Checkpoint service accounts

backend/src/middleware/index.ts

@@ -10,6 +10,7 @@ import requireIntegrationAuth from './requireIntegrationAuth';
 import requireIntegrationAuthorizationAuth from './requireIntegrationAuthorizationAuth';
 import requireServiceTokenAuth from './requireServiceTokenAuth';
 import requireServiceTokenDataAuth from './requireServiceTokenDataAuth';
+import requireServiceAccountAuth from './requireServiceAccountAuth';
 import requireSecretAuth from './requireSecretAuth';
 import requireSecretsAuth from './requireSecretsAuth';
 import validateRequest from './validateRequest';
@@ -27,6 +28,7 @@ export {
 	requireIntegrationAuthorizationAuth,
 	requireServiceTokenAuth,
 	requireServiceTokenDataAuth,
+	requireServiceAccountAuth,
 	requireSecretAuth,
 	requireSecretsAuth,
 	validateRequest

backend/src/middleware/requireOrganizationAuth.ts

@@ -2,6 +2,8 @@ import { Request, Response, NextFunction } from 'express';
 import { IOrganization, MembershipOrg } from '../models';
 import { UnauthorizedRequestError, ValidationError } from '../utils/errors';
 
+type req = 'params' | 'body' | 'query';
+
 /**
  * Validate if user on request is a member with proper roles for organization
  * on request params.
@@ -11,18 +13,22 @@ import { UnauthorizedRequestError, ValidationError } from '../utils/errors';
  */
 const requireOrganizationAuth = ({
 	acceptedRoles,
-	acceptedStatuses
+	acceptedStatuses,
+	location = 'params'
 }: {
 	acceptedRoles: string[];
 	acceptedStatuses: string[];
+	location?: req;
 }) => {
 	return async (req: Request, res: Response, next: NextFunction) => {
 		// organization authorization middleware
+		
+		const { organizationId } = req[location];
 
 		// validate organization membership
 		const membershipOrg = await MembershipOrg.findOne({
 			user: req.user._id,
-			organization: req.params.organizationId
+			organization: organizationId
 		}).populate<{ organization: IOrganization }>('organization');
 
 

backend/src/middleware/requireServiceAccountAuth.ts

@@ -0,0 +1,39 @@
+import { Request, Response, NextFunction } from 'express';
+import { ServiceAccount } from '../models';
+import {
+    AccountNotFoundError,
+    UnauthorizedRequestError
+} from '../utils/errors';
+
+type req = 'params' | 'body' | 'query';
+
+const requireServiceAccountAuth = ({
+    acceptedRoles,
+    acceptedStatuses,
+    location = 'params'
+}: {
+    acceptedRoles: string[];
+    acceptedStatuses: string[];
+    location?: req;
+}) => {
+    return async (req: Request, res: Response, next: NextFunction) => {
+        const serviceAccountId = req[location].serviceAccountId;
+        const serviceAccount = await ServiceAccount.findById(serviceAccountId); 
+        
+        // TODO: acceptedRoles and acceptedStatuses
+        
+        if (!serviceAccount) {
+            return next(AccountNotFoundError({ message: 'Failed to locate Service Account' }));
+        }
+        
+        if (serviceAccount.user.toString() !== req.user.id.toString()) {
+            return next(UnauthorizedRequestError({ message: 'Failed to authenticate the Service Account' }));
+        }
+        
+        req.serviceAccount = serviceAccount;
+        
+        next();
+    }
+}
+
+export default requireServiceAccountAuth;