Checkpoint service accounts

backend/src/controllers/v2/index.ts

@@ -7,6 +7,7 @@ import * as serviceTokenDataController from './serviceTokenDataController';
 import * as apiKeyDataController from './apiKeyDataController';
 import * as secretController from './secretController';
 import * as secretsController from './secretsController';
+import * as serviceAccountsController from './serviceAccountsController';
 import * as environmentController from './environmentController';
 import * as tagController from './tagController';
 
@@ -20,6 +21,7 @@ export {
     apiKeyDataController,
     secretController,
     secretsController,
+    serviceAccountsController,
     environmentController,
     tagController
 }

backend/src/controllers/v2/organizationsController.ts

@@ -1,9 +1,11 @@
 import { Request, Response } from 'express';
 import * as Sentry from '@sentry/node';
+import { Types } from 'mongoose';
 import { 
     MembershipOrg,
     Membership,
-    Workspace
+    Workspace,
+    ServiceAccount
 } from '../../models';
 import { deleteMembershipOrg } from '../../helpers/membershipOrg';
 import { updateSubscriptionOrgQuantity } from '../../helpers/organization';
@@ -260,37 +262,44 @@ export const getOrganizationWorkspaces = async (req: Request, res: Response) =>
         }
     }   
     */
-    let workspaces;
-    try {
-        const { organizationId } = req.params;
+    const { organizationId } = req.params;
 
-		const workspacesSet = new Set(
-			(
-				await Workspace.find(
-					{
-						organization: organizationId
-					},
-					'_id'
-				)
-			).map((w) => w._id.toString())
-		);
+    const workspacesSet = new Set(
+        (
+            await Workspace.find(
+                {
+                    organization: organizationId
+                },
+                '_id'
+            )
+        ).map((w) => w._id.toString())
+    );
 
-		workspaces = (
-			await Membership.find({
-				user: req.user._id
-			}).populate('workspace')
-		)
-			.filter((m) => workspacesSet.has(m.workspace._id.toString()))
-			.map((m) => m.workspace);
-    } catch (err) {
-        Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get organization workspaces'
-		});	
-    }
-    
-    return res.status(200).send({
+    const workspaces = (
+        await Membership.find({
+            user: req.user._id
+        }).populate('workspace')
+    )
+    .filter((m) => workspacesSet.has(m.workspace._id.toString()))
+    .map((m) => m.workspace);
+
+return res.status(200).send({
         workspaces
     });
+}
+
+/**
+ * Return service accounts for organization with id [organizationId]
+ * @param req 
+ * @param res 
+ */
+export const getOrganizationServiceAccounts = async (req: Request, res: Response) => {
+    const { organizationId } = req.params;
+    const serviceAccounts = await ServiceAccount.find({
+        organization: new Types.ObjectId(organizationId)
+    });
+    
+    return res.status(200).send({
+        serviceAccounts
+    });
 }

backend/src/controllers/v2/serviceAccountsController.ts

@@ -0,0 +1,178 @@
+import { Request, Response } from 'express';
+import { Types } from 'mongoose';
+import { 
+    ServiceAccount,
+    ServiceAccountKey,
+    ServiceAccountPermission
+} from '../../models';
+import {
+    CreateServiceAccountDto
+} from '../../interfaces/serviceAccounts/dto';
+
+/**
+ * Create a new service account under organization with id [organizationId]
+ * that has access to workspaces [workspaces]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const createServiceAccount = async (req: Request, res: Response) => {
+    const {
+        organizationId,
+        name,
+        publicKey,
+        expiresIn,
+    }: CreateServiceAccountDto = req.body;
+
+    let expiresAt;
+    if (expiresIn) {
+        expiresAt = new Date();
+        expiresAt.setSeconds(expiresAt.getSeconds() + expiresIn);
+    }
+    
+    const serviceAccount = await new ServiceAccount({
+        name,
+        organization: new Types.ObjectId(organizationId),
+        user: req.user,
+        publicKey,
+        expiresAt
+    }).save();
+
+    // await Promise.all(
+    //     workspaces.map(async ({ 
+    //         workspaceId, 
+    //         environments, 
+    //         permissions,
+    //         encryptedKey,
+    //         nonce
+    //     }: {
+    //         workspaceId: string;
+    //         environments: string[];
+    //         permissions: string[];
+    //         encryptedKey: string;
+    //         nonce: string;
+    //     }) => {
+    //         const serviceAccountKey = await new ServiceAccountKey({
+    //             encryptedKey,
+    //             nonce,
+    //             sender: req.user._id,
+    //             serviceAccount: serviceAccount._id,
+    //             workspace: new Types.ObjectId(workspaceId)
+    //         });
+            
+    //         console.log('serviceAccountKey: ', serviceAccountKey);
+            
+    //         await Promise.all(
+    //             permissions.map(async (name: string) => {
+    //                 const permission = await new ServiceAccountPermission({
+    //                     serviceAccount: serviceAccount._id,
+    //                     name,
+    //                     workspace: new Types.ObjectId(workspaceId),
+    //                     environments
+    //                 }).save();
+
+    //                 console.log('permission: ', permission);
+    //             })
+    //         );
+    //     })
+    // );
+    
+    return res.status(200).send({
+        serviceAccount
+    });
+}
+
+// /**
+//  * Add a service account key to service account with id [serviceAccountId]
+//  * for workspace with id [workspaceId]
+//  * @param req 
+//  * @param res 
+//  * @returns 
+//  */
+// export const addServiceAccountKey = async (req: Request, res: Response) => {
+//     const {
+//         workspaceId,
+//         encryptedKey,
+//         nonce
+//     } = req.body;
+    
+//     const serviceAccountKey = await new ServiceAccountKey({
+//         encryptedKey,
+//         nonce,
+//         sender: req.user._id,
+//         serviceAccount: req.serviceAccount._d,
+//         workspace: new Types.ObjectId(workspaceId)
+//     }).save();
+
+//     return serviceAccountKey;
+// }
+
+/**
+ * Delete service account with id [serviceAccountId]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const deleteServiceAccount = async (req: Request, res: Response) => {
+    const { serviceAccountId } = req.params;
+
+    const serviceAccount = await ServiceAccount.findByIdAndDelete(serviceAccountId);
+
+    await ServiceAccountKey.deleteMany({
+        serviceAccount: new Types.ObjectId(serviceAccountId)
+    });
+    
+    return res.status(200).send({
+        serviceAccount
+    });
+}
+
+export const addServiceAccountWorkspaceAccess = async (req: Request, res: Response) => {
+    const { serviceAccountId, workspaceId } = req.params;
+    const {
+        encryptedKey,
+        nonce,
+        permissions // should contain environments
+    } = req.body;
+
+    const serviceAccountKey = await new ServiceAccountKey({
+        encryptedKey,
+        nonce,
+        sender: req.user._id,
+        serviceAccount: req.serviceAccount._id,
+        workspace: new Types.ObjectId('workspaceId')
+    });
+    
+    const serviceAccountPermissions = await Promise.all(
+        permissions.map
+    );
+}
+
+export const deleteServiceAccountWorkspaceAccess = async (req: Request, res: Response) => {
+    // TODO
+}
+
+// /**
+//  * Add a service account key to service account with id [serviceAccountId]
+//  * for workspace with id [workspaceId]
+//  * @param req 
+//  * @param res 
+//  * @returns 
+//  */
+// export const addServiceAccountKey = async (req: Request, res: Response) => {
+//     const {
+//         workspaceId,
+//         encryptedKey,
+//         nonce
+//     } = req.body;
+    
+//     const serviceAccountKey = await new ServiceAccountKey({
+//         encryptedKey,
+//         nonce,
+//         sender: req.user._id,
+//         serviceAccount: req.serviceAccount._d,
+//         workspace: new Types.ObjectId(workspaceId)
+//     }).save();
+
+//     return serviceAccountKey;
+// }