Add frontend, backend and CLI

backend/src/middleware/index.ts

@@ -0,0 +1,19 @@
+import requireAuth from './requireAuth';
+import requireSignupAuth from './requireSignupAuth';
+import requireWorkspaceAuth from './requireWorkspaceAuth';
+import requireOrganizationAuth from './requireOrganizationAuth';
+import requireIntegrationAuth from './requireIntegrationAuth';
+import requireIntegrationAuthorizationAuth from './requireIntegrationAuthorizationAuth';
+import requireServiceTokenAuth from './requireServiceTokenAuth';
+import validateRequest from './validateRequest';
+
+export {
+	requireAuth,
+	requireSignupAuth,
+	requireWorkspaceAuth,
+	requireOrganizationAuth,
+	requireIntegrationAuth,
+	requireIntegrationAuthorizationAuth,
+	requireServiceTokenAuth,
+	validateRequest
+};

backend/src/middleware/requireAuth.ts

@@ -0,0 +1,51 @@
+import jwt from 'jsonwebtoken';
+import { Request, Response, NextFunction } from 'express';
+import * as Sentry from '@sentry/node';
+import { User } from '../models';
+import { JWT_AUTH_SECRET } from '../config';
+
+declare module 'jsonwebtoken' {
+	export interface UserIDJwtPayload extends jwt.JwtPayload {
+		userId: string;
+	}
+}
+
+/**
+ * Validate if JWT (auth) token on request is valid (e.g. not expired),
+ * if there is an associated user, and if that user is fully setup.
+ * @param req - express request object
+ * @param res - express response object
+ * @param next - express next function
+ * @returns
+ */
+const requireAuth = async (req: Request, res: Response, next: NextFunction) => {
+	// JWT authentication middleware
+	try {
+		if (!req.headers?.authorization)
+			throw new Error('Failed to locate authorization header');
+
+		const token = req.headers.authorization.split(' ')[1];
+		const decodedToken = <jwt.UserIDJwtPayload>(
+			jwt.verify(token, JWT_AUTH_SECRET)
+		);
+
+		const user = await User.findOne({
+			_id: decodedToken.userId
+		}).select('+publicKey');
+
+		if (!user) throw new Error('Failed to authenticate unfound user');
+		if (!user?.publicKey)
+			throw new Error('Failed to authenticate not fully set up account');
+
+		req.user = user;
+		return next();
+	} catch (err) {
+		Sentry.setUser(null);
+		Sentry.captureException(err);
+		return res.status(401).send({
+			error: 'Failed to authenticate user. Try logging in'
+		});
+	}
+};
+
+export default requireAuth;

backend/src/middleware/requireIntegrationAuth.ts

@@ -0,0 +1,76 @@
+import * as Sentry from '@sentry/node';
+import { Request, Response, NextFunction } from 'express';
+import { Integration, IntegrationAuth, Membership } from '../models';
+import { getOAuthAccessToken } from '../helpers/integrationAuth';
+
+/**
+ * Validate if user on request is a member of workspace with proper roles associated
+ * with the integration on request params.
+ * @param {Object} obj
+ * @param {String[]} obj.acceptedRoles - accepted workspace roles
+ * @param {String[]} obj.acceptedStatuses - accepted workspace statuses
+ */
+const requireIntegrationAuth = ({
+	acceptedRoles,
+	acceptedStatuses
+}: {
+	acceptedRoles: string[];
+	acceptedStatuses: string[];
+}) => {
+	return async (req: Request, res: Response, next: NextFunction) => {
+		// integration authorization middleware
+
+		try {
+			const { integrationId } = req.params;
+
+			// validate integration accessibility
+			const integration = await Integration.findOne({
+				_id: integrationId
+			});
+
+			if (!integration) {
+				throw new Error('Failed to find integration');
+			}
+
+			const membership = await Membership.findOne({
+				user: req.user._id,
+				workspace: integration.workspace
+			});
+
+			if (!membership) {
+				throw new Error('Failed to find integration workspace membership');
+			}
+
+			if (!acceptedRoles.includes(membership.role)) {
+				throw new Error('Failed to validate workspace membership role');
+			}
+
+			if (!acceptedStatuses.includes(membership.status)) {
+				throw new Error('Failed to validate workspace membership status');
+			}
+
+			const integrationAuth = await IntegrationAuth.findOne({
+				_id: integration.integrationAuth
+			}).select(
+				'+refreshCiphertext +refreshIV +refreshTag +accessCiphertext +accessIV +accessTag +accessExpiresAt'
+			);
+
+			if (!integrationAuth) {
+				throw new Error('Failed to find integration authorization');
+			}
+
+			req.integration = integration;
+			req.accessToken = await getOAuthAccessToken({ integrationAuth });
+
+			return next();
+		} catch (err) {
+			Sentry.setUser(null);
+			Sentry.captureException(err);
+			return res.status(401).send({
+				error: 'Failed integration authorization'
+			});
+		}
+	};
+};
+
+export default requireIntegrationAuth;

backend/src/middleware/requireIntegrationAuthorizationAuth.ts

@@ -0,0 +1,72 @@
+import * as Sentry from '@sentry/node';
+import { Request, Response, NextFunction } from 'express';
+import { IntegrationAuth, Membership } from '../models';
+import { decryptSymmetric } from '../utils/crypto';
+import { getOAuthAccessToken } from '../helpers/integrationAuth';
+
+/**
+ * Validate if user on request is a member of workspace with proper roles associated
+ * with the integration authorization on request params.
+ * @param {Object} obj
+ * @param {String[]} obj.acceptedRoles - accepted workspace roles
+ * @param {String[]} obj.acceptedStatuses - accepted workspace statuses
+ * @param {Boolean} obj.attachRefresh - whether or not to decrypt and attach integration authorization refresh token onto request
+ */
+const requireIntegrationAuthorizationAuth = ({
+	acceptedRoles,
+	acceptedStatuses
+}: {
+	acceptedRoles: string[];
+	acceptedStatuses: string[];
+}) => {
+	return async (req: Request, res: Response, next: NextFunction) => {
+		// (authorization) integration authorization middleware
+
+		try {
+			const { integrationAuthId } = req.params;
+
+			const integrationAuth = await IntegrationAuth.findOne({
+				_id: integrationAuthId
+			}).select(
+				'+refreshCiphertext +refreshIV +refreshTag +accessCiphertext +accessIV +accessTag +accessExpiresAt'
+			);
+
+			if (!integrationAuth) {
+				throw new Error('Failed to find integration authorization');
+			}
+
+			const membership = await Membership.findOne({
+				user: req.user._id,
+				workspace: integrationAuth.workspace
+			});
+
+			if (!membership) {
+				throw new Error(
+					'Failed to find integration authorization workspace membership'
+				);
+			}
+
+			if (!acceptedRoles.includes(membership.role)) {
+				throw new Error('Failed to validate workspace membership role');
+			}
+
+			if (!acceptedStatuses.includes(membership.status)) {
+				throw new Error('Failed to validate workspace membership status');
+			}
+
+			req.integrationAuth = integrationAuth;
+
+			// TODO: make compatible with other integration types since they won't necessarily have access tokens
+			req.accessToken = await getOAuthAccessToken({ integrationAuth });
+			return next();
+		} catch (err) {
+			Sentry.setUser(null);
+			Sentry.captureException(err);
+			return res.status(401).send({
+				error: 'Failed (authorization) integration authorizationt'
+			});
+		}
+	};
+};
+
+export default requireIntegrationAuthorizationAuth;

backend/src/middleware/requireOrganizationAuth.ts

@@ -0,0 +1,54 @@
+import * as Sentry from '@sentry/node';
+import { Request, Response, NextFunction } from 'express';
+import { IOrganization, MembershipOrg } from '../models';
+
+/**
+ * Validate if user on request is a member with proper roles for organization
+ * on request params.
+ * @param {Object} obj
+ * @param {String[]} obj.acceptedRoles - accepted organization roles
+ * @param {String[]} obj.acceptedStatuses - accepted organization statuses
+ */
+const requireOrganizationAuth = ({
+	acceptedRoles,
+	acceptedStatuses
+}: {
+	acceptedRoles: string[];
+	acceptedStatuses: string[];
+}) => {
+	return async (req: Request, res: Response, next: NextFunction) => {
+		// organization authorization middleware
+
+		try {
+			// validate organization membership
+			const membershipOrg = await MembershipOrg.findOne({
+				user: req.user._id,
+				organization: req.params.organizationId
+			}).populate<{ organization: IOrganization }>('organization');
+
+			if (!membershipOrg) {
+				throw new Error('Failed to find organization membership');
+			}
+
+			if (!acceptedRoles.includes(membershipOrg.role)) {
+				throw new Error('Failed to validate organization membership role');
+			}
+
+			if (!acceptedStatuses.includes(membershipOrg.status)) {
+				throw new Error('Failed to validate organization membership status');
+			}
+
+			req.membershipOrg = membershipOrg;
+
+			return next();
+		} catch (err) {
+			Sentry.setUser(null);
+			Sentry.captureException(err);
+			return res.status(401).send({
+				error: 'Failed organization authorization'
+			});
+		}
+	};
+};
+
+export default requireOrganizationAuth;

backend/src/middleware/requireServiceTokenAuth.ts

@@ -0,0 +1,56 @@
+import jwt from 'jsonwebtoken';
+import { Request, Response, NextFunction } from 'express';
+import * as Sentry from '@sentry/node';
+import { ServiceToken } from '../models';
+import { JWT_SERVICE_SECRET } from '../config';
+
+declare module 'jsonwebtoken' {
+	export interface UserIDJwtPayload extends jwt.JwtPayload {
+		userId: string;
+	}
+}
+
+/**
+ * Validate if JWT (service) token on request is valid (e.g. not expired),
+ * and if there is an associated service token
+ * @param req - express request object
+ * @param res - express response object
+ * @param next - express next function
+ * @returns
+ */
+const requireServiceTokenAuth = async (
+	req: Request,
+	res: Response,
+	next: NextFunction
+) => {
+	// JWT service token middleware
+	try {
+		if (!req.headers?.authorization)
+			throw new Error('Failed to locate authorization header');
+
+		const token = req.headers.authorization.split(' ')[1];
+
+		const decodedToken = <jwt.UserIDJwtPayload>(
+			jwt.verify(token, JWT_SERVICE_SECRET)
+		);
+
+		const serviceToken = await ServiceToken.findOne({
+			_id: decodedToken.serviceTokenId
+		})
+			.populate('user', '+publicKey')
+			.select('+encryptedKey +publicKey +nonce');
+
+		if (!serviceToken) throw new Error('Failed to find service token');
+
+		req.serviceToken = serviceToken;
+		return next();
+	} catch (err) {
+		Sentry.setUser(null);
+		Sentry.captureException(err);
+		return res.status(401).send({
+			error: 'Failed to authenticate service token'
+		});
+	}
+};
+
+export default requireServiceTokenAuth;

backend/src/middleware/requireSignupAuth.ts

@@ -0,0 +1,52 @@
+import jwt from 'jsonwebtoken';
+import { Request, Response, NextFunction } from 'express';
+import * as Sentry from '@sentry/node';
+import { User } from '../models';
+import { JWT_SIGNUP_SECRET } from '../config';
+
+declare module 'jsonwebtoken' {
+	export interface UserIDJwtPayload extends jwt.JwtPayload {
+		userId: string;
+	}
+}
+
+/**
+ * Validate if JWT temporary token on request is valid (e.g. not expired)
+ * and if there is an associated user.
+ */
+const requireSignupAuth = async (
+	req: Request,
+	res: Response,
+	next: NextFunction
+) => {
+	// JWT (temporary) authentication middleware for complete signup
+
+	try {
+		if (!req.headers?.authorization)
+			throw new Error('Failed to locate authorization header');
+
+		const token = req.headers.authorization.split(' ')[1];
+		const decodedToken = <jwt.UserIDJwtPayload>(
+			jwt.verify(token, JWT_SIGNUP_SECRET)
+		);
+
+		const user = await User.findOne({
+			_id: decodedToken.userId
+		}).select('+publicKey');
+
+		if (!user)
+			throw new Error('Failed to temporarily authenticate unfound user');
+
+		req.user = user;
+		return next();
+	} catch (err) {
+		Sentry.setUser(null);
+		Sentry.captureException(err);
+		return res.status(401).send({
+			error:
+				'Failed to temporarily authenticate user for complete account. Try logging in'
+		});
+	}
+};
+
+export default requireSignupAuth;

backend/src/middleware/requireWorkspaceAuth.ts

@@ -0,0 +1,60 @@
+import * as Sentry from '@sentry/node';
+import { Request, Response, NextFunction } from 'express';
+import { Membership, IWorkspace } from '../models';
+
+type req = 'params' | 'body' | 'query';
+
+/**
+ * Validate if user on request is a member with proper roles for workspace
+ * on request params.
+ * @param {Object} obj
+ * @param {String[]} obj.acceptedRoles - accepted workspace roles
+ * @param {String[]} obj.acceptedStatuses - accepted workspace statuses
+ * @param {String[]} obj.location - location of [workspaceId] on request (e.g. params, body) for parsing
+ */
+const requireWorkspaceAuth = ({
+	acceptedRoles,
+	acceptedStatuses,
+	location = 'params'
+}: {
+	acceptedRoles: string[];
+	acceptedStatuses: string[];
+	location?: req;
+}) => {
+	return async (req: Request, res: Response, next: NextFunction) => {
+		// workspace authorization middleware
+
+		try {
+			// validate workspace membership
+
+			const membership = await Membership.findOne({
+				user: req.user._id,
+				workspace: req[location].workspaceId
+			}).populate<{ workspace: IWorkspace }>('workspace');
+
+			if (!membership) {
+				throw new Error('Failed to find workspace membership');
+			}
+
+			if (!acceptedRoles.includes(membership.role)) {
+				throw new Error('Failed to validate workspace membership role');
+			}
+
+			if (!acceptedStatuses.includes(membership.status)) {
+				throw new Error('Failed to validate workspace membership status');
+			}
+
+			req.membership = membership;
+
+			return next();
+		} catch (err) {
+			Sentry.setUser(null);
+			Sentry.captureException(err);
+			return res.status(401).send({
+				error: 'Failed workspace authorization'
+			});
+		}
+	};
+};
+
+export default requireWorkspaceAuth;

backend/src/middleware/validateRequest.ts

@@ -0,0 +1,31 @@
+import { Request, Response, NextFunction } from 'express';
+import * as Sentry from '@sentry/node';
+import { validationResult } from 'express-validator';
+
+/**
+ * Validate intended inputs on [req] via express-validator
+ * @param req - express request object
+ * @param res - express response object
+ * @param next - express next function
+ * @returns
+ */
+const validate = (req: Request, res: Response, next: NextFunction) => {
+	// express validator middleware
+
+	try {
+		const errors = validationResult(req);
+		if (!errors.isEmpty()) {
+			return res.status(400).json({ errors: errors.array() });
+		}
+
+		return next();
+	} catch (err) {
+		Sentry.setUser(null);
+		Sentry.captureException(err);
+		return res.status(401).send({
+			error: "Looks like you're unauthenticated . Try logging in"
+		});
+	}
+};
+
+export default validate;