Add required endpoints/functions for service account to create service tokens

backend/src/helpers/secret.ts

@@ -21,7 +21,6 @@ import {
 	ACTION_READ_SECRETS
 } from '../variables';
 import _ from 'lodash';
-import { ABILITY_WRITE } from '../variables/organization';
 import { BadRequestError, UnauthorizedRequestError } from '../utils/errors';
 
 interface V1PushSecret {

backend/src/helpers/secrets.ts

@@ -18,7 +18,7 @@ import {
 import {
     validateServiceAccountClientForSecrets
 } from '../helpers/serviceAccount';
-import { BadRequestError } from '../utils/errors';
+import { BadRequestError, UnauthorizedRequestError } from '../utils/errors';
 import {
     AUTH_MODE_JWT,
     AUTH_MODE_SERVICE_ACCOUNT,
@@ -60,21 +60,23 @@ const validateClientForSecrets = async ({
     }
 
     if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
-        // TODO
         await validateUserClientForSecrets({
             user: authData.authPayload,
             secrets,
             requiredPermissions
         });
+        
+        return secrets;
     }
     
     if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
-        // TODO
         await validateServiceAccountClientForSecrets({
             serviceAccount: authData.authPayload,
             secrets,
             requiredPermissions
         });
+        
+        return secrets;
     }
         
     if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
@@ -83,18 +85,23 @@ const validateClientForSecrets = async ({
             secrets,
             requiredPermissions
         });
+        
+        return secrets;
     }
 
     if (authData.authMode === AUTH_MODE_API_KEY && authData.authPayload instanceof User) {
-        // TODO
         await validateUserClientForSecrets({
             user: authData.authPayload,
             secrets,
             requiredPermissions
         });
+        
+        return secrets;
     }
-    
-    return secrets;
+
+    throw UnauthorizedRequestError({
+        message: 'Failed client authorization for secrets resource'
+    });
 }
 
 export {

backend/src/helpers/serviceAccount.ts

@@ -1,17 +1,102 @@
 import _ from 'lodash';
 import { Types } from 'mongoose';
 import {
+	User,
+	IUser,
+	ServiceAccount,
     IServiceAccount,
+	ServiceTokenData,
+	IServiceTokenData,
 	ISecret,
 	ServiceAccountWorkspacePermission
 } from '../models';
+import { 
+	BadRequestError, 
+	UnauthorizedRequestError,
+	ServiceAccountNotFoundError
+} from '../utils/errors';
+import {
+	PERMISSION_READ_SECRETS,
+	PERMISSION_WRITE_SECRETS,
+	AUTH_MODE_JWT,
+	AUTH_MODE_SERVICE_ACCOUNT,
+	AUTH_MODE_SERVICE_TOKEN,
+	AUTH_MODE_API_KEY
+} from '../variables';
+import {
+	validateUserClientForServiceAccount
+} from '../helpers/user';
+
+const validateClientForServiceAccount = async ({
+	authData,
+	serviceAccountId,
+	requiredPermissions
+}: {
+	authData: {
+		authMode: string;
+		authPayload: IUser | IServiceAccount | IServiceTokenData;
+	},
+	serviceAccountId: Types.ObjectId;
+	requiredPermissions?: string[];
+}) => {
+	const serviceAccount = await ServiceAccount.findById(serviceAccountId); 
+	
+	if (!serviceAccount) {
+		throw ServiceAccountNotFoundError({
+			message: 'Failed to find service account'
+		});
+	}
+	
+	if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
+		await validateUserClientForServiceAccount({
+			user: authData.authPayload,
+			serviceAccount,
+			requiredPermissions
+		});
+		
+		return serviceAccount;
+	}
+
+	if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
+		await validateServiceAccountClientForServiceAccount({
+			serviceAccount: authData.authPayload,
+			targetServiceAccount: serviceAccount,
+			requiredPermissions
+		});
+
+		return serviceAccount;
+	}
+
+	if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
+		throw UnauthorizedRequestError({
+			message: 'Failed service token authorization for service account resource'
+		});
+	}
+
+	if (authData.authMode === AUTH_MODE_API_KEY && authData.authPayload instanceof User) {
+		await validateUserClientForServiceAccount({
+			user: authData.authPayload,
+			serviceAccount,
+			requiredPermissions
+		});
+		
+		return serviceAccount;
+	}
+	
+	throw UnauthorizedRequestError({
+		message: 'Failed client authorization for service account resource'
+	});
+}
 
 /**
- * Validate that serviceAccount (client) can access workspace
+ * Validate that service account (client) can access workspace
  * with id [workspaceId] and its environment [environment] with required permissions
  * [requiredPermissions]
- *  @param {Object} obj
- *  @param {Object} obj.
+ * @param {Object} obj
+ * @param {ServiceAccount} obj.serviceAccount - service account client
+ * @param {Types.ObjectId} obj.workspaceId - id of workspace to validate against
+ * @param {String} environment - (optional) environment in workspace to validate against
+ * @param {String[]} requiredPermissions - required permissions as part of the endpoint
  */
  const validateServiceAccountClientForWorkspace = async ({
     serviceAccount,
@@ -21,18 +106,51 @@ import {
 }: {
     serviceAccount: IServiceAccount;
 	workspaceId: Types.ObjectId;
-	environment: string;
-	requiredPermissions: string[];
+	environment?: string;
+	requiredPermissions?: string[];
 }) => {
-	// TODO
-	return [];
+	// TODO: add service account API support for workspace-level endpoints that are not
+	// tied to any specific environment
+
+	if (environment) {
+		const permission = await ServiceAccountWorkspacePermission.findOne({
+			serviceAccount,
+			workspace: new Types.ObjectId(workspaceId),
+			environment
+		});
+		
+		if (!permission) throw UnauthorizedRequestError({
+			message: 'Failed service account authorization for the given workspace environment'
+		});
+		
+		// TODO: refactor
+		let runningIsDisallowed = false;
+		requiredPermissions?.forEach((requiredPermission: string) => {
+			switch (requiredPermission) {
+				case PERMISSION_READ_SECRETS:
+					if (!permission.read) runningIsDisallowed = true;
+					break;
+				case PERMISSION_WRITE_SECRETS:
+					if (!permission.write) runningIsDisallowed = true;
+					break;
+				default:
+					break;
+			}
+			
+			if (runningIsDisallowed) {
+				throw UnauthorizedRequestError({
+					message: `Failed permissions authorization for workspace environment action : ${requiredPermission}`
+				});	
+			}
+		});
+	}
 }
 
 /**
  * Validate that service account (client) can access secrets
  * with required permissions [requiredPermissions]
  * @param {Object} obj
- * @param {ServiceTokenData} obj.serviceAccount - service account client
+ * @param {ServiceAccount} obj.serviceAccount - service account client
  * @param {Secret[]} secrets - secrets to validate against
  * @param {string[]} requiredPermissions - required permissions as part of the endpoint
  */
@@ -49,15 +167,73 @@ import {
 	const permissions = await ServiceAccountWorkspacePermission.find({
 		serviceAccount: serviceAccount._id 
 	});
+
 	const permissionsObj = _.keyBy(permissions, (p) => {
 		return `${p.workspace.toString()}-${p.environment}`
 	});
 
+	secrets.forEach((secret: ISecret) => {
+		const permission = permissionsObj[`${secret.workspace.toString()}-${secret.environment}`];
+		
+		if (!permission) throw BadRequestError({
+			message: 'Failed to find any permission for the secret workspace and environment'
+		});
+		
+		requiredPermissions?.forEach((requiredPermission: string) => {
+			// TODO: refactor
+			let runningIsDisallowed = false;
+			requiredPermissions?.forEach((requiredPermission: string) => {
+				switch (requiredPermission) {
+					case PERMISSION_READ_SECRETS:
+						if (!permission.read) runningIsDisallowed = true;
+						break;
+					case PERMISSION_WRITE_SECRETS:
+						if (!permission.write) runningIsDisallowed = true;
+						break;
+					default:
+						break;
+				}
+				
+				if (runningIsDisallowed) {
+					throw UnauthorizedRequestError({
+						message: `Failed permissions authorization for workspace environment action : ${requiredPermission}`
+					});	
+				}
+			});
+		});
+	});
+
 	// TODO
     return [];
 }
 
+/**
+ * Validate that service account (client) can access target service
+ * account [serviceAccount] with required permissions [requiredPermissions]
+ * @param {Object} obj
+ * @param {SerivceAccount} obj.serviceAccount - service account client
+ * @param {ServiceAccount} targetServiceAccount - target service account to validate against
+ * @param {string[]} requiredPermissions - required permissions as part of the endpoint
+ */
+const validateServiceAccountClientForServiceAccount = ({
+	serviceAccount,
+	targetServiceAccount,
+	requiredPermissions
+}: {
+	serviceAccount: IServiceAccount;
+	targetServiceAccount: IServiceAccount;
+	requiredPermissions?: string[];
+}) => {
+	if (!serviceAccount.organization.equals(targetServiceAccount.organization)) {
+		throw UnauthorizedRequestError({
+			message: 'Failed service account authorization for the given service account'
+		});
+	}
+}
+
 export {
+	validateClientForServiceAccount,
     validateServiceAccountClientForWorkspace,
-	validateServiceAccountClientForSecrets
+	validateServiceAccountClientForSecrets,
+	validateServiceAccountClientForServiceAccount
 }

backend/src/helpers/user.ts

@@ -3,6 +3,7 @@ import { Types } from 'mongoose';
 import {
 	IUser, 
 	ISecret,
+	IServiceAccount,
 	User,
 	Membership
 } from '../models';
@@ -11,8 +12,12 @@ import { validateMembership } from './membership';
 import _ from 'lodash';
 import { BadRequestError, UnauthorizedRequestError } from '../utils/errors';
 import {
-	ABILITY_WRITE
-} from '../variables/organization';
+	validateMembershipOrg
+} from '../helpers/membershipOrg';
+import {
+	PERMISSION_READ_SECRETS,
+	PERMISSION_WRITE_SECRETS
+} from '../variables';
 
 /**
  * Initialize a user under email [email]
@@ -180,24 +185,38 @@ const validateUserClientForWorkspace = async ({
 	requiredPermissions?: string[];
 }) => {
 	
-	// org-level and workspace-level permissions? - workspace-level env scoped?
-
 	// validate user membership in workspace
 	const membership = await validateMembership({
         userId: user._id,
         workspaceId
     });
 	
-	// validate user permission
-	
-	
-	// TODO: validate that user can perform action on environment in workspace
+	// TODO: refactor
+	let runningIsDisallowed = false;
+	requiredPermissions?.forEach((requiredPermission: string) => {
+		switch (requiredPermission) {
+			case PERMISSION_READ_SECRETS:
+				runningIsDisallowed = _.some(membership.deniedPermissions, { environmentSlug: environment, ability: PERMISSION_READ_SECRETS });
+				break;
+			case PERMISSION_WRITE_SECRETS:
+				runningIsDisallowed = _.some(membership.deniedPermissions, { environmentSlug: environment, ability: PERMISSION_WRITE_SECRETS });
+				break;
+			default:
+				break;
+		}
+		
+		if (runningIsDisallowed) {
+			throw UnauthorizedRequestError({
+				message: `Failed permissions authorization for workspace environment action : ${requiredPermission}`
+			});	
+		}
+	});
 	
 	return membership;
 }
 
 /**
- * Validate that user (client) can access secrets with ids [secretIds]
+ * Validate that user (client) can access secrets [secrets]
  * with required permissions [requiredPermissions]
  * @param {Object} obj
  * @param {User} obj.user - user client
@@ -213,7 +232,7 @@ const validateUserClientForWorkspace = async ({
 	secrets: ISecret[];
 	requiredPermissions?: string[];
 }) => {
-	// TODO: consider refactor
+	// TODO: refactor
 
 	const userMemberships = await Membership.find({ user: user._id })
 	const userMembershipById = _.keyBy(userMemberships, 'workspace');
@@ -221,27 +240,59 @@ const validateUserClientForWorkspace = async ({
 
 	// for each secret check if the secret belongs to a workspace the user is a member of
 	secrets.forEach((secret: ISecret) => {
-		if (workspaceIdsSet.has(secret.workspace.toString())) {
+		if (!workspaceIdsSet.has(secret.workspace.toString())) {
+			throw BadRequestError({
+				message: 'Failed authorization for the secret'
+			});
+		}
+
+		if (requiredPermissions?.includes(PERMISSION_WRITE_SECRETS)) {
 			const deniedMembershipPermissions = userMembershipById[secret.workspace.toString()].deniedPermissions;
-			const isDisallowed = _.some(deniedMembershipPermissions, { environmentSlug: secret.environment, ability: ABILITY_WRITE });
+			const isDisallowed = _.some(deniedMembershipPermissions, { environmentSlug: secret.environment, ability: PERMISSION_WRITE_SECRETS });
 
 			if (isDisallowed) {
 				throw UnauthorizedRequestError({
 					message: 'You do not have the required permissions to perform this action' 
 				});
 			}
-		} else {
-			throw BadRequestError({ 
-				message: 'You cannot edit secrets of a workspace you are not a member of' 
-			});
 		}
 	});
 }
 
+/**
+ * Validate that user (client) can access service account [serviceAccount]
+ * with required permissions [requiredPermissions]
+ * @param {Object} obj
+ * @param {User} obj.user - user client
+ * @param {ServiceAccount} obj.serviceAccount - service account to validate against
+ * @param {String[]} requiredPermissions - required permissions as part of the endpoint
+ */
+const validateUserClientForServiceAccount = async ({
+	user,
+	serviceAccount,
+	requiredPermissions
+}: {
+	user: IUser;
+	serviceAccount: IServiceAccount;
+	requiredPermissions?: string[];
+}) => {
+	if (!serviceAccount.user.equals(user._id)) {
+		// case: user who created service account is not the
+		// same user that is on the request
+		await validateMembershipOrg({
+			userId: user._id,
+			organizationId: serviceAccount.organization,
+			acceptedRoles: [],
+			acceptedStatuses: []
+		});
+	}
+}
+
 export { 
 	setupAccount, 
 	completeAccount, 
 	checkUserDevice,
 	validateUserClientForWorkspace,
-	validateUserClientForSecrets
+	validateUserClientForSecrets,
+	validateUserClientForServiceAccount
 };

backend/src/helpers/workspace.ts

@@ -53,30 +53,26 @@ const validateClientForWorkspace = async ({
 	requiredPermissions?: string[];
 }) => {
 
-	let membership;
 	if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
-		membership = await validateUserClientForWorkspace({
+		const membership = await validateUserClientForWorkspace({
 			user: authData.authPayload,
 			workspaceId,
 			environment,
 			requiredPermissions
 		});
 		
-		// TODO: validate user against [requiredPermissions]
+		return ({ membership });
 	}
 
 	if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
-		const permission = await ServiceAccountWorkspacePermission.findOne({
-			serviceAccount: authData.authPayload._id,
-			workspace: new Types.ObjectId(workspaceId),
-			environment
+		await validateServiceAccountClientForWorkspace({
+			serviceAccount: authData.authPayload,
+			workspaceId,
+			environment,
+			requiredPermissions
 		});
 		
-		if (!permission) throw UnauthorizedRequestError({
-			message: 'Failed service account authorization for the given workspace environment'
-		});
-		
-		// TODO: validate [requiredPermissions] against [permission]
+		return {};
 	}
 	
 	if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
@@ -87,20 +83,22 @@ const validateClientForWorkspace = async ({
 			requiredPermissions
 		});
 
-		// TODO: validate [requiredPermissions] against [permission]
+		return {};
 	}
 
 	if (authData.authMode === AUTH_MODE_API_KEY && authData.authPayload instanceof User) {
-		membership = await validateUserClientForWorkspace({
+		const membership = await validateUserClientForWorkspace({
 			user: authData.authPayload,
 			workspaceId,
 			environment,
 			requiredPermissions
 		});
+		
+		return ({ membership });
 	}
 	
-	return ({
-		membership
+	throw UnauthorizedRequestError({
+		message: 'Failed client authorization for workspace resource'
 	});
 }