Resolve merge conflicts

backend/src/app.ts

@@ -38,7 +38,8 @@ import {
 } from './routes/v1';
 import {
   secret as v2SecretRouter,
-  workspace as v2WorkspaceRouter
+  workspace as v2WorkspaceRouter,
+  serviceTokenData as v2ServiceTokenDataRouter,
 } from './routes/v2';
 
 import { getLogger } from './utils/logger';
@@ -87,7 +88,7 @@ app.use('/api/v1/membership', v1MembershipRouter);
 app.use('/api/v1/key', v1KeyRouter);
 app.use('/api/v1/invite-org', v1InviteOrgRouter);
 app.use('/api/v1/secret', v1SecretRouter);
-app.use('/api/v1/service-token', v1ServiceTokenRouter);
+app.use('/api/v1/service-token', v1ServiceTokenRouter); // deprecate
 app.use('/api/v1/password', v1PasswordRouter);
 app.use('/api/v1/stripe', v1StripeRouter);
 app.use('/api/v1/integration', v1IntegrationRouter);
@@ -96,7 +97,7 @@ app.use('/api/v1/integration-auth', v1IntegrationAuthRouter);
 // v2 routes
 app.use('/api/v2/workspace', v2WorkspaceRouter);
 app.use('/api/v2/secret', v2SecretRouter);
-
+app.use('/api/v2/service-token-data', v2ServiceTokenDataRouter);
 
 //* Handle unrouted requests and respond with proper error message as well as status code
 app.use((req, res, next)=>{

backend/src/config/index.ts

@@ -1,6 +1,7 @@
 const PORT = process.env.PORT || 4000;
 const EMAIL_TOKEN_LIFETIME = process.env.EMAIL_TOKEN_LIFETIME! || '86400';
 const ENCRYPTION_KEY = process.env.ENCRYPTION_KEY!;
+const SALT_ROUNDS = parseInt(process.env.SALT_ROUNDS!) || 10;
 const JWT_AUTH_LIFETIME = process.env.JWT_AUTH_LIFETIME! || '10d';
 const JWT_AUTH_SECRET = process.env.JWT_AUTH_SECRET!;
 const JWT_REFRESH_LIFETIME = process.env.JWT_REFRESH_LIFETIME! || '90d';
@@ -47,6 +48,7 @@ export {
   PORT,
   EMAIL_TOKEN_LIFETIME,
   ENCRYPTION_KEY,
+  SALT_ROUNDS,
   JWT_AUTH_LIFETIME,
   JWT_AUTH_SECRET,
   JWT_REFRESH_LIFETIME,

backend/src/controllers/v1/serviceTokenController.ts

@@ -11,7 +11,6 @@ import { JWT_SERVICE_SECRET } from '../../config';
  * @returns
  */
 export const getServiceToken = async (req: Request, res: Response) => {
-	// get service token
 	return res.status(200).send({
 		serviceToken: req.serviceToken
 	});
@@ -73,4 +72,4 @@ export const createServiceToken = async (req: Request, res: Response) => {
 	return res.status(200).send({
 		token
 	});
-};
+};

backend/src/controllers/v1/workspaceController.ts

@@ -8,6 +8,7 @@ import {
 	IntegrationAuth,
 	IUser,
 	ServiceToken,
+	ServiceTokenData
 } from '../../models';
 import {
 	createWorkspace as create,
@@ -334,4 +335,31 @@ export const getWorkspaceServiceTokens = async (
 	return res.status(200).send({
 		serviceTokens
 	});
+}
+
+export const getWorkspaceServiceTokenData = async (
+	req: Request,
+	res: Response
+) => {
+	let serviceTokenData;
+        try {
+            const { workspaceId } = req.query;
+
+            serviceTokenData = await ServiceTokenData
+				.find({
+					workspace: workspaceId
+				})
+				.select('+encryptedKey +iv +tag');
+
+        } catch (err) {
+            Sentry.setUser({ email: req.user.email });
+            Sentry.captureException(err);
+            return res.status(400).send({
+                message: 'Failed to get workspace service token data'
+            });
+        }
+        
+        return res.status(200).send({
+            serviceTokenData
+        });
 }

backend/src/controllers/v2/index.ts

@@ -1,5 +1,7 @@
 import * as workspaceController from './workspaceController';
+import * as serviceTokenDataController from './serviceTokenDataController';
 
 export { 
-    workspaceController
+    workspaceController,
+    serviceTokenDataController
 }

backend/src/controllers/v2/serviceTokenDataController.ts

@@ -0,0 +1,105 @@
+import { Request, Response } from 'express';
+import * as Sentry from '@sentry/node';
+import crypto from 'crypto';
+import bcrypt from 'bcrypt';
+import {
+    ServiceTokenData
+} from '../../models';
+import {
+    SALT_ROUNDS
+} from '../../config';
+
+/**
+ * Return service token data associated with service token on request
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const getServiceTokenData = async (req: Request, res: Response) => res.status(200).send({
+    serviceTokenData: req.serviceTokenData
+});
+
+/**
+ * Create new service token data for workspace with id [workspaceId] and
+ * environment [environment].
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const createServiceTokenData = async (req: Request, res: Response) => {
+    let serviceToken, serviceTokenData;
+    try {
+        const { 
+            name,
+            workspaceId, 
+            environment,
+            encryptedKey,
+            iv,
+            tag,
+            expiresIn
+        } = req.body;
+
+        const secret = crypto.randomBytes(16).toString('hex');
+        const secretHash = await bcrypt.hash(secret, SALT_ROUNDS);
+        
+		const expiresAt = new Date();
+		expiresAt.setSeconds(expiresAt.getSeconds() + expiresIn);
+        
+        serviceTokenData = await new ServiceTokenData({
+            name,
+            workspace: workspaceId,
+            environment,
+            user: req.user._id,
+            expiresAt,
+            secretHash,
+            encryptedKey,
+            iv,
+            tag
+        }).save();
+        
+        // return service token data without sensitive data
+        serviceTokenData = await ServiceTokenData.findById(serviceTokenData._id);
+        
+        if (!serviceTokenData) throw new Error('Failed to find service token data');
+        
+        serviceToken = `st.${serviceTokenData._id.toString()}.${secret}`;
+
+    } catch (err) {
+        Sentry.setUser({ email: req.user.email });
+        Sentry.captureException(err);
+        return res.status(400).send({
+            message: 'Failed to create service token data'
+        });
+    }
+
+    return res.status(200).send({
+        serviceToken,
+        serviceTokenData
+    });
+}
+
+/**
+ * Delete service token data with id [serviceTokenDataId].
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const deleteServiceTokenData = async (req: Request, res: Response) => {
+    let serviceTokenData;
+    try {
+        const { serviceTokenDataId } = req.params;
+
+        serviceTokenData = await ServiceTokenData.findByIdAndDelete(serviceTokenDataId);
+        
+    } catch (err) {
+        Sentry.setUser({ email: req.user.email });
+        Sentry.captureException(err);
+        return res.status(400).send({
+            message: 'Failed to delete service token data'
+        });
+    }
+    
+    return res.status(200).send({
+        serviceTokenData
+    });
+}

backend/src/controllers/v2/workspaceController.ts

@@ -24,6 +24,7 @@ import { addMemberships } from '../../helpers/membership';
 import { postHogClient, EventService } from '../../services';
 import { eventPushSecrets } from '../../events';
 import { ADMIN, COMPLETED, GRANTED, ENV_SET } from '../../variables';
+
 interface V2PushSecret {
 	type: string; // personal or shared
 	secretKeyCiphertext: string;
@@ -40,326 +41,6 @@ interface V2PushSecret {
 	secretCommentHash?: string;
 }
 
-/**
- * Return public keys of members of workspace with id [workspaceId]
- * @param req
- * @param res
- * @returns
- */
-export const getWorkspacePublicKeys = async (req: Request, res: Response) => {
-	let publicKeys;
-	try {
-		const { workspaceId } = req.params;
-
-		publicKeys = (
-			await Membership.find({
-				workspace: workspaceId
-			}).populate<{ user: IUser }>('user', 'publicKey')
-		)
-			.filter((m) => m.status === COMPLETED || m.status === GRANTED)
-			.map((member) => {
-				return {
-					publicKey: member.user.publicKey,
-					userId: member.user._id
-				};
-			});
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get workspace member public keys'
-		});
-	}
-
-	return res.status(200).send({
-		publicKeys
-	});
-};
-
-/**
- * Return memberships for workspace with id [workspaceId]
- * @param req
- * @param res
- * @returns
- */
-export const getWorkspaceMemberships = async (req: Request, res: Response) => {
-	let users;
-	try {
-		const { workspaceId } = req.params;
-
-		users = await Membership.find({
-			workspace: workspaceId
-		}).populate('user', '+publicKey');
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get workspace members'
-		});
-	}
-
-	return res.status(200).send({
-		users
-	});
-};
-
-/**
- * Return workspaces that user is part of
- * @param req
- * @param res
- * @returns
- */
-export const getWorkspaces = async (req: Request, res: Response) => {
-	let workspaces;
-	try {
-		workspaces = (
-			await Membership.find({
-				user: req.user._id
-			}).populate('workspace')
-		).map((m) => m.workspace);
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get workspaces'
-		});
-	}
-
-	return res.status(200).send({
-		workspaces
-	});
-};
-
-/**
- * Return workspace with id [workspaceId]
- * @param req
- * @param res
- * @returns
- */
-export const getWorkspace = async (req: Request, res: Response) => {
-	let workspace;
-	try {
-		const { workspaceId } = req.params;
-
-		workspace = await Workspace.findOne({
-			_id: workspaceId
-		});
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get workspace'
-		});
-	}
-
-	return res.status(200).send({
-		workspace
-	});
-};
-
-/**
- * Create new workspace named [workspaceName] under organization with id
- * [organizationId] and add user as admin
- * @param req
- * @param res
- * @returns
- */
-export const createWorkspace = async (req: Request, res: Response) => {
-	let workspace;
-	try {
-		const { workspaceName, organizationId } = req.body;
-
-		// validate organization membership
-		const membershipOrg = await MembershipOrg.findOne({
-			user: req.user._id,
-			organization: organizationId
-		});
-
-		if (!membershipOrg) {
-			throw new Error('Failed to validate organization membership');
-		}
-
-		if (workspaceName.length < 1) {
-			throw new Error('Workspace names must be at least 1-character long');
-		}
-
-		// create workspace and add user as member
-		workspace = await create({
-			name: workspaceName,
-			organizationId
-		});
-
-		await addMemberships({
-			userIds: [req.user._id],
-			workspaceId: workspace._id.toString(),
-			roles: [ADMIN],
-			statuses: [GRANTED]
-		});
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to create workspace'
-		});
-	}
-
-	return res.status(200).send({
-		workspace
-	});
-};
-
-/**
- * Delete workspace with id [workspaceId]
- * @param req
- * @param res
- * @returns
- */
-export const deleteWorkspace = async (req: Request, res: Response) => {
-	try {
-		const { workspaceId } = req.params;
-
-		// delete workspace
-		await deleteWork({
-			id: workspaceId
-		});
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to delete workspace'
-		});
-	}
-
-	return res.status(200).send({
-		message: 'Successfully deleted workspace'
-	});
-};
-
-/**
- * Change name of workspace with id [workspaceId] to [name]
- * @param req
- * @param res
- * @returns
- */
-export const changeWorkspaceName = async (req: Request, res: Response) => {
-	let workspace;
-	try {
-		const { workspaceId } = req.params;
-		const { name } = req.body;
-
-		workspace = await Workspace.findOneAndUpdate(
-			{
-				_id: workspaceId
-			},
-			{
-				name
-			},
-			{
-				new: true
-			}
-		);
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to change workspace name'
-		});
-	}
-
-	return res.status(200).send({
-		message: 'Successfully changed workspace name',
-		workspace
-	});
-};
-
-/**
- * Return integrations for workspace with id [workspaceId]
- * @param req
- * @param res
- * @returns
- */
-export const getWorkspaceIntegrations = async (req: Request, res: Response) => {
-	let integrations;
-	try {
-		const { workspaceId } = req.params;
-
-		integrations = await Integration.find({
-			workspace: workspaceId
-		});
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get workspace integrations'
-		});
-	}
-
-	return res.status(200).send({
-		integrations
-	});
-};
-
-/**
- * Return (integration) authorizations for workspace with id [workspaceId]
- * @param req
- * @param res
- * @returns
- */
-export const getWorkspaceIntegrationAuthorizations = async (
-	req: Request,
-	res: Response
-) => {
-	let authorizations;
-	try {
-		const { workspaceId } = req.params;
-
-		authorizations = await IntegrationAuth.find({
-			workspace: workspaceId
-		});
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get workspace integration authorizations'
-		});
-	}
-
-	return res.status(200).send({
-		authorizations
-	});
-};
-
-/**
- * Return service service tokens for workspace [workspaceId] belonging to user
- * @param req 
- * @param res 
- * @returns 
- */
-export const getWorkspaceServiceTokens = async (
-	req: Request,
-	res: Response
-) => {
-	let serviceTokens;
-	try {
-		const { workspaceId } = req.params;
-
-		serviceTokens = await ServiceToken.find({
-			user: req.user._id,
-			workspace: workspaceId
-		});
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get workspace service tokens'
-		});
-	}
-	
-	return res.status(200).send({
-		serviceTokens
-	});
-}
-
 /**
  * Upload (encrypted) secrets to workspace with id [workspaceId]
  * for environment [environment]
@@ -434,40 +115,32 @@ export const pushWorkspaceSecrets = async (req: Request, res: Response) => {
 
 /**
  * Return (encrypted) secrets for workspace with id [workspaceId]
- * for environment [environment] and (encrypted) workspace key
+ * for environment [environment]
  * @param req
  * @param res
  * @returns
  */
 export const pullSecrets = async (req: Request, res: Response) => {
-	// TODO: only return secrets, do not return workspace key
-
 	let secrets;
-	let key;
 	try {
 		const environment: string = req.query.environment as string;
 		const channel: string = req.query.channel as string;
 		const { workspaceId } = req.params;
-
-		// validate environment
-		if (!ENV_SET.has(environment)) {
-			throw new Error('Failed to validate environment');
+		
+		let userId;
+		if (req.user) {
+			userId = req.user._id.toString();
+		} else if (req.serviceTokenData) {
+			userId = req.serviceTokenData.user._id
 		}
 
 		secrets = await pull({
-			userId: req.user._id.toString(),
+			userId,
 			workspaceId,
 			environment,
 			channel,
 			ipAddress: req.ip
 		});
-
-		key = await Key.findOne({
-			workspace: workspaceId,
-			receiver: req.user._id
-		})
-			.sort({ createdAt: -1 })
-			.populate('sender', '+publicKey');
 		
 		if (channel !== 'cli') {
 			secrets = reformatPullSecrets({ secrets });
@@ -495,75 +168,30 @@ export const pullSecrets = async (req: Request, res: Response) => {
 	}
 
 	return res.status(200).send({
-		secrets,
-		key
+		secrets
 	});
 };
 
-// TODO: modify based on upcoming serviceTokenData changes
-
-/**
- * Return (encrypted) secrets for workspace with id [workspaceId]
- * for environment [environment] and (encrypted) workspace key
- * via service token
- * @param req
- * @param res
- * @returns
- */
- export const pullSecretsServiceToken = async (req: Request, res: Response) => {
-	let secrets;
+export const getWorkspaceKey = async (req: Request, res: Response) => {
 	let key;
 	try {
-		const environment: string = req.query.environment as string;
-		const channel: string = req.query.channel as string;
 		const { workspaceId } = req.params;
 
-		// validate environment
-		if (!ENV_SET.has(environment)) {
-			throw new Error('Failed to validate environment');
-		}
-
-		secrets = await pull({
-			userId: req.serviceToken.user._id.toString(),
-			workspaceId,
-			environment,
-			channel: 'cli',
-			ipAddress: req.ip
-		});
-
-		key = {
-			encryptedKey: req.serviceToken.encryptedKey,
-			nonce: req.serviceToken.nonce,
-			sender: {
-				publicKey: req.serviceToken.publicKey
-			},
-			receiver: req.serviceToken.user,
-			workspace: req.serviceToken.workspace
-		};
-
-		if (postHogClient) {
-			// capture secrets pulled event in production
-			postHogClient.capture({
-				distinctId: req.serviceToken.user.email,
-				event: 'secrets pulled',
-				properties: {
-					numberOfSecrets: secrets.length,
-					environment,
-					workspaceId,
-					channel: channel ? channel : 'cli'
-				}
-			});
-		}
+		key = await Key.findOne({
+			workspace: workspaceId,
+			receiver: req.user._id
+		}).populate('sender', '+publicKey');
+		
+		if (!key) throw new Error('Failed to find workspace key');
 	} catch (err) {
-		Sentry.setUser({ email: req.serviceToken.user.email });
+		Sentry.setUser({ email: req.user.email });
 		Sentry.captureException(err);
 		return res.status(400).send({
-			message: 'Failed to pull workspace secrets'
+			message: 'Failed to get workspace key'
 		});
 	}
 
 	return res.status(200).send({
-		secrets: reformatPullSecrets({ secrets }),
 		key
 	});
-};
+}

backend/src/ee/routes/v1/secret.ts

@@ -11,7 +11,9 @@ import { ADMIN, MEMBER, COMPLETED, GRANTED } from '../../../variables';
 
 router.get(
 	'/:secretId/secret-versions',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireSecretAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [COMPLETED, GRANTED]

backend/src/ee/routes/v1/workspace.ts

@@ -11,7 +11,9 @@ import { workspaceController } from '../../controllers/v1';
 
 router.get(
 	'/:workspaceId/secret-snapshots',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [GRANTED]

backend/src/helpers/auth.ts

@@ -1,14 +1,140 @@
 import jwt from 'jsonwebtoken';
 import * as Sentry from '@sentry/node';
+import bcrypt from 'bcrypt';
 import {
-	User
+	User,
+	ServiceTokenData
 } from '../models';
 import {
 	JWT_AUTH_LIFETIME,
 	JWT_AUTH_SECRET,
 	JWT_REFRESH_LIFETIME,
-	JWT_REFRESH_SECRET
+	JWT_REFRESH_SECRET,
+	SALT_ROUNDS
 } from '../config';
+import {
+	AccountNotFoundError,
+	ServiceTokenDataNotFoundError,
+	UnauthorizedRequestError,
+	BadRequestError
+} from '../utils/errors';
+
+/**
+ * Validate that auth token value [authTokenValue] falls under one of
+ * accepted auth modes [acceptedAuthModes].
+ * @param {Object} obj
+ * @param {String} obj.authTokenValue - auth token value (e.g. JWT or service token value)
+ * @param {String[]} obj.acceptedAuthModes - accepted auth modes (e.g. jwt, serviceToken)
+ * @returns {String} authMode - auth mode
+ */
+const validateAuthMode = ({
+	authTokenValue,
+	acceptedAuthModes
+}: {
+	authTokenValue: string;
+	acceptedAuthModes: string[];
+}) => {
+	let authMode;
+	try {
+		switch (authTokenValue.split('.', 1)[0]) {
+			case 'st':
+				authMode = 'serviceToken';
+				break;
+			default:
+				authMode = 'jwt';
+				break;
+		}
+		
+		if (!acceptedAuthModes.includes(authMode)) 
+			throw UnauthorizedRequestError({ message: 'Failed to authenticated auth mode' });
+
+	} catch (err) {
+		throw UnauthorizedRequestError({ message: 'Failed to authenticated auth mode' });
+	}
+	
+	return authMode;
+}
+
+/**
+ * Return user payload corresponding to JWT token [authTokenValue]
+ * @param {Object} obj
+ * @param {String} obj.authTokenValue - JWT token value
+ * @returns {User} user - user corresponding to JWT token
+ */
+const getAuthUserPayload = async ({
+	authTokenValue
+}: {
+	authTokenValue: string;
+}) => {
+	let user;
+	try {
+		const decodedToken = <jwt.UserIDJwtPayload>(
+			jwt.verify(authTokenValue, JWT_AUTH_SECRET)
+		);
+
+		user = await User.findOne({
+			_id: decodedToken.userId
+		}).select('+publicKey');
+
+		if (!user) throw AccountNotFoundError({ message: 'Failed to find User' });
+
+		if (!user?.publicKey) throw UnauthorizedRequestError({ message: 'Failed to authenticate User with partially set up account' });
+
+	} catch (err) {
+		throw UnauthorizedRequestError({
+			message: 'Failed to authenticate JWT token'
+		});
+	}
+	
+	return user;
+}
+
+/**
+ * Return service token data payload corresponding to service token [authTokenValue]
+ * @param {Object} obj
+ * @param {String} obj.authTokenValue - service token value
+ * @returns {ServiceTokenData} serviceTokenData - service token data
+ */
+const getAuthSTDPayload = async ({
+	authTokenValue
+}: {
+	authTokenValue: string;
+}) => {
+	let serviceTokenData;
+	try {
+		const [_, TOKEN_IDENTIFIER, TOKEN_SECRET] = <[string, string, string]>authTokenValue.split('.', 3);
+
+		// TODO: optimize double query
+		serviceTokenData = await ServiceTokenData
+			.findById(TOKEN_IDENTIFIER, 'secretHash expiresAt');
+		
+		if (serviceTokenData?.expiresAt && new Date(serviceTokenData.expiresAt) < new Date()) {
+			// case: service token expired
+			await ServiceTokenData.findByIdAndDelete(serviceTokenData._id);
+			throw UnauthorizedRequestError({
+				message: 'Failed to authenticate expired service token'
+			});
+		}
+
+		if (!serviceTokenData) throw ServiceTokenDataNotFoundError({ message: 'Failed to find service token data' });
+
+		const isMatch = await bcrypt.compare(TOKEN_SECRET, serviceTokenData.secretHash);
+		if (!isMatch) throw UnauthorizedRequestError({
+			message: 'Failed to authenticate service token'
+		});
+
+		serviceTokenData = await ServiceTokenData
+			.findById(TOKEN_IDENTIFIER)
+			.select('+encryptedKey +iv +tag');
+
+	} catch (err) {
+		throw UnauthorizedRequestError({
+			message: 'Failed to authenticate service token'
+		});
+	}
+	
+	return serviceTokenData;
+}
 
 /**
  * Return newly issued (JWT) auth and refresh tokens to user with id [userId]
@@ -99,4 +225,11 @@ const createToken = ({
 	}
 };
 
-export { createToken, issueTokens, clearTokens };
+export { 
+	validateAuthMode,
+	getAuthUserPayload,
+	getAuthSTDPayload,
+	createToken, 
+	issueTokens, 
+	clearTokens 
+};

backend/src/middleware/index.ts

@@ -6,6 +6,7 @@ import requireOrganizationAuth from './requireOrganizationAuth';
 import requireIntegrationAuth from './requireIntegrationAuth';
 import requireIntegrationAuthorizationAuth from './requireIntegrationAuthorizationAuth';
 import requireServiceTokenAuth from './requireServiceTokenAuth';
+import requireServiceTokenDataAuth from './requireServiceTokenDataAuth';
 import requireSecretAuth from './requireSecretAuth';
 import validateRequest from './validateRequest';
 
@@ -18,6 +19,7 @@ export {
 	requireIntegrationAuth,
 	requireIntegrationAuthorizationAuth,
 	requireServiceTokenAuth,
+	requireServiceTokenDataAuth,
 	requireSecretAuth,
 	validateRequest
 };

backend/src/middleware/requireAuth.ts

@@ -1,8 +1,12 @@
 import jwt from 'jsonwebtoken';
 import { Request, Response, NextFunction } from 'express';
-import { User } from '../models';
-import { JWT_AUTH_SECRET } from '../config';
-import { AccountNotFoundError, BadRequestError, UnauthorizedRequestError } from '../utils/errors';
+import { User, ServiceTokenData } from '../models';
+import {
+	validateAuthMode,
+	getAuthUserPayload,
+	getAuthSTDPayload
+} from '../helpers/auth';
+import { BadRequestError } from '../utils/errors';
 
 declare module 'jsonwebtoken' {
 	export interface UserIDJwtPayload extends jwt.JwtPayload {
@@ -11,34 +15,53 @@ declare module 'jsonwebtoken' {
 }
 
 /**
- * Validate if JWT (auth) token on request is valid (e.g. not expired),
- * if there is an associated user, and if that user is fully setup.
- * @param req - express request object
- * @param res - express response object
- * @param next - express next function
+ * Validate if token on request is valid (e.g. not expired) for various auth modes:
+ * - If token is a JWT token, then check if there is an associated user
+ * and if user is fully setup.
+ * - If token is a service token (st), then check if there is associated
+ * service token data.
+ * @param {Object} obj
+ * @param {String[]} obj.acceptedAuthModes - accepted modes of authentication (jwt/st)
  * @returns
  */
-const requireAuth = async (req: Request, res: Response, next: NextFunction) => {
-	// JWT authentication middleware
-	const [ AUTH_TOKEN_TYPE, AUTH_TOKEN_VALUE ] = <[string, string]>req.headers['authorization']?.split(' ', 2) ?? [null, null]
-	if(AUTH_TOKEN_TYPE === null) return next(BadRequestError({message: `Missing Authorization Header in the request header.`}))
-	if(AUTH_TOKEN_TYPE.toLowerCase() !== 'bearer') return next(BadRequestError({message: `The provided authentication type '${AUTH_TOKEN_TYPE}' is not supported.`}))
-	if(AUTH_TOKEN_VALUE === null) return next(BadRequestError({message: 'Missing Authorization Body in the request header'}))
+const requireAuth  = ({
+	acceptedAuthModes = ['jwt']
+}: {
+	acceptedAuthModes: string[];
+}) => {
+	return async (req: Request, res: Response, next: NextFunction) => {
+		const [ AUTH_TOKEN_TYPE, AUTH_TOKEN_VALUE ] = <[string, string]>req.headers['authorization']?.split(' ', 2) ?? [null, null]
+		if(AUTH_TOKEN_TYPE === null) 
+			return next(BadRequestError({message: `Missing Authorization Header in the request header.`}))
+		if(AUTH_TOKEN_TYPE.toLowerCase() !== 'bearer') 
+			return next(BadRequestError({message: `The provided authentication type '${AUTH_TOKEN_TYPE}' is not supported.`}))
+		if(AUTH_TOKEN_VALUE === null) 
+			return next(BadRequestError({message: 'Missing Authorization Body in the request header'}))
+		
+		// validate auth token against 
+		const authMode = validateAuthMode({
+			authTokenValue: AUTH_TOKEN_VALUE,
+			acceptedAuthModes
+		});
+		
+		if (!acceptedAuthModes.includes(authMode)) throw new Error('Failed to validate auth mode');
+		
+		// attach auth payloads
+		switch (authMode) {
+			case 'serviceToken':
+				req.serviceTokenData = await getAuthSTDPayload({
+					authTokenValue: AUTH_TOKEN_VALUE
+				});
+				break;
+			default:
+				req.user = await getAuthUserPayload({
+					authTokenValue: AUTH_TOKEN_VALUE
+				});
+				break;
+		}
 
-	const decodedToken = <jwt.UserIDJwtPayload>(
-		jwt.verify(AUTH_TOKEN_VALUE, JWT_AUTH_SECRET)
-	);
-
-	const user = await User.findOne({
-		_id: decodedToken.userId
-	}).select('+publicKey');
-
-	if (!user) return next(AccountNotFoundError({message: 'Failed to locate User account'}))
-	if (!user?.publicKey)
-		return next(UnauthorizedRequestError({message: 'Unable to authenticate due to partially set up account'}))
-
-	req.user = user;
-	return next();
-};
+		return next();
+	}
+}
 
 export default requireAuth;

backend/src/middleware/requireServiceTokenAuth.ts

@@ -4,6 +4,7 @@ import { ServiceToken } from '../models';
 import { JWT_SERVICE_SECRET } from '../config';
 import { BadRequestError, UnauthorizedRequestError } from '../utils/errors';
 
+// TODO: deprecate
 declare module 'jsonwebtoken' {
 	export interface UserIDJwtPayload extends jwt.JwtPayload {
 		userId: string;

backend/src/middleware/requireServiceTokenDataAuth.ts

@@ -0,0 +1,44 @@
+import { Request, Response, NextFunction } from 'express';
+import { ServiceToken, ServiceTokenData } from '../models';
+import { validateMembership } from '../helpers/membership';
+import { AccountNotFoundError, UnauthorizedRequestError } from '../utils/errors';
+
+type req = 'params' | 'body' | 'query';
+
+const requireServiceTokenDataAuth = ({
+    acceptedRoles,
+    acceptedStatuses,
+    location = 'params'
+}: {
+    acceptedRoles: string[];
+    acceptedStatuses: string[];
+    location?: req;
+}) => {
+    return async (req: Request, res: Response, next: NextFunction) => {
+        const { serviceTokenDataId } = req[location];
+
+        const serviceTokenData = await ServiceTokenData
+            .findById(req[location].serviceTokenDataId)
+            .select('+encryptedKey +iv +tag');
+
+        if (!serviceTokenData) {
+            return next(AccountNotFoundError({message: 'Failed to locate service token data'}));
+        }
+
+        if (req.user) {
+            // case: jwt auth
+            await validateMembership({
+                userId: req.user._id.toString(),
+                workspaceId: serviceTokenData.workspace.toString(),
+                acceptedRoles,
+                acceptedStatuses
+            });
+        }
+        
+        req.serviceTokenData = serviceTokenData;
+        
+        next();
+    }
+}
+
+export default requireServiceTokenDataAuth;

backend/src/middleware/requireWorkspaceAuth.ts

@@ -8,8 +8,8 @@ type req = 'params' | 'body' | 'query';
  * Validate if user on request is a member with proper roles for workspace
  * on request params.
  * @param {Object} obj
- * @param {String[]} obj.acceptedRoles - accepted workspace roles
- * @param {String[]} obj.acceptedStatuses - accepted workspace statuses
+ * @param {String[]} obj.acceptedRoles - accepted workspace roles for JWT auth
+ * @param {String[]} obj.acceptedStatuses - accepted workspace statuses for JWT auth
  * @param {String[]} obj.location - location of [workspaceId] on request (e.g. params, body) for parsing
  */
 const requireWorkspaceAuth = ({
@@ -22,17 +22,28 @@ const requireWorkspaceAuth = ({
 	location?: req;
 }) => {
 	return async (req: Request, res: Response, next: NextFunction) => {
-		// workspace authorization middleware
-
 		try {
-			const membership = await validateMembership({
-				userId: req.user._id.toString(),
-				workspaceId: req[location].workspaceId,
-				acceptedRoles,
-				acceptedStatuses
-			});
+			const { workspaceId } = req[location];
 
-			req.membership = membership;
+			if (req.user) {
+				// case: jwt auth
+				const membership = await validateMembership({
+					userId: req.user._id.toString(),
+					workspaceId,
+					acceptedRoles,
+					acceptedStatuses
+				});
+
+				req.membership = membership;
+			}
+			
+			if (
+				req.serviceTokenData 
+				&& req.serviceTokenData.workspace !== workspaceId
+				&& req.serviceTokenData.environment !== req.query.environment
+			) {
+				next(UnauthorizedRequestError({message: 'Unable to authenticate workspace'}))	
+			}
 
 			return next();
 		} catch (err) {

backend/src/models/index.ts

@@ -14,6 +14,7 @@ import Token, { IToken } from './token';
 import User, { IUser } from './user';
 import UserAction, { IUserAction } from './userAction';
 import Workspace, { IWorkspace } from './workspace';
+import ServiceTokenData, { IServiceTokenData } from './serviceTokenData ';
 
 export {
 	BackupPrivateKey,
@@ -47,5 +48,7 @@ export {
 	UserAction,
 	IUserAction,
 	Workspace,
-	IWorkspace
+	IWorkspace,
+	ServiceTokenData,
+	IServiceTokenData
 };

backend/src/models/serviceToken.ts

@@ -1,6 +1,7 @@
 import { Schema, model, Types } from 'mongoose';
 import { ENV_DEV, ENV_TESTING, ENV_STAGING, ENV_PROD } from '../variables';
 
+// TODO: deprecate
 export interface IServiceToken {
 	_id: Types.ObjectId;
 	name: string;

backend/src/models/serviceTokenData .ts

@@ -0,0 +1,65 @@
+import { Schema, model, Types } from 'mongoose';
+import { ENV_DEV, ENV_TESTING, ENV_STAGING, ENV_PROD } from '../variables';
+
+export interface IServiceTokenData {
+    name: string;
+    workspace: Types.ObjectId;
+    environment: string; // TODO: adapt to upcoming environment id
+    user: Types.ObjectId;
+    expiresAt: Date;
+    secretHash: string;
+    encryptedKey: string;
+    iv: string;
+    tag: string;
+}
+
+const serviceTokenDataSchema = new Schema<IServiceTokenData>(
+    {
+        name: {
+            type: String,
+            required: true
+        },
+        workspace: {
+            type: Schema.Types.ObjectId,
+            ref: 'Workspace',
+            required: true
+        },
+        environment: { // TODO: adapt to upcoming environment id
+            type: String,
+            required: true
+        },
+        user: {
+            type: Schema.Types.ObjectId,
+            ref: 'User',
+            required: true
+        },
+        expiresAt: {
+            type: Date
+        },
+        secretHash: {
+            type: String,
+            unique: true,
+            required: true,
+            select: false
+        },
+        encryptedKey: {
+            type: String,
+            select: false
+        },
+        iv: {
+            type: String,
+            select: false
+        },
+        tag: {
+            type: String,
+            select: false
+        }
+    }, 
+    {
+        timestamps: true
+    }
+);
+
+const ServiceTokenData = model<IServiceTokenData>('ServiceTokenData', serviceTokenDataSchema);
+    
+export default ServiceTokenData;

backend/src/routes/v1/auth.ts

@@ -25,7 +25,19 @@ router.post(
   authController.login2
 );
 
-router.post('/logout', requireAuth, authController.logout);
-router.post('/checkAuth', requireAuth, authController.checkAuth);
+router.post(
+  '/logout', 
+  requireAuth({
+    acceptedAuthModes: ['jwt']
+  }), 
+  authController.logout
+);
+router.post(
+  '/checkAuth', 
+  requireAuth({
+    acceptedAuthModes: ['jwt']
+  }), 
+  authController.checkAuth
+);
 
 export default router;

backend/src/routes/v1/bot.ts

@@ -12,7 +12,9 @@ import { ADMIN, MEMBER, COMPLETED, GRANTED } from '../../variables';
 
 router.get(
     '/:workspaceId',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [COMPLETED, GRANTED]
@@ -24,7 +26,9 @@ router.get(
 
 router.patch(
     '/:botId/active',
-    requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
     requireBotAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [COMPLETED, GRANTED]

backend/src/routes/v1/integration.ts

@@ -11,7 +11,9 @@ import { integrationController } from '../../controllers/v1';
 
 router.patch(
 	'/:integrationId',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	requireIntegrationAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [GRANTED]
@@ -29,7 +31,9 @@ router.patch(
 
 router.delete(
 	'/:integrationId',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	requireIntegrationAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [GRANTED]

backend/src/routes/v1/integrationAuth.ts

@@ -12,13 +12,17 @@ import { integrationAuthController } from '../../controllers/v1';
 
 router.get(
 	'/integration-options',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	integrationAuthController.getIntegrationOptions
 );
 
 router.post(
 	'/oauth-token',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [GRANTED],
@@ -33,7 +37,9 @@ router.post(
 
 router.get(
 	'/:integrationAuthId/apps',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	requireIntegrationAuthorizationAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [GRANTED]
@@ -45,7 +51,9 @@ router.get(
 
 router.delete(
 	'/:integrationAuthId',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	requireIntegrationAuthorizationAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [GRANTED],

backend/src/routes/v1/inviteOrg.ts

@@ -6,7 +6,9 @@ import { membershipOrgController } from '../../controllers/v1';
 
 router.post(
 	'/signup',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	body('inviteeEmail').exists().trim().notEmpty().isEmail(),
 	body('organizationId').exists().trim().notEmpty(),
 	validateRequest,

backend/src/routes/v1/key.ts

@@ -11,7 +11,9 @@ import { keyController } from '../../controllers/v1';
 
 router.post(
 	'/:workspaceId',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [COMPLETED, GRANTED]
@@ -24,7 +26,9 @@ router.post(
 
 router.get(
 	'/:workspaceId/latest',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [COMPLETED, GRANTED]

backend/src/routes/v1/membership.ts

@@ -6,7 +6,9 @@ import { membershipController } from '../../controllers/v1';
 
 router.get( // used for CLI (deprecate)
 	'/:workspaceId/connect',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	param('workspaceId').exists().trim(),
 	validateRequest,
 	membershipController.validateMembership
@@ -14,7 +16,9 @@ router.get( // used for CLI (deprecate)
 
 router.delete(
 	'/:membershipId',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	param('membershipId').exists().trim(),
 	validateRequest,
 	membershipController.deleteMembership
@@ -22,7 +26,9 @@ router.delete(
 
 router.post(
 	'/:membershipId/change-role',
-	requireAuth,
+	requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
 	body('role').exists().trim(),
 	validateRequest,
 	membershipController.changeMembershipRole

backend/src/routes/v1/membershipOrg.ts

@@ -7,7 +7,9 @@ import { membershipOrgController } from '../../controllers/v1';
 router.post(
 	// TODO
 	'/membershipOrg/:membershipOrgId/change-role',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	param('membershipOrgId'),
 	validateRequest,
 	membershipOrgController.changeMembershipOrgRole
@@ -15,7 +17,9 @@ router.post(
 
 router.delete(
 	'/:membershipOrgId',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	param('membershipOrgId').exists().trim(),
 	validateRequest,
 	membershipOrgController.deleteMembershipOrg

backend/src/routes/v1/organization.ts

@@ -11,13 +11,17 @@ import { organizationController } from '../../controllers/v1';
 
 router.get(
 	'/',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	organizationController.getOrganizations
 );
 
 router.post( // not used on frontend
 	'/',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	body('organizationName').exists().trim().notEmpty(),
 	validateRequest,
 	organizationController.createOrganization
@@ -25,7 +29,9 @@ router.post( // not used on frontend
 
 router.get(
 	'/:organizationId',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
 		acceptedStatuses: [ACCEPTED]
@@ -37,7 +43,9 @@ router.get(
 
 router.get(
 	'/:organizationId/users',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
 		acceptedStatuses: [ACCEPTED]
@@ -49,7 +57,9 @@ router.get(
 
 router.get(
 	'/:organizationId/my-workspaces',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
 		acceptedStatuses: [ACCEPTED]
@@ -61,7 +71,9 @@ router.get(
 
 router.patch(
 	'/:organizationId/name',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
 		acceptedStatuses: [ACCEPTED]
@@ -74,7 +86,9 @@ router.patch(
 
 router.get(
 	'/:organizationId/incidentContactOrg',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
 		acceptedStatuses: [ACCEPTED]
@@ -86,7 +100,9 @@ router.get(
 
 router.post(
 	'/:organizationId/incidentContactOrg',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
 		acceptedStatuses: [ACCEPTED]
@@ -99,7 +115,9 @@ router.post(
 
 router.delete(
 	'/:organizationId/incidentContactOrg',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
 		acceptedStatuses: [ACCEPTED]
@@ -112,7 +130,9 @@ router.delete(
 
 router.post(
 	'/:organizationId/customer-portal-session',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
 		acceptedStatuses: [ACCEPTED]
@@ -124,7 +144,9 @@ router.post(
 
 router.get(
 	'/:organizationId/subscriptions',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireOrganizationAuth({
 		acceptedRoles: [OWNER, ADMIN, MEMBER],
 		acceptedStatuses: [ACCEPTED]

backend/src/routes/v1/password.ts

@@ -7,7 +7,9 @@ import { passwordLimiter } from '../../helpers/rateLimiter';
 
 router.post(
 	'/srp1',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	body('clientPublicKey').exists().trim().notEmpty(),
 	validateRequest,
 	passwordController.srp1
@@ -16,7 +18,9 @@ router.post(
 router.post(
 	'/change-password',
 	passwordLimiter,
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	body('clientProof').exists().trim().notEmpty(),
 	body('encryptedPrivateKey').exists().trim().notEmpty().notEmpty(), // private key encrypted under new pwd
 	body('iv').exists().trim().notEmpty(), // new iv for private key
@@ -54,7 +58,9 @@ router.get(
 router.post(
 	'/backup-private-key',
 	passwordLimiter,
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	body('clientProof').exists().trim().notEmpty(),
 	body('encryptedPrivateKey').exists().trim().notEmpty(), // (backup) private key encrypted under a strong key
 	body('iv').exists().trim().notEmpty(), // new iv for (backup) private key

backend/src/routes/v1/secret.ts

@@ -12,7 +12,9 @@ import { ADMIN, MEMBER, COMPLETED, GRANTED } from '../../variables';
 
 router.post(
 	'/:workspaceId',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [COMPLETED, GRANTED]
@@ -28,7 +30,9 @@ router.post(
 
 router.get(
 	'/:workspaceId',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [COMPLETED, GRANTED]

backend/src/routes/v1/serviceToken.ts

@@ -10,7 +10,7 @@ import { body } from 'express-validator';
 import { ADMIN, MEMBER, GRANTED } from '../../variables';
 import { serviceTokenController } from '../../controllers/v1';
 
-// TODO: revoke service token
+// note: deprecate service-token routes in favor of service-token data routes/structure
 
 router.get(
 	'/',
@@ -20,7 +20,9 @@ router.get(
 
 router.post(
 	'/',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [GRANTED],

backend/src/routes/v1/user.ts

@@ -3,6 +3,12 @@ const router = express.Router();
 import { requireAuth } from '../../middleware';
 import { userController } from '../../controllers/v1';
 
-router.get('/', requireAuth, userController.getUser);
+router.get(
+    '/', 
+    requireAuth({
+        acceptedAuthModes: ['jwt']
+    }), 
+    userController.getUser
+);
 
 export default router;

backend/src/routes/v1/userAction.ts

@@ -7,7 +7,9 @@ import { userActionController } from '../../controllers/v1';
 // note: [userAction] will be deprecated in /v2 in favor of [action]
 router.post(
 	'/',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	body('action'),
 	validateRequest,
 	userActionController.addUserAction
@@ -15,7 +17,9 @@ router.post(
 
 router.get(
 	'/',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	query('action'),
 	validateRequest,
 	userActionController.getUserAction

backend/src/routes/v1/workspace.ts

@@ -11,7 +11,9 @@ import { workspaceController, membershipController } from '../../controllers/v1'
 
 router.get(
 	'/:workspaceId/keys',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [COMPLETED, GRANTED]
@@ -23,7 +25,9 @@ router.get(
 
 router.get(
 	'/:workspaceId/users',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [COMPLETED, GRANTED]
@@ -33,11 +37,19 @@ router.get(
 	workspaceController.getWorkspaceMemberships
 );
 
-router.get('/', requireAuth, workspaceController.getWorkspaces);
+router.get(
+	'/', 
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}), 
+	workspaceController.getWorkspaces
+);
 
 router.get(
 	'/:workspaceId',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [COMPLETED, GRANTED]
@@ -49,7 +61,9 @@ router.get(
 
 router.post(
 	'/',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	body('workspaceName').exists().trim().notEmpty(),
 	body('organizationId').exists().trim().notEmpty(),
 	validateRequest,
@@ -58,7 +72,9 @@ router.post(
 
 router.delete(
 	'/:workspaceId',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN],
 		acceptedStatuses: [GRANTED]
@@ -70,7 +86,9 @@ router.delete(
 
 router.post(
 	'/:workspaceId/name',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [COMPLETED, GRANTED]
@@ -83,7 +101,9 @@ router.post(
 
 router.post(
 	'/:workspaceId/invite-signup',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [GRANTED]
@@ -96,7 +116,9 @@ router.post(
 
 router.get(
 	'/:workspaceId/integrations',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [GRANTED]
@@ -108,7 +130,9 @@ router.get(
 
 router.get(
 	'/:workspaceId/authorizations',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [GRANTED]
@@ -119,8 +143,10 @@ router.get(
 );
 
 router.get(
-	'/:workspaceId/service-tokens',
-	requireAuth,
+	'/:workspaceId/service-tokens', // deprecate
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [GRANTED]
@@ -130,4 +156,18 @@ router.get(
 	workspaceController.getWorkspaceServiceTokens
 );
 
+router.get(
+	'/:workspaceId/service-token-data',
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
+	requireWorkspaceAuth({
+		acceptedRoles: [ADMIN, MEMBER],
+		acceptedStatuses: [GRANTED]
+	}),
+	param('workspaceId').exists().trim(),
+	validateRequest,
+	workspaceController.getWorkspaceServiceTokenData
+);
+
 export default router;

backend/src/routes/v2/index.ts

@@ -1,7 +1,9 @@
 import secret from './secret';
 import workspace from './workspace';
+import serviceTokenData from './serviceTokenData';
 
 export {
     secret,
-    workspace
+    workspace,
+    serviceTokenData
 }

backend/src/routes/v2/serviceTokenData.ts

@@ -0,0 +1,61 @@
+import express from 'express';
+const router = express.Router();
+import {
+    requireAuth,
+    requireWorkspaceAuth,
+    requireServiceTokenDataAuth,
+    validateRequest
+} from '../../middleware';
+import { param, body } from 'express-validator';
+import {
+    ADMIN,
+    MEMBER,
+    COMPLETED,
+    GRANTED
+} from '../../variables';
+import { serviceTokenDataController } from '../../controllers/v2';
+
+router.get(
+    '/',
+    requireAuth({
+        acceptedAuthModes: ['serviceToken']
+    }),
+    serviceTokenDataController.getServiceTokenData
+);
+
+router.post(
+    '/',
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
+    requireWorkspaceAuth({
+        acceptedRoles: [ADMIN, MEMBER],
+        acceptedStatuses: [COMPLETED, GRANTED],
+        location: 'body'
+    }),
+    body('name').exists().trim(),
+    body('workspaceId'),
+    body('environment'),
+    body('encryptedKey'),
+    body('iv'),
+    body('tag'),
+    body('expiresIn'), // measured in ms
+    validateRequest,
+    serviceTokenDataController.createServiceTokenData
+);
+
+router.delete(
+    '/:serviceTokenDataId',
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
+    requireServiceTokenDataAuth({
+        acceptedRoles: [ADMIN, MEMBER],
+        acceptedStatuses: [COMPLETED, GRANTED],
+    }),
+    param('serviceTokenDataId').exists().trim(),
+    validateRequest,
+    serviceTokenDataController.deleteServiceTokenData
+);
+
+export default router;

backend/src/routes/v2/workspace.ts

@@ -4,137 +4,16 @@ import { body, param, query } from 'express-validator';
 import {
 	requireAuth,
 	requireWorkspaceAuth,
-	requireServiceTokenAuth,
 	validateRequest
 } from '../../middleware';
 import { ADMIN, MEMBER, COMPLETED, GRANTED } from '../../variables';
-import { membershipController } from '../../controllers/v1';
 import { workspaceController } from '../../controllers/v2';
 
-router.get(
-	'/:workspaceId/keys',
-	requireAuth,
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		acceptedStatuses: [COMPLETED, GRANTED]
-	}),
-	param('workspaceId').exists().trim(),
-	validateRequest,
-	workspaceController.getWorkspacePublicKeys
-);
-
-router.get(
-	'/:workspaceId/users',
-	requireAuth,
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		acceptedStatuses: [COMPLETED, GRANTED]
-	}),
-	param('workspaceId').exists().trim(),
-	validateRequest,
-	workspaceController.getWorkspaceMemberships
-);
-
-router.get('/', requireAuth, workspaceController.getWorkspaces);
-
-router.get(
-	'/:workspaceId',
-	requireAuth,
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		acceptedStatuses: [COMPLETED, GRANTED]
-	}),
-	param('workspaceId').exists().trim(),
-	validateRequest,
-	workspaceController.getWorkspace
-);
-
-router.post(
-	'/',
-	requireAuth,
-	body('workspaceName').exists().trim().notEmpty(),
-	body('organizationId').exists().trim().notEmpty(),
-	validateRequest,
-	workspaceController.createWorkspace
-);
-
-router.delete(
-	'/:workspaceId',
-	requireAuth,
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN],
-		acceptedStatuses: [GRANTED]
-	}),
-	param('workspaceId').exists().trim(),
-	validateRequest,
-	workspaceController.deleteWorkspace
-);
-
-router.post(
-	'/:workspaceId/name',
-	requireAuth,
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		acceptedStatuses: [COMPLETED, GRANTED]
-	}),
-	param('workspaceId').exists().trim(),
-	body('name').exists().trim().notEmpty(),
-	validateRequest,
-	workspaceController.changeWorkspaceName
-);
-
-router.post(
-	'/:workspaceId/invite-signup',
-	requireAuth,
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		acceptedStatuses: [GRANTED]
-	}),
-	param('workspaceId').exists().trim(),
-	body('email').exists().trim().notEmpty(),
-	validateRequest,
-	membershipController.inviteUserToWorkspace
-);
-
-router.get(
-	'/:workspaceId/integrations',
-	requireAuth,
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		acceptedStatuses: [GRANTED]
-	}),
-	param('workspaceId').exists().trim(),
-	validateRequest,
-	workspaceController.getWorkspaceIntegrations
-);
-
-router.get(
-	'/:workspaceId/authorizations',
-	requireAuth,
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		acceptedStatuses: [GRANTED]
-	}),
-	param('workspaceId').exists().trim(),
-	validateRequest,
-	workspaceController.getWorkspaceIntegrationAuthorizations
-);
-
-router.get( // TODO: modify
-	'/:workspaceId/service-tokens',
-	requireAuth,
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		acceptedStatuses: [GRANTED]
-	}),
-	param('workspaceId').exists().trim(),
-	validateRequest,
-	workspaceController.getWorkspaceServiceTokens
-);
-
 router.post(
 	'/:workspaceId/secrets',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [COMPLETED, GRANTED]
@@ -150,7 +29,9 @@ router.post(
 
 router.get(
 	'/:workspaceId/secrets',
-	requireAuth,
+	requireAuth({
+		acceptedAuthModes: ['jwt', 'serviceToken']
+	}),
 	requireWorkspaceAuth({
 		acceptedRoles: [ADMIN, MEMBER],
 		acceptedStatuses: [COMPLETED, GRANTED]
@@ -162,15 +43,18 @@ router.get(
 	workspaceController.pullSecrets
 );
 
-router.get( // TODO: modify based on upcoming serviceTokenData changes
-	'/:workspaceId/secrets-service-token',
-	requireServiceTokenAuth,
-	query('environment').exists().trim(),
-	query('channel'),
+router.get(
+	'/:workspaceId/key',
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
+	requireWorkspaceAuth({
+		acceptedRoles: [ADMIN, MEMBER],
+		acceptedStatuses: [COMPLETED, GRANTED]
+	}),	
 	param('workspaceId').exists().trim(),
-	validateRequest,
-	workspaceController.pullSecretsServiceToken
+	validateRequest,	
+	workspaceController.getWorkspaceKey
 );
 
-
 export default router;

backend/src/types/express/index.d.ts

@@ -16,6 +16,7 @@ declare global {
 			secretSnapshot: any;
 			serviceToken: any;
 			accessToken: any;
+			serviceTokenData: any;
 			query?: any;
 		}
 	}

backend/src/utils/errors.ts

@@ -143,4 +143,14 @@ export const ActionNotFoundError = (error?: Partial<RequestErrorContext>) => new
     stack: error?.stack
 });
 
+//* ----->[SERVICE TOKEN DATA ERRORS]<-----
+export const ServiceTokenDataNotFoundError = (error?: Partial<RequestErrorContext>) => new RequestError({
+    logLevel: error?.logLevel ?? LogLevel.ERROR,
+    statusCode: error?.statusCode ?? 404,
+    type: error?.type ?? 'service_token_data_not_found_error',
+    message: error?.message ?? 'The requested service token data was not found',
+    context: error?.context,
+    stack: error?.stack
+})
+
 //* ----->[MISC ERRORS]<-----