Begin service account middleware

backend/src/middleware/requireAuth.ts

@@ -4,7 +4,8 @@ import {
 	validateAuthMode,
 	getAuthUserPayload,
 	getAuthSTDPayload,
-	getAuthAPIKeyPayload
+	getAuthAPIKeyPayload,
+	getAuthSAAKPayload
 } from '../helpers/auth';
 import { 
 	UnauthorizedRequestError
@@ -41,14 +42,22 @@ const requireAuth = ({
 			acceptedAuthModes
 		});
 
+		req.authTokenType = authTokenType;
+
 		// attach auth payloads
 		let serviceTokenData: any;
 		switch (authTokenType) {
+			case 'serviceAccount':
+				req.serviceAccount = await getAuthSAAKPayload({
+					authTokenValue
+				});
+				break;
 			case 'serviceToken':
 				serviceTokenData = await getAuthSTDPayload({
 					authTokenValue
 				});
 				
+				// TODO: bring this into a separate collection
 				requiredServiceTokenPermissions.forEach((requiredServiceTokenPermission) => {
 					if (!serviceTokenData.permissions.includes(requiredServiceTokenPermission)) {
 						return next(UnauthorizedRequestError({ message: 'Failed to authorize service token for endpoint' }));
@@ -60,6 +69,7 @@ const requireAuth = ({
 				
 				break;
 			case 'apiKey':
+				// TODO: deprecate API key
 				req.user = await getAuthAPIKeyPayload({
 					authTokenValue
 				});
@@ -70,7 +80,7 @@ const requireAuth = ({
 				});
 				break;
 		}
-
+		
 		return next();
 	}
 }

backend/src/middleware/requireBotAuth.ts

@@ -20,8 +20,8 @@ const requireBotAuth = ({
         }
         
         await validateMembership({
-            userId: req.user._id.toString(),
-            workspaceId: bot.workspace.toString(),
+            userId: req.user._id,
+            workspaceId: bot.workspace,
             acceptedRoles
         });
         

backend/src/middleware/requireIntegrationAuth.ts

@@ -30,8 +30,8 @@ const requireIntegrationAuth = ({
 		}
 		
 		await validateMembership({
-			userId: req.user._id.toString(),
-			workspaceId: integration.workspace.toString(),
+			userId: req.user._id,
+			workspaceId: integration.workspace,
 			acceptedRoles
 		});
 

backend/src/middleware/requireIntegrationAuthorizationAuth.ts

@@ -38,8 +38,8 @@ const requireIntegrationAuthorizationAuth = ({
 		}
 		
 		await validateMembership({
-			userId: req.user._id.toString(),
-			workspaceId: integrationAuth.workspace._id.toString(),
+			userId: req.user._id,
+			workspaceId: integrationAuth.workspace._id,
 			acceptedRoles
 		});
 

backend/src/middleware/requireMembershipAuth.ts

@@ -40,8 +40,8 @@ const requireMembershipAuth = ({
             if (!userMembership) throw new Error('Failed to validate own membership')
             
             const targetMembership = await validateMembership({
-                userId: req.user._id.toString(),
-                workspaceId: membership.workspace.toString(),
+                userId: req.user._id,
+                workspaceId: membership.workspace,
                 acceptedRoles
             });
             

backend/src/middleware/requireSecretAuth.ts

@@ -32,8 +32,8 @@ const requireSecretAuth = ({
             }
             
             await validateMembership({
-                userId: req.user._id.toString(),
-                workspaceId: secret.workspace.toString(),
+                userId: req.user._id,
+                workspaceId: secret.workspace,
                 acceptedRoles
             });
             

backend/src/middleware/requireServiceTokenDataAuth.ts

@@ -26,8 +26,8 @@ const requireServiceTokenDataAuth = ({
         if (req.user) {
             // case: jwt auth
             await validateMembership({
-                userId: req.user._id.toString(),
-                workspaceId: serviceTokenData.workspace.toString(),
+                userId: req.user._id,
+                workspaceId: serviceTokenData.workspace,
                 acceptedRoles
             });
         }

backend/src/middleware/requireWorkspaceAuth.ts

@@ -1,5 +1,7 @@
 import { Request, Response, NextFunction } from 'express';
+import { Types } from 'mongoose';
 import { validateMembership } from '../helpers/membership';
+import { validateClientForWorkspace } from '../helpers/workspace';
 import { UnauthorizedRequestError } from '../utils/errors';
 
 type req = 'params' | 'body' | 'query';
@@ -13,26 +15,33 @@ type req = 'params' | 'body' | 'query';
  */
 const requireWorkspaceAuth = ({
 	acceptedRoles,
-	location = 'params'
+	locationWorkspaceId,
+	locationEnvironment = undefined
 }: {
 	acceptedRoles: string[];
-	location?: req;
+	locationWorkspaceId: req;
+	locationEnvironment?: req | undefined;
 }) => {
 	return async (req: Request, res: Response, next: NextFunction) => {
 		try {
-			const { workspaceId } = req[location];
-			
-			if (req.user) {
-				// case: jwt auth
-				const membership = await validateMembership({
-					userId: req.user._id.toString(),
-					workspaceId,
-					acceptedRoles
-				});
+			// TODO: throw errors if workspaceId or environemnt are not present
 
+			const workspaceId = req[locationWorkspaceId]?.workspaceId;
+			const environment = locationEnvironment ? req[locationEnvironment]?.environment : undefined;
+			
+			// validate clients
+			const { membership } = await validateClientForWorkspace({
+				userId: req.user?._id,
+				serviceAccountId: req.serviceAccount?._id,
+				serviceTokenDataId: req.serviceTokenData?._id,
+				workspaceId: new Types.ObjectId(workspaceId),
+				environment
+			});
+			
+			if (membership) {
 				req.membership = membership;
 			}
-
+			
 			if (
 				req.serviceTokenData 
 				&& req.serviceTokenData.workspace.toString() !== workspaceId