Split requireBlindIndicesEnabled, E2EEOff, requireIPAllowlistCheck away from requireWorkspaceAuth

backend/src/middleware/index.ts

@@ -14,6 +14,9 @@ import requireServiceAccountAuth from "./requireServiceAccountAuth";
 import requireServiceAccountWorkspacePermissionAuth from "./requireServiceAccountWorkspacePermissionAuth";
 import requireSecretAuth from "./requireSecretAuth";
 import requireSecretsAuth from "./requireSecretsAuth";
+import requireBlindIndicesEnabled from "./requireBlindIndicesEnabled";
+import requireE2EEOff from "./requireE2EEOff";
+import requireIPAllowlistCheck from "./requireIPAllowlistCheck";
 import validateRequest from "./validateRequest";
 
 export {
@@ -33,5 +36,8 @@ export {
 	requireServiceAccountWorkspacePermissionAuth,
 	requireSecretAuth,
 	requireSecretsAuth,
+	requireBlindIndicesEnabled,
+	requireE2EEOff,
+	requireIPAllowlistCheck,
 	validateRequest,
 };

backend/src/middleware/requireBlindIndicesEnabled.ts

@@ -0,0 +1,34 @@
+import { NextFunction, Request, Response } from "express";
+import { Types } from "mongoose";
+import { SecretBlindIndexData } from "../models";
+import { UnauthorizedRequestError } from "../utils/errors";
+
+type req = "params" | "body" | "query";
+
+/**
+ * Validate if workspace with [workspaceId] has blind indices enabled
+ * @param {Object} obj
+ * @param {String} obj.locationWorkspaceId - location of [workspaceId] on request (e.g. params, body) for parsing
+ * @returns 
+ */
+const requireBlindIndicesEnabled = ({
+    locationWorkspaceId
+}: {
+    locationWorkspaceId: req;
+}) => {
+    return async (req: Request, res: Response, next: NextFunction) => {
+		const workspaceId = req[locationWorkspaceId]?.workspaceId;
+
+        const secretBlindIndexData = await SecretBlindIndexData.exists({
+            workspace: new Types.ObjectId(workspaceId)
+        });
+
+        if (!secretBlindIndexData) throw UnauthorizedRequestError({
+            message: "Failed workspace authorization due to blind indices not being enabled"
+        });
+        
+        return next();
+    }
+}
+
+export default requireBlindIndicesEnabled;

backend/src/middleware/requireE2EEOff.ts

@@ -0,0 +1,31 @@
+import { NextFunction, Request, Response } from "express";
+import { BadRequestError } from "../utils/errors";
+import { BotService } from "../services";
+
+type req = "params" | "body" | "query";
+
+/**
+ * Validate if workspace with [workspaceId] has E2EE off/disabled
+ * @param {Object} obj
+ * @param {String} obj.locationWorkspaceId - location of [workspaceId] on request (e.g. params, body) for parsing
+ * @returns 
+ */
+const requireE2EEOff = ({
+    locationWorkspaceId
+}: {
+    locationWorkspaceId: req;
+}) => {
+    return async (req: Request, _: Response, next: NextFunction) => {
+		const workspaceId = req[locationWorkspaceId]?.workspaceId;
+
+        const isWorkspaceE2EE = await BotService.getIsWorkspaceE2EE(workspaceId);
+
+        if (isWorkspaceE2EE) throw BadRequestError({
+            message: "Failed workspace authorization due to end-to-end encryption not being disabled"
+        });
+        
+        return next();
+    }
+}
+
+export default requireE2EEOff;

backend/src/middleware/requireIPAllowlistCheck.ts

@@ -0,0 +1,55 @@
+import net from "net";
+import { NextFunction, Request, Response } from "express";
+import { UnauthorizedRequestError } from "../utils/errors";
+import { extractIPDetails } from "../utils/ip";
+import { ActorType, TrustedIP } from "../ee/models";
+
+type req = "params" | "body" | "query";
+
+/**
+ * Validate if workspace with [workspaceId] has E2EE off/disabled
+ * @param {Object} obj
+ * @param {String} obj.locationWorkspaceId - location of [workspaceId] on request (e.g. params, body) for parsing
+ * @returns 
+ */
+const requireIPAllowlistCheck = ({
+    locationWorkspaceId
+}: {
+    locationWorkspaceId: req;
+}) => {
+    return async (req: Request, _: Response, next: NextFunction) => {
+		const workspaceId = req[locationWorkspaceId]?.workspaceId;
+        
+        if (req.authData.actor.type === ActorType.SERVICE) {
+            const trustedIps = await TrustedIP.find({
+                workspace: workspaceId
+            });
+
+            if (trustedIps.length > 0) {
+            // case: check the IP address of the inbound request against trusted IPs
+
+            const blockList = new net.BlockList();
+
+            for (const trustedIp of trustedIps) {
+                if (trustedIp.prefix !== undefined) {
+                    blockList.addSubnet(trustedIp.ipAddress, trustedIp.prefix, trustedIp.type);
+                } else {
+                    blockList.addAddress(trustedIp.ipAddress, trustedIp.type);
+                }
+            }
+
+            const { type } = extractIPDetails(req.authData.ipAddress);
+            const check = blockList.check(req.authData.ipAddress, type);
+
+            if (!check)
+                throw UnauthorizedRequestError({
+                    message: "Failed workspace authorization"
+                });
+            }
+        }
+        
+        return next();
+    }
+}
+
+export default requireIPAllowlistCheck;

backend/src/middleware/requireWorkspaceAuth.ts

@@ -9,24 +9,18 @@ type req = "params" | "body" | "query";
  * on request params.
  * @param {Object} obj
  * @param {String[]} obj.acceptedRoles - accepted workspace roles for JWT auth
- * @param {String[]} obj.location - location of [workspaceId] on request (e.g. params, body) for parsing
+ * @param {String} obj.locationWorkspaceId - location of [workspaceId] on request (e.g. params, body) for parsing
  */
 const requireWorkspaceAuth = ({
 	acceptedRoles,
 	locationWorkspaceId,
 	locationEnvironment = undefined,
 	requiredPermissions = [],
-	requireBlindIndicesEnabled = false,
-	requireE2EEOff = false,
-	checkIPAllowlist = false
 }: {
 	acceptedRoles: Array<"admin" | "member">;
 	locationWorkspaceId: req;
 	locationEnvironment?: req | undefined;
 	requiredPermissions?: string[];
-	requireBlindIndicesEnabled?: boolean;
-	requireE2EEOff?: boolean;
-	checkIPAllowlist?: boolean;
 }) => {
 	return async (req: Request, res: Response, next: NextFunction) => {
 		const workspaceId = req[locationWorkspaceId]?.workspaceId;
@@ -38,10 +32,7 @@ const requireWorkspaceAuth = ({
 			workspaceId: new Types.ObjectId(workspaceId),
 			environment,
 			acceptedRoles,
-			requiredPermissions,
-			requireBlindIndicesEnabled,
-			requireE2EEOff,
-			checkIPAllowlist
+			requiredPermissions
 		});
 		
 		if (membership) {