Add org-scoped auth to project-level endpoints

backend/src/services/secret/secret-service.ts

@@ -37,7 +37,6 @@ import {
   TGetSecretsDTO,
   TGetSecretsRawDTO,
   TGetSecretVersionsDTO,
-  TListSecretVersionDTO,
   TUpdateBulkSecretDTO,
   TUpdateSecretDTO,
   TUpdateSecretRawDTO
@@ -267,8 +266,16 @@ export const secretServiceFactory = ({
     return { secsGroupedByBlindIndex, secrets };
   };
 
-  const createSecret = async ({ path, actor, actorId, environment, projectId, ...inputSecret }: TCreateSecretDTO) => {
-    const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
+  const createSecret = async ({
+    path,
+    actor,
+    actorId,
+    actorOrgScope,
+    environment,
+    projectId,
+    ...inputSecret
+  }: TCreateSecretDTO) => {
+    const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId, actorOrgScope);
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Create,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
@@ -337,8 +344,16 @@ export const secretServiceFactory = ({
     return { ...secret[0], environment, workspace: projectId, tags };
   };
 
-  const updateSecret = async ({ path, actor, actorId, environment, projectId, ...inputSecret }: TUpdateSecretDTO) => {
-    const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
+  const updateSecret = async ({
+    path,
+    actor,
+    actorId,
+    actorOrgScope,
+    environment,
+    projectId,
+    ...inputSecret
+  }: TUpdateSecretDTO) => {
+    const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId, actorOrgScope);
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Edit,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
@@ -429,8 +444,16 @@ export const secretServiceFactory = ({
     return { ...updatedSecret[0], workspace: projectId, environment };
   };
 
-  const deleteSecret = async ({ path, actor, actorId, environment, projectId, ...inputSecret }: TDeleteSecretDTO) => {
-    const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
+  const deleteSecret = async ({
+    path,
+    actor,
+    actorId,
+    actorOrgScope,
+    environment,
+    projectId,
+    ...inputSecret
+  }: TDeleteSecretDTO) => {
+    const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId, actorOrgScope);
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Delete,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
@@ -476,8 +499,16 @@ export const secretServiceFactory = ({
     return { ...deletedSecret[0], _id: deletedSecret[0].id, workspace: projectId, environment };
   };
 
-  const getSecrets = async ({ actorId, path, environment, projectId, actor, includeImports }: TGetSecretsDTO) => {
-    const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
+  const getSecrets = async ({
+    actorId,
+    path,
+    environment,
+    projectId,
+    actor,
+    actorOrgScope,
+    includeImports
+  }: TGetSecretsDTO) => {
+    const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId, actorOrgScope);
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Read,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
@@ -518,6 +549,7 @@ export const secretServiceFactory = ({
   const getSecretByName = async ({
     actorId,
     actor,
+    actorOrgScope,
     projectId,
     environment,
     path,
@@ -526,7 +558,7 @@ export const secretServiceFactory = ({
     version,
     includeImports
   }: TGetASecretDTO) => {
-    const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
+    const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId, actorOrgScope);
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Read,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
@@ -595,11 +627,12 @@ export const secretServiceFactory = ({
     path,
     actor,
     actorId,
+    actorOrgScope,
     environment,
     projectId,
     secrets: inputSecrets
   }: TCreateBulkSecretDTO) => {
-    const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
+    const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId, actorOrgScope);
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Create,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
@@ -649,11 +682,12 @@ export const secretServiceFactory = ({
     path,
     actor,
     actorId,
+    actorOrgScope,
     environment,
     projectId,
     secrets: inputSecrets
   }: TUpdateBulkSecretDTO) => {
-    const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
+    const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId, actorOrgScope);
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Create,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
@@ -721,9 +755,10 @@ export const secretServiceFactory = ({
     environment,
     projectId,
     actor,
-    actorId
+    actorId,
+    actorOrgScope
   }: TDeleteBulkSecretDTO) => {
-    const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
+    const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId, actorOrgScope);
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Create,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
@@ -762,20 +797,15 @@ export const secretServiceFactory = ({
     return secretsDeleted;
   };
 
-  const listSecretVersionsBySecretId = async ({ actorId, actor, limit, offset, secretId }: TListSecretVersionDTO) => {
-    const secret = await secretDAL.findById(secretId);
-    if (!secret) throw new BadRequestError({ message: "Failed to find secret" });
-
-    const folder = await folderDAL.findById(secret.folderId);
-    if (!folder) throw new BadRequestError({ message: "Folder not found" });
-    const { permission } = await permissionService.getProjectPermission(actor, actorId, folder.projectId);
-    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);
-
-    const secretVersions = await secretVersionDAL.find({ secretId }, { limit, offset, sort: [["createdAt", "desc"]] });
-    return secretVersions;
-  };
-
-  const getSecretsRaw = async ({ projectId, path, actor, actorId, environment, includeImports }: TGetSecretsRawDTO) => {
+  const getSecretsRaw = async ({
+    projectId,
+    path,
+    actor,
+    actorId,
+    actorOrgScope,
+    environment,
+    includeImports
+  }: TGetSecretsRawDTO) => {
     const botKey = await projectBotService.getBotKey(projectId);
     if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" });
 
@@ -784,6 +814,7 @@ export const secretServiceFactory = ({
       projectId,
       environment,
       actor,
+      actorOrgScope,
       path,
       includeImports
     });
@@ -806,6 +837,7 @@ export const secretServiceFactory = ({
     environment,
     projectId,
     actorId,
+    actorOrgScope,
     secretName,
     includeImports,
     version
@@ -818,6 +850,7 @@ export const secretServiceFactory = ({
       projectId,
       environment,
       actor,
+      actorOrgScope,
       path,
       secretName,
       type,
@@ -833,6 +866,7 @@ export const secretServiceFactory = ({
     projectId,
     environment,
     actor,
+    actorOrgScope,
     type,
     secretPath,
     secretValue,
@@ -854,6 +888,7 @@ export const secretServiceFactory = ({
       path: secretPath,
       actor,
       actorId,
+      actorOrgScope,
       secretKeyCiphertext: secretKeyEncrypted.ciphertext,
       secretKeyIV: secretKeyEncrypted.iv,
       secretKeyTag: secretKeyEncrypted.tag,
@@ -878,6 +913,7 @@ export const secretServiceFactory = ({
     projectId,
     environment,
     actor,
+    actorOrgScope,
     type,
     secretPath,
     secretValue,
@@ -896,6 +932,7 @@ export const secretServiceFactory = ({
       path: secretPath,
       actor,
       actorId,
+      actorOrgScope,
       secretValueCiphertext: secretValueEncrypted.ciphertext,
       secretValueIV: secretValueEncrypted.iv,
       secretValueTag: secretValueEncrypted.tag,
@@ -914,6 +951,7 @@ export const secretServiceFactory = ({
     projectId,
     environment,
     actor,
+    actorOrgScope,
     type,
     secretPath
   }: TDeleteSecretRawDTO) => {
@@ -927,7 +965,8 @@ export const secretServiceFactory = ({
       type,
       path: secretPath,
       actor,
-      actorId
+      actorId,
+      actorOrgScope
     });
 
     await snapshotService.performSnapshot(secret.folderId);
@@ -936,14 +975,26 @@ export const secretServiceFactory = ({
     return decryptSecretRaw(secret, botKey);
   };
 
-  const getSecretVersions = async ({ actorId, actor, limit = 20, offset = 0, secretId }: TGetSecretVersionsDTO) => {
+  const getSecretVersions = async ({
+    actorId,
+    actor,
+    actorOrgScope,
+    limit = 20,
+    offset = 0,
+    secretId
+  }: TGetSecretVersionsDTO) => {
     const secret = await secretDAL.findById(secretId);
     if (!secret) throw new BadRequestError({ message: "Failed to find secret" });
 
     const folder = await folderDAL.findById(secret.folderId);
     if (!folder) throw new BadRequestError({ message: "Failed to find secret" });
 
-    const { permission } = await permissionService.getProjectPermission(actor, actorId, folder.projectId);
+    const { permission } = await permissionService.getProjectPermission(
+      actor,
+      actorId,
+      folder.projectId,
+      actorOrgScope
+    );
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);
 
     const secretVersions = await secretVersionDAL.find({ secretId }, { offset, limit, sort: [["createdAt", "desc"]] });
@@ -964,7 +1015,6 @@ export const secretServiceFactory = ({
     createSecretRaw,
     updateSecretRaw,
     deleteSecretRaw,
-    listSecretVersionsBySecretId,
     getSecretVersions,
     // external services function
     fnSecretBulkDelete,

backend/src/services/secret/secret-types.ts

@@ -128,12 +128,6 @@ export type TDeleteBulkSecretDTO = {
   }>;
 } & TProjectPermission;
 
-export type TListSecretVersionDTO = {
-  secretId: string;
-  offset?: number;
-  limit?: number;
-} & Omit<TProjectPermission, "projectId">;
-
 export type TGetSecretsRawDTO = {
   path: string;
   environment: string;