Continue developing service token v2

backend/src/routes/serviceTokenData.ts

@@ -1,144 +0,0 @@
-import express from 'express';
-const router = express.Router();
-import crypto from 'crypto';
-import bcrypt from 'bcrypt';
-import * as Sentry from '@sentry/node';
-import {
-    requireAuth,
-    requireWorkspaceAuth,
-    requireServiceTokenDataAuth,
-    validateRequest
-} from '../middleware';
-import {
-    ServiceTokenData
-} from '../models';
-import { param, body, query } from 'express-validator';
-import {
-    SALT_ROUNDS
-} from '../config';
-import {
-    ADMIN,
-    MEMBER,
-    COMPLETED,
-    GRANTED
-} from '../variables';
-
-// TODO: move logic into separate controller (probably after pull with latest routing)
-
-/**
- * 2 different concepts that we should distinguish between:
- * - API key (user) - allows user to perform queries and mutations on whatever
- * their account could access (better than JWT because it has ACL and scoping).
- * - Service token (bound to a workspace and environment).
- */
-
-/**
- * Service token flow?
- * 1. Post service token data details including project key encrypted under <symmetric_key> on cient-side.
- * 2. Construct <infisical_token> on client-side as <infisical_token>=<service_token>.<symmetric_key>
- * 3. Need for CLI to be able to get back service token details
- */
-
-router.post(
-    '/',
-    requireWorkspaceAuth({
-        acceptedRoles: [ADMIN, MEMBER],
-        acceptedStatuses: [COMPLETED, GRANTED],
-        location: 'body'
-    }),
-    requireAuth,
-    body('name').exists().trim(),
-    body('workspace'),
-    body('environment'),
-    body('encryptedKey'),
-    body('iv'),
-    body('tag'),
-    body('expiresAt'),
-    validateRequest,
-    async (req, res) => {
-        let serviceToken, serviceTokenData;
-        try {
-            const { 
-                name,
-                workspace, 
-                environment,
-                encryptedKey,
-                iv,
-                tag,
-                expiresAt
-            } = req.body;
-            
-            // create 38-char service token with first 6-char being the prefix
-            serviceToken = crypto.randomBytes(19).toString('hex');
-
-            const serviceTokenHash = await bcrypt.hash(serviceToken, SALT_ROUNDS);
-            
-            serviceTokenData = await new ServiceTokenData({
-                name,
-                workspace,
-                environment,
-                expiresAt,
-                prefix: serviceToken.substring(0, 6),
-                serviceTokenHash,
-                encryptedKey,
-                iv,
-                tag
-            }).save();
-            
-        } catch (err) {
-            Sentry.setUser({ email: req.user.email });
-            Sentry.captureException(err);
-            return res.status(400).send({
-                message: 'Failed to create service token data'
-            });
-        }
-
-        return res.status(200).send({
-            serviceToken,
-            serviceTokenData
-        });
-    }
-);
-
-// TODO: CLI has to get service token details without needing a JWT
-router.get(
-    '/:serviceTokenDataId',
-    requireAuth,
-    requireServiceTokenDataAuth,
-    param('serviceTokenDataId').exists().trim(),
-    validateRequest,
-    async (req, res) => {
-        return ({
-            serviceTokenData: req.serviceTokenData
-        });
-    }
-);
-
-router.delete(
-    '/:serviceTokenDataId',
-    requireAuth,
-    requireServiceTokenDataAuth,
-    param('serviceTokenDataId').exists().trim(),
-    validateRequest,
-    async (req, res) => {
-        let serviceTokenData;
-        try {
-            const { serviceTokenDataId } = req.params;
-
-            serviceTokenData = await ServiceTokenData.findByIdAndDelete(serviceTokenDataId);
-            
-        } catch (err) {
-            Sentry.setUser({ email: req.user.email });
-            Sentry.captureException(err);
-            return res.status(400).send({
-                message: 'Failed to delete service token data'
-            });
-        }
-        
-        return res.status(200).send({
-            serviceTokenData
-        });
-    }
-);
-
-export default router;

backend/src/routes/user.ts

@@ -1,8 +0,0 @@
-import express from 'express';
-const router = express.Router();
-import { requireAuth } from '../middleware';
-import { userController } from '../controllers';
-
-router.get('/', requireAuth, userController.getUser);
-
-export default router;

backend/src/routes/v1/auth.ts

@@ -1,9 +1,9 @@
 import express from 'express';
 const router = express.Router();
 import { body } from 'express-validator';
-import { requireAuth, validateRequest } from '../middleware';
-import { authController } from '../controllers';
-import { loginLimiter } from '../helpers/rateLimiter';
+import { requireAuth, validateRequest } from '../../middleware';
+import { authController } from '../../controllers/v1';
+import { loginLimiter } from '../../helpers/rateLimiter';
 
 router.post('/token', validateRequest, authController.getNewToken);
 
@@ -25,7 +25,19 @@ router.post(
   authController.login2
 );
 
-router.post('/logout', requireAuth, authController.logout);
-router.post('/checkAuth', requireAuth, authController.checkAuth);
+router.post(
+  '/logout', 
+  requireAuth({
+    acceptedAuthModes: ['jwt']
+  }), 
+  authController.logout
+);
+router.post(
+  '/checkAuth', 
+  requireAuth({
+    acceptedAuthModes: ['jwt']
+  }), 
+  authController.checkAuth
+);
 
 export default router;

backend/src/routes/v1/bot.ts

@@ -6,13 +6,15 @@ import {
     requireBotAuth,
     requireWorkspaceAuth,
     validateRequest
-} from '../middleware';
-import { botController } from '../controllers';
-import { ADMIN, MEMBER, COMPLETED, GRANTED } from '../variables';
+} from '../../middleware';
+import { botController } from '../../controllers/v1';
+import { ADMIN, MEMBER, COMPLETED, GRANTED } from '../../variables';
 
 router.get(
     '/:workspaceId',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [COMPLETED, GRANTED]
@@ -24,7 +26,9 @@ router.get(
 
 router.patch(
     '/:botId/active',
-    requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
     requireBotAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [COMPLETED, GRANTED]

backend/src/routes/v1/integration.ts

@@ -4,14 +4,16 @@ import {
 	requireAuth,
 	requireIntegrationAuth,
 	validateRequest
-} from '../middleware';
-import { ADMIN, MEMBER, GRANTED } from '../variables';
+} from '../../middleware';
+import { ADMIN, MEMBER, GRANTED } from '../../variables';
 import { body, param } from 'express-validator';
-import { integrationController } from '../controllers';
+import { integrationController } from '../../controllers/v1';
 
 router.patch(
 	'/:integrationId',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	requireIntegrationAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [GRANTED]
@@ -29,7 +31,9 @@ router.patch(
 
 router.delete(
 	'/:integrationId',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	requireIntegrationAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [GRANTED]

backend/src/routes/v1/integrationAuth.ts

@@ -6,19 +6,23 @@ import {
 	requireWorkspaceAuth,
 	requireIntegrationAuthorizationAuth,
 	validateRequest
-} from '../middleware';
-import { ADMIN, MEMBER, GRANTED } from '../variables';
-import { integrationAuthController } from '../controllers';
+} from '../../middleware';
+import { ADMIN, MEMBER, GRANTED } from '../../variables';
+import { integrationAuthController } from '../../controllers/v1';
 
 router.get(
 	'/integration-options',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	integrationAuthController.getIntegrationOptions
 );
 
 router.post(
 	'/oauth-token',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [GRANTED],
@@ -33,7 +37,9 @@ router.post(
 
 router.get(
 	'/:integrationAuthId/apps',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	requireIntegrationAuthorizationAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [GRANTED]
@@ -45,7 +51,9 @@ router.get(
 
 router.delete(
 	'/:integrationAuthId',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	requireIntegrationAuthorizationAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [GRANTED],

backend/src/routes/v1/inviteOrg.ts

@@ -1,12 +1,14 @@
 import express from 'express';
 const router = express.Router();
 import { body } from 'express-validator';
-import { requireAuth, validateRequest } from '../middleware';
-import { membershipOrgController } from '../controllers';
+import { requireAuth, validateRequest } from '../../middleware';
+import { membershipOrgController } from '../../controllers/v1';
 
 router.post(
 	'/signup',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	body('inviteeEmail').exists().trim().notEmpty().isEmail(),
 	body('organizationId').exists().trim().notEmpty(),
 	validateRequest,

backend/src/routes/v1/key.ts

@@ -4,14 +4,16 @@ import {
 	requireAuth,
 	requireWorkspaceAuth,
 	validateRequest
-} from '../middleware';
+} from '../../middleware';
 import { body, param } from 'express-validator';
-import { ADMIN, MEMBER, COMPLETED, GRANTED } from '../variables';
-import { keyController } from '../controllers';
+import { ADMIN, MEMBER, COMPLETED, GRANTED } from '../../variables';
+import { keyController } from '../../controllers/v1';
 
 router.post(
 	'/:workspaceId',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [COMPLETED, GRANTED]
@@ -24,7 +26,9 @@ router.post(
 
 router.get(
 	'/:workspaceId/latest',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [COMPLETED, GRANTED]

backend/src/routes/v1/membership.ts

@@ -1,12 +1,14 @@
 import express from 'express';
 const router = express.Router();
 import { body, param } from 'express-validator';
-import { requireAuth, validateRequest } from '../middleware';
-import { membershipController } from '../controllers';
+import { requireAuth, validateRequest } from '../../middleware';
+import { membershipController } from '../../controllers/v1';
 
 router.get( // used for CLI (deprecate)
 	'/:workspaceId/connect',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	param('workspaceId').exists().trim(),
 	validateRequest,
 	membershipController.validateMembership
@@ -14,7 +16,9 @@ router.get( // used for CLI (deprecate)
 
 router.delete(
 	'/:membershipId',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	param('membershipId').exists().trim(),
 	validateRequest,
 	membershipController.deleteMembership
@@ -22,7 +26,9 @@ router.delete(
 
 router.post(
 	'/:membershipId/change-role',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	body('role').exists().trim(),
 	validateRequest,
 	membershipController.changeMembershipRole

backend/src/routes/v1/membershipOrg.ts

@@ -1,13 +1,15 @@
 import express from 'express';
 const router = express.Router();
 import { param } from 'express-validator';
-import { requireAuth, validateRequest } from '../middleware';
-import { membershipOrgController } from '../controllers';
+import { requireAuth, validateRequest } from '../../middleware';
+import { membershipOrgController } from '../../controllers/v1';
 
 router.post(
 	// TODO
 	'/membershipOrg/:membershipOrgId/change-role',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	param('membershipOrgId'),
 	validateRequest,
 	membershipOrgController.changeMembershipOrgRole
@@ -15,7 +17,9 @@ router.post(
 
 router.delete(
 	'/:membershipOrgId',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	param('membershipOrgId').exists().trim(),
 	validateRequest,
 	membershipOrgController.deleteMembershipOrg

backend/src/routes/v1/organization.ts

@@ -5,19 +5,23 @@ import {
 	requireAuth,
 	requireOrganizationAuth,
 	validateRequest
-} from '../middleware';
-import { OWNER, ADMIN, MEMBER, ACCEPTED } from '../variables';
-import { organizationController } from '../controllers';
+} from '../../middleware';
+import { OWNER, ADMIN, MEMBER, ACCEPTED } from '../../variables';
+import { organizationController } from '../../controllers/v1';
 
 router.get(
 	'/',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	organizationController.getOrganizations
 );
 
 router.post( // not used on frontend
 	'/',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	body('organizationName').exists().trim().notEmpty(),
 	validateRequest,
 	organizationController.createOrganization
@@ -25,7 +29,9 @@ router.post( // not used on frontend
 
 router.get(
 	'/:organizationId',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
 		acceptedStatuses: [ACCEPTED]
@@ -37,7 +43,9 @@ router.get(
 
 router.get(
 	'/:organizationId/users',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
 		acceptedStatuses: [ACCEPTED]
@@ -49,7 +57,9 @@ router.get(
 
 router.get(
 	'/:organizationId/my-workspaces',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
 		acceptedStatuses: [ACCEPTED]
@@ -61,7 +71,9 @@ router.get(
 
 router.patch(
 	'/:organizationId/name',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
 		acceptedStatuses: [ACCEPTED]
@@ -74,7 +86,9 @@ router.patch(
 
 router.get(
 	'/:organizationId/incidentContactOrg',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
 		acceptedStatuses: [ACCEPTED]
@@ -86,7 +100,9 @@ router.get(
 
 router.post(
 	'/:organizationId/incidentContactOrg',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
 		acceptedStatuses: [ACCEPTED]
@@ -99,7 +115,9 @@ router.post(
 
 router.delete(
 	'/:organizationId/incidentContactOrg',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
 		acceptedStatuses: [ACCEPTED]
@@ -112,7 +130,9 @@ router.delete(
 
 router.post(
 	'/:organizationId/customer-portal-session',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
 		acceptedStatuses: [ACCEPTED]
@@ -124,7 +144,9 @@ router.post(
 
 router.get(
 	'/:organizationId/subscriptions',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
 		acceptedStatuses: [ACCEPTED]

backend/src/routes/v1/password.ts

@@ -1,13 +1,15 @@
 import express from 'express';
 const router = express.Router();
 import { body } from 'express-validator';
-import { requireAuth, requireSignupAuth, validateRequest } from '../middleware';
-import { passwordController } from '../controllers';
-import { passwordLimiter } from '../helpers/rateLimiter';
+import { requireAuth, requireSignupAuth, validateRequest } from '../../middleware';
+import { passwordController } from '../../controllers/v1';
+import { passwordLimiter } from '../../helpers/rateLimiter';
 
 router.post(
 	'/srp1',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	body('clientPublicKey').exists().trim().notEmpty(),
 	validateRequest,
 	passwordController.srp1
@@ -16,7 +18,9 @@ router.post(
 router.post(
 	'/change-password',
 	passwordLimiter,
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	body('clientProof').exists().trim().notEmpty(),
 	body('encryptedPrivateKey').exists().trim().notEmpty().notEmpty(), // private key encrypted under new pwd
 	body('iv').exists().trim().notEmpty(), // new iv for private key
@@ -54,7 +58,9 @@ router.get(
 router.post(
 	'/backup-private-key',
 	passwordLimiter,
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	body('clientProof').exists().trim().notEmpty(),
 	body('encryptedPrivateKey').exists().trim().notEmpty(), // (backup) private key encrypted under a strong key
 	body('iv').exists().trim().notEmpty(), // new iv for (backup) private key

backend/src/routes/v1/secret.ts

@@ -5,14 +5,16 @@ import {
 	requireWorkspaceAuth,
 	requireServiceTokenAuth,
 	validateRequest
-} from '../middleware';
+} from '../../middleware';
 import { body, query, param } from 'express-validator';
-import { secretController } from '../controllers';
-import { ADMIN, MEMBER, COMPLETED, GRANTED } from '../variables';
+import { secretController } from '../../controllers/v1';
+import { ADMIN, MEMBER, COMPLETED, GRANTED } from '../../variables';
 
 router.post(
 	'/:workspaceId',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [COMPLETED, GRANTED]
@@ -28,7 +30,9 @@ router.post(
 
 router.get(
 	'/:workspaceId',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [COMPLETED, GRANTED]

backend/src/routes/v1/serviceToken.ts

@@ -5,12 +5,12 @@ import {
 	requireWorkspaceAuth,
 	requireServiceTokenAuth,
 	validateRequest
-} from '../middleware';
+} from '../../middleware';
 import { body } from 'express-validator';
-import { ADMIN, MEMBER, GRANTED } from '../variables';
-import { serviceTokenController } from '../controllers';
+import { ADMIN, MEMBER, GRANTED } from '../../variables';
+import { serviceTokenController } from '../../controllers/v1';
 
-// Note to devs: service-token to be deprecated in favor of api-key
+// note: deprecate service-token routes in favor of service-token data routes/structure
 
 router.get(
 	'/',
@@ -20,7 +20,9 @@ router.get(
 
 router.post(
 	'/',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [GRANTED],

backend/src/routes/v1/serviceTokenData.ts

@@ -0,0 +1,63 @@
+import express, { Request, Response } from 'express';
+const router = express.Router();
+import {
+    requireAuth,
+    requireWorkspaceAuth,
+    requireServiceTokenDataAuth,
+    validateRequest
+} from '../../middleware';
+import { param, body } from 'express-validator';
+import {
+    ADMIN,
+    MEMBER,
+    COMPLETED,
+    GRANTED
+} from '../../variables';
+import { serviceTokenDataController } from '../../controllers/v1';
+
+router.get(
+    '/',
+    requireAuth({
+        acceptedAuthModes: ['st']
+    }),
+    param('serviceTokenDataId').exists().trim(),
+    validateRequest,
+    serviceTokenDataController.getServiceTokenData
+);
+
+router.post(
+    '/',
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
+    requireWorkspaceAuth({
+        acceptedRoles: [ADMIN, MEMBER],
+        acceptedStatuses: [COMPLETED, GRANTED],
+        location: 'body'
+    }),
+    body('name').exists().trim(),
+    body('workspaceId'),
+    body('environment'),
+    body('encryptedKey'),
+    body('iv'),
+    body('tag'),
+    body('expiresIn'), // measured in ms
+    validateRequest,
+    serviceTokenDataController.createServiceTokenData
+);
+
+router.delete(
+    '/:serviceTokenDataId',
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
+    requireServiceTokenDataAuth({
+        acceptedRoles: [ADMIN, MEMBER],
+        acceptedStatuses: [COMPLETED, GRANTED],
+    }),
+    param('serviceTokenDataId').exists().trim(),
+    validateRequest,
+    serviceTokenDataController.deleteServiceTokenData
+);
+
+export default router;

backend/src/routes/v1/signup.ts

@@ -1,9 +1,9 @@
 import express from 'express';
 const router = express.Router();
 import { body } from 'express-validator';
-import { requireSignupAuth, validateRequest } from '../middleware';
-import { signupController } from '../controllers';
-import { signupLimiter } from '../helpers/rateLimiter';
+import { requireSignupAuth, validateRequest } from '../../middleware';
+import { signupController } from '../../controllers/v1';
+import { signupLimiter } from '../../helpers/rateLimiter';
 
 router.post(
 	'/email/signup',

backend/src/routes/v1/stripe.ts

@@ -1,6 +1,6 @@
 import express from 'express';
 const router = express.Router();
-import { stripeController } from '../controllers';
+import { stripeController } from '../../controllers/v1';
 
 router.post('/webhook', stripeController.handleWebhook);
 

backend/src/routes/v1/user.ts

@@ -0,0 +1,14 @@
+import express from 'express';
+const router = express.Router();
+import { requireAuth } from '../../middleware';
+import { userController } from '../../controllers/v1';
+
+router.get(
+    '/', 
+    requireAuth({
+        acceptedAuthModes: ['jwt']
+    }), 
+    userController.getUser
+);
+
+export default router;

backend/src/routes/v1/userAction.ts

@@ -1,12 +1,14 @@
 import express from 'express';
 const router = express.Router();
-import { requireAuth, validateRequest } from '../middleware';
+import { requireAuth, validateRequest } from '../../middleware';
 import { body, query } from 'express-validator';
-import { userActionController } from '../controllers';
+import { userActionController } from '../../controllers/v1';
 
 router.post(
 	'/',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	body('action'),
 	validateRequest,
 	userActionController.addUserAction
@@ -14,7 +16,9 @@ router.post(
 
 router.get(
 	'/',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	query('action'),
 	validateRequest,
 	userActionController.getUserAction

backend/src/routes/v1/workspace.ts

@@ -5,13 +5,15 @@ import {
 	requireAuth,
 	requireWorkspaceAuth,
 	validateRequest
-} from '../middleware';
-import { ADMIN, MEMBER, COMPLETED, GRANTED } from '../variables';
-import { workspaceController, membershipController } from '../controllers';
+} from '../../middleware';
+import { ADMIN, MEMBER, COMPLETED, GRANTED } from '../../variables';
+import { workspaceController, membershipController } from '../../controllers/v1';
 
 router.get(
 	'/:workspaceId/keys',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [COMPLETED, GRANTED]
@@ -23,7 +25,9 @@ router.get(
 
 router.get(
 	'/:workspaceId/users',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [COMPLETED, GRANTED]
@@ -33,11 +37,19 @@ router.get(
 	workspaceController.getWorkspaceMemberships
 );
 
-router.get('/', requireAuth, workspaceController.getWorkspaces);
+router.get(
+	'/', 
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}), 
+	workspaceController.getWorkspaces
+);
 
 router.get(
 	'/:workspaceId',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [COMPLETED, GRANTED]
@@ -49,7 +61,9 @@ router.get(
 
 router.post(
 	'/',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	body('workspaceName').exists().trim().notEmpty(),
 	body('organizationId').exists().trim().notEmpty(),
 	validateRequest,
@@ -58,7 +72,9 @@ router.post(
 
 router.delete(
 	'/:workspaceId',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN],
 		acceptedStatuses: [GRANTED]
@@ -70,7 +86,9 @@ router.delete(
 
 router.post(
 	'/:workspaceId/name',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [COMPLETED, GRANTED]
@@ -83,7 +101,9 @@ router.post(
 
 router.post(
 	'/:workspaceId/invite-signup',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [GRANTED]
@@ -96,7 +116,9 @@ router.post(
 
 router.get(
 	'/:workspaceId/integrations',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [GRANTED]
@@ -108,7 +130,9 @@ router.get(
 
 router.get(
 	'/:workspaceId/authorizations',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [GRANTED]
@@ -120,7 +144,9 @@ router.get(
 
 router.get(
 	'/:workspaceId/service-tokens', // deprecate
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [GRANTED]
@@ -132,7 +158,9 @@ router.get(
 
 router.get(
 	'/:workspaceId/service-token-data',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [GRANTED]

backend/src/routes/v2/index.ts

@@ -0,0 +1,7 @@
+import secret from './secret';
+import workspace from './workspace';
+
+export {
+    secret,
+    workspace
+}

backend/src/routes/v2/secret.ts

@@ -0,0 +1,4 @@
+import express from 'express';
+const router = express.Router();
+
+export default router;

backend/src/routes/v2/workspace.ts

@@ -0,0 +1,62 @@
+import express from 'express';
+const router = express.Router();
+import { body, param, query } from 'express-validator';
+import {
+	requireAuth,
+	requireWorkspaceAuth,
+	requireServiceTokenAuth,
+	validateRequest
+} from '../../middleware';
+import { ADMIN, MEMBER, COMPLETED, GRANTED } from '../../variables';
+import { membershipController } from '../../controllers/v1';
+import { workspaceController } from '../../controllers/v2';
+
+router.post( // unfinished
+	'/:workspaceId/secrets',
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
+	requireWorkspaceAuth({
+		acceptedRoles: [ADMIN, MEMBER],
+		acceptedStatuses: [COMPLETED, GRANTED]
+	}),
+	body('secrets').exists(),
+	body('keys').exists(),
+	body('environment').exists().trim().notEmpty(),
+	body('channel'),
+	param('workspaceId').exists().trim(),
+	validateRequest,
+	workspaceController.pushWorkspaceSecrets
+);
+
+router.get( // unfinished, check that it works with st
+	'/:workspaceId/secrets',
+	requireAuth({
+		acceptedAuthModes: ['jwt', 'st']
+	}),
+	requireWorkspaceAuth({
+		acceptedRoles: [ADMIN, MEMBER],
+		acceptedStatuses: [COMPLETED, GRANTED]
+	}),
+	query('environment').exists().trim(),
+	query('channel'),
+	param('workspaceId').exists().trim(),
+	validateRequest,
+	workspaceController.pullSecrets
+);
+
+router.get(
+	'/:workspaceId/key',
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
+	requireWorkspaceAuth({
+		acceptedRoles: [ADMIN, MEMBER],
+		acceptedStatuses: [COMPLETED, GRANTED]
+	}),	
+	param('workspaceId').exists().trim(),
+	validateRequest,	
+	workspaceController.getWorkspaceKey
+);
+
+export default router;