Modify secret snapshots to point to secret versions

backend/src/app.ts

@@ -14,6 +14,7 @@ import { apiLimiter } from './helpers/rateLimiter';
 import {
   workspace as eeWorkspaceRouter,
   secret as eeSecretRouter,
+  secretSnapshot as eeSecretSnapshotRouter,
   action as eeActionRouter
 } from './ee/routes/v1';
 import {
@@ -69,6 +70,7 @@ if (NODE_ENV === 'production') {
 
 // (EE) routes
 app.use('/api/v1/secret', eeSecretRouter);
+app.use('/api/v1/secret-snapshot', eeSecretSnapshotRouter);
 app.use('/api/v1/workspace', eeWorkspaceRouter);
 app.use('/api/v1/action', eeActionRouter);
 

backend/src/ee/controllers/v1/index.ts

@@ -1,11 +1,13 @@
 import * as stripeController from './stripeController';
 import * as secretController from './secretController';
+import * as secretSnapshotController from './secretSnapshotController';
 import * as workspaceController from './workspaceController';
 import * as actionController from './actionController';
 
 export {
     stripeController,
     secretController,
+    secretSnapshotController,
     workspaceController,
     actionController
 }

backend/src/ee/controllers/v1/secretSnapshotController.ts

@@ -0,0 +1,27 @@
+import { Request, Response } from 'express';
+import * as Sentry from '@sentry/node';
+import { SecretSnapshot } from '../../models';
+
+export const getSecretSnapshot = async (req: Request, res: Response) => {
+    let secretSnapshot;
+    try {
+        const { secretSnapshotId } = req.params;
+
+        secretSnapshot = await SecretSnapshot
+            .findById(secretSnapshotId)
+            .populate('secretVersions');
+        
+        if (!secretSnapshot) throw new Error('Failed to find secret snapshot');
+        
+    } catch (err) {
+        Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to get secret snapshot'
+		});
+    }
+    
+    return res.status(200).send({
+        secretSnapshot
+    });
+}

backend/src/ee/helpers/secret.ts

@@ -23,34 +23,44 @@ import {
 }: {
 	workspaceId: string;
 }) => {
+	
 	let secretSnapshot;
 	try {
-		const secrets = await Secret.find({
+		const secretIds = (await Secret.find({
 			workspace: workspaceId
-		});
+		}, '_id')).map((s) => s._id);
+		
+		const latestSecretVersions = (await SecretVersion.aggregate([
+			{
+				$match: { 
+					secret: { 
+						$in: secretIds 
+					} 
+				}
+			},
+			{
+				$group: {
+					_id: '$secret',
+					version: { $max: '$version' },
+					versionId: { $max: '$_id' } // secret version id
+				}
+			},
+			{
+				$sort: { version: -1 }
+			}
+			])
+			.exec())
+			.map((s) => s.versionId);
 			
 		const latestSecretSnapshot = await SecretSnapshot.findOne({
 			workspace: workspaceId
 		}).sort({ version: -1 });
 		
-		if (!latestSecretSnapshot) {
-			// case: no snapshots exist for workspace -> create first snapshot
-			await new SecretSnapshot({
-				workspace: workspaceId,
-				version: 1,
-				secrets 
-			}).save();	
-
-			return;
-		}
-		
-		// case: snapshots exist for workspace
 		secretSnapshot = await new SecretSnapshot({
 			workspace: workspaceId,
-			version: latestSecretSnapshot.version + 1,
+			version: latestSecretSnapshot ? latestSecretSnapshot.version + 1 : 1,
-			secrets 
+			secretVersions: latestSecretVersions
 		}).save();
-		
 	} catch (err) {
 		Sentry.setUser(null);
 		Sentry.captureException(err);

backend/src/ee/middleware/index.ts

@@ -0,0 +1,7 @@
+import requireLicenseAuth from './requireLicenseAuth';
+import requireSecretSnapshotAuth from './requireSecretSnapshotAuth';
+
+export {
+    requireLicenseAuth,
+    requireSecretSnapshotAuth
+}

backend/src/ee/middleware/requireSecretSnapshotAuth.ts

@@ -0,0 +1,50 @@
+import { Request, Response, NextFunction } from 'express';
+import { UnauthorizedRequestError, SecretSnapshotNotFoundError } from '../../utils/errors';
+import { SecretSnapshot } from '../models';
+import {
+    validateMembership
+} from '../../helpers/membership';
+
+/**
+ * Validate if user on request has proper membership for secret snapshot
+ * @param {Object} obj
+ * @param {String[]} obj.acceptedRoles - accepted workspace roles
+ * @param {String[]} obj.acceptedStatuses - accepted workspace statuses
+ * @param {String[]} obj.location - location of [workspaceId] on request (e.g. params, body) for parsing
+ */
+const requireSecretSnapshotAuth = ({
+    acceptedRoles,
+    acceptedStatuses
+}: {
+    acceptedRoles: string[];
+    acceptedStatuses: string[];
+}) => {
+    return async (req: Request, res: Response, next: NextFunction) => {
+        try {
+            const { secretSnapshotId } = req.params;
+            
+            const secretSnapshot = await SecretSnapshot.findById(secretSnapshotId);
+            
+            if (!secretSnapshot) {
+                return next(SecretSnapshotNotFoundError({
+                    message: 'Failed to find secret snapshot'
+                }));
+            }
+            
+            await validateMembership({
+                userId: req.user._id.toString(),
+                workspaceId: secretSnapshot.workspace.toString(),
+                acceptedRoles,
+                acceptedStatuses
+            });
+            
+            req.secretSnapshot = secretSnapshot as any;
+
+            next();
+        } catch (err) {
+            return next(UnauthorizedRequestError({ message: 'Unable to authenticate secret snapshot' }));
+        }
+    }
+}
+
+export default requireSecretSnapshotAuth;

backend/src/ee/models/secretSnapshot.ts

@@ -1,31 +1,9 @@
 import { Schema, model, Types } from 'mongoose';
-import {
-	SECRET_SHARED,
-	SECRET_PERSONAL,
-	ENV_DEV,
-	ENV_TESTING,
-	ENV_STAGING,
-	ENV_PROD
-} from '../../variables';
 
 export interface ISecretSnapshot {
     workspace: Types.ObjectId;
     version: number;
-    secrets: {
+    secretVersions: Types.ObjectId[];
-        version: number;
-        workspace: Types.ObjectId;
-        type: string;
-        user: Types.ObjectId;
-        environment: string;
-        secretKeyCiphertext: string;
-        secretKeyIV: string;
-        secretKeyTag: string;
-        secretKeyHash: string;
-        secretValueCiphertext: string;
-        secretValueIV: string;
-        secretValueTag: string;
-        secretValueHash: string;
-    }[]
 }
 
 const secretSnapshotSchema = new Schema<ISecretSnapshot>(
@@ -39,64 +17,10 @@ const secretSnapshotSchema = new Schema<ISecretSnapshot>(
             type: Number,
             required: true
         },
-        secrets: [{
+        secretVersions: [{
-            version: {
+            type: Schema.Types.ObjectId,
-                type: Number,
+            ref: 'SecretVersion',
-                default: 1,
+            required: true
-                required: true
-            },
-            workspace: {
-                type: Schema.Types.ObjectId,
-                ref: 'Workspace',
-                required: true
-            },
-            type: {
-                type: String,
-                enum: [SECRET_SHARED, SECRET_PERSONAL],
-                required: true
-            },
-            user: {
-                // user associated with the personal secret
-                type: Schema.Types.ObjectId,
-                ref: 'User'
-            },
-            environment: {
-                type: String,
-                enum: [ENV_DEV, ENV_TESTING, ENV_STAGING, ENV_PROD],
-                required: true
-            },
-            secretKeyCiphertext: {
-                type: String,
-                required: true
-            },
-            secretKeyIV: {
-                type: String, // symmetric
-                required: true
-            },
-            secretKeyTag: {
-                type: String, // symmetric
-                required: true
-            },
-            secretKeyHash: {
-                type: String,
-                required: true
-            },
-            secretValueCiphertext: {
-                type: String,
-                required: true
-            },
-            secretValueIV: {
-                type: String, // symmetric
-                required: true
-            },
-            secretValueTag: {
-                type: String, // symmetric
-                required: true
-            },
-            secretValueHash: {
-                type: String,
-                required: true
-            }
         }]
     },
     {

backend/src/ee/models/secretVersion.ts

@@ -1,9 +1,30 @@
 import { Schema, model, Types } from 'mongoose';
+import {
+	SECRET_SHARED,
+	SECRET_PERSONAL,
+	ENV_DEV,
+	ENV_TESTING,
+	ENV_STAGING,
+	ENV_PROD
+} from '../../variables';
+
+/**
+ * TODO: 
+ * 1. Modify SecretVersion to also contain XX
+ * - type
+ * - user
+ * - environment
+ * 2. Modify SecretSnapshot to point to arrays of SecretVersion
+ */
 
 export interface ISecretVersion {
     _id?: Types.ObjectId;
     secret: Types.ObjectId;
     version: number;
+	workspace: Types.ObjectId; // new
+	type: string; // new
+	user: Types.ObjectId; // new
+	environment: string; // new
     isDeleted: boolean;
     secretKeyCiphertext: string;
 	secretKeyIV: string;
@@ -27,6 +48,26 @@ const secretVersionSchema = new Schema<ISecretVersion>(
             default: 1,
             required: true
         },
+		workspace: {
+			type: Schema.Types.ObjectId,
+			ref: 'Workspace',
+			required: true
+		},
+		type: {
+			type: String,
+			enum: [SECRET_SHARED, SECRET_PERSONAL],
+			required: true
+		},
+		user: {
+			// user associated with the personal secret
+			type: Schema.Types.ObjectId,
+			ref: 'User'
+		},
+		environment: {
+			type: String,
+			enum: [ENV_DEV, ENV_TESTING, ENV_STAGING, ENV_PROD],
+			required: true
+		},
         isDeleted: {
             type: Boolean,
             default: false,

backend/src/ee/routes/v1/index.ts

@@ -1,9 +1,11 @@
 import secret from './secret';
+import secretSnapshot from './secretSnapshot';
 import workspace from './workspace';
 import action from './action';
 
 export {
     secret,
+    secretSnapshot,
     workspace,
     action
 }

backend/src/ee/routes/v1/secret.ts

@@ -5,7 +5,7 @@ import {
 	requireSecretAuth,
     validateRequest
 } from '../../../middleware';
-import { body, query, param } from 'express-validator';
+import { query, param } from 'express-validator';
 import { secretController } from '../../controllers/v1';
 import { ADMIN, MEMBER, COMPLETED, GRANTED } from '../../../variables';
 

backend/src/ee/routes/v1/secretSnapshot.ts

@@ -0,0 +1,26 @@
+import express from 'express';
+const router = express.Router();
+import {
+    requireSecretSnapshotAuth
+} from '../../middleware';
+import {
+    requireAuth,
+    validateRequest
+} from '../../../middleware';
+import { param } from 'express-validator';
+import { ADMIN, MEMBER, GRANTED } from '../../../variables';
+import { secretSnapshotController } from '../../controllers/v1';
+
+router.get(
+    '/:secretSnapshotId',
+    requireAuth,
+    requireSecretSnapshotAuth({
+        acceptedRoles: [ADMIN, MEMBER],
+		acceptedStatuses: [GRANTED]
+    }),
+    param('secretSnapshotId').exists().trim(),
+    validateRequest,
+    secretSnapshotController.getSecretSnapshot
+);
+
+export default router;

backend/src/helpers/secret.ts

@@ -1,4 +1,5 @@
 import * as Sentry from '@sentry/node';
+import { Types } from 'mongoose';
 import {
 	Secret,
 	ISecret,
@@ -8,7 +9,6 @@ import {
 	EELogService
 } from '../ee/services';
 import {
-	SecretVersion,
 	IAction
 } from '../ee/models';
 import { 
@@ -105,10 +105,8 @@ const v1PushSecrets = async ({
 				_id: { $in: toDelete }
 			});
 
-			await SecretVersion.updateMany({
+			await EESecretService.markDeletedSecretVersions({
-				secret: { $in: toDelete }
+				secretIds: toDelete
-			}, {
-				isDeleted: true
 			});
 		}
 		
@@ -191,6 +189,10 @@ const v1PushSecrets = async ({
 				return ({
 					secret: _id,
 					version: version ? version + 1 : 1,
+					workspace: new Types.ObjectId(workspaceId),
+					type: newSecret.type,
+					user: new Types.ObjectId(userId),
+					environment,
 					isDeleted: false,
 					secretKeyCiphertext: newSecret.ciphertextKey,
 					secretKeyIV: newSecret.ivKey,
@@ -242,6 +244,11 @@ const v1PushSecrets = async ({
 			EESecretService.addSecretVersions({
 				secretVersions: newSecrets.map(({
 					_id,
+					version,
+					workspace,
+					type,
+					user,
+					environment,
 					secretKeyCiphertext,
 					secretKeyIV,
 					secretKeyTag,
@@ -252,7 +259,11 @@ const v1PushSecrets = async ({
 					secretValueHash
 				}) => ({
 					secret: _id,
-					version: 1,
+					version,
+					workspace,
+					type,
+					user,
+					environment,
 					isDeleted: false,
 					secretKeyCiphertext,
 					secretKeyIV,
@@ -419,29 +430,14 @@ const v1PushSecrets = async ({
 			// (EE) add secret versions for updated secrets
 			await EESecretService.addSecretVersions({
 				secretVersions: toUpdate.map((s) => {
-					const {
-						secretKeyCiphertext,
-						secretKeyIV,
-						secretKeyTag,
-						secretKeyHash,
-						secretValueCiphertext,
-						secretValueIV,
-						secretValueTag,
-						secretValueHash,
-					} = newSecretsObj[`${s.type}-${s.secretKeyHash}`];
-
 					return ({
+						...newSecretsObj[`${s.type}-${s.secretKeyHash}`],
 						secret: s._id,
 						version: s.version ? s.version + 1 : 1,
-						isDeleted: false,
+						workspace: new Types.ObjectId(workspaceId),
-						secretKeyCiphertext,
+						user: s.user,
-						secretKeyIV,
+						environment: s.environment,
-						secretKeyTag,
+						isDeleted: false
-						secretKeyHash,
-						secretValueCiphertext,
-						secretValueIV,
-						secretValueTag,
-						secretValueHash
 					})
 				}) 
 			});
@@ -474,28 +470,10 @@ const v1PushSecrets = async ({
 
 			// (EE) add secret versions for new secrets
 			EESecretService.addSecretVersions({
-				secretVersions: newSecrets.map(({
+				secretVersions: newSecrets.map((s) => ({
-					_id,
+					...s,
-					secretKeyCiphertext,
+					secret: s._id,
-					secretKeyIV,
+					isDeleted: false
-					secretKeyTag,
-					secretKeyHash,
-					secretValueCiphertext,
-					secretValueIV,
-					secretValueTag,
-					secretValueHash
-				}) => ({
-					secret: _id,
-					version: 1,
-					isDeleted: false,
-					secretKeyCiphertext,
-					secretKeyIV,
-					secretKeyTag,
-					secretKeyHash,
-					secretValueCiphertext,
-					secretValueIV,
-					secretValueTag,
-					secretValueHash
 				}))
 			});
 

backend/src/types/express/index.d.ts

@@ -13,6 +13,7 @@ declare global {
 			integrationAuth: any;
 			bot: any;
 			secret: any;
+			secretSnapshot: any;
 			serviceToken: any;
 			accessToken: any;
 			query?: any;

backend/src/utils/errors.ts

@@ -123,6 +123,16 @@ export const SecretNotFoundError = (error?: Partial<RequestErrorContext>) => new
     stack: error?.stack
 });
 
+//* ----->[SECRET SNAPSHOT ERRORS]<-----
+export const SecretSnapshotNotFoundError = (error?: Partial<RequestErrorContext>) => new RequestError({
+    logLevel: error?.logLevel ?? LogLevel.ERROR,
+    statusCode: error?.statusCode ?? 404,
+    type: error?.type ?? 'secret_snapshot_not_found_error',
+    message: error?.message ?? 'The requested secret snapshot was not found',
+    context: error?.context,
+    stack: error?.stack
+});
+
 //* ----->[ACTION ERRORS]<-----
 export const ActionNotFoundError = (error?: Partial<RequestErrorContext>) => new RequestError({
     logLevel: error?.logLevel ?? LogLevel.ERROR,