Scope switch cases into blocks for secrets v3

backend/src/validation/index.ts

@@ -9,4 +9,4 @@ export * from "./organization";
 export * from "./secrets";
 export * from "./serviceAccount";
 export * from "./serviceTokenData";
-export * from "./serviceTokenV3";
+export * from "./serviceTokenDataV3";

backend/src/validation/secrets.ts

@@ -254,7 +254,7 @@ export const CreateSecretRawV3 = z.object({
     environment: z.string().trim(),
     secretPath: z.string().trim().default("/"),
     secretValue: z.string().trim(),
-    secretComment: z.string().trim(),
+    secretComment: z.string().trim().optional().default(""),
     type: z.enum([SECRET_SHARED, SECRET_PERSONAL])
   }),
   params: z.object({

backend/src/validation/serviceTokenDataV3.ts

@@ -0,0 +1,96 @@
+import { Types } from "mongoose";
+import { IServiceTokenDataV3 } from "../models";
+import { Permission } from "../models/serviceTokenDataV3";
+import { z } from "zod";
+import { UnauthorizedRequestError } from "../utils/errors";
+import { isValidScopeV3 } from "../helpers";
+
+/**
+ * Validate that service token (client) can access workspace
+ * with id [workspaceId] and its environment [environment] with required permissions
+ * [requiredPermissions]
+ * @param {Object} obj
+ * @param {ServiceTokenData} obj.serviceTokenData - service token client
+ * @param {Types.ObjectId} obj.workspaceId - id of workspace to validate against
+ * @param {String} environment - (optional) environment in workspace to validate against
+ * @param {String[]} acceptedPermissions - accepted permissions as part of the endpoint
+ */
+ export const validateServiceTokenDataV3ClientForWorkspace = async ({
+  serviceTokenData,
+  workspaceId,
+  environment,
+  secretPath = "/",
+  acceptedPermissions
+}: {
+  serviceTokenData: IServiceTokenDataV3;
+  workspaceId: Types.ObjectId;
+  environment?: string;
+  secretPath?: string;
+  acceptedPermissions: Permission[];
+}) => {
+
+  if (!serviceTokenData.workspace.equals(workspaceId)) {
+    // case: invalid workspaceId passed
+    throw UnauthorizedRequestError({
+      message: "Failed service token authorization for the given workspace"
+    });
+  }
+  
+  if (environment) {
+    const isValid = isValidScopeV3({
+      authPayload: serviceTokenData,
+      environment,
+      secretPath,
+      acceptedPermissions
+    });
+    
+    if (!isValid) throw UnauthorizedRequestError({
+      message: "Failed service token authorization for the given workspace"
+    });
+  }
+};
+
+export const CreateServiceTokenV3 = z.object({
+  body: z.object({
+    name: z.string().trim(),
+    workspaceId: z.string().trim(),
+    publicKey: z.string().trim(),
+    scopes: z
+      .object({
+        permission: z.enum(["read", "readWrite"]),
+        environment: z.string().trim(),
+        secretPath: z.string().trim()
+      })
+      .array()
+      .min(1),
+    expiresIn: z.number().optional(),
+    encryptedKey: z.string().trim(),
+    nonce: z.string().trim()
+  })
+});
+  
+export const UpdateServiceTokenV3 = z.object({
+  params: z.object({
+    serviceTokenDataId: z.string()
+  }),
+  body: z.object({
+    name: z.string().trim().optional(),
+    isActive: z.boolean().optional(),
+    scopes: z
+      .object({
+        permission: z.enum(["read", "readWrite"]),
+        environment: z.string().trim(),
+        secretPath: z.string().trim()
+      })
+      .array()
+      .min(1)
+      .optional(),
+    expiresIn: z.number().optional()
+  }),
+});
+
+export const DeleteServiceTokenV3 = z.object({
+  params: z.object({
+    serviceTokenDataId: z.string()
+  }),
+});

backend/src/validation/serviceTokenV3.ts

@@ -1,46 +0,0 @@
-import { z } from "zod";
-
-export const CreateServiceTokenV3 = z.object({
-  body: z.object({
-    name: z.string().trim(),
-    workspaceId: z.string().trim(),
-    publicKey: z.string().trim(),
-    scopes: z
-      .object({
-        permission: z.enum(["read", "readWrite"]),
-        environment: z.string().trim(),
-        secretPath: z.string().trim()
-      })
-      .array()
-      .min(1),
-    expiresIn: z.number().optional(),
-    encryptedKey: z.string().trim(),
-    nonce: z.string().trim()
-  })
-});
-  
-export const UpdateServiceTokenV3 = z.object({
-  params: z.object({
-    serviceTokenDataId: z.string()
-  }),
-  body: z.object({
-    name: z.string().trim().optional(),
-    isActive: z.boolean().optional(),
-    scopes: z
-      .object({
-        permission: z.enum(["read", "readWrite"]),
-        environment: z.string().trim(),
-        secretPath: z.string().trim()
-      })
-      .array()
-      .min(1)
-      .optional(),
-    expiresIn: z.number().optional()
-  }),
-});
-
-export const DeleteServiceTokenV3 = z.object({
-  params: z.object({
-    serviceTokenDataId: z.string()
-  }),
-});

backend/src/validation/workspace.ts

@@ -57,7 +57,7 @@ export const validateClientForWorkspace = async ({
         environment,
         requiredPermissions
       });
-      break;
+      return { membership, workspace};
     case ActorType.SERVICE_V3:
       throw UnauthorizedRequestError({
         message: "Failed service token authorization for organization"