Add validation to batch secret endpoint

backend/src/controllers/v2/secretsController.ts

@@ -44,24 +44,16 @@ export const batchSecrets = async (req: Request, res: Response) => {
     }= req.body;
     
     // construct object containing all secrets
-    // listed across requests
     const listedSecretsObj: {
         [key: string]: { 
             version: number;
             type: string;
         }
-    } = (await Secret.find({
+    } = req.secrets.reduce((obj: any, secret: ISecret) => ({
-        _id: {
-            $in: requests
-                .map((request) => request.secret._id)
-                .filter((secretId) => secretId !== undefined)
-        }
-    }).select('version type')).reduce((obj: any, secret: ISecret) => ({
         ...obj,
         [secret._id.toString()]: secret
     }), {});
 
-
     const createSecrets: BatchSecret[] = [];
     const updateSecrets: BatchSecret[] = [];
     const deleteSecrets: Types.ObjectId[] = [];

backend/src/routes/v2/secrets.ts

@@ -6,8 +6,9 @@ import {
     requireSecretsAuth,
     validateRequest
 } from '../../middleware';
-import { query, check, body } from 'express-validator';
+import { query, body } from 'express-validator';
 import { secretsController } from '../../controllers/v2';
+import { validateSecrets } from '../../helpers/secret';
 import {
     ADMIN,
     MEMBER,
@@ -15,14 +16,12 @@ import {
     SECRET_SHARED
 } from '../../variables';
 
-// TODO: create batch update endpoint
+import {
+    BatchSecretRequest
+} from '../../types/secret';
 
 router.post(
     '/batch',
-    body('workspaceId').exists().isString().trim(),
-    body('environment').exists().isString().trim(),
-    body('requests').exists(), // perform validation for batch requests
-    validateRequest,
     requireAuth({
         acceptedAuthModes: ['jwt', 'apiKey']
     }),
@@ -30,8 +29,30 @@ router.post(
         acceptedRoles: [ADMIN, MEMBER],
         location: 'body'
     }),
+    body('workspaceId').exists().isString().trim(),
+    body('environment').exists().isString().trim(),
+    body('requests')
+        .exists()
+        .custom(async (requests: BatchSecretRequest[], { req }) => {
+            if (Array.isArray(requests)) {
+                const secretIds = requests
+                    .map((request) => request.secret._id)
+                    .filter((secretId) => secretId !== undefined)
+                
+                if (secretIds.length > 0) {
+                    const relevantSecrets = await validateSecrets({
+                        userId: req.user._id.toString(),
+                        secretIds
+                    });
+                    
+                    req.secrets = relevantSecrets;
+                }
+            }
+        return true;
+    }),
+    validateRequest,
     secretsController.batchSecrets
-)
+);
 
 router.post(
     '/',