Merge remote-tracking branch 'origin/main' into secret-versioning

backend/environment.d.ts

@@ -14,6 +14,8 @@ declare global {
 			JWT_SIGNUP_SECRET: string;
       MONGO_URL: string;
       NODE_ENV: 'development' | 'staging' | 'testing' | 'production';
+      VERBOSE_ERROR_OUTPUT: string;
+      LOKI_HOST: string;
       CLIENT_ID_HEROKU: string;
       CLIENT_ID_VERCEL: string;
       CLIENT_ID_NETLIFY: string;

backend/package.json

@@ -28,7 +28,9 @@
     "stripe": "^10.7.0",
     "tweetnacl": "^1.0.3",
     "tweetnacl-util": "^0.15.1",
-    "typescript": "^4.9.3"
+    "typescript": "^4.9.3",
+    "winston": "^3.8.2",
+    "winston-loki": "^6.0.6"
   },
   "name": "infisical-api",
   "version": "1.0.0",

backend/src/app.ts

@@ -1,5 +1,5 @@
-/* eslint-disable no-console */
 
+import { patchRouterParam } from './utils/patchAsyncRoutes';
 import express from 'express';
 import helmet from 'helmet';
 import cors from 'cors';
@@ -29,6 +29,12 @@ import {
   integration as integrationRouter,
   integrationAuth as integrationAuthRouter
 } from './routes';
+import { getLogger } from './utils/logger';
+import { RouteNotFoundError } from './utils/errors';
+import { requestErrorHandler } from './middleware/requestErrorHandler';
+
+//* Patch Async route params to handle Promise Rejections
+patchRouterParam()
 
 export const app = express();
 
@@ -69,6 +75,17 @@ app.use('/api/v1/stripe', stripeRouter);
 app.use('/api/v1/integration', integrationRouter);
 app.use('/api/v1/integration-auth', integrationAuthRouter);
 
+
+//* Handle unrouted requests and respond with proper error message as well as status code
+app.use((req, res, next)=>{
+  if(res.headersSent) return next();
+  next(RouteNotFoundError({message: `The requested source '(${req.method})${req.url}' was not found`}))
+})
+
+//* Error Handling Middleware (must be after all routing logic)
+app.use(requestErrorHandler)
+
+
 export const server = app.listen(PORT, () => {
-  console.log(`Listening on PORT ${[PORT]}`);
+  getLogger("backend-main").info(`Server started listening at port ${PORT}`)
 });

backend/src/config/index.ts

@@ -10,6 +10,8 @@ const JWT_SIGNUP_LIFETIME = process.env.JWT_SIGNUP_LIFETIME! || '15m';
 const JWT_SIGNUP_SECRET = process.env.JWT_SIGNUP_SECRET!;
 const MONGO_URL = process.env.MONGO_URL!;
 const NODE_ENV = process.env.NODE_ENV! || 'production';
+const VERBOSE_ERROR_OUTPUT = process.env.VERBOSE_ERROR_OUTPUT! === 'true' && true;
+const LOKI_HOST = process.env.LOKI_HOST || undefined;
 const CLIENT_SECRET_HEROKU = process.env.CLIENT_SECRET_HEROKU!;
 const CLIENT_ID_HEROKU = process.env.CLIENT_ID_HEROKU!;
 const CLIENT_ID_VERCEL = process.env.CLIENT_ID_VERCEL!;
@@ -53,6 +55,8 @@ export {
   JWT_SIGNUP_SECRET,
   MONGO_URL,
   NODE_ENV,
+  VERBOSE_ERROR_OUTPUT,
+  LOKI_HOST,
   CLIENT_ID_HEROKU,
   CLIENT_ID_VERCEL,
   CLIENT_ID_NETLIFY,

backend/src/helpers/integration.ts

@@ -2,18 +2,18 @@ import * as Sentry from '@sentry/node';
 import {
     Bot,
     Integration,
-    IIntegration,
     IntegrationAuth,
-    IIntegrationAuth
 } from '../models';
 import { exchangeCode, exchangeRefresh, syncSecrets } from '../integrations';
-import { BotService, IntegrationService } from '../services';
+import { BotService } from '../services';
 import {
     ENV_DEV,
     EVENT_PUSH_SECRETS,
     INTEGRATION_VERCEL,
     INTEGRATION_NETLIFY
 } from '../variables';
+import { UnauthorizedRequestError } from '../utils/errors';
+import RequestError from '../utils/requestError';
 
 interface Update {
     workspace: string;
@@ -176,12 +176,13 @@ const syncIntegrationsHelper = async ({
  */
  const getIntegrationAuthRefreshHelper = async ({ integrationAuthId }: { integrationAuthId: string }) => {
     let refreshToken;
+	
     try {
         const integrationAuth = await IntegrationAuth
             .findById(integrationAuthId)
             .select('+refreshCiphertext +refreshIV +refreshTag');
 
-        if (!integrationAuth) throw new Error('Failed to find integration auth');
+        if (!integrationAuth) throw UnauthorizedRequestError({message: 'Failed to locate Integration Authentication credentials'});
 
         refreshToken = await BotService.decryptSymmetric({
             workspaceId: integrationAuth.workspace.toString(),
@@ -193,7 +194,10 @@ const syncIntegrationsHelper = async ({
     } catch (err) {
         Sentry.setUser(null);
 		Sentry.captureException(err);
-		throw new Error('Failed to get integration refresh token');
+        if(err instanceof RequestError)
+            throw err
+        else
+            throw new Error('Failed to get integration refresh token');
     }
     
     return refreshToken;
@@ -209,12 +213,13 @@ const syncIntegrationsHelper = async ({
  */
 const getIntegrationAuthAccessHelper = async ({ integrationAuthId }: { integrationAuthId: string }) => {
     let accessToken;
+	
     try {
         const integrationAuth = await IntegrationAuth
             .findById(integrationAuthId)
             .select('workspace integration +accessCiphertext +accessIV +accessTag +accessExpiresAt + refreshCiphertext');
 
-        if (!integrationAuth) throw new Error('Failed to find integration auth');
+        if (!integrationAuth) throw UnauthorizedRequestError({message: 'Failed to locate Integration Authentication credentials'});
 
         accessToken = await BotService.decryptSymmetric({
             workspaceId: integrationAuth.workspace.toString(),
@@ -240,7 +245,10 @@ const getIntegrationAuthAccessHelper = async ({ integrationAuthId }: { integrati
     } catch (err) {
         Sentry.setUser(null);
 		Sentry.captureException(err);
-		throw new Error('Failed to get integration access token');
+        if(err instanceof RequestError)
+            throw err
+        else
+            throw new Error('Failed to get integration access token');
     }
     
     return accessToken;

backend/src/helpers/membership.ts

@@ -21,6 +21,7 @@ const validateMembership = async ({
 }) => {
 	
 	let membership;
+	//TODO: Refactor code to take advantage of using RequestError. It's possible to create new types of errors for more detailed errors
 	try {
 		membership = await Membership.findOne({
 			user: userId,

backend/src/integrations/refresh.ts

@@ -53,6 +53,7 @@ const exchangeRefreshHeroku = async ({
   refreshToken: string;
 }) => {
     let accessToken;
+	//TODO: Refactor code to take advantage of using RequestError. It's possible to create new types of errors for more detailed errors
     try {
         const res = await axios.post(
             INTEGRATION_HEROKU_TOKEN_URL,

backend/src/middleware/requestErrorHandler.ts

@@ -0,0 +1,29 @@
+import { ErrorRequestHandler } from "express";
+
+import * as Sentry from '@sentry/node';
+import { InternalServerError } from "../utils/errors";
+import { getLogger } from "../utils/logger";
+import RequestError, { LogLevel } from "../utils/requestError";
+
+
+export const requestErrorHandler: ErrorRequestHandler = (error: RequestError|Error, req, res, next) => {
+    if(res.headersSent) return next();
+    //TODO: Find better way to type check for error. In current setting you need to cast type to get the functions and variables from RequestError
+    if(!(error instanceof RequestError)){
+        error = InternalServerError({context: {exception: error.message}, stack: error.stack})
+        getLogger('backend-main').log((<RequestError>error).levelName.toLowerCase(), (<RequestError>error).message)
+    }
+    
+    //* Set Sentry user identification if req.user is populated
+    if(req.user !== undefined && req.user !== null){
+        Sentry.setUser({ email: req.user.email })
+    }
+    //* Only sent error to Sentry if LogLevel is one of the following level 'ERROR', 'EMERGENCY' or 'CRITICAL'
+    //* with this we will eliminate false-positive errors like 'BadRequestError', 'UnauthorizedRequestError' and so on
+    if([LogLevel.ERROR, LogLevel.EMERGENCY, LogLevel.CRITICAL].includes((<RequestError>error).level)){
+        Sentry.captureException(error)
+    }
+    
+    res.status((<RequestError>error).statusCode).json((<RequestError>error).format(req))
+    next()
+}

backend/src/middleware/requireAuth.ts

@@ -1,8 +1,8 @@
 import jwt from 'jsonwebtoken';
 import { Request, Response, NextFunction } from 'express';
-import * as Sentry from '@sentry/node';
 import { User } from '../models';
 import { JWT_AUTH_SECRET } from '../config';
+import { AccountNotFoundError, BadRequestError, UnauthorizedRequestError } from '../utils/errors';
 
 declare module 'jsonwebtoken' {
 	export interface UserIDJwtPayload extends jwt.JwtPayload {
@@ -20,32 +20,25 @@ declare module 'jsonwebtoken' {
  */
 const requireAuth = async (req: Request, res: Response, next: NextFunction) => {
 	// JWT authentication middleware
-	try {
-		if (!req.headers?.authorization)
-			throw new Error('Failed to locate authorization header');
+	const [ AUTH_TOKEN_TYPE, AUTH_TOKEN_VALUE ] = <[string, string]>req.headers['authorization']?.split(' ', 2) ?? [null, null]
+	if(AUTH_TOKEN_TYPE === null) return next(BadRequestError({message: `Missing Authorization Header in the request header.`}))
+	if(AUTH_TOKEN_TYPE.toLowerCase() !== 'bearer') return next(BadRequestError({message: `The provided authentication type '${AUTH_TOKEN_TYPE}' is not supported.`}))
+	if(AUTH_TOKEN_VALUE === null) return next(BadRequestError({message: 'Missing Authorization Body in the request header'}))
 
-		const token = req.headers.authorization.split(' ')[1];
-		const decodedToken = <jwt.UserIDJwtPayload>(
-			jwt.verify(token, JWT_AUTH_SECRET)
-		);
+	const decodedToken = <jwt.UserIDJwtPayload>(
+		jwt.verify(AUTH_TOKEN_VALUE, JWT_AUTH_SECRET)
+	);
 
-		const user = await User.findOne({
-			_id: decodedToken.userId
-		}).select('+publicKey');
+	const user = await User.findOne({
+		_id: decodedToken.userId
+	}).select('+publicKey');
 
-		if (!user) throw new Error('Failed to authenticate unfound user');
-		if (!user?.publicKey)
-			throw new Error('Failed to authenticate not fully set up account');
+	if (!user) return next(AccountNotFoundError({message: 'Failed to locate User account'}))
+	if (!user?.publicKey)
+		return next(UnauthorizedRequestError({message: 'Unable to authenticate due to partially set up account'}))
 
-		req.user = user;
-		return next();
-	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-		return res.status(401).send({
-			error: 'Failed to authenticate user. Try logging in'
-		});
-	}
+	req.user = user;
+	return next();
 };
 
 export default requireAuth;

backend/src/middleware/requireBotAuth.ts

@@ -1,7 +1,7 @@
-import * as Sentry from '@sentry/node';
 import { Request, Response, NextFunction } from 'express';
 import { Bot } from '../models';
 import { validateMembership } from '../helpers/membership';
+import { AccountNotFoundError } from '../utils/errors';
 
 type req = 'params' | 'body' | 'query';
 
@@ -15,30 +15,22 @@ const requireBotAuth = ({
     location?: req;
 }) => {
     return async (req: Request, res: Response, next: NextFunction) => {
-        try {
-            const bot = await Bot.findOne({ _id: req[location].botId });
-            
-            if (!bot) {
-                throw new Error('Failed to find bot');
-            }
-            
-            await validateMembership({
-                userId: req.user._id.toString(),
-                workspaceId: bot.workspace.toString(),
-                acceptedRoles,
-                acceptedStatuses
-            });
-            
-            req.bot = bot;
-            
-            next();
-        } catch (err) {
-            Sentry.setUser(null);
-			Sentry.captureException(err);
-			return res.status(401).send({
-				error: 'Failed bot authorization'
-			});
+        const bot = await Bot.findOne({ _id: req[location].botId });
+        
+        if (!bot) {
+            return next(AccountNotFoundError({message: 'Failed to locate Bot account'}))
         }
+        
+        await validateMembership({
+            userId: req.user._id.toString(),
+            workspaceId: bot.workspace.toString(),
+            acceptedRoles,
+            acceptedStatuses
+        });
+        
+        req.bot = bot;
+        
+        next();
     }
 }
 

backend/src/middleware/requireIntegrationAuth.ts

@@ -1,8 +1,8 @@
-import * as Sentry from '@sentry/node';
 import { Request, Response, NextFunction } from 'express';
-import { Bot, Integration, IntegrationAuth, Membership } from '../models';
+import { Integration, IntegrationAuth } from '../models';
 import { IntegrationService } from '../services';
 import { validateMembership } from '../helpers/membership';
+import { IntegrationNotFoundError, UnauthorizedRequestError } from '../utils/errors';
 
 /**
  * Validate if user on request is a member of workspace with proper roles associated
@@ -21,48 +21,40 @@ const requireIntegrationAuth = ({
 	return async (req: Request, res: Response, next: NextFunction) => {
 		// integration authorization middleware
 
-		try {
-			const { integrationId } = req.params;
+		const { integrationId } = req.params;
 
-			// validate integration accessibility
-			const integration = await Integration.findOne({
-				_id: integrationId
-			});
+		// validate integration accessibility
+		const integration = await Integration.findOne({
+			_id: integrationId
+		});
 
-			if (!integration) {
-				throw new Error('Failed to find integration');
-			}
-			
-			await validateMembership({
-				userId: req.user._id.toString(),
-				workspaceId: integration.workspace.toString(),
-				acceptedRoles,
-				acceptedStatuses
-			});
-
-			const integrationAuth = await IntegrationAuth.findOne({
-				_id: integration.integrationAuth
-			}).select(
-				'+refreshCiphertext +refreshIV +refreshTag +accessCiphertext +accessIV +accessTag +accessExpiresAt'
-			);
-
-			if (!integrationAuth) {
-				throw new Error('Failed to find integration authorization');
-			}
-
-			req.integration = integration;
-			req.accessToken = await IntegrationService.getIntegrationAuthAccess({
-				integrationAuthId: integrationAuth._id.toString()
-			});
-
-			return next();
-		} catch (err) {
-			Sentry.setUser(null);
-			Sentry.captureException(err);
-			return res.status(401).send({
-				error: 'Failed integration authorization'
-			});
+		if (!integration) {
+			return next(IntegrationNotFoundError({message: 'Failed to locate Integration'}))
 		}
+		
+		await validateMembership({
+			userId: req.user._id.toString(),
+			workspaceId: integration.workspace.toString(),
+			acceptedRoles,
+			acceptedStatuses
+		});
+
+		const integrationAuth = await IntegrationAuth.findOne({
+			_id: integration.integrationAuth
+		}).select(
+			'+refreshCiphertext +refreshIV +refreshTag +accessCiphertext +accessIV +accessTag +accessExpiresAt'
+		);
+
+		if (!integrationAuth) {
+			return next(UnauthorizedRequestError({message: 'Failed to locate Integration Authentication credentials'}))
+		}
+
+		req.integration = integration;
+		req.accessToken = await IntegrationService.getIntegrationAuthAccess({
+			integrationAuthId: integrationAuth._id.toString()
+		});
+
+		return next();
 	};
 };
 

backend/src/middleware/requireIntegrationAuthorizationAuth.ts

@@ -3,6 +3,7 @@ import { Request, Response, NextFunction } from 'express';
 import { IntegrationAuth } from '../models';
 import { IntegrationService } from '../services';
 import { validateMembership } from '../helpers/membership';
+import { UnauthorizedRequestError } from '../utils/errors';
 
 /**
  * Validate if user on request is a member of workspace with proper roles associated
@@ -22,41 +23,33 @@ const requireIntegrationAuthorizationAuth = ({
 	attachAccessToken?: boolean;
 }) => {
 	return async (req: Request, res: Response, next: NextFunction) => {
-		try {
-			const { integrationAuthId } = req.params;
+		const { integrationAuthId } = req.params;
 
-			const integrationAuth = await IntegrationAuth.findOne({
-				_id: integrationAuthId
-			}).select(
-				'+refreshCiphertext +refreshIV +refreshTag +accessCiphertext +accessIV +accessTag +accessExpiresAt'
-			);
+		const integrationAuth = await IntegrationAuth.findOne({
+			_id: integrationAuthId
+		}).select(
+			'+refreshCiphertext +refreshIV +refreshTag +accessCiphertext +accessIV +accessTag +accessExpiresAt'
+		);
 
-			if (!integrationAuth) {
-				throw new Error('Failed to find integration authorization');
-			}
-			
-			await validateMembership({
-				userId: req.user._id.toString(),
-				workspaceId: integrationAuth.workspace.toString(),
-				acceptedRoles,
-				acceptedStatuses
-			});
+		if (!integrationAuth) {
+			return next(UnauthorizedRequestError({message: 'Failed to locate Integration Authorization credentials'}))
+		}
+		
+		await validateMembership({
+			userId: req.user._id.toString(),
+			workspaceId: integrationAuth.workspace.toString(),
+			acceptedRoles,
+			acceptedStatuses
+		});
 
-			req.integrationAuth = integrationAuth;
-			if (attachAccessToken) {
-				req.accessToken = await IntegrationService.getIntegrationAuthAccess({
-					integrationAuthId: integrationAuth._id.toString()
-				});
-			}
-			
-			return next();
-		} catch (err) {
-			Sentry.setUser(null);
-			Sentry.captureException(err);
-			return res.status(401).send({
-				error: 'Failed (authorization) integration authorizationt'
+		req.integrationAuth = integrationAuth;
+		if (attachAccessToken) {
+			req.accessToken = await IntegrationService.getIntegrationAuthAccess({
+				integrationAuthId: integrationAuth._id.toString()
 			});
 		}
+		
+		return next();
 	};
 };
 

backend/src/middleware/requireOrganizationAuth.ts

@@ -1,6 +1,6 @@
-import * as Sentry from '@sentry/node';
 import { Request, Response, NextFunction } from 'express';
 import { IOrganization, MembershipOrg } from '../models';
+import { UnauthorizedRequestError, ValidationError } from '../utils/errors';
 
 /**
  * Validate if user on request is a member with proper roles for organization
@@ -19,35 +19,28 @@ const requireOrganizationAuth = ({
 	return async (req: Request, res: Response, next: NextFunction) => {
 		// organization authorization middleware
 
-		try {
-			// validate organization membership
-			const membershipOrg = await MembershipOrg.findOne({
-				user: req.user._id,
-				organization: req.params.organizationId
-			}).populate<{ organization: IOrganization }>('organization');
+		// validate organization membership
+		const membershipOrg = await MembershipOrg.findOne({
+			user: req.user._id,
+			organization: req.params.organizationId
+		}).populate<{ organization: IOrganization }>('organization');
 
-			if (!membershipOrg) {
-				throw new Error('Failed to find organization membership');
-			}
 
-			if (!acceptedRoles.includes(membershipOrg.role)) {
-				throw new Error('Failed to validate organization membership role');
-			}
-
-			if (!acceptedStatuses.includes(membershipOrg.status)) {
-				throw new Error('Failed to validate organization membership status');
-			}
-
-			req.membershipOrg = membershipOrg;
-
-			return next();
-		} catch (err) {
-			Sentry.setUser(null);
-			Sentry.captureException(err);
-			return res.status(401).send({
-				error: 'Failed organization authorization'
-			});
+		if (!membershipOrg) {
+			return next(UnauthorizedRequestError({message: "You're not a member of this Organization."}))
 		}
+		//TODO is this important to validate? I mean is it possible to save wrong role to database or get wrong role from databse? - Zamion101
+		if (!acceptedRoles.includes(membershipOrg.role)) {
+			return next(ValidationError({message: 'Failed to validate Organization Membership Role'}))
+		}
+
+		if (!acceptedStatuses.includes(membershipOrg.status)) {
+			return next(ValidationError({message: 'Failed to validate Organization Membership Status'}))
+		}
+
+		req.membershipOrg = membershipOrg;
+
+		return next();
 	};
 };
 

backend/src/middleware/requireServiceTokenAuth.ts

@@ -1,8 +1,8 @@
 import jwt from 'jsonwebtoken';
 import { Request, Response, NextFunction } from 'express';
-import * as Sentry from '@sentry/node';
 import { ServiceToken } from '../models';
 import { JWT_SERVICE_SECRET } from '../config';
+import { BadRequestError, UnauthorizedRequestError } from '../utils/errors';
 
 declare module 'jsonwebtoken' {
 	export interface UserIDJwtPayload extends jwt.JwtPayload {
@@ -24,33 +24,27 @@ const requireServiceTokenAuth = async (
 	next: NextFunction
 ) => {
 	// JWT service token middleware
-	try {
-		if (!req.headers?.authorization)
-			throw new Error('Failed to locate authorization header');
+	
+	const [ AUTH_TOKEN_TYPE, AUTH_TOKEN_VALUE ] = <[string, string]>req.headers['authorization']?.split(' ', 2) ?? [null, null]
+	if(AUTH_TOKEN_TYPE === null) return next(BadRequestError({message: `Missing Authorization Header in the request header.`}))
+	//TODO: Determine what is the actual Token Type for Service Token Authentication (ex. Bearer)
+	//if(AUTH_TOKEN_TYPE.toLowerCase() !== 'bearer') return next(UnauthorizedRequestError({message: `The provided authentication type '${AUTH_TOKEN_TYPE}' is not supported.`}))
+	if(AUTH_TOKEN_VALUE === null) return next(BadRequestError({message: 'Missing Authorization Body in the request header'}))
 
-		const token = req.headers.authorization.split(' ')[1];
+	const decodedToken = <jwt.UserIDJwtPayload>(
+		jwt.verify(AUTH_TOKEN_VALUE, JWT_SERVICE_SECRET)
+	);
 
-		const decodedToken = <jwt.UserIDJwtPayload>(
-			jwt.verify(token, JWT_SERVICE_SECRET)
-		);
+	const serviceToken = await ServiceToken.findOne({
+		_id: decodedToken.serviceTokenId
+	})
+		.populate('user', '+publicKey')
+		.select('+encryptedKey +publicKey +nonce');
 
-		const serviceToken = await ServiceToken.findOne({
-			_id: decodedToken.serviceTokenId
-		})
-			.populate('user', '+publicKey')
-			.select('+encryptedKey +publicKey +nonce');
+	if (!serviceToken) return next(UnauthorizedRequestError({message: 'The service token does not match the record in the database'}))
 
-		if (!serviceToken) throw new Error('Failed to find service token');
-
-		req.serviceToken = serviceToken;
-		return next();
-	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-		return res.status(401).send({
-			error: 'Failed to authenticate service token'
-		});
-	}
+	req.serviceToken = serviceToken;
+	return next();
 };
 
 export default requireServiceTokenAuth;

backend/src/middleware/requireSignupAuth.ts

@@ -1,8 +1,8 @@
 import jwt from 'jsonwebtoken';
 import { Request, Response, NextFunction } from 'express';
-import * as Sentry from '@sentry/node';
 import { User } from '../models';
 import { JWT_SIGNUP_SECRET } from '../config';
+import { BadRequestError, UnauthorizedRequestError } from '../utils/errors';
 
 declare module 'jsonwebtoken' {
 	export interface UserIDJwtPayload extends jwt.JwtPayload {
@@ -21,32 +21,24 @@ const requireSignupAuth = async (
 ) => {
 	// JWT (temporary) authentication middleware for complete signup
 
-	try {
-		if (!req.headers?.authorization)
-			throw new Error('Failed to locate authorization header');
+	const [ AUTH_TOKEN_TYPE, AUTH_TOKEN_VALUE ] = <[string, string]>req.headers['authorization']?.split(' ', 2) ?? [null, null]
+	if(AUTH_TOKEN_TYPE === null) return next(BadRequestError({message: `Missing Authorization Header in the request header.`}))
+	if(AUTH_TOKEN_TYPE.toLowerCase() !== 'bearer') return next(BadRequestError({message: `The provided authentication type '${AUTH_TOKEN_TYPE}' is not supported.`}))
+	if(AUTH_TOKEN_VALUE === null) return next(BadRequestError({message: 'Missing Authorization Body in the request header'}))
+	
+	const decodedToken = <jwt.UserIDJwtPayload>(
+		jwt.verify(AUTH_TOKEN_VALUE, JWT_SIGNUP_SECRET)
+	);
 
-		const token = req.headers.authorization.split(' ')[1];
-		const decodedToken = <jwt.UserIDJwtPayload>(
-			jwt.verify(token, JWT_SIGNUP_SECRET)
-		);
+	const user = await User.findOne({
+		_id: decodedToken.userId
+	}).select('+publicKey');
 
-		const user = await User.findOne({
-			_id: decodedToken.userId
-		}).select('+publicKey');
+	if (!user)
+		return next(UnauthorizedRequestError({message: 'Unable to authenticate for User account completion. Try logging in again'}))
 
-		if (!user)
-			throw new Error('Failed to temporarily authenticate unfound user');
-
-		req.user = user;
-		return next();
-	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-		return res.status(401).send({
-			error:
-				'Failed to temporarily authenticate user for complete account. Try logging in'
-		});
-	}
+	req.user = user;
+	return next();
 };
 
 export default requireSignupAuth;

backend/src/middleware/requireWorkspaceAuth.ts

@@ -1,6 +1,6 @@
-import * as Sentry from '@sentry/node';
 import { Request, Response, NextFunction } from 'express';
 import { validateMembership } from '../helpers/membership';
+import { UnauthorizedRequestError } from '../utils/errors';
 
 type req = 'params' | 'body' | 'query';
 
@@ -36,11 +36,7 @@ const requireWorkspaceAuth = ({
 
 			return next();
 		} catch (err) {
-			Sentry.setUser(null);
-			Sentry.captureException(err);
-			return res.status(401).send({
-				error: 'Failed workspace authorization'
-			});
+			return next(UnauthorizedRequestError({message: 'Unable to authenticate workspace'}))
 		}
 	};
 };

backend/src/middleware/validateRequest.ts

@@ -1,6 +1,6 @@
 import { Request, Response, NextFunction } from 'express';
-import * as Sentry from '@sentry/node';
 import { validationResult } from 'express-validator';
+import { BadRequestError, UnauthorizedRequestError } from '../utils/errors';
 
 /**
  * Validate intended inputs on [req] via express-validator
@@ -15,16 +15,12 @@ const validate = (req: Request, res: Response, next: NextFunction) => {
 	try {
 		const errors = validationResult(req);
 		if (!errors.isEmpty()) {
-			return res.status(400).json({ errors: errors.array() });
+			return next(BadRequestError({context: {errors: errors.array}}))
 		}
 
 		return next();
 	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-		return res.status(401).send({
-			error: "Looks like you're unauthenticated . Try logging in"
-		});
+		return next(UnauthorizedRequestError({message: 'Unauthenticated requests are not allowed. Try logging in'}))
 	}
 };
 

backend/src/services/PostHogClient.ts

@@ -5,8 +5,16 @@ import {
   POSTHOG_PROJECT_API_KEY,
   TELEMETRY_ENABLED
 } from '../config';
+import { getLogger } from '../utils/logger';
 
-console.log('TELEMETRY_ENABLED: ', TELEMETRY_ENABLED);
+if(TELEMETRY_ENABLED){
+  getLogger("backend-main").info([
+    "",
+    "Infisical collects telemetry data about general usage.",
+    "The data helps us understand how the product is doing and guide our product development to create the best possible platform; it also helps us demonstrate growth for investors as we support Infisical as open-source software.",
+    "To opt out of telemetry, you can set `TELEMETRY_ENABLED=false` within the environment variables",
+  ].join('\n'))
+}
 
 let postHogClient: any;
 if (NODE_ENV === 'production' && TELEMETRY_ENABLED) {

backend/src/services/database.ts

@@ -1,10 +1,10 @@
-/* eslint-disable no-console */
 import mongoose from 'mongoose';
+import { getLogger } from '../utils/logger';
 
 export const initDatabase = (MONGO_URL: string) => {
   mongoose
     .connect(MONGO_URL)
-    .then(() => console.log('Successfully connected to DB'))
-    .catch((e) => console.log('Failed to connect to DB ', e));
+    .then(() => getLogger("database").info("Database connection established"))
+    .catch((e) => getLogger("database").error(`Unable to establish Database connection due to the error.\n${e}`));
   return mongoose.connection;
 };

backend/src/services/health.ts

@@ -1,10 +1,10 @@
-/* eslint-disable no-console */
 import mongoose from 'mongoose';
 import { createTerminus } from '@godaddy/terminus';
+import { getLogger } from '../utils/logger';
 
 export const setUpHealthEndpoint = <T>(server: T) => {
   const onSignal = () => {
-    console.log('Server is starting clean-up');
+    getLogger('backend-main').info('Server is starting clean-up');
     return Promise.all([
       new Promise((resolve) => {
         if (mongoose.connection && mongoose.connection.readyState == 1) {

backend/src/types/express/index.d.ts

@@ -1,5 +1,6 @@
 import * as express from 'express';
 
+
 // TODO: fix (any) types
 declare global {
 	namespace Express {

backend/src/utils/errors.ts

@@ -0,0 +1,116 @@
+import RequestError, { LogLevel, RequestErrorContext } from "./requestError"
+
+//* ----->[GENERAL HTTP ERRORS]<-----
+export const RouteNotFoundError = (error?: Partial<RequestErrorContext>) => new RequestError({
+    logLevel: error?.logLevel ?? LogLevel.INFO,
+    statusCode: error?.statusCode ?? 404,
+    type: error?.type ?? 'route_not_found',
+    message: error?.message ?? 'The requested source was not found',
+    context: error?.context,
+    stack: error?.stack
+})
+
+export const MethodNotAllowedError = (error?: Partial<RequestErrorContext>) => new RequestError({
+    logLevel: error?.logLevel ?? LogLevel.INFO,
+    statusCode: error?.statusCode ?? 405,
+    type: error?.type ?? 'method_not_allowed',
+    message: error?.message ?? 'The requested method is not allowed for the resource',
+    context: error?.context,
+    stack: error?.stack
+})
+
+export const UnauthorizedRequestError = (error?: Partial<RequestErrorContext>) => new RequestError({
+    logLevel: error?.logLevel ?? LogLevel.INFO,
+    statusCode: error?.statusCode ?? 401,
+    type: error?.type ?? 'unauthorized',
+    message: error?.message ?? 'You are not authorized to access this resource',
+    context: error?.context,
+    stack: error?.stack
+})
+  
+export const ForbiddenRequestError = (error?: Partial<RequestErrorContext>) => new RequestError({
+    logLevel: error?.logLevel ?? LogLevel.INFO,
+    statusCode: error?.statusCode ?? 403,
+    type: error?.type ?? 'forbidden',
+    message: error?.message ?? 'You are not allowed to access this resource',
+    context: error?.context,
+    stack: error?.stack
+})
+
+export const BadRequestError = (error?: Partial<RequestErrorContext>) => new RequestError({
+    logLevel: error?.logLevel ?? LogLevel.INFO,
+    statusCode: error?.statusCode ?? 400,
+    type: error?.type ?? 'bad_request',
+    message: error?.message ?? 'The request is invalid or cannot be served',
+    context: error?.context,
+    stack: error?.stack
+})
+
+export const InternalServerError = (error?: Partial<RequestErrorContext>) => new RequestError({
+    logLevel: error?.logLevel ?? LogLevel.ERROR,
+    statusCode: error?.statusCode ?? 500,
+    type: error?.type ?? 'internal_server_error',
+    message: error?.message ?? 'The server encountered an error while processing the request',
+    context: error?.context,
+    stack: error?.stack
+})
+
+export const ServiceUnavailableError = (error?: Partial<RequestErrorContext>) => new RequestError({
+    logLevel: error?.logLevel ?? LogLevel.ERROR,
+    statusCode: error?.statusCode ?? 503,
+    type: error?.type ?? 'service_unavailable',
+    message: error?.message ?? 'The service is currently unavailable. Please try again later.',
+    context: error?.context,
+    stack: error?.stack
+})
+
+export const ValidationError = (error?: Partial<RequestErrorContext>) => new RequestError({
+    logLevel: error?.logLevel ?? LogLevel.ERROR,
+    statusCode: error?.statusCode ?? 400,
+    type: error?.type ?? 'validation_error',
+    message: error?.message ?? 'The request failed validation',
+    context: error?.context,
+    stack: error?.stack
+})
+
+//* ----->[INTEGRATION ERRORS]<-----
+export const IntegrationNotFoundError = (error?: Partial<RequestErrorContext>) => new RequestError({
+    logLevel: error?.logLevel ?? LogLevel.ERROR,
+    statusCode: error?.statusCode ?? 404,
+    type: error?.type ?? 'integration_not_found_error',
+    message: error?.message ?? 'The requested integration was not found',
+    context: error?.context,
+    stack: error?.stack
+})
+
+//* ----->[WORKSPACE ERRORS]<-----
+export const WorkspaceNotFoundError = (error?: Partial<RequestErrorContext>) => new RequestError({
+    logLevel: error?.logLevel ?? LogLevel.ERROR,
+    statusCode: error?.statusCode ?? 404,
+    type: error?.type ?? 'workspace_not_found_error',
+    message: error?.message ?? 'The requested workspace was not found',
+    context: error?.context,
+    stack: error?.stack
+})
+
+//* ----->[ORGANIZATION ERRORS]<-----
+export const OrganizationNotFoundError = (error?: Partial<RequestErrorContext>) => new RequestError({
+    logLevel: error?.logLevel ?? LogLevel.ERROR,
+    statusCode: error?.statusCode ?? 404,
+    type: error?.type ?? 'organization_not_found_error',
+    message: error?.message ?? 'The requested organization was not found',
+    context: error?.context,
+    stack: error?.stack
+})
+
+//* ----->[ACCOUNT ERRORS]<-----
+export const AccountNotFoundError = (error?: Partial<RequestErrorContext>) => new RequestError({
+    logLevel: error?.logLevel ?? LogLevel.ERROR,
+    statusCode: error?.statusCode ?? 404,
+    type: error?.type ?? 'account_not_found_error',
+    message: error?.message ?? 'The requested account was not found',
+    context: error?.context,
+    stack: error?.stack
+})
+
+//* ----->[MISC ERRORS]<-----

backend/src/utils/logger.ts

@@ -0,0 +1,65 @@
+/* eslint-disable no-console */
+import { createLogger, format, transports } from 'winston';
+import LokiTransport from 'winston-loki';
+import { LOKI_HOST, NODE_ENV } from '../config';
+
+const { combine, colorize, label, printf, splat, timestamp } = format;
+
+const logFormat = (prefix: string) => combine(
+  timestamp(),
+  splat(),
+  label({ label: prefix }),
+  printf((info) => `${info.timestamp} ${info.label} ${info.level}: ${info.message}`)
+);
+
+const createLoggerWithLabel = (level: string, label: string) => {
+  const _level = level.toLowerCase() || 'info'
+  //* Always add Console output to transports
+  const _transports: any[] = [
+    new transports.Console({
+      format: combine(
+        colorize(),
+        logFormat(label),
+        // format.json()
+      )
+    })
+  ]
+  //* Add LokiTransport if it's enabled
+  if(LOKI_HOST !== undefined){
+    _transports.push(
+      new LokiTransport({
+        host: LOKI_HOST,
+        handleExceptions: true,
+        handleRejections: true,
+        batching: true,
+        level: _level,
+        timeout: 30000,
+        format: format.combine(
+          format.json()
+        ),
+        labels: {app: process.env.npm_package_name, version: process.env.npm_package_version, environment: NODE_ENV},
+        onConnectionError: (err: Error)=> console.error('Connection error while connecting to Loki Server.\n', err)
+      })
+    )
+  }
+  
+  
+  return createLogger({
+    level: _level,
+    transports: _transports,
+    format: format.combine(
+      logFormat(label),
+      format.metadata({ fillExcept: ['message', 'level', 'timestamp', 'label'] })
+    )
+  });
+}
+
+const DEFAULT_LOGGERS = {
+  "backend-main": createLoggerWithLabel('info', '[IFSC:backend-main]'),
+  "database": createLoggerWithLabel('info', '[IFSC:database]'),
+}
+type LoggerNames = keyof typeof DEFAULT_LOGGERS
+
+export const getLogger = (loggerName: LoggerNames) => {
+  return DEFAULT_LOGGERS[loggerName]
+} 

backend/src/utils/patchAsyncRoutes.js

@@ -0,0 +1,65 @@
+/*
+Original work Copyright (c) 2016, Nikolay Nemshilov <nemshilov@gmail.com>
+Modified work Copyright (c) 2016, David Banham <david@banham.id.au>
+
+Permission to use, copy, modify, and/or distribute this software for any purpose
+with or without fee is hereby granted, provided that the above copyright notice
+and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
+THIS SOFTWARE.
+
+*/
+
+/* eslint-disable @typescript-eslint/no-var-requires */
+/* eslint-env node */
+const Layer = require('express/lib/router/layer');
+const Router = require('express/lib/router');
+
+const last = (arr = []) => arr[arr.length - 1];
+const noop = Function.prototype;
+
+function copyFnProps(oldFn, newFn) {
+  Object.keys(oldFn).forEach((key) => {
+    newFn[key] = oldFn[key];
+  });
+  return newFn;
+}
+
+function wrap(fn) {
+  const newFn = function newFn(...args) {
+    const ret = fn.apply(this, args);
+    const next = (args.length === 5 ? args[2] : last(args)) || noop;
+    if (ret && ret.catch) ret.catch(err => next(err));
+    return ret;
+  };
+  Object.defineProperty(newFn, 'length', {
+    value: fn.length,
+    writable: false,
+  });
+  return copyFnProps(fn, newFn);
+}
+
+export function patchRouterParam() {
+  const originalParam = Router.prototype.constructor.param;
+  Router.prototype.constructor.param = function param(name, fn) {
+    fn = wrap(fn);
+    return originalParam.call(this, name, fn);
+  };
+}
+
+Object.defineProperty(Layer.prototype, 'handle', {
+  enumerable: true,
+  get() {
+    return this.__handle;
+  },
+  set(fn) {
+    fn = wrap(fn);
+    this.__handle = fn;
+  },
+});

backend/src/utils/requestError.ts

@@ -0,0 +1,113 @@
+import { Request } from 'express'
+import { VERBOSE_ERROR_OUTPUT } from '../config'
+
+export enum LogLevel {
+    DEBUG = 100,
+    INFO = 200,
+    NOTICE = 250,
+    WARNING = 300,
+    ERROR = 400,
+    CRITICAL = 500,
+    ALERT = 550,
+    EMERGENCY = 600,
+}
+
+export type RequestErrorContext =  {
+	logLevel?: LogLevel,
+	statusCode: number,
+	type: string,
+	message: string,
+	context?: Record<string, unknown>,
+	stack?: string|undefined
+}
+
+export default class RequestError extends Error{
+
+    private _logLevel: LogLevel
+    private _logName: string
+    statusCode: number
+    type: string
+    context: Record<string, unknown>
+    extra: Record<string, string|number|symbol>[]
+    private stacktrace: string|undefined|string[]
+
+    constructor(
+        {logLevel, statusCode, type, message, context, stack} : RequestErrorContext
+        ){
+        super(message)
+        this._logLevel = logLevel || LogLevel.INFO
+        this._logName = LogLevel[this._logLevel]
+        this.statusCode = statusCode
+        this.type = type
+        this.context = context || {}
+        this.extra = []
+
+        if(stack) this.stack = stack
+        else Error.captureStackTrace(this, this.constructor)
+        this.stacktrace = this.stack?.split('\n')
+    }
+
+    static convertFrom(error: Error) {
+        //This error was not handled by error handler. Please report this incident to the staff.
+        return new RequestError({
+            logLevel: LogLevel.ERROR,
+            statusCode: 500,
+            type: 'internal_server_error',
+            message: 'This error was not handled by error handler. Please report this incident to the staff',
+            context: {
+                message: error.message,
+                name: error.name
+            },
+            stack: error.stack
+        })
+    }
+
+    get level(){ return this._logLevel }
+    get levelName(){ return this._logName }
+
+    withTags(...tags: string[]|number[]){
+        this.context['tags'] = Object.assign(tags, this.context['tags'])
+        return this
+    }
+
+    withExtras(...extras: Record<string, string|boolean|number>[]){
+        this.extra = Object.assign(extras, this.extra)
+        return this
+    }
+
+    private _omit(obj: any, keys: string[]): typeof obj{
+        const exclude = new Set(keys)
+        obj = Object.fromEntries(Object.entries(obj).filter(e => !exclude.has(e[0])))
+        return obj
+    }
+
+    public format(req: Request){
+        let _context = Object.assign({
+            stacktrace: this.stacktrace
+        }, this.context)
+
+        //* Omit sensitive information from context that can leak internal workings of this program if user is not developer
+        if(!VERBOSE_ERROR_OUTPUT){
+            _context = this._omit(_context, [
+                'stacktrace',
+                'exception',
+            ])
+        }
+
+        const formatObject = {
+            type: this.type,
+            message: this.message,
+            context: _context,
+            level: this.level,
+            level_name: this.levelName,
+            status_code: this.statusCode,
+            datetime_iso: new Date().toISOString(),
+            application: process.env.npm_package_name || 'unknown',
+            request_id: req.headers["Request-Id"],
+            extra: this.extra
+        }
+
+        return formatObject
+
+    }
+}