feat(rbac): made new permission check for v3 secrets and v2 batch

backend/src/validation/serviceTokenData.ts

@@ -5,6 +5,7 @@ import { validateUserClientForWorkspace } from "./user";
 import { ActorType } from "../ee/models";
 import { AuthData } from "../interfaces/middleware";
 import { z } from "zod";
+import { isValidScope } from "../helpers";
 
 /**
  * Validate authenticated clients for service token with id [serviceTokenId] based
@@ -62,11 +63,13 @@ export const validateServiceTokenDataClientForWorkspace = async ({
   serviceTokenData,
   workspaceId,
   environment,
+  secretPath = "/",
   requiredPermissions
 }: {
   serviceTokenData: IServiceTokenData;
   workspaceId: Types.ObjectId;
   environment?: string;
+  secretPath?: string;
   requiredPermissions?: string[];
 }) => {
   if (!serviceTokenData.workspace.equals(workspaceId)) {
@@ -78,7 +81,6 @@ export const validateServiceTokenDataClientForWorkspace = async ({
 
   if (environment) {
     // case: environment is specified
-
     if (!serviceTokenData.scopes.find(({ environment: tkEnv }) => tkEnv === environment)) {
       // case: invalid environment passed
       throw UnauthorizedRequestError({
@@ -86,6 +88,10 @@ export const validateServiceTokenDataClientForWorkspace = async ({
       });
     }
 
+    if (!isValidScope(serviceTokenData, environment, secretPath)) {
+      throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
+    }
+
     requiredPermissions?.forEach((permission) => {
       if (!serviceTokenData.permissions.includes(permission)) {
         throw UnauthorizedRequestError({