feat(rbac): added new validation to all routes and permission check to most

backend/src/routes/v2/users.ts

@@ -1,114 +1,87 @@
 import express from "express";
 const router = express.Router();
-import {
-    requireAuth,
-    validateRequest,
-} from "../../middleware";
-import { body, param } from "express-validator";
+import { requireAuth } from "../../middleware";
 import { usersController } from "../../controllers/v2";
 import { AuthMode } from "../../variables";
-import {
-    AuthMethod
-} from "../../models";
 
 router.get(
-    "/me",
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
-    }),
-    usersController.getMe
+  "/me",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  usersController.getMe
 );
 
 router.patch(
-    "/me/mfa",
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
-    }),
-    body("isMfaEnabled").exists().isBoolean(),
-    validateRequest,
-    usersController.updateMyMfaEnabled
+  "/me/mfa",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  usersController.updateMyMfaEnabled
 );
 
 router.patch(
-    "/me/name",
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
-    }),
-    body("firstName").exists().isString(),
-    body("lastName").isString(),
-    validateRequest,
-    usersController.updateName
+  "/me/name",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  usersController.updateName
 );
 
 router.put(
-    "/me/auth-methods",
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
-    }),
-    body("authMethods").exists().isArray({
-        min: 1,
-    }).custom((authMethods: AuthMethod[]) => {
-        return authMethods.every(provider => [
-            AuthMethod.EMAIL,
-            AuthMethod.GOOGLE,
-            AuthMethod.GITHUB
-        ].includes(provider))
-    }),
-    validateRequest,
-    usersController.updateAuthMethods,
+  "/me/auth-methods",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  usersController.updateAuthMethods
 );
 
 router.get(
-    "/me/organizations",
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
-    }),
-    usersController.getMyOrganizations
+  "/me/organizations",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  usersController.getMyOrganizations
 );
 
 router.get(
-    "/me/api-keys",
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT]
-    }),
-    usersController.getMyAPIKeys
+  "/me/api-keys",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  usersController.getMyAPIKeys
 );
 
 router.post(
-    "/me/api-keys",
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT]
-    }),
-    body("name").exists().isString().trim(),
-    body("expiresIn").isNumeric(),
-    validateRequest,
-    usersController.createAPIKey
+  "/me/api-keys",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  usersController.createAPIKey
 );
 
 router.delete(
-    "/me/api-keys/:apiKeyDataId",
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT]
-    }),
-    param("apiKeyDataId").exists().trim(),
-    validateRequest,
-    usersController.deleteAPIKey
+  "/me/api-keys/:apiKeyDataId",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  usersController.deleteAPIKey
 );
 
 router.get(
-    "/me/sessions",
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT]
-    }), 
-    usersController.getMySessions
+  "/me/sessions",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  usersController.getMySessions
 );
 
 router.delete(
-    "/me/sessions",
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT]
-    }), 
-    usersController.deleteMySessions
+  "/me/sessions",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  usersController.deleteMySessions
 );
 
-export default router;
+export default router;