feat(rbac): added new validation to all routes and permission check to most

backend/src/controllers/v1/authController.ts

@@ -17,6 +17,8 @@ import {
   getJwtRefreshSecret
 } from "../../config";
 import { ActorType } from "../../ee/models";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/auth";
 
 declare module "jsonwebtoken" {
   export interface UserIDJwtPayload extends jwt.JwtPayload {
@@ -32,7 +34,9 @@ declare module "jsonwebtoken" {
  * @returns
  */
 export const login1 = async (req: Request, res: Response) => {
-  const { email, clientPublicKey }: { email: string; clientPublicKey: string } = req.body;
+  const {
+    body: { email, clientPublicKey }
+  } = await validateRequest(reqValidator.Login1V1, req);
 
   const user = await User.findOne({
     email
@@ -76,7 +80,10 @@ export const login1 = async (req: Request, res: Response) => {
  * @returns
  */
 export const login2 = async (req: Request, res: Response) => {
-  const { email, clientProof } = req.body;
+  const {
+    body: { email, clientProof }
+  } = await validateRequest(reqValidator.Login2V1, req);
+
   const user = await User.findOne({
     email
   }).select("+salt +verifier +publicKey +encryptedPrivateKey +iv +tag");
@@ -194,6 +201,14 @@ export const logout = async (req: Request, res: Response) => {
   });
 };
 
+export const getCommonPasswords = async (req: Request, res: Response) => {
+  const commonPasswords = fs
+    .readFileSync(path.resolve(__dirname, "../../data/" + "common_passwords.txt"), "utf8")
+    .split("\n");
+
+  return res.status(200).send(commonPasswords);
+};
+
 export const revokeAllSessions = async (req: Request, res: Response) => {
   await TokenVersion.updateMany(
     {

backend/src/controllers/v1/botController.ts

@@ -2,10 +2,19 @@ import { Request, Response } from "express";
 import { Types } from "mongoose";
 import { Bot, BotKey } from "../../models";
 import { createBot } from "../../helpers/bot";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/bot";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../services/ProjectRoleService";
+import { ForbiddenError } from "@casl/ability";
+import { BadRequestError } from "../../utils/errors";
 
 interface BotKey {
-    encryptedKey: string;
-    nonce: string;
+  encryptedKey: string;
+  nonce: string;
 }
 
 /**
@@ -16,23 +25,30 @@ interface BotKey {
  * @returns
  */
 export const getBotByWorkspaceId = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetBotByWorkspaceIdV1, req);
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Integrations
+  );
 
   let bot = await Bot.findOne({
-      workspace: workspaceId,
+    workspace: workspaceId
   });
-  
+
   if (!bot) {
-      // case: bot doesn't exist for workspace with id [workspaceId]
-      // -> create a new bot and return it
-      bot = await createBot({
-          name: "Infisical Bot",
-          workspaceId: new Types.ObjectId(workspaceId),
-      });
+    // case: bot doesn't exist for workspace with id [workspaceId]
+    // -> create a new bot and return it
+    bot = await createBot({
+      name: "Infisical Bot",
+      workspaceId: new Types.ObjectId(workspaceId)
+    });
   }
-    
+
   return res.status(200).send({
-      bot,
+    bot
   });
 };
 
@@ -43,46 +59,69 @@ export const getBotByWorkspaceId = async (req: Request, res: Response) => {
  * @returns
  */
 export const setBotActiveState = async (req: Request, res: Response) => {
-    const { isActive, botKey }: { isActive: boolean, botKey: BotKey } = req.body;
-    
-    if (isActive) {
-        // bot state set to active -> share workspace key with bot
-        if (!botKey?.encryptedKey || !botKey?.nonce) {
-            return res.status(400).send({
-                message: "Failed to set bot state to active - missing bot key",
-            });
-        }
-        
-        await BotKey.findOneAndUpdate({
-            workspace: req.bot.workspace,
-        }, {
-            encryptedKey: botKey.encryptedKey,
-            nonce: botKey.nonce,
-            sender: req.user._id,
-            bot: req.bot._id,
-            workspace: req.bot.workspace,
-        }, {
-            upsert: true,
-            new: true,
-        });
-    } else {
-        // case: bot state set to inactive -> delete bot's workspace key
-        await BotKey.deleteOne({
-            bot: req.bot._id,
-        });
+  const {
+    body: { botKey, isActive },
+    params: { botId }
+  } = await validateRequest(reqValidator.SetBotActiveStateV1, req);
+
+  const bot = await Bot.findById(botId);
+  if (!bot) {
+    throw BadRequestError({ message: "Bot not found" });
+  }
+  const userId = req.user._id;
+
+  const { permission } = await getUserProjectPermissions(userId, bot.workspace.toString());
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Edit,
+    ProjectPermissionSub.Integrations
+  );
+
+  if (isActive) {
+    // bot state set to active -> share workspace key with bot
+    if (!botKey?.encryptedKey || !botKey?.nonce) {
+      return res.status(400).send({
+        message: "Failed to set bot state to active - missing bot key"
+      });
     }
 
-    const bot = await Bot.findOneAndUpdate({
-        _id: req.bot._id,
-    }, {
-        isActive,
-    }, {
-        new: true,
-    });
-    
-    if (!bot) throw new Error("Failed to update bot active state");
-    
-    return res.status(200).send({
-        bot,
+    await BotKey.findOneAndUpdate(
+      {
+        workspace: bot.workspace
+      },
+      {
+        encryptedKey: botKey.encryptedKey,
+        nonce: botKey.nonce,
+        sender: userId,
+        bot: bot._id,
+        workspace: bot.workspace
+      },
+      {
+        upsert: true,
+        new: true
+      }
+    );
+  } else {
+    // case: bot state set to inactive -> delete bot's workspace key
+    await BotKey.deleteOne({
+      bot: bot._id
     });
+  }
+
+  const updatedBot = await Bot.findOneAndUpdate(
+    {
+      _id: bot._id
+    },
+    {
+      isActive
+    },
+    {
+      new: true
+    }
+  );
+
+  if (!updatedBot) throw new Error("Failed to update bot active state");
+
+  return res.status(200).send({
+    bot
+  });
 };

backend/src/controllers/v1/integrationAuthController.ts

@@ -2,7 +2,7 @@ import { Request, Response } from "express";
 import { Types } from "mongoose";
 import { standardRequest } from "../../config/request";
 import { getApps, getTeams, revokeAccess } from "../../integrations";
-import { Bot, IntegrationAuth } from "../../models";
+import { Bot, IntegrationAuth, Workspace } from "../../models";
 import { EventType } from "../../ee/models";
 import { IntegrationService } from "../../services";
 import { EEAuditLogService } from "../../ee/services";
@@ -18,12 +18,25 @@ import {
   getIntegrationOptions as getIntegrationOptionsFunc
 } from "../../variables";
 import { exchangeRefresh } from "../../integrations";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/integrationAuth";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../services/ProjectRoleService";
+import { ForbiddenError } from "@casl/ability";
+import { getIntegrationAuthAccessHelper } from "../../helpers";
+import { ObjectId } from "mongodb";
 
 /***
  * Return integration authorization with id [integrationAuthId]
  */
 export const getIntegrationAuth = async (req: Request, res: Response) => {
-  const { integrationAuthId } = req.params;
+  const {
+    params: { integrationAuthId }
+  } = await validateRequest(reqValidator.GetIntegrationAuthV1, req);
+
   const integrationAuth = await IntegrationAuth.findById(integrationAuthId);
 
   if (!integrationAuth)
@@ -31,6 +44,15 @@ export const getIntegrationAuth = async (req: Request, res: Response) => {
       message: "Failed to find integration authorization"
     });
 
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Integrations
+  );
+
   return res.status(200).send({
     integrationAuth
   });
@@ -51,15 +73,19 @@ export const getIntegrationOptions = async (req: Request, res: Response) => {
  * @returns
  */
 export const oAuthExchange = async (req: Request, res: Response) => {
-  const { 
-    workspaceId, 
-    code, 
-    integration,
-    url
-  } = req.body;
+  const {
+    body: { integration, workspaceId, code, url }
+  } = await validateRequest(reqValidator.OauthExchangeV1, req);
   if (!INTEGRATION_SET.has(integration)) throw new Error("Failed to validate integration");
 
-  const environments = req.membership.workspace?.environments || [];
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Create,
+    ProjectPermissionSub.Integrations
+  );
+
+  const workspace = await Workspace.findById(workspaceId);
+  const environments = workspace?.environments || [];
   if (environments.length === 0) {
     throw new Error("Failed to get environments");
   }
@@ -99,25 +125,16 @@ export const oAuthExchange = async (req: Request, res: Response) => {
 export const saveIntegrationToken = async (req: Request, res: Response) => {
   // TODO: refactor
   // TODO: check if access token is valid for each integration
-
   let integrationAuth;
   const {
-    workspaceId,
-    accessId,
-    refreshToken,
-    accessToken,
-    url,
-    namespace,
-    integration
-  }: {
-    workspaceId: string;
-    accessId: string | undefined;
-    refreshToken: string | undefined;
-    accessToken: string | undefined;
-    url: string;
-    namespace: string;
-    integration: string;
-  } = req.body;
+    body: { workspaceId, integration, url, accessId, namespace, accessToken, refreshToken }
+  } = await validateRequest(reqValidator.SaveIntegrationAccessTokenV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Create,
+    ProjectPermissionSub.Integrations
+  );
 
   const bot = await Bot.findOne({
     workspace: new Types.ObjectId(workspaceId),
@@ -169,7 +186,7 @@ export const saveIntegrationToken = async (req: Request, res: Response) => {
   }
 
   if (!integrationAuth) throw new Error("Failed to save integration access token");
-  
+
   await EEAuditLogService.createAuditLog(
     req.authData,
     {
@@ -195,13 +212,29 @@ export const saveIntegrationToken = async (req: Request, res: Response) => {
  * @returns
  */
 export const getIntegrationAuthApps = async (req: Request, res: Response) => {
-  const teamId = req.query.teamId as string;
-  const workspaceSlug = req.query.workspaceSlug as string;
+  const {
+    params: { integrationAuthId },
+    query: { teamId, workspaceSlug }
+  } = await validateRequest(reqValidator.GetIntegrationAuthAppsV1, req);
+
+  // TODO(akhilmhdh): remove class -> static function path and makes these into reusable independent functions
+  const { integrationAuth, accessToken, accessId } = await getIntegrationAuthAccessHelper({
+    integrationAuthId: new ObjectId(integrationAuthId)
+  });
+
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Integrations
+  );
 
   const apps = await getApps({
-    integrationAuth: req.integrationAuth,
-    accessToken: req.accessToken,
-    accessId: req.accessId,
+    integrationAuth: integrationAuth,
+    accessToken: accessToken,
+    accessId: accessId,
     ...(teamId && { teamId }),
     ...(workspaceSlug && { workspaceSlug })
   });
@@ -218,9 +251,27 @@ export const getIntegrationAuthApps = async (req: Request, res: Response) => {
  * @returns
  */
 export const getIntegrationAuthTeams = async (req: Request, res: Response) => {
+  const {
+    params: { integrationAuthId }
+  } = await validateRequest(reqValidator.GetIntegrationAuthTeamsV1, req);
+
+  // TODO(akhilmhdh): remove class -> static function path and makes these into reusable independent functions
+  const { integrationAuth, accessToken } = await getIntegrationAuthAccessHelper({
+    integrationAuthId: new ObjectId(integrationAuthId)
+  });
+
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Integrations
+  );
+
   const teams = await getTeams({
-    integrationAuth: req.integrationAuth,
-    accessToken: req.accessToken
+    integrationAuth: integrationAuth,
+    accessToken: accessToken
   });
 
   return res.status(200).send({
@@ -235,7 +286,24 @@ export const getIntegrationAuthTeams = async (req: Request, res: Response) => {
  * @param res
  */
 export const getIntegrationAuthVercelBranches = async (req: Request, res: Response) => {
-  const appId = req.query.appId as string;
+  const {
+    params: { integrationAuthId },
+    query: { appId }
+  } = await validateRequest(reqValidator.GetIntegrationAuthVercelBranchesV1, req);
+
+  // TODO(akhilmhdh): remove class -> static function path and makes these into reusable independent functions
+  const { integrationAuth, accessToken } = await getIntegrationAuthAccessHelper({
+    integrationAuthId: new ObjectId(integrationAuthId)
+  });
+
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Integrations
+  );
 
   interface VercelBranch {
     ref: string;
@@ -245,9 +313,9 @@ export const getIntegrationAuthVercelBranches = async (req: Request, res: Respon
 
   const params = new URLSearchParams({
     projectId: appId,
-    ...(req.integrationAuth.teamId
+    ...(integrationAuth.teamId
       ? {
-          teamId: req.integrationAuth.teamId
+          teamId: integrationAuth.teamId
         }
       : {})
   });
@@ -260,7 +328,7 @@ export const getIntegrationAuthVercelBranches = async (req: Request, res: Respon
       {
         params,
         headers: {
-          Authorization: `Bearer ${req.accessToken}`,
+          Authorization: `Bearer ${accessToken}`,
           "Accept-Encoding": "application/json"
         }
       }
@@ -281,7 +349,24 @@ export const getIntegrationAuthVercelBranches = async (req: Request, res: Respon
  * @param res
  */
 export const getIntegrationAuthRailwayEnvironments = async (req: Request, res: Response) => {
-  const appId = req.query.appId as string;
+  const {
+    params: { integrationAuthId },
+    query: { appId }
+  } = await validateRequest(reqValidator.GetIntegrationAuthRailwayEnvironmentsV1, req);
+
+  // TODO(akhilmhdh): remove class -> static function path and makes these into reusable independent functions
+  const { integrationAuth, accessToken } = await getIntegrationAuthAccessHelper({
+    integrationAuthId: new ObjectId(integrationAuthId)
+  });
+
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Integrations
+  );
 
   interface RailwayEnvironment {
     node: {
@@ -331,7 +416,7 @@ export const getIntegrationAuthRailwayEnvironments = async (req: Request, res: R
       },
       {
         headers: {
-          Authorization: `Bearer ${req.accessToken}`,
+          Authorization: `Bearer ${accessToken}`,
           "Content-Type": "application/json"
         }
       }
@@ -357,7 +442,24 @@ export const getIntegrationAuthRailwayEnvironments = async (req: Request, res: R
  * @param res
  */
 export const getIntegrationAuthRailwayServices = async (req: Request, res: Response) => {
-  const appId = req.query.appId as string;
+  const {
+    params: { integrationAuthId },
+    query: { appId }
+  } = await validateRequest(reqValidator.GetIntegrationAuthRailwayServicesV1, req);
+
+  // TODO(akhilmhdh): remove class -> static function path and makes these into reusable independent functions
+  const { integrationAuth, accessToken } = await getIntegrationAuthAccessHelper({
+    integrationAuthId: new ObjectId(integrationAuthId)
+  });
+
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Integrations
+  );
 
   interface RailwayService {
     node: {
@@ -422,7 +524,7 @@ export const getIntegrationAuthRailwayServices = async (req: Request, res: Respo
       },
       {
         headers: {
-          Authorization: `Bearer ${req.accessToken}`,
+          Authorization: `Bearer ${accessToken}`,
           "Content-Type": "application/json"
         }
       }
@@ -446,7 +548,6 @@ export const getIntegrationAuthRailwayServices = async (req: Request, res: Respo
  * @returns
  */
 export const getIntegrationAuthBitBucketWorkspaces = async (req: Request, res: Response) => {
-  
   interface WorkspaceResponse {
     size: number;
     page: number;
@@ -466,31 +567,46 @@ export const getIntegrationAuthBitBucketWorkspaces = async (req: Request, res: R
     updated_on: string;
   }
 
+  const {
+    params: { integrationAuthId }
+  } = await validateRequest(reqValidator.GetIntegrationAuthBitbucketWorkspacesV1, req);
+
+  // TODO(akhilmhdh): remove class -> static function path and makes these into reusable independent functions
+  const { integrationAuth, accessToken } = await getIntegrationAuthAccessHelper({
+    integrationAuthId: new ObjectId(integrationAuthId)
+  });
+
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Integrations
+  );
+
   const workspaces: Workspace[] = [];
   let hasNextPage = true;
-  let workspaceUrl = `${INTEGRATION_BITBUCKET_API_URL}/2.0/workspaces`
+  let workspaceUrl = `${INTEGRATION_BITBUCKET_API_URL}/2.0/workspaces`;
 
   while (hasNextPage) {
-    const { data }: { data: WorkspaceResponse } = await standardRequest.get(
-      workspaceUrl,
-      {
-        headers: {
-          Authorization: `Bearer ${req.accessToken}`,
-          "Accept-Encoding": "application/json"
-        }
+    const { data }: { data: WorkspaceResponse } = await standardRequest.get(workspaceUrl, {
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        "Accept-Encoding": "application/json"
       }
-    );
-    
+    });
+
     if (data?.values.length > 0) {
       data.values.forEach((workspace) => {
-        workspaces.push(workspace)
-      })
+        workspaces.push(workspace);
+      });
     }
 
     if (data.next) {
-      workspaceUrl = data.next
+      workspaceUrl = data.next;
     } else {
-      hasNextPage = false
+      hasNextPage = false;
     }
   }
 
@@ -501,13 +617,30 @@ export const getIntegrationAuthBitBucketWorkspaces = async (req: Request, res: R
 
 /**
  * Return list of secret groups for Northflank project with id [appId]
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const getIntegrationAuthNorthflankSecretGroups = async (req: Request, res: Response) => {
-  const appId = req.query.appId as string;
-  
+  const {
+    params: { integrationAuthId },
+    query: { appId }
+  } = await validateRequest(reqValidator.GetIntegrationAuthNorthflankSecretGroupsV1, req);
+
+  // TODO(akhilmhdh): remove class -> static function path and makes these into reusable independent functions
+  const { integrationAuth, accessToken } = await getIntegrationAuthAccessHelper({
+    integrationAuthId: new ObjectId(integrationAuthId)
+  });
+
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Integrations
+  );
+
   interface NorthflankSecretGroup {
     id: string;
     name: string;
@@ -515,43 +648,41 @@ export const getIntegrationAuthNorthflankSecretGroups = async (req: Request, res
     priority: number;
     projectId: string;
   }
-  
+
   interface SecretGroup {
     name: string;
     groupId: string;
   }
-  
+
   const secretGroups: SecretGroup[] = [];
 
-  if (appId && appId !== "") { 
+  if (appId && appId !== "") {
     let page = 1;
     const perPage = 10;
     let hasMorePages = true;
-    
-    while(hasMorePages) {
+
+    while (hasMorePages) {
       const params = new URLSearchParams({
         page: String(page),
         per_page: String(perPage),
-        filter: "all",
+        filter: "all"
       });
 
       const {
         data: {
-          data: {
-            secrets
-          }
+          data: { secrets }
         }
-      } = await standardRequest.get<{ data: { secrets: NorthflankSecretGroup[] }}>(
+      } = await standardRequest.get<{ data: { secrets: NorthflankSecretGroup[] } }>(
         `${INTEGRATION_NORTHFLANK_API_URL}/v1/projects/${appId}/secrets`,
         {
           params,
           headers: {
-            Authorization: `Bearer ${req.accessToken}`,
-            "Accept-Encoding": "application/json",
-          },
+            Authorization: `Bearer ${accessToken}`,
+            "Accept-Encoding": "application/json"
+          }
         }
       );
-      
+
       secrets.forEach((a: any) => {
         secretGroups.push({
           name: a.name,
@@ -566,11 +697,11 @@ export const getIntegrationAuthNorthflankSecretGroups = async (req: Request, res
       page++;
     }
   }
-  
+
   return res.status(200).send({
     secretGroups
   });
-}
+};
 
 /**
  * Return list of build configs for TeamCity project with id [appId]
@@ -579,7 +710,23 @@ export const getIntegrationAuthNorthflankSecretGroups = async (req: Request, res
  * @returns 
  */
 export const getIntegrationAuthTeamCityBuildConfigs = async (req: Request, res: Response) => {
-  const appId = req.query.appId as string;
+  const {
+    params: { integrationAuthId,appId },
+  } = await validateRequest(reqValidator.GetIntegrationAuthTeamCityBuildConfigsV1 , req);
+
+  // TODO(akhilmhdh): remove class -> static function path and makes these into reusable independent functions
+  const { integrationAuth } = await getIntegrationAuthAccessHelper({
+    integrationAuthId: new ObjectId(integrationAuthId)
+  });
+
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Integrations
+  );
   
   interface TeamCityBuildConfig {
     id: string;
@@ -630,30 +777,48 @@ export const getIntegrationAuthTeamCityBuildConfigs = async (req: Request, res:
  * @returns
  */
 export const deleteIntegrationAuth = async (req: Request, res: Response) => {
-  const integrationAuth = await revokeAccess({
-    integrationAuth: req.integrationAuth,
-    accessToken: req.accessToken
+  const {
+    params: { integrationAuthId }
+  } = await validateRequest(reqValidator.DeleteIntegrationAuthV1, req);
+
+  // TODO(akhilmhdh): remove class -> static function path and makes these into reusable independent functions
+  const { integrationAuth, accessToken } = await getIntegrationAuthAccessHelper({
+    integrationAuthId: new ObjectId(integrationAuthId)
   });
-  
-  if (!integrationAuth) return res.status(400).send({
-    message: "Failed to find integration authorization"
+
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Delete,
+    ProjectPermissionSub.Integrations
+  );
+
+  const deletedIntegrationAuth = await revokeAccess({
+    integrationAuth: integrationAuth,
+    accessToken: accessToken
   });
 
+  if (!deletedIntegrationAuth)
+    return res.status(400).send({
+      message: "Failed to find integration authorization"
+    });
+
   await EEAuditLogService.createAuditLog(
     req.authData,
     {
       type: EventType.UNAUTHORIZE_INTEGRATION,
       metadata: {
-        integration: integrationAuth.integration
+        integration: deletedIntegrationAuth.integration
       }
     },
     {
-      workspaceId: integrationAuth.workspace
+      workspaceId: deletedIntegrationAuth.workspace
     }
   );
 
   return res.status(200).send({
-    integrationAuth
+    integrationAuth: deletedIntegrationAuth
   });
 };
-

backend/src/controllers/v1/integrationController.ts

@@ -1,6 +1,6 @@
 import { Request, Response } from "express";
 import { Types } from "mongoose";
-import { Folder, Integration } from "../../models";
+import { IWorkspace, Integration, Folder, IntegrationAuth } from "../../models";
 import { EventService } from "../../services";
 import { eventStartIntegration } from "../../events";
 import { getFolderByPath } from "../../services/FolderService";
@@ -8,6 +8,14 @@ import { BadRequestError } from "../../utils/errors";
 import { EEAuditLogService } from "../../ee/services";
 import { EventType } from "../../ee/models";
 import { syncSecretsToActiveIntegrationsQueue } from "../../queues/integrations/syncSecretsToThirdPartyServices";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/integration";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../services/ProjectRoleService";
+import { ForbiddenError } from "@casl/ability";
 
 /**
  * Create/initialize an (empty) integration for integration authorization
@@ -17,24 +25,42 @@ import { syncSecretsToActiveIntegrationsQueue } from "../../queues/integrations/
  */
 export const createIntegration = async (req: Request, res: Response) => {
   const {
-    integrationAuthId,
-    app,
-    appId,
-    isActive,
-    sourceEnvironment,
-    targetEnvironment,
-    targetEnvironmentId,
-    targetService,
-    targetServiceId,
-    owner,
-    path,
-    region,
-    secretPath,
-    metadata
-  } = req.body;
+    body: {
+      isActive,
+      sourceEnvironment,
+      secretPath,
+      app,
+      path,
+      appId,
+      owner,
+      region,
+      targetService,
+      targetServiceId,
+      integrationAuthId,
+      targetEnvironment,
+      targetEnvironmentId
+    }
+  } = await validateRequest(reqValidator.CreateIntegrationV1, req);
+
+  const integrationAuth = await IntegrationAuth.findById(integrationAuthId)
+    .populate<{ workspace: IWorkspace }>("workspace")
+    .select(
+      "+refreshCiphertext +refreshIV +refreshTag +accessCiphertext +accessIV +accessTag +accessExpiresAt"
+    );
+
+  if (!integrationAuth) throw BadRequestError({ message: "Integration auth not found" });
+
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integrationAuth.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Create,
+    ProjectPermissionSub.Integrations
+  );
 
   const folders = await Folder.findOne({
-    workspace: req.integrationAuth.workspace._id,
+    workspace: integrationAuth.workspace._id,
     environment: sourceEnvironment
   });
 
@@ -42,7 +68,7 @@ export const createIntegration = async (req: Request, res: Response) => {
     const folder = getFolderByPath(folders.nodes, secretPath);
     if (!folder) {
       throw BadRequestError({
-        message: "Path for service token does not exist"
+        message: "Folder path doesn't exist"
       });
     }
   }
@@ -51,7 +77,7 @@ export const createIntegration = async (req: Request, res: Response) => {
 
   // initialize new integration after saving integration access token
   const integration = await new Integration({
-    workspace: req.integrationAuth.workspace._id,
+    workspace: integrationAuth.workspace._id,
     environment: sourceEnvironment,
     isActive,
     app,
@@ -64,9 +90,8 @@ export const createIntegration = async (req: Request, res: Response) => {
     path,
     region,
     secretPath,
-    integration: req.integrationAuth.integration,
-    integrationAuth: new Types.ObjectId(integrationAuthId),
-    metadata
+    integration: integrationAuth.integration,
+    integrationAuth: new Types.ObjectId(integrationAuthId)
   }).save();
 
   if (integration) {
@@ -120,17 +145,32 @@ export const updateIntegration = async (req: Request, res: Response) => {
   // integration has the correct fields populated in [Integration]
 
   const {
-    environment,
-    isActive,
-    app,
-    appId,
-    targetEnvironment,
-    owner, // github-specific integration param
-    secretPath
-  } = req.body;
+    body: {
+      environment,
+      isActive,
+      app,
+      appId,
+      targetEnvironment,
+      owner, // github-specific integration param
+      secretPath
+    },
+    params: { integrationId }
+  } = await validateRequest(reqValidator.UpdateIntegrationV1, req);
+
+  const integration = await Integration.findById(integrationId);
+  if (!integration) throw BadRequestError({ message: "Integration not found" });
+
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integration.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Edit,
+    ProjectPermissionSub.Integrations
+  );
 
   const folders = await Folder.findOne({
-    workspace: req.integration.workspace,
+    workspace: integration.workspace,
     environment
   });
 
@@ -143,9 +183,9 @@ export const updateIntegration = async (req: Request, res: Response) => {
     }
   }
 
-  const integration = await Integration.findOneAndUpdate(
+  const updatedIntegration = await Integration.findOneAndUpdate(
     {
-      _id: req.integration._id
+      _id: integration._id
     },
     {
       environment,
@@ -161,18 +201,18 @@ export const updateIntegration = async (req: Request, res: Response) => {
     }
   );
 
-  if (integration) {
+  if (updatedIntegration) {
     // trigger event - push secrets
     EventService.handleEvent({
       event: eventStartIntegration({
-        workspaceId: integration.workspace,
+        workspaceId: updatedIntegration.workspace,
         environment
       })
     });
   }
 
   return res.status(200).send({
-    integration
+    integration: updatedIntegration
   });
 };
 
@@ -183,13 +223,27 @@ export const updateIntegration = async (req: Request, res: Response) => {
  * @returns
  */
 export const deleteIntegration = async (req: Request, res: Response) => {
-  const { integrationId } = req.params;
+  const {
+    params: { integrationId }
+  } = await validateRequest(reqValidator.DeleteIntegrationV1, req);
 
-  const integration = await Integration.findOneAndDelete({
+  const integration = await Integration.findById(integrationId);
+  if (!integration) throw BadRequestError({ message: "Integration not found" });
+
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    integration.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Delete,
+    ProjectPermissionSub.Integrations
+  );
+
+  const deletedIntegration = await Integration.findOneAndDelete({
     _id: integrationId
   });
 
-  if (!integration) throw new Error("Failed to find integration");
+  if (!deletedIntegration) throw new Error("Failed to find integration");
 
   await EEAuditLogService.createAuditLog(
     req.authData,

backend/src/controllers/v1/keyController.ts

@@ -4,6 +4,14 @@ import { Key } from "../../models";
 import { findMembership } from "../../helpers/membership";
 import { EventType } from "../../ee/models";
 import { EEAuditLogService } from "../../ee/services";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/key";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../services/ProjectRoleService";
+import { ForbiddenError } from "@casl/ability";
 
 /**
  * Add (encrypted) copy of workspace key for workspace with id [workspaceId] for user with
@@ -13,13 +21,21 @@ import { EEAuditLogService } from "../../ee/services";
  * @returns
  */
 export const uploadKey = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
-  const { key } = req.body;
+  const {
+    params: { workspaceId },
+    body: { key }
+  } = await validateRequest(reqValidator.UploadKeyV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Edit,
+    ProjectPermissionSub.Member
+  );
 
   // validate membership of receiver
   const receiverMembership = await findMembership({
     user: key.userId,
-    workspace: workspaceId,
+    workspace: workspaceId
   });
 
   if (!receiverMembership) {
@@ -31,12 +47,12 @@ export const uploadKey = async (req: Request, res: Response) => {
     nonce: key.nonce,
     sender: req.user._id,
     receiver: key.userId,
-    workspace: workspaceId,
+    workspace: workspaceId
   }).save();
 
-	return res.status(200).send({
-		message: "Successfully uploaded key to workspace",
-	});
+  return res.status(200).send({
+    message: "Successfully uploaded key to workspace"
+  });
 };
 
 /**
@@ -46,21 +62,23 @@ export const uploadKey = async (req: Request, res: Response) => {
  * @returns
  */
 export const getLatestKey = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
-  
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetLatestKeyV1, req);
+
   // get latest key
   const latestKey = await Key.find({
     workspace: workspaceId,
-    receiver: req.user._id,
+    receiver: req.user._id
   })
     .sort({ createdAt: -1 })
     .limit(1)
     .populate("sender", "+publicKey");
 
-	const resObj: any = {};
+  const resObj: any = {};
 
-	if (latestKey.length > 0) {
-		resObj["latestKey"] = latestKey[0];
+  if (latestKey.length > 0) {
+    resObj["latestKey"] = latestKey[0];
     await EEAuditLogService.createAuditLog(
       req.authData,
       {
@@ -73,7 +91,7 @@ export const getLatestKey = async (req: Request, res: Response) => {
         workspaceId: new Types.ObjectId(workspaceId)
       }
     );
-	}
+  }
 
-	return res.status(200).send(resObj);
+  return res.status(200).send(resObj);
 };

backend/src/controllers/v1/membershipController.ts

@@ -7,6 +7,14 @@ import { sendMail } from "../../helpers/nodemailer";
 import { ACCEPTED, ADMIN, MEMBER } from "../../variables";
 import { getSiteURL } from "../../config";
 import { EEAuditLogService } from "../../ee/services";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/membership";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../services/ProjectRoleService";
+import { ForbiddenError } from "@casl/ability";
 
 /**
  * Check that user is a member of workspace with id [workspaceId]
@@ -15,7 +23,10 @@ import { EEAuditLogService } from "../../ee/services";
  * @returns
  */
 export const validateMembership = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.ValidateMembershipV1, req);
+
   // validate membership
   const membership = await findMembership({
     user: req.user._id,
@@ -38,8 +49,10 @@ export const validateMembership = async (req: Request, res: Response) => {
  * @returns
  */
 export const deleteMembership = async (req: Request, res: Response) => {
-  const { membershipId } = req.params;
-  
+  const {
+    params: { membershipId }
+  } = await validateRequest(reqValidator.DeleteMembershipV1, req);
+
   // check if membership to delete exists
   const membershipToDelete = await Membership.findOne({
     _id: membershipId
@@ -49,27 +62,20 @@ export const deleteMembership = async (req: Request, res: Response) => {
     throw new Error("Failed to delete workspace membership that doesn't exist");
   }
 
-  // check if user is a member and admin of the workspace
-  // whose membership we wish to delete
-  const membership = await Membership.findOne({
-    user: req.user._id,
-    workspace: membershipToDelete.workspace
-  });
-
-  if (!membership) {
-    throw new Error("Failed to validate workspace membership");
-  }
-
-  if (membership.role !== ADMIN) {
-    // user is not an admin member of the workspace
-    throw new Error("Insufficient role for deleting workspace membership");
-  }
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    membershipToDelete.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Delete,
+    ProjectPermissionSub.Member
+  );
 
   // delete workspace membership
   const deletedMembership = await deleteMember({
     membershipId: membershipToDelete._id.toString()
   });
-  
+
   await EEAuditLogService.createAuditLog(
     req.authData,
     {
@@ -80,7 +86,7 @@ export const deleteMembership = async (req: Request, res: Response) => {
       }
     },
     {
-      workspaceId: membership.workspace
+      workspaceId: membershipToDelete.workspace
     }
   );
 
@@ -96,43 +102,37 @@ export const deleteMembership = async (req: Request, res: Response) => {
  * @returns
  */
 export const changeMembershipRole = async (req: Request, res: Response) => {
-  const { membershipId } = req.params;
-  const { role } = req.body;
+  const {
+    body: { role },
+    params: { membershipId }
+  } = await validateRequest(reqValidator.ChangeMembershipRoleV1, req);
 
   if (![ADMIN, MEMBER].includes(role)) {
     throw new Error("Failed to validate role");
   }
 
   // validate target membership
-  const membershipToChangeRole = await Membership
-    .findById(membershipId)
-    .populate<{ user: IUser }>("user");
+  const membershipToChangeRole = await Membership.findById(membershipId).populate<{ user: IUser }>(
+    "user"
+  );
 
   if (!membershipToChangeRole) {
     throw new Error("Failed to find membership to change role");
   }
 
-  // check if user is a member and admin of target membership's
-  // workspace
-  const membership = await findMembership({
-    user: req.user._id,
-    workspace: membershipToChangeRole.workspace
-  });
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    membershipToChangeRole.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Edit,
+    ProjectPermissionSub.Member
+  );
 
-  if (!membership) {
-    throw new Error("Failed to validate membership");
-  }
-
-  if (membership.role !== ADMIN) {
-    // user is not an admin member of the workspace
-    throw new Error("Insufficient role for changing member roles");
-  }
-  
   const oldRole = membershipToChangeRole.role;
-
   membershipToChangeRole.role = role;
   await membershipToChangeRole.save();
-  
+
   await EEAuditLogService.createAuditLog(
     req.authData,
     {

backend/src/controllers/v1/passwordController.ts

@@ -14,6 +14,8 @@ import {
   getSiteURL
 } from "../../config";
 import { ActorType } from "../../ee/models";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/auth";
 
 /**
  * Password reset step 1: Send email verification link to email [email]
@@ -23,7 +25,9 @@ import { ActorType } from "../../ee/models";
  * @returns
  */
 export const emailPasswordReset = async (req: Request, res: Response) => {
-  const email: string = req.body.email;
+  const {
+    body: { email }
+  } = await validateRequest(reqValidator.EmailPasswordResetV1, req);
 
   const user = await User.findOne({ email }).select("+publicKey");
   if (!user || !user?.publicKey) {
@@ -62,7 +66,9 @@ export const emailPasswordReset = async (req: Request, res: Response) => {
  * @returns
  */
 export const emailPasswordResetVerify = async (req: Request, res: Response) => {
-  const { email, code } = req.body;
+  const {
+    body: { email, code }
+  } = await validateRequest(reqValidator.EmailPasswordResetVerifyV1, req);
 
   const user = await User.findOne({ email }).select("+publicKey");
   if (!user || !user?.publicKey) {
@@ -103,8 +109,10 @@ export const emailPasswordResetVerify = async (req: Request, res: Response) => {
  */
 export const srp1 = async (req: Request, res: Response) => {
   // return salt, serverPublicKey as part of first step of SRP protocol
+  const {
+    body: { clientPublicKey }
+  } = await validateRequest(reqValidator.Srp1V1, req);
 
-  const { clientPublicKey } = req.body;
   const user = await User.findOne({
     email: req.user.email
   }).select("+salt +verifier");
@@ -149,16 +157,18 @@ export const srp1 = async (req: Request, res: Response) => {
  */
 export const changePassword = async (req: Request, res: Response) => {
   const {
-    clientProof,
-    protectedKey,
-    protectedKeyIV,
-    protectedKeyTag,
-    encryptedPrivateKey,
-    encryptedPrivateKeyIV,
-    encryptedPrivateKeyTag,
-    salt,
-    verifier
-  } = req.body;
+    body: {
+      clientProof,
+      protectedKey,
+      protectedKeyIV,
+      protectedKeyTag,
+      encryptedPrivateKey,
+      encryptedPrivateKeyIV,
+      encryptedPrivateKeyTag,
+      salt,
+      verifier
+    }
+  } = await validateRequest(reqValidator.ChangePasswordV1, req);
 
   const user = await User.findOne({
     email: req.user.email
@@ -208,10 +218,7 @@ export const changePassword = async (req: Request, res: Response) => {
           }
         );
 
-        if (
-          req.authData.actor.type === ActorType.USER &&
-          req.authData.tokenVersionId
-        ) {
+        if (req.authData.actor.type === ActorType.USER && req.authData.tokenVersionId) {
           await clearTokens(req.authData.tokenVersionId);
         }
 
@@ -246,8 +253,9 @@ export const createBackupPrivateKey = async (req: Request, res: Response) => {
   // create/change backup private key
   // requires verifying [clientProof] as part of second step of SRP protocol
   // as initiated in /srp1
-
-  const { clientProof, encryptedPrivateKey, iv, tag, salt, verifier } = req.body;
+  const {
+    body: { clientProof, encryptedPrivateKey, salt, verifier, iv, tag }
+  } = await validateRequest(reqValidator.CreateBackupPrivateKeyV1, req);
   const user = await User.findOne({
     email: req.user.email
   }).select("+salt +verifier");
@@ -325,15 +333,17 @@ export const getBackupPrivateKey = async (req: Request, res: Response) => {
 
 export const resetPassword = async (req: Request, res: Response) => {
   const {
-    protectedKey,
-    protectedKeyIV,
-    protectedKeyTag,
-    encryptedPrivateKey,
-    encryptedPrivateKeyIV,
-    encryptedPrivateKeyTag,
-    salt,
-    verifier
-  } = req.body;
+    body: {
+      encryptedPrivateKey,
+      protectedKeyTag,
+      protectedKey,
+      protectedKeyIV,
+      salt,
+      verifier,
+      encryptedPrivateKeyIV,
+      encryptedPrivateKeyTag
+    }
+  } = await validateRequest(reqValidator.ResetPasswordV1, req);
 
   await User.findByIdAndUpdate(
     req.user._id.toString(),

backend/src/controllers/v1/secretImportController.ts

@@ -1,15 +1,28 @@
 import { Request, Response } from "express";
-import { isValidScope, validateMembership } from "../../helpers";
+import { isValidScope } from "../../helpers";
 import { Folder, SecretImport, ServiceTokenData } from "../../models";
 import { getAllImportedSecrets } from "../../services/SecretImportService";
 import { getFolderWithPathFromId } from "../../services/FolderService";
-import { BadRequestError, ResourceNotFoundError,UnauthorizedRequestError } from "../../utils/errors";
-import { ADMIN, MEMBER } from "../../variables";
+import {
+  BadRequestError,
+  ResourceNotFoundError,
+  UnauthorizedRequestError
+} from "../../utils/errors";
 import { EEAuditLogService } from "../../ee/services";
 import { EventType } from "../../ee/models";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/secretImports";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../services/ProjectRoleService";
+import { ForbiddenError, subject } from "@casl/ability";
 
 export const createSecretImport = async (req: Request, res: Response) => {
-  const { workspaceId, environment, folderId, secretImport } = req.body;
+  const {
+    body: { workspaceId, environment, folderId, secretImport }
+  } = await validateRequest(reqValidator.CreateSecretImportV1, req);
 
   const folders = await Folder.findOne({
     workspace: workspaceId,
@@ -27,12 +40,19 @@ export const createSecretImport = async (req: Request, res: Response) => {
     const { folderPath } = getFolderWithPathFromId(folders.nodes, folderId);
     secretPath = folderPath;
   }
+
   if (req.authData.authPayload instanceof ServiceTokenData) {
     // root check
     const isValidScopeAccess = isValidScope(req.authData.authPayload, environment, secretPath);
     if (!isValidScopeAccess) {
       throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
     }
+  } else {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Create,
+      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
+    );
   }
 
   const importSecDoc = await SecretImport.findOne({
@@ -40,8 +60,10 @@ export const createSecretImport = async (req: Request, res: Response) => {
     environment,
     folderId
   });
-  
-  const importToSecretPath = folders?getFolderWithPathFromId(folders.nodes, folderId).folderPath:"/";
+
+  const importToSecretPath = folders
+    ? getFolderWithPathFromId(folders.nodes, folderId).folderPath
+    : "/";
 
   if (!importSecDoc) {
     const doc = new SecretImport({
@@ -50,7 +72,7 @@ export const createSecretImport = async (req: Request, res: Response) => {
       folderId,
       imports: [{ environment: secretImport.environment, secretPath: secretImport.secretPath }]
     });
-    
+
     await doc.save();
     await EEAuditLogService.createAuditLog(
       req.authData,
@@ -84,7 +106,7 @@ export const createSecretImport = async (req: Request, res: Response) => {
     secretPath: secretImport.secretPath
   });
   await importSecDoc.save();
-  
+
   await EEAuditLogService.createAuditLog(
     req.authData,
     {
@@ -108,32 +130,30 @@ export const createSecretImport = async (req: Request, res: Response) => {
 // to keep the ordering, you must pass all the imports in here not the only updated one
 // this is because the order decide which import gets overriden
 export const updateSecretImport = async (req: Request, res: Response) => {
-  const { id } = req.params;
-  const { secretImports } = req.body;
+  const {
+    body: { secretImports },
+    params: { id }
+  } = await validateRequest(reqValidator.UpdateSecretImportV1, req);
+
   const importSecDoc = await SecretImport.findById(id);
   if (!importSecDoc) {
     throw BadRequestError({ message: "Import not found" });
   }
 
-  if (!(req.authData.authPayload instanceof ServiceTokenData)) {
-    await validateMembership({
-      userId: req.user._id.toString(),
-      workspaceId: importSecDoc.workspace,
-      acceptedRoles: [ADMIN, MEMBER]
-    });
-  } else {
-    // check for service token validity
-    const folders = await Folder.findOne({
-      workspace: importSecDoc.workspace,
-      environment: importSecDoc.environment
-    }).lean();
+  // check for service token validity
+  const folders = await Folder.findOne({
+    workspace: importSecDoc.workspace,
+    environment: importSecDoc.environment
+  }).lean();
 
-    let secretPath = "/";
-    if (folders) {
-      const { folderPath } = getFolderWithPathFromId(folders.nodes, importSecDoc.folderId);
-      secretPath = folderPath;
-    }
+  let secretPath = "/";
+  if (folders) {
+    const { folderPath } = getFolderWithPathFromId(folders.nodes, importSecDoc.folderId);
+    secretPath = folderPath;
+  }
 
+  if (req.authData.authPayload instanceof ServiceTokenData) {
+    // token permission check
     const isValidScopeAccess = isValidScope(
       req.authData.authPayload,
       importSecDoc.environment,
@@ -142,23 +162,25 @@ export const updateSecretImport = async (req: Request, res: Response) => {
     if (!isValidScopeAccess) {
       throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
     }
+  } else {
+    // non token entry check
+    const { permission } = await getUserProjectPermissions(
+      req.user._id,
+      importSecDoc.workspace.toString()
+    );
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Edit,
+      subject(ProjectPermissionSub.SecretImports, {
+        environment: importSecDoc.environment,
+        secretPath
+      })
+    );
   }
 
   const orderBefore = importSecDoc.imports;
   importSecDoc.imports = secretImports;
-  
+
   await importSecDoc.save();
-  
-  const folders = await Folder.findOne({
-    workspace: importSecDoc.workspace,
-    environment: importSecDoc.environment,
-  }).lean();
-  
-  if (!folders) throw ResourceNotFoundError({
-    message: "Failed to find folder"
-  });
-  
-  const importToSecretPath = folders?getFolderWithPathFromId(folders.nodes, importSecDoc.folderId).folderPath:"/";
 
   await EEAuditLogService.createAuditLog(
     req.authData,
@@ -166,7 +188,7 @@ export const updateSecretImport = async (req: Request, res: Response) => {
       type: EventType.UPDATE_SECRET_IMPORT,
       metadata: {
         importToEnvironment: importSecDoc.environment,
-        importToSecretPath,
+        importToSecretPath: secretPath,
         secretImportId: importSecDoc._id.toString(),
         folderId: importSecDoc.folderId.toString(),
         orderBefore,
@@ -181,32 +203,29 @@ export const updateSecretImport = async (req: Request, res: Response) => {
 };
 
 export const deleteSecretImport = async (req: Request, res: Response) => {
-  const { id } = req.params;
-  const { secretImportEnv, secretImportPath } = req.body;
+  const {
+    params: { id },
+    body: { secretImportEnv, secretImportPath }
+  } = await validateRequest(reqValidator.DeleteSecretImportV1, req);
+
   const importSecDoc = await SecretImport.findById(id);
   if (!importSecDoc) {
     throw BadRequestError({ message: "Import not found" });
   }
 
-  if (!(req.authData.authPayload instanceof ServiceTokenData)) {
-    await validateMembership({
-      userId: req.user._id.toString(),
-      workspaceId: importSecDoc.workspace,
-      acceptedRoles: [ADMIN, MEMBER]
-    });
-  } else {
-    // check for service token validity
-    const folders = await Folder.findOne({
-      workspace: importSecDoc.workspace,
-      environment: importSecDoc.environment
-    }).lean();
+  // check for service token validity
+  const folders = await Folder.findOne({
+    workspace: importSecDoc.workspace,
+    environment: importSecDoc.environment
+  }).lean();
 
-    let secretPath = "/";
-    if (folders) {
-      const { folderPath } = getFolderWithPathFromId(folders.nodes, importSecDoc.folderId);
-      secretPath = folderPath;
-    }
+  let secretPath = "/";
+  if (folders) {
+    const { folderPath } = getFolderWithPathFromId(folders.nodes, importSecDoc.folderId);
+    secretPath = folderPath;
+  }
 
+  if (req.authData.authPayload instanceof ServiceTokenData) {
     const isValidScopeAccess = isValidScope(
       req.authData.authPayload,
       importSecDoc.environment,
@@ -215,6 +234,18 @@ export const deleteSecretImport = async (req: Request, res: Response) => {
     if (!isValidScopeAccess) {
       throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
     }
+  } else {
+    const { permission } = await getUserProjectPermissions(
+      req.user._id,
+      importSecDoc.workspace.toString()
+    );
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Delete,
+      subject(ProjectPermissionSub.SecretImports, {
+        environment: importSecDoc.environment,
+        secretPath
+      })
+    );
   }
   importSecDoc.imports = importSecDoc.imports.filter(
     ({ environment, secretPath }) =>
@@ -222,17 +253,6 @@ export const deleteSecretImport = async (req: Request, res: Response) => {
   );
   await importSecDoc.save();
 
-  const folders = await Folder.findOne({
-    workspace: importSecDoc.workspace,
-    environment: importSecDoc.environment,
-  }).lean();
-  
-  if (!folders) throw ResourceNotFoundError({
-    message: "Failed to find folder"
-  });
-  
-  const importToSecretPath = folders?getFolderWithPathFromId(folders.nodes, importSecDoc.folderId).folderPath:"/";
-
   await EEAuditLogService.createAuditLog(
     req.authData,
     {
@@ -243,7 +263,7 @@ export const deleteSecretImport = async (req: Request, res: Response) => {
         importFromEnvironment: secretImportEnv,
         importFromSecretPath: secretImportPath,
         importToEnvironment: importSecDoc.environment,
-        importToSecretPath
+        importToSecretPath: secretPath
       }
     },
     {
@@ -266,19 +286,19 @@ export const getSecretImports = async (req: Request, res: Response) => {
     return res.status(200).json({ secretImport: {} });
   }
 
+  // check for service token validity
+  const folders = await Folder.findOne({
+    workspace: importSecDoc.workspace,
+    environment: importSecDoc.environment
+  }).lean();
+
+  let secretPath = "/";
+  if (folders) {
+    const { folderPath } = getFolderWithPathFromId(folders.nodes, importSecDoc.folderId);
+    secretPath = folderPath;
+  }
+
   if (req.authData.authPayload instanceof ServiceTokenData) {
-    // check for service token validity
-    const folders = await Folder.findOne({
-      workspace: importSecDoc.workspace,
-      environment: importSecDoc.environment
-    }).lean();
-
-    let secretPath = "/";
-    if (folders) {
-      const { folderPath } = getFolderWithPathFromId(folders.nodes, importSecDoc.folderId);
-      secretPath = folderPath;
-    }
-
     const isValidScopeAccess = isValidScope(
       req.authData.authPayload,
       importSecDoc.environment,
@@ -287,6 +307,18 @@ export const getSecretImports = async (req: Request, res: Response) => {
     if (!isValidScopeAccess) {
       throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
     }
+  } else {
+    const { permission } = await getUserProjectPermissions(
+      req.user._id,
+      importSecDoc.workspace.toString()
+    );
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.SecretImports, {
+        environment: importSecDoc.environment,
+        secretPath
+      })
+    );
   }
 
   return res.status(200).json({ secretImport: importSecDoc });
@@ -308,19 +340,19 @@ export const getAllSecretsFromImport = async (req: Request, res: Response) => {
     return res.status(200).json({ secrets: [] });
   }
 
+  const folders = await Folder.findOne({
+    workspace: importSecDoc.workspace,
+    environment: importSecDoc.environment
+  }).lean();
+
+  let secretPath = "/";
+  if (folders) {
+    const { folderPath } = getFolderWithPathFromId(folders.nodes, importSecDoc.folderId);
+    secretPath = folderPath;
+  }
+
   if (req.authData.authPayload instanceof ServiceTokenData) {
     // check for service token validity
-    const folders = await Folder.findOne({
-      workspace: importSecDoc.workspace,
-      environment: importSecDoc.environment
-    }).lean();
-
-    let secretPath = "/";
-    if (folders) {
-      const { folderPath } = getFolderWithPathFromId(folders.nodes, importSecDoc.folderId);
-      secretPath = folderPath;
-    }
-
     const isValidScopeAccess = isValidScope(
       req.authData.authPayload,
       importSecDoc.environment,
@@ -329,6 +361,25 @@ export const getAllSecretsFromImport = async (req: Request, res: Response) => {
     if (!isValidScopeAccess) {
       throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
     }
+  } else {
+    const { permission } = await getUserProjectPermissions(
+      req.user._id,
+      importSecDoc.workspace.toString()
+    );
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.SecretImports, {
+        environment: importSecDoc.environment,
+        secretPath
+      })
+    );
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.Secrets, {
+        environment: importSecDoc.environment,
+        secretPath
+      })
+    );
   }
 
   await EEAuditLogService.createAuditLog(

backend/src/controllers/v1/secretsFolderController.ts

@@ -1,10 +1,12 @@
+import { ForbiddenError, subject } from "@casl/ability";
 import { Request, Response } from "express";
 import { Types } from "mongoose";
 import { EventType, FolderVersion } from "../../ee/models";
 import { EEAuditLogService, EESecretService } from "../../ee/services";
-import { validateMembership } from "../../helpers/membership";
 import { isValidScope } from "../../helpers/secrets";
-import { Folder, Secret, ServiceTokenData } from "../../models";
+import { validateRequest } from "../../helpers/validation";
+import { Secret, ServiceTokenData } from "../../models";
+import {Folder} from "../../models/folder";
 import {
   appendFolder,
   deleteFolderById,
@@ -15,12 +17,20 @@ import {
   getParentFromFolderId,
   validateFolderName
 } from "../../services/FolderService";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../services/ProjectRoleService";
 import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
-import { ADMIN, MEMBER } from "../../variables";
+import * as reqValidator from "../../validation/folders";
 
 // verify workspace id/environment
 export const createFolder = async (req: Request, res: Response) => {
-  const { workspaceId, environment, folderName, parentFolderId } = req.body;
+  const {
+    body: { workspaceId, environment, folderName, parentFolderId }
+  } = await validateRequest(reqValidator.CreateFolderV1, req);
+
   if (!validateFolderName(folderName)) {
     throw BadRequestError({
       message: "Folder name cannot contain spaces. Only underscore and dashes"
@@ -32,8 +42,20 @@ export const createFolder = async (req: Request, res: Response) => {
     environment
   }).lean();
 
+  if (req.user) {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    const secretPath =
+      folders && parentFolderId
+        ? getFolderWithPathFromId(folders.nodes, parentFolderId).folderPath
+        : "/";
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Create,
+      subject(ProjectPermissionSub.Folders, { environment, secretPath })
+    );
+  }
+
   // space has no folders initialized
-  
+
   if (!folders) {
     if (req.authData.authPayload instanceof ServiceTokenData) {
       // root check
@@ -62,10 +84,10 @@ export const createFolder = async (req: Request, res: Response) => {
     });
     await folderVersion.save();
     await EESecretService.takeSecretSnapshot({
-      workspaceId,
+      workspaceId: new Types.ObjectId(workspaceId),
       environment
     });
-    
+
     await EEAuditLogService.createAuditLog(
       req.authData,
       {
@@ -86,9 +108,9 @@ export const createFolder = async (req: Request, res: Response) => {
   }
 
   const folder = appendFolder(folders.nodes, { folderName, parentFolderId });
-  
+
   await Folder.findByIdAndUpdate(folders._id, folders);
-  
+
   const { folder: parentFolder, folderPath: parentFolderPath } = getFolderWithPathFromId(
     folders.nodes,
     parentFolderId || "root"
@@ -116,13 +138,13 @@ export const createFolder = async (req: Request, res: Response) => {
   await folderVersion.save();
 
   await EESecretService.takeSecretSnapshot({
-    workspaceId,
+    workspaceId: new Types.ObjectId(workspaceId),
     environment,
     folderId: parentFolderId
   });
-  
-  const {folderPath} = getFolderWithPathFromId(folders.nodes, folder.id);
-  
+
+  const { folderPath } = getFolderWithPathFromId(folders.nodes, folder.id);
+
   await EEAuditLogService.createAuditLog(
     req.authData,
     {
@@ -143,8 +165,11 @@ export const createFolder = async (req: Request, res: Response) => {
 };
 
 export const updateFolderById = async (req: Request, res: Response) => {
-  const { folderId } = req.params;
-  const { name, workspaceId, environment } = req.body;
+  const {
+    body: { workspaceId, environment, name },
+    params: { folderId }
+  } = await validateRequest(reqValidator.UpdateFolderV1, req);
+
   if (!validateFolderName(name)) {
     throw BadRequestError({
       message: "Folder name cannot contain spaces. Only underscore and dashes"
@@ -156,21 +181,21 @@ export const updateFolderById = async (req: Request, res: Response) => {
     throw BadRequestError({ message: "The folder doesn't exist" });
   }
 
-  if (!(req.authData.authPayload instanceof ServiceTokenData)) {
-    // check that user is a member of the workspace
-    await validateMembership({
-      userId: req.user._id.toString(),
-      workspaceId,
-      acceptedRoles: [ADMIN, MEMBER]
-    });
-  }
-
   const parentFolder = getParentFromFolderId(folders.nodes, folderId);
   if (!parentFolder) {
     throw BadRequestError({ message: "The folder doesn't exist" });
   }
+
+  if (req.user) {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    const secretPath = getFolderWithPathFromId(folders.nodes, parentFolder.id).folderPath;
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Edit,
+      subject(ProjectPermissionSub.Folders, { environment, secretPath })
+    );
+  }
+
   const folder = parentFolder.children.find(({ id }) => id === folderId);
-  
   if (!folder) {
     throw BadRequestError({ message: "The folder doesn't exist" });
   }
@@ -197,13 +222,13 @@ export const updateFolderById = async (req: Request, res: Response) => {
   await folderVersion.save();
 
   await EESecretService.takeSecretSnapshot({
-    workspaceId,
+    workspaceId: new Types.ObjectId(workspaceId),
     environment,
     folderId: parentFolder.id
   });
 
-  const {folderPath} = getFolderWithPathFromId(folders.nodes, folder.id);
-  
+  const { folderPath } = getFolderWithPathFromId(folders.nodes, folder.id);
+
   await EEAuditLogService.createAuditLog(
     req.authData,
     {
@@ -228,37 +253,35 @@ export const updateFolderById = async (req: Request, res: Response) => {
 };
 
 export const deleteFolder = async (req: Request, res: Response) => {
-  const { folderId } = req.params;
-  const { workspaceId, environment } = req.body;
+  const {
+    params: { folderId },
+    body: { environment, workspaceId }
+  } = await validateRequest(reqValidator.DeleteFolderV1, req);
 
   const folders = await Folder.findOne({ workspace: workspaceId, environment });
   if (!folders) {
     throw BadRequestError({ message: "The folder doesn't exist" });
   }
 
-  if (!(req.authData.authPayload instanceof ServiceTokenData)) {
-    // check that user is a member of the workspace
-    await validateMembership({
-      userId: req.user._id.toString(),
-      workspaceId,
-      acceptedRoles: [ADMIN, MEMBER]
-    });
-  }
-
-  const {folderPath} = getFolderWithPathFromId(folders.nodes, folderId);
-
   const delOp = deleteFolderById(folders.nodes, folderId);
   if (!delOp) {
     throw BadRequestError({ message: "The folder doesn't exist" });
   }
   const { deletedNode: delFolder, parent: parentFolder } = delOp;
+  const { folderPath: secretPath } = getFolderWithPathFromId(folders.nodes, parentFolder.id);
 
   if (req.authData.authPayload instanceof ServiceTokenData) {
-    const { folderPath: secretPath } = getFolderWithPathFromId(folders.nodes, parentFolder.id);
     const isValidScopeAccess = isValidScope(req.authData.authPayload, environment, secretPath);
     if (!isValidScopeAccess) {
       throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
     }
+  } else {
+    // check that user is a member of the workspace
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Delete,
+      subject(ProjectPermissionSub.Folders, { environment, secretPath })
+    );
   }
 
   parentFolder.version += 1;
@@ -280,7 +303,7 @@ export const deleteFolder = async (req: Request, res: Response) => {
   }
 
   await EESecretService.takeSecretSnapshot({
-    workspaceId,
+    workspaceId: new Types.ObjectId(workspaceId),
     environment,
     folderId: parentFolder.id
   });
@@ -288,12 +311,12 @@ export const deleteFolder = async (req: Request, res: Response) => {
   await EEAuditLogService.createAuditLog(
     req.authData,
     {
-      type: EventType.DELETE_FOLDER ,
+      type: EventType.DELETE_FOLDER,
       metadata: {
         environment,
         folderId,
         folderName: delFolder.name,
-        folderPath
+        folderPath: secretPath
       }
     },
     {
@@ -306,28 +329,30 @@ export const deleteFolder = async (req: Request, res: Response) => {
 
 // TODO: validate workspace
 export const getFolders = async (req: Request, res: Response) => {
-  const { workspaceId, environment, parentFolderId, parentFolderPath } = req.query as {
-    workspaceId: string;
-    environment: string;
-    parentFolderId?: string;
-    parentFolderPath?: string;
-  };
+  const {
+    query: { workspaceId, environment, parentFolderId, parentFolderPath }
+  } = await validateRequest(reqValidator.GetFoldersV1, req);
 
   const folders = await Folder.findOne({ workspace: workspaceId, environment });
+
+  if (req.user) {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    const secretPath =
+      folders && parentFolderId
+        ? getFolderWithPathFromId(folders.nodes, parentFolderId).folderPath
+        : parentFolderPath || "/";
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.Folders, { environment, secretPath })
+    );
+  }
+
   if (!folders) {
     res.send({ folders: [], dir: [] });
     return;
   }
 
-  if (!(req.authData.authPayload instanceof ServiceTokenData)) {
-    // check that user is a member of the workspace
-    await validateMembership({
-      userId: req.user._id.toString(),
-      workspaceId,
-      acceptedRoles: [ADMIN, MEMBER]
-    });
-  }
-
   // if instead of parentFolderId given a path like /folder1/folder2
   if (parentFolderPath) {
     if (req.authData.authPayload instanceof ServiceTokenData) {

backend/src/controllers/v1/signupController.ts

@@ -10,6 +10,8 @@ import {
   getSmtpConfigured
 } from "../../config";
 import { validateUserEmail } from "../../validation";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/auth";
 
 /**
  * Signup step 1: Initialize account for user under email [email] and send a verification code
@@ -19,7 +21,9 @@ import { validateUserEmail } from "../../validation";
  * @returns
  */
 export const beginEmailSignup = async (req: Request, res: Response) => {
-  const email: string = req.body.email;
+  const {
+    body: { email }
+  } = await validateRequest(reqValidator.BeginEmailSignUpV1, req);
 
   // validate that email is not disposable
   validateUserEmail(email);
@@ -50,7 +54,9 @@ export const beginEmailSignup = async (req: Request, res: Response) => {
  */
 export const verifyEmailSignup = async (req: Request, res: Response) => {
   let user;
-  const { email, code } = req.body;
+  const {
+    body: { email, code }
+  } = await validateRequest(reqValidator.VerifyEmailSignUpV1, req);
 
   // initialize user account
   user = await User.findOne({ email }).select("+publicKey");

backend/src/controllers/v1/userActionController.ts

@@ -1,5 +1,7 @@
 import { Request, Response } from "express";
+import { validateRequest } from "../../helpers/validation";
 import { UserAction } from "../../models";
+import * as reqValidator from "../../validation/action";
 
 /**
  * Add user action [action]
@@ -8,26 +10,27 @@ import { UserAction } from "../../models";
  * @returns
  */
 export const addUserAction = async (req: Request, res: Response) => {
-	// add/record new action [action] for user with id [req.user._id]
-
-  const { action } = req.body;
+  // add/record new action [action] for user with id [req.user._id]
+  const {
+    body: { action }
+  } = await validateRequest(reqValidator.AddUserActionV1, req);
 
   const userAction = await UserAction.findOneAndUpdate(
     {
       user: req.user._id,
-      action,
+      action
     },
     { user: req.user._id, action },
     {
       new: true,
-      upsert: true,
+      upsert: true
     }
   );
 
-	return res.status(200).send({
-		message: "Successfully recorded user action",
-		userAction,
-	});
+  return res.status(200).send({
+    message: "Successfully recorded user action",
+    userAction
+  });
 };
 
 /**
@@ -37,15 +40,17 @@ export const addUserAction = async (req: Request, res: Response) => {
  * @returns
  */
 export const getUserAction = async (req: Request, res: Response) => {
-	// get user action [action] for user with id [req.user._id]
-  const action: string = req.query.action as string;
+  // get user action [action] for user with id [req.user._id]
+  const {
+    query: { action }
+  } = await validateRequest(reqValidator.GetUserActionV1, req);
 
   const userAction = await UserAction.findOne({
     user: req.user._id,
-    action,
+    action
   });
 
-	return res.status(200).send({
-		userAction,
-	});
+  return res.status(200).send({
+    userAction
+  });
 };

backend/src/controllers/v1/webhookController.ts

@@ -1,16 +1,32 @@
 import { Request, Response } from "express";
 import { Types } from "mongoose";
 import { client, getRootEncryptionKey } from "../../config";
-import { validateMembership } from "../../helpers";
 import { Webhook } from "../../models";
 import { getWebhookPayload, triggerWebhookRequest } from "../../services/WebhookService";
 import { BadRequestError, ResourceNotFoundError } from "../../utils/errors";
 import { EEAuditLogService } from "../../ee/services";
 import { EventType } from "../../ee/models";
-import { ADMIN, ALGORITHM_AES_256_GCM, ENCODING_SCHEME_BASE64, MEMBER } from "../../variables";
+import { ALGORITHM_AES_256_GCM, ENCODING_SCHEME_BASE64 } from "../../variables";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/webhooks";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../services/ProjectRoleService";
+import { ForbiddenError } from "@casl/ability";
 
 export const createWebhook = async (req: Request, res: Response) => {
-  const { webhookUrl, webhookSecretKey, environment, workspaceId, secretPath } = req.body;
+  const {
+    body: { webhookUrl, webhookSecretKey, environment, workspaceId, secretPath }
+  } = await validateRequest(reqValidator.CreateWebhookV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Create,
+    ProjectPermissionSub.Webhooks
+  );
+
   const webhook = new Webhook({
     workspace: workspaceId,
     environment,
@@ -29,7 +45,7 @@ export const createWebhook = async (req: Request, res: Response) => {
   }
 
   await webhook.save();
-  
+
   await EEAuditLogService.createAuditLog(
     req.authData,
     {
@@ -43,7 +59,7 @@ export const createWebhook = async (req: Request, res: Response) => {
       }
     },
     {
-      workspaceId
+      workspaceId: new Types.ObjectId(workspaceId)
     }
   );
 
@@ -54,19 +70,24 @@ export const createWebhook = async (req: Request, res: Response) => {
 };
 
 export const updateWebhook = async (req: Request, res: Response) => {
-  const { webhookId } = req.params;
-  const { isDisabled } = req.body;
+  const {
+    body: { isDisabled },
+    params: { webhookId }
+  } = await validateRequest(reqValidator.UpdateWebhookV1, req);
+
   const webhook = await Webhook.findById(webhookId);
   if (!webhook) {
     throw BadRequestError({ message: "Webhook not found!!" });
   }
 
-  // check that user is a member of the workspace
-  await validateMembership({
-    userId: req.user._id.toString(),
-    workspaceId: webhook.workspace,
-    acceptedRoles: [ADMIN, MEMBER]
-  });
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    webhook.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Edit,
+    ProjectPermissionSub.Webhooks
+  );
 
   if (typeof isDisabled !== undefined) {
     webhook.isDisabled = isDisabled;
@@ -97,19 +118,24 @@ export const updateWebhook = async (req: Request, res: Response) => {
 };
 
 export const deleteWebhook = async (req: Request, res: Response) => {
-  const { webhookId } = req.params;
+  const {
+    params: { webhookId }
+  } = await validateRequest(reqValidator.DeleteWebhookV1, req);
   let webhook = await Webhook.findById(webhookId);
 
   if (!webhook) {
     throw ResourceNotFoundError({ message: "Webhook not found!!" });
   }
 
-  await validateMembership({
-    userId: req.user._id.toString(),
-    workspaceId: webhook.workspace,
-    acceptedRoles: [ADMIN, MEMBER]
-  });
-  
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    webhook.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Delete,
+    ProjectPermissionSub.Webhooks
+  );
+
   webhook = await Webhook.findByIdAndDelete(webhookId);
 
   if (!webhook) {
@@ -139,17 +165,23 @@ export const deleteWebhook = async (req: Request, res: Response) => {
 };
 
 export const testWebhook = async (req: Request, res: Response) => {
-  const { webhookId } = req.params;
+  const {
+    params: { webhookId }
+  } = await validateRequest(reqValidator.TestWebhookV1, req);
+
   const webhook = await Webhook.findById(webhookId);
   if (!webhook) {
     throw BadRequestError({ message: "Webhook not found!!" });
   }
 
-  await validateMembership({
-    userId: req.user._id.toString(),
-    workspaceId: webhook.workspace,
-    acceptedRoles: [ADMIN, MEMBER]
-  });
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    webhook.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Webhooks
+  );
 
   try {
     await triggerWebhookRequest(
@@ -182,7 +214,15 @@ export const testWebhook = async (req: Request, res: Response) => {
 };
 
 export const listWebhooks = async (req: Request, res: Response) => {
-  const { environment, workspaceId, secretPath } = req.query;
+  const {
+    query: { environment, workspaceId, secretPath }
+  } = await validateRequest(reqValidator.ListWebhooksV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Webhooks
+  );
 
   const optionalFilters: Record<string, string> = {};
   if (environment) optionalFilters.environment = environment as string;

backend/src/controllers/v1/workspaceController.ts

@@ -20,6 +20,13 @@ import {
   getUserOrgPermissions
 } from "../../services/RoleService";
 import { ForbiddenError } from "@casl/ability";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../services/ProjectRoleService";
 
 /**
  * Return public keys of members of workspace with id [workspaceId]
@@ -28,7 +35,15 @@ import { ForbiddenError } from "@casl/ability";
  * @returns
  */
 export const getWorkspacePublicKeys = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetWorkspacePublicKeysV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Member
+  );
 
   const publicKeys = (
     await Membership.find({
@@ -53,7 +68,15 @@ export const getWorkspacePublicKeys = async (req: Request, res: Response) => {
  * @returns
  */
 export const getWorkspaceMemberships = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetWorkspaceMembershipsV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Member
+  );
 
   const users = await Membership.find({
     workspace: workspaceId
@@ -89,7 +112,9 @@ export const getWorkspaces = async (req: Request, res: Response) => {
  * @returns
  */
 export const getWorkspace = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetWorkspaceV1, req);
 
   const workspace = await Workspace.findOne({
     _id: workspaceId
@@ -108,7 +133,9 @@ export const getWorkspace = async (req: Request, res: Response) => {
  * @returns
  */
 export const createWorkspace = async (req: Request, res: Response) => {
-  const { workspaceName, organizationId } = req.body;
+  const {
+    body: { organizationId, workspaceName }
+  } = await validateRequest(reqValidator.CreateWorkspaceV1, req);
 
   const organization = await Organization.findById(organizationId);
   if (!organization) {
@@ -183,8 +210,16 @@ export const deleteWorkspace = async (req: Request, res: Response) => {
  * @returns
  */
 export const changeWorkspaceName = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
-  const { name } = req.body;
+  const {
+    params: { workspaceId },
+    body: { name }
+  } = await validateRequest(reqValidator.ChangeWorkspaceNameV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Edit,
+    ProjectPermissionSub.Workspace
+  );
 
   const workspace = await Workspace.findOneAndUpdate(
     {
@@ -229,7 +264,15 @@ export const getWorkspaceIntegrations = async (req: Request, res: Response) => {
  * @returns
  */
 export const getWorkspaceIntegrationAuthorizations = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetWorkspaceIntegrationAuthorizationsV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Integrations
+  );
 
   const authorizations = await IntegrationAuth.find({
     workspace: workspaceId
@@ -247,7 +290,16 @@ export const getWorkspaceIntegrationAuthorizations = async (req: Request, res: R
  * @returns
  */
 export const getWorkspaceServiceTokens = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetWorkspaceServiceTokensV1, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.ServiceTokens
+  );
+
   // ?? FIX.
   const serviceTokens = await ServiceToken.find({
     user: req.user._id,

backend/src/controllers/v2/authController.ts

@@ -10,16 +10,11 @@ import { sendMail } from "../../helpers/nodemailer";
 import { TokenService } from "../../services";
 import { EELogService } from "../../ee/services";
 import { BadRequestError, InternalServerError } from "../../utils/errors";
-import {
-  ACTION_LOGIN,
-  TOKEN_EMAIL_MFA,
-} from "../../variables";
+import { ACTION_LOGIN, TOKEN_EMAIL_MFA } from "../../variables";
 import { getUserAgentType } from "../../utils/posthog"; // TODO: move this
-import {
-  getHttpsEnabled,
-  getJwtMfaLifetime,
-  getJwtMfaSecret,
-} from "../../config";
+import { getHttpsEnabled, getJwtMfaLifetime, getJwtMfaSecret } from "../../config";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/auth";
 
 declare module "jsonwebtoken" {
   export interface UserIDJwtPayload extends jwt.JwtPayload {
@@ -34,13 +29,10 @@ declare module "jsonwebtoken" {
  * @returns
  */
 export const login1 = async (req: Request, res: Response) => {
-  const {
-    email,
-    clientPublicKey,
-  }: { email: string; clientPublicKey: string } = req.body;
+  const { email, clientPublicKey }: { email: string; clientPublicKey: string } = req.body;
 
   const user = await User.findOne({
-    email,
+    email
   }).select("+salt +verifier");
 
   if (!user) throw new Error("Failed to find user");
@@ -49,25 +41,28 @@ export const login1 = async (req: Request, res: Response) => {
   server.init(
     {
       salt: user.salt,
-      verifier: user.verifier,
+      verifier: user.verifier
     },
     async () => {
       // generate server-side public key
       const serverPublicKey = server.getPublicKey();
 
-      await LoginSRPDetail.findOneAndReplace({ email: email }, {
-        email: email,
-        clientPublicKey: clientPublicKey,
-        serverBInt: bigintConversion.bigintToBuf(server.bInt),
-      }, { upsert: true, returnNewDocument: false });
+      await LoginSRPDetail.findOneAndReplace(
+        { email: email },
+        {
+          email: email,
+          clientPublicKey: clientPublicKey,
+          serverBInt: bigintConversion.bigintToBuf(server.bInt)
+        },
+        { upsert: true, returnNewDocument: false }
+      );
 
       return res.status(200).send({
         serverPublicKey,
-        salt: user.salt,
+        salt: user.salt
       });
     }
   );
-  
 };
 
 /**
@@ -78,19 +73,22 @@ export const login1 = async (req: Request, res: Response) => {
  * @returns
  */
 export const login2 = async (req: Request, res: Response) => {
-  if (!req.headers["user-agent"]) throw InternalServerError({ message: "User-Agent header is required" });
+  if (!req.headers["user-agent"])
+    throw InternalServerError({ message: "User-Agent header is required" });
 
   const { email, clientProof } = req.body;
   const user = await User.findOne({
-    email,
-  }).select("+salt +verifier +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag +publicKey +encryptedPrivateKey +iv +tag +devices");
+    email
+  }).select(
+    "+salt +verifier +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag +publicKey +encryptedPrivateKey +iv +tag +devices"
+  );
 
   if (!user) throw new Error("Failed to find user");
 
-  const loginSRPDetail = await LoginSRPDetail.findOneAndDelete({ email: email })
+  const loginSRPDetail = await LoginSRPDetail.findOneAndDelete({ email: email });
 
   if (!loginSRPDetail) {
-    return BadRequestError(Error("Failed to find login details for SRP"))
+    return BadRequestError(Error("Failed to find login details for SRP"));
   }
 
   const server = new jsrp.server();
@@ -98,7 +96,7 @@ export const login2 = async (req: Request, res: Response) => {
     {
       salt: user.salt,
       verifier: user.verifier,
-      b: loginSRPDetail.serverBInt,
+      b: loginSRPDetail.serverBInt
     },
     async () => {
       server.setClientPublicKey(loginSRPDetail.clientPublicKey);
@@ -111,15 +109,15 @@ export const login2 = async (req: Request, res: Response) => {
           // generate temporary MFA token
           const token = createToken({
             payload: {
-              userId: user._id.toString(),
+              userId: user._id.toString()
             },
             expiresIn: await getJwtMfaLifetime(),
-            secret: await getJwtMfaSecret(),
+            secret: await getJwtMfaSecret()
           });
 
           const code = await TokenService.createToken({
             type: TOKEN_EMAIL_MFA,
-            email,
+            email
           });
 
           // send MFA code [code] to [email]
@@ -128,27 +126,27 @@ export const login2 = async (req: Request, res: Response) => {
             subjectLine: "Infisical MFA code",
             recipients: [email],
             substitutions: {
-              code,
-            },
+              code
+            }
           });
 
           return res.status(200).send({
             mfaEnabled: true,
-            token,
+            token
           });
         }
 
         await checkUserDevice({
           user,
           ip: req.realIP,
-          userAgent: req.headers["user-agent"] ?? "",
+          userAgent: req.headers["user-agent"] ?? ""
         });
 
         // issue tokens
-        const tokens = await issueAuthTokens({ 
+        const tokens = await issueAuthTokens({
           userId: user._id,
           ip: req.realIP,
-          userAgent: req.headers["user-agent"] ?? "",
+          userAgent: req.headers["user-agent"] ?? ""
         });
 
         // store (refresh) token in httpOnly cookie
@@ -156,7 +154,7 @@ export const login2 = async (req: Request, res: Response) => {
           httpOnly: true,
           path: "/",
           sameSite: "strict",
-          secure: await getHttpsEnabled(),
+          secure: await getHttpsEnabled()
         });
 
         // case: user does not have MFA enabled
@@ -182,36 +180,33 @@ export const login2 = async (req: Request, res: Response) => {
           publicKey: user.publicKey,
           encryptedPrivateKey: user.encryptedPrivateKey,
           iv: user.iv,
-          tag: user.tag,
-        }
+          tag: user.tag
+        };
 
-        if (
-          user?.protectedKey &&
-          user?.protectedKeyIV &&
-          user?.protectedKeyTag
-        ) {
+        if (user?.protectedKey && user?.protectedKeyIV && user?.protectedKeyTag) {
           response.protectedKey = user.protectedKey;
-          response.protectedKeyIV = user.protectedKeyIV
+          response.protectedKeyIV = user.protectedKeyIV;
           response.protectedKeyTag = user.protectedKeyTag;
         }
 
         const loginAction = await EELogService.createAction({
           name: ACTION_LOGIN,
-          userId: user._id,
+          userId: user._id
         });
 
-        loginAction && await EELogService.createLog({
-          userId: user._id,
-          actions: [loginAction],
-          channel: getUserAgentType(req.headers["user-agent"]),
-          ipAddress: req.ip,
-        });
+        loginAction &&
+          (await EELogService.createLog({
+            userId: user._id,
+            actions: [loginAction],
+            channel: getUserAgentType(req.headers["user-agent"]),
+            ipAddress: req.ip
+          }));
 
         return res.status(200).send(response);
       }
 
       return res.status(400).send({
-        message: "Failed to authenticate. Try again?",
+        message: "Failed to authenticate. Try again?"
       });
     }
   );
@@ -219,15 +214,17 @@ export const login2 = async (req: Request, res: Response) => {
 
 /**
  * Send MFA token to email [email]
- * @param req 
- * @param res 
+ * @param req
+ * @param res
  */
 export const sendMfaToken = async (req: Request, res: Response) => {
-  const { email } = req.body;
+  const {
+    body: { email }
+  } = await validateRequest(reqValidator.SendMfaTokenV2, req);
 
   const code = await TokenService.createToken({
     type: TOKEN_EMAIL_MFA,
-    email,
+    email
   });
 
   // send MFA code [code] to [email]
@@ -236,49 +233,53 @@ export const sendMfaToken = async (req: Request, res: Response) => {
     subjectLine: "Infisical MFA code",
     recipients: [email],
     substitutions: {
-      code,
-    },
+      code
+    }
   });
 
   return res.status(200).send({
-    message: "Successfully sent new MFA code",
+    message: "Successfully sent new MFA code"
   });
-}
+};
 
 /**
  * Verify MFA token [mfaToken] and issue JWT and refresh tokens if the
  * MFA token [mfaToken] is valid
- * @param req 
- * @param res 
+ * @param req
+ * @param res
  */
 export const verifyMfaToken = async (req: Request, res: Response) => {
-  const { email, mfaToken } = req.body;
+  const {
+    body: { email, mfaToken }
+  } = await validateRequest(reqValidator.VerifyMfaTokenV2, req);
 
   await TokenService.validateToken({
     type: TOKEN_EMAIL_MFA,
     email,
-    token: mfaToken,
+    token: mfaToken
   });
 
   const user = await User.findOne({
-    email,
-  }).select("+salt +verifier +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag +publicKey +encryptedPrivateKey +iv +tag +devices");
+    email
+  }).select(
+    "+salt +verifier +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag +publicKey +encryptedPrivateKey +iv +tag +devices"
+  );
 
   if (!user) throw new Error("Failed to find user");
 
-  await LoginSRPDetail.deleteOne({ userId: user.id })
+  await LoginSRPDetail.deleteOne({ userId: user.id });
 
   await checkUserDevice({
     user,
     ip: req.realIP,
-    userAgent: req.headers["user-agent"] ?? "",
+    userAgent: req.headers["user-agent"] ?? ""
   });
 
   // issue tokens
-  const tokens = await issueAuthTokens({ 
+  const tokens = await issueAuthTokens({
     userId: user._id,
     ip: req.realIP,
-    userAgent: req.headers["user-agent"] ?? "",
+    userAgent: req.headers["user-agent"] ?? ""
   });
 
   // store (refresh) token in httpOnly cookie
@@ -286,7 +287,7 @@ export const verifyMfaToken = async (req: Request, res: Response) => {
     httpOnly: true,
     path: "/",
     sameSite: "strict",
-    secure: await getHttpsEnabled(),
+    secure: await getHttpsEnabled()
   });
 
   interface VerifyMfaTokenRes {
@@ -319,8 +320,8 @@ export const verifyMfaToken = async (req: Request, res: Response) => {
     publicKey: user.publicKey as string,
     encryptedPrivateKey: user.encryptedPrivateKey as string,
     iv: user.iv as string,
-    tag: user.tag as string,
-  }
+    tag: user.tag as string
+  };
 
   if (user?.protectedKey && user?.protectedKeyIV && user?.protectedKeyTag) {
     resObj.protectedKey = user.protectedKey;
@@ -330,15 +331,16 @@ export const verifyMfaToken = async (req: Request, res: Response) => {
 
   const loginAction = await EELogService.createAction({
     name: ACTION_LOGIN,
-    userId: user._id,
+    userId: user._id
   });
 
-  loginAction && await EELogService.createLog({
-    userId: user._id,
-    actions: [loginAction],
-    channel: getUserAgentType(req.headers["user-agent"]),
-    ipAddress: req.realIP,
-  });
+  loginAction &&
+    (await EELogService.createLog({
+      userId: user._id,
+      actions: [loginAction],
+      channel: getUserAgentType(req.headers["user-agent"]),
+      ipAddress: req.realIP
+    }));
 
   return res.status(200).send(resObj);
-}
+};

backend/src/controllers/v2/environmentController.ts

@@ -6,13 +6,21 @@ import {
   Secret,
   ServiceToken,
   ServiceTokenData,
-  Workspace,
+  Workspace
 } from "../../models";
 import { EventType, SecretVersion } from "../../ee/models";
 import { EEAuditLogService, EELicenseService } from "../../ee/services";
 import { BadRequestError, WorkspaceNotFoundError } from "../../utils/errors";
 import _ from "lodash";
 import { PERMISSION_READ_SECRETS, PERMISSION_WRITE_SECRETS } from "../../variables";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/environments";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../services/ProjectRoleService";
+import { ForbiddenError } from "@casl/ability";
 
 /**
  * Create new workspace environment named [environmentName] under workspace with id
@@ -20,13 +28,18 @@ import { PERMISSION_READ_SECRETS, PERMISSION_WRITE_SECRETS } from "../../variabl
  * @param res
  * @returns
  */
-export const createWorkspaceEnvironment = async (
-  req: Request,
-  res: Response
-) => {
+export const createWorkspaceEnvironment = async (req: Request, res: Response) => {
+  const {
+    params: { workspaceId },
+    body: { environmentName, environmentSlug }
+  } = await validateRequest(reqValidator.CreateWorkspaceEnvironmentV2, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Create,
+    ProjectPermissionSub.Environments
+  );
 
-  const { workspaceId } = req.params;
-  const { environmentName, environmentSlug } = req.body;
   const workspace = await Workspace.findById(workspaceId).exec();
 
   if (!workspace) throw WorkspaceNotFoundError();
@@ -39,7 +52,8 @@ export const createWorkspaceEnvironment = async (
       // case: number of environments used exceeds the number of environments allowed
 
       return res.status(400).send({
-        message: "Failed to create environment due to environment limit reached. Upgrade plan to create more environments.",
+        message:
+          "Failed to create environment due to environment limit reached. Upgrade plan to create more environments."
       });
     }
   }
@@ -55,7 +69,7 @@ export const createWorkspaceEnvironment = async (
 
   workspace?.environments.push({
     name: environmentName,
-    slug: environmentSlug.toLowerCase(),
+    slug: environmentSlug.toLowerCase()
   });
   await workspace.save();
 
@@ -80,8 +94,8 @@ export const createWorkspaceEnvironment = async (
     workspace: workspaceId,
     environment: {
       name: environmentName,
-      slug: environmentSlug,
-    },
+      slug: environmentSlug
+    }
   });
 };
 
@@ -129,12 +143,18 @@ export const reorderWorkspaceEnvironments = async (
  * @param res
  * @returns
  */
-export const renameWorkspaceEnvironment = async (
-  req: Request,
-  res: Response
-) => {
-  const { workspaceId } = req.params;
-  const { environmentName, environmentSlug, oldEnvironmentSlug } = req.body;
+export const renameWorkspaceEnvironment = async (req: Request, res: Response) => {
+  const {
+    params: { workspaceId },
+    body: { environmentName, environmentSlug, oldEnvironmentSlug }
+  } = await validateRequest(reqValidator.UpdateWorkspaceEnvironmentV2, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Edit,
+    ProjectPermissionSub.Environments
+  );
+
   // user should pass both new slug and env name
   if (!environmentSlug || !environmentName) {
     throw new Error("Invalid environment given.");
@@ -148,16 +168,13 @@ export const renameWorkspaceEnvironment = async (
 
   const isEnvExist = workspace.environments.some(
     ({ name, slug }) =>
-      slug !== oldEnvironmentSlug &&
-      (name === environmentName || slug === environmentSlug)
+      slug !== oldEnvironmentSlug && (name === environmentName || slug === environmentSlug)
   );
   if (isEnvExist) {
     throw new Error("Invalid environment given");
   }
 
-  const envIndex = workspace?.environments.findIndex(
-    ({ slug }) => slug === oldEnvironmentSlug
-  );
+  const envIndex = workspace?.environments.findIndex(({ slug }) => slug === oldEnvironmentSlug);
   if (envIndex === -1) {
     throw new Error("Invalid environment given");
   }
@@ -191,7 +208,7 @@ export const renameWorkspaceEnvironment = async (
   await Membership.updateMany(
     {
       workspace: workspaceId,
-      "deniedPermissions.environmentSlug": oldEnvironmentSlug,
+      "deniedPermissions.environmentSlug": oldEnvironmentSlug
     },
     { $set: { "deniedPermissions.$[element].environmentSlug": environmentSlug } },
     { arrayFilters: [{ "element.environmentSlug": oldEnvironmentSlug }] }
@@ -218,8 +235,8 @@ export const renameWorkspaceEnvironment = async (
     workspace: workspaceId,
     environment: {
       name: environmentName,
-      slug: environmentSlug,
-    },
+      slug: environmentSlug
+    }
   });
 };
 
@@ -229,21 +246,25 @@ export const renameWorkspaceEnvironment = async (
  * @param res
  * @returns
  */
-export const deleteWorkspaceEnvironment = async (
-  req: Request,
-  res: Response
-) => {
-  const { workspaceId } = req.params;
-  const { environmentSlug } = req.body;
+export const deleteWorkspaceEnvironment = async (req: Request, res: Response) => {
+  const {
+    params: { workspaceId },
+    body: { environmentSlug }
+  } = await validateRequest(reqValidator.DeleteWorkspaceEnvironmentV2, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Delete,
+    ProjectPermissionSub.Environments
+  );
+
   // atomic update the env to avoid conflict
   const workspace = await Workspace.findById(workspaceId).exec();
   if (!workspace) {
     throw new Error("Failed to create workspace environment");
   }
 
-  const envIndex = workspace?.environments.findIndex(
-    ({ slug }) => slug === environmentSlug
-  );
+  const envIndex = workspace?.environments.findIndex(({ slug }) => slug === environmentSlug);
   if (envIndex === -1) {
     throw new Error("Invalid environment given");
   }
@@ -256,11 +277,11 @@ export const deleteWorkspaceEnvironment = async (
   // clean up
   await Secret.deleteMany({
     workspace: workspaceId,
-    environment: environmentSlug,
+    environment: environmentSlug
   });
   await SecretVersion.deleteMany({
     workspace: workspaceId,
-    environment: environmentSlug,
+    environment: environmentSlug
   });
 
   // await ServiceToken.deleteMany({
@@ -279,7 +300,7 @@ export const deleteWorkspaceEnvironment = async (
 
   await Integration.deleteMany({
     workspace: workspaceId,
-    environment: environmentSlug,
+    environment: environmentSlug
   });
   await Membership.updateMany(
     { workspace: workspaceId },
@@ -305,46 +326,48 @@ export const deleteWorkspaceEnvironment = async (
   return res.status(200).send({
     message: "Successfully deleted environment",
     workspace: workspaceId,
-    environment: environmentSlug,
+    environment: environmentSlug
   });
 };
 
+// TODO(akhilmhdh) after rbac this can be completely removed
+export const getAllAccessibleEnvironmentsOfWorkspace = async (req: Request, res: Response) => {
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetAllAccessibileEnvironmentsOfWorkspaceV2, req);
 
-export const getAllAccessibleEnvironmentsOfWorkspace = async (
-  req: Request,
-  res: Response
-) => {
-  const { workspaceId } = req.params;
-  const workspacesUserIsMemberOf = await Membership.findOne({
-    workspace: workspaceId,
-    user: req.user,
-  })
+  const { membership: workspacesUserIsMemberOf } = await getUserProjectPermissions(
+    req.user._id,
+    workspaceId
+  );
 
-  if (!workspacesUserIsMemberOf) {
-    throw BadRequestError()
-  }
+  const accessibleEnvironments: any = [];
+  const deniedPermission = workspacesUserIsMemberOf.deniedPermissions;
 
-  const accessibleEnvironments: any = []
-  const deniedPermission = workspacesUserIsMemberOf.deniedPermissions
-
-  const relatedWorkspace = await Workspace.findById(workspaceId)
+  const relatedWorkspace = await Workspace.findById(workspaceId);
   if (!relatedWorkspace) {
-    throw BadRequestError()
+    throw BadRequestError();
   }
-  relatedWorkspace.environments.forEach(environment => {
-    const isReadBlocked = _.some(deniedPermission, { environmentSlug: environment.slug, ability: PERMISSION_READ_SECRETS })
-    const isWriteBlocked = _.some(deniedPermission, { environmentSlug: environment.slug, ability: PERMISSION_WRITE_SECRETS })
+  relatedWorkspace.environments.forEach((environment) => {
+    const isReadBlocked = _.some(deniedPermission, {
+      environmentSlug: environment.slug,
+      ability: PERMISSION_READ_SECRETS
+    });
+    const isWriteBlocked = _.some(deniedPermission, {
+      environmentSlug: environment.slug,
+      ability: PERMISSION_WRITE_SECRETS
+    });
     if (isReadBlocked && isWriteBlocked) {
-      return
+      return;
     } else {
       accessibleEnvironments.push({
         name: environment.name,
         slug: environment.slug,
         isWriteDenied: isWriteBlocked,
-        isReadDenied: isReadBlocked,
-      })
+        isReadDenied: isReadBlocked
+      });
     }
-  })
+  });
 
-  res.json({ accessibleEnvironments })
+  res.json({ accessibleEnvironments });
 };

backend/src/controllers/v2/secretsController.ts

@@ -25,7 +25,7 @@ import {
   userHasWriteOnlyAbility
 } from "../../ee/helpers/checkMembershipPermissions";
 import _ from "lodash";
-import { BatchSecret, BatchSecretRequest } from "../../types/secret";
+import { BatchSecret } from "../../types/secret";
 import {
   getFolderByPath,
   getFolderIdFromServiceToken,
@@ -35,6 +35,8 @@ import {
 import { isValidScope } from "../../helpers/secrets";
 import path from "path";
 import { getAllImportedSecrets } from "../../services/SecretImportService";
+import { validateRequest } from "../../helpers/validation";
+import { BatchSecretsV2, GetSecretsV2 } from "../../validation";
 
 /**
  * Peform a batch of any specified CUD secret operations
@@ -46,22 +48,17 @@ export const batchSecrets = async (req: Request, res: Response) => {
   const channel = getUserAgentType(req.headers["user-agent"]);
   const postHogClient = await TelemetryService.getPostHogClient();
 
+  const validatedData = await validateRequest(BatchSecretsV2, req);
   const {
-    workspaceId,
-    environment,
-    requests
-  }: {
-    workspaceId: string;
-    environment: string;
-    requests: BatchSecretRequest[];
-  } = req.body;
-
-  let secretPath = req.body.secretPath as string;
-  let folderId = req.body.folderId as string;
+    body: { workspaceId, environment, requests }
+  } = validatedData;
+  let {
+    body: { secretPath, folderId }
+  } = validatedData;
 
   const createSecrets: BatchSecret[] = [];
   const updateSecrets: BatchSecret[] = [];
-  const deleteSecrets: { _id: Types.ObjectId, secretName: string; }[] = [];
+  const deleteSecrets: { _id: Types.ObjectId; secretName: string }[] = [];
   const actions: IAction[] = [];
 
   // get secret blind index salt
@@ -72,7 +69,11 @@ export const batchSecrets = async (req: Request, res: Response) => {
   const folders = await Folder.findOne({ workspace: workspaceId, environment });
 
   if (req.authData.authPayload instanceof ServiceTokenData) {
-    const isValidScopeAccess = isValidScope(req.authData.authPayload, environment, secretPath);
+    const isValidScopeAccess = isValidScope(
+      req.authData.authPayload,
+      environment,
+      secretPath || "/"
+    );
 
     // in service token when not giving secretpath folderid must be root
     // this is to avoid giving folderid when service tokens are used
@@ -133,7 +134,10 @@ export const batchSecrets = async (req: Request, res: Response) => {
         });
         break;
       case "DELETE":
-        deleteSecrets.push({ _id: new Types.ObjectId(request.secret._id), secretName: request.secret.secretName });
+        deleteSecrets.push({
+          _id: new Types.ObjectId(request.secret._id),
+          secretName: request.secret.secretName
+        });
         break;
     }
   }
@@ -332,18 +336,19 @@ export const batchSecrets = async (req: Request, res: Response) => {
   if (deleteSecrets.length > 0) {
     const deleteSecretIds: Types.ObjectId[] = deleteSecrets.map((s) => s._id);
 
-    const deletedSecretsObj = (await Secret.find({
-      _id: {
-        $in: deleteSecretIds
-      }
-    }))
-      .reduce(
-        (obj: any, secret: ISecret) => ({
-          ...obj,
-          [secret._id.toString()]: secret
-        }),
-        {}
-      );
+    const deletedSecretsObj = (
+      await Secret.find({
+        _id: {
+          $in: deleteSecretIds
+        }
+      })
+    ).reduce(
+      (obj: any, secret: ISecret) => ({
+        ...obj,
+        [secret._id.toString()]: secret
+      }),
+      {}
+    );
 
     await Secret.deleteMany({
       _id: {
@@ -781,10 +786,13 @@ export const getSecrets = async (req: Request, res: Response) => {
     }   
     */
 
-  const { tagSlugs, secretPath, include_imports } = req.query;
-  let { folderId } = req.query;
-  const workspaceId = req.query.workspaceId as string;
-  const environment = req.query.environment as string;
+  const validatedData = await validateRequest(GetSecretsV2, req);
+  const {
+    query: { tagSlugs, secretPath, include_imports, workspaceId, environment }
+  } = validatedData;
+  let {
+    query: { folderId }
+  } = validatedData;
 
   const folders = await Folder.findOne({ workspace: workspaceId, environment });
 
@@ -926,7 +934,7 @@ export const getSecrets = async (req: Request, res: Response) => {
 
   // TODO(akhilmhdh) - secret-imp change this to org type
   let importedSecrets: any[] = [];
-  if (include_imports === "true") {
+  if (include_imports) {
     importedSecrets = await getAllImportedSecrets(workspaceId, environment, folderId as string);
   }
 

backend/src/controllers/v2/serviceTokenDataController.ts

@@ -6,6 +6,15 @@ import { getSaltRounds } from "../../config";
 import { BadRequestError } from "../../utils/errors";
 import { ActorType, EventType } from "../../ee/models";
 import { EEAuditLogService } from "../../ee/services";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/serviceTokenData";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../services/ProjectRoleService";
+import { ForbiddenError } from "@casl/ability";
+import { Types } from "mongoose";
 
 /**
  * Return service token data associated with service token on request
@@ -63,7 +72,14 @@ export const getServiceTokenData = async (req: Request, res: Response) => {
 export const createServiceTokenData = async (req: Request, res: Response) => {
   let serviceTokenData;
 
-  const { name, workspaceId, encryptedKey, iv, tag, expiresIn, permissions, scopes } = req.body;
+  const {
+    body: { workspaceId, permissions, tag, encryptedKey, scopes, name, expiresIn, iv }
+  } = await validateRequest(reqValidator.CreateServiceTokenV2, req);
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Create,
+    ProjectPermissionSub.ServiceTokens
+  );
 
   const secret = crypto.randomBytes(16).toString("hex");
   const secretHash = await bcrypt.hash(secret, await getSaltRounds());
@@ -75,7 +91,7 @@ export const createServiceTokenData = async (req: Request, res: Response) => {
   }
 
   let user;
-  
+
   if (req.authData.actor.type === ActorType.USER) {
     user = req.authData.authPayload._id;
   }
@@ -100,7 +116,7 @@ export const createServiceTokenData = async (req: Request, res: Response) => {
   if (!serviceTokenData) throw new Error("Failed to find service token data");
 
   const serviceToken = `st.${serviceTokenData._id.toString()}.${secret}`;
-  
+
   await EEAuditLogService.createAuditLog(
     req.authData,
     {
@@ -111,7 +127,7 @@ export const createServiceTokenData = async (req: Request, res: Response) => {
       }
     },
     {
-      workspaceId
+      workspaceId: new Types.ObjectId(workspaceId)
     }
   );
 
@@ -128,14 +144,29 @@ export const createServiceTokenData = async (req: Request, res: Response) => {
  * @returns
  */
 export const deleteServiceTokenData = async (req: Request, res: Response) => {
-  const { serviceTokenDataId } = req.params;
+  const {
+    params: { serviceTokenDataId }
+  } = await validateRequest(reqValidator.DeleteServiceTokenV2, req);
+
+  let serviceTokenData = await ServiceTokenData.findById(serviceTokenDataId);
+  if (!serviceTokenData) throw BadRequestError({ message: "Service token not found" });
+
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    serviceTokenData.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Delete,
+    ProjectPermissionSub.ServiceTokens
+  );
+
+  serviceTokenData = await ServiceTokenData.findByIdAndDelete(serviceTokenDataId);
+
+  if (!serviceTokenData)
+    return res.status(200).send({
+      message: "Failed to delete service token"
+    });
 
-  const serviceTokenData = await ServiceTokenData.findByIdAndDelete(serviceTokenDataId);
-  
-  if (!serviceTokenData) return res.status(200).send({
-    message: "Failed to delete service token"
-  });
-  
   await EEAuditLogService.createAuditLog(
     req.authData,
     {

backend/src/controllers/v2/tagController.ts

@@ -1,42 +1,58 @@
+import { ForbiddenError } from "@casl/ability";
 import { Request, Response } from "express";
 import { Types } from "mongoose";
-import { Membership, Secret, Tag } from "../../models";
-import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
+import { Secret, Tag } from "../../models";
+import { BadRequestError } from "../../utils/errors";
+import { validateRequest } from "../../helpers/validation";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../services/ProjectRoleService";
+import * as reqValidator from "../../validation/tags";
 
 export const createWorkspaceTag = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
-  const { name, slug, tagColor } = req.body;
-  
+  const {
+    body: { name, slug },
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.CreateWorkspaceTagsV2, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Create,
+    ProjectPermissionSub.Tags
+  );
+
   const tagToCreate = {
-      name,
-      tagColor,
-      workspace: new Types.ObjectId(workspaceId),
-      slug,
-      user: new Types.ObjectId(req.user._id),
-    };
-  
+    name,
+    workspace: new Types.ObjectId(workspaceId),
+    slug,
+    user: new Types.ObjectId(req.user._id)
+  };
+
   const createdTag = await new Tag(tagToCreate).save();
-  
+
   res.json(createdTag);
 };
 
 export const deleteWorkspaceTag = async (req: Request, res: Response) => {
-  const { tagId } = req.params;
+  const {
+    params: { tagId }
+  } = await validateRequest(reqValidator.DeleteWorkspaceTagsV2, req);
 
   const tagFromDB = await Tag.findById(tagId);
   if (!tagFromDB) {
     throw BadRequestError();
   }
 
-  // can only delete if the request user is one that belongs to the same workspace as the tag
-  const membership = await Membership.findOne({
-    user: req.user,
-    workspace: tagFromDB.workspace
-  });
-
-  if (!membership) {
-    UnauthorizedRequestError({ message: "Failed to validate membership" });
-  }
+  const { permission } = await getUserProjectPermissions(
+    req.user._id,
+    tagFromDB.workspace.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Delete,
+    ProjectPermissionSub.Tags
+  );
 
   const result = await Tag.findByIdAndDelete(tagId);
 
@@ -47,12 +63,19 @@ export const deleteWorkspaceTag = async (req: Request, res: Response) => {
 };
 
 export const getWorkspaceTags = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
-  
-  const workspaceTags = await Tag.find({ 
-    workspace: new Types.ObjectId(workspaceId) 
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetWorkspaceTagsV2, req);
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Tags
+  );
+
+  const workspaceTags = await Tag.find({
+    workspace: new Types.ObjectId(workspaceId)
   });
-  
+
   return res.json({
     workspaceTags
   });

backend/src/controllers/v2/usersController.ts

@@ -2,23 +2,19 @@ import { Request, Response } from "express";
 import { Types } from "mongoose";
 import crypto from "crypto";
 import bcrypt from "bcrypt";
-import {
-    APIKeyData,
-    AuthMethod,
-    MembershipOrg,
-    TokenVersion,
-    User
-} from "../../models";
+import { APIKeyData, AuthMethod, MembershipOrg, TokenVersion, User } from "../../models";
 import { getSaltRounds } from "../../config";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation";
 
 /**
  * Return the current user.
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const getMe = async (req: Request, res: Response) => {
-    /* 
+  /* 
     #swagger.summary = "Retrieve the current user on the request"
     #swagger.description = "Retrieve the current user on the request"
     
@@ -43,124 +39,117 @@ export const getMe = async (req: Request, res: Response) => {
         }
     }   
     */
-    const user = await User
-        .findById(req.user._id)
-        .select("+salt +publicKey +encryptedPrivateKey +iv +tag +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag");
-    
-    return res.status(200).send({
-        user,
-    });
-}
+  const user = await User.findById(req.user._id).select(
+    "+salt +publicKey +encryptedPrivateKey +iv +tag +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag"
+  );
+
+  return res.status(200).send({
+    user
+  });
+};
 
 /**
  * Update the current user's MFA-enabled status [isMfaEnabled].
  * Note: Infisical currently only supports email-based 2FA only; this will expand to
  * include SMS and authenticator app modes of authentication in the future.
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const updateMyMfaEnabled = async (req: Request, res: Response) => {
-    const { isMfaEnabled }: { isMfaEnabled: boolean } = req.body;
-    req.user.isMfaEnabled = isMfaEnabled;
-    
-    if (isMfaEnabled) { 
-        // TODO: adapt this route/controller 
-        // to work for different forms of MFA
-        req.user.mfaMethods = ["email"];
-    } else {
-        req.user.mfaMethods = [];
-    }
+  const {
+    body: { isMfaEnabled }
+  } = await validateRequest(reqValidator.UpdateMyMfaEnabledV2, req);
 
-    await req.user.save();
-    
-    const user = req.user;
-    
-    return res.status(200).send({
-        user,
-    });
-}
+  req.user.isMfaEnabled = isMfaEnabled;
+
+  if (isMfaEnabled) {
+    // TODO: adapt this route/controller
+    // to work for different forms of MFA
+    req.user.mfaMethods = ["email"];
+  } else {
+    req.user.mfaMethods = [];
+  }
+
+  await req.user.save();
+
+  const user = req.user;
+
+  return res.status(200).send({
+    user
+  });
+};
 
 /**
  * Update name of the current user to [firstName, lastName].
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const updateName = async (req: Request, res: Response) => {
-    const { 
-        firstName, 
-        lastName 
-    }: { 
-        firstName: string; 
-        lastName: string; 
-    } = req.body;
-    
-    const user = await User.findByIdAndUpdate(
-        req.user._id.toString(),
-        {
-            firstName,
-            lastName: lastName ?? ""
-        },
-        {
-            new: true
-        }
-    );
-    
-    return res.status(200).send({
-        user,
-    });
-}
+  const {
+    body: { lastName, firstName }
+  } = await validateRequest(reqValidator.UpdateNameV2, req);
+
+  const user = await User.findByIdAndUpdate(
+    req.user._id.toString(),
+    {
+      firstName,
+      lastName: lastName ?? ""
+    },
+    {
+      new: true
+    }
+  );
+
+  return res.status(200).send({
+    user
+  });
+};
 
 /**
  * Update auth method of the current user to [authMethods]
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
- export const updateAuthMethods = async (req: Request, res: Response) => {
-    const {
-        authMethods
-    } = req.body;
-    
-    const hasSamlEnabled = req.user.authMethods
-        .some(
-            (authMethod: AuthMethod) => [
-                AuthMethod.OKTA_SAML,
-                AuthMethod.AZURE_SAML,
-                AuthMethod.JUMPCLOUD_SAML
-            ].includes(authMethod)
-        );
+export const updateAuthMethods = async (req: Request, res: Response) => {
+  const {
+    body: { authMethods }
+  } = await validateRequest(reqValidator.UpdateAuthMethodsV2, req);
 
-    if (hasSamlEnabled) {
-        return res.status(400).send({
-            message: "Failed to update user authentication method because SAML SSO is enforced"
-        });
-    }
+  const hasSamlEnabled = req.user.authMethods.some((authMethod: AuthMethod) =>
+    [AuthMethod.OKTA_SAML, AuthMethod.AZURE_SAML, AuthMethod.JUMPCLOUD_SAML].includes(authMethod)
+  );
 
-    const user = await User.findByIdAndUpdate(
-        req.user._id.toString(),
-        {
-            authMethods
-        },
-        {
-            new: true
-        }
-    );
-
-    return res.status(200).send({
-        user
+  if (hasSamlEnabled) {
+    return res.status(400).send({
+      message: "Failed to update user authentication method because SAML SSO is enforced"
     });
-}
+  }
 
+  const user = await User.findByIdAndUpdate(
+    req.user._id.toString(),
+    {
+      authMethods
+    },
+    {
+      new: true
+    }
+  );
+
+  return res.status(200).send({
+    user
+  });
+};
 
 /**
  * Return organizations that the current user is part of.
- * @param req 
- * @param res 
+ * @param req
+ * @param res
  */
 export const getMyOrganizations = async (req: Request, res: Response) => {
-    /* 
+  /* 
     #swagger.summary = 'Return organizations that current user is part of'
     #swagger.description = 'Return organizations that current user is part of'
     
@@ -189,114 +178,121 @@ export const getMyOrganizations = async (req: Request, res: Response) => {
     */
   const organizations = (
     await MembershipOrg.find({
-      user: req.user._id,
+      user: req.user._id
     }).populate("organization")
   ).map((m) => m.organization);
 
-	return res.status(200).send({
-		organizations,
-	});
-}
+  return res.status(200).send({
+    organizations
+  });
+};
 
 /**
  * Return API keys belonging to current user.
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const getMyAPIKeys = async (req: Request, res: Response) => {
-    const apiKeyData = await APIKeyData.find({
-		user: req.user._id,
-	});
+  const apiKeyData = await APIKeyData.find({
+    user: req.user._id
+  });
 
-	return res.status(200).send(apiKeyData);
-}
+  return res.status(200).send(apiKeyData);
+};
 
 /**
  * Create new API key for current user.
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const createAPIKey = async (req: Request, res: Response) => {
-	const { name, expiresIn } = req.body;
+  const {
+    body: { name, expiresIn }
+  } = await validateRequest(reqValidator.CreateApiKeyV2, req);
 
-	const secret = crypto.randomBytes(16).toString("hex");
-	const secretHash = await bcrypt.hash(secret, await getSaltRounds());
+  const secret = crypto.randomBytes(16).toString("hex");
+  const secretHash = await bcrypt.hash(secret, await getSaltRounds());
 
-	const expiresAt = new Date();
-	expiresAt.setSeconds(expiresAt.getSeconds() + expiresIn);
+  const expiresAt = new Date();
+  expiresAt.setSeconds(expiresAt.getSeconds() + expiresIn);
 
-	let apiKeyData = await new APIKeyData({
-		name,
-		lastUsed: new Date(),
-		expiresAt,
-		user: req.user._id,
-		secretHash,
-	}).save();
+  let apiKeyData = await new APIKeyData({
+    name,
+    lastUsed: new Date(),
+    expiresAt,
+    user: req.user._id,
+    secretHash
+  }).save();
 
-	// return api key data without sensitive data
-	apiKeyData = (await APIKeyData.findById(apiKeyData._id)) as any;
+  // return api key data without sensitive data
+  apiKeyData = (await APIKeyData.findById(apiKeyData._id)) as any;
 
-	if (!apiKeyData) throw new Error("Failed to find API key data");
+  if (!apiKeyData) throw new Error("Failed to find API key data");
 
-	const apiKey = `ak.${apiKeyData._id.toString()}.${secret}`;
+  const apiKey = `ak.${apiKeyData._id.toString()}.${secret}`;
 
-	return res.status(200).send({
-		apiKey,
-		apiKeyData,
-	});
-}
+  return res.status(200).send({
+    apiKey,
+    apiKeyData
+  });
+};
 
 /**
  * Delete API key with id [apiKeyDataId] belonging to current user
- * @param req 
- * @param res 
+ * @param req
+ * @param res
  */
 export const deleteAPIKey = async (req: Request, res: Response) => {
-    const { apiKeyDataId } = req.params;
+  const {
+    params: { apiKeyDataId }
+  } = await validateRequest(reqValidator.DeleteApiKeyV2, req);
 
-    const apiKeyData = await APIKeyData.findOneAndDelete({
-        _id: new Types.ObjectId(apiKeyDataId),
-        user: req.user._id
-    });
+  const apiKeyData = await APIKeyData.findOneAndDelete({
+    _id: new Types.ObjectId(apiKeyDataId),
+    user: req.user._id
+  });
 
-	return res.status(200).send({
-		apiKeyData
-	});
-}
+  return res.status(200).send({
+    apiKeyData
+  });
+};
 
 /**
  * Return active sessions (TokenVersion) belonging to user
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const getMySessions = async (req: Request, res: Response) => {
-    const tokenVersions = await TokenVersion.find({
-        user: req.user._id
-    });
-    
-    return res.status(200).send(tokenVersions);
-}
+  const tokenVersions = await TokenVersion.find({
+    user: req.user._id
+  });
+
+  return res.status(200).send(tokenVersions);
+};
 
 /**
  * Revoke all active sessions belong to user
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const deleteMySessions = async (req: Request, res: Response) => {
-    await TokenVersion.updateMany({
-        user: req.user._id,
-    }, {
-        $inc: {
-            refreshVersion: 1,
-            accessVersion: 1,
-        },
-    });
+  await TokenVersion.updateMany(
+    {
+      user: req.user._id
+    },
+    {
+      $inc: {
+        refreshVersion: 1,
+        accessVersion: 1
+      }
+    }
+  );
 
-    return res.status(200).send({
-        message: "Successfully revoked all sessions"
-    });
-}
+  return res.status(200).send({
+    message: "Successfully revoked all sessions"
+  });
+};

backend/src/controllers/v2/workspaceController.ts

@@ -11,6 +11,14 @@ import { EventService, TelemetryService } from "../../services";
 import { eventPushSecrets } from "../../events";
 import { EEAuditLogService } from "../../ee/services";
 import { EventType } from "../../ee/models";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../services/ProjectRoleService";
+import { ForbiddenError } from "@casl/ability";
 
 interface V2PushSecret {
   type: string; // personal or shared
@@ -181,15 +189,17 @@ export const getWorkspaceKey = async (req: Request, res: Response) => {
         }
     }   
     */
-  const { workspaceId } = req.params;
-  
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetWorkspaceKeyV2, req);
+
   const key = await Key.findOne({
     workspace: workspaceId,
     receiver: req.user._id
   }).populate("sender", "+publicKey");
 
   if (!key) throw new Error("Failed to find workspace key");
-  
+
   await EEAuditLogService.createAuditLog(
     req.authData,
     {
@@ -258,7 +268,15 @@ export const getWorkspaceMemberships = async (req: Request, res: Response) => {
         }
     }   
     */
-  const { workspaceId } = req.params;
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetWorkspaceMembershipsV2, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Member
+  );
 
   const memberships = await Membership.find({
     workspace: workspaceId
@@ -329,8 +347,16 @@ export const updateWorkspaceMembership = async (req: Request, res: Response) =>
         }
     }   
     */
-  const { membershipId } = req.params;
-  const { role } = req.body;
+  const {
+    params: { workspaceId, membershipId },
+    body: { role }
+  } = await validateRequest(reqValidator.UpdateWorkspaceMembershipsV2, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Edit,
+    ProjectPermissionSub.Member
+  );
 
   const membership = await Membership.findByIdAndUpdate(
     membershipId,
@@ -390,7 +416,15 @@ export const deleteWorkspaceMembership = async (req: Request, res: Response) =>
         }
     }   
     */
-  const { membershipId } = req.params;
+  const {
+    params: { workspaceId, membershipId }
+  } = await validateRequest(reqValidator.DeleteWorkspaceMembershipsV2, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Delete,
+    ProjectPermissionSub.Member
+  );
 
   const membership = await Membership.findByIdAndDelete(membershipId);
 
@@ -413,8 +447,16 @@ export const deleteWorkspaceMembership = async (req: Request, res: Response) =>
  * @returns
  */
 export const toggleAutoCapitalization = async (req: Request, res: Response) => {
-  const { workspaceId } = req.params;
-  const { autoCapitalization } = req.body;
+  const {
+    params: { workspaceId },
+    body: { autoCapitalization }
+  } = await validateRequest(reqValidator.ToggleAutoCapitalizationV2, req);
+
+  const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    ProjectPermissionActions.Edit,
+    ProjectPermissionSub.Settings
+  );
 
   const workspace = await Workspace.findOneAndUpdate(
     {

backend/src/controllers/v3/authController.ts

@@ -10,25 +10,20 @@ import { sendMail } from "../../helpers/nodemailer";
 import { TokenService } from "../../services";
 import { EELogService } from "../../ee/services";
 import { BadRequestError, InternalServerError } from "../../utils/errors";
-import {
-    ACTION_LOGIN,
-    TOKEN_EMAIL_MFA,
-} from "../../variables";
+import { ACTION_LOGIN, TOKEN_EMAIL_MFA } from "../../variables";
 import { getUserAgentType } from "../../utils/posthog"; // TODO: move this
-import {
-    getHttpsEnabled,
-    getJwtMfaLifetime,
-    getJwtMfaSecret,
-} from "../../config";
+import { getHttpsEnabled, getJwtMfaLifetime, getJwtMfaSecret } from "../../config";
 import { AuthMethod } from "../../models/user";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/auth";
 
 declare module "jsonwebtoken" {
-    export interface ProviderAuthJwtPayload extends jwt.JwtPayload {
-        userId: string;
-        email: string;
-        authProvider: AuthMethod;
-        isUserCompleted: boolean,
-    }
+  export interface ProviderAuthJwtPayload extends jwt.JwtPayload {
+    userId: string;
+    email: string;
+    authProvider: AuthMethod;
+    isUserCompleted: boolean;
+  }
 }
 
 /**
@@ -38,53 +33,51 @@ declare module "jsonwebtoken" {
  * @returns
  */
 export const login1 = async (req: Request, res: Response) => {
-    const {
-        email,
-        providerAuthToken,
-        clientPublicKey,
-    }: {
-        email: string;
-        clientPublicKey: string,
-        providerAuthToken?: string;
-    } = req.body;
-    
-    const user = await User.findOne({
-        email,
-    }).select("+salt +verifier");
+  const {
+    body: { email, clientPublicKey, providerAuthToken }
+  } = await validateRequest(reqValidator.Login1V3, req);
 
-    if (!user) throw new Error("Failed to find user");
-    
-    if (!user.authMethods.includes(AuthMethod.EMAIL)) {
-        await validateProviderAuthToken({
-            email,
-            providerAuthToken,
-        });
-    }
+  const user = await User.findOne({
+    email
+  }).select("+salt +verifier");
 
-    const server = new jsrp.server();
-    server.init(
+  if (!user) throw new Error("Failed to find user");
+
+  if (!user.authMethods.includes(AuthMethod.EMAIL)) {
+    await validateProviderAuthToken({
+      email,
+      providerAuthToken
+    });
+  }
+
+  const server = new jsrp.server();
+  server.init(
+    {
+      salt: user.salt,
+      verifier: user.verifier
+    },
+    async () => {
+      // generate server-side public key
+      const serverPublicKey = server.getPublicKey();
+      await LoginSRPDetail.findOneAndReplace(
         {
-            salt: user.salt,
-            verifier: user.verifier,
+          email: email
         },
-        async () => {
-            // generate server-side public key
-            const serverPublicKey = server.getPublicKey();
-            await LoginSRPDetail.findOneAndReplace({
-                email: email,
-            }, {
-                email,
-                userId: user.id,
-                clientPublicKey: clientPublicKey,
-                serverBInt: bigintConversion.bigintToBuf(server.bInt),
-            }, { upsert: true, returnNewDocument: false });
+        {
+          email,
+          userId: user.id,
+          clientPublicKey: clientPublicKey,
+          serverBInt: bigintConversion.bigintToBuf(server.bInt)
+        },
+        { upsert: true, returnNewDocument: false }
+      );
 
-            return res.status(200).send({
-                serverPublicKey,
-                salt: user.salt,
-            });
-        }
-    );
+      return res.status(200).send({
+        serverPublicKey,
+        salt: user.salt
+      });
+    }
+  );
 };
 
 /**
@@ -95,150 +88,151 @@ export const login1 = async (req: Request, res: Response) => {
  * @returns
  */
 export const login2 = async (req: Request, res: Response) => {
-    if (!req.headers["user-agent"]) throw InternalServerError({ message: "User-Agent header is required" });
+  if (!req.headers["user-agent"])
+    throw InternalServerError({ message: "User-Agent header is required" });
 
-    const { email, clientProof, providerAuthToken } = req.body;
+  const {
+    body: { email, providerAuthToken, clientProof }
+  } = await validateRequest(reqValidator.Login2V3, req);
 
-    const user = await User.findOne({
-        email,
-    }).select("+salt +verifier +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag +publicKey +encryptedPrivateKey +iv +tag +devices");
+  const user = await User.findOne({
+    email
+  }).select(
+    "+salt +verifier +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag +publicKey +encryptedPrivateKey +iv +tag +devices"
+  );
 
-    if (!user) throw new Error("Failed to find user");
-    
-    if (!user.authMethods.includes(AuthMethod.EMAIL)) {
-        await validateProviderAuthToken({
-            email,
-            providerAuthToken,
-        })
-    }
+  if (!user) throw new Error("Failed to find user");
 
-    const loginSRPDetail = await LoginSRPDetail.findOneAndDelete({ email: email })
+  if (!user.authMethods.includes(AuthMethod.EMAIL)) {
+    await validateProviderAuthToken({
+      email,
+      providerAuthToken
+    });
+  }
 
-    if (!loginSRPDetail) {
-        return BadRequestError(Error("Failed to find login details for SRP"))
-    }
+  const loginSRPDetail = await LoginSRPDetail.findOneAndDelete({ email: email });
 
-    const server = new jsrp.server();
-    server.init(
-        {
-            salt: user.salt,
-            verifier: user.verifier,
-            b: loginSRPDetail.serverBInt,
-        },
-        async () => {
-            server.setClientPublicKey(loginSRPDetail.clientPublicKey);
+  if (!loginSRPDetail) {
+    return BadRequestError(Error("Failed to find login details for SRP"));
+  }
 
-            // compare server and client shared keys
-            if (server.checkClientProof(clientProof)) {
+  const server = new jsrp.server();
+  server.init(
+    {
+      salt: user.salt,
+      verifier: user.verifier,
+      b: loginSRPDetail.serverBInt
+    },
+    async () => {
+      server.setClientPublicKey(loginSRPDetail.clientPublicKey);
 
-                if (user.isMfaEnabled) {
-                    // case: user has MFA enabled
+      // compare server and client shared keys
+      if (server.checkClientProof(clientProof)) {
+        if (user.isMfaEnabled) {
+          // case: user has MFA enabled
 
-                    // generate temporary MFA token
-                    const token = createToken({
-                        payload: {
-                            userId: user._id.toString(),
-                        },
-                        expiresIn: await getJwtMfaLifetime(),
-                        secret: await getJwtMfaSecret(),
-                    });
+          // generate temporary MFA token
+          const token = createToken({
+            payload: {
+              userId: user._id.toString()
+            },
+            expiresIn: await getJwtMfaLifetime(),
+            secret: await getJwtMfaSecret()
+          });
 
-                    const code = await TokenService.createToken({
-                        type: TOKEN_EMAIL_MFA,
-                        email,
-                    });
+          const code = await TokenService.createToken({
+            type: TOKEN_EMAIL_MFA,
+            email
+          });
 
-                    // send MFA code [code] to [email]
-                    await sendMail({
-                        template: "emailMfa.handlebars",
-                        subjectLine: "Infisical MFA code",
-                        recipients: [user.email],
-                        substitutions: {
-                            code,
-                        },
-                    });
-
-                    return res.status(200).send({
-                        mfaEnabled: true,
-                        token,
-                    });
-                }
-
-                await checkUserDevice({
-                    user,
-                    ip: req.realIP,
-                    userAgent: req.headers["user-agent"] ?? "",
-                });
-
-                // issue tokens
-                const tokens = await issueAuthTokens({ 
-                    userId: user._id,
-                    ip: req.realIP,
-                    userAgent: req.headers["user-agent"] ?? "",
-                });
-                
-                // store (refresh) token in httpOnly cookie
-                res.cookie("jid", tokens.refreshToken, {
-                    httpOnly: true,
-                    path: "/",
-                    sameSite: "strict",
-                    secure: await getHttpsEnabled(),
-                });
-
-                // case: user does not have MFA enablgged
-                // return (access) token in response
-
-                interface ResponseData {
-                    mfaEnabled: boolean;
-                    encryptionVersion: any;
-                    protectedKey?: string;
-                    protectedKeyIV?: string;
-                    protectedKeyTag?: string;
-                    token: string;
-                    publicKey?: string;
-                    encryptedPrivateKey?: string;
-                    iv?: string;
-                    tag?: string;
-                }
-
-                const response: ResponseData = {
-                    mfaEnabled: false,
-                    encryptionVersion: user.encryptionVersion,
-                    token: tokens.token,
-                    publicKey: user.publicKey,
-                    encryptedPrivateKey: user.encryptedPrivateKey,
-                    iv: user.iv,
-                    tag: user.tag,
-                }
-
-                if (
-                    user?.protectedKey &&
-                    user?.protectedKeyIV &&
-                    user?.protectedKeyTag
-                ) {
-                    response.protectedKey = user.protectedKey;
-                    response.protectedKeyIV = user.protectedKeyIV
-                    response.protectedKeyTag = user.protectedKeyTag;
-                }
-
-                const loginAction = await EELogService.createAction({
-                    name: ACTION_LOGIN,
-                    userId: user._id,
-                });
-
-                loginAction && await EELogService.createLog({
-                    userId: user._id,
-                    actions: [loginAction],
-                    channel: getUserAgentType(req.headers["user-agent"]),
-                    ipAddress: req.realIP,
-                });
-
-                return res.status(200).send(response);
+          // send MFA code [code] to [email]
+          await sendMail({
+            template: "emailMfa.handlebars",
+            subjectLine: "Infisical MFA code",
+            recipients: [user.email],
+            substitutions: {
+              code
             }
+          });
 
-            return res.status(400).send({
-                message: "Failed to authenticate. Try again?",
-            });
+          return res.status(200).send({
+            mfaEnabled: true,
+            token
+          });
         }
-    );
+
+        await checkUserDevice({
+          user,
+          ip: req.realIP,
+          userAgent: req.headers["user-agent"] ?? ""
+        });
+
+        // issue tokens
+        const tokens = await issueAuthTokens({
+          userId: user._id,
+          ip: req.realIP,
+          userAgent: req.headers["user-agent"] ?? ""
+        });
+
+        // store (refresh) token in httpOnly cookie
+        res.cookie("jid", tokens.refreshToken, {
+          httpOnly: true,
+          path: "/",
+          sameSite: "strict",
+          secure: await getHttpsEnabled()
+        });
+
+        // case: user does not have MFA enablgged
+        // return (access) token in response
+
+        interface ResponseData {
+          mfaEnabled: boolean;
+          encryptionVersion: any;
+          protectedKey?: string;
+          protectedKeyIV?: string;
+          protectedKeyTag?: string;
+          token: string;
+          publicKey?: string;
+          encryptedPrivateKey?: string;
+          iv?: string;
+          tag?: string;
+        }
+
+        const response: ResponseData = {
+          mfaEnabled: false,
+          encryptionVersion: user.encryptionVersion,
+          token: tokens.token,
+          publicKey: user.publicKey,
+          encryptedPrivateKey: user.encryptedPrivateKey,
+          iv: user.iv,
+          tag: user.tag
+        };
+
+        if (user?.protectedKey && user?.protectedKeyIV && user?.protectedKeyTag) {
+          response.protectedKey = user.protectedKey;
+          response.protectedKeyIV = user.protectedKeyIV;
+          response.protectedKeyTag = user.protectedKeyTag;
+        }
+
+        const loginAction = await EELogService.createAction({
+          name: ACTION_LOGIN,
+          userId: user._id
+        });
+
+        loginAction &&
+          (await EELogService.createLog({
+            userId: user._id,
+            actions: [loginAction],
+            channel: getUserAgentType(req.headers["user-agent"]),
+            ipAddress: req.realIP
+          }));
+
+        return res.status(200).send(response);
+      }
+
+      return res.status(400).send({
+        message: "Failed to authenticate. Try again?"
+      });
+    }
+  );
 };

backend/src/controllers/v3/secretsController.ts

@@ -9,8 +9,14 @@ import { getAllImportedSecrets } from "../../services/SecretImportService";
 import { Folder, IServiceTokenData } from "../../models";
 import { getFolderByPath } from "../../services/FolderService";
 import { BadRequestError } from "../../utils/errors";
-import { requireWorkspaceAuth } from "../../middleware";
-import { ADMIN, MEMBER, PERMISSION_READ_SECRETS } from "../../variables";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/secrets";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  getUserProjectPermissions
+} from "../../services/ProjectRoleService";
+import { ForbiddenError, subject } from "@casl/ability";
 
 /**
  * Return secrets for workspace with id [workspaceId] and environment
@@ -19,31 +25,29 @@ import { ADMIN, MEMBER, PERMISSION_READ_SECRETS } from "../../variables";
  * @param res
  */
 export const getSecretsRaw = async (req: Request, res: Response) => {
-  let workspaceId = req.query.workspaceId as string;
-  let environment = req.query.environment as string;
-  let secretPath = req.query.secretPath as string;
-  const folderId = req.query.folderId as string | undefined;
-  const includeImports = req.query.include_imports as string;
+  let {
+    query: { secretPath, environment, workspaceId, include_imports: includeImports, folderId }
+  } = await validateRequest(reqValidator.GetSecretsRawV3, req);
 
   // if the service token has single scope, it will get all secrets for that scope by default
   const serviceTokenDetails: IServiceTokenData = req?.serviceTokenData;
-  if (serviceTokenDetails && serviceTokenDetails.scopes.length == 1 && !containsGlobPatterns(serviceTokenDetails.scopes[0].secretPath)) {
+  if (
+    serviceTokenDetails &&
+    serviceTokenDetails.scopes.length == 1 &&
+    !containsGlobPatterns(serviceTokenDetails.scopes[0].secretPath)
+  ) {
     const scope = serviceTokenDetails.scopes[0];
     secretPath = scope.secretPath;
     environment = scope.environment;
     workspaceId = serviceTokenDetails.workspace.toString();
   } else {
-    requireWorkspaceAuth({
-      acceptedRoles: [ADMIN, MEMBER],
-      locationWorkspaceId: "query",
-      locationEnvironment: "query",
-      requiredPermissions: [PERMISSION_READ_SECRETS],
-      requireBlindIndicesEnabled: true,
-      requireE2EEOff: true
-    });
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
   }
 
-
   const secrets = await SecretService.getSecrets({
     workspaceId: new Types.ObjectId(workspaceId),
     environment,
@@ -56,7 +60,7 @@ export const getSecretsRaw = async (req: Request, res: Response) => {
     workspaceId: new Types.ObjectId(workspaceId)
   });
 
-  if (includeImports === "true") {
+  if (includeImports) {
     const folders = await Folder.findOne({ workspace: workspaceId, environment });
     let folderId = "root";
     // if folder exist get it and replace folderid with new one
@@ -99,11 +103,18 @@ export const getSecretsRaw = async (req: Request, res: Response) => {
  * @param res
  */
 export const getSecretByNameRaw = async (req: Request, res: Response) => {
-  const { secretName } = req.params;
-  const workspaceId = req.query.workspaceId as string;
-  const environment = req.query.environment as string;
-  const secretPath = req.query.secretPath as string;
-  const type = req.query.type as "shared" | "personal" | undefined;
+  const {
+    query: { secretPath, environment, workspaceId, type },
+    params: { secretName }
+  } = await validateRequest(reqValidator.GetSecretByNameRawV3, req);
+
+  if (req.user._id) {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
+  }
 
   const secret = await SecretService.getSecret({
     secretName,
@@ -132,8 +143,18 @@ export const getSecretByNameRaw = async (req: Request, res: Response) => {
  * @param res
  */
 export const createSecretRaw = async (req: Request, res: Response) => {
-  const { secretName } = req.params;
-  const { workspaceId, environment, type, secretValue, secretComment, secretPath = "/" } = req.body;
+  const {
+    params: { secretName },
+    body: { secretPath, environment, workspaceId, type, secretValue, secretComment }
+  } = await validateRequest(reqValidator.CreateSecretRawV3, req);
+
+  if (req.user._id) {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Create,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
+  }
 
   const key = await BotService.getWorkspaceKeyWithBot({
     workspaceId: new Types.ObjectId(workspaceId)
@@ -197,8 +218,18 @@ export const createSecretRaw = async (req: Request, res: Response) => {
  * @param res
  */
 export const updateSecretByNameRaw = async (req: Request, res: Response) => {
-  const { secretName } = req.params;
-  const { workspaceId, environment, type, secretValue, secretPath = "/" } = req.body;
+  const {
+    params: { secretName },
+    body: { secretValue, environment, secretPath, type, workspaceId }
+  } = await validateRequest(reqValidator.UpdateSecretByNameRawV3, req);
+
+  if (req.user._id) {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Edit,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
+  }
 
   const key = await BotService.getWorkspaceKeyWithBot({
     workspaceId: new Types.ObjectId(workspaceId)
@@ -211,7 +242,7 @@ export const updateSecretByNameRaw = async (req: Request, res: Response) => {
 
   const secret = await SecretService.updateSecret({
     secretName,
-    workspaceId,
+    workspaceId: new Types.ObjectId(workspaceId),
     environment,
     type,
     authData: req.authData,
@@ -243,12 +274,22 @@ export const updateSecretByNameRaw = async (req: Request, res: Response) => {
  * @param res
  */
 export const deleteSecretByNameRaw = async (req: Request, res: Response) => {
-  const { secretName } = req.params;
-  const { workspaceId, environment, type, secretPath = "/" } = req.body;
+  const {
+    params: { secretName },
+    body: { environment, secretPath, type, workspaceId }
+  } = await validateRequest(reqValidator.DeleteSecretByNameRawV3, req);
+
+  if (req.user._id) {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Delete,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
+  }
 
   const { secret } = await SecretService.deleteSecret({
     secretName,
-    workspaceId,
+    workspaceId: new Types.ObjectId(workspaceId),
     environment,
     type,
     authData: req.authData,
@@ -282,11 +323,17 @@ export const deleteSecretByNameRaw = async (req: Request, res: Response) => {
  * @param res
  */
 export const getSecrets = async (req: Request, res: Response) => {
-  const workspaceId = req.query.workspaceId as string;
-  const environment = req.query.environment as string;
-  const secretPath = req.query.secretPath as string;
-  const folderId = req.query.folderId as string | undefined;
-  const includeImports = req.query.include_imports as string;
+  const {
+    query: { secretPath, environment, workspaceId, include_imports: includeImports,folderId }
+  } = await validateRequest(reqValidator.GetSecretsV3, req);
+
+  if (req.user._id) {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
+  }
 
   const secrets = await SecretService.getSecrets({
     workspaceId: new Types.ObjectId(workspaceId),
@@ -296,7 +343,7 @@ export const getSecrets = async (req: Request, res: Response) => {
     authData: req.authData
   });
 
-  if (includeImports === "true") {
+  if (includeImports) {
     const folders = await Folder.findOne({ workspace: workspaceId, environment });
     let folderId = "root";
     // if folder exist get it and replace folderid with new one
@@ -325,11 +372,18 @@ export const getSecrets = async (req: Request, res: Response) => {
  * @param res
  */
 export const getSecretByName = async (req: Request, res: Response) => {
-  const { secretName } = req.params;
-  const workspaceId = req.query.workspaceId as string;
-  const environment = req.query.environment as string;
-  const secretPath = req.query.secretPath as string;
-  const type = req.query.type as "shared" | "personal" | undefined;
+  const {
+    query: { secretPath, environment, workspaceId, type },
+    params: { secretName }
+  } = await validateRequest(reqValidator.GetSecretByNameV3, req);
+
+  if (req.user._id) {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
+  }
 
   const secret = await SecretService.getSecret({
     secretName,
@@ -351,23 +405,33 @@ export const getSecretByName = async (req: Request, res: Response) => {
  * @param res
  */
 export const createSecret = async (req: Request, res: Response) => {
-  const { secretName } = req.params;
   const {
-    workspaceId,
-    environment,
-    type,
-    secretKeyCiphertext,
-    secretKeyIV,
-    secretKeyTag,
-    secretValueCiphertext,
-    secretValueIV,
-    secretValueTag,
-    secretCommentCiphertext,
-    secretCommentIV,
-    secretCommentTag,
-    secretPath = "/",
-    metadata
-  } = req.body;
+    body: {
+      workspaceId,
+      secretName,
+      secretPath,
+      environment,
+      metadata,
+      type,
+      secretKeyIV,
+      secretKeyTag,
+      secretValueIV,
+      secretValueTag,
+      secretCommentIV,
+      secretCommentTag,
+      secretKeyCiphertext,
+      secretValueCiphertext,
+      secretCommentCiphertext
+    }
+  } = await validateRequest(reqValidator.CreateSecretV3, req);
+
+  if (req.user._id) {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Create,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
+  }
 
   const secret = await SecretService.createSecret({
     secretName,
@@ -410,20 +474,30 @@ export const createSecret = async (req: Request, res: Response) => {
  * @param res
  */
 export const updateSecretByName = async (req: Request, res: Response) => {
-  const { secretName } = req.params;
   const {
-    workspaceId,
-    environment,
-    type,
-    secretValueCiphertext,
-    secretValueIV,
-    secretValueTag,
-    secretPath = "/"
-  } = req.body;
+    body: {
+      secretValueCiphertext,
+      secretValueTag,
+      secretValueIV,
+      type,
+      environment,
+      secretPath,
+      workspaceId
+    },
+    params: { secretName }
+  } = await validateRequest(reqValidator.UpdateSecretByNameV3, req);
+
+  if (req.user._id) {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Edit,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
+  }
 
   const secret = await SecretService.updateSecret({
     secretName,
-    workspaceId,
+    workspaceId: new Types.ObjectId(workspaceId),
     environment,
     type,
     authData: req.authData,
@@ -452,12 +526,22 @@ export const updateSecretByName = async (req: Request, res: Response) => {
  * @param res
  */
 export const deleteSecretByName = async (req: Request, res: Response) => {
-  const { secretName } = req.params;
-  const { workspaceId, environment, type, secretPath = "/" } = req.body;
+  const {
+    body: { type, environment, secretPath, workspaceId },
+    params: { secretName }
+  } = await validateRequest(reqValidator.DeleteSecretByNameV3, req);
+
+  if (req.user._id) {
+    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Delete,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
+  }
 
   const { secret } = await SecretService.deleteSecret({
     secretName,
-    workspaceId,
+    workspaceId: new Types.ObjectId(workspaceId),
     environment,
     type,
     authData: req.authData,

backend/src/controllers/v3/signupController.ts

@@ -3,9 +3,7 @@ import { Request, Response } from "express";
 import * as Sentry from "@sentry/node";
 import { MembershipOrg, User } from "../../models";
 import { completeAccount } from "../../helpers/user";
-import {
-	initializeDefaultOrg,
-} from "../../helpers/signup";
+import { initializeDefaultOrg } from "../../helpers/signup";
 import { issueAuthTokens, validateProviderAuthToken } from "../../helpers/auth";
 import { ACCEPTED, INVITED } from "../../variables";
 import { standardRequest } from "../../config/request";
@@ -13,6 +11,8 @@ import { getHttpsEnabled, getJwtSignupSecret, getLoopsApiKey } from "../../confi
 import { BadRequestError } from "../../utils/errors";
 import { TelemetryService } from "../../services";
 import { AuthMethod } from "../../models";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/auth";
 
 /**
  * Complete setting up user by adding their personal and auth information as part of the
@@ -22,177 +22,174 @@ import { AuthMethod } from "../../models";
  * @returns
  */
 export const completeAccountSignup = async (req: Request, res: Response) => {
-	let user, token, refreshToken;
-	try {
-		const {
-			email,
-			firstName,
-			lastName,
-			protectedKey,
-			protectedKeyIV,
-			protectedKeyTag,
-			publicKey,
-			encryptedPrivateKey,
-			encryptedPrivateKeyIV,
-			encryptedPrivateKeyTag,
-			salt,
-			verifier,
-			organizationName,
-			providerAuthToken,
-			attributionSource,
-		}: {
-			email: string;
-			firstName: string;
-			lastName: string;
-			protectedKey: string;
-			protectedKeyIV: string;
-			protectedKeyTag: string;
-			publicKey: string;
-			encryptedPrivateKey: string;
-			encryptedPrivateKeyIV: string;
-			encryptedPrivateKeyTag: string;
-			salt: string;
-			verifier: string;
-			organizationName: string;
-			providerAuthToken?: string;
-			attributionSource?: string;
-		} = req.body;
+  let user, token;
+  try {
+    const {
+      body: {
+        email,
+        publicKey,
+        salt,
+        lastName,
+        verifier,
+        firstName,
+        protectedKey,
+        protectedKeyIV,
+        protectedKeyTag,
+        organizationName,
+        providerAuthToken,
+        attributionSource,
+        encryptedPrivateKey,
+        encryptedPrivateKeyIV,
+        encryptedPrivateKeyTag
+      }
+    } = await validateRequest(reqValidator.CompletedAccountSignupV3, req);
 
-		user = await User.findOne({ email });
+    user = await User.findOne({ email });
 
-		if (!user || (user && user?.publicKey)) {
-			// case 1: user doesn't exist.
-			// case 2: user has already completed account
-			return res.status(403).send({
-				error: "Failed to complete account for complete user",
-			});
-		}
+    if (!user || (user && user?.publicKey)) {
+      // case 1: user doesn't exist.
+      // case 2: user has already completed account
+      return res.status(403).send({
+        error: "Failed to complete account for complete user"
+      });
+    }
 
-		if (providerAuthToken) {
-			await validateProviderAuthToken({
-				email,
-				providerAuthToken
-			});
-		} else {
-			const [AUTH_TOKEN_TYPE, AUTH_TOKEN_VALUE] = <[string, string]>req.headers["authorization"]?.split(" ", 2) ?? [null, null]
-			if (AUTH_TOKEN_TYPE === null) {
-				throw BadRequestError({ message: "Missing Authorization Header in the request header." });
-			}
-			if (AUTH_TOKEN_TYPE.toLowerCase() !== "bearer") {
-				throw BadRequestError({ message: `The provided authentication type '${AUTH_TOKEN_TYPE}' is not supported.` })
-			}
-			if (AUTH_TOKEN_VALUE === null) {
-				throw BadRequestError({
-					message: "Missing Authorization Body in the request header",
-				})
-			}
+    if (providerAuthToken) {
+      await validateProviderAuthToken({
+        email,
+        providerAuthToken,
+        user
+      });
+    } else {
+      const [AUTH_TOKEN_TYPE, AUTH_TOKEN_VALUE] = <[string, string]>(
+        req.headers["authorization"]?.split(" ", 2)
+      ) ?? [null, null];
+      if (AUTH_TOKEN_TYPE === null) {
+        throw BadRequestError({ message: "Missing Authorization Header in the request header." });
+      }
+      if (AUTH_TOKEN_TYPE.toLowerCase() !== "bearer") {
+        throw BadRequestError({
+          message: `The provided authentication type '${AUTH_TOKEN_TYPE}' is not supported.`
+        });
+      }
+      if (AUTH_TOKEN_VALUE === null) {
+        throw BadRequestError({
+          message: "Missing Authorization Body in the request header"
+        });
+      }
 
-			const decodedToken = <jwt.UserIDJwtPayload>(
-				jwt.verify(AUTH_TOKEN_VALUE, await getJwtSignupSecret())
-			);
+      const decodedToken = <jwt.UserIDJwtPayload>(
+        jwt.verify(AUTH_TOKEN_VALUE, await getJwtSignupSecret())
+      );
 
-			if (decodedToken.userId !== user.id) {
-				throw BadRequestError();
-			}
-		}
+      if (decodedToken.userId !== user.id) {
+        throw BadRequestError();
+      }
+    }
 
-		// complete setting up user's account
-		user = await completeAccount({
-			userId: user._id.toString(),
-			firstName,
-			lastName,
-			encryptionVersion: 2,
-			protectedKey,
-			protectedKeyIV,
-			protectedKeyTag,
-			publicKey,
-			encryptedPrivateKey,
-			encryptedPrivateKeyIV,
-			encryptedPrivateKeyTag,
-			salt,
-			verifier,
-		});
+    // complete setting up user's account
+    user = await completeAccount({
+      userId: user._id.toString(),
+      firstName,
+      lastName,
+      encryptionVersion: 2,
+      protectedKey,
+      protectedKeyIV,
+      protectedKeyTag,
+      publicKey,
+      encryptedPrivateKey,
+      encryptedPrivateKeyIV,
+      encryptedPrivateKeyTag,
+      salt,
+      verifier
+    });
 
-		if (!user)
-			throw new Error("Failed to complete account for non-existent user"); // ensure user is non-null
+    if (!user) throw new Error("Failed to complete account for non-existent user"); // ensure user is non-null
 
-		const hasSamlEnabled = user.authMethods.some((authMethod: AuthMethod) => [AuthMethod.OKTA_SAML, AuthMethod.AZURE_SAML, AuthMethod.JUMPCLOUD_SAML].includes(authMethod));
-		
-		if (!hasSamlEnabled) { // TODO: modify this part
-			// initialize default organization and workspace
-			await initializeDefaultOrg({
-				organizationName,
-				user,
-			});
-		}
+    const hasSamlEnabled = user.authMethods.some((authMethod: AuthMethod) =>
+      [AuthMethod.OKTA_SAML, AuthMethod.AZURE_SAML, AuthMethod.JUMPCLOUD_SAML].includes(authMethod)
+    );
 
-		// update organization membership statuses that are
-		// invited to completed with user attached
-		await MembershipOrg.updateMany(
-			{
-				inviteEmail: email,
-				status: INVITED,
-			},
-			{
-				user,
-				status: ACCEPTED,
-			}
-		);
+    if (!hasSamlEnabled) {
+      // TODO: modify this part
+      // initialize default organization and workspace
+      await initializeDefaultOrg({
+        organizationName,
+        user
+      });
+    }
 
-		// issue tokens
-		const tokens = await issueAuthTokens({
-			userId: user._id,
-			ip: req.realIP,
-			userAgent: req.headers["user-agent"] ?? "",
-		});
+    // update organization membership statuses that are
+    // invited to completed with user attached
+    await MembershipOrg.updateMany(
+      {
+        inviteEmail: email,
+        status: INVITED
+      },
+      {
+        user,
+        status: ACCEPTED
+      }
+    );
 
-		token = tokens.token;
+    // issue tokens
+    const tokens = await issueAuthTokens({
+      userId: user._id,
+      ip: req.realIP,
+      userAgent: req.headers["user-agent"] ?? ""
+    });
 
-		// sending a welcome email to new users
-		if (await getLoopsApiKey()) {
-			await standardRequest.post("https://app.loops.so/api/v1/events/send", {
-				"email": email,
-				"eventName": "Sign Up",
-				"firstName": firstName,
-				"lastName": lastName,
-			}, {
-				headers: {
-					"Accept": "application/json",
-					"Authorization": "Bearer " + (await getLoopsApiKey()),
-				},
-			});
-		}
+    token = tokens.token;
 
-		// store (refresh) token in httpOnly cookie
-		res.cookie("jid", tokens.refreshToken, {
-			httpOnly: true,
-			path: "/",
-			sameSite: "strict",
-			secure: await getHttpsEnabled(),
-		});
+    // sending a welcome email to new users
+    if (await getLoopsApiKey()) {
+      await standardRequest.post(
+        "https://app.loops.so/api/v1/events/send",
+        {
+          email: email,
+          eventName: "Sign Up",
+          firstName: firstName,
+          lastName: lastName
+        },
+        {
+          headers: {
+            Accept: "application/json",
+            Authorization: "Bearer " + (await getLoopsApiKey())
+          }
+        }
+      );
+    }
 
-		const postHogClient = await TelemetryService.getPostHogClient();
-		if (postHogClient) {
-			postHogClient.capture({
-				event: "User Signed Up",
-				distinctId: email,
-				properties: {
-					email,
-					...(attributionSource ? { attributionSource } : {})
-				},
-			});
-		}
-	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: "Failed to complete account setup",
-		});
-	}
+    // store (refresh) token in httpOnly cookie
+    res.cookie("jid", tokens.refreshToken, {
+      httpOnly: true,
+      path: "/",
+      sameSite: "strict",
+      secure: await getHttpsEnabled()
+    });
 
-	return res.status(200).send({
-		message: "Successfully set up account",
-		user,
-		token,
-	});
+    const postHogClient = await TelemetryService.getPostHogClient();
+    if (postHogClient) {
+      postHogClient.capture({
+        event: "User Signed Up",
+        distinctId: email,
+        properties: {
+          email,
+          ...(attributionSource ? { attributionSource } : {})
+        }
+      });
+    }
+  } catch (err) {
+    Sentry.setUser(null);
+    Sentry.captureException(err);
+    return res.status(400).send({
+      message: "Failed to complete account setup"
+    });
+  }
+
+  return res.status(200).send({
+    message: "Successfully set up account",
+    user,
+    token
+  });
 };

backend/src/controllers/v3/workspacesController.ts

@@ -1,90 +1,103 @@
 import { Request, Response } from "express";
 import { Types } from "mongoose";
+import { validateRequest } from "../../helpers/validation";
 import { Secret } from "../../models";
-import { SecretService } from"../../services";
+import { SecretService } from "../../services";
+import { getUserProjectPermissions } from "../../services/ProjectRoleService";
+import { UnauthorizedRequestError } from "../../utils/errors";
+import * as reqValidator from "../../validation/workspace";
 
 /**
  * Return whether or not all secrets in workspace with id [workspaceId]
  * are blind-indexed
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const getWorkspaceBlindIndexStatus = async (req: Request, res: Response) => {
-    const { workspaceId } = req.params;
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetWorkspaceBlinkIndexStatusV3, req);
 
-    const secretsWithoutBlindIndex = await Secret.countDocuments({
-        workspace: new Types.ObjectId(workspaceId),
-        secretBlindIndex: {
-            $exists: false,
-        },
-    });
+  const { membership } = await getUserProjectPermissions(req.user._id, workspaceId);
+  if (membership.role !== "admin")
+    throw UnauthorizedRequestError({ message: "User must be an admin" });
 
-    return res.status(200).send(secretsWithoutBlindIndex === 0);
-}
+  const secretsWithoutBlindIndex = await Secret.countDocuments({
+    workspace: new Types.ObjectId(workspaceId),
+    secretBlindIndex: {
+      $exists: false
+    }
+  });
+
+  return res.status(200).send(secretsWithoutBlindIndex === 0);
+};
 
 /**
  * Get all secrets for workspace with id [workspaceId]
  */
 export const getWorkspaceSecrets = async (req: Request, res: Response) => {
-    const { workspaceId } = req.params;
+  const {
+    params: { workspaceId }
+  } = await validateRequest(reqValidator.GetWorkspaceSecretsV3, req);
 
-    const secrets = await Secret.find({
-        workspace: new Types.ObjectId (workspaceId),
-    });
-    
-    return res.status(200).send({
-        secrets,
-    });
-}
+  const { membership } = await getUserProjectPermissions(req.user._id, workspaceId);
+  if (membership.role !== "admin")
+    throw UnauthorizedRequestError({ message: "User must be an admin" });
+
+  const secrets = await Secret.find({
+    workspace: new Types.ObjectId(workspaceId)
+  });
+
+  return res.status(200).send({
+    secrets
+  });
+};
 
 /**
  * Update blind indices for secrets in workspace with id [workspaceId]
- * @param req 
- * @param res 
+ * @param req
+ * @param res
  */
 export const nameWorkspaceSecrets = async (req: Request, res: Response) => {
-    interface SecretToUpdate {
-        secretName: string;
-        _id: string;
-    }
+  const {
+    params: { workspaceId },
+    body: { secretsToUpdate }
+  } = await validateRequest(reqValidator.NameWorkspaceSecretsV3, req);
 
-    const { workspaceId } = req.params;
-    const { 
-        secretsToUpdate, 
-    }: {
-        secretsToUpdate: SecretToUpdate[];
-    } = req.body;
+  const { membership } = await getUserProjectPermissions(req.user._id, workspaceId);
+  if (membership.role !== "admin")
+    throw UnauthorizedRequestError({ message: "User must be an admin" });
 
-    // get secret blind index salt
-    const salt = await SecretService.getSecretBlindIndexSalt({
-        workspaceId: new Types.ObjectId(workspaceId),
-    });
+  // get secret blind index salt
+  const salt = await SecretService.getSecretBlindIndexSalt({
+    workspaceId: new Types.ObjectId(workspaceId)
+  });
 
-    // update secret blind indices
-    const operations = await Promise.all(
-        secretsToUpdate.map(async (secretToUpdate: SecretToUpdate) => {
-            const secretBlindIndex = await SecretService.generateSecretBlindIndexWithSalt({
-                secretName: secretToUpdate.secretName,
-                salt,
-            });
-    
-            return ({
-                updateOne: {
-                    filter: {
-                        _id: new Types.ObjectId(secretToUpdate._id),
-                    },
-                    update: {
-                        secretBlindIndex,
-                    },
-                },
-            });
-        })
-    );
+  // update secret blind indices
+  const operations = await Promise.all(
+    secretsToUpdate.map(async (secretToUpdate) => {
+      const secretBlindIndex = await SecretService.generateSecretBlindIndexWithSalt({
+        secretName: secretToUpdate.secretName,
+        salt
+      });
 
-    await Secret.bulkWrite(operations);
+      return {
+        updateOne: {
+          filter: {
+            _id: new Types.ObjectId(secretToUpdate._id)
+          },
+          update: {
+            secretBlindIndex
+          }
+        }
+      };
+    })
+  );
 
-    return res.status(200).send({
-        message: "Successfully named workspace secrets",
-    });
-}
+  await Secret.bulkWrite(operations);
+
+  return res.status(200).send({
+    message: "Successfully named workspace secrets"
+  });
+};