Add paywall to ST V3 ip allowlisting

backend/src/controllers/v3/index.ts

@@ -2,12 +2,10 @@ import * as secretsController from "./secretsController";
 import * as workspacesController from "./workspacesController";
 import * as authController from "./authController";
 import * as signupController from "./signupController";
-import * as serviceTokenDataController from "./serviceTokenDataController";
 
 export {
     authController,
     secretsController,
     signupController,
-    workspacesController,
-    serviceTokenDataController
+    workspacesController
 }

backend/src/ee/controllers/v3/index.ts

@@ -0,0 +1,5 @@
+import * as serviceTokenDataController from "./serviceTokenDataController";
+
+export {
+    serviceTokenDataController 
+}

backend/src/ee/controllers/v3/serviceTokenDataController.ts

@@ -4,29 +4,30 @@ import {
     IServiceTokenDataV3,
     IUser,
     ServiceTokenDataV3,
-    ServiceTokenDataV3Key
-} from "../../models";
+    ServiceTokenDataV3Key,
+    Workspace
+} from "../../../models";
 import {
     IServiceTokenV3Scope, 
     IServiceTokenV3TrustedIp 
-} from "../../models/serviceTokenDataV3";
+} from "../../../models/serviceTokenDataV3";
 import {
     ActorType,
     EventType
-} from "../../ee/models";
-import { validateRequest } from "../../helpers/validation";
-import * as reqValidator from "../../validation/serviceTokenDataV3";
-import { createToken } from "../../helpers/auth";
+} from "../../models";
+import { validateRequest } from "../../../helpers/validation";
+import * as reqValidator from "../../../validation/serviceTokenDataV3";
+import { createToken } from "../../../helpers/auth";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
   getUserProjectPermissions
-} from "../../ee/services/ProjectRoleService";
+} from "../../services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability"; 
-import { BadRequestError, ResourceNotFoundError } from "../../utils/errors";
-import { extractIPDetails, isValidIpOrCidr } from "../../utils/ip";
-import { EEAuditLogService } from "../../ee/services";
-import { getJwtServiceTokenSecret } from "../../config";
+import { BadRequestError, ResourceNotFoundError } from "../../../utils/errors";
+import { extractIPDetails, isValidIpOrCidr } from "../../../utils/ip";
+import { EEAuditLogService, EELicenseService } from "../../services";
+import { getJwtServiceTokenSecret } from "../../../config";
 
 /**
  * Return project key for service token
@@ -80,8 +81,17 @@ export const createServiceTokenData = async (req: Request, res: Response) => {
         ProjectPermissionSub.ServiceTokens
     );
     
+    const workspace = await Workspace.findById(workspaceId);
+    if (!workspace) throw BadRequestError({ message: "Workspace not found" });
+
+    const plan = await EELicenseService.getPlan(workspace.organization);
+    
     // validate trusted ips
     const reformattedTrustedIps = trustedIps.map((trustedIp) => {
+        if (!plan.ipAllowlisting && trustedIp.ipAddress !== "0.0.0.0/0") return res.status(400).send({
+            message: "Failed to add IP access range to service token due to plan restriction. Upgrade plan to add IP access range."
+        });
+
         const isValidIPOrCidr = isValidIpOrCidr(trustedIp.ipAddress);
         
         if (!isValidIPOrCidr) return res.status(400).send({
@@ -173,7 +183,6 @@ export const updateServiceTokenData = async (req: Request, res: Response) => {
     } = await validateRequest(reqValidator.UpdateServiceTokenV3, req);
 
     let serviceTokenData = await ServiceTokenDataV3.findById(serviceTokenDataId);
-
     if (!serviceTokenData) throw ResourceNotFoundError({ 
         message: "Service token not found" 
     });
@@ -188,10 +197,19 @@ export const updateServiceTokenData = async (req: Request, res: Response) => {
         ProjectPermissionSub.ServiceTokens
     );
 
+    const workspace = await Workspace.findById(serviceTokenData.workspace);
+    if (!workspace) throw BadRequestError({ message: "Workspace not found" });
+
+    const plan = await EELicenseService.getPlan(workspace.organization);
+
     // validate trusted ips
     let reformattedTrustedIps;
     if (trustedIps) {
         reformattedTrustedIps = trustedIps.map((trustedIp) => {
+            if (!plan.ipAllowlisting && trustedIp.ipAddress !== "0.0.0.0/0") return res.status(400).send({
+                message: "Failed to update IP access range to service token due to plan restriction. Upgrade plan to update IP access range."
+            });
+
             const isValidIPOrCidr = isValidIpOrCidr(trustedIp.ipAddress);
             
             if (!isValidIPOrCidr) return res.status(400).send({

backend/src/ee/routes/v3/index.ts

@@ -0,0 +1,5 @@
+import serviceTokenData from "./serviceTokenData";
+
+export {
+    serviceTokenData
+}

backend/src/ee/routes/v3/serviceTokenData.ts

@@ -1,7 +1,7 @@
 import express from "express";
 const router = express.Router();
-import { requireAuth } from "../../middleware";
-import { AuthMode } from "../../variables";
+import { requireAuth } from "../../../middleware";
+import { AuthMode } from "../../../variables";
 import { serviceTokenDataController } from "../../controllers/v3";
 
 router.get(

backend/src/index.ts

@@ -27,6 +27,9 @@ import {
   roles as v1RoleRouter,
   secretScanning as v1SecretScanningRouter
 } from "./ee/routes/v1";
+import {
+  serviceTokenData as v3ServiceTokenDataRouter
+} from "./ee/routes/v3";
 import {
   auth as v1AuthRouter,
   bot as v1BotRouter,
@@ -55,7 +58,6 @@ import {
   organizations as v2OrganizationsRouter,
   secret as v2SecretRouter, // begin to phase out
   secrets as v2SecretsRouter,
-  serviceAccounts as v2ServiceAccountsRouter,
   serviceTokenData as v2ServiceTokenDataRouter,
   signup as v2SignupRouter,
   tags as v2TagsRouter,
@@ -66,8 +68,7 @@ import {
   auth as v3AuthRouter,
   secrets as v3SecretsRouter,
   signup as v3SignupRouter,
-  workspaces as v3WorkspacesRouter,
-  serviceTokenData as v3ServiceTokenDataRouter
+  workspaces as v3WorkspacesRouter
 } from "./routes/v3";
 import { healthCheck } from "./routes/status";
 import { getLogger } from "./utils/logger";
@@ -155,6 +156,7 @@ const main = async () => {
   app.use("/api/v1/organizations", eeOrganizationsRouter);
   app.use("/api/v1/sso", eeSSORouter);
   app.use("/api/v1/cloud-products", eeCloudProductsRouter);
+  app.use("/api/v3/service-token", v3ServiceTokenDataRouter);
 
   // v1 routes
   app.use("/api/v1/signup", v1SignupRouter);
@@ -198,8 +200,6 @@ const main = async () => {
   app.use("/api/v3/secrets", v3SecretsRouter);
   app.use("/api/v3/workspaces", v3WorkspacesRouter);
   app.use("/api/v3/signup", v3SignupRouter);
-  app.use("/api/v3/service-token", v3ServiceTokenDataRouter);
-  
 
   // api docs
   app.use("/api-docs", swaggerUi.serve, swaggerUi.setup(swaggerFile));

backend/src/routes/v3/index.ts

@@ -2,12 +2,10 @@ import auth from "./auth";
 import secrets from "./secrets";
 import workspaces from "./workspaces";
 import signup from "./signup";
-import serviceTokenData from "./serviceTokenData";
 
 export {
     auth,
     secrets,
     signup,
-    workspaces,
-    serviceTokenData
+    workspaces
 }