Fast forward

backend/src/routes/v1/auth.ts

@@ -4,11 +4,11 @@ import { body } from "express-validator";
 import { requireAuth, validateRequest } from "../../middleware";
 import { authController } from "../../controllers/v1";
 import { authLimiter } from "../../helpers/rateLimiter";
-import { AUTH_MODE_JWT } from "../../variables";
+import { AuthMode } from "../../variables";
 
 router.post("/token", validateRequest, authController.getNewToken);
 
-router.post( // deprecated (moved to api/v2/auth/login1)
+router.post( // TODO endpoint: deprecate (moved to api/v3/auth/login1)
   "/login1",
   authLimiter,
   body("email").exists().trim().notEmpty(),
@@ -17,7 +17,7 @@ router.post( // deprecated (moved to api/v2/auth/login1)
   authController.login1
 );
 
-router.post( // deprecated (moved to api/v2/auth/login2)
+router.post( // TODO endpoint: deprecate (moved to api/v3/auth/login2)
   "/login2",
   authLimiter,
   body("email").exists().trim().notEmpty(),
@@ -30,7 +30,7 @@ router.post(
   "/logout",
   authLimiter,
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT],
+    acceptedAuthModes: [AuthMode.JWT],
   }),
   authController.logout
 );
@@ -38,7 +38,7 @@ router.post(
 router.post(
   "/checkAuth",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT],
+    acceptedAuthModes: [AuthMode.JWT],
   }),
   authController.checkAuth
 );
@@ -49,13 +49,13 @@ router.get(
   authController.getCommonPasswords
 );
 
-router.delete(
+router.delete( // TODO endpoint: deprecate (moved to DELETE v2/users/me/sessions)
   "/sessions",
   authLimiter,
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT],
+    acceptedAuthModes: [AuthMode.JWT],
   }), 
   authController.revokeAllSessions
 );
 
-export default router;
+export default router;

backend/src/routes/v1/bot.ts

@@ -8,12 +8,12 @@ import {
     validateRequest,
 } from "../../middleware";
 import { botController } from "../../controllers/v1";
-import { ADMIN, AUTH_MODE_JWT, MEMBER } from "../../variables";
+import { ADMIN, AuthMode, MEMBER } from "../../variables";
 
 router.get(
     "/:workspaceId",
 	requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
+        acceptedAuthModes: [AuthMode.JWT],
     }),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -27,7 +27,7 @@ router.get(
 router.patch(
     "/:botId/active",
 	requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
+        acceptedAuthModes: [AuthMode.JWT],
     }),
     requireBotAuth({
 		acceptedRoles: [ADMIN, MEMBER],

backend/src/routes/v1/integration.ts

@@ -8,9 +8,8 @@ import {
 } from "../../middleware";
 import {
   ADMIN,
-  AUTH_MODE_API_KEY,
-  AUTH_MODE_JWT,
-  MEMBER,
+  AuthMode,
+  MEMBER
 } from "../../variables";
 import { body, param } from "express-validator";
 import { integrationController } from "../../controllers/v1";
@@ -18,7 +17,7 @@ import { integrationController } from "../../controllers/v1";
 router.post(
   "/",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY],
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
   }),
   requireIntegrationAuthorizationAuth({
     acceptedRoles: [ADMIN, MEMBER],
@@ -44,7 +43,7 @@ router.post(
 router.patch(
   "/:integrationId",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT],
+    acceptedAuthModes: [AuthMode.JWT]
   }),
   requireIntegrationAuth({
     acceptedRoles: [ADMIN, MEMBER],
@@ -64,7 +63,7 @@ router.patch(
 router.delete(
   "/:integrationId",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT],
+    acceptedAuthModes: [AuthMode.JWT]
   }),
   requireIntegrationAuth({
     acceptedRoles: [ADMIN, MEMBER],

backend/src/routes/v1/integrationAuth.ts

@@ -9,16 +9,15 @@ import {
 } from "../../middleware";
 import {
 	ADMIN, 
-	AUTH_MODE_API_KEY,
-	AUTH_MODE_JWT,
-	MEMBER,
+	AuthMode,
+	MEMBER
 } from "../../variables";
 import { integrationAuthController } from "../../controllers/v1";
 
 router.get(
 	"/integration-options",
 	requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
+        acceptedAuthModes: [AuthMode.JWT],
     }),
 	integrationAuthController.getIntegrationOptions
 );
@@ -26,7 +25,7 @@ router.get(
 router.get(
 	"/:integrationAuthId",
 	requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
+        acceptedAuthModes: [AuthMode.JWT],
     }),
 	requireIntegrationAuthorizationAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -39,7 +38,7 @@ router.get(
 router.post(
 	"/oauth-token",
 	requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
+        acceptedAuthModes: [AuthMode.JWT],
     }),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -62,7 +61,7 @@ router.post(
 	body("integration").exists().trim().notEmpty(),
 	validateRequest,
 	requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY],
+        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
     }),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -74,7 +73,7 @@ router.post(
 router.get(
 	"/:integrationAuthId/apps",
 	requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
+        acceptedAuthModes: [AuthMode.JWT],
     }),
 	requireIntegrationAuthorizationAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -89,7 +88,7 @@ router.get(
 router.get(
 	"/:integrationAuthId/teams",
 	requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
+        acceptedAuthModes: [AuthMode.JWT],
     }),
 	requireIntegrationAuthorizationAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -102,7 +101,7 @@ router.get(
 router.get(
 	"/:integrationAuthId/vercel/branches",
 	requireAuth({
-        acceptedAuthModes: ["jwt"],
+        acceptedAuthModes: [AuthMode.JWT],
     }),
 	requireIntegrationAuthorizationAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -117,7 +116,7 @@ router.get(
 router.get(
 	"/:integrationAuthId/railway/environments",
 	requireAuth({
-		acceptedAuthModes: ["jwt"],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	requireIntegrationAuthorizationAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -131,7 +130,7 @@ router.get(
 router.get(
 	"/:integrationAuthId/railway/services",
 	requireAuth({
-		acceptedAuthModes: ["jwt"],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	requireIntegrationAuthorizationAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -145,7 +144,7 @@ router.get(
 router.get(
 	"/:integrationAuthId/bitbucket/workspaces",
 	requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
+        acceptedAuthModes: [AuthMode.JWT],
     }),
 	requireIntegrationAuthorizationAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -158,7 +157,7 @@ router.get(
 router.get(
 	"/:integrationAuthId/northflank/secret-groups",
 	requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
+        acceptedAuthModes: [AuthMode.JWT],
     }),
 	requireIntegrationAuthorizationAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -172,7 +171,7 @@ router.get(
 router.delete(
 	"/:integrationAuthId",
 	requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
+        acceptedAuthModes: [AuthMode.JWT],
     }),
 	requireIntegrationAuthorizationAuth({
 		acceptedRoles: [ADMIN, MEMBER],

backend/src/routes/v1/inviteOrg.ts

@@ -3,12 +3,14 @@ const router = express.Router();
 import { body } from "express-validator";
 import { requireAuth, validateRequest } from "../../middleware";
 import { membershipOrgController } from "../../controllers/v1";
-import { AUTH_MODE_JWT } from "../../variables";
+import { AuthMode } from "../../variables";
+
+// TODO endpoint: consider moving these endpoints to be under /organization to be more RESTful
 
 router.post(
 	"/signup",
 	requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
+        acceptedAuthModes: [AuthMode.JWT],
     }),
 	body("inviteeEmail").exists().trim().notEmpty().isEmail(),
 	body("organizationId").exists().trim().notEmpty(),

backend/src/routes/v1/key.ts

@@ -6,13 +6,15 @@ import {
 	validateRequest,
 } from "../../middleware";
 import { body, param } from "express-validator";
-import { ADMIN, AUTH_MODE_JWT, MEMBER } from "../../variables";
+import { ADMIN, AuthMode, MEMBER } from "../../variables";
 import { keyController } from "../../controllers/v1";
 
+// TODO endpoint: consider moving these endpoints to be under /workspaces to be more RESTful
+
 router.post(
 	"/:workspaceId",
 	requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
+        acceptedAuthModes: [AuthMode.JWT],
     }),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -24,10 +26,10 @@ router.post(
 	keyController.uploadKey
 );
 
-router.get(
+router.get( // TODO endpoint: deprecate (note: move frontend to v2/workspace/key or something)
 	"/:workspaceId/latest",
 	requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
+        acceptedAuthModes: [AuthMode.JWT],
     }),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],

backend/src/routes/v1/membership.ts

@@ -4,44 +4,45 @@ import { body, param } from "express-validator";
 import { requireAuth, validateRequest } from "../../middleware";
 import { membershipController } from "../../controllers/v1";
 import { membershipController as EEMembershipControllers } from "../../ee/controllers/v1";
-import { AUTH_MODE_JWT } from "../../variables";
+import { AuthMode } from "../../variables";
 
 // note: ALL DEPRECIATED (moved to api/v2/workspace/:workspaceId/memberships/:membershipId)
+// TODO endpoint: consider moving these endpoints to be under /workspace to be more RESTful
 
-router.get( // used for old CLI (deprecate)
+router.get( // TODO endpoint: deprecate - used for old CLI (deprecate)
 	"/:workspaceId/connect",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	param("workspaceId").exists().trim(),
 	validateRequest,
 	membershipController.validateMembership
 );
 
-router.delete(
+router.delete( // TODO endpoint: check dashboard
 	"/:membershipId",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	param("membershipId").exists().trim(),
 	validateRequest,
 	membershipController.deleteMembership
 );
 
-router.post(
+router.post( // TODO endpoint: check dashboard
 	"/:membershipId/change-role",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	body("role").exists().trim(),
 	validateRequest,
 	membershipController.changeMembershipRole
 );
 
-router.post(
+router.post( // TODO endpoint: check dashboard
 	"/:membershipId/deny-permissions",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	param("membershipId").isMongoId().exists().trim(),
 	body("permissions").isArray().exists(),

backend/src/routes/v1/membershipOrg.ts

@@ -3,13 +3,12 @@ const router = express.Router();
 import { param } from "express-validator";
 import { requireAuth, validateRequest } from "../../middleware";
 import { membershipOrgController } from "../../controllers/v1";
-import { AUTH_MODE_JWT } from "../../variables";
+import { AuthMode } from "../../variables";
 
-router.post(
-	// TODO
+router.post( // TODO endpoint: check dashboard
 	"/membershipOrg/:membershipOrgId/change-role",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	param("membershipOrgId"),
 	validateRequest,
@@ -17,9 +16,9 @@ router.post(
 );
 
 router.delete(
-	"/:membershipOrgId",
+	"/:membershipOrgId", // TODO endpoint: check dashboard
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	param("membershipOrgId").exists().trim(),
 	validateRequest,

backend/src/routes/v1/organization.ts

@@ -9,16 +9,16 @@ import {
 import {
 	ACCEPTED, 
 	ADMIN, 
-	AUTH_MODE_JWT, 
+	AuthMode,
 	MEMBER,
-	OWNER,
+	OWNER
 } from "../../variables";
 import { organizationController } from "../../controllers/v1";
 
-router.get( // deprecated (moved to api/v2/users/me/organizations)
+router.get( // TODO endpoint: deprecate (moved to api/v2/users/me/organizations)
 	"/",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	organizationController.getOrganizations
 );
@@ -26,7 +26,7 @@ router.get( // deprecated (moved to api/v2/users/me/organizations)
 router.post( // not used on frontend
 	"/",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	body("organizationName").exists().trim().notEmpty(),
 	validateRequest,
@@ -36,7 +36,7 @@ router.post( // not used on frontend
 router.get(
 	"/:organizationId",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
@@ -47,10 +47,10 @@ router.get(
 	organizationController.getOrganization
 );
 
-router.get( // deprecated (moved to api/v2/organizations/:organizationId/memberships)
+router.get( // TODO endpoint: deprecate (moved to api/v2/organizations/:organizationId/memberships)
 	"/:organizationId/users",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
@@ -61,10 +61,10 @@ router.get( // deprecated (moved to api/v2/organizations/:organizationId/members
 	organizationController.getOrganizationMembers
 );
 
-router.get(
+router.get( // TODO endpoint: move to /v2/users/me/organizations/:organizationId/workspaces
 	"/:organizationId/my-workspaces", // deprecated (moved to api/v2/organizations/:organizationId/workspaces)
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
@@ -78,7 +78,7 @@ router.get(
 router.patch(
 	"/:organizationId/name",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
@@ -93,7 +93,7 @@ router.patch(
 router.get(
 	"/:organizationId/incidentContactOrg",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
@@ -107,7 +107,7 @@ router.get(
 router.post(
 	"/:organizationId/incidentContactOrg",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
@@ -122,7 +122,7 @@ router.post(
 router.delete(
 	"/:organizationId/incidentContactOrg",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
@@ -135,9 +135,9 @@ router.delete(
 );
 
 router.post(
-	"/:organizationId/customer-portal-session",
+	"/:organizationId/customer-portal-session", // TODO endpoint: move to EE
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
@@ -148,24 +148,10 @@ router.post(
 	organizationController.createOrganizationPortalSession
 );
 
-router.get(
-	"/:organizationId/subscriptions",
-	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
-	}),
-	requireOrganizationAuth({
-		acceptedRoles: [OWNER, ADMIN, MEMBER],
-		acceptedStatuses: [ACCEPTED],
-	}),
-	param("organizationId").exists().trim(),
-	validateRequest,
-	organizationController.getOrganizationSubscriptions
-);
-
 router.get(
 	"/:organizationId/workspace-memberships",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT]
 	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],

backend/src/routes/v1/password.ts

@@ -4,14 +4,12 @@ import { body } from "express-validator";
 import { requireAuth, requireSignupAuth, validateRequest } from "../../middleware";
 import { passwordController } from "../../controllers/v1";
 import { passwordLimiter } from "../../helpers/rateLimiter";
-import {
-	AUTH_MODE_JWT,
-} from "../../variables";
+import { AuthMode } from "../../variables";
 
 router.post(
 	"/srp1",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	body("clientPublicKey").exists().isString().trim().notEmpty(),
 	validateRequest,
@@ -22,7 +20,7 @@ router.post(
 	"/change-password",
 	passwordLimiter,
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	body("clientProof").exists().trim().notEmpty(),
 	body("protectedKey").exists().isString().trim().notEmpty(),
@@ -65,7 +63,7 @@ router.post(
 	"/backup-private-key",
 	passwordLimiter,
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	body("clientProof").exists().isString().trim().notEmpty(),
 	body("encryptedPrivateKey").exists().isString().trim().notEmpty(), // (backup) private key encrypted under a strong key

backend/src/routes/v1/secret.ts

@@ -10,16 +10,16 @@ import { body, param, query } from "express-validator";
 import { secretController } from "../../controllers/v1";
 import {
 	ADMIN, 
-	AUTH_MODE_JWT,
-	MEMBER,
+	AuthMode,
+	MEMBER
 } from "../../variables";
 
-// note to devs: these endpoints will be deprecated in favor of v2
+// note: endpoints deprecated in favor of v3/secrets
 
-router.post(
+router.post( // TODO endpoint: deprecate (moved to POST api/v3/secrets)
 	"/:workspaceId",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -34,10 +34,10 @@ router.post(
 	secretController.pushSecrets
 );
 
-router.get(
+router.get( // TODO endpoint: deprecate (moved to GET api/v3/secrets)
 	"/:workspaceId",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -50,7 +50,7 @@ router.get(
 	secretController.pullSecrets
 );
 
-router.get(
+router.get( // TODO endpoint: deprecate (moved to GET api/v3/secrets)
 	"/:workspaceId/service-token",
 	requireServiceTokenAuth,
 	query("environment").exists().trim(),

backend/src/routes/v1/secretImport.ts

@@ -1,14 +1,14 @@
 import express from "express";
-const router = express.Router();
 import { body, param, query } from "express-validator";
 import { secretImportController } from "../../controllers/v1";
 import { requireAuth, requireWorkspaceAuth, validateRequest } from "../../middleware";
-import { ADMIN, AUTH_MODE_JWT, MEMBER } from "../../variables";
+import { ADMIN, AuthMode, MEMBER } from "../../variables";
+const router = express.Router();
 
 router.post(
   "/",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT]
+    acceptedAuthModes: [AuthMode.JWT,AuthMode.SERVICE_TOKEN]
   }),
   requireWorkspaceAuth({
     acceptedRoles: [ADMIN, MEMBER],
@@ -27,7 +27,7 @@ router.post(
 router.put(
   "/:id",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT]
+    acceptedAuthModes: [AuthMode.JWT,AuthMode.SERVICE_TOKEN]
   }),
   param("id").exists().isString().trim(),
   body("secretImports").exists().isArray(),
@@ -40,7 +40,7 @@ router.put(
 router.delete(
   "/:id",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT]
+    acceptedAuthModes: [AuthMode.JWT,AuthMode.SERVICE_TOKEN]
   }),
   param("id").exists().isString().trim(),
   body("secretImportPath").isString().exists().trim(),
@@ -52,7 +52,7 @@ router.delete(
 router.get(
   "/",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT]
+    acceptedAuthModes: [AuthMode.JWT,AuthMode.SERVICE_TOKEN]
   }),
   requireWorkspaceAuth({
     acceptedRoles: [ADMIN, MEMBER],
@@ -68,7 +68,7 @@ router.get(
 router.get(
   "/secrets",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT]
+    acceptedAuthModes: [AuthMode.JWT,AuthMode.SERVICE_TOKEN]
   }),
   requireWorkspaceAuth({
     acceptedRoles: [ADMIN, MEMBER],

backend/src/routes/v1/secretsFolder.ts

@@ -1,27 +1,23 @@
 import express from "express";
-const router = express.Router();
-import {
-  requireAuth,
-  requireWorkspaceAuth,
-  validateRequest,
-} from "../../middleware";
 import { body, param, query } from "express-validator";
 import {
   createFolder,
   deleteFolder,
   getFolders,
-  updateFolderById,
+  updateFolderById
 } from "../../controllers/v1/secretsFolderController";
-import { ADMIN, MEMBER } from "../../variables";
+import { requireAuth, requireWorkspaceAuth, validateRequest } from "../../middleware";
+import { ADMIN, AuthMode, MEMBER } from "../../variables";
+const router = express.Router();
 
 router.post(
   "/",
   requireAuth({
-    acceptedAuthModes: ["jwt"],
+    acceptedAuthModes: [AuthMode.JWT,AuthMode.SERVICE_TOKEN]
   }),
   requireWorkspaceAuth({
     acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "body",
+    locationWorkspaceId: "body"
   }),
   body("workspaceId").exists(),
   body("environment").exists(),
@@ -34,7 +30,7 @@ router.post(
 router.patch(
   "/:folderId",
   requireAuth({
-    acceptedAuthModes: ["jwt"],
+    acceptedAuthModes: [AuthMode.JWT,AuthMode.SERVICE_TOKEN]
   }),
   body("workspaceId").exists(),
   body("environment").exists(),
@@ -46,7 +42,7 @@ router.patch(
 router.delete(
   "/:folderId",
   requireAuth({
-    acceptedAuthModes: ["jwt"],
+    acceptedAuthModes: [AuthMode.JWT,AuthMode.SERVICE_TOKEN]
   }),
   body("workspaceId").exists(),
   body("environment").exists(),
@@ -58,7 +54,7 @@ router.delete(
 router.get(
   "/",
   requireAuth({
-    acceptedAuthModes: ["jwt"],
+    acceptedAuthModes: [AuthMode.JWT,AuthMode.SERVICE_TOKEN]
   }),
   query("workspaceId").exists().isString().trim(),
   query("environment").exists().isString().trim(),

backend/src/routes/v1/serviceToken.ts

@@ -9,23 +9,23 @@ import {
 import { body } from "express-validator";
 import {
 	ADMIN, 
-	AUTH_MODE_JWT,
-	MEMBER,
+	AuthMode,
+	MEMBER
 } from "../../variables";
 import { serviceTokenController } from "../../controllers/v1";
 
 // note: deprecate service-token routes in favor of service-token data routes/structure
 
-router.get(
+router.get( // TODO endpoint: deprecate
 	"/",
 	requireServiceTokenAuth,
 	serviceTokenController.getServiceToken
 );
 
-router.post(
+router.post( // TODO endpoint: deprecate
 	"/",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],

backend/src/routes/v1/signup.ts

@@ -5,7 +5,9 @@ import { validateRequest } from "../../middleware";
 import { signupController } from "../../controllers/v1";
 import { authLimiter } from "../../helpers/rateLimiter";
 
-router.post(
+// TODO: consider moving to users/v3/signup
+
+router.post( // TODO endpoint: consider moving to v3/users/signup/mail
 	"/email/signup",
 	authLimiter,
 	body("email").exists().trim().notEmpty().isEmail(),
@@ -14,7 +16,7 @@ router.post(
 );
 
 router.post(
-	"/email/verify",
+	"/email/verify", // TODO endpoint: consider moving to v3/users/signup/verify
 	authLimiter,
 	body("email").exists().trim().notEmpty().isEmail(),
 	body("code").exists().trim().notEmpty(),
@@ -22,4 +24,4 @@ router.post(
 	signupController.verifyEmailSignup
 );
 
-export default router;
+export default router;

backend/src/routes/v1/user.ts

@@ -2,14 +2,12 @@ import express from "express";
 const router = express.Router();
 import { requireAuth } from "../../middleware";
 import { userController } from "../../controllers/v1";
-import {
-    AUTH_MODE_JWT,
-} from "../../variables";
+import { AuthMode } from "../../variables";
 
-router.get(
+router.get( // TODO endpoint: deprecate (moved to v2/users/me)
     "/", 
     requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
+        acceptedAuthModes: [AuthMode.JWT],
     }), 
     userController.getUser
 );

backend/src/routes/v1/userAction.ts

@@ -3,13 +3,13 @@ const router = express.Router();
 import { requireAuth, validateRequest } from "../../middleware";
 import { body, query } from "express-validator";
 import { userActionController } from "../../controllers/v1";
-import { AUTH_MODE_JWT } from "../../variables";
+import { AuthMode } from "../../variables";
 
 // note: [userAction] will be deprecated in /v2 in favor of [action]
-router.post(
+router.post( // TODO endpoint: move this into /users/me
 	"/",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	body("action"),
 	validateRequest,
@@ -19,7 +19,7 @@ router.post(
 router.get(
 	"/",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	query("action"),
 	validateRequest,

backend/src/routes/v1/webhook.ts

@@ -2,13 +2,13 @@ import express from "express";
 const router = express.Router();
 import { requireAuth, requireWorkspaceAuth, validateRequest } from "../../middleware";
 import { body, param, query } from "express-validator";
-import { ADMIN, AUTH_MODE_JWT, MEMBER } from "../../variables";
+import { ADMIN, AuthMode, MEMBER } from "../../variables";
 import { webhookController } from "../../controllers/v1";
 
 router.post(
   "/",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT]
+    acceptedAuthModes: [AuthMode.JWT],
   }),
   requireWorkspaceAuth({
     acceptedRoles: [ADMIN, MEMBER],
@@ -27,7 +27,7 @@ router.post(
 router.patch(
   "/:webhookId",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT]
+    acceptedAuthModes: [AuthMode.JWT],
   }),
   param("webhookId").exists().isString().trim(),
   body("isDisabled").default(false).isBoolean(),
@@ -38,7 +38,7 @@ router.patch(
 router.post(
   "/:webhookId/test",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT]
+    acceptedAuthModes: [AuthMode.JWT],
   }),
   param("webhookId").exists().isString().trim(),
   validateRequest,
@@ -48,7 +48,7 @@ router.post(
 router.delete(
   "/:webhookId",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT]
+    acceptedAuthModes: [AuthMode.JWT],
   }),
   param("webhookId").exists().isString().trim(),
   validateRequest,
@@ -58,7 +58,7 @@ router.delete(
 router.get(
   "/",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT]
+    acceptedAuthModes: [AuthMode.JWT],
   }),
   requireWorkspaceAuth({
     acceptedRoles: [ADMIN, MEMBER],

backend/src/routes/v1/workspace.ts

@@ -8,16 +8,15 @@ import {
 } from "../../middleware";
 import {
 	ADMIN, 
-	AUTH_MODE_API_KEY,
-	AUTH_MODE_JWT,
-	MEMBER,
+	AuthMode,
+	MEMBER
 } from "../../variables";
 import { membershipController, workspaceController } from "../../controllers/v1";
 
 router.get(
 	"/:workspaceId/keys",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -31,7 +30,7 @@ router.get(
 router.get(
 	"/:workspaceId/users",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -45,7 +44,7 @@ router.get(
 router.get(
 	"/", 
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY],
+		acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
 	}), 
 	workspaceController.getWorkspaces
 );
@@ -53,7 +52,7 @@ router.get(
 router.get(
 	"/:workspaceId",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -67,7 +66,7 @@ router.get(
 router.post(
 	"/",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	body("workspaceName").exists().trim().notEmpty(),
 	body("organizationId").exists().trim().notEmpty(),
@@ -78,7 +77,7 @@ router.post(
 router.delete(
 	"/:workspaceId",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN],
@@ -92,7 +91,7 @@ router.delete(
 router.post(
 	"/:workspaceId/name",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -107,7 +106,7 @@ router.post(
 router.post(
 	"/:workspaceId/invite-signup",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -122,7 +121,7 @@ router.post(
 router.get(
 	"/:workspaceId/integrations",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -136,7 +135,7 @@ router.get(
 router.get(
 	"/:workspaceId/authorizations",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -148,9 +147,9 @@ router.get(
 );
 
 router.get(
-	"/:workspaceId/service-tokens", // deprecate
+	"/:workspaceId/service-tokens", // TODO endpoint: deprecate
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],

backend/src/routes/v2/auth.ts

@@ -5,7 +5,7 @@ import { requireMfaAuth, validateRequest } from "../../middleware";
 import { authController } from "../../controllers/v2";
 import { authLimiter } from "../../helpers/rateLimiter";
 
-router.post(
+router.post( // TODO: deprecate (moved to api/v3/auth/login1)
   "/login1",
   authLimiter,
   body("email").isString().trim().notEmpty(),
@@ -14,7 +14,7 @@ router.post(
   authController.login1
 );
 
-router.post(
+router.post( // TODO: deprecate (moved to api/v3/auth/login1)
   "/login2",
   authLimiter,
   body("email").isString().trim().notEmpty(),

backend/src/routes/v2/environment.ts

@@ -9,14 +9,14 @@ import {
 } from "../../middleware";
 import {
   ADMIN, 
-  AUTH_MODE_JWT,
-  MEMBER,
+  AuthMode,
+  MEMBER
 } from "../../variables";
 
 router.post(
   "/:workspaceId/environments",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT],
+    acceptedAuthModes: [AuthMode.JWT],
   }),
   requireWorkspaceAuth({
     acceptedRoles: [ADMIN, MEMBER],
@@ -32,7 +32,7 @@ router.post(
 router.put(
   "/:workspaceId/environments",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT],
+    acceptedAuthModes: [AuthMode.JWT],
   }),
   requireWorkspaceAuth({
     acceptedRoles: [ADMIN, MEMBER],
@@ -49,7 +49,7 @@ router.put(
 router.delete(
   "/:workspaceId/environments",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT],
+    acceptedAuthModes: [AuthMode.JWT],
   }),
   requireWorkspaceAuth({
     acceptedRoles: [ADMIN],
@@ -64,7 +64,7 @@ router.delete(
 router.get(
   "/:workspaceId/environments",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT],
+    acceptedAuthModes: [AuthMode.JWT],
   }),
   requireWorkspaceAuth({
     acceptedRoles: [MEMBER, ADMIN],

backend/src/routes/v2/organizations.ts

@@ -10,10 +10,9 @@ import { body, param } from "express-validator";
 import { 
     ACCEPTED, 
     ADMIN, 
-    AUTH_MODE_API_KEY, 
-    AUTH_MODE_JWT,
+    AuthMode,
     MEMBER,
-    OWNER,
+    OWNER
 } from "../../variables";
 import { organizationsController } from "../../controllers/v2";
 
@@ -24,7 +23,7 @@ router.get(
     param("organizationId").exists().trim(),
     validateRequest,
     requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY],
+        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
     }),
     requireOrganizationAuth({
         acceptedRoles: [OWNER, ADMIN, MEMBER],
@@ -40,7 +39,7 @@ router.patch(
     body("role").exists().isString().trim().isIn([OWNER, ADMIN, MEMBER]),
     validateRequest,
     requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY],
+        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
     }),
     requireOrganizationAuth({
         acceptedRoles: [OWNER, ADMIN],
@@ -59,7 +58,7 @@ router.delete(
     param("membershipId").exists().trim(),
     validateRequest,
     requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY],
+        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
     }),
     requireOrganizationAuth({
         acceptedRoles: [OWNER, ADMIN],
@@ -77,7 +76,7 @@ router.get(
     param("organizationId").exists().trim(),
     validateRequest,
     requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY],
+        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
     }),
     requireOrganizationAuth({
         acceptedRoles: [OWNER, ADMIN],
@@ -86,12 +85,12 @@ router.get(
     organizationsController.getOrganizationWorkspaces
 );
 
-router.get(
+router.get( // TODO endpoint: deprecate service accounts
     "/:organizationId/service-accounts",
     param("organizationId").exists().trim(),
     validateRequest,
     requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
+        acceptedAuthModes: [AuthMode.JWT]
     }),
     requireOrganizationAuth({
         acceptedRoles: [OWNER, ADMIN],

backend/src/routes/v2/secret.ts

@@ -1,4 +1,5 @@
 import express from "express";
+const router = express.Router();
 import { 
   requireAuth, 
   requireSecretAuth,
@@ -8,8 +9,7 @@ import {
 import { body, param, query } from "express-validator";
 import {
   ADMIN, 
-  AUTH_MODE_JWT,
-  AUTH_MODE_SERVICE_TOKEN,
+  AuthMode,
   MEMBER,
   PERMISSION_READ_SECRETS,
   PERMISSION_WRITE_SECRETS,
@@ -17,14 +17,12 @@ import {
 import { CreateSecretRequestBody, ModifySecretRequestBody } from "../../types/secret";
 import { secretController } from "../../controllers/v2";
 
-// note to devs: stop supporting these routes [deprecated]
+// note: endpoints deprecated in favor of v3/secrets
 
-const router = express.Router();
-
-router.post(
+router.post( // TODO endpoint: deprecate (moved to POST api/v3/secrets)
   "/batch-create/workspace/:workspaceId/environment/:environment",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT],
+    acceptedAuthModes: [AuthMode.JWT],
   }),
   requireWorkspaceAuth({
     acceptedRoles: [ADMIN, MEMBER],
@@ -39,9 +37,9 @@ router.post(
 );
 
 router.post(
-  "/workspace/:workspaceId/environment/:environment",
+  "/workspace/:workspaceId/environment/:environment", // TODO endpoint: deprecate (moved to POST api/v3/secrets)
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT],
+    acceptedAuthModes: [AuthMode.JWT],
   }),
   requireWorkspaceAuth({
     acceptedRoles: [ADMIN, MEMBER],
@@ -55,12 +53,12 @@ router.post(
   secretController.createSecret
 );
 
-router.get(
+router.get( // TODO endpoint: deprecate (moved to GET api/v3/secrets)
   "/workspace/:workspaceId",
   param("workspaceId").exists().trim(),
   query("environment").exists(),
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_SERVICE_TOKEN],
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN],
   }),
   requireWorkspaceAuth({
     acceptedRoles: [ADMIN, MEMBER],
@@ -71,10 +69,10 @@ router.get(
   secretController.getSecrets
 );
 
-router.get(
+router.get( // TODO endpoint: deprecate (moved to POST api/v3/secrets)
   "/:secretId",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_SERVICE_TOKEN],
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN],
   }),
   requireSecretAuth({
     acceptedRoles: [ADMIN, MEMBER],
@@ -84,10 +82,10 @@ router.get(
   secretController.getSecret
 );
 
-router.delete(
+router.delete( // TODO endpoint: deprecate (moved to DELETE api/v3/secrets)
   "/batch/workspace/:workspaceId/environment/:environmentName",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT],
+    acceptedAuthModes: [AuthMode.JWT],
   }),
   param("workspaceId").exists().isMongoId().trim(),
   param("environmentName").exists().trim(),
@@ -100,10 +98,10 @@ router.delete(
   secretController.deleteSecrets
 );
 
-router.delete(
+router.delete( // TODO endpoint: deprecate (moved to DELETE api/v3/secrets)
   "/:secretId",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT],
+    acceptedAuthModes: [AuthMode.JWT],
   }),
   requireSecretAuth({
     acceptedRoles: [ADMIN, MEMBER],
@@ -114,10 +112,10 @@ router.delete(
   secretController.deleteSecret
 );
 
-router.patch(
+router.patch( // TODO endpoint: deprecate (moved to PATCH api/v3/secrets)
   "/batch-modify/workspace/:workspaceId/environment/:environmentName",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT],
+    acceptedAuthModes: [AuthMode.JWT],
   }),
   body("secrets").exists().isArray().custom((secrets: ModifySecretRequestBody[]) => secrets.length > 0),
   param("workspaceId").exists().isMongoId().trim(),
@@ -130,10 +128,10 @@ router.patch(
   secretController.updateSecrets
 );
 
-router.patch(
+router.patch( // TODO endpoint: deprecate (moved to PATCH api/v3/secrets)
   "/workspace/:workspaceId/environment/:environmentName",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT],
+    acceptedAuthModes: [AuthMode.JWT],
   }),
   body("secret").isObject(),
   param("workspaceId").exists().isMongoId().trim(),

backend/src/routes/v2/secrets.ts

@@ -12,10 +12,7 @@ import { body, query } from "express-validator";
 import { secretsController } from "../../controllers/v2";
 import {
   ADMIN,
-  AUTH_MODE_API_KEY,
-  AUTH_MODE_JWT,
-  AUTH_MODE_SERVICE_ACCOUNT,
-  AUTH_MODE_SERVICE_TOKEN,
+  AuthMode,
   MEMBER,
   PERMISSION_READ_SECRETS,
   PERMISSION_WRITE_SECRETS,
@@ -24,10 +21,10 @@ import {
 } from "../../variables";
 import { BatchSecretRequest } from "../../types/secret";
 
-router.post(
+router.post( // TODO endpoint: strongly consider deprecation in favor of a single operation experience on dashboard
   "/batch",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY, AUTH_MODE_SERVICE_TOKEN]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN]
   }),
   requireWorkspaceAuth({
     acceptedRoles: [ADMIN, MEMBER],
@@ -59,7 +56,7 @@ router.post(
   secretsController.batchSecrets
 );
 
-router.post(
+router.post( // TODO endpoint: deprecate (moved to POST api/v3/secrets)
   "/",
   body("workspaceId").exists().isString().trim(),
   body("environment").exists().isString().trim(),
@@ -109,7 +106,7 @@ router.post(
     }),
   validateRequest,
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY, AUTH_MODE_SERVICE_TOKEN]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN]
   }),
   requireWorkspaceAuth({
     acceptedRoles: [ADMIN, MEMBER],
@@ -120,7 +117,7 @@ router.post(
   secretsController.createSecrets
 );
 
-router.get(
+router.get( // TODO endpoint: deprecate (moved to GET api/v3/secrets)
   "/",
   query("workspaceId").exists().trim(),
   query("environment").exists().trim(),
@@ -130,12 +127,7 @@ router.get(
   query("include_imports").optional().default(false).isBoolean(),
   validateRequest,
   requireAuth({
-    acceptedAuthModes: [
-      AUTH_MODE_JWT,
-      AUTH_MODE_API_KEY,
-      AUTH_MODE_SERVICE_TOKEN,
-      AUTH_MODE_SERVICE_ACCOUNT
-    ]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN]
   }),
   requireWorkspaceAuth({
     acceptedRoles: [ADMIN, MEMBER],
@@ -146,7 +138,7 @@ router.get(
   secretsController.getSecrets
 );
 
-router.patch(
+router.patch( // TODO endpoint: deprecate (moved to PATCH api/v3/secrets)
   "/",
   body("secrets")
     .exists()
@@ -172,7 +164,7 @@ router.patch(
     }),
   validateRequest,
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY, AUTH_MODE_SERVICE_TOKEN]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN]
   }),
   requireSecretsAuth({
     acceptedRoles: [ADMIN, MEMBER],
@@ -181,7 +173,7 @@ router.patch(
   secretsController.updateSecrets
 );
 
-router.delete(
+router.delete( // TODO endpoint: deprecate (moved to DELETE api/v3/secrets)
   "/",
   body("secretIds")
     .exists()
@@ -201,7 +193,7 @@ router.delete(
     .isEmpty(),
   validateRequest,
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY, AUTH_MODE_SERVICE_TOKEN]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN]
   }),
   requireSecretsAuth({
     acceptedRoles: [ADMIN, MEMBER],

backend/src/routes/v2/serviceAccounts.ts

@@ -1,159 +1,161 @@
 import express from "express";
 const router = express.Router();
-import {
-    requireAuth,
-    requireOrganizationAuth,
-    requireServiceAccountAuth,
-    requireServiceAccountWorkspacePermissionAuth,
-    requireWorkspaceAuth,
-    validateRequest,
-} from "../../middleware";
-import { body, param, query } from "express-validator";
-import {
-    ACCEPTED,
-    ADMIN,
-    AUTH_MODE_JWT,
-    AUTH_MODE_SERVICE_ACCOUNT,
-    MEMBER,
-    OWNER,
-} from "../../variables";
-import { serviceAccountsController } from "../../controllers/v2";
 
-router.get( // TODO: check
-    "/me",
-    requireAuth({
-        acceptedAuthModes: [AUTH_MODE_SERVICE_ACCOUNT],
-    }),
-    serviceAccountsController.getCurrentServiceAccount
-);
+// TODO endpoint: deprecate all
 
-router.get(
-    "/:serviceAccountId",
-    param("serviceAccountId").exists().isString().trim(),
-    requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
-    }),
-    requireServiceAccountAuth({
-        acceptedRoles: [OWNER, ADMIN],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    serviceAccountsController.getServiceAccountById
-);
+// import {
+//     requireAuth,
+//     requireOrganizationAuth,
+//     requireServiceAccountAuth,
+//     requireServiceAccountWorkspacePermissionAuth,
+//     requireWorkspaceAuth,
+//     validateRequest,
+// } from "../../middleware";
+// import { body, param, query } from "express-validator";
+// import {
+//     ACCEPTED,
+//     ADMIN,
+//     MEMBER,
+//     OWNER,
+//     AuthMode
+// } from "../../variables";
+// import { serviceAccountsController } from "../../controllers/v2";
 
-router.post(
-    "/",
-    body("organizationId").exists().isString().trim(),
-    body("name").exists().isString().trim(),
-    body("publicKey").exists().isString().trim(),
-    body("expiresIn").isNumeric(), // measured in ms
-    validateRequest,
-    requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
-    }),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-        locationOrganizationId: "body",
-    }),
-    serviceAccountsController.createServiceAccount
-);
+// router.get( // TODO: check
+//     "/me",
+//     requireAuth({
+//         acceptedAuthModes: [AUTH_MODE_SERVICE_ACCOUNT],
+//     }),
+//     serviceAccountsController.getCurrentServiceAccount
+// );
 
-router.patch(
-    "/:serviceAccountId/name",
-    param("serviceAccountId").exists().isString().trim(),
-    validateRequest,
-    requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
-    }),
-    requireServiceAccountAuth({
-        acceptedRoles: [OWNER, ADMIN],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    serviceAccountsController.changeServiceAccountName
-);
+// router.get(
+//     "/:serviceAccountId",
+//     param("serviceAccountId").exists().isString().trim(),
+//     requireAuth({
+//         acceptedAuthModes: [AUTH_MODE_JWT],
+//     }),
+//     requireServiceAccountAuth({
+//         acceptedRoles: [OWNER, ADMIN],
+//         acceptedStatuses: [ACCEPTED],
+//     }),
+//     serviceAccountsController.getServiceAccountById
+// );
 
-router.delete(
-    "/:serviceAccountId",
-    param("serviceAccountId").exists().isString().trim(),
-    validateRequest,
-    requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
-    }),
-    requireServiceAccountAuth({
-        acceptedRoles: [OWNER, ADMIN],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    serviceAccountsController.deleteServiceAccount
-);
+// router.post(
+//     "/",
+//     body("organizationId").exists().isString().trim(),
+//     body("name").exists().isString().trim(),
+//     body("publicKey").exists().isString().trim(),
+//     body("expiresIn").isNumeric(), // measured in ms
+//     validateRequest,
+//     requireAuth({
+//         acceptedAuthModes: [AUTH_MODE_JWT],
+//     }),
+//     requireOrganizationAuth({
+//         acceptedRoles: [OWNER, ADMIN, MEMBER],
+//         acceptedStatuses: [ACCEPTED],
+//         locationOrganizationId: "body",
+//     }),
+//     serviceAccountsController.createServiceAccount
+// );
 
-router.get(
-    "/:serviceAccountId/permissions/workspace",
-    param("serviceAccountId").exists().isString().trim(),
-    validateRequest,
-    requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
-    }),
-    requireServiceAccountAuth({
-        acceptedRoles: [OWNER, ADMIN],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    serviceAccountsController.getServiceAccountWorkspacePermissions
-);
+// router.patch(
+//     "/:serviceAccountId/name",
+//     param("serviceAccountId").exists().isString().trim(),
+//     validateRequest,
+//     requireAuth({
+//         acceptedAuthModes: [AUTH_MODE_JWT],
+//     }),
+//     requireServiceAccountAuth({
+//         acceptedRoles: [OWNER, ADMIN],
+//         acceptedStatuses: [ACCEPTED],
+//     }),
+//     serviceAccountsController.changeServiceAccountName
+// );
 
-router.post(
-    "/:serviceAccountId/permissions/workspace",
-    param("serviceAccountId").exists().isString().trim(),
-    body("workspaceId").exists().isString().notEmpty(),
-    body("environment").exists().isString().notEmpty(),
-    body("read").isBoolean().optional(),
-    body("write").isBoolean().optional(),
-    body("encryptedKey").exists().isString().notEmpty(),
-    body("nonce").exists().isString().notEmpty(),
-    validateRequest,
-    requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
-    }),
-    requireServiceAccountAuth({
-        acceptedRoles: [OWNER, ADMIN],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    requireWorkspaceAuth({
-        acceptedRoles: [ADMIN, MEMBER],
-        locationWorkspaceId: "body",
-    }),
-    serviceAccountsController.addServiceAccountWorkspacePermission 
-);
+// router.delete(
+//     "/:serviceAccountId",
+//     param("serviceAccountId").exists().isString().trim(),
+//     validateRequest,
+//     requireAuth({
+//         acceptedAuthModes: [AUTH_MODE_JWT],
+//     }),
+//     requireServiceAccountAuth({
+//         acceptedRoles: [OWNER, ADMIN],
+//         acceptedStatuses: [ACCEPTED],
+//     }),
+//     serviceAccountsController.deleteServiceAccount
+// );
 
-router.delete(
-    "/:serviceAccountId/permissions/workspace/:serviceAccountWorkspacePermissionId",
-    param("serviceAccountId").exists().isString().trim(),
-    param("serviceAccountWorkspacePermissionId").exists().isString().trim(),
-    validateRequest,
-    requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
-    }),
-    requireServiceAccountAuth({
-        acceptedRoles: [OWNER, ADMIN],
-        acceptedStatuses: [ACCEPTED],
-    }), 
-    requireServiceAccountWorkspacePermissionAuth({
-        acceptedRoles: [OWNER, ADMIN],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    serviceAccountsController.deleteServiceAccountWorkspacePermission
-);
+// router.get(
+//     "/:serviceAccountId/permissions/workspace",
+//     param("serviceAccountId").exists().isString().trim(),
+//     validateRequest,
+//     requireAuth({
+//         acceptedAuthModes: [AUTH_MODE_JWT],
+//     }),
+//     requireServiceAccountAuth({
+//         acceptedRoles: [OWNER, ADMIN],
+//         acceptedStatuses: [ACCEPTED],
+//     }),
+//     serviceAccountsController.getServiceAccountWorkspacePermissions
+// );
 
-router.get(
-    "/:serviceAccountId/keys",
-    query("workspaceId").optional().isString(),
-    requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_SERVICE_ACCOUNT],
-    }),
-    requireServiceAccountAuth({
-        acceptedRoles: [OWNER, ADMIN],
-        acceptedStatuses: [ACCEPTED],
-    }), 
-    serviceAccountsController.getServiceAccountKeys
-);
+// router.post(
+//     "/:serviceAccountId/permissions/workspace",
+//     param("serviceAccountId").exists().isString().trim(),
+//     body("workspaceId").exists().isString().notEmpty(),
+//     body("environment").exists().isString().notEmpty(),
+//     body("read").isBoolean().optional(),
+//     body("write").isBoolean().optional(),
+//     body("encryptedKey").exists().isString().notEmpty(),
+//     body("nonce").exists().isString().notEmpty(),
+//     validateRequest,
+//     requireAuth({
+//         acceptedAuthModes: [AUTH_MODE_JWT],
+//     }),
+//     requireServiceAccountAuth({
+//         acceptedRoles: [OWNER, ADMIN],
+//         acceptedStatuses: [ACCEPTED],
+//     }),
+//     requireWorkspaceAuth({
+//         acceptedRoles: [ADMIN, MEMBER],
+//         locationWorkspaceId: "body",
+//     }),
+//     serviceAccountsController.addServiceAccountWorkspacePermission 
+// );
+
+// router.delete(
+//     "/:serviceAccountId/permissions/workspace/:serviceAccountWorkspacePermissionId",
+//     param("serviceAccountId").exists().isString().trim(),
+//     param("serviceAccountWorkspacePermissionId").exists().isString().trim(),
+//     validateRequest,
+//     requireAuth({
+//         acceptedAuthModes: [AUTH_MODE_JWT],
+//     }),
+//     requireServiceAccountAuth({
+//         acceptedRoles: [OWNER, ADMIN],
+//         acceptedStatuses: [ACCEPTED],
+//     }), 
+//     requireServiceAccountWorkspacePermissionAuth({
+//         acceptedRoles: [OWNER, ADMIN],
+//         acceptedStatuses: [ACCEPTED],
+//     }),
+//     serviceAccountsController.deleteServiceAccountWorkspacePermission
+// );
+
+// router.get(
+//     "/:serviceAccountId/keys",
+//     query("workspaceId").optional().isString(),
+//     requireAuth({
+//         acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_SERVICE_ACCOUNT],
+//     }),
+//     requireServiceAccountAuth({
+//         acceptedRoles: [OWNER, ADMIN],
+//         acceptedStatuses: [ACCEPTED],
+//     }), 
+//     serviceAccountsController.getServiceAccountKeys
+// );
 
 export default router;

backend/src/routes/v2/serviceTokenData.ts

@@ -9,9 +9,7 @@ import {
 import { body, param } from "express-validator";
 import {
   ADMIN,
-  AUTH_MODE_JWT,
-  AUTH_MODE_SERVICE_ACCOUNT,
-  AUTH_MODE_SERVICE_TOKEN,
+  AuthMode,
   MEMBER,
   PERMISSION_WRITE_SECRETS
 } from "../../variables";
@@ -20,7 +18,7 @@ import { serviceTokenDataController } from "../../controllers/v2";
 router.get(
   "/",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_SERVICE_TOKEN]
+    acceptedAuthModes: [AuthMode.SERVICE_TOKEN]
   }),
   serviceTokenDataController.getServiceTokenData
 );
@@ -28,7 +26,7 @@ router.get(
 router.post(
   "/",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_SERVICE_ACCOUNT]
+    acceptedAuthModes: [AuthMode.JWT]
   }),
   requireWorkspaceAuth({
     acceptedRoles: [ADMIN, MEMBER],
@@ -63,7 +61,7 @@ router.post(
 router.delete(
   "/:serviceTokenDataId",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT]
+    acceptedAuthModes: [AuthMode.JWT]
   }),
   requireServiceTokenDataAuth({
     acceptedRoles: [ADMIN, MEMBER]

backend/src/routes/v2/signup.ts

@@ -6,7 +6,7 @@ import { signupController } from "../../controllers/v2";
 import { authLimiter } from "../../helpers/rateLimiter";
 
 router.post(
-    "/complete-account/signup",
+    "/complete-account/signup", // TODO endpoint: deprecate (moved to v3/signup/complete/account-signup)
     authLimiter,
     requireSignupAuth,
     body("email").exists().isString().trim().notEmpty().isEmail(),
@@ -27,7 +27,7 @@ router.post(
 );
 
 router.post(
-	"/complete-account/invite",
+	"/complete-account/invite", // TODO: consider moving to v3/users/new/complete-account/invite
 	authLimiter,
 	requireSignupAuth,
 	body("email").exists().isString().trim().notEmpty().isEmail(),

backend/src/routes/v2/tags.ts

@@ -9,14 +9,14 @@ import {
 } from "../../middleware";
 import { 
   ADMIN, 
-  AUTH_MODE_JWT,
-  MEMBER,
+  AuthMode,
+  MEMBER
 } from "../../variables";
 
 router.get(
   "/:workspaceId/tags",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT],
+    acceptedAuthModes: [AuthMode.JWT],
   }),
   requireWorkspaceAuth({
     acceptedRoles: [MEMBER, ADMIN],
@@ -30,7 +30,7 @@ router.get(
 router.delete(
   "/tags/:tagId",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT],
+    acceptedAuthModes: [AuthMode.JWT],
   }),
   param("tagId").exists().trim(),
   validateRequest,
@@ -40,7 +40,7 @@ router.delete(
 router.post(
   "/:workspaceId/tags",
   requireAuth({
-    acceptedAuthModes: [AUTH_MODE_JWT],
+    acceptedAuthModes: [AuthMode.JWT],
   }),
   requireWorkspaceAuth({
     acceptedRoles: [MEMBER, ADMIN],

backend/src/routes/v2/users.ts

@@ -6,10 +6,7 @@ import {
 } from "../../middleware";
 import { body, param } from "express-validator";
 import { usersController } from "../../controllers/v2";
-import {
-    AUTH_MODE_API_KEY,
-    AUTH_MODE_JWT,
-} from "../../variables";
+import { AuthMode } from "../../variables";
 import {
     AuthProvider
 } from "../../models";
@@ -17,7 +14,7 @@ import {
 router.get(
     "/me",
     requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY],
+        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
     }),
     usersController.getMe
 );
@@ -25,7 +22,7 @@ router.get(
 router.patch(
     "/me/mfa",
     requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY],
+        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
     }),
     body("isMfaEnabled").exists().isBoolean(),
     validateRequest,
@@ -35,7 +32,7 @@ router.patch(
 router.patch(
     "/me/name",
     requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY],
+        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
     }),
     body("firstName").exists().isString(),
     body("lastName").isString(),
@@ -46,7 +43,7 @@ router.patch(
 router.patch(
     "/me/auth-provider",
     requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY],
+        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
     }),
     body("authProvider").exists().isString().isIn([
         AuthProvider.EMAIL,
@@ -78,7 +75,7 @@ router.put(
 router.get(
     "/me/organizations",
     requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY],
+        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
     }),
     usersController.getMyOrganizations
 );
@@ -86,7 +83,7 @@ router.get(
 router.get(
     "/me/api-keys",
     requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
+        acceptedAuthModes: [AuthMode.JWT]
     }),
     usersController.getMyAPIKeys
 );
@@ -94,7 +91,7 @@ router.get(
 router.post(
     "/me/api-keys",
     requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
+        acceptedAuthModes: [AuthMode.JWT]
     }),
     body("name").exists().isString().trim(),
     body("expiresIn").isNumeric(),
@@ -105,7 +102,7 @@ router.post(
 router.delete(
     "/me/api-keys/:apiKeyDataId",
     requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
+        acceptedAuthModes: [AuthMode.JWT]
     }),
     param("apiKeyDataId").exists().trim(),
     validateRequest,
@@ -115,7 +112,7 @@ router.delete(
 router.get(
     "/me/sessions",
     requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
+        acceptedAuthModes: [AuthMode.JWT]
     }), 
     usersController.getMySessions
 );
@@ -123,7 +120,7 @@ router.get(
 router.delete(
     "/me/sessions",
     requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
+        acceptedAuthModes: [AuthMode.JWT]
     }), 
     usersController.deleteMySessions
 );

backend/src/routes/v2/workspace.ts

@@ -9,17 +9,15 @@ import {
 } from "../../middleware";
 import {
 	ADMIN, 
-	AUTH_MODE_API_KEY,
-	AUTH_MODE_JWT,
-	AUTH_MODE_SERVICE_TOKEN,
-	MEMBER,
+	AuthMode,
+	MEMBER
 } from "../../variables";
 import { workspaceController } from "../../controllers/v2";
 
-router.post(
+router.post( // TODO endpoint: deprecate (moved to POST v3/secrets)
 	"/:workspaceId/secrets",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -34,10 +32,10 @@ router.post(
 	workspaceController.pushWorkspaceSecrets
 );
 
-router.get(
+router.get( // TODO endpoint: deprecate (moved to GET v3/secrets)
 	"/:workspaceId/secrets",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_SERVICE_TOKEN],
+		acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN],
 	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -50,10 +48,10 @@ router.get(
 	workspaceController.pullSecrets
 );
 
-router.get(
+router.get( // TODO endpoint: consider moving to v3/users/me/workspaces/:workspaceId/key
 	"/:workspaceId/encrypted-key",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY],
+		acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
 	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -67,7 +65,7 @@ router.get(
 router.get(
 	"/:workspaceId/service-token-data",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT],
 	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -83,7 +81,7 @@ router.get( // new - TODO: rewire dashboard to this route
 	param("workspaceId").exists().trim(),
 	validateRequest,
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY],
+		acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
 	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
@@ -99,7 +97,7 @@ router.patch( // TODO - rewire dashboard to this route
 	body("role").exists().isString().trim().isIn([ADMIN, MEMBER]),
 	validateRequest,
 	requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY],
+        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
     }),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN],
@@ -118,7 +116,7 @@ router.delete( // TODO - rewire dashboard to this route
 	param("membershipId").exists().trim(),
 	validateRequest,
 	requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY],
+        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
     }),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN],
@@ -134,7 +132,7 @@ router.delete( // TODO - rewire dashboard to this route
 router.patch(
 	"/:workspaceId/auto-capitalization",
 	requireAuth({
-		acceptedAuthModes: [AUTH_MODE_JWT],
+		acceptedAuthModes: [AuthMode.JWT]
 	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],

backend/src/routes/v3/secrets.ts

@@ -5,10 +5,7 @@ import { body, param, query } from "express-validator";
 import { secretsController } from "../../controllers/v3";
 import {
   ADMIN,
-  AUTH_MODE_API_KEY,
-  AUTH_MODE_JWT,
-  AUTH_MODE_SERVICE_ACCOUNT,
-  AUTH_MODE_SERVICE_TOKEN,
+  AuthMode,
   MEMBER,
   PERMISSION_READ_SECRETS,
   PERMISSION_WRITE_SECRETS,
@@ -25,10 +22,9 @@ router.get(
   validateRequest,
   requireAuth({
     acceptedAuthModes: [
-      AUTH_MODE_JWT,
-      AUTH_MODE_API_KEY,
-      AUTH_MODE_SERVICE_TOKEN,
-      AUTH_MODE_SERVICE_ACCOUNT
+      AuthMode.JWT,
+      AuthMode.API_KEY,
+      AuthMode.SERVICE_TOKEN
     ]
   }),
   secretsController.getSecretsRaw
@@ -44,10 +40,9 @@ router.get(
   validateRequest,
   requireAuth({
     acceptedAuthModes: [
-      AUTH_MODE_JWT,
-      AUTH_MODE_API_KEY,
-      AUTH_MODE_SERVICE_TOKEN,
-      AUTH_MODE_SERVICE_ACCOUNT
+      AuthMode.JWT,
+      AuthMode.API_KEY,
+      AuthMode.SERVICE_TOKEN
     ]
   }),
   requireWorkspaceAuth({
@@ -73,10 +68,9 @@ router.post(
   validateRequest,
   requireAuth({
     acceptedAuthModes: [
-      AUTH_MODE_JWT,
-      AUTH_MODE_API_KEY,
-      AUTH_MODE_SERVICE_TOKEN,
-      AUTH_MODE_SERVICE_ACCOUNT
+      AuthMode.JWT,
+      AuthMode.API_KEY,
+      AuthMode.SERVICE_TOKEN
     ]
   }),
   requireWorkspaceAuth({
@@ -102,10 +96,9 @@ router.patch(
   validateRequest,
   requireAuth({
     acceptedAuthModes: [
-      AUTH_MODE_JWT,
-      AUTH_MODE_API_KEY,
-      AUTH_MODE_SERVICE_TOKEN,
-      AUTH_MODE_SERVICE_ACCOUNT
+      AuthMode.JWT,
+      AuthMode.API_KEY,
+      AuthMode.SERVICE_TOKEN
     ]
   }),
   requireWorkspaceAuth({
@@ -130,10 +123,9 @@ router.delete(
   validateRequest,
   requireAuth({
     acceptedAuthModes: [
-      AUTH_MODE_JWT,
-      AUTH_MODE_API_KEY,
-      AUTH_MODE_SERVICE_TOKEN,
-      AUTH_MODE_SERVICE_ACCOUNT
+      AuthMode.JWT,
+      AuthMode.API_KEY,
+      AuthMode.SERVICE_TOKEN
     ]
   }),
   requireWorkspaceAuth({
@@ -156,10 +148,9 @@ router.get(
   validateRequest,
   requireAuth({
     acceptedAuthModes: [
-      AUTH_MODE_JWT,
-      AUTH_MODE_API_KEY,
-      AUTH_MODE_SERVICE_TOKEN,
-      AUTH_MODE_SERVICE_ACCOUNT
+      AuthMode.JWT,
+      AuthMode.API_KEY,
+      AuthMode.SERVICE_TOKEN
     ]
   }),
   requireWorkspaceAuth({
@@ -192,10 +183,9 @@ router.post(
   validateRequest,
   requireAuth({
     acceptedAuthModes: [
-      AUTH_MODE_JWT,
-      AUTH_MODE_API_KEY,
-      AUTH_MODE_SERVICE_TOKEN,
-      AUTH_MODE_SERVICE_ACCOUNT
+      AuthMode.JWT,
+      AuthMode.API_KEY,
+      AuthMode.SERVICE_TOKEN
     ]
   }),
   requireWorkspaceAuth({
@@ -220,10 +210,9 @@ router.get(
   validateRequest,
   requireAuth({
     acceptedAuthModes: [
-      AUTH_MODE_JWT,
-      AUTH_MODE_API_KEY,
-      AUTH_MODE_SERVICE_TOKEN,
-      AUTH_MODE_SERVICE_ACCOUNT
+      AuthMode.JWT,
+      AuthMode.API_KEY,
+      AuthMode.SERVICE_TOKEN
     ]
   }),
   requireWorkspaceAuth({
@@ -250,10 +239,9 @@ router.patch(
   validateRequest,
   requireAuth({
     acceptedAuthModes: [
-      AUTH_MODE_JWT,
-      AUTH_MODE_API_KEY,
-      AUTH_MODE_SERVICE_TOKEN,
-      AUTH_MODE_SERVICE_ACCOUNT
+      AuthMode.JWT,
+      AuthMode.API_KEY,
+      AuthMode.SERVICE_TOKEN
     ]
   }),
   requireWorkspaceAuth({
@@ -278,10 +266,9 @@ router.delete(
   validateRequest,
   requireAuth({
     acceptedAuthModes: [
-      AUTH_MODE_JWT,
-      AUTH_MODE_API_KEY,
-      AUTH_MODE_SERVICE_TOKEN,
-      AUTH_MODE_SERVICE_ACCOUNT
+      AuthMode.JWT,
+      AuthMode.API_KEY,
+      AuthMode.SERVICE_TOKEN
     ]
   }),
   requireWorkspaceAuth({

backend/src/routes/v3/signup.ts

@@ -6,7 +6,7 @@ import { authLimiter } from "../../helpers/rateLimiter";
 import { validateRequest } from "../../middleware";
 
 router.post(
-    "/complete-account/signup",
+    "/complete-account/signup", // TODO: consider moving endpoint to v3/users/new/complete-account/signup
     authLimiter,
     body("email").exists().isString().trim().notEmpty().isEmail(),
 	body("firstName").exists().isString().trim().notEmpty(),

backend/src/routes/v3/workspaces.ts

@@ -8,7 +8,7 @@ import {
 import { workspacesController } from "../../controllers/v3";
 import {
     ADMIN,
-    AUTH_MODE_JWT,
+    AuthMode
 } from "../../variables";
 import { body, param } from "express-validator";
 
@@ -19,7 +19,7 @@ router.get(
     param("workspaceId").exists().isString().trim(),
     validateRequest,
     requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
+        acceptedAuthModes: [AuthMode.JWT],
     }),
     requireWorkspaceAuth({
         acceptedRoles: [ADMIN],
@@ -33,7 +33,7 @@ router.get( // allow admins to get all workspace secrets (part of blind indices
     param("workspaceId").exists().isString().trim(),
     validateRequest,
     requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
+        acceptedAuthModes: [AuthMode.JWT],
     }),
     requireWorkspaceAuth({
         acceptedRoles: [ADMIN],
@@ -65,7 +65,7 @@ router.post( // allow admins to name all workspace secrets (part of blind indice
         .withMessage("secretId must be a string"),
     validateRequest,
     requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT],
+        acceptedAuthModes: [AuthMode.JWT],
     }),
     requireWorkspaceAuth({
         acceptedRoles: [ADMIN],