService.syncIntegrations({
-                    workspaceId
+                    workspaceId,
+                    environment
                 });
                 break;
         }

backend/src/helpers/integration.ts

@@ -1,17 +1,42 @@
 import * as Sentry from '@sentry/node';
+import { Types } from 'mongoose';
 import {
     Bot,
     Integration,
     IntegrationAuth,
+    IUser,
+    User,
+    IServiceAccount,
+    ServiceAccount,
+    IServiceTokenData,
+    ServiceTokenData
 } from '../models';
 import { exchangeCode, exchangeRefresh, syncSecrets } from '../integrations';
 import { BotService } from '../services';
 import {
+    AUTH_MODE_JWT,
+	AUTH_MODE_SERVICE_ACCOUNT,
+	AUTH_MODE_SERVICE_TOKEN,
+	AUTH_MODE_API_KEY,
     INTEGRATION_VERCEL,
     INTEGRATION_NETLIFY
 } from '../variables';
-import { UnauthorizedRequestError } from '../utils/errors';
+import { 
+    UnauthorizedRequestError,
+    IntegrationAuthNotFoundError,
+    IntegrationNotFoundError
+} from '../utils/errors';
 import RequestError from '../utils/requestError';
+import {
+    validateClientForIntegrationAuth 
+} from '../helpers/integrationAuth';
+import {
+    validateUserClientForWorkspace
+} from '../helpers/user';
+import {
+    validateServiceAccountClientForWorkspace
+} from '../helpers/serviceAccount';
+import { IntegrationService } from '../services';
 
 interface Update {
     workspace: string;
@@ -20,6 +45,84 @@ interface Update {
     accountId?: string;
 }
 
+/**
+ * Validate authenticated clients for integration with id [integrationId] based
+ * on any known permissions.
+ * @param {Object} obj
+ * @param {Object} obj.authData - authenticated client details
+ * @param {Types.ObjectId} obj.integrationId - id of integration to validate against
+ * @param {String} obj.environment - (optional) environment in workspace to validate against
+ * @param {Array<'admin' | 'member'>} obj.acceptedRoles - accepted workspace roles
+ * @param {String[]} obj.requiredPermissions - required permissions as part of the endpoint
+ */
+ const validateClientForIntegration = async ({
+    authData,
+    integrationId,
+    acceptedRoles
+}: {
+    authData: {
+		authMode: string;
+		authPayload: IUser | IServiceAccount | IServiceTokenData;
+	};
+    integrationId: Types.ObjectId;
+    acceptedRoles: Array<'admin' | 'member'>;
+}) => {
+    
+    const integration = await Integration.findById(integrationId);
+    if (!integration) throw IntegrationNotFoundError();
+
+    const integrationAuth = await IntegrationAuth
+        .findById(integration.integrationAuth)
+        .select(
+			'+refreshCiphertext +refreshIV +refreshTag +accessCiphertext +accessIV +accessTag +accessExpiresAt'
+        );
+    
+    if (!integrationAuth) throw IntegrationAuthNotFoundError();
+
+    const accessToken = (await IntegrationService.getIntegrationAuthAccess({
+        integrationAuthId: integrationAuth._id
+    })).accessToken;
+
+    if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
+        await validateUserClientForWorkspace({
+            user: authData.authPayload,
+            workspaceId: integration.workspace,
+            acceptedRoles
+        });
+        
+        return ({ integration, accessToken });
+    }
+    
+    if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
+        await validateServiceAccountClientForWorkspace({
+            serviceAccount: authData.authPayload,
+            workspaceId: integration.workspace
+        });
+        
+        return ({ integration, accessToken });
+    }
+
+    if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
+        throw UnauthorizedRequestError({
+            message: 'Failed service token authorization for integration'
+        });
+    }
+
+    if (authData.authMode === AUTH_MODE_API_KEY && authData.authPayload instanceof User) {
+        await validateUserClientForWorkspace({
+            user: authData.authPayload,
+            workspaceId: integration.workspace,
+            acceptedRoles
+        });
+        
+        return ({ integration, accessToken });
+    }
+    
+    throw UnauthorizedRequestError({
+        message: 'Failed client authorization for integration'
+    });
+}
+
 /**
  * Perform OAuth2 code-token exchange for workspace with id [workspaceId] and integration
  * named [integration]
@@ -114,14 +217,19 @@ const handleOAuthExchangeHelper = async ({
  * @param {Object} obj.workspaceId - id of workspace
  */
 const syncIntegrationsHelper = async ({
-    workspaceId
+    workspaceId,
+    environment
 }: {
-    workspaceId: string;
+    workspaceId: Types.ObjectId;
+    environment?: string;
 }) => {
     let integrations;
     try {
         integrations = await Integration.find({
             workspace: workspaceId,
+            ...(environment ? {
+                environment
+            } : {}),
             isActive: true,
             app: { $ne: null }
         });
@@ -131,7 +239,7 @@ const syncIntegrationsHelper = async ({
         for await (const integration of integrations) {
             // get workspace, environment (shared) secrets
             const secrets = await BotService.getSecrets({ // issue here?
-                workspaceId: integration.workspace.toString(),
+                workspaceId: integration.workspace,
                 environment: integration.environment
             });
 
@@ -140,7 +248,7 @@ const syncIntegrationsHelper = async ({
             
             // get integration auth access token
             const access = await getIntegrationAuthAccessHelper({
-                integrationAuthId: integration.integrationAuth.toString()
+                integrationAuthId: integration.integrationAuth
             });
 
             // sync secrets to integration
@@ -167,7 +275,7 @@ const syncIntegrationsHelper = async ({
  * @param {String} obj.integrationAuthId - id of integration auth
  * @param {String} refreshToken - decrypted refresh token
  */
- const getIntegrationAuthRefreshHelper = async ({ integrationAuthId }: { integrationAuthId: string }) => {
+ const getIntegrationAuthRefreshHelper = async ({ integrationAuthId }: { integrationAuthId: Types.ObjectId }) => {
     let refreshToken;
 	
     try {
@@ -178,7 +286,7 @@ const syncIntegrationsHelper = async ({
         if (!integrationAuth) throw UnauthorizedRequestError({message: 'Failed to locate Integration Authentication credentials'});
 
         refreshToken = await BotService.decryptSymmetric({
-            workspaceId: integrationAuth.workspace.toString(),
+            workspaceId: integrationAuth.workspace,
             ciphertext: integrationAuth.refreshCiphertext as string,
             iv: integrationAuth.refreshIV as string,
             tag: integrationAuth.refreshTag as string
@@ -204,7 +312,7 @@ const syncIntegrationsHelper = async ({
  * @param {String} obj.integrationAuthId - id of integration auth
  * @returns {String} accessToken - decrypted access token
  */
-const getIntegrationAuthAccessHelper = async ({ integrationAuthId }: { integrationAuthId: string }) => {
+const getIntegrationAuthAccessHelper = async ({ integrationAuthId }: { integrationAuthId: Types.ObjectId }) => {
     let accessId;
     let accessToken;
     try {
@@ -215,7 +323,7 @@ const getIntegrationAuthAccessHelper = async ({ integrationAuthId }: { integrati
         if (!integrationAuth) throw UnauthorizedRequestError({message: 'Failed to locate Integration Authentication credentials'});
 
         accessToken = await BotService.decryptSymmetric({
-            workspaceId: integrationAuth.workspace.toString(),
+            workspaceId: integrationAuth.workspace,
             ciphertext: integrationAuth.accessCiphertext as string,
             iv: integrationAuth.accessIV as string,
             tag: integrationAuth.accessTag as string
@@ -237,7 +345,7 @@ const getIntegrationAuthAccessHelper = async ({ integrationAuthId }: { integrati
         
         if (integrationAuth?.accessIdCiphertext && integrationAuth?.accessIdIV && integrationAuth?.accessIdTag) {
             accessId = await BotService.decryptSymmetric({
-                workspaceId: integrationAuth.workspace.toString(),
+                workspaceId: integrationAuth.workspace,
                 ciphertext: integrationAuth.accessIdCiphertext as string,
                 iv: integrationAuth.accessIdIV as string,
                 tag: integrationAuth.accessIdTag as string
@@ -283,7 +391,7 @@ const setIntegrationAuthRefreshHelper = async ({
         if (!integrationAuth) throw new Error('Failed to find integration auth');
         
         const obj = await BotService.encryptSymmetric({
-            workspaceId: integrationAuth.workspace.toString(),
+            workspaceId: integrationAuth.workspace,
             plaintext: refreshToken
         });
         
@@ -332,14 +440,14 @@ const setIntegrationAuthAccessHelper = async ({
         if (!integrationAuth) throw new Error('Failed to find integration auth');
         
         const encryptedAccessTokenObj = await BotService.encryptSymmetric({
-            workspaceId: integrationAuth.workspace.toString(),
+            workspaceId: integrationAuth.workspace,
             plaintext: accessToken
         });
         
         let encryptedAccessIdObj;
         if (accessId) {
             encryptedAccessIdObj = await BotService.encryptSymmetric({
-                workspaceId: integrationAuth.workspace.toString(),
+                workspaceId: integrationAuth.workspace,
                 plaintext: accessId
             }); 
         }
@@ -367,6 +475,7 @@ const setIntegrationAuthAccessHelper = async ({
 }
 
 export {
+    validateClientForIntegration,
     handleOAuthExchangeHelper,
     syncIntegrationsHelper,
     getIntegrationAuthRefreshHelper,

backend/src/helpers/integrationAuth.ts

@@ -0,0 +1,108 @@
+import { Types } from 'mongoose';
+import {
+    IntegrationAuth,
+    IUser,
+    User,
+    IServiceAccount,
+    ServiceAccount,
+    IServiceTokenData,
+    ServiceTokenData,
+    IWorkspace
+} from '../models';
+import { 
+    AUTH_MODE_JWT,
+    AUTH_MODE_SERVICE_ACCOUNT,
+    AUTH_MODE_SERVICE_TOKEN,
+    AUTH_MODE_API_KEY
+} from '../variables';
+import {
+    IntegrationAuthNotFoundError,
+    UnauthorizedRequestError
+} from '../utils/errors';
+import { IntegrationService } from '../services';
+import { validateUserClientForWorkspace } from '../helpers/user';
+import { validateServiceAccountClientForWorkspace } from '../helpers/serviceAccount';
+
+/**
+ * Validate authenticated clients for integration authorization with id [integrationAuthId] based
+ * on any known permissions.
+ * @param {Object} obj
+ * @param {Object} obj.authData - authenticated client details
+ * @param {Types.ObjectId} obj.integrationAuthId - id of integration authorization to validate against
+ * @param {Array<'admin' | 'member'>} obj.acceptedRoles - accepted workspace roles
+ * @param {String[]} obj.requiredPermissions - required permissions as part of the endpoint
+ */
+ const validateClientForIntegrationAuth = async ({
+    authData,
+    integrationAuthId,
+    acceptedRoles,
+    attachAccessToken
+}: {
+    authData: {
+		authMode: string;
+		authPayload: IUser | IServiceAccount | IServiceTokenData;
+	};
+    integrationAuthId: Types.ObjectId;
+    acceptedRoles: Array<'admin' | 'member'>;
+    attachAccessToken?: boolean;
+}) => {
+
+    const integrationAuth = await IntegrationAuth
+        .findById(integrationAuthId)
+        .populate<{ workspace: IWorkspace }>('workspace')
+        .select(
+			'+refreshCiphertext +refreshIV +refreshTag +accessCiphertext +accessIV +accessTag +accessExpiresAt'
+        );
+    
+    if (!integrationAuth) throw IntegrationAuthNotFoundError();
+    
+    let accessToken;
+    if (attachAccessToken) {
+        accessToken = (await IntegrationService.getIntegrationAuthAccess({
+            integrationAuthId: integrationAuth._id
+        })).accessToken;
+    }
+    
+    if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
+        await validateUserClientForWorkspace({
+            user: authData.authPayload,
+            workspaceId: integrationAuth.workspace._id,
+            acceptedRoles
+        });
+
+        return ({ integrationAuth, accessToken });
+    }
+    
+    if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
+        await validateServiceAccountClientForWorkspace({
+            serviceAccount: authData.authPayload,
+            workspaceId: integrationAuth.workspace._id
+        });
+
+        return ({ integrationAuth, accessToken });
+    }
+
+    if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
+        throw UnauthorizedRequestError({
+            message: 'Failed service token authorization for integration authorization'
+        });
+    }
+
+    if (authData.authMode === AUTH_MODE_API_KEY && authData.authPayload instanceof User) {
+        await validateUserClientForWorkspace({
+            user: authData.authPayload,
+            workspaceId: integrationAuth.workspace._id,
+            acceptedRoles
+        });
+
+        return ({ integrationAuth, accessToken });
+    }
+    
+    throw UnauthorizedRequestError({
+        message: 'Failed client authorization for integration authorization'
+    });
+}
+
+export {
+    validateClientForIntegrationAuth
+};

backend/src/helpers/membership.ts

@@ -1,5 +1,106 @@
 import * as Sentry from '@sentry/node';
-import { Membership, Key } from '../models';
+import { Types } from 'mongoose';
+import { 
+	Membership, 
+	Key,
+	IUser,
+	User,
+	IServiceAccount,
+	ServiceAccount,
+	IServiceTokenData,
+	ServiceTokenData
+} from '../models';
+import {
+	MembershipNotFoundError,
+	BadRequestError,
+	UnauthorizedRequestError
+} from '../utils/errors';
+import {
+	AUTH_MODE_JWT,
+	AUTH_MODE_SERVICE_ACCOUNT,
+	AUTH_MODE_SERVICE_TOKEN,
+	AUTH_MODE_API_KEY
+} from '../variables';
+import {
+	validateUserClientForWorkspace
+} from '../helpers/user';
+import {
+	validateServiceAccountClientForWorkspace
+} from '../helpers/serviceAccount';
+import {
+	validateServiceTokenDataClientForWorkspace
+} from '../helpers/serviceTokenData';
+
+/**
+ * Validate authenticated clients for membership with id [membershipId] based
+ * on any known permissions.
+ * @param {Object} obj
+ * @param {Object} obj.authData - authenticated client details
+ * @param {Types.ObjectId} obj.membershipId - id of membership to validate against
+ * @param {Array<'admin' | 'member'>} obj.acceptedRoles - accepted workspaceRoles
+ * @returns {Membership} - validated membership
+ */
+const validateClientForMembership = async ({
+	authData,
+	membershipId,
+	acceptedRoles
+}: {
+	authData: {
+		authMode: string;
+		authPayload: IUser | IServiceAccount | IServiceTokenData;
+	};
+	membershipId: Types.ObjectId;
+    acceptedRoles: Array<'admin' | 'member'>;
+}) => {
+	
+	const membership = await Membership.findById(membershipId);
+	
+	if (!membership) throw MembershipNotFoundError({
+		message: 'Failed to find membership'
+	});
+
+	if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
+		await validateUserClientForWorkspace({
+			user: authData.authPayload,
+			workspaceId: membership.workspace,
+			acceptedRoles
+		});
+		
+		return membership;
+	}
+	
+	if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
+		await validateServiceAccountClientForWorkspace({
+			serviceAccount: authData.authPayload,
+			workspaceId: membership.workspace
+		});
+
+		return membership;
+	}
+	
+	if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
+		await validateServiceTokenDataClientForWorkspace({
+			serviceTokenData: authData.authPayload,
+			workspaceId: new Types.ObjectId(membership.workspace)
+		});
+		
+		return membership;
+	}
+
+	if (authData.authMode == AUTH_MODE_API_KEY && authData.authPayload instanceof User) {
+		await validateUserClientForWorkspace({
+			user: authData.authPayload,
+			workspaceId: membership.workspace,
+			acceptedRoles 
+		});
+		
+		return membership;
+	}
+	
+	throw UnauthorizedRequestError({
+		message: 'Failed client authorization for membership'
+	});
+}
 
 /**
  * Validate that user with id [userId] is a member of workspace with id [workspaceId]
@@ -14,28 +115,24 @@ const validateMembership = async ({
 	workspaceId,
 	acceptedRoles,
 }: {
-	userId: string;
-	workspaceId: string;
-	acceptedRoles: string[];
+	userId: Types.ObjectId;
+	workspaceId: Types.ObjectId;
+	acceptedRoles?: Array<'admin' | 'member'>;
 }) => {
 	
-	let membership;
-	//TODO: Refactor code to take advantage of using RequestError. It's possible to create new types of errors for more detailed errors
-	try {
-		membership = await Membership.findOne({
-			user: userId,
-			workspace: workspaceId
-		}).populate("workspace");
-		
-		if (!membership) throw new Error('Failed to find membership');
-		
+	const membership = await Membership.findOne({
+		user: userId,
+		workspace: workspaceId
+	}).populate("workspace");
+	
+	if (!membership) {
+		throw MembershipNotFoundError({ message: 'Failed to find workspace membership' });
+	}
+	
+	if (acceptedRoles) {
 		if (!acceptedRoles.includes(membership.role)) {
-			throw new Error('Failed to validate membership role');
+			throw BadRequestError({ message: 'Failed authorization for membership role' });
 		}
-	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-		throw new Error('Failed to validate membership');
 	}
 	
 	return membership;
@@ -133,6 +230,7 @@ const deleteMembership = async ({ membershipId }: { membershipId: string }) => {
 };
 
 export { 
+	validateClientForMembership,
 	validateMembership,
 	addMemberships, 
 	findMembership, 

backend/src/helpers/membershipOrg.ts

@@ -1,40 +1,140 @@
 import * as Sentry from '@sentry/node';
 import { Types } from 'mongoose';
-import { MembershipOrg, Workspace, Membership, Key } from '../models';
+import { 
+	MembershipOrg, 
+	Workspace, 
+	Membership, 
+	Key,
+	IUser,
+	User,
+	IServiceAccount,
+	ServiceAccount,
+	IServiceTokenData,
+	ServiceTokenData
+} from '../models';
+import {
+	MembershipOrgNotFoundError,
+	BadRequestError,
+	UnauthorizedRequestError
+} from '../utils/errors';
+import {
+	AUTH_MODE_JWT,
+	AUTH_MODE_SERVICE_ACCOUNT,
+	AUTH_MODE_SERVICE_TOKEN,
+	AUTH_MODE_API_KEY
+} from '../variables';
+
+/**
+ * Validate authenticated clients for organization membership with id [membershipOrgId] based
+ * on any known permissions.
+ * @param {Object} obj
+ * @param {Object} obj.authData - authenticated client details
+ * @param {Types.ObjectId} obj.membershipOrgId - id of organization membership to validate against
+ * @param {Array<'owner' | 'admin' | 'member'>} obj.acceptedRoles - accepted organization roles
+ * @param {MembershipOrg} - validated organization membership
+ */
+const validateClientForMembershipOrg = async ({
+	authData,
+	membershipOrgId,
+	acceptedRoles,
+	acceptedStatuses
+}: {
+	authData: {
+		authMode: string;
+		authPayload: IUser | IServiceAccount | IServiceTokenData;
+	};
+	membershipOrgId: Types.ObjectId;
+    acceptedRoles: Array<'owner' | 'admin' | 'member'>;
+    acceptedStatuses: Array<'invited' | 'accepted'>;
+}) => {
+	const membershipOrg = await MembershipOrg.findById(membershipOrgId);
+
+	if (!membershipOrg) throw MembershipOrgNotFoundError({
+		message: 'Failed to find organization membership '
+	});
+
+	if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
+		await validateMembershipOrg({
+			userId: authData.authPayload._id,
+			organizationId: membershipOrg.organization,
+			acceptedRoles,
+			acceptedStatuses
+		});
+		
+		return membershipOrg;
+	}
+
+	if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
+		if (!authData.authPayload.organization.equals(membershipOrg.organization)) throw UnauthorizedRequestError({
+			message: 'Failed service account client authorization for organization membership'
+		});
+		
+		return membershipOrg;
+	}
+
+	if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
+		throw UnauthorizedRequestError({
+			message: 'Failed service account client authorization for organization membership'
+		});
+	}
+	
+	if (authData.authMode === AUTH_MODE_API_KEY && authData.authPayload instanceof User) {
+		await validateMembershipOrg({
+			userId: authData.authPayload._id,
+			organizationId: membershipOrg.organization,
+			acceptedRoles,
+			acceptedStatuses
+		});
+		
+		return membershipOrg;
+	}
+	
+	throw UnauthorizedRequestError({
+		message: 'Failed client authorization for organization membership'
+	});
+}
 
 /**
  * Validate that user with id [userId] is a member of organization with id [organizationId]
  * and has at least one of the roles in [acceptedRoles]
- *
+ * @param {Object} obj
+ * @param {Types.ObjectId} obj.userId
+ * @param {Types.ObjectId} obj.organizationId
+ * @param {String[]} obj.acceptedRoles
  */
-const validateMembership = async ({
+const validateMembershipOrg = async ({
 	userId,
 	organizationId,
-	acceptedRoles
+	acceptedRoles,
+	acceptedStatuses
 }: {
-	userId: string;
-	organizationId: string;
-	acceptedRoles: string[];
+	userId: Types.ObjectId;
+	organizationId: Types.ObjectId;
+	acceptedRoles?: Array<'owner' | 'admin' | 'member'>;
+	acceptedStatuses?: Array<'invited' | 'accepted'>;
 }) => {
-	let membership;
-	try {
-		membership = await MembershipOrg.findOne({
-			user: new Types.ObjectId(userId),
-			organization: new Types.ObjectId(organizationId)
-		});
-		
-		if (!membership) throw new Error('Failed to find organization membership');
-		
-		if (!acceptedRoles.includes(membership.role)) {
-			throw new Error('Failed to validate organization membership role');
-		}
-	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-		throw new Error('Failed to validate organization membership');
+	const membershipOrg = await MembershipOrg.findOne({
+		user: userId,
+		organization: organizationId
+	});
+	
+	if (!membershipOrg) {
+		throw MembershipOrgNotFoundError({ message: 'Failed to find organization membership' });
 	}
 	
-	return membership;
+	if (acceptedRoles) {
+		if (!acceptedRoles.includes(membershipOrg.role)) {
+			throw UnauthorizedRequestError({ message: 'Failed to validate organization membership role' });
+		}
+	}
+	
+	if (acceptedStatuses) {
+		if (!acceptedStatuses.includes(membershipOrg.status)) {
+			throw UnauthorizedRequestError({ message: 'Failed to validate organization membership status' });
+		}
+	}
+	
+	return membershipOrg;
 }
 
 /**
@@ -156,7 +256,8 @@ const deleteMembershipOrg = async ({
 };
 
 export {
-	validateMembership,
+	validateClientForMembershipOrg,
+	validateMembershipOrg,
 	findMembershipOrg,
 	addMembershipsOrg, 
 	deleteMembershipOrg 

backend/src/helpers/organization.ts

@@ -1,14 +1,110 @@
 import * as Sentry from '@sentry/node';
 import Stripe from 'stripe';
 import { Types } from 'mongoose';
-import { ACCEPTED } from '../variables';
+import {
+	IUser,
+	User,
+	IServiceAccount,
+	ServiceAccount,
+	IServiceTokenData,
+	ServiceTokenData
+} from '../models';
 import { Organization, MembershipOrg } from '../models';
+import { 
+	ACCEPTED,
+	AUTH_MODE_JWT,
+	AUTH_MODE_SERVICE_ACCOUNT,
+	AUTH_MODE_SERVICE_TOKEN,
+	AUTH_MODE_API_KEY,
+	OWNER
+} from '../variables';
 import { 
 	getStripeSecretKey,
 	getStripeProductPro,
 	getStripeProductTeam,
 	getStripeProductStarter
 } from '../config';
+import {
+	UnauthorizedRequestError,
+	OrganizationNotFoundError
+} from '../utils/errors';
+import {
+	validateUserClientForOrganization
+} from '../helpers/user';
+import {
+	validateServiceAccountClientForOrganization
+} from '../helpers/serviceAccount';
+
+/**
+ * Validate accepted clients for organization with id [organizationId]
+ * @param {Object} obj
+ * @param {Object} obj.authData - authenticated client details
+ * @param {Types.ObjectId} obj.organizationId - id of organization to validate against
+ */
+const validateClientForOrganization = async ({
+	authData,
+	organizationId,
+	acceptedRoles,
+	acceptedStatuses
+}: {
+	authData: {
+		authMode: string;
+		authPayload: IUser | IServiceAccount | IServiceTokenData;
+	},
+	organizationId: Types.ObjectId;
+	acceptedRoles: Array<'owner' | 'admin' | 'member'>;
+	acceptedStatuses: Array<'invited' | 'accepted'>;
+}) => {
+	
+	const organization = await Organization.findById(organizationId);
+	
+	if (!organization) {
+		throw OrganizationNotFoundError({
+			message: 'Failed to find organization'
+		});
+	}
+	
+	if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
+		const membershipOrg = await validateUserClientForOrganization({
+			user: authData.authPayload,
+			organization,
+			acceptedRoles,
+			acceptedStatuses
+		});
+		
+		return ({ organization, membershipOrg });
+	}
+
+	if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
+		await validateServiceAccountClientForOrganization({
+			serviceAccount: authData.authPayload,
+			organization
+		});
+		
+		return ({ organization });
+	}
+
+	if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
+		throw UnauthorizedRequestError({
+			message: 'Failed service token authorization for organization'
+		});
+	}
+
+	if (authData.authMode === AUTH_MODE_API_KEY && authData.authPayload instanceof User) {
+		const membershipOrg = await validateUserClientForOrganization({
+			user: authData.authPayload,
+			organization,
+			acceptedRoles,
+			acceptedStatuses
+		});
+		
+		return ({ organization, membershipOrg });
+	}
+	
+	throw UnauthorizedRequestError({
+		message: 'Failed client authorization for organization'
+	});
+}
 
 /**
  * Create an organization with name [name]
@@ -172,6 +268,7 @@ const updateSubscriptionOrgQuantity = async ({
 };
 
 export {
+	validateClientForOrganization,
 	createOrganization,
 	initSubscriptionOrg,
 	updateSubscriptionOrgQuantity

backend/src/helpers/rateLimiter.ts

@@ -15,7 +15,7 @@ const apiLimiter = rateLimit({
 });
 
 // 10 requests per minute
-const authLimiter = rateLimit({
+const authLimit = rateLimit({
   windowMs: 60 * 1000,
   max: 10,
   standardHeaders: true,
@@ -36,8 +36,16 @@ const passwordLimiter = rateLimit({
   }
 });
 
-export { 
-  apiLimiter, 
-  authLimiter,
-  passwordLimiter 
+const authLimiter = (req: any, res: any, next: any) => {
+  if (process.env.NODE_ENV === 'production') {
+    authLimit(req, res, next);
+  } else {
+    next();
+  }
+};
+
+export {
+  apiLimiter,
+  authLimiter,
+  passwordLimiter
 };

backend/src/helpers/secret.ts

@@ -10,7 +10,8 @@ import {
 	EELogService
 } from '../ee/services';
 import {
-	IAction
+	IAction,
+	SecretVersion
 } from '../ee/models';
 import {
 	SECRET_SHARED,
@@ -21,60 +22,8 @@ import {
 	ACTION_READ_SECRETS
 } from '../variables';
 import _ from 'lodash';
-import { ABILITY_WRITE } from '../variables/organization';
 import { BadRequestError, UnauthorizedRequestError } from '../utils/errors';
 
-/**
- * Validate that user with id [userId] can modify secrets with ids [secretIds]
- * @param {Object} obj
- * @param {Object} obj.userId - id of user to validate
- * @param {Object} obj.secretIds - secret ids
- * @returns {Secret[]} secrets
- */
-const validateSecrets = async ({
-	userId,
-	secretIds
-}: {
-	userId: string;
-	secretIds: string[];
-}) => {
-	let secrets;
-	try {
-		secrets = await Secret.find({
-			_id: {
-				$in: secretIds.map((secretId: string) => new Types.ObjectId(secretId))
-			}
-		});
-
-		if (secrets.length != secretIds.length) {
-			throw BadRequestError({ message: 'Unable to validate some secrets' })
-		}
-
-		const userMemberships = await Membership.find({ user: userId })
-		const userMembershipById = _.keyBy(userMemberships, 'workspace');
-		const workspaceIdsSet = new Set(userMemberships.map((m) => m.workspace.toString()));
-
-		// for each secret check if the secret belongs to a workspace the user is a member of
-		secrets.forEach((secret: ISecret) => {
-			if (workspaceIdsSet.has(secret.workspace.toString())) {
-				const deniedMembershipPermissions = userMembershipById[secret.workspace.toString()].deniedPermissions;
-				const isDisallowed = _.some(deniedMembershipPermissions, { environmentSlug: secret.environment, ability: ABILITY_WRITE });
-
-				if (isDisallowed) {
-					throw UnauthorizedRequestError({ message: 'You do not have the required permissions to perform this action' });
-				}
-			} else {
-				throw BadRequestError({ message: 'You cannot edit secrets of a workspace you are not a member of' });
-			}
-		});
-
-	} catch (err) {
-		throw BadRequestError({ message: 'Unable to validate secrets' })
-	}
-
-	return secrets;
-}
-
 interface V1PushSecret {
 	ciphertextKey: string;
 	ivKey: string;
@@ -241,8 +190,7 @@ const v1PushSecrets = async ({
 				secretKeyHash,
 			}) => {
 				const newSecret = newSecretsObj[`${type}-${secretKeyHash}`];
-				return ({
-					_id: new Types.ObjectId(),
+				return new SecretVersion({
 					secret: _id,
 					version: version ? version + 1 : 1,
 					workspace: new Types.ObjectId(workspaceId),
@@ -313,8 +261,7 @@ const v1PushSecrets = async ({
 					secretValueIV,
 					secretValueTag,
 					secretValueHash
-				}) => ({
-					_id: new Types.ObjectId(),
+				}) => new SecretVersion({
 					secret: _id,
 					version,
 					workspace,
@@ -336,7 +283,7 @@ const v1PushSecrets = async ({
 
 		// (EE) take a secret snapshot
 		await EESecretService.takeSecretSnapshot({
-			workspaceId
+			workspaceId: new Types.ObjectId(workspaceId)
 		});
 	} catch (err) {
 		Sentry.setUser(null);
@@ -527,12 +474,12 @@ const v2PushSecrets = async ({
 
 			// (EE) add secret versions for new secrets
 			EESecretService.addSecretVersions({
-				secretVersions: newSecrets.map((secretDocument) => {
-					return {
-						...secretDocument.toObject(),
+				secretVersions: newSecrets.map((secretDocument: ISecret) => {
+					return new SecretVersion({
+						...secretDocument,
 						secret: secretDocument._id,
 						isDeleted: false
-					}
+					})
 				})
 			});
 
@@ -547,7 +494,7 @@ const v2PushSecrets = async ({
 
 		// (EE) take a secret snapshot
 		await EESecretService.takeSecretSnapshot({
-			workspaceId
+			workspaceId: new Types.ObjectId(workspaceId)
 		})
 
 		// (EE) create (audit) log
@@ -714,7 +661,6 @@ const reformatPullSecrets = ({ secrets }: { secrets: ISecret[] }) => {
 };
 
 export {
-	validateSecrets,
 	v1PushSecrets,
 	v2PushSecrets,
 	pullSecrets,

backend/src/helpers/secrets.ts

@@ -0,0 +1,945 @@
+import { Types } from 'mongoose';
+import {
+    CreateSecretParams,
+    GetSecretsParams,
+    GetSecretParams,
+    UpdateSecretParams,
+    DeleteSecretParams
+} from '../interfaces/services/SecretService';
+import {
+    AuthData
+} from '../interfaces/middleware';
+import {
+    User,
+    Workspace,
+    ServiceAccount,
+    ServiceTokenData,
+    Secret,
+    ISecret,
+    SecretBlindIndexData,
+} from '../models';
+import { SecretVersion } from '../ee/models';
+import {
+    validateMembership
+} from '../helpers/membership';
+import {
+    validateUserClientForSecret,
+    validateUserClientForSecrets
+} from '../helpers/user';
+import {
+    validateServiceTokenDataClientForSecrets, 
+    validateServiceTokenDataClientForWorkspace
+} from '../helpers/serviceTokenData';
+import {
+    validateServiceAccountClientForSecrets,
+    validateServiceAccountClientForWorkspace
+} from '../helpers/serviceAccount';
+import { 
+    BadRequestError, 
+    UnauthorizedRequestError,
+    SecretNotFoundError,
+    SecretBlindIndexDataNotFoundError
+} from '../utils/errors';
+import {
+    AUTH_MODE_JWT,
+    AUTH_MODE_SERVICE_ACCOUNT,
+    AUTH_MODE_SERVICE_TOKEN,
+    AUTH_MODE_API_KEY,
+    SECRET_PERSONAL,
+    SECRET_SHARED,
+    ACTION_ADD_SECRETS,
+    ACTION_READ_SECRETS,
+    ACTION_UPDATE_SECRETS,
+    ACTION_DELETE_SECRETS
+} from '../variables';
+import crypto from 'crypto';
+import * as argon2 from 'argon2';
+import { 
+    encryptSymmetric,
+    decryptSymmetric
+} from '../utils/crypto';
+import { getEncryptionKey } from '../config';
+import { TelemetryService } from '../services';
+import {
+    EESecretService,
+    EELogService
+} from '../ee/services';
+import {
+    getAuthDataPayloadIdObj,
+    getAuthDataPayloadUserObj
+} from '../utils/auth';
+
+/**
+ * Validate authenticated clients for secrets with id [secretId] based
+ * on any known permissions.
+ * @param {Object} obj
+ * @param {Object} obj.authData - authenticated client details
+ * @param {Types.ObjectId} obj.secretId - id of secret to validate against
+ * @param {Array<'admin' | 'member'>} obj.acceptedRoles - accepted workspace roles
+ * @param {String[]} obj.requiredPermissions - required permissions as part of the endpoint
+ */
+const validateClientForSecret = async ({
+    authData,
+    secretId,
+    acceptedRoles,
+    requiredPermissions
+}: {
+    authData: AuthData;
+    secretId: Types.ObjectId;
+    acceptedRoles: Array<'admin' | 'member'>;
+    requiredPermissions: string[];
+}) => {
+    const secret = await Secret.findById(secretId);
+
+    if (!secret) throw SecretNotFoundError({
+        message: 'Failed to find secret'
+    });
+
+    if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
+        await validateUserClientForSecret({
+            user: authData.authPayload,
+            secret,
+            acceptedRoles,
+            requiredPermissions
+        });
+
+        return secret;
+    }
+
+    if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
+        await validateServiceAccountClientForWorkspace({
+            serviceAccount: authData.authPayload,
+            workspaceId: secret.workspace,
+            environment: secret.environment,
+            requiredPermissions
+        });
+        
+        return secret;
+    }
+
+    if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
+        await validateServiceTokenDataClientForWorkspace({
+            serviceTokenData: authData.authPayload,
+            workspaceId: secret.workspace,
+            environment: secret.environment
+        });
+    
+        return secret;
+    }
+    
+    if (authData.authMode === AUTH_MODE_API_KEY && authData.authPayload instanceof User) {
+        await validateUserClientForSecret({
+            user: authData.authPayload,
+            secret,
+            acceptedRoles,
+            requiredPermissions
+        });
+
+        return secret;
+    }
+    
+    throw UnauthorizedRequestError({
+        message: 'Failed client authorization for secret'
+    });
+}
+
+/**
+ * Validate authenticated clients for secrets with ids [secretIds] based
+ * on any known permissions.
+ * @param {Object} obj
+ * @param {Object} obj.authData - authenticated client details
+ * @param {Types.ObjectId[]} obj.secretIds - id of workspace to validate against
+ * @param {String} obj.environment - (optional) environment in workspace to validate against
+ * @param {Array<'admin' | 'member'>} obj.acceptedRoles - accepted workspace roles
+ * @param {String[]} obj.requiredPermissions - required permissions as part of the endpoint
+ */
+const validateClientForSecrets = async ({
+    authData,
+    secretIds,
+    requiredPermissions
+}: {
+    authData: AuthData;
+    secretIds: Types.ObjectId[];
+    requiredPermissions: string[];
+}) => {
+
+    let secrets: ISecret[] = [];
+    
+    secrets = await Secret.find({
+        _id: {
+            $in: secretIds
+        }
+    });
+
+    if (secrets.length != secretIds.length) {
+        throw BadRequestError({ message: 'Failed to validate non-existent secrets' })
+    }
+
+    if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
+        await validateUserClientForSecrets({
+            user: authData.authPayload,
+            secrets,
+            requiredPermissions
+        });
+        
+        return secrets;
+    }
+    
+    if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
+        await validateServiceAccountClientForSecrets({
+            serviceAccount: authData.authPayload,
+            secrets,
+            requiredPermissions
+        });
+        
+        return secrets;
+    }
+        
+    if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
+        await validateServiceTokenDataClientForSecrets({
+            serviceTokenData: authData.authPayload,
+            secrets,
+            requiredPermissions
+        });
+        
+        return secrets;
+    }
+
+    if (authData.authMode === AUTH_MODE_API_KEY && authData.authPayload instanceof User) {
+        await validateUserClientForSecrets({
+            user: authData.authPayload,
+            secrets,
+            requiredPermissions
+        });
+        
+        return secrets;
+    }
+
+    throw UnauthorizedRequestError({
+        message: 'Failed client authorization for secrets resource'
+    });
+}
+
+/**
+ * Initialize secret blind index data by setting previously
+ * un-initialized projects to have secret blind index data
+ * (Ensures that all projects have associated blind index data)
+ */
+const initSecretBlindIndexDataHelper = async () => {
+    const workspaceIdsBlindIndexed = await SecretBlindIndexData.distinct('workspace');
+    const workspaceIdsToBlindIndex = await Workspace.distinct('_id', {
+        _id: {
+            $nin: workspaceIdsBlindIndexed
+        }
+    });
+    
+    const secretBlindIndexDataToInsert = workspaceIdsToBlindIndex.map((workspaceToBlindIndex) => {
+        const salt = crypto.randomBytes(16).toString('base64');
+
+        const { 
+            ciphertext: encryptedSaltCiphertext,
+            iv: saltIV,
+            tag: saltTag
+        } = encryptSymmetric({
+            plaintext: salt,
+            key: getEncryptionKey()
+        });
+
+        const secretBlindIndexData = new SecretBlindIndexData({
+            workspace: workspaceToBlindIndex,
+            encryptedSaltCiphertext,
+            saltIV,
+            saltTag
+        })
+        
+        return secretBlindIndexData;
+    });
+    
+    if (secretBlindIndexDataToInsert.length > 0) {
+        await SecretBlindIndexData.insertMany(secretBlindIndexDataToInsert);
+    }
+}
+
+/**
+ * Create secret blind index data containing encrypted blind index [salt]
+ * for workspace with id [workspaceId]
+ * @param {Object} obj
+ * @param {Types.ObjectId} obj.workspaceId
+ */
+const createSecretBlindIndexDataHelper = async ({
+    workspaceId
+}: {
+    workspaceId: Types.ObjectId;
+}) => {
+    // initialize random blind index salt for workspace
+    const salt = crypto.randomBytes(16).toString('base64');
+    
+    const { 
+        ciphertext: encryptedSaltCiphertext,
+        iv: saltIV,
+        tag: saltTag
+    } = encryptSymmetric({
+        plaintext: salt,
+        key: getEncryptionKey()
+    });
+    
+    const secretBlindIndexData = await new SecretBlindIndexData({
+        workspace: workspaceId,
+        encryptedSaltCiphertext,
+        saltIV,
+        saltTag
+    }).save();
+    
+    return secretBlindIndexData;
+}
+
+/**
+ * Get secret blind index salt for workspace with id [workspaceId]
+ * @param {Object} obj
+ * @param {Types.ObjectId} obj.workspaceId - id of workspace to get salt for
+ * @returns 
+ */
+const getSecretBlindIndexSaltHelper = async ({
+    workspaceId
+}: {
+    workspaceId: Types.ObjectId;
+}) => {
+    // check if workspace blind index data exists
+    const secretBlindIndexData = await SecretBlindIndexData.findOne({
+        workspace: workspaceId
+    });
+    
+    if (!secretBlindIndexData) throw SecretBlindIndexDataNotFoundError();
+    
+    // decrypt workspace salt
+    const salt = decryptSymmetric({
+        ciphertext: secretBlindIndexData.encryptedSaltCiphertext,
+        iv: secretBlindIndexData.saltIV,
+        tag: secretBlindIndexData.saltTag,
+        key: getEncryptionKey()
+    });
+    
+    return salt;
+}
+
+/**
+ * Generate blind index for secret with name [secretName]
+ * and salt [salt]
+ * @param {Object} obj
+ * @param {String} obj.secretName - name of secret to generate blind index for
+ * @param {String} obj.salt - base64-salt
+ */
+ const generateSecretBlindIndexWithSaltHelper = async ({
+    secretName,
+    salt
+}: {
+    secretName: string;
+    salt: string;
+}) => {
+
+    // generate secret blind index
+    const secretBlindIndex = (await argon2.hash(secretName, {
+        type: argon2.argon2id,
+        salt: Buffer.from(salt, 'base64'),
+        saltLength: 16, // default 16 bytes
+        memoryCost: 65536, // default pool of 64 MiB per thread.
+        hashLength: 32,
+        parallelism: 1,
+        raw: true
+    })).toString('base64');
+
+    return secretBlindIndex;
+}
+
+/**
+ * Generate blind index for secret with name [secretName] 
+ * for workspace with id [workspaceId]
+ * @param {Object} obj
+ * @param {Stringj} obj.secretName - name of secret to generate blind index for
+ * @param {Types.ObjectId} obj.workspaceId - id of workspace that secret belongs to
+ */
+const generateSecretBlindIndexHelper = async ({
+    secretName,
+    workspaceId
+}: {
+    secretName: string;
+    workspaceId: Types.ObjectId;
+}) => {
+
+    // check if workspace blind index data exists
+    const secretBlindIndexData = await SecretBlindIndexData.findOne({
+        workspace: workspaceId
+    });
+    
+    if (!secretBlindIndexData) throw SecretBlindIndexDataNotFoundError();
+    
+    // decrypt workspace salt
+    const salt = decryptSymmetric({
+        ciphertext: secretBlindIndexData.encryptedSaltCiphertext,
+        iv: secretBlindIndexData.saltIV,
+        tag: secretBlindIndexData.saltTag,
+        key: getEncryptionKey()
+    });
+
+    const secretBlindIndex = await generateSecretBlindIndexWithSaltHelper({
+        secretName,
+        salt
+    });
+
+    return secretBlindIndex;
+}
+
+/**
+ * Create secret with name [secretName]
+ * @param {Object} obj
+ * @param {String} obj.secretName - name of secret to create
+ * @param {Types.ObjectId} obj.workspaceId - id of workspace to create secret for
+ * @param {String} obj.environment - environment in workspace to create secret for
+ * @param {'shared' | 'personal'} obj.type - type of secret
+ * @param {AuthData} obj.authData - authentication data on request
+ * @returns 
+ */
+const createSecretHelper = async ({
+    secretName,
+    workspaceId,
+    environment,
+    type,
+    authData,
+    secretKeyCiphertext,
+    secretKeyIV,
+    secretKeyTag,
+    secretValueCiphertext,
+    secretValueIV,
+    secretValueTag,
+    secretCommentCiphertext,
+    secretCommentIV,
+    secretCommentTag
+}: CreateSecretParams) => {
+    const secretBlindIndex = await generateSecretBlindIndexHelper({
+        secretName,
+        workspaceId: new Types.ObjectId(workspaceId)
+    });
+
+    const exists = await Secret.exists({
+        secretBlindIndex,
+        workspace: new Types.ObjectId(workspaceId),
+        type,
+        ...(type === SECRET_PERSONAL ? getAuthDataPayloadUserObj(authData) : {})
+    });
+    
+    if (exists) throw BadRequestError({
+        message: 'Failed to create secret that already exists'
+    });
+    
+    if (type === SECRET_PERSONAL) {
+        // case: secret type is personal -> check if a corresponding shared secret 
+        // with the same blind index [secretBlindIndex] exists
+
+        const exists = await Secret.exists({
+            secretBlindIndex,
+            workspace: new Types.ObjectId(workspaceId),
+            type: SECRET_SHARED
+        });
+        
+        if (!exists) throw BadRequestError({
+            message: 'Failed to create personal secret override for no corresponding shared secret'
+        });
+    }
+    
+    // create secret
+    const secret = await new Secret({
+        version: 1,
+        workspace: new Types.ObjectId(workspaceId),
+        environment,
+        type,
+        ...(type === SECRET_PERSONAL ? getAuthDataPayloadUserObj(authData) : {}),
+        secretBlindIndex,
+        secretKeyCiphertext,
+        secretKeyIV,
+        secretKeyTag,
+        secretValueCiphertext,
+        secretValueIV,
+        secretValueTag,
+        secretCommentCiphertext,
+        secretCommentIV,
+        secretCommentTag
+    }).save();
+    
+    const secretVersion = new SecretVersion({
+        secret: secret._id,
+        version: secret.version,
+        workspace: secret.workspace,
+        type,
+        ...(type === SECRET_PERSONAL ? getAuthDataPayloadUserObj(authData) : {}),
+        environment: secret.environment,
+        isDeleted: false,
+        secretBlindIndex,
+        secretKeyCiphertext,
+        secretKeyIV,
+        secretKeyTag,
+        secretValueCiphertext,
+        secretValueIV,
+        secretValueTag
+    });
+
+    // // (EE) add version for new secret
+    await EESecretService.addSecretVersions({
+        secretVersions: [secretVersion]
+    });
+
+    // (EE) create (audit) log
+    const action = await EELogService.createAction({
+        name: ACTION_ADD_SECRETS,
+        ...getAuthDataPayloadIdObj(authData),
+        workspaceId,
+        secretIds: [secret._id]
+    });
+    
+    action && await EELogService.createLog({
+        ...getAuthDataPayloadIdObj(authData),
+        workspaceId,
+        actions: [action],
+        channel: authData.authChannel,
+        ipAddress: authData.authIP
+    });
+    
+    // (EE) take a secret snapshot
+    await EESecretService.takeSecretSnapshot({
+        workspaceId
+    });
+
+    const postHogClient = TelemetryService.getPostHogClient();
+
+    if (postHogClient) {
+        postHogClient.capture({
+            event: 'secrets added',
+            distinctId: await TelemetryService.getDistinctId({
+                authData
+            }),
+            properties: {
+                numberOfSecrets: 1,
+                environment,
+                workspaceId,
+                channel: authData.authChannel,
+                userAgent: authData.authUserAgent
+            }
+        });
+    }
+    
+    return secret;
+}
+
+/**
+ * Get secrets for workspace with id [workspaceId] and environment [environment]
+ * @param {Object} obj
+ * @param {Types.ObjectId} obj.workspaceId - id of workspace
+ * @param {String} obj.environment - environment in workspace
+ * @param {AuthData} obj.authData - authentication data on request
+ * @returns 
+ */
+const getSecretsHelper = async ({
+    workspaceId,
+    environment,
+    authData
+}: GetSecretsParams) => {
+    let secrets: ISecret[] = [];
+
+    // get personal secrets first
+    secrets = await Secret.find({
+        workspace: new Types.ObjectId(workspaceId),
+        environment,
+        type: SECRET_PERSONAL,
+        ...getAuthDataPayloadUserObj(authData)
+    });
+
+    // concat with shared secrets
+    secrets = secrets.concat(await Secret.find({
+        workspace: new Types.ObjectId(workspaceId),
+        environment,
+        type: SECRET_SHARED,
+        secretBlindIndex: {
+            $nin: secrets.map((secret) => secret.secretBlindIndex)
+        }
+    }));
+
+    // (EE) create (audit) log
+    const action = await EELogService.createAction({
+        name: ACTION_READ_SECRETS,
+        ...getAuthDataPayloadIdObj(authData),
+        workspaceId,
+        secretIds: secrets.map((secret) => secret._id)
+    });
+    
+    action && await EELogService.createLog({
+        ...getAuthDataPayloadIdObj(authData),
+        workspaceId,
+        actions: [action],
+        channel: authData.authChannel,
+        ipAddress: authData.authIP
+    });
+
+    const postHogClient = TelemetryService.getPostHogClient();
+
+    if (postHogClient) {
+        postHogClient.capture({
+            event: 'secrets pulled',
+            distinctId: await TelemetryService.getDistinctId({
+                authData
+            }),
+            properties: {
+                numberOfSecrets: secrets.length,
+                environment,
+                workspaceId,
+                channel: authData.authChannel,
+                userAgent: authData.authUserAgent
+            }
+        });
+    }
+
+    return secrets;
+}
+
+/**
+ * Get secret with name [secretName]
+ * @param {Object} obj
+ * @param {String} obj.secretName - name of secret to get
+ * @param {Types.ObjectId} obj.workspaceId - id of workspace that secret belongs to
+ * @param {String} obj.environment - environment in workspace that secret belongs to
+ * @param {'shared' | 'personal'} obj.type - type of secret
+ * @param {AuthData} obj.authData - authentication data on request
+ * @returns 
+ */
+const getSecretHelper = async ({
+    secretName,
+    workspaceId,
+    environment,
+    type,
+    authData
+}: GetSecretParams) => {
+    const secretBlindIndex = await generateSecretBlindIndexHelper({
+        secretName,
+        workspaceId: new Types.ObjectId(workspaceId)
+    });
+    let secret: ISecret | null = null;
+    
+    // try getting personal secret first (if exists)
+    secret = await Secret.findOne({
+        secretBlindIndex,
+        workspace: new Types.ObjectId(workspaceId),
+        environment,
+        type: type ?? SECRET_PERSONAL,
+        ...(type === SECRET_PERSONAL ? getAuthDataPayloadUserObj(authData) : {})
+    });
+
+    if (!secret) {
+        // case: failed to find personal secret matching criteria
+        // -> find shared secret matching criteria
+        secret = await Secret.findOne({
+            secretBlindIndex,
+            workspace: new Types.ObjectId(workspaceId),
+            environment,
+            type: SECRET_SHARED
+        });
+    }
+    
+    if (!secret) throw SecretNotFoundError();
+    
+    // (EE) create (audit) log
+    const action = await EELogService.createAction({
+        name: ACTION_READ_SECRETS,
+        ...getAuthDataPayloadIdObj(authData),
+        workspaceId,
+        secretIds: [secret._id]
+    });
+    
+    action && await EELogService.createLog({
+        ...getAuthDataPayloadIdObj(authData),
+        workspaceId,
+        actions: [action],
+        channel: authData.authChannel,
+        ipAddress: authData.authIP
+    });
+
+    const postHogClient = TelemetryService.getPostHogClient();
+
+    if (postHogClient) {
+        postHogClient.capture({
+            event: 'secrets pull',
+            distinctId: await TelemetryService.getDistinctId({
+                authData
+            }),
+            properties: {
+                numberOfSecrets: 1,
+                environment,
+                workspaceId,
+                channel: authData.authChannel,
+                userAgent: authData.authUserAgent
+            }
+        });
+    }
+
+    return secret;
+}
+
+/**
+ * Update secret with name [secretName]
+ * @param {Object} obj
+ * @param {String} obj.secretName - name of secret to update
+ * @param {Types.ObjectId} obj.workspaceId - id of workspace that secret belongs to
+ * @param {String} obj.environment - environment in workspace that secret belongs to
+ * @param {'shared' | 'personal'} obj.type - type of secret
+ * @param {String} obj.secretValueCiphertext - ciphertext of secret value
+ * @param {String} obj.secretValueIV - IV of secret value
+ * @param {String} obj.secretValueTag - tag of secret value
+ * @param {AuthData} obj.authData - authentication data on request
+ * @returns 
+ */
+const updateSecretHelper = async ({
+    secretName,
+    workspaceId,
+    environment,
+    type,
+    authData,
+    secretValueCiphertext,
+    secretValueIV,
+    secretValueTag
+}: UpdateSecretParams) => {
+    const secretBlindIndex = await generateSecretBlindIndexHelper({
+        secretName,
+        workspaceId: new Types.ObjectId(workspaceId)
+    });
+
+    let secret: ISecret | null = null;
+    
+    if (type === SECRET_SHARED) {
+        // case: update shared secret
+        secret = await Secret.findOneAndUpdate(
+            {
+                secretBlindIndex,
+                workspace: new Types.ObjectId(workspaceId),
+                environment,
+                type
+            },
+            {
+                secretValueCiphertext,
+                secretValueIV,
+                secretValueTag,
+                $inc: { version: 1 }
+            },
+            {
+                new: true
+            }
+        );
+    } else {
+        // case: update personal secret
+        
+        secret = await Secret.findOneAndUpdate(
+            {
+                secretBlindIndex,
+                workspace: new Types.ObjectId(workspaceId),
+                environment,
+                type,
+                ...getAuthDataPayloadUserObj(authData)
+            },
+            {
+                secretValueCiphertext,
+                secretValueIV,
+                secretValueTag,
+                $inc: { version: 1 }
+            },
+            {
+                new: true
+            }
+        );
+    }
+
+    if (!secret) throw SecretNotFoundError();
+
+    const secretVersion = new SecretVersion({
+        secret: secret._id,
+        version: secret.version,
+        workspace: secret.workspace,
+        type,
+        ...(type === SECRET_PERSONAL ? getAuthDataPayloadUserObj(authData) : {}),
+        environment: secret.environment,
+        isDeleted: false,
+        secretBlindIndex,
+        secretKeyCiphertext: secret.secretKeyCiphertext,
+        secretKeyIV: secret.secretKeyIV,
+        secretKeyTag: secret.secretKeyTag,
+        secretValueCiphertext,
+        secretValueIV,
+        secretValueTag
+    });
+
+    // (EE) add version for new secret
+    await EESecretService.addSecretVersions({
+        secretVersions: [secretVersion]
+    });
+
+    // (EE) create (audit) log
+    const action = await EELogService.createAction({
+        name: ACTION_UPDATE_SECRETS,
+        ...getAuthDataPayloadIdObj(authData),
+        workspaceId,
+        secretIds: [secret._id]
+    });
+    
+    action && await EELogService.createLog({
+        ...getAuthDataPayloadIdObj(authData),
+        workspaceId,
+        actions: [action],
+        channel: authData.authChannel,
+        ipAddress: authData.authIP
+    });
+    
+    // (EE) take a secret snapshot
+    await EESecretService.takeSecretSnapshot({
+        workspaceId
+    });
+
+    const postHogClient = TelemetryService.getPostHogClient();
+
+    if (postHogClient) {
+        postHogClient.capture({
+            event: 'secrets modified',
+            distinctId: await TelemetryService.getDistinctId({
+                authData
+            }),
+            properties: {
+                numberOfSecrets: 1,
+                environment,
+                workspaceId,
+                channel: authData.authChannel,
+                userAgent: authData.authUserAgent
+            }
+        });
+    }
+
+    return secret;
+}
+
+/**
+ * Delete secret with name [secretName]
+ * @param {Object} obj
+ * @param {String} obj.secretName - name of secret to delete
+ * @param {Types.ObjectId} obj.workspaceId - id of workspace that secret belongs to
+ * @param {String} obj.environment - environment in workspace that secret belongs to
+ * @param {'shared' | 'personal'} obj.type - type of secret
+ * @param {AuthData} obj.authData - authentication data on request
+ * @returns 
+ */
+const deleteSecretHelper = async ({
+    secretName,
+    workspaceId,
+    environment,
+    type,
+    authData
+}: DeleteSecretParams) => {
+    const secretBlindIndex = await generateSecretBlindIndexHelper({
+        secretName,
+        workspaceId: new Types.ObjectId(workspaceId)
+    });
+
+    let secrets: ISecret[] = [];
+    let secret: ISecret | null = null;
+    
+    if (type === SECRET_SHARED) {
+        secrets = await Secret.find({
+            secretBlindIndex,
+            workspaceId: new Types.ObjectId(workspaceId),
+            environment
+        });
+        
+        secret = await Secret.findOneAndDelete({
+            secretBlindIndex,
+            workspaceId: new Types.ObjectId(workspaceId),
+            environment,
+            type
+        });
+        
+        await Secret.deleteMany({
+            secretBlindIndex,
+            workspaceId: new Types.ObjectId(workspaceId),
+            environment
+        });
+    } else {
+        secret = await Secret.findOneAndDelete({
+            secretBlindIndex,
+            workspaceId: new Types.ObjectId(workspaceId),
+            environment,
+            type,
+            ...getAuthDataPayloadUserObj(authData)
+        });
+        
+        if (secret) {
+            secrets = [secret];
+        }
+    }
+    
+    if (!secret) throw SecretNotFoundError();
+    
+    await EESecretService.markDeletedSecretVersions({
+        secretIds: secrets.map((secret) => secret._id)
+    });
+
+    // (EE) create (audit) log
+    const action = await EELogService.createAction({
+        name: ACTION_DELETE_SECRETS,
+        ...getAuthDataPayloadIdObj(authData),
+        workspaceId,
+        secretIds: secrets.map((secret) => secret._id)
+    });
+
+    // (EE) take a secret snapshot
+    action && await EELogService.createLog({
+        ...getAuthDataPayloadIdObj(authData),
+        workspaceId,
+        actions: [action],
+        channel: authData.authChannel,
+        ipAddress: authData.authIP
+    });
+
+    // (EE) take a secret snapshot
+    await EESecretService.takeSecretSnapshot({
+        workspaceId
+    });
+
+    const postHogClient = TelemetryService.getPostHogClient();
+
+    if (postHogClient) {
+        postHogClient.capture({
+            event: 'secrets deleted',
+            distinctId: await TelemetryService.getDistinctId({
+                authData
+            }),
+            properties: {
+                numberOfSecrets: secrets.length,
+                environment,
+                workspaceId,
+                channel: authData.authChannel,
+                userAgent: authData.authUserAgent
+            }
+        });
+    }
+    
+    return ({
+        secrets,
+        secret
+    });
+}
+
+export {
+    validateClientForSecret,
+    validateClientForSecrets,
+    initSecretBlindIndexDataHelper,
+    createSecretBlindIndexDataHelper,
+    getSecretBlindIndexSaltHelper,
+    generateSecretBlindIndexWithSaltHelper,
+    generateSecretBlindIndexHelper,
+    createSecretHelper,
+    getSecretsHelper,
+    getSecretHelper,
+    updateSecretHelper,
+    deleteSecretHelper
+}

backend/src/helpers/serviceAccount.ts

@@ -0,0 +1,271 @@
+import _ from 'lodash';
+import { Types } from 'mongoose';
+import {
+	User,
+	IUser,
+	ServiceAccount,
+    IServiceAccount,
+	ServiceTokenData,
+	IServiceTokenData,
+	ISecret,
+	IOrganization,
+	IServiceAccountWorkspacePermission,
+	ServiceAccountWorkspacePermission
+} from '../models';
+import { 
+	BadRequestError, 
+	UnauthorizedRequestError,
+	ServiceAccountNotFoundError
+} from '../utils/errors';
+import {
+	PERMISSION_READ_SECRETS,
+	PERMISSION_WRITE_SECRETS,
+	AUTH_MODE_JWT,
+	AUTH_MODE_SERVICE_ACCOUNT,
+	AUTH_MODE_SERVICE_TOKEN,
+	AUTH_MODE_API_KEY
+} from '../variables';
+import {
+	validateUserClientForServiceAccount
+} from '../helpers/user';
+
+const validateClientForServiceAccount = async ({
+	authData,
+	serviceAccountId,
+	requiredPermissions
+}: {
+	authData: {
+		authMode: string;
+		authPayload: IUser | IServiceAccount | IServiceTokenData;
+	},
+	serviceAccountId: Types.ObjectId;
+	requiredPermissions?: string[];
+}) => {
+	const serviceAccount = await ServiceAccount.findById(serviceAccountId); 
+	
+	if (!serviceAccount) {
+		throw ServiceAccountNotFoundError({
+			message: 'Failed to find service account'
+		});
+	}
+	
+	if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
+		await validateUserClientForServiceAccount({
+			user: authData.authPayload,
+			serviceAccount,
+			requiredPermissions
+		});
+		
+		return serviceAccount;
+	}
+
+	if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
+		await validateServiceAccountClientForServiceAccount({
+			serviceAccount: authData.authPayload,
+			targetServiceAccount: serviceAccount,
+			requiredPermissions
+		});
+
+		return serviceAccount;
+	}
+
+	if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
+		throw UnauthorizedRequestError({
+			message: 'Failed service token authorization for service account resource'
+		});
+	}
+
+	if (authData.authMode === AUTH_MODE_API_KEY && authData.authPayload instanceof User) {
+		await validateUserClientForServiceAccount({
+			user: authData.authPayload,
+			serviceAccount,
+			requiredPermissions
+		});
+		
+		return serviceAccount;
+	}
+	
+	throw UnauthorizedRequestError({
+		message: 'Failed client authorization for service account resource'
+	});
+}
+
+/**
+ * Validate that service account (client) can access workspace
+ * with id [workspaceId] and its environment [environment] with required permissions
+ * [requiredPermissions]
+ * @param {Object} obj
+ * @param {ServiceAccount} obj.serviceAccount - service account client
+ * @param {Types.ObjectId} obj.workspaceId - id of workspace to validate against
+ * @param {String} environment - (optional) environment in workspace to validate against
+ * @param {String[]} requiredPermissions - required permissions as part of the endpoint
+ */
+ const validateServiceAccountClientForWorkspace = async ({
+    serviceAccount,
+	workspaceId,
+	environment,
+	requiredPermissions
+}: {
+    serviceAccount: IServiceAccount;
+	workspaceId: Types.ObjectId;
+	environment?: string;
+	requiredPermissions?: string[];
+}) => {
+	if (environment) {
+		// case: environment specified ->
+		// evaluate service account authorization for workspace
+		// in the context of a specific environment [environment]
+		const permission = await ServiceAccountWorkspacePermission.findOne({
+			serviceAccount,
+			workspace: new Types.ObjectId(workspaceId),
+			environment
+		});
+	
+		if (!permission) throw UnauthorizedRequestError({
+			message: 'Failed service account authorization for the given workspace environment'
+		});
+
+		let runningIsDisallowed = false;
+		requiredPermissions?.forEach((requiredPermission: string) => {
+			switch (requiredPermission) {
+				case PERMISSION_READ_SECRETS:
+					if (!permission.read) runningIsDisallowed = true;
+					break;
+				case PERMISSION_WRITE_SECRETS:
+					if (!permission.write) runningIsDisallowed = true;
+					break;
+				default:
+					break;
+			}
+			
+			if (runningIsDisallowed) {
+				throw UnauthorizedRequestError({
+					message: `Failed permissions authorization for workspace environment action : ${requiredPermission}`
+				});	
+			}
+		});
+		
+	} else {
+		// case: no environment specified ->
+		// evaluate service account authorization for workspace
+		// without need of environment [environment]
+
+		const permission = await ServiceAccountWorkspacePermission.findOne({
+			serviceAccount,
+			workspace: new Types.ObjectId(workspaceId)
+		});
+		
+		if (!permission) throw UnauthorizedRequestError({
+			message: 'Failed service account authorization for the given workspace'
+		});
+	}
+}
+
+/**
+ * Validate that service account (client) can access secrets
+ * with required permissions [requiredPermissions]
+ * @param {Object} obj
+ * @param {ServiceAccount} obj.serviceAccount - service account client
+ * @param {Secret[]} secrets - secrets to validate against
+ * @param {string[]} requiredPermissions - required permissions as part of the endpoint
+ */
+ const validateServiceAccountClientForSecrets = async ({
+	serviceAccount,
+	secrets,
+	requiredPermissions
+}: {
+	serviceAccount: IServiceAccount;
+	secrets: ISecret[];
+	requiredPermissions?: string[];
+}) => {
+
+	const permissions = await ServiceAccountWorkspacePermission.find({
+		serviceAccount: serviceAccount._id 
+	});
+
+	const permissionsObj = _.keyBy(permissions, (p) => {
+		return `${p.workspace.toString()}-${p.environment}`
+	});
+
+	secrets.forEach((secret: ISecret) => {
+		const permission = permissionsObj[`${secret.workspace.toString()}-${secret.environment}`];
+		
+		if (!permission) throw BadRequestError({
+			message: 'Failed to find any permission for the secret workspace and environment'
+		});
+		
+		requiredPermissions?.forEach((requiredPermission: string) => {
+			let runningIsDisallowed = false;
+			requiredPermissions?.forEach((requiredPermission: string) => {
+				switch (requiredPermission) {
+					case PERMISSION_READ_SECRETS:
+						if (!permission.read) runningIsDisallowed = true;
+						break;
+					case PERMISSION_WRITE_SECRETS:
+						if (!permission.write) runningIsDisallowed = true;
+						break;
+					default:
+						break;
+				}
+				
+				if (runningIsDisallowed) {
+					throw UnauthorizedRequestError({
+						message: `Failed permissions authorization for workspace environment action : ${requiredPermission}`
+					});	
+				}
+			});
+		});
+	});
+}
+
+/**
+ * Validate that service account (client) can access target service
+ * account [serviceAccount] with required permissions [requiredPermissions]
+ * @param {Object} obj
+ * @param {SerivceAccount} obj.serviceAccount - service account client
+ * @param {ServiceAccount} targetServiceAccount - target service account to validate against
+ * @param {string[]} requiredPermissions - required permissions as part of the endpoint
+ */
+const validateServiceAccountClientForServiceAccount = ({
+	serviceAccount,
+	targetServiceAccount,
+	requiredPermissions
+}: {
+	serviceAccount: IServiceAccount;
+	targetServiceAccount: IServiceAccount;
+	requiredPermissions?: string[];
+}) => {
+	if (!serviceAccount.organization.equals(targetServiceAccount.organization)) {
+		throw UnauthorizedRequestError({
+			message: 'Failed service account authorization for the given service account'
+		});
+	}
+}
+
+/**
+ * Validate that service account (client) can access organization [organization]
+ * @param {Object} obj
+ * @param {User} obj.user - service account client
+ * @param {Organization} obj.organization - organization to validate against
+ */
+const validateServiceAccountClientForOrganization = async ({
+	serviceAccount,
+	organization
+}: {
+	serviceAccount: IServiceAccount;
+	organization: IOrganization;
+}) => {
+	if (!serviceAccount.organization.equals(organization._id)) {
+		throw UnauthorizedRequestError({
+			message: 'Failed service account authorization for the given organization'
+		});
+	}
+}
+
+export {
+	validateClientForServiceAccount,
+    validateServiceAccountClientForWorkspace,
+	validateServiceAccountClientForSecrets,
+	validateServiceAccountClientForServiceAccount,
+	validateServiceAccountClientForOrganization
+}

backend/src/helpers/serviceTokenData.ts

@@ -0,0 +1,188 @@
+import { Types } from 'mongoose';
+import {
+    ISecret,
+    IServiceTokenData,
+    ServiceTokenData,
+    IUser,
+    User,
+    IServiceAccount,
+    ServiceAccount,
+} from '../models';
+import { 
+    UnauthorizedRequestError,
+    ServiceTokenDataNotFoundError
+} from '../utils/errors';
+import {
+    AUTH_MODE_JWT,
+	AUTH_MODE_SERVICE_ACCOUNT,
+	AUTH_MODE_SERVICE_TOKEN,
+	AUTH_MODE_API_KEY
+} from '../variables';
+import { validateUserClientForWorkspace } from '../helpers/user';
+import { validateServiceAccountClientForWorkspace } from '../helpers/serviceAccount';
+
+/**
+ * Validate authenticated clients for service token with id [serviceTokenId] based
+ * on any known permissions.
+ * @param {Object} obj
+ * @param {Object} obj.authData - authenticated client details
+ * @param {Types.ObjectId} obj.serviceTokenData - id of service token to validate against
+ * @param {Array<'admin' | 'member'>} obj.acceptedRoles - accepted workspace roles
+ */
+const validateClientForServiceTokenData = async ({
+    authData,
+    serviceTokenDataId,
+    acceptedRoles
+}: {
+    authData: {
+		authMode: string;
+		authPayload: IUser | IServiceAccount | IServiceTokenData;
+	};
+    serviceTokenDataId: Types.ObjectId;
+    acceptedRoles: Array<'admin' | 'member'>;
+}) => {
+    const serviceTokenData = await ServiceTokenData
+            .findById(serviceTokenDataId)
+            .select('+encryptedKey +iv +tag')
+            .populate<{ user: IUser }>('user');
+
+    if (!serviceTokenData) throw ServiceTokenDataNotFoundError({
+        message: 'Failed to find service token data'
+    });
+
+    if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
+        await validateUserClientForWorkspace({
+            user: authData.authPayload,
+            workspaceId: serviceTokenData.workspace,
+            acceptedRoles
+        });
+        
+        return serviceTokenData;
+    }
+
+    if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
+        await validateServiceAccountClientForWorkspace({
+            serviceAccount: authData.authPayload,
+            workspaceId: serviceTokenData.workspace
+        });
+        
+        return serviceTokenData;
+    }
+
+    if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
+        throw UnauthorizedRequestError({
+            message: 'Failed service token authorization for service token data'
+        });
+    }
+
+    if (authData.authMode === AUTH_MODE_API_KEY && authData.authPayload instanceof User) {
+        await validateUserClientForWorkspace({
+            user: authData.authPayload,
+            workspaceId: serviceTokenData.workspace,
+            acceptedRoles
+        });
+        
+        return serviceTokenData;
+    }
+    
+    throw UnauthorizedRequestError({
+        message: 'Failed client authorization for service token data'
+    });
+}
+
+/**
+ * Validate that service token (client) can access workspace
+ * with id [workspaceId] and its environment [environment] with required permissions
+ * [requiredPermissions]
+ * @param {Object} obj
+ * @param {ServiceTokenData} obj.serviceTokenData - service token client
+ * @param {Types.ObjectId} obj.workspaceId - id of workspace to validate against
+ * @param {String} environment - (optional) environment in workspace to validate against
+ * @param {String[]} requiredPermissions - required permissions as part of the endpoint
+ */
+ const validateServiceTokenDataClientForWorkspace = async ({
+    serviceTokenData,
+	workspaceId,
+	environment,
+	requiredPermissions
+}: {
+    serviceTokenData: IServiceTokenData;
+	workspaceId: Types.ObjectId;
+	environment?: string;
+	requiredPermissions?: string[];
+}) => {
+    if (!serviceTokenData.workspace.equals(workspaceId)) {
+        // case: invalid workspaceId passed
+        throw UnauthorizedRequestError({
+            message: 'Failed service token authorization for the given workspace'
+        });
+    }
+
+    if (environment) {
+        // case: environment is specified
+        
+        if (serviceTokenData.environment !== environment) {
+            // case: invalid environment passed
+            throw UnauthorizedRequestError({
+                message: 'Failed service token authorization for the given workspace environment'
+            });
+        }
+
+        requiredPermissions?.forEach((permission) => {
+            if (!serviceTokenData.permissions.includes(permission)) {
+                throw UnauthorizedRequestError({
+                    message: `Failed service token authorization for the given workspace environment action: ${permission}`
+                });
+            }
+        });
+    }
+}
+
+/**
+ * Validate that service token (client) can access secrets
+ * with required permissions [requiredPermissions]
+ * @param {Object} obj
+ * @param {ServiceTokenData} obj.serviceTokenData - service token client
+ * @param {Secret[]} secrets - secrets to validate against
+ * @param {string[]} requiredPermissions - required permissions as part of the endpoint
+ */
+ const validateServiceTokenDataClientForSecrets = async ({
+    serviceTokenData,
+    secrets,
+	requiredPermissions
+}: {
+    serviceTokenData: IServiceTokenData;
+    secrets: ISecret[];
+	requiredPermissions?: string[];
+}) => {
+
+    secrets.forEach((secret: ISecret) => {
+        if (!serviceTokenData.workspace.equals(secret.workspace)) {
+            // case: invalid workspaceId passed
+            throw UnauthorizedRequestError({
+                message: 'Failed service token authorization for the given workspace'
+            });
+        }
+        
+        if (serviceTokenData.environment !== secret.environment) {
+            // case: invalid environment passed
+            throw UnauthorizedRequestError({
+                message: 'Failed service token authorization for the given workspace environment'
+            });
+        }
+        
+        requiredPermissions?.forEach((permission) => {
+            if (!serviceTokenData.permissions.includes(permission)) {
+                throw UnauthorizedRequestError({
+                    message: `Failed service token authorization for the given workspace environment action: ${permission}`
+                });
+            }
+        });
+    });
+}
+
+export {
+    validateClientForServiceTokenData,
+    validateServiceTokenDataClientForWorkspace,
+    validateServiceTokenDataClientForSecrets
+}

backend/src/helpers/user.ts

@@ -1,6 +1,25 @@
 import * as Sentry from '@sentry/node';
-import { IUser, User } from '../models';
+import { Types } from 'mongoose';
+import {
+	IUser, 
+	ISecret,
+	IServiceAccount,
+	User,
+	Membership,
+	IOrganization,
+	Organization,
+} from '../models';
 import { sendMail } from './nodemailer';
+import { validateMembership } from './membership';
+import _ from 'lodash';
+import { BadRequestError, UnauthorizedRequestError } from '../utils/errors';
+import {
+	validateMembershipOrg
+} from '../helpers/membershipOrg';
+import {
+	PERMISSION_READ_SECRETS,
+	PERMISSION_WRITE_SECRETS
+} from '../variables';
 
 /**
  * Initialize a user under email [email]
@@ -146,4 +165,204 @@ const checkUserDevice = async ({
 	}
 }
 
-export { setupAccount, completeAccount, checkUserDevice };
+/**
+ * Validate that user (client) can access workspace
+ * with id [workspaceId] and its environment [environment] with required permissions
+ * [requiredPermissions]
+ * @param {Object} obj
+ * @param {User} obj.user - user client
+ * @param {Types.ObjectId} obj.workspaceId - id of workspace to validate against
+ * @param {String} environment - (optional) environment in workspace to validate against
+ * @param {String[]} requiredPermissions - required permissions as part of the endpoint
+ */
+const validateUserClientForWorkspace = async ({
+	user,
+	workspaceId,
+	environment,
+	acceptedRoles,
+	requiredPermissions
+}: {
+	user: IUser;
+	workspaceId: Types.ObjectId;
+	environment?: string;
+	acceptedRoles: Array<'admin' | 'member'>;
+	requiredPermissions?: string[];
+}) => {
+	
+	// validate user membership in workspace
+	const membership = await validateMembership({
+        userId: user._id,
+        workspaceId,
+		acceptedRoles
+    });
+	
+	let runningIsDisallowed = false;
+	requiredPermissions?.forEach((requiredPermission: string) => {
+		switch (requiredPermission) {
+			case PERMISSION_READ_SECRETS:
+				runningIsDisallowed = _.some(membership.deniedPermissions, { environmentSlug: environment, ability: PERMISSION_READ_SECRETS });
+				break;
+			case PERMISSION_WRITE_SECRETS:
+				runningIsDisallowed = _.some(membership.deniedPermissions, { environmentSlug: environment, ability: PERMISSION_WRITE_SECRETS });
+				break;
+			default:
+				break;
+		}
+		
+		if (runningIsDisallowed) {
+			throw UnauthorizedRequestError({
+				message: `Failed permissions authorization for workspace environment action : ${requiredPermission}`
+			});	
+		}
+	});
+	
+	return membership;
+}
+
+/**
+ * Validate that user (client) can access secret [secret]
+ * with required permissions [requiredPermissions]
+ * @param {Object} obj
+ * @param {User} obj.user - user client
+ * @param {Secret[]} obj.secrets - secrets to validate against
+ * @param {String[]} requiredPermissions - required permissions as part of the endpoint
+ */
+const validateUserClientForSecret = async ({
+	user,
+	secret,
+	acceptedRoles,
+	requiredPermissions
+}: {
+	user: IUser;
+	secret: ISecret;
+	acceptedRoles?: Array<'admin' | 'member'>;
+	requiredPermissions?: string[];
+}) => {
+	const membership = await validateMembership({
+		userId: user._id,
+		workspaceId: secret.workspace,
+		acceptedRoles
+	});
+	
+	if (requiredPermissions?.includes(PERMISSION_WRITE_SECRETS)) {
+		const isDisallowed = _.some(membership.deniedPermissions, { environmentSlug: secret.environment, ability: PERMISSION_WRITE_SECRETS });
+
+		if (isDisallowed) {
+			throw UnauthorizedRequestError({
+				message: 'You do not have the required permissions to perform this action' 
+			});
+		}
+	}
+}
+
+/**
+ * Validate that user (client) can access secrets [secrets]
+ * with required permissions [requiredPermissions]
+ * @param {Object} obj
+ * @param {User} obj.user - user client
+ * @param {Secret[]} obj.secrets - secrets to validate against
+ * @param {String[]} requiredPermissions - required permissions as part of the endpoint
+ */
+ const validateUserClientForSecrets = async ({
+	user,
+	secrets,
+	requiredPermissions
+}: {
+	user: IUser;
+	secrets: ISecret[];
+	requiredPermissions?: string[];
+}) => {
+	
+	// TODO: add acceptedRoles?
+
+	const userMemberships = await Membership.find({ user: user._id })
+	const userMembershipById = _.keyBy(userMemberships, 'workspace');
+	const workspaceIdsSet = new Set(userMemberships.map((m) => m.workspace.toString()));
+
+	// for each secret check if the secret belongs to a workspace the user is a member of
+	secrets.forEach((secret: ISecret) => {
+		if (!workspaceIdsSet.has(secret.workspace.toString())) {
+			throw BadRequestError({
+				message: 'Failed authorization for the secret'
+			});
+		}
+
+		if (requiredPermissions?.includes(PERMISSION_WRITE_SECRETS)) {
+			const deniedMembershipPermissions = userMembershipById[secret.workspace.toString()].deniedPermissions;
+			const isDisallowed = _.some(deniedMembershipPermissions, { environmentSlug: secret.environment, ability: PERMISSION_WRITE_SECRETS });
+
+			if (isDisallowed) {
+				throw UnauthorizedRequestError({
+					message: 'You do not have the required permissions to perform this action' 
+				});
+			}
+		}
+	});
+}
+
+/**
+ * Validate that user (client) can access service account [serviceAccount]
+ * with required permissions [requiredPermissions]
+ * @param {Object} obj
+ * @param {User} obj.user - user client
+ * @param {ServiceAccount} obj.serviceAccount - service account to validate against
+ * @param {String[]} requiredPermissions - required permissions as part of the endpoint
+ */
+const validateUserClientForServiceAccount = async ({
+	user,
+	serviceAccount,
+	requiredPermissions
+}: {
+	user: IUser;
+	serviceAccount: IServiceAccount;
+	requiredPermissions?: string[];
+}) => {
+	if (!serviceAccount.user.equals(user._id)) {
+		// case: user who created service account is not the
+		// same user that is on the request
+		await validateMembershipOrg({
+			userId: user._id,
+			organizationId: serviceAccount.organization,
+			acceptedRoles: [],
+			acceptedStatuses: []
+		});
+	}
+}
+
+/**
+ * Validate that user (client) can access organization [organization]
+ * @param {Object} obj
+ * @param {User} obj.user - user client
+ * @param {Organization} obj.organization - organization to validate against
+ */
+ const validateUserClientForOrganization = async ({
+	user,
+	organization,
+	acceptedRoles,
+	acceptedStatuses
+}: {
+	user: IUser;
+	organization: IOrganization;
+	acceptedRoles: Array<'owner' | 'admin' | 'member'>;
+	acceptedStatuses: Array<'invited' | 'accepted'>;
+}) => {
+	const membershipOrg = await validateMembershipOrg({
+		userId: user._id,
+		organizationId: organization._id,
+		acceptedRoles,
+		acceptedStatuses
+	});
+	
+	return membershipOrg;
+}
+
+export { 
+	setupAccount, 
+	completeAccount, 
+	checkUserDevice,
+	validateUserClientForWorkspace,
+	validateUserClientForSecrets,
+	validateUserClientForServiceAccount,
+	validateUserClientForOrganization,
+	validateUserClientForSecret
+};

backend/src/helpers/workspace.ts

@@ -1,12 +1,136 @@
 import * as Sentry from '@sentry/node';
+import crypto from 'crypto';
+import { Types } from 'mongoose';
 import {
 	Workspace,
 	Bot,
 	Membership,
 	Key,
-	Secret
+	Secret,
+	User,
+	IUser,
+	ServiceAccountWorkspacePermission,
+	ServiceAccount,
+	IServiceAccount,
+	ServiceTokenData,
+	IServiceTokenData,
+	SecretBlindIndexData
 } from '../models';
 import { createBot } from '../helpers/bot';
+import { validateUserClientForWorkspace } from '../helpers/user';
+import { validateServiceAccountClientForWorkspace } from '../helpers/serviceAccount';
+import { validateServiceTokenDataClientForWorkspace } from '../helpers/serviceTokenData';
+import { validateMembership } from '../helpers/membership';
+import { UnauthorizedRequestError, WorkspaceNotFoundError } from '../utils/errors';
+import {
+	AUTH_MODE_JWT,
+	AUTH_MODE_SERVICE_ACCOUNT,
+	AUTH_MODE_SERVICE_TOKEN,
+	AUTH_MODE_API_KEY
+} from '../variables';
+import { getEncryptionKey } from '../config';
+import { encryptSymmetric } from '../utils/crypto';
+import { SecretService } from '../services';
+
+/**
+ * Validate authenticated clients for workspace with id [workspaceId] based
+ * on any known permissions.
+ * @param {Object} obj
+ * @param {Object} obj.authData - authenticated client details
+ * @param {Types.ObjectId} obj.workspaceId - id of workspace to validate against
+ * @param {String} obj.environment - (optional) environment in workspace to validate against
+ * @param {Array<'admin' | 'member'>} obj.acceptedRoles - accepted workspace roles
+ * @param {String[]} obj.requiredPermissions - required permissions as part of the endpoint
+ */
+const validateClientForWorkspace = async ({
+	authData,
+	workspaceId,
+	environment,
+	acceptedRoles,
+	requiredPermissions,
+	requireBlindIndicesEnabled
+}: {
+	authData: {
+		authMode: string;
+		authPayload: IUser | IServiceAccount | IServiceTokenData;
+	};
+	workspaceId: Types.ObjectId;
+	environment?: string;
+	acceptedRoles: Array<'admin' | 'member'>;
+	requiredPermissions?: string[];
+	requireBlindIndicesEnabled: boolean;
+}) => {
+	
+	const workspace = await Workspace.findById(workspaceId);
+
+	if (!workspace) throw WorkspaceNotFoundError({
+		message: 'Failed to find workspace'
+	});
+
+	if (requireBlindIndicesEnabled) {
+		// case: blind indices are not enabled for secrets in this workspace
+		// (i.e. workspace was created before blind indices were introduced
+		// and no admin has enabled it)
+		
+		const secretBlindIndexData = await SecretBlindIndexData.exists({
+			workspace: new Types.ObjectId(workspaceId)
+		});
+		
+		if (!secretBlindIndexData) throw UnauthorizedRequestError({
+			message: 'Failed workspace authorization due to blind indices not being enabled'
+		});
+	}
+
+	if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
+		const membership = await validateUserClientForWorkspace({
+			user: authData.authPayload,
+			workspaceId,
+			environment,
+			acceptedRoles,
+			requiredPermissions
+		});
+		
+		return ({ membership });
+	}
+
+	if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
+		await validateServiceAccountClientForWorkspace({
+			serviceAccount: authData.authPayload,
+			workspaceId,
+			environment,
+			requiredPermissions
+		});
+		
+		return {};
+	}
+	
+	if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
+		await validateServiceTokenDataClientForWorkspace({
+			serviceTokenData: authData.authPayload,
+			workspaceId,
+			environment,
+			requiredPermissions
+		});
+
+		return {};
+	}
+
+	if (authData.authMode === AUTH_MODE_API_KEY && authData.authPayload instanceof User) {
+		const membership = await validateUserClientForWorkspace({
+			user: authData.authPayload,
+			workspaceId,
+			environment,
+			acceptedRoles,
+			requiredPermissions
+		});
+		
+		return ({ membership });
+	}
+	
+	throw UnauthorizedRequestError({
+		message: 'Failed client authorization for workspace'
+	});
+}
 
 /**
  * Create a workspace with name [name] in organization with id [organizationId]
@@ -27,13 +151,21 @@ const createWorkspace = async ({
 		// create workspace
 		workspace = await new Workspace({
 			name,
-			organization: organizationId
+			organization: organizationId,
+			autoCapitalization: true
 		}).save();
 		
-		const bot = await createBot({
+		// initialize bot for workspace
+		await createBot({
 			name: 'Infisical Bot',
-			workspaceId: workspace._id.toString()
+			workspaceId: workspace._id
 		});
+		
+		// initialize blind index salt for workspace
+		await SecretService.createSecretBlindIndexData({
+			workspaceId: workspace._id
+		});
+
 	} catch (err) {
 		Sentry.setUser(null);
 		Sentry.captureException(err);
@@ -71,4 +203,8 @@ const deleteWorkspace = async ({ id }: { id: string }) => {
 	}
 };
 
-export { createWorkspace, deleteWorkspace };
+export {
+	validateClientForWorkspace,
+	createWorkspace, 
+	deleteWorkspace 
+};

backend/src/index.ts

@@ -9,7 +9,7 @@ import * as Sentry from '@sentry/node';
 import { DatabaseService } from './services';
 import { setUpHealthEndpoint } from './services/health';
 import { initSmtp } from './services/smtp';
-import { logTelemetryMessage } from './services';
+import { TelemetryService } from './services';
 import { setTransporter } from './helpers/nodemailer';
 import { createTestUserForDevelopment } from './utils/addDevelopmentUser';
 // eslint-disable-next-line @typescript-eslint/no-var-requires
@@ -56,10 +56,15 @@ import {
     secret as v2SecretRouter, // begin to phase out
     secrets as v2SecretsRouter,
     serviceTokenData as v2ServiceTokenDataRouter,
+    serviceAccounts as v2ServiceAccountsRouter,
     apiKeyData as v2APIKeyDataRouter,
     environment as v2EnvironmentRouter,
     tags as v2TagsRouter,
 } from './routes/v2';
+import {
+    secrets as v3SecretsRouter,
+    workspaces as v3WorkspacesRouter
+} from './routes/v3';
 import { healthCheck } from './routes/status';
 import { getLogger } from './utils/logger';
 import { RouteNotFoundError } from './utils/errors';
@@ -69,7 +74,8 @@ import {
     getNodeEnv,
     getPort,
     getSentryDSN,
-    getSiteURL
+    getSiteURL,
+    getSmtpHost
 } from './config';
 
 const main = async () => {
@@ -79,7 +85,7 @@ const main = async () => {
         });
     }
 
-    logTelemetryMessage();
+    TelemetryService.logTelemetryMessage();
     setTransporter(initSmtp());
 
     await DatabaseService.initDatabase(getMongoURL());
@@ -120,7 +126,7 @@ const main = async () => {
     app.use('/api/v1/workspace', eeWorkspaceRouter);
     app.use('/api/v1/action', eeActionRouter);
 
-    // v1 routes
+    // v1 routes (default)
     app.use('/api/v1/signup', v1SignupRouter);
     app.use('/api/v1/auth', v1AuthRouter);
     app.use('/api/v1/bot', v1BotRouter);
@@ -139,7 +145,7 @@ const main = async () => {
     app.use('/api/v1/integration', v1IntegrationRouter);
     app.use('/api/v1/integration-auth', v1IntegrationAuthRouter);
 
-    // v2 routes
+    // v2 routes (improvements)
     app.use('/api/v2/signup', v2SignupRouter);
     app.use('/api/v2/auth', v2AuthRouter);
     app.use('/api/v2/users', v2UsersRouter);
@@ -150,7 +156,12 @@ const main = async () => {
     app.use('/api/v2/secret', v2SecretRouter); // deprecated
     app.use('/api/v2/secrets', v2SecretsRouter);
     app.use('/api/v2/service-token', v2ServiceTokenDataRouter); // TODO: turn into plural route
+    app.use('/api/v2/service-accounts', v2ServiceAccountsRouter); // new
     app.use('/api/v2/api-key', v2APIKeyDataRouter);
+    
+    // v3 routes (experimental)
+    app.use('/api/v3/secrets', v3SecretsRouter);
+    app.use('/api/v3/workspaces', v3WorkspacesRouter);
 
     // api docs 
     app.use('/api-docs', swaggerUi.serve, swaggerUi.setup(swaggerFile))
@@ -170,7 +181,7 @@ const main = async () => {
         getLogger("backend-main").info(`Server started listening at port ${getPort()}`)
     });
 
-    createTestUserForDevelopment();
+    await createTestUserForDevelopment();
     setUpHealthEndpoint(server);
 
     server.on('close', async () => {

backend/src/integrations/apps.ts

@@ -12,17 +12,21 @@ import {
   INTEGRATION_GITHUB,
   INTEGRATION_GITLAB,
   INTEGRATION_RENDER,
+  INTEGRATION_RAILWAY,
   INTEGRATION_FLYIO,
   INTEGRATION_CIRCLECI,
   INTEGRATION_TRAVISCI,
+  INTEGRATION_SUPABASE,
   INTEGRATION_HEROKU_API_URL,
   INTEGRATION_GITLAB_API_URL,
   INTEGRATION_VERCEL_API_URL,
   INTEGRATION_NETLIFY_API_URL,
   INTEGRATION_RENDER_API_URL,
+  INTEGRATION_RAILWAY_API_URL,
   INTEGRATION_FLYIO_API_URL,
   INTEGRATION_CIRCLECI_API_URL,
   INTEGRATION_TRAVISCI_API_URL,
+  INTEGRATION_SUPABASE_API_URL
 } from "../variables";
 
 interface App {
@@ -94,6 +98,11 @@ const getApps = async ({
           accessToken,
         });
         break;
+      case INTEGRATION_RAILWAY:
+        apps = await getAppsRailway({
+          accessToken 
+        });
+        break;
       case INTEGRATION_FLYIO:
         apps = await getAppsFlyio({
           accessToken,
@@ -109,6 +118,11 @@ const getApps = async ({
           accessToken,
         })
         break;
+      case INTEGRATION_SUPABASE:
+        apps = await getAppsSupabase({
+            accessToken
+        });
+        break;
     }
   } catch (err) {
     Sentry.setUser(null);
@@ -323,6 +337,58 @@ const getAppsRender = async ({ accessToken }: { accessToken: string }) => {
   return apps;
 };
 
+/**
+ * Return list of projects for Railway integration
+ * @param {Object} obj
+ * @param {String} obj.accessToken - access token for Railway API
+ * @returns {Object[]} apps - names and ids of Railway services
+ * @returns {String} apps.name - name of Railway project
+ * @returns {String} apps.appId - id of Railway project
+ *
+*/
+const getAppsRailway = async ({ accessToken }: { accessToken: string }) => {
+  let apps: any[] = [];
+  try {
+    const query = `
+      query GetProjects($userId: String, $teamId: String) {
+        projects(userId: $userId, teamId: $teamId) {
+          edges {
+            node {
+              id
+              name
+            }
+          }
+        }
+      }
+    `;
+
+    const variables = {};
+
+    const { data: { data: { projects: { edges }}} } = await request.post(INTEGRATION_RAILWAY_API_URL, {
+      query,
+      variables,
+    }, {
+      headers: {
+        'Authorization': `Bearer ${accessToken}`,
+        'Content-Type': 'application/json',
+        'Accept-Encoding': 'application/json'
+      },
+    });
+    
+    apps = edges.map((e: any) => ({
+      name: e.node.name,
+      appId: e.node.id
+    }));
+
+  } catch (err) {
+    Sentry.setUser(null);
+    Sentry.captureException(err);
+    throw new Error("Failed to get Railway services");
+  }
+  
+  return apps;
+}
+
 /**
  * Return list of apps for Fly.io integration
  * @param {Object} obj
@@ -549,4 +615,40 @@ const getAppsGitlab = async ({
   return apps;
 }
 
+
+/**
+ * Return list of projects for Supabase integration
+ * @param {Object} obj
+ * @param {String} obj.accessToken - access token for Supabase API
+ * @returns {Object[]} apps - names of Supabase apps
+ * @returns {String} apps.name - name of Supabase app
+ */
+const getAppsSupabase = async ({ accessToken }: { accessToken: string }) => {
+  let apps: any;
+  try {
+      const { data } = await request.get(
+        `${INTEGRATION_SUPABASE_API_URL}/v1/projects`,
+        {
+          headers: {
+          Authorization: `Bearer ${accessToken}`,
+          'Accept-Encoding': 'application/json'
+          }
+        }
+      );
+
+      apps = data.map((a: any) => {
+        return {
+            name: a.name,
+            appId: a.id
+        };
+    });
+  } catch (err) {
+    Sentry.setUser(null);
+    Sentry.captureException(err);
+    throw new Error('Failed to get Supabase projects');
+  }
+  
+  return apps;
+};
+
 export { getApps };

backend/src/integrations/sync.ts

@@ -21,19 +21,24 @@ import {
   INTEGRATION_GITHUB,
   INTEGRATION_GITLAB,
   INTEGRATION_RENDER,
+  INTEGRATION_RAILWAY,
   INTEGRATION_FLYIO,
   INTEGRATION_CIRCLECI,
   INTEGRATION_TRAVISCI,
+  INTEGRATION_SUPABASE,
   INTEGRATION_HEROKU_API_URL,
   INTEGRATION_GITLAB_API_URL,
   INTEGRATION_VERCEL_API_URL,
   INTEGRATION_NETLIFY_API_URL,
   INTEGRATION_RENDER_API_URL,
+  INTEGRATION_RAILWAY_API_URL,
   INTEGRATION_FLYIO_API_URL,
   INTEGRATION_CIRCLECI_API_URL,
   INTEGRATION_TRAVISCI_API_URL,
+  INTEGRATION_SUPABASE_API_URL
 } from "../variables";
 import request from '../config/request';
+import axios from "axios";
 
 /**
  * Sync/push [secrets] to [app] in integration named [integration]
@@ -126,6 +131,13 @@ const syncSecrets = async ({
           accessToken,
         });
         break;
+      case INTEGRATION_RAILWAY:
+        await syncSecretsRailway({
+          integration,
+          secrets,
+          accessToken
+        });
+        break;
       case INTEGRATION_FLYIO:
         await syncSecretsFlyio({
           integration,
@@ -147,6 +159,13 @@ const syncSecrets = async ({
           accessToken,
         });
         break;
+      case INTEGRATION_SUPABASE:
+        await syncSecretsSupabase({
+            integration,
+            secrets,
+            accessToken
+        });
+        break;
     }
   } catch (err) {
     Sentry.setUser(null);
@@ -1152,6 +1171,58 @@ const syncSecretsRender = async ({
   }
 };
 
+/**
+ * Sync/push [secrets] to Railway project with id [integration.appId]
+ * @param {Object} obj
+ * @param {IIntegration} obj.integration - integration details
+ * @param {Object} obj.secrets - secrets to push to integration (object where keys are secret keys and values are secret values)
+ * @param {String} obj.accessToken - access token for Railway integration
+ */
+const syncSecretsRailway = async ({
+  integration,
+  secrets,
+  accessToken
+}: {
+  integration: IIntegration;
+  secrets: any;
+  accessToken: string;
+}) => {
+  try {
+
+    const query = `
+      mutation UpsertVariables($input: VariableCollectionUpsertInput!) {
+        variableCollectionUpsert(input: $input)
+      }
+    `;
+
+    const input = {
+      projectId: integration.appId,
+      environmentId: integration.targetEnvironmentId,
+      ...(integration.targetServiceId ? { serviceId: integration.targetServiceId } : {}),
+      replace: true,
+      variables: secrets
+    };
+
+    await request.post(INTEGRATION_RAILWAY_API_URL, {
+      query,
+      variables: {
+        input,
+      },
+    }, {
+      headers: {
+        'Authorization': `Bearer ${accessToken}`,
+        'Content-Type': 'application/json',
+        'Accept-Encoding': 'application/json'
+      },
+    });
+    
+  } catch (err) {
+    Sentry.setUser(null);
+    Sentry.captureException(err);
+    throw new Error("Failed to sync secrets to Railway");
+  }
+}
+
 /**
  * Sync/push [secrets] to Fly.io app
  * @param {Object} obj
@@ -1556,4 +1627,79 @@ const syncSecretsGitLab = async ({
   }
 }
 
+/**
+ * Sync/push [secrets] to Supabase with name [integration.app]
+ * @param {Object} obj
+ * @param {IIntegration} obj.integration - integration details
+ * @param {IIntegrationAuth} obj.integrationAuth - integration auth details
+ * @param {Object} obj.secrets - secrets to push to integration (object where keys are secret keys and values are secret values)
+ * @param {String} obj.accessToken - access token for Supabase integration
+ */
+const syncSecretsSupabase = async ({
+  integration,
+  secrets,
+  accessToken
+}: {
+  integration: IIntegration;
+  secrets: any;
+  accessToken: string;
+}) => {
+  try {
+    const { data: getSecretsRes } = await request.get(
+      `${INTEGRATION_SUPABASE_API_URL}/v1/projects/${integration.appId}/secrets`,
+      {
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+            'Accept-Encoding': 'application/json'
+        }
+      }
+    );
+
+    // convert the secrets to [{}] format
+    const modifiedFormatForSecretInjection = Object.keys(secrets).map(
+      (key) => {
+        return {
+            name: key,
+            value: secrets[key]
+        };
+      }
+    );
+
+    await request.post(
+      `${INTEGRATION_SUPABASE_API_URL}/v1/projects/${integration.appId}/secrets`,
+      modifiedFormatForSecretInjection,
+      {
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+            'Accept-Encoding': 'application/json'
+        }
+      }
+    );
+
+    const secretsToDelete: any = [];
+    getSecretsRes?.forEach((secretObj: any) => {
+      if (!(secretObj.name in secrets)) {
+          secretsToDelete.push(secretObj.name);
+      }
+    });
+
+    await request.delete(
+      `${INTEGRATION_SUPABASE_API_URL}/v1/projects/${integration.appId}/secrets`,
+      {
+        headers: {
+          Authorization: `Bearer ${accessToken}`,
+          'Content-Type': 'application/json',
+          'Accept-Encoding': 'application/json'
+        },
+        data: secretsToDelete
+      }
+    );
+  } catch (err) {
+    Sentry.setUser(null);
+    Sentry.captureException(err);
+    throw new Error('Failed to sync secrets to Supabase');
+  }
+};
+
+
 export { syncSecrets };

backend/src/interfaces/middleware/index.ts

@@ -0,0 +1,13 @@
+import {
+    IUser,
+    IServiceAccount,
+    IServiceTokenData
+} from '../../models';
+
+export interface AuthData {
+    authMode: string;
+    authPayload: IUser | IServiceAccount | IServiceTokenData;
+    authChannel: string;
+    authIP: string;
+    authUserAgent: string;
+}

backend/src/interfaces/serviceAccounts/dto/AddServiceAccountPermissionDto.ts

@@ -0,0 +1,7 @@
+interface AddServiceAccountPermissionDto {
+    name: string;
+    workspaceId?: string;
+    environment?: string;
+}
+
+export default AddServiceAccountPermissionDto;

backend/src/interfaces/serviceAccounts/dto/CreateServiceAccountDto.ts

@@ -0,0 +1,8 @@
+interface CreateServiceAccountDto {
+    organizationId: string;
+    name: string;
+    publicKey: string; 
+    expiresIn: number;
+}
+
+export default CreateServiceAccountDto;

backend/src/interfaces/serviceAccounts/dto/index.ts

@@ -0,0 +1,7 @@
+import CreateServiceAccountDto from './CreateServiceAccountDto';
+import AddServiceAccountPermissionDto from './AddServiceAccountPermissionDto';
+
+export {
+    CreateServiceAccountDto,
+    AddServiceAccountPermissionDto
+}

backend/src/interfaces/services/SecretService/index.ts

@@ -0,0 +1,52 @@
+import { Types } from 'mongoose';
+import { AuthData } from '../../middleware';
+
+export interface CreateSecretParams {
+    secretName: string;
+    workspaceId: Types.ObjectId;
+    environment: string;
+    type: 'shared' | 'personal';
+    authData: AuthData;
+    secretKeyCiphertext: string;
+    secretKeyIV: string;
+    secretKeyTag: string;
+    secretValueCiphertext: string;
+    secretValueIV: string;
+    secretValueTag: string;
+    secretCommentCiphertext?: string;
+    secretCommentIV?: string;
+    secretCommentTag?: string;
+}
+
+export interface GetSecretsParams {
+    workspaceId: Types.ObjectId;
+    environment: string;
+    authData: AuthData;
+}
+
+export interface GetSecretParams {
+    secretName: string;
+    workspaceId: Types.ObjectId;
+    environment: string;
+    type?: 'shared' | 'personal';
+    authData: AuthData;
+}
+
+export interface UpdateSecretParams {
+    secretName: string;
+    workspaceId: Types.ObjectId;
+    environment: string;
+    type: 'shared' | 'personal',
+    authData: AuthData
+    secretValueCiphertext: string;
+    secretValueIV: string;
+    secretValueTag: string;
+}
+
+export interface DeleteSecretParams {
+    secretName: string;
+    workspaceId: Types.ObjectId;
+    environment: string;
+    type: 'shared' | 'personal';
+    authData: AuthData;
+}

backend/src/middleware/index.ts

@@ -10,6 +10,8 @@ import requireIntegrationAuth from './requireIntegrationAuth';
 import requireIntegrationAuthorizationAuth from './requireIntegrationAuthorizationAuth';
 import requireServiceTokenAuth from './requireServiceTokenAuth';
 import requireServiceTokenDataAuth from './requireServiceTokenDataAuth';
+import requireServiceAccountAuth from './requireServiceAccountAuth';
+import requireServiceAccountWorkspacePermissionAuth from './requireServiceAccountWorkspacePermissionAuth';
 import requireSecretAuth from './requireSecretAuth';
 import requireSecretsAuth from './requireSecretsAuth';
 import validateRequest from './validateRequest';
@@ -27,6 +29,8 @@ export {
 	requireIntegrationAuthorizationAuth,
 	requireServiceTokenAuth,
 	requireServiceTokenDataAuth,
+	requireServiceAccountAuth,
+	requireServiceAccountWorkspacePermissionAuth,
 	requireSecretAuth,
 	requireSecretsAuth,
 	validateRequest

backend/src/middleware/requireAuth.ts

@@ -4,11 +4,24 @@ import {
 	validateAuthMode,
 	getAuthUserPayload,
 	getAuthSTDPayload,
-	getAuthAPIKeyPayload
+	getAuthAPIKeyPayload,
+	getAuthSAAKPayload
 } from '../helpers/auth';
 import { 
 	UnauthorizedRequestError
 } from '../utils/errors';
+import {
+	IUser,
+	IServiceAccount,
+	IServiceTokenData
+} from '../models';
+import {
+	AUTH_MODE_JWT,
+	AUTH_MODE_SERVICE_ACCOUNT,
+	AUTH_MODE_SERVICE_TOKEN,
+	AUTH_MODE_API_KEY
+} from '../variables';
+import { getChannelFromUserAgent } from '../utils/posthog';
 
 declare module 'jsonwebtoken' {
 	export interface UserIDJwtPayload extends jwt.JwtPayload {
@@ -27,50 +40,61 @@ declare module 'jsonwebtoken' {
  * @returns
  */
 const requireAuth = ({
-	acceptedAuthModes = ['jwt'],
-	requiredServiceTokenPermissions = []
+	acceptedAuthModes = [AUTH_MODE_JWT],
 }: {
 	acceptedAuthModes: string[];
-	requiredServiceTokenPermissions?: string[];
 }) => {
 	return async (req: Request, res: Response, next: NextFunction) => {
+		
 		// validate auth token against accepted auth modes [acceptedAuthModes]
 		// and return token type [authTokenType] and value [authTokenValue]
-		const { authTokenType, authTokenValue } = validateAuthMode({
+		const { authMode, authTokenValue } = validateAuthMode({
 			headers: req.headers,
 			acceptedAuthModes
 		});
 
-		// attach auth payloads
-		let serviceTokenData: any;
-		switch (authTokenType) {
-			case 'serviceToken':
-				serviceTokenData = await getAuthSTDPayload({
+		let authPayload: IUser | IServiceAccount | IServiceTokenData;
+		switch (authMode) {
+			case AUTH_MODE_SERVICE_ACCOUNT:
+				authPayload = await getAuthSAAKPayload({
 					authTokenValue
 				});
-				
-				requiredServiceTokenPermissions.forEach((requiredServiceTokenPermission) => {
-					if (!serviceTokenData.permissions.includes(requiredServiceTokenPermission)) {
-						return next(UnauthorizedRequestError({ message: 'Failed to authorize service token for endpoint' }));
-					}
-				});
-			
-				req.serviceTokenData = serviceTokenData;
-				req.user = serviceTokenData?.user;
-				
+				req.serviceAccount = authPayload;
 				break;
-			case 'apiKey':
-				req.user = await getAuthAPIKeyPayload({
+			case AUTH_MODE_SERVICE_TOKEN:
+				authPayload = await getAuthSTDPayload({
 					authTokenValue
 				});
+				req.serviceTokenData = authPayload;
+				break;
+			case AUTH_MODE_API_KEY:
+				authPayload = await getAuthAPIKeyPayload({
+					authTokenValue
+				});
+				req.user = authPayload;
 				break;
 			default:
-				req.user = await getAuthUserPayload({
+				authPayload = await getAuthUserPayload({
 					authTokenValue
 				});
+				req.user = authPayload;
 				break;
 		}
-
+		
+		req.requestData = {
+			...req.params,
+			...req.query,
+			...req.body,
+		}
+		
+		req.authData = {
+			authMode,
+			authPayload, // User, ServiceAccount, ServiceTokenData
+			authChannel: getChannelFromUserAgent(req.headers['user-agent']),
+			authIP: req.ip,
+			authUserAgent: req.headers['user-agent'] ?? 'other'
+		}
+		
 		return next();
 	}
 }

backend/src/middleware/requireBotAuth.ts

@@ -1,32 +1,28 @@
 import { Request, Response, NextFunction } from 'express';
+import { Types } from 'mongoose';
 import { Bot } from '../models';
 import { validateMembership } from '../helpers/membership';
+import { validateClientForBot } from '../helpers/bot';
 import { AccountNotFoundError } from '../utils/errors';
 
 type req = 'params' | 'body' | 'query';
 
 const requireBotAuth = ({
     acceptedRoles,
-    location = 'params'
+    locationBotId = 'params'
 }: {
-    acceptedRoles: string[];
-    location?: req;
+    acceptedRoles: Array<'admin' | 'member'>;
+    locationBotId?: req;
 }) => {
     return async (req: Request, res: Response, next: NextFunction) => {
-        const bot = await Bot.findById(req[location].botId);
+        const { botId } = req[locationBotId];
         
-        if (!bot) {
-            return next(AccountNotFoundError({message: 'Failed to locate Bot account'}))
-        }
-        
-        await validateMembership({
-            userId: req.user._id.toString(),
-            workspaceId: bot.workspace.toString(),
+        req.bot = await validateClientForBot({
+            authData: req.authData,
+            botId: new Types.ObjectId(botId),
             acceptedRoles
         });
         
-        req.bot = bot;
-        
         next();
     }
 }

backend/src/middleware/requireIntegrationAuth.ts

@@ -1,7 +1,9 @@
 import { Request, Response, NextFunction } from 'express';
+import { Types } from 'mongoose';
 import { Integration, IntegrationAuth } from '../models';
 import { IntegrationService } from '../services';
 import { validateMembership } from '../helpers/membership';
+import { validateClientForIntegration } from '../helpers/integration';
 import { IntegrationNotFoundError, UnauthorizedRequestError } from '../utils/errors';
 
 /**
@@ -13,42 +15,24 @@ import { IntegrationNotFoundError, UnauthorizedRequestError } from '../utils/err
 const requireIntegrationAuth = ({
 	acceptedRoles
 }: {
-	acceptedRoles: string[];
+	acceptedRoles: Array<'admin' | 'member'>;
 }) => {
 	return async (req: Request, res: Response, next: NextFunction) => {
-		// integration authorization middleware
-
 		const { integrationId } = req.params;
 
-		// validate integration accessibility
-		const integration = await Integration.findOne({
-			_id: integrationId
-		});
-
-		if (!integration) {
-			return next(IntegrationNotFoundError({message: 'Failed to locate Integration'}))
-		}
-		
-		await validateMembership({
-			userId: req.user._id.toString(),
-			workspaceId: integration.workspace.toString(),
+		const { integration, accessToken } = await validateClientForIntegration({
+			authData: req.authData,
+			integrationId: new Types.ObjectId(integrationId),
 			acceptedRoles
 		});
 
-		const integrationAuth = await IntegrationAuth.findOne({
-			_id: integration.integrationAuth
-		}).select(
-			'+refreshCiphertext +refreshIV +refreshTag +accessCiphertext +accessIV +accessTag +accessExpiresAt'
-		);
-
-		if (!integrationAuth) {
-			return next(UnauthorizedRequestError({message: 'Failed to locate Integration Authentication credentials'}))
+		if (integration) {
+			req.integration = integration;
+		}
+		
+		if (accessToken) {
+			req.accessToken = accessToken;
 		}
-
-		req.integration = integration;
-		req.accessToken = await IntegrationService.getIntegrationAuthAccess({
-			integrationAuthId: integrationAuth._id.toString()
-		});
 
 		return next();
 	};

backend/src/middleware/requireIntegrationAuthorizationAuth.ts

@@ -1,7 +1,9 @@
 import * as Sentry from '@sentry/node';
+import { Types } from 'mongoose';
 import { Request, Response, NextFunction } from 'express';
 import { IntegrationAuth, IWorkspace } from '../models';
 import { IntegrationService } from '../services';
+import { validateClientForIntegrationAuth } from '../helpers/integrationAuth';
 import { validateMembership } from '../helpers/membership';
 import { UnauthorizedRequestError } from '../utils/errors';
 
@@ -19,36 +21,26 @@ const requireIntegrationAuthorizationAuth = ({
 	attachAccessToken = true,
 	location = 'params'
 }: {
-	acceptedRoles: string[];
+	acceptedRoles: Array<'admin' | 'member'>;
 	attachAccessToken?: boolean;
 	location?: req;
 }) => {
 	return async (req: Request, res: Response, next: NextFunction) => {
 		const { integrationAuthId } = req[location];
-		const integrationAuth = await IntegrationAuth.findOne({
-			_id: integrationAuthId
-		})
-		.populate<{ workspace: IWorkspace }>('workspace')
-		.select(
-			'+refreshCiphertext +refreshIV +refreshTag +accessCiphertext +accessIV +accessTag +accessExpiresAt'
-		);
 
-		if (!integrationAuth) {
-			return next(UnauthorizedRequestError({message: 'Failed to locate Integration Authorization credentials'}))
-		}
-		
-		await validateMembership({
-			userId: req.user._id.toString(),
-			workspaceId: integrationAuth.workspace._id.toString(),
-			acceptedRoles
+		const { integrationAuth, accessToken } = await validateClientForIntegrationAuth({
+			authData: req.authData,
+			integrationAuthId: new Types.ObjectId(integrationAuthId),
+			acceptedRoles,
+			attachAccessToken
 		});
+		
+		if (integrationAuth) {
+			req.integrationAuth = integrationAuth;
+		}
 
-		req.integrationAuth = integrationAuth;
-		if (attachAccessToken) {
-			const access = await IntegrationService.getIntegrationAuthAccess({
-				integrationAuthId: integrationAuth._id.toString()
-			});
-			req.accessToken = access.accessToken;
+		if (accessToken) {
+			req.accessToken = accessToken;
 		}
 		
 		return next();

backend/src/middleware/requireMembershipAuth.ts

@@ -1,9 +1,13 @@
+import { Types } from 'mongoose';
 import { Request, Response, NextFunction } from 'express';
 import { UnauthorizedRequestError } from '../utils/errors';
 import {
     Membership,
 } from '../models';
-import { validateMembership } from '../helpers/membership';
+import {
+    validateClientForMembership,
+    validateMembership
+} from '../helpers/membership';
 
 type req = 'params' | 'body' | 'query';
 
@@ -16,43 +20,25 @@ type req = 'params' | 'body' | 'query';
  */
 const requireMembershipAuth = ({
     acceptedRoles,
-    location = 'params'
+    locationMembershipId = 'params'
 }: {
-    acceptedRoles: string[];
-    location?: req;
+    acceptedRoles: Array<'admin' | 'member'>;
+    locationMembershipId: req
 }) => {
     return async (
         req: Request, 
         res: Response, 
         next: NextFunction
     ) => {
-        try {
-            const { membershipId } = req[location];
-            
-            const membership = await Membership.findById(membershipId);
-            
-            if (!membership) throw new Error('Failed to find target membership');
-            
-            const userMembership = await Membership.findOne({
-                workspace: membership.workspace
-            });
-            
-            if (!userMembership) throw new Error('Failed to validate own membership')
-            
-            const targetMembership = await validateMembership({
-                userId: req.user._id.toString(),
-                workspaceId: membership.workspace.toString(),
-                acceptedRoles
-            });
-            
-            req.targetMembership = targetMembership;
-            
-            return next();
-        } catch (err) {
-            return next(UnauthorizedRequestError({ 
-                message: 'Unable to validate workspace membership' 
-            }));
-        }
+        const { membershipId } = req[locationMembershipId];
+        
+        req.targetMembership = await validateClientForMembership({
+            authData: req.authData,
+            membershipId: new Types.ObjectId(membershipId),
+            acceptedRoles
+        });
+        
+        return next();
     }
 }
 

backend/src/middleware/requireMembershipOrgAuth.ts

@@ -1,11 +1,17 @@
+import { Types } from 'mongoose';
 import { Request, Response, NextFunction } from 'express';
 import { UnauthorizedRequestError } from '../utils/errors';
 import {
     MembershipOrg
 } from '../models';
-import { validateMembership } from '../helpers/membershipOrg';
+import { 
+    validateClientForMembershipOrg,
+    validateMembershipOrg
+} from '../helpers/membershipOrg';
 
 
+// TODO: transform
+
 type req = 'params' | 'body' | 'query';
 
 /**
@@ -17,32 +23,24 @@ type req = 'params' | 'body' | 'query';
  */
 const requireMembershipOrgAuth = ({
     acceptedRoles,
-    location = 'params'
+    acceptedStatuses,
+    locationMembershipOrgId = 'params'
 }: {
-    acceptedRoles: string[];
-    location?: req;
+    acceptedRoles: Array<'owner' | 'admin' | 'member'>;
+	acceptedStatuses: Array<'invited' | 'accepted'>;
+    locationMembershipOrgId?: req;
 }) => {
     return async (req: Request, res: Response, next: NextFunction) => {
-        try {
-            const { membershipId } = req[location];
-            const membershipOrg = await MembershipOrg.findById(membershipId);
-            
-            if (!membershipOrg) throw new Error('Failed to find target organization membership');
-            
-            const targetMembership = await validateMembership({
-                userId: req.user._id.toString(),
-                organizationId: membershipOrg.organization.toString(),
-                acceptedRoles
-            });
-            
-            req.targetMembership = targetMembership;
-            
-            return next();
-        } catch (err) {
-            return next(UnauthorizedRequestError({
-                message: 'Unable to validate organization membership'
-            }));
-        }
+        const { membershipId } = req[locationMembershipOrgId];
+        
+        req.membershipOrg = await validateClientForMembershipOrg({
+            authData: req.authData,
+            membershipOrgId: new Types.ObjectId(membershipId),
+            acceptedRoles,
+            acceptedStatuses
+        });
+        
+        return next();
     }
 }
 

backend/src/middleware/requireOrganizationAuth.ts

@@ -1,45 +1,46 @@
 import { Request, Response, NextFunction } from 'express';
+import { Types } from 'mongoose';
 import { IOrganization, MembershipOrg } from '../models';
 import { UnauthorizedRequestError, ValidationError } from '../utils/errors';
+import { validateMembershipOrg } from '../helpers/membershipOrg';
+import { validateClientForOrganization } from '../helpers/organization';
+
+type req = 'params' | 'body' | 'query';
 
 /**
  * Validate if user on request is a member with proper roles for organization
  * on request params.
  * @param {Object} obj
  * @param {String[]} obj.acceptedRoles - accepted organization roles
- * @param {String[]} obj.acceptedStatuses - accepted organization statuses
+ * @param {String[]} obj.accepteStatuses - accepted organization statuses
  */
 const requireOrganizationAuth = ({
 	acceptedRoles,
-	acceptedStatuses
+	acceptedStatuses,
+	locationOrganizationId = 'params'
 }: {
-	acceptedRoles: string[];
-	acceptedStatuses: string[];
+	acceptedRoles: Array<'owner' | 'admin' | 'member'>;
+	acceptedStatuses: Array<'invited' | 'accepted'>;
+	locationOrganizationId?: req;
 }) => {
 	return async (req: Request, res: Response, next: NextFunction) => {
-		// organization authorization middleware
-
-		// validate organization membership
-		const membershipOrg = await MembershipOrg.findOne({
-			user: req.user._id,
-			organization: req.params.organizationId
-		}).populate<{ organization: IOrganization }>('organization');
-
-
-		if (!membershipOrg) {
-			return next(UnauthorizedRequestError({message: "You're not a member of this Organization."}))
-		}
-		//TODO is this important to validate? I mean is it possible to save wrong role to database or get wrong role from databse? - Zamion101
-		if (!acceptedRoles.includes(membershipOrg.role)) {
-			return next(ValidationError({message: 'Failed to validate Organization Membership Role'}))
+		const { organizationId } = req[locationOrganizationId];
+		
+		const { organization, membershipOrg } = await validateClientForOrganization({
+			authData: req.authData,
+			organizationId: new Types.ObjectId(organizationId),
+			acceptedRoles,
+			acceptedStatuses
+		});
+		
+		if (organization) {
+			req.organization = organization;
 		}
 
-		if (!acceptedStatuses.includes(membershipOrg.status)) {
-			return next(ValidationError({message: 'Failed to validate Organization Membership Status'}))
+		if (membershipOrg) {
+			req.membershipOrg = membershipOrg;
 		}
 
-		req.membershipOrg = membershipOrg;
-
 		return next();
 	};
 };

backend/src/middleware/requireSecretAuth.ts

@@ -1,12 +1,17 @@
 import { Request, Response, NextFunction } from 'express';
+import { Types } from 'mongoose';
 import { UnauthorizedRequestError, SecretNotFoundError } from '../utils/errors';
 import { Secret } from '../models';
 import {
     validateMembership
 } from '../helpers/membership';
+import {
+    validateClientForSecret
+} from '../helpers/secrets';
 
 // note: used for old /v1/secret and /v2/secret routes.
-// newer /v2/secrets routes use [requireSecretsAuth] middleware
+// newer /v2/secrets routes use [requireSecretsAuth] middleware with the exception
+// of some /ee endpoints
 
 /**
  * Validate if user on request has proper membership to modify secret.
@@ -15,34 +20,25 @@ import {
  * @param {String[]} obj.location - location of [workspaceId] on request (e.g. params, body) for parsing
  */
 const requireSecretAuth = ({
-    acceptedRoles
+    acceptedRoles,
+    requiredPermissions
 }: {
-    acceptedRoles: string[];
+    acceptedRoles: Array<'admin' | 'member'>;
+    requiredPermissions: string[];
 }) => {
     return async (req: Request, res: Response, next: NextFunction) => {
-        try {
-            const { secretId } = req.params;
-            
-            const secret = await Secret.findById(secretId);
-            
-            if (!secret) {
-                return next(SecretNotFoundError({
-                    message: 'Failed to find secret'
-                }));
-            }
-            
-            await validateMembership({
-                userId: req.user._id.toString(),
-                workspaceId: secret.workspace.toString(),
-                acceptedRoles
-            });
-            
-            req._secret = secret;
+        const { secretId } = req.params;
+        
+        const secret = await validateClientForSecret({
+            authData: req.authData,
+            secretId: new Types.ObjectId(secretId),
+            acceptedRoles,
+            requiredPermissions
+        });
+        
+        req._secret = secret;
 
-            next();
-        } catch (err) {
-            return next(UnauthorizedRequestError({ message: 'Unable to authenticate secret' }));
-        }
+        next();
     }
 }
 

backend/src/middleware/requireSecretsAuth.ts

@@ -1,48 +1,35 @@
 import { Request, Response, NextFunction } from 'express';
+import { Types } from 'mongoose';
 import { UnauthorizedRequestError } from '../utils/errors';
 import { Secret, Membership } from '../models';
-import { validateSecrets } from '../helpers/secret';
-
-// TODO: make this work for delete route
+import { validateClientForSecrets } from '../helpers/secrets';
 
 const requireSecretsAuth = ({
-    acceptedRoles
+    acceptedRoles,
+    requiredPermissions = []
 }: {
     acceptedRoles: string[];
+    requiredPermissions?: string[];
 }) => {
     return async (req: Request, res: Response, next: NextFunction) => {
-        let secrets;
-        try {
-            if (Array.isArray(req.body.secrets)) {
-                // case: validate multiple secrets
-                secrets = await validateSecrets({
-                    userId: req.user._id.toString(),
-                    secretIds: req.body.secrets.map((s: any) => s.id)
-                });
-            } else if (typeof req.body.secrets === 'object') { // change this to check for object
-                // case: validate 1 secret
-                secrets = await validateSecrets({
-                    userId: req.user._id.toString(),
-                    secretIds: [req.body.secrets.id]
-                });
-            } else if (Array.isArray(req.body.secretIds)) {
-                secrets = await validateSecrets({
-                    userId: req.user._id.toString(),
-                    secretIds: req.body.secretIds
-                });
-            } else if (typeof req.body.secretIds === 'string') {
-                // case: validate secretIds
-                secrets = await validateSecrets({
-                    userId: req.user._id.toString(),
-                    secretIds: [req.body.secretIds]
-                });
-            }
-            
-            req.secrets = secrets;
-            return next();
-        } catch (err) {
-            return next(UnauthorizedRequestError({ message: 'Unable to authenticate secret(s)' }));
+        let secretIds = [];
+        if (Array.isArray(req.body.secrets)) {
+            secretIds = req.body.secrets.map((s: any) => s.id);
+        } else if (typeof req.body.secrets === 'object') {
+            secretIds = [req.body.secrets.id];
+        } else if (Array.isArray(req.body.secretIds)) {
+            secretIds = req.body.secretIds;
+        } else if (typeof req.body.secretIds === 'string') {
+            secretIds = [req.body.secretIds];
         }
+
+        req.secrets = await validateClientForSecrets({
+            authData: req.authData,
+            secretIds: secretIds.map((secretId: string) => new Types.ObjectId(secretId)),
+            requiredPermissions
+        });
+    
+        return next();
     }
 }
 

backend/src/middleware/requireServiceAccountAuth.ts

@@ -0,0 +1,40 @@
+import { Request, Response, NextFunction } from 'express';
+import { Types } from 'mongoose';
+import { ServiceAccount } from '../models';
+import {
+    ServiceAccountNotFoundError
+} from '../utils/errors';
+import {
+    validateMembershipOrg
+} from '../helpers/membershipOrg';
+import {
+    validateClientForServiceAccount
+} from '../helpers/serviceAccount';
+
+type req = 'params' | 'body' | 'query';
+
+const requireServiceAccountAuth = ({
+    acceptedRoles,
+    acceptedStatuses,
+    locationServiceAccountId = 'params',
+    requiredPermissions = []
+}: {
+    acceptedRoles: string[];
+    acceptedStatuses: string[];
+    locationServiceAccountId?: req;
+    requiredPermissions?: string[];
+}) => {
+    return async (req: Request, res: Response, next: NextFunction) => {
+        const serviceAccountId = req[locationServiceAccountId].serviceAccountId;
+        
+        req.serviceAccount = await validateClientForServiceAccount({
+            authData: req.authData,
+            serviceAccountId: new Types.ObjectId(serviceAccountId),
+            requiredPermissions
+        });
+        
+        next();
+    }
+}
+
+export default requireServiceAccountAuth;

backend/src/middleware/requireServiceAccountWorkspacePermissionAuth.ts

@@ -0,0 +1,52 @@
+import { Request, Response, NextFunction } from 'express';
+import { ServiceAccount, ServiceAccountWorkspacePermission } from '../models';
+import {
+    ServiceAccountNotFoundError
+} from '../utils/errors';
+import {
+    validateMembershipOrg
+} from '../helpers/membershipOrg';
+
+type req = 'params' | 'body' | 'query';
+
+const requireServiceAccountWorkspacePermissionAuth = ({
+    acceptedRoles,
+    acceptedStatuses,
+    location = 'params'
+}: {
+    acceptedRoles: Array<'owner' | 'admin' | 'member'>;
+	acceptedStatuses: Array<'invited' | 'accepted'>;
+    location?: req;
+}) => {
+    return async (req: Request, res: Response, next: NextFunction) => {
+        const serviceAccountWorkspacePermissionId = req[location].serviceAccountWorkspacePermissionId;
+        const serviceAccountWorkspacePermission = await ServiceAccountWorkspacePermission.findById(serviceAccountWorkspacePermissionId);
+
+        if (!serviceAccountWorkspacePermission) {
+            return next(ServiceAccountNotFoundError({ message: 'Failed to locate Service Account workspace permission' }));
+        }
+        
+        const serviceAccount = await ServiceAccount.findById(serviceAccountWorkspacePermission.serviceAccount);
+
+        if (!serviceAccount) {
+            return next(ServiceAccountNotFoundError({ message: 'Failed to locate Service Account' }));
+        }
+        
+        if (serviceAccount.user.toString() !== req.user.id.toString()) {
+            // case: creator of the service account is different from
+            // the user on the request -> apply middleware role/status validation
+            await validateMembershipOrg({
+                userId: req.user._id,
+                organizationId: serviceAccount.organization,
+                acceptedRoles,
+                acceptedStatuses
+            });
+        }
+        
+        req.serviceAccount = serviceAccount;
+        
+        next();
+    }
+}
+
+export default requireServiceAccountWorkspacePermissionAuth;

backend/src/middleware/requireServiceTokenDataAuth.ts

@@ -1,5 +1,7 @@
 import { Request, Response, NextFunction } from 'express';
+import { Types } from 'mongoose';
 import { ServiceToken, ServiceTokenData } from '../models';
+import { validateClientForServiceTokenData } from '../helpers/serviceTokenData';
 import { validateMembership } from '../helpers/membership';
 import { AccountNotFoundError, UnauthorizedRequestError } from '../utils/errors';
 
@@ -9,30 +11,17 @@ const requireServiceTokenDataAuth = ({
     acceptedRoles,
     location = 'params'
 }: {
-    acceptedRoles: string[];
+    acceptedRoles: Array<'admin' | 'member'>;
     location?: req;
 }) => {
     return async (req: Request, res: Response, next: NextFunction) => {
         const { serviceTokenDataId } = req[location];
-
-        const serviceTokenData = await ServiceTokenData
-            .findById(req[location].serviceTokenDataId)
-            .select('+encryptedKey +iv +tag').populate('user');
-
-        if (!serviceTokenData) {
-            return next(AccountNotFoundError({ message: 'Failed to locate service token data' }));
-        }
-
-        if (req.user) {
-            // case: jwt auth
-            await validateMembership({
-                userId: req.user._id.toString(),
-                workspaceId: serviceTokenData.workspace.toString(),
-                acceptedRoles
-            });
-        }
-
-        req.serviceTokenData = serviceTokenData;
+        
+        req.serviceTokenData = await validateClientForServiceTokenData({
+            authData: req.authData,
+            serviceTokenDataId: new Types.ObjectId(serviceTokenDataId),
+            acceptedRoles
+        });
 
         next();
     }

backend/src/middleware/requireWorkspaceAuth.ts

@@ -1,5 +1,7 @@
 import { Request, Response, NextFunction } from 'express';
+import { Types } from 'mongoose';
 import { validateMembership } from '../helpers/membership';
+import { validateClientForWorkspace } from '../helpers/workspace';
 import { UnauthorizedRequestError } from '../utils/errors';
 
 type req = 'params' | 'body' | 'query';
@@ -13,38 +15,36 @@ type req = 'params' | 'body' | 'query';
  */
 const requireWorkspaceAuth = ({
 	acceptedRoles,
-	location = 'params'
+	locationWorkspaceId,
+	locationEnvironment = undefined,
+	requiredPermissions = [],
+	requireBlindIndicesEnabled = false
 }: {
-	acceptedRoles: string[];
-	location?: req;
+	acceptedRoles: Array<'admin' | 'member'>;
+	locationWorkspaceId: req;
+	locationEnvironment?: req | undefined;
+	requiredPermissions?: string[];
+	requireBlindIndicesEnabled?: boolean;
 }) => {
 	return async (req: Request, res: Response, next: NextFunction) => {
-		try {
-			const { workspaceId } = req[location];
-			
-			if (req.user) {
-				// case: jwt auth
-				const membership = await validateMembership({
-					userId: req.user._id.toString(),
-					workspaceId,
-					acceptedRoles
-				});
-
-				req.membership = membership;
-			}
-
-			if (
-				req.serviceTokenData 
-				&& req.serviceTokenData.workspace.toString() !== workspaceId
-				&& req.serviceTokenData.environment !== req.body.environment
-			) {
-				next(UnauthorizedRequestError({message: 'Unable to authenticate workspace'}))	
-			}
-
-			return next();
-		} catch (err) {
-			return next(UnauthorizedRequestError({message: 'Unable to authenticate workspace'}))
+		const workspaceId = req[locationWorkspaceId]?.workspaceId;
+		const environment = locationEnvironment ? req[locationEnvironment]?.environment : undefined;
+		
+		// validate clients
+		const { membership } = await validateClientForWorkspace({
+			authData: req.authData,
+			workspaceId: new Types.ObjectId(workspaceId),
+			environment,
+			acceptedRoles,
+			requiredPermissions,
+			requireBlindIndicesEnabled
+		});
+		
+		if (membership) {
+			req.membership = membership;
 		}
+
+		return next();
 	};
 };
 

backend/src/models/apiKeyData.ts

@@ -3,6 +3,7 @@ import { Schema, model, Types } from 'mongoose';
 export interface IAPIKeyData {
     name: string;
     user: Types.ObjectId;
+    lastUsed: Date;
     expiresAt: Date;
     secretHash: string;
 }
@@ -18,6 +19,9 @@ const apiKeyDataSchema = new Schema<IAPIKeyData>(
             ref: 'User',
             required: true
         },
+        lastUsed: {
+            type: Date
+        },
         expiresAt: {
             type: Date
         },

backend/src/models/index.ts

@@ -9,7 +9,12 @@ import Membership, { IMembership } from './membership';
 import MembershipOrg, { IMembershipOrg } from './membershipOrg';
 import Organization, { IOrganization } from './organization';
 import Secret, { ISecret } from './secret';
+import SecretBlindIndexData, { ISecretBlindIndexData } from './secretBlindIndexData';
 import ServiceToken, { IServiceToken } from './serviceToken';
+import ServiceAccount, { IServiceAccount } from './serviceAccount'; // new
+import ServiceAccountKey, { IServiceAccountKey } from './serviceAccountKey'; // new 
+import ServiceAccountOrganizationPermission, { IServiceAccountOrganizationPermission } from './serviceAccountOrganizationPermission'; // new
+import ServiceAccountWorkspacePermission, { IServiceAccountWorkspacePermission } from './serviceAccountWorkspacePermission'; // new
 import TokenData, { ITokenData } from './tokenData';
 import User, { IUser } from './user';
 import UserAction, { IUserAction } from './userAction';
@@ -41,8 +46,18 @@ export {
 	IOrganization,
 	Secret,
 	ISecret,
+	SecretBlindIndexData,
+	ISecretBlindIndexData,
 	ServiceToken,
 	IServiceToken,
+	ServiceAccount,
+	IServiceAccount,
+	ServiceAccountKey,
+	IServiceAccountKey,
+	ServiceAccountOrganizationPermission,
+	IServiceAccountOrganizationPermission,
+	ServiceAccountWorkspacePermission,
+	IServiceAccountWorkspacePermission,
 	TokenData,
 	ITokenData,
 	User,

backend/src/models/integration.ts

@@ -9,9 +9,11 @@ import {
   INTEGRATION_GITHUB,
   INTEGRATION_GITLAB,
   INTEGRATION_RENDER,
+  INTEGRATION_RAILWAY,
   INTEGRATION_FLYIO,
   INTEGRATION_CIRCLECI,
   INTEGRATION_TRAVISCI,
+  INTEGRATION_SUPABASE
 } from "../variables";
 
 export interface IIntegration {
@@ -20,9 +22,12 @@ export interface IIntegration {
   environment: string;
   isActive: boolean;
   app: string;
+  appId: string;
   owner: string;
   targetEnvironment: string;
-  appId: string;
+  targetEnvironmentId: string;
+  targetService: string;
+  targetServiceId: string;
   path: string;
   region: string;
   integration:
@@ -35,9 +40,11 @@ export interface IIntegration {
     | 'github'
     | 'gitlab'
     | 'render' 
+    | 'railway' 
     | 'flyio'
     | 'circleci'
-    | 'travisci';
+    | 'travisci'
+    | 'supabase';
   integrationAuth: Types.ObjectId;
 }
 
@@ -71,6 +78,20 @@ const integrationSchema = new Schema<IIntegration>(
       type: String,
       default: null,
     },
+    targetEnvironmentId: {
+      type: String,
+      default: null
+    },
+    targetService: {
+      // railway-specific service
+      type: String,
+      default: null
+    },
+    targetServiceId: {
+      // railway-specific service
+      type: String,
+      default: null
+    },
     owner: {
       // github-specific repo owner-login
       type: String,
@@ -99,9 +120,11 @@ const integrationSchema = new Schema<IIntegration>(
         INTEGRATION_GITHUB,
         INTEGRATION_GITLAB,
         INTEGRATION_RENDER,
+        INTEGRATION_RAILWAY,
         INTEGRATION_FLYIO,
         INTEGRATION_CIRCLECI,
         INTEGRATION_TRAVISCI,
+        INTEGRATION_SUPABASE
       ],
       required: true,
     },

backend/src/models/integrationAuth.ts

@@ -1,4 +1,4 @@
-import { Schema, model, Types } from "mongoose";
+import { Schema, model, Types, Document } from "mongoose";
 import {
   INTEGRATION_AZURE_KEY_VAULT,
   INTEGRATION_AWS_PARAMETER_STORE,
@@ -9,15 +9,17 @@ import {
   INTEGRATION_GITHUB,
   INTEGRATION_GITLAB,
   INTEGRATION_RENDER,
+  INTEGRATION_RAILWAY,
   INTEGRATION_FLYIO,
   INTEGRATION_CIRCLECI,
   INTEGRATION_TRAVISCI,
+  INTEGRATION_SUPABASE,
 } from "../variables";
 
-export interface IIntegrationAuth {
+export interface IIntegrationAuth extends Document {
   _id: Types.ObjectId;
   workspace: Types.ObjectId;
-  integration: 'heroku' | 'vercel' | 'netlify' | 'github' | 'gitlab' | 'render' | 'flyio' | 'azure-key-vault' | 'circleci' | 'travisci' | 'aws-parameter-store' | 'aws-secret-manager';
+  integration: 'heroku' | 'vercel' | 'netlify' | 'github' | 'gitlab' | 'render' | 'railway' | 'flyio' | 'azure-key-vault' | 'circleci' | 'travisci' | 'supabase' | 'aws-parameter-store' | 'aws-secret-manager';
   teamId: string;
   accountId: string;
   refreshCiphertext?: string;
@@ -51,9 +53,11 @@ const integrationAuthSchema = new Schema<IIntegrationAuth>(
         INTEGRATION_GITHUB,
         INTEGRATION_GITLAB,
         INTEGRATION_RENDER,
+        INTEGRATION_RAILWAY,
         INTEGRATION_FLYIO,
         INTEGRATION_CIRCLECI,
         INTEGRATION_TRAVISCI,
+        INTEGRATION_SUPABASE
       ],
       required: true,
     },

backend/src/models/membershipOrg.ts

@@ -1,7 +1,7 @@
-import { Schema, model, Types } from 'mongoose';
+import { Schema, model, Types, Document } from 'mongoose';
 import { OWNER, ADMIN, MEMBER, INVITED, ACCEPTED } from '../variables';
 
-export interface IMembershipOrg {
+export interface IMembershipOrg extends Document {
 	_id: Types.ObjectId;
 	user: Types.ObjectId;
 	inviteEmail: string;

backend/src/models/secret.ts

@@ -11,6 +11,7 @@ export interface ISecret {
 	type: string;
 	user: Types.ObjectId;
 	environment: string;
+	secretBlindIndex?: string;
 	secretKeyCiphertext: string;
 	secretKeyIV: string;
 	secretKeyTag: string;
@@ -57,6 +58,10 @@ const secretSchema = new Schema<ISecret>(
 			type: String,
 			required: true
 		},
+		secretBlindIndex: {
+			type: String,
+			select: false
+		},
 		secretKeyCiphertext: {
 			type: String,
 			required: true

backend/src/models/secretBlindIndexData.ts

@@ -0,0 +1,35 @@
+import { Schema, model, Types, Document } from 'mongoose';
+
+export interface ISecretBlindIndexData extends Document {
+    _id: Types.ObjectId;
+    workspace: Types.ObjectId;
+    encryptedSaltCiphertext: string;
+    saltIV: string;
+    saltTag: string;
+}
+
+const secretBlindIndexDataSchema = new Schema<ISecretBlindIndexData>(
+    {
+        workspace: {
+            type: Schema.Types.ObjectId,
+            ref: 'Workspace',
+            required: true
+        },
+        encryptedSaltCiphertext: {
+            type: String,
+            required: true
+        },
+        saltIV: {
+            type: String,
+            required: true
+        },
+        saltTag: {
+            type: String,
+            required: true
+        }
+    }
+);
+
+const SecretBlindIndexData = model<ISecretBlindIndexData>('SecretBlindIndexData', secretBlindIndexDataSchema);
+
+export default SecretBlindIndexData;

backend/src/models/serviceAccount.ts

@@ -0,0 +1,53 @@
+import { Schema, model, Types, Document } from 'mongoose';
+
+export interface IServiceAccount extends Document {
+    _id: Types.ObjectId;
+    name: string;
+    organization: Types.ObjectId;
+    user: Types.ObjectId;
+    publicKey: string;
+    lastUsed: Date;
+    expiresAt: Date;
+    secretHash: string;
+}
+
+const serviceAccountSchema = new Schema<IServiceAccount>(
+    {
+        name: {
+            type: String,
+            required: true
+        },
+        organization: {
+            type: Schema.Types.ObjectId,
+            ref: 'Organization',
+            required: true
+        },
+        user: { // user who created the service account
+            type: Schema.Types.ObjectId,
+            ref: 'User',
+            required: true
+        },
+        publicKey: {
+            type: String,
+            required: true
+        },
+        lastUsed: {
+            type: Date
+        },
+        expiresAt: {
+            type: Date
+        },
+        secretHash: {
+            type: String,
+            required: true,
+            select: false
+        }
+    },
+    {
+        timestamps: true
+    }
+);
+
+const ServiceAccount = model<IServiceAccount>('ServiceAccount', serviceAccountSchema);
+
+export default ServiceAccount;

backend/src/models/serviceAccountKey.ts

@@ -0,0 +1,44 @@
+import { Schema, model, Types } from 'mongoose';
+
+export interface IServiceAccountKey {
+    _id: Types.ObjectId;
+    encryptedKey: string;
+    nonce: string;
+    sender: Types.ObjectId;
+    serviceAccount: Types.ObjectId;
+    workspace: Types.ObjectId;
+}
+
+const serviceAccountKeySchema = new Schema<IServiceAccountKey>(
+    {
+        encryptedKey: {
+            type: String,
+            required: true
+        },
+        nonce: {
+            type: String,
+            required: true
+        },
+        sender: {
+            type: Schema.Types.ObjectId,
+            required: true
+        },
+        serviceAccount: {
+            type: Schema.Types.ObjectId,
+            ref: 'ServiceAccount',
+            required: true
+        },
+        workspace: {
+            type: Schema.Types.ObjectId,
+            ref: 'Workspace',
+            required: true
+        }
+    },
+    {
+        timestamps: true
+    }
+);
+
+const ServiceAccountKey = model<IServiceAccountKey>('ServiceAccountKey', serviceAccountKeySchema);
+
+export default ServiceAccountKey;

backend/src/models/serviceAccountOrganizationPermission.ts

@@ -0,0 +1,23 @@
+import { Schema, model, Types, Document } from 'mongoose';
+
+export interface IServiceAccountOrganizationPermission extends Document {
+    _id: Types.ObjectId;
+    serviceAccount: Types.ObjectId;
+}
+
+const serviceAccountOrganizationPermissionSchema = new Schema<IServiceAccountOrganizationPermission>(
+    {
+        serviceAccount: {
+            type: Schema.Types.ObjectId,
+            ref: 'ServiceAccount',
+            required: true
+        }
+    },
+    {
+        timestamps: true
+    }
+);
+
+const ServiceAccountOrganizationPermission = model<IServiceAccountOrganizationPermission>('ServiceAccountOrganizationPermission', serviceAccountOrganizationPermissionSchema);
+
+export default ServiceAccountOrganizationPermission;

backend/src/models/serviceAccountWorkspacePermission.ts

@@ -0,0 +1,44 @@
+import { Schema, model, Types, Document } from 'mongoose';
+
+export interface IServiceAccountWorkspacePermission extends Document {
+    _id: Types.ObjectId;
+    serviceAccount: Types.ObjectId;
+    workspace: Types.ObjectId;
+    environment: string;
+    read: boolean;
+    write: boolean;
+}
+
+const serviceAccountWorkspacePermissionSchema = new Schema<IServiceAccountWorkspacePermission>(
+    {
+        serviceAccount: {
+            type: Schema.Types.ObjectId,
+            ref: 'ServiceAccount',
+            required: true
+        },
+        workspace:{
+            type: Schema.Types.ObjectId,
+            ref: 'Workspace',
+            required: true
+        },
+        environment: {
+            type: String,
+            required: true
+        },
+        read: {
+            type: Boolean,
+            default: false
+        },
+        write: {
+            type: Boolean,
+            default: false
+        }
+    },
+    {
+        timestamps: true
+    }
+);
+
+const ServiceAccountWorkspacePermission = model<IServiceAccountWorkspacePermission>('ServiceAccountWorkspacePermission', serviceAccountWorkspacePermissionSchema);
+
+export default ServiceAccountWorkspacePermission;

backend/src/models/serviceTokenData.ts

@@ -1,10 +1,13 @@
-import { Schema, model, Types } from 'mongoose';
+import { Schema, model, Types, Document } from 'mongoose';
 
-export interface IServiceTokenData {
+export interface IServiceTokenData extends Document {
+    _id: Types.ObjectId;
     name: string;
     workspace: Types.ObjectId;
     environment: string;
     user: Types.ObjectId;
+    serviceAccount: Types.ObjectId;
+    lastUsed: Date;
     expiresAt: Date;
     secretHash: string;
     encryptedKey: string;
@@ -24,7 +27,7 @@ const serviceTokenDataSchema = new Schema<IServiceTokenData>(
             ref: 'Workspace',
             required: true
         },
-        environment: { // TODO: adapt to upcoming environment id
+        environment: {
             type: String,
             required: true
         },
@@ -33,6 +36,13 @@ const serviceTokenDataSchema = new Schema<IServiceTokenData>(
             ref: 'User',
             required: true
         },
+        serviceAccount: {
+            type: Schema.Types.ObjectId,
+            ref: 'ServiceAccount'
+        },
+        lastUsed: {
+            type: Date
+        },
         expiresAt: {
             type: Date
         },

backend/src/models/workspace.ts

@@ -55,4 +55,4 @@ const workspaceSchema = new Schema<IWorkspace>({
 
 const Workspace = model<IWorkspace>('Workspace', workspaceSchema);
 
-export default Workspace;
+export default Workspace;

backend/src/routes/v1/auth.ts

@@ -4,6 +4,7 @@ import { body } from 'express-validator';
 import { requireAuth, validateRequest } from '../../middleware';
 import { authController } from '../../controllers/v1';
 import { authLimiter } from '../../helpers/rateLimiter';
+import { AUTH_MODE_JWT } from '../../variables';
 
 router.post('/token', validateRequest, authController.getNewToken);
 
@@ -29,7 +30,7 @@ router.post(
   '/logout', 
   authLimiter,
   requireAuth({
-    acceptedAuthModes: ['jwt']
+    acceptedAuthModes: [AUTH_MODE_JWT]
   }), 
   authController.logout
 );
@@ -37,7 +38,7 @@ router.post(
 router.post(
   '/checkAuth', 
   requireAuth({
-    acceptedAuthModes: ['jwt']
+    acceptedAuthModes: [AUTH_MODE_JWT]
   }), 
   authController.checkAuth
 );

backend/src/routes/v1/bot.ts

@@ -8,15 +8,16 @@ import {
     validateRequest
 } from '../../middleware';
 import { botController } from '../../controllers/v1';
-import { ADMIN, MEMBER } from '../../variables';
+import { ADMIN, MEMBER, AUTH_MODE_JWT } from '../../variables';
 
 router.get(
     '/:workspaceId',
 	requireAuth({
-        acceptedAuthModes: ['jwt']
+        acceptedAuthModes: [AUTH_MODE_JWT]
     }),
 	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER]
+		acceptedRoles: [ADMIN, MEMBER],
+        locationWorkspaceId: 'params'
 	}),
     param('workspaceId').exists().trim().notEmpty(),
     validateRequest,
@@ -26,7 +27,7 @@ router.get(
 router.patch(
     '/:botId/active',
 	requireAuth({
-        acceptedAuthModes: ['jwt']
+        acceptedAuthModes: [AUTH_MODE_JWT]
     }),
     requireBotAuth({
 		acceptedRoles: [ADMIN, MEMBER]

backend/src/routes/v1/integration.ts

@@ -6,14 +6,19 @@ import {
 	requireIntegrationAuthorizationAuth,
 	validateRequest
 } from '../../middleware';
-import { ADMIN, MEMBER } from '../../variables';
+import {
+	ADMIN, 
+	MEMBER,
+	AUTH_MODE_JWT,
+	AUTH_MODE_API_KEY
+} from '../../variables';
 import { body, param } from 'express-validator';
 import { integrationController } from '../../controllers/v1';
 
 router.post( // new: add new integration for integration auth
 	'/',
 	requireAuth({
-        acceptedAuthModes: ['jwt', 'apiKey']
+        acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY]
     }),
 	requireIntegrationAuthorizationAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -25,6 +30,9 @@ router.post( // new: add new integration for integration auth
 	body('appId').trim(),
 	body('sourceEnvironment').trim(),
 	body('targetEnvironment').trim(),
+	body('targetEnvironmentId').trim(),
+	body('targetService').trim(),
+	body('targetServiceId').trim(),
 	body('owner').trim(),
 	body('path').trim(),
 	body('region').trim(),
@@ -35,7 +43,7 @@ router.post( // new: add new integration for integration auth
 router.patch(
 	'/:integrationId',
 	requireAuth({
-        acceptedAuthModes: ['jwt']
+        acceptedAuthModes: [AUTH_MODE_JWT]
     }),
 	requireIntegrationAuth({
 		acceptedRoles: [ADMIN, MEMBER]
@@ -54,7 +62,7 @@ router.patch(
 router.delete(
 	'/:integrationId',
 	requireAuth({
-        acceptedAuthModes: ['jwt']
+        acceptedAuthModes: [AUTH_MODE_JWT]
     }),
 	requireIntegrationAuth({
 		acceptedRoles: [ADMIN, MEMBER]

backend/src/routes/v1/integrationAuth.ts

@@ -7,13 +7,18 @@ import {
 	requireIntegrationAuthorizationAuth,
 	validateRequest
 } from '../../middleware';
-import { ADMIN, MEMBER } from '../../variables';
+import {
+	ADMIN, 
+	MEMBER,
+	AUTH_MODE_JWT,
+	AUTH_MODE_API_KEY
+} from '../../variables';
 import { integrationAuthController } from '../../controllers/v1';
 
 router.get(
 	'/integration-options',
 	requireAuth({
-        acceptedAuthModes: ['jwt']
+        acceptedAuthModes: [AUTH_MODE_JWT]
     }),
 	integrationAuthController.getIntegrationOptions
 );
@@ -21,7 +26,7 @@ router.get(
 router.get(
 	'/:integrationAuthId',
 	requireAuth({
-        acceptedAuthModes: ['jwt']
+        acceptedAuthModes: [AUTH_MODE_JWT]
     }),
 	requireIntegrationAuthorizationAuth({
 		acceptedRoles: [ADMIN, MEMBER]
@@ -34,11 +39,11 @@ router.get(
 router.post(
 	'/oauth-token',
 	requireAuth({
-        acceptedAuthModes: ['jwt']
+        acceptedAuthModes: [AUTH_MODE_JWT]
     }),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
-		location: 'body'
+		locationWorkspaceId: 'body'
 	}),
 	body('workspaceId').exists().trim().notEmpty(),
 	body('code').exists().trim().notEmpty(),
@@ -49,25 +54,25 @@ router.post(
 
 router.post(
 	'/access-token',
-	requireAuth({
-        acceptedAuthModes: ['jwt', 'apiKey']
-    }),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		location: 'body'
-	}),
 	body('workspaceId').exists().trim().notEmpty(),
 	body('accessId').trim(),
 	body('accessToken').exists().trim().notEmpty(),
 	body('integration').exists().trim().notEmpty(),
 	validateRequest,
+	requireAuth({
+        acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY]
+    }),
+	requireWorkspaceAuth({
+		acceptedRoles: [ADMIN, MEMBER],
+		locationWorkspaceId: 'body'
+	}),
 	integrationAuthController.saveIntegrationAccessToken
 );
 
 router.get(
 	'/:integrationAuthId/apps',
 	requireAuth({
-        acceptedAuthModes: ['jwt']
+        acceptedAuthModes: [AUTH_MODE_JWT]
     }),
 	requireIntegrationAuthorizationAuth({
 		acceptedRoles: [ADMIN, MEMBER]
@@ -81,7 +86,7 @@ router.get(
 router.get(
 	'/:integrationAuthId/teams',
 	requireAuth({
-        acceptedAuthModes: ['jwt']
+        acceptedAuthModes: [AUTH_MODE_JWT]
     }),
 	requireIntegrationAuthorizationAuth({
 		acceptedRoles: [ADMIN, MEMBER]
@@ -106,10 +111,38 @@ router.get(
 	integrationAuthController.getIntegrationAuthVercelBranches
 );
 
+router.get(
+	'/:integrationAuthId/railway/environments',
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
+	requireIntegrationAuthorizationAuth({
+		acceptedRoles: [ADMIN, MEMBER]
+	}),
+	param('integrationAuthId').exists().isString(),
+	query('appId').exists().isString(),
+	validateRequest,
+	integrationAuthController.getIntegrationAuthRailwayEnvironments
+);
+
+router.get(
+	'/:integrationAuthId/railway/services',
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
+	requireIntegrationAuthorizationAuth({
+		acceptedRoles: [ADMIN, MEMBER]
+	}),
+	param('integrationAuthId').exists().isString(),
+	query('appId').exists().isString(),
+	validateRequest,
+	integrationAuthController.getIntegrationAuthRailwayServices
+);
+
 router.delete(
 	'/:integrationAuthId',
 	requireAuth({
-        acceptedAuthModes: ['jwt']
+        acceptedAuthModes: [AUTH_MODE_JWT]
     }),
 	requireIntegrationAuthorizationAuth({
 		acceptedRoles: [ADMIN, MEMBER],

backend/src/routes/v1/inviteOrg.ts

@@ -3,11 +3,12 @@ const router = express.Router();
 import { body } from 'express-validator';
 import { requireAuth, validateRequest } from '../../middleware';
 import { membershipOrgController } from '../../controllers/v1';
+import { AUTH_MODE_JWT } from '../../variables';
 
 router.post(
 	'/signup',
 	requireAuth({
-        acceptedAuthModes: ['jwt']
+        acceptedAuthModes: [AUTH_MODE_JWT]
     }),
 	body('inviteeEmail').exists().trim().notEmpty().isEmail(),
 	body('organizationId').exists().trim().notEmpty(),