Merge remote-tracking branch 'origin' into secrets-v3

backend/src/routes/v2/secret.ts

@@ -10,7 +10,9 @@ import {
   ADMIN, 
   MEMBER,
   AUTH_MODE_JWT,
-  AUTH_MODE_SERVICE_TOKEN
+  AUTH_MODE_SERVICE_TOKEN,
+  PERMISSION_READ_SECRETS,
+  PERMISSION_WRITE_SECRETS
 } from '../../variables';
 import { CreateSecretRequestBody, ModifySecretRequestBody } from '../../types/secret';
 import { secretController } from '../../controllers/v2';
@@ -75,7 +77,8 @@ router.get(
     acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_SERVICE_TOKEN]
   }),
   requireSecretAuth({
-    acceptedRoles: [ADMIN, MEMBER]
+    acceptedRoles: [ADMIN, MEMBER],
+    requiredPermissions: [PERMISSION_READ_SECRETS]
   }),
   validateRequest,
   secretController.getSecret
@@ -103,7 +106,8 @@ router.delete(
     acceptedAuthModes: [AUTH_MODE_JWT]
   }),
   requireSecretAuth({
-    acceptedRoles: [ADMIN, MEMBER]
+    acceptedRoles: [ADMIN, MEMBER],
+    requiredPermissions: [PERMISSION_READ_SECRETS, PERMISSION_WRITE_SECRETS]
   }),
   param('secretId').isMongoId(),
   validateRequest,

backend/src/routes/v2/secrets.ts

@@ -1,5 +1,6 @@
 import express from 'express';
 const router = express.Router();
+import { Types } from 'mongoose';
 import {
     requireAuth,
     requireWorkspaceAuth,
@@ -47,7 +48,7 @@ router.post(
                 if (secretIds.length > 0) {
                     req.secrets = await validateClientForSecrets({
                         authData: req.authData,
-                        secretIds,
+                        secretIds: secretIds.map((secretId: string) => new Types.ObjectId(secretId)),
                         requiredPermissions: []
                     });
                 }

backend/src/routes/v2/serviceAccounts.ts

@@ -53,7 +53,7 @@ router.post(
     requireOrganizationAuth({
         acceptedRoles: [OWNER, ADMIN, MEMBER],
         acceptedStatuses: [ACCEPTED],
-        location: 'body'
+        locationOrganizationId: 'body'
     }),
     serviceAccountsController.createServiceAccount
 );

backend/src/routes/v2/workspace.ts

@@ -106,7 +106,8 @@ router.patch( // TODO - rewire dashboard to this route
 		locationWorkspaceId: 'params'
 	}),
 	requireMembershipAuth({
-		acceptedRoles: [ADMIN]
+		acceptedRoles: [ADMIN],
+		locationMembershipId: 'params'
 	}),
 	workspaceController.updateWorkspaceMembership
 );
@@ -124,7 +125,8 @@ router.delete( // TODO - rewire dashboard to this route
 		locationWorkspaceId: 'params'
 	}),
 	requireMembershipAuth({
-		acceptedRoles: [ADMIN]
+		acceptedRoles: [ADMIN],
+		locationMembershipId: 'params'
 	}),
 	workspaceController.deleteWorkspaceMembership
 );