Add requireSecretAuth middleware

backend/src/middleware/index.ts

@@ -6,6 +6,7 @@ import requireOrganizationAuth from './requireOrganizationAuth';
 import requireIntegrationAuth from './requireIntegrationAuth';
 import requireIntegrationAuthorizationAuth from './requireIntegrationAuthorizationAuth';
 import requireServiceTokenAuth from './requireServiceTokenAuth';
+import requireSecretAuth from './requireSecretAuth';
 import validateRequest from './validateRequest';
 
 export {
@@ -17,5 +18,6 @@ export {
 	requireIntegrationAuth,
 	requireIntegrationAuthorizationAuth,
 	requireServiceTokenAuth,
+	requireSecretAuth,
 	validateRequest
 };

backend/src/middleware/requireBotAuth.ts

@@ -15,7 +15,7 @@ const requireBotAuth = ({
     location?: req;
 }) => {
     return async (req: Request, res: Response, next: NextFunction) => {
-        const bot = await Bot.findOne({ _id: req[location].botId });
+        const bot = await Bot.findById(req[location].botId);
         
         if (!bot) {
             return next(AccountNotFoundError({message: 'Failed to locate Bot account'}))

backend/src/middleware/requireSecretAuth.ts

@@ -0,0 +1,50 @@
+import { Request, Response, NextFunction } from 'express';
+import { UnauthorizedRequestError, SecretNotFoundError } from '../utils/errors';
+import { Secret } from '../models';
+import {
+    validateMembership
+} from '../helpers/membership';
+
+/**
+ * Validate if user on request has proper membership to modify secret.
+ * @param {Object} obj
+ * @param {String[]} obj.acceptedRoles - accepted workspace roles
+ * @param {String[]} obj.acceptedStatuses - accepted workspace statuses
+ * @param {String[]} obj.location - location of [workspaceId] on request (e.g. params, body) for parsing
+ */
+const requireSecretAuth = ({
+    acceptedRoles,
+    acceptedStatuses
+}: {
+    acceptedRoles: string[];
+    acceptedStatuses: string[];
+}) => {
+    return async (req: Request, res: Response, next: NextFunction) => {
+        try {
+            const { secretId } = req.params;
+            
+            const secret = await Secret.findById(secretId);
+            
+            if (!secret) {
+                return next(SecretNotFoundError({
+                    message: 'Failed to find secret'
+                }));
+            }
+            
+            await validateMembership({
+                userId: req.user._id.toString(),
+                workspaceId: secret.workspace.toString(),
+                acceptedRoles,
+                acceptedStatuses
+            });
+            
+            req.secret = secret as any;
+
+            next();
+        } catch (err) {
+            return next(UnauthorizedRequestError({ message: 'Unable to authenticate secret' }));
+        }
+    }
+}
+
+export default requireSecretAuth;