feat(rbac): added new zod validation and permission check for all org level api

backend/src/controllers/v1/membershipOrgController.ts

@@ -8,14 +8,8 @@ import { updateSubscriptionOrgQuantity } from "../../helpers/organization";
 import { sendMail } from "../../helpers/nodemailer";
 import { TokenService } from "../../services";
 import { EELicenseService } from "../../ee/services";
-import {
-  ACCEPTED,
-  ADMIN,
-  INVITED,
-  MEMBER,
-  OWNER,
-  TOKEN_EMAIL_ORG_INVITATION
-} from "../../variables";
+import { ACCEPTED, INVITED, MEMBER, TOKEN_EMAIL_ORG_INVITATION } from "../../variables";
+import * as reqValidator from "../../validation/membershipOrg";
 import {
   getJwtSignupLifetime,
   getJwtSignupSecret,
@@ -23,6 +17,13 @@ import {
   getSmtpConfigured
 } from "../../config";
 import { validateUserEmail } from "../../validation";
+import { validateRequest } from "../../helpers/validation";
+import {
+  GeneralPermissionActions,
+  OrgPermissionSubjects,
+  getUserOrgPermissions
+} from "../../services/RoleService";
+import { ForbiddenError } from "@casl/ability";
 
 /**
  * Delete organization membership with id [membershipOrgId] from organization
@@ -31,7 +32,9 @@ import { validateUserEmail } from "../../validation";
  * @returns
  */
 export const deleteMembershipOrg = async (req: Request, _res: Response) => {
-  const { membershipOrgId } = req.params;
+  const {
+    params: { membershipOrgId }
+  } = await validateRequest(reqValidator.DelOrgMembershipv1, req);
 
   // check if organization membership to delete exists
   const membershipOrgToDelete = await MembershipOrg.findOne({
@@ -42,21 +45,14 @@ export const deleteMembershipOrg = async (req: Request, _res: Response) => {
     throw new Error("Failed to delete organization membership that doesn't exist");
   }
 
-  // check if user is a member and admin of the organization
-  // whose membership we wish to delete
-  const membershipOrg = await MembershipOrg.findOne({
-    user: req.user._id,
-    organization: membershipOrgToDelete.organization
-  });
-
-  if (!membershipOrg) {
-    throw new Error("Failed to validate organization membership");
-  }
-
-  if (membershipOrg.role !== OWNER && membershipOrg.role !== ADMIN) {
-    // user is not an admin member of the organization
-    throw new Error("Insufficient role for deleting organization membership");
-  }
+  const { permission, membership: membershipOrg } = await getUserOrgPermissions(
+    req.user._id,
+    membershipOrgToDelete.organization.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    GeneralPermissionActions.Delete,
+    OrgPermissionSubjects.Member
+  );
 
   // delete organization membership
   await deleteMemberFromOrg({
@@ -96,22 +92,20 @@ export const changeMembershipOrgRole = async (req: Request, res: Response) => {
  */
 export const inviteUserToOrganization = async (req: Request, res: Response) => {
   let inviteeMembershipOrg, completeInviteLink;
-  const { organizationId, inviteeEmail } = req.body;
+  const {
+    body: { inviteeEmail, organizationId }
+  } = await validateRequest(reqValidator.InviteUserToOrgv1, req);
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    GeneralPermissionActions.Create,
+    OrgPermissionSubjects.Member
+  );
+
   const host = req.headers.host;
   const siteUrl = `${req.protocol}://${host}`;
-
-  // validate membership
-  const membershipOrg = await MembershipOrg.findOne({
-    user: req.user._id,
-    organization: new Types.ObjectId(organizationId)
-  });
-
-  if (!membershipOrg) {
-    throw new Error("Failed to validate organization membership");
-  }
-
   const plan = await EELicenseService.getPlan(new Types.ObjectId(organizationId));
-  
+
   const ssoConfig = await SSOConfig.findOne({
     organization: new Types.ObjectId(organizationId)
   });
@@ -119,9 +113,8 @@ export const inviteUserToOrganization = async (req: Request, res: Response) => {
   if (ssoConfig && ssoConfig.isActive) {
     // case: SAML SSO is enabled for the organization
     return res.status(400).send({
-      message:
-        "Failed to invite member due to SAML SSO configured for organization"
-    }); 
+      message: "Failed to invite member due to SAML SSO configured for organization"
+    });
   }
 
   if (plan.memberLimit !== null) {
@@ -231,7 +224,10 @@ export const inviteUserToOrganization = async (req: Request, res: Response) => {
  */
 export const verifyUserToOrganization = async (req: Request, res: Response) => {
   let user;
-  const { email, organizationId, code } = req.body;
+
+  const {
+    body: { organizationId, email, code }
+  } = await validateRequest(reqValidator.VerifyUserToOrgv1, req);
 
   user = await User.findOne({ email }).select("+publicKey");
 

backend/src/controllers/v1/organizationController.ts

@@ -1,28 +1,38 @@
 import { Request, Response } from "express";
 import {
-	IncidentContactOrg,
-	Membership,
-	MembershipOrg,
-	Organization,
-	Workspace,
+  IncidentContactOrg,
+  Membership,
+  MembershipOrg,
+  Organization,
+  Workspace
 } from "../../models";
 import { createOrganization as create } from "../../helpers/organization";
 import { addMembershipsOrg } from "../../helpers/membershipOrg";
 import { ACCEPTED, OWNER } from "../../variables";
 import { getLicenseServerUrl, getSiteURL } from "../../config";
 import { licenseServerKeyRequest } from "../../config/request";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/organization";
+import {
+  GeneralPermissionActions,
+  OrgPermissionSubjects,
+  WorkspacePermissionActions,
+  getUserOrgPermissions
+} from "../../services/RoleService";
+import { OrganizationNotFoundError } from "../../utils/errors";
+import { ForbiddenError } from "@casl/ability";
 
 export const getOrganizations = async (req: Request, res: Response) => {
   const organizations = (
     await MembershipOrg.find({
       user: req.user._id,
-      status: ACCEPTED,
+      status: ACCEPTED
     }).populate("organization")
   ).map((m) => m.organization);
 
-	return res.status(200).send({
-		organizations,
-	});
+  return res.status(200).send({
+    organizations
+  });
 };
 
 /**
@@ -33,28 +43,26 @@ export const getOrganizations = async (req: Request, res: Response) => {
  * @returns
  */
 export const createOrganization = async (req: Request, res: Response) => {
-  const { organizationName } = req.body;
-
-  if (organizationName.length < 1) {
-    throw new Error("Organization names must be at least 1-character long");
-  }
+  const {
+    body: { organizationName }
+  } = await validateRequest(reqValidator.CreateOrgv1, req);
 
   // create organization and add user as member
   const organization = await create({
     email: req.user.email,
-    name: organizationName,
+    name: organizationName
   });
 
   await addMembershipsOrg({
     userIds: [req.user._id.toString()],
     organizationId: organization._id.toString(),
     roles: [OWNER],
-    statuses: [ACCEPTED],
+    statuses: [ACCEPTED]
   });
 
-	return res.status(200).send({
-		organization,
-	});
+  return res.status(200).send({
+    organization
+  });
 };
 
 /**
@@ -64,10 +72,23 @@ export const createOrganization = async (req: Request, res: Response) => {
  * @returns
  */
 export const getOrganization = async (req: Request, res: Response) => {
-	const organization = req.organization
-	return res.status(200).send({
-		organization,
-	});
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgv1, req);
+
+  // ensure user has membership
+  await getUserOrgPermissions(req.user._id, organizationId);
+
+  const organization = await Organization.findById(organizationId);
+  if (!organization) {
+    throw OrganizationNotFoundError({
+      message: "Failed to find organization"
+    });
+  }
+
+  return res.status(200).send({
+    organization
+  });
 };
 
 /**
@@ -77,15 +98,23 @@ export const getOrganization = async (req: Request, res: Response) => {
  * @returns
  */
 export const getOrganizationMembers = async (req: Request, res: Response) => {
-  const { organizationId } = req.params;
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgMembersv1, req);
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    GeneralPermissionActions.Read,
+    OrgPermissionSubjects.Member
+  );
 
   const users = await MembershipOrg.find({
-    organization: organizationId,
+    organization: organizationId
   }).populate("user", "+publicKey");
 
-	return res.status(200).send({
-		users,
-	});
+  return res.status(200).send({
+    users
+  });
 };
 
 /**
@@ -94,17 +123,22 @@ export const getOrganizationMembers = async (req: Request, res: Response) => {
  * @param res
  * @returns
  */
-export const getOrganizationWorkspaces = async (
-	req: Request,
-	res: Response
-) => {
-  const { organizationId } = req.params;
+export const getOrganizationWorkspaces = async (req: Request, res: Response) => {
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgWorkspacesv1, req);
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    WorkspacePermissionActions.Read,
+    OrgPermissionSubjects.Workspace
+  );
 
   const workspacesSet = new Set(
     (
       await Workspace.find(
         {
-          organization: organizationId,
+          organization: organizationId
         },
         "_id"
       )
@@ -113,15 +147,15 @@ export const getOrganizationWorkspaces = async (
 
   const workspaces = (
     await Membership.find({
-      user: req.user._id,
+      user: req.user._id
     }).populate("workspace")
   )
     .filter((m) => workspacesSet.has(m.workspace._id.toString()))
     .map((m) => m.workspace);
 
-	return res.status(200).send({
-		workspaces,
-	});
+  return res.status(200).send({
+    workspaces
+  });
 };
 
 /**
@@ -131,25 +165,33 @@ export const getOrganizationWorkspaces = async (
  * @returns
  */
 export const changeOrganizationName = async (req: Request, res: Response) => {
-  const { organizationId } = req.params;
-  const { name } = req.body;
+  const {
+    params: { organizationId },
+    body: { name }
+  } = await validateRequest(reqValidator.ChangeOrgNamev1, req);
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    GeneralPermissionActions.Edit,
+    OrgPermissionSubjects.Settings
+  );
 
   const organization = await Organization.findOneAndUpdate(
     {
-      _id: organizationId,
+      _id: organizationId
     },
     {
-      name,
+      name
     },
     {
-      new: true,
+      new: true
     }
   );
 
-	return res.status(200).send({
-		message: "Successfully changed organization name",
-		organization,
-	});
+  return res.status(200).send({
+    message: "Successfully changed organization name",
+    organization
+  });
 };
 
 /**
@@ -158,19 +200,24 @@ export const changeOrganizationName = async (req: Request, res: Response) => {
  * @param res
  * @returns
  */
-export const getOrganizationIncidentContacts = async (
-	req: Request,
-	res: Response
-) => {
-  const { organizationId } = req.params;
+export const getOrganizationIncidentContacts = async (req: Request, res: Response) => {
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgIncidentContactv1, req);
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    GeneralPermissionActions.Read,
+    OrgPermissionSubjects.IncidentAccount
+  );
 
   const incidentContactsOrg = await IncidentContactOrg.find({
-    organization: organizationId,
+    organization: organizationId
   });
 
-	return res.status(200).send({
-		incidentContactsOrg,
-	});
+  return res.status(200).send({
+    incidentContactsOrg
+  });
 };
 
 /**
@@ -179,12 +226,17 @@ export const getOrganizationIncidentContacts = async (
  * @param res
  * @returns
  */
-export const addOrganizationIncidentContact = async (
-	req: Request,
-	res: Response
-) => {
-  const { organizationId } = req.params;
-  const { email } = req.body;
+export const addOrganizationIncidentContact = async (req: Request, res: Response) => {
+  const {
+    params: { organizationId },
+    body: { email }
+  } = await validateRequest(reqValidator.CreateOrgIncideContact, req);
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    GeneralPermissionActions.Create,
+    OrgPermissionSubjects.IncidentAccount
+  );
 
   const incidentContactOrg = await IncidentContactOrg.findOneAndUpdate(
     { email, organization: organizationId },
@@ -192,9 +244,9 @@ export const addOrganizationIncidentContact = async (
     { upsert: true, new: true }
   );
 
-	return res.status(200).send({
-		incidentContactOrg,
-	});
+  return res.status(200).send({
+    incidentContactOrg
+  });
 };
 
 /**
@@ -203,22 +255,27 @@ export const addOrganizationIncidentContact = async (
  * @param res
  * @returns
  */
-export const deleteOrganizationIncidentContact = async (
-	req: Request,
-	res: Response
-) => {
-  const { organizationId } = req.params;
-  const { email } = req.body;
+export const deleteOrganizationIncidentContact = async (req: Request, res: Response) => {
+  const {
+    params: { organizationId },
+    body: { email }
+  } = await validateRequest(reqValidator.DelOrgIncideContact, req);
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    GeneralPermissionActions.Delete,
+    OrgPermissionSubjects.IncidentAccount
+  );
 
   const incidentContactOrg = await IncidentContactOrg.findOneAndDelete({
     email,
-    organization: organizationId,
+    organization: organizationId
   });
 
-	return res.status(200).send({
-		message: "Successfully deleted organization incident contact",
-		incidentContactOrg,
-	});
+  return res.status(200).send({
+    message: "Successfully deleted organization incident contact",
+    incidentContactOrg
+  });
 };
 
 /**
@@ -228,19 +285,41 @@ export const deleteOrganizationIncidentContact = async (
  * @param res
  * @returns
  */
-export const createOrganizationPortalSession = async (
-	req: Request,
-	res: Response
-) => {
-  const { data: { pmtMethods } } = await licenseServerKeyRequest.get(
-    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${req.organization.customerId}/billing-details/payment-methods`,
+export const createOrganizationPortalSession = async (req: Request, res: Response) => {
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgPlanBillingInfov1, req);
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    GeneralPermissionActions.Create,
+    OrgPermissionSubjects.Billing
   );
-  
+
+  const organization = await Organization.findById(organizationId);
+  if (!organization) {
+    throw OrganizationNotFoundError({
+      message: "Failed to find organization"
+    });
+  }
+
+  const {
+    data: { pmtMethods }
+  } = await licenseServerKeyRequest.get(
+    `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
+      organization.customerId
+    }/billing-details/payment-methods`
+  );
+
   if (pmtMethods.length < 1) {
     // case: organization has no payment method on file
-    // -> redirect to add payment method portal 
-    const { data: { url } } = await licenseServerKeyRequest.post(
-      `${await getLicenseServerUrl()}/api/license-server/v1/customers/${req.organization.customerId}/billing-details/payment-methods`,
+    // -> redirect to add payment method portal
+    const {
+      data: { url }
+    } = await licenseServerKeyRequest.post(
+      `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
+        organization.customerId
+      }/billing-details/payment-methods`,
       {
         success_url: (await getSiteURL()) + "/dashboard",
         cancel_url: (await getSiteURL()) + "/dashboard"
@@ -250,8 +329,12 @@ export const createOrganizationPortalSession = async (
   } else {
     // case: organization has payment method on file
     // -> redirect to billing portal
-    const { data: { url } } = await licenseServerKeyRequest.post(
-      `${await getLicenseServerUrl()}/api/license-server/v1/customers/${req.organization.customerId}/billing-details/billing-portal`,
+    const {
+      data: { url }
+    } = await licenseServerKeyRequest.post(
+      `${await getLicenseServerUrl()}/api/license-server/v1/customers/${
+        organization.customerId
+      }/billing-details/billing-portal`,
       {
         return_url: (await getSiteURL()) + "/dashboard"
       }
@@ -266,36 +349,43 @@ export const createOrganizationPortalSession = async (
  * @param res
  * @returns
  */
-export const getOrganizationMembersAndTheirWorkspaces = async (
-	req: Request,
-	res: Response
-) => {
-	const { organizationId } = req.params;
+export const getOrganizationMembersAndTheirWorkspaces = async (req: Request, res: Response) => {
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgMembersv1, req);
 
-	const workspacesSet = (
-			await Workspace.find(
-				{
-					organization: organizationId,
-				},
-				"_id"
-			)
-		).map((w) => w._id.toString());
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    GeneralPermissionActions.Read,
+    OrgPermissionSubjects.Member
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    WorkspacePermissionActions.Read,
+    OrgPermissionSubjects.Workspace
+  );
 
-	const memberships = (
-		await Membership.find({
-			workspace: { $in: workspacesSet },
-		}).populate("workspace")
-	);
-	const userToWorkspaceIds: any = {};
+  const workspacesSet = (
+    await Workspace.find(
+      {
+        organization: organizationId
+      },
+      "_id"
+    )
+  ).map((w) => w._id.toString());
 
-	memberships.forEach(membership => {
-		const user = membership.user.toString();
-		if (userToWorkspaceIds[user]) {
-			userToWorkspaceIds[user].push(membership.workspace);
-		} else {
-			userToWorkspaceIds[user] = [membership.workspace];
-		}
-	});
+  const memberships = await Membership.find({
+    workspace: { $in: workspacesSet }
+  }).populate("workspace");
+  const userToWorkspaceIds: any = {};
 
-	return res.json(userToWorkspaceIds);
+  memberships.forEach((membership) => {
+    const user = membership.user.toString();
+    if (userToWorkspaceIds[user]) {
+      userToWorkspaceIds[user].push(membership.workspace);
+    } else {
+      userToWorkspaceIds[user] = [membership.workspace];
+    }
+  });
+
+  return res.json(userToWorkspaceIds);
 };

backend/src/controllers/v1/roleController.ts

@@ -21,8 +21,8 @@ export const createRole = async (req: Request, res: Response) => {
     body: { workspaceId, name, description, slug, permissions, orgId }
   } = await validateRequest(CreateRoleSchema, req);
 
-  const orgPermission = await getUserOrgPermissions(req.user.id, orgId);
-  if (orgPermission.cannot(GeneralPermissionActions.Create, OrgPermissionSubjects.Role)) {
+  const { permission } = await getUserOrgPermissions(req.user.id, orgId);
+  if (permission.cannot(GeneralPermissionActions.Create, OrgPermissionSubjects.Role)) {
     throw BadRequestError({ message: "User doesn't have the permission." });
   }
 
@@ -59,8 +59,8 @@ export const updateRole = async (req: Request, res: Response) => {
   } = await validateRequest(UpdateRoleSchema, req);
   const isOrgRole = !workspaceId; // if workspaceid is provided then its a workspace rule
 
-  const orgPermission = await getUserOrgPermissions(req.user.id, orgId);
-  if (orgPermission.cannot(GeneralPermissionActions.Edit, OrgPermissionSubjects.Role)) {
+  const { permission } = await getUserOrgPermissions(req.user.id, orgId);
+  if (permission.cannot(GeneralPermissionActions.Edit, OrgPermissionSubjects.Role)) {
     throw BadRequestError({ message: "User doesn't have the permission." });
   }
 
@@ -103,8 +103,8 @@ export const deleteRole = async (req: Request, res: Response) => {
     throw BadRequestError({ message: "Role not found" });
   }
 
-  const orgPermission = await getUserOrgPermissions(req.user.id, role.organization.toString());
-  if (orgPermission.cannot(GeneralPermissionActions.Delete, OrgPermissionSubjects.Role)) {
+  const { permission } = await getUserOrgPermissions(req.user.id, role.organization.toString());
+  if (permission.cannot(GeneralPermissionActions.Delete, OrgPermissionSubjects.Role)) {
     throw BadRequestError({ message: "User doesn't have the permission." });
   }
   await Role.findByIdAndDelete(role.id);
@@ -123,8 +123,8 @@ export const getRoles = async (req: Request, res: Response) => {
   } = await validateRequest(GetRoleSchema, req);
   const isOrgRole = !workspaceId;
 
-  const orgPermission = await getUserOrgPermissions(req.user.id, orgId);
-  if (orgPermission.cannot(GeneralPermissionActions.Read, OrgPermissionSubjects.Role)) {
+  const { permission } = await getUserOrgPermissions(req.user.id, orgId);
+  if (permission.cannot(GeneralPermissionActions.Read, OrgPermissionSubjects.Role)) {
     throw BadRequestError({ message: "User doesn't have the permission." });
   }
 

backend/src/controllers/v1/secretScanningController.ts

@@ -2,20 +2,45 @@ import { Request, Response } from "express";
 import GitAppInstallationSession from "../../ee/models/gitAppInstallationSession";
 import crypto from "crypto";
 import { Types } from "mongoose";
-import { UnauthorizedRequestError } from "../../utils/errors";
+import { OrganizationNotFoundError, UnauthorizedRequestError } from "../../utils/errors";
 import GitAppOrganizationInstallation from "../../ee/models/gitAppOrganizationInstallation";
-import { MembershipOrg } from "../../models";
 import { scanGithubFullRepoForSecretLeaks  } from "../../queues/secret-scanning/githubScanFullRepository"
 import { getSecretScanningGitAppId, getSecretScanningPrivateKey } from "../../config";
 import GitRisks, { STATUS_RESOLVED_FALSE_POSITIVE, STATUS_RESOLVED_NOT_REVOKED, STATUS_RESOLVED_REVOKED } from "../../ee/models/gitRisks";
 import { ProbotOctokit } from "probot";
+import { Organization } from "../../models";
+import { validateRequest } from "../../helpers/validation";
+import * as reqValidator from "../../validation/secretScanning";
+import {
+  GeneralPermissionActions,
+  OrgPermissionSubjects,
+  getUserOrgPermissions
+} from "../../services/RoleService";
+import { ForbiddenError } from "@casl/ability";
 
 export const createInstallationSession = async (req: Request, res: Response) => {
   const sessionId = crypto.randomBytes(16).toString("hex");
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.CreateInstalLSessionv1, req);
+
+  const organization = await Organization.findById(organizationId);
+  if (!organization) {
+    throw OrganizationNotFoundError({
+      message: "Failed to find organization"
+    });
+  }
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    GeneralPermissionActions.Create,
+    OrgPermissionSubjects.SecretScanning
+  );
+
   await GitAppInstallationSession.findByIdAndUpdate(
-    req.organization,
+    organization,
     {
-      organization: new Types.ObjectId(req.organization),
+      organization: organization.id,
       sessionId: sessionId,
       user: new Types.ObjectId(req.user._id)
     },
@@ -24,31 +49,43 @@ export const createInstallationSession = async (req: Request, res: Response) =>
 
   res.send({
     sessionId: sessionId
-  })
-}
+  });
+};
 
 export const linkInstallationToOrganization = async (req: Request, res: Response) => {
-  const { installationId, sessionId } = req.body
+  const {
+    body: { sessionId, installationId }
+  } = await validateRequest(reqValidator.LinkInstallationToOrgv1, req);
 
-  const installationSession = await GitAppInstallationSession.findOneAndDelete({ sessionId: sessionId })
+  const installationSession = await GitAppInstallationSession.findOneAndDelete({
+    sessionId: sessionId
+  });
   if (!installationSession) {
-    throw UnauthorizedRequestError()
+    throw UnauthorizedRequestError();
   }
 
-  const userMembership = await MembershipOrg.find({ user: req.user._id, organization: installationSession.organization })
-  if (!userMembership) {
-    throw UnauthorizedRequestError()
-  }
+  const { permission } = await getUserOrgPermissions(
+    req.user._id,
+    installationSession.organization.toString()
+  );
+  ForbiddenError.from(permission).throwUnlessCan(
+    GeneralPermissionActions.Edit,
+    OrgPermissionSubjects.SecretScanning
+  );
 
-  const installationLink = await GitAppOrganizationInstallation.findOneAndUpdate({
-    organizationId: installationSession.organization,
-  }, {
-    installationId: installationId,
-    organizationId: installationSession.organization,
-    user: installationSession.user
-  }, {
-    upsert: true
-  }).lean()
+  const installationLink = await GitAppOrganizationInstallation.findOneAndUpdate(
+    {
+      organizationId: installationSession.organization
+    },
+    {
+      installationId: installationId,
+      organizationId: installationSession.organization,
+      user: installationSession.user
+    },
+    {
+      upsert: true
+    }
+  ).lean();
 
   const octokit = new ProbotOctokit({
     auth: {
@@ -66,41 +103,68 @@ export const linkInstallationToOrganization = async (req: Request, res: Response
 }
 
 export const getCurrentOrganizationInstallationStatus = async (req: Request, res: Response) => {
-  const { organizationId } = req.params
+  const { organizationId } = req.params;
   try {
-    const appInstallation = await GitAppOrganizationInstallation.findOne({ organizationId: organizationId }).lean()
+    const appInstallation = await GitAppOrganizationInstallation.findOne({
+      organizationId: organizationId
+    }).lean();
     if (!appInstallation) {
       res.json({
         appInstallationComplete: false
-      })
+      });
     }
 
     res.json({
       appInstallationComplete: true
-    })
+    });
   } catch {
     res.json({
       appInstallationComplete: false
-    })
+    });
   }
-}
+};
 
 export const getRisksForOrganization = async (req: Request, res: Response) => {
-  const { organizationId } = req.params
-  const risks = await GitRisks.find({ organization: organizationId }).sort({ createdAt: -1 }).lean()
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgRisksv1, req);
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    GeneralPermissionActions.Read,
+    OrgPermissionSubjects.SecretScanning
+  );
+
+  const risks = await GitRisks.find({ organization: organizationId })
+    .sort({ createdAt: -1 })
+    .lean();
   res.json({
     risks: risks
-  })
-}
+  });
+};
 
 export const updateRisksStatus = async (req: Request, res: Response) => {
-  const { riskId } = req.params
-  const { status } = req.body
-  const isRiskResolved = status == STATUS_RESOLVED_FALSE_POSITIVE || status == STATUS_RESOLVED_REVOKED || status == STATUS_RESOLVED_NOT_REVOKED ? true : false
+  const {
+    params: { organizationId, riskId },
+    body: { status }
+  } = await validateRequest(reqValidator.UpdateRiskStatusv1, req);
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    GeneralPermissionActions.Edit,
+    OrgPermissionSubjects.SecretScanning
+  );
+
+  const isRiskResolved =
+    status == STATUS_RESOLVED_FALSE_POSITIVE ||
+    status == STATUS_RESOLVED_REVOKED ||
+    status == STATUS_RESOLVED_NOT_REVOKED
+      ? true
+      : false;
   const risk = await GitRisks.findByIdAndUpdate(riskId, {
     status: status,
     isResolved: isRiskResolved
-  }).lean()
+  }).lean();
 
-  res.json(risk)
-}
+  res.json(risk);
+};

backend/src/controllers/v1/workspaceController.ts

@@ -5,17 +5,21 @@ import {
   Integration,
   IntegrationAuth,
   Membership,
-  MembershipOrg,
+  Organization,
   ServiceToken,
-  Workspace,
+  Workspace
 } from "../../models";
-import {
-  createWorkspace as create,
-  deleteWorkspace as deleteWork,
-} from "../../helpers/workspace";
+import { createWorkspace as create, deleteWorkspace as deleteWork } from "../../helpers/workspace";
 import { EELicenseService } from "../../ee/services";
 import { addMemberships } from "../../helpers/membership";
 import { ADMIN } from "../../variables";
+import { OrganizationNotFoundError } from "../../utils/errors";
+import {
+  OrgPermissionSubjects,
+  WorkspacePermissionActions,
+  getUserOrgPermissions
+} from "../../services/RoleService";
+import { ForbiddenError } from "@casl/ability";
 
 /**
  * Return public keys of members of workspace with id [workspaceId]
@@ -28,17 +32,17 @@ export const getWorkspacePublicKeys = async (req: Request, res: Response) => {
 
   const publicKeys = (
     await Membership.find({
-      workspace: workspaceId,
+      workspace: workspaceId
     }).populate<{ user: IUser }>("user", "publicKey")
   ).map((member) => {
     return {
       publicKey: member.user.publicKey,
-      userId: member.user._id,
+      userId: member.user._id
     };
   });
 
   return res.status(200).send({
-    publicKeys,
+    publicKeys
   });
 };
 
@@ -52,11 +56,11 @@ export const getWorkspaceMemberships = async (req: Request, res: Response) => {
   const { workspaceId } = req.params;
 
   const users = await Membership.find({
-    workspace: workspaceId,
+    workspace: workspaceId
   }).populate("user", "+publicKey");
 
   return res.status(200).send({
-    users,
+    users
   });
 };
 
@@ -69,12 +73,12 @@ export const getWorkspaceMemberships = async (req: Request, res: Response) => {
 export const getWorkspaces = async (req: Request, res: Response) => {
   const workspaces = (
     await Membership.find({
-      user: req.user._id,
+      user: req.user._id
     }).populate("workspace")
   ).map((m) => m.workspace);
 
   return res.status(200).send({
-    workspaces,
+    workspaces
   });
 };
 
@@ -88,11 +92,11 @@ export const getWorkspace = async (req: Request, res: Response) => {
   const { workspaceId } = req.params;
 
   const workspace = await Workspace.findOne({
-    _id: workspaceId,
+    _id: workspaceId
   });
 
   return res.status(200).send({
-    workspace,
+    workspace
   });
 };
 
@@ -106,24 +110,28 @@ export const getWorkspace = async (req: Request, res: Response) => {
 export const createWorkspace = async (req: Request, res: Response) => {
   const { workspaceName, organizationId } = req.body;
 
-  // validate organization membership
-  const membershipOrg = await MembershipOrg.findOne({
-    user: req.user._id,
-    organization: new Types.ObjectId(organizationId),
-  });
-
-  if (!membershipOrg) {
-    throw new Error("Failed to validate organization membership");
+  const organization = await Organization.findById(organizationId);
+  if (!organization) {
+    throw OrganizationNotFoundError({
+      message: "Failed to find organization"
+    });
   }
 
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    WorkspacePermissionActions.Create,
+    OrgPermissionSubjects.Workspace
+  );
+
   const plan = await EELicenseService.getPlan(new Types.ObjectId(organizationId));
-  
+
   if (plan.workspaceLimit !== null) {
     // case: limit imposed on number of workspaces allowed
     if (plan.workspacesUsed >= plan.workspaceLimit) {
       // case: number of workspaces used exceeds the number of workspaces allowed
       return res.status(400).send({
-        message: "Failed to create workspace due to plan limit reached. Upgrade plan to add more workspaces.",
+        message:
+          "Failed to create workspace due to plan limit reached. Upgrade plan to add more workspaces."
       });
     }
   }
@@ -135,17 +143,17 @@ export const createWorkspace = async (req: Request, res: Response) => {
   // create workspace and add user as member
   const workspace = await create({
     name: workspaceName,
-    organizationId: new Types.ObjectId(organizationId),
+    organizationId: new Types.ObjectId(organizationId)
   });
 
   await addMemberships({
     userIds: [req.user._id],
     workspaceId: workspace._id.toString(),
-    roles: [ADMIN],
+    roles: [ADMIN]
   });
 
   return res.status(200).send({
-    workspace,
+    workspace
   });
 };
 
@@ -160,11 +168,11 @@ export const deleteWorkspace = async (req: Request, res: Response) => {
 
   // delete workspace
   await deleteWork({
-    id: workspaceId,
+    id: workspaceId
   });
 
   return res.status(200).send({
-    message: "Successfully deleted workspace",
+    message: "Successfully deleted workspace"
   });
 };
 
@@ -180,19 +188,19 @@ export const changeWorkspaceName = async (req: Request, res: Response) => {
 
   const workspace = await Workspace.findOneAndUpdate(
     {
-      _id: workspaceId,
+      _id: workspaceId
     },
     {
-      name,
+      name
     },
     {
-      new: true,
+      new: true
     }
   );
 
   return res.status(200).send({
     message: "Successfully changed workspace name",
-    workspace,
+    workspace
   });
 };
 
@@ -206,11 +214,11 @@ export const getWorkspaceIntegrations = async (req: Request, res: Response) => {
   const { workspaceId } = req.params;
 
   const integrations = await Integration.find({
-    workspace: workspaceId,
+    workspace: workspaceId
   });
 
   return res.status(200).send({
-    integrations,
+    integrations
   });
 };
 
@@ -220,18 +228,15 @@ export const getWorkspaceIntegrations = async (req: Request, res: Response) => {
  * @param res
  * @returns
  */
-export const getWorkspaceIntegrationAuthorizations = async (
-  req: Request,
-  res: Response
-) => {
+export const getWorkspaceIntegrationAuthorizations = async (req: Request, res: Response) => {
   const { workspaceId } = req.params;
 
   const authorizations = await IntegrationAuth.find({
-    workspace: workspaceId,
+    workspace: workspaceId
   });
 
   return res.status(200).send({
-    authorizations,
+    authorizations
   });
 };
 
@@ -241,18 +246,15 @@ export const getWorkspaceIntegrationAuthorizations = async (
  * @param res
  * @returns
  */
-export const getWorkspaceServiceTokens = async (
-  req: Request,
-  res: Response
-) => {
+export const getWorkspaceServiceTokens = async (req: Request, res: Response) => {
   const { workspaceId } = req.params;
   // ?? FIX.
   const serviceTokens = await ServiceToken.find({
     user: req.user._id,
-    workspace: workspaceId,
+    workspace: workspaceId
   });
 
   return res.status(200).send({
-    serviceTokens,
+    serviceTokens
   });
 };

backend/src/controllers/v2/organizationsController.ts

@@ -6,6 +6,15 @@ import { updateSubscriptionOrgQuantity } from "../../helpers/organization";
 import Role from "../../models/role";
 import { BadRequestError } from "../../utils/errors";
 import { CUSTOM } from "../../variables";
+import * as reqValidator from "../../validation/organization";
+import { validateRequest } from "../../helpers/validation";
+import {
+  GeneralPermissionActions,
+  OrgPermissionSubjects,
+  WorkspacePermissionActions,
+  getUserOrgPermissions
+} from "../../services/RoleService";
+import { ForbiddenError } from "@casl/ability";
 
 /**
  * Return memberships for organization with id [organizationId]
@@ -46,7 +55,15 @@ export const getOrganizationMemberships = async (req: Request, res: Response) =>
         }
     }   
     */
-  const { organizationId } = req.params;
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgMembersv2, req);
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    GeneralPermissionActions.Read,
+    OrgPermissionSubjects.Member
+  );
 
   const memberships = await MembershipOrg.find({
     organization: organizationId
@@ -116,8 +133,15 @@ export const updateOrganizationMembership = async (req: Request, res: Response)
         }
     }   
     */
-  const { membershipId } = req.params;
-  const { role } = req.body;
+  const {
+    params: { organizationId, membershipId },
+    body: { role }
+  } = await validateRequest(reqValidator.UpdateOrgMemberv2, req);
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    GeneralPermissionActions.Edit,
+    OrgPermissionSubjects.Member
+  );
 
   const isCustomRole = !["admin", "member", "owner"].includes(role);
   if (isCustomRole) {
@@ -191,7 +215,14 @@ export const deleteOrganizationMembership = async (req: Request, res: Response)
         }
     }   
     */
-  const { membershipId } = req.params;
+  const {
+    params: { organizationId, membershipId }
+  } = await validateRequest(reqValidator.DeleteOrgMemberv2, req);
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    GeneralPermissionActions.Delete,
+    OrgPermissionSubjects.Member
+  );
 
   // delete organization membership
   const membership = await deleteMembershipOrg({
@@ -247,7 +278,15 @@ export const getOrganizationWorkspaces = async (req: Request, res: Response) =>
         }
     }   
     */
-  const { organizationId } = req.params;
+  const {
+    params: { organizationId }
+  } = await validateRequest(reqValidator.GetOrgWorkspacesv2, req);
+
+  const { permission } = await getUserOrgPermissions(req.user._id, organizationId);
+  ForbiddenError.from(permission).throwUnlessCan(
+    WorkspacePermissionActions.Read,
+    OrgPermissionSubjects.Workspace
+  );
 
   const workspacesSet = new Set(
     (