Merge branch 'main' into gitlab-sso

backend/src/ee/routes/v1/action.ts

@@ -1,17 +1,8 @@
 import express from "express";
 const router = express.Router();
-import {
-    validateRequest,
-} from "../../../middleware";
-import { param } from "express-validator";
 import { actionController } from "../../controllers/v1";
 
 // TODO: put into action controller
-router.get(
-    "/:actionId",
-    param("actionId").exists().trim(),
-    validateRequest,
-    actionController.getAction
-);
+router.get("/:actionId", actionController.getAction);
 
-export default router;
+export default router;

backend/src/ee/routes/v1/cloudProducts.ts

@@ -1,21 +1,16 @@
 import express from "express";
 const router = express.Router();
-import {
-    requireAuth,
-    validateRequest,
-} from "../../../middleware";
-import { query } from "express-validator";
+import { requireAuth, validateRequest } from "../../../middleware";
 import { cloudProductsController } from "../../controllers/v1";
 import { AuthMode } from "../../../variables";
 
 router.get(
-    "/",
-    requireAuth({
-		acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
-	}),
-    query("billing-cycle").exists().isIn(["monthly", "yearly"]),
-    validateRequest,
-    cloudProductsController.getCloudProducts 
+  "/",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  validateRequest,
+  cloudProductsController.getCloudProducts
 );
 
-export default router;
+export default router;

backend/src/ee/routes/v1/index.ts

@@ -7,15 +7,17 @@ import workspace from "./workspace";
 import action from "./action";
 import cloudProducts from "./cloudProducts";
 import secretScanning from "./secretScanning";
+import roles from "./role";
 
 export {
-    secret,
-    secretSnapshot,
-    organizations,
-    sso,
-    users,
-    workspace,
-    action,
-    cloudProducts,
-    secretScanning
-}
+  secret,
+  secretSnapshot,
+  organizations,
+  sso,
+  users,
+  workspace,
+  action,
+  cloudProducts,
+  secretScanning,
+  roles
+};

backend/src/ee/routes/v1/organizations.ts

@@ -1,237 +1,127 @@
 import express from "express";
 const router = express.Router();
-import {
-    requireAuth,
-    requireOrganizationAuth,
-    validateRequest,
-} from "../../../middleware";
-import { body, param, query } from "express-validator";
+import { requireAuth } from "../../../middleware";
 import { organizationsController } from "../../controllers/v1";
-import {
-    ACCEPTED, ADMIN, AuthMode, MEMBER, OWNER
-} from "../../../variables";
+import { AuthMode } from "../../../variables";
 
 router.get(
-    "/:organizationId/plans/table",
-    requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    query("billingCycle").exists().isString().isIn(["monthly", "yearly"]),
-    validateRequest,
-    organizationsController.getOrganizationPlansTable
+  "/:organizationId/plans/table",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.getOrganizationPlansTable
 );
 
 router.get(
-    "/:organizationId/plan",
-    requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    query("workspaceId").optional().isString(),
-    validateRequest,
-    organizationsController.getOrganizationPlan
+  "/:organizationId/plan",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.getOrganizationPlan
 );
 
 router.post(
-    "/:organizationId/session/trial",
-    requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    body("success_url").exists().trim(),
-    validateRequest,
-    organizationsController.startOrganizationTrial
+  "/:organizationId/session/trial",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.startOrganizationTrial
 );
 
 router.get(
-    "/:organizationId/plan/billing",
-    requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    query("workspaceId").optional().isString(),
-    validateRequest,
-    organizationsController.getOrganizationPlanBillingInfo
+  "/:organizationId/plan/billing",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.getOrganizationPlanBillingInfo
 );
 
 router.get(
-    "/:organizationId/plan/table",
-    requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    query("workspaceId").optional().isString(),
-    validateRequest,
-    organizationsController.getOrganizationPlanTable
+  "/:organizationId/plan/table",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.getOrganizationPlanTable
 );
 
 router.get(
-    "/:organizationId/billing-details",
-    requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    validateRequest,
-    organizationsController.getOrganizationBillingDetails
+  "/:organizationId/billing-details",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.getOrganizationBillingDetails
 );
 
 router.patch(
-    "/:organizationId/billing-details",
-    requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    body("email").optional().isString().trim(),
-    body("name").optional().isString().trim(),
-    validateRequest,
-    organizationsController.updateOrganizationBillingDetails
+  "/:organizationId/billing-details",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.updateOrganizationBillingDetails
 );
 
 router.get(
-    "/:organizationId/billing-details/payment-methods",
-    requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    validateRequest,
-    organizationsController.getOrganizationPmtMethods
+  "/:organizationId/billing-details/payment-methods",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.getOrganizationPmtMethods
 );
 
 router.post(
-    "/:organizationId/billing-details/payment-methods",
-    requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    body("success_url").exists().isString(),
-    body("cancel_url").exists().isString(),
-    validateRequest,
-    organizationsController.addOrganizationPmtMethod
+  "/:organizationId/billing-details/payment-methods",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.addOrganizationPmtMethod
 );
 
 router.delete(
-    "/:organizationId/billing-details/payment-methods/:pmtMethodId",
-    requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    param("pmtMethodId").exists().trim(),
-    validateRequest,
-    organizationsController.deleteOrganizationPmtMethod
+  "/:organizationId/billing-details/payment-methods/:pmtMethodId",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.deleteOrganizationPmtMethod
 );
 
 router.get(
-    "/:organizationId/billing-details/tax-ids",
-    requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    validateRequest,
-    organizationsController.getOrganizationTaxIds
+  "/:organizationId/billing-details/tax-ids",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.getOrganizationTaxIds
 );
 
 router.post(
-    "/:organizationId/billing-details/tax-ids",
-    requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    body("type").exists().isString(),
-    body("value").exists().isString(),
-    validateRequest,
-    organizationsController.addOrganizationTaxId
+  "/:organizationId/billing-details/tax-ids",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.addOrganizationTaxId
 );
 
 router.delete(
-    "/:organizationId/billing-details/tax-ids/:taxId",
-    requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    param("taxId").exists().trim(),
-    validateRequest,
-    organizationsController.deleteOrganizationTaxId
+  "/:organizationId/billing-details/tax-ids/:taxId",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.deleteOrganizationTaxId
 );
 
 router.get(
-    "/:organizationId/invoices",
-    requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    validateRequest,
-    organizationsController.getOrganizationInvoices
+  "/:organizationId/invoices",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.getOrganizationInvoices
 );
 
 router.get(
-    "/:organizationId/licenses",
-    requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    param("organizationId").exists().trim(),
-    validateRequest,
-    organizationsController.getOrganizationLicenses
+  "/:organizationId/licenses",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationsController.getOrganizationLicenses
 );
 
-export default router;
+export default router;

backend/src/ee/routes/v1/role.ts

@@ -0,0 +1,33 @@
+import express from "express";
+import { roleController } from "../../controllers/v1";
+import { requireAuth } from "../../../middleware";
+import { AuthMode } from "../../../variables";
+
+const router = express.Router();
+
+router.post("/", requireAuth({ acceptedAuthModes: [AuthMode.JWT] }), roleController.createRole);
+
+router.patch("/:id", requireAuth({ acceptedAuthModes: [AuthMode.JWT] }), roleController.updateRole);
+
+router.delete(
+  "/:id",
+  requireAuth({ acceptedAuthModes: [AuthMode.JWT] }),
+  roleController.deleteRole
+);
+
+router.get("/", requireAuth({ acceptedAuthModes: [AuthMode.JWT] }), roleController.getRoles);
+
+// get a user permissions in an org
+router.get(
+  "/organization/:orgId/permissions",
+  requireAuth({ acceptedAuthModes: [AuthMode.JWT] }),
+  roleController.getUserPermissions
+);
+
+router.get(
+  "/workspace/:workspaceId/permissions",
+  requireAuth({ acceptedAuthModes: [AuthMode.JWT] }),
+  roleController.getUserWorkspacePermissions
+);
+
+export default router;

backend/src/ee/routes/v1/secret.ts

@@ -1,48 +1,25 @@
 import express from "express";
 const router = express.Router();
-import {
-    requireAuth,
-	requireSecretAuth,
-    validateRequest,
-} from "../../../middleware";
-import { body, param, query } from "express-validator";
+import { requireAuth } from "../../../middleware";
 import { secretController } from "../../controllers/v1";
 import {
-	ADMIN, 
-	AuthMode,
-	MEMBER,
-	PERMISSION_READ_SECRETS,
-	PERMISSION_WRITE_SECRETS
+  AuthMode
 } from "../../../variables";
 
 router.get(
-	"/:secretId/secret-versions",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
-	}),
-	requireSecretAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		requiredPermissions: [PERMISSION_READ_SECRETS],
-	}),
-	param("secretId").exists().trim(),
-	query("offset").exists().isInt(),
-	query("limit").exists().isInt(),
-	validateRequest,
-	secretController.getSecretVersions
+  "/:secretId/secret-versions",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  secretController.getSecretVersions
 );
 
 router.post(
-	"/:secretId/secret-versions/rollback",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
-	}),
-	requireSecretAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		requiredPermissions: [PERMISSION_READ_SECRETS, PERMISSION_WRITE_SECRETS],
-	}),
-	param("secretId").exists().trim(),
-	body("version").exists().isInt(),
-	secretController.rollbackSecretVersion
+  "/:secretId/secret-versions/rollback",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  secretController.rollbackSecretVersion
 );
 
-export default router;
+export default router;

backend/src/ee/routes/v1/secretScanning.ts

@@ -1,81 +1,53 @@
 import express from "express";
 const router = express.Router();
+import { requireAuth } from "../../../middleware";
 import {
-  requireAuth,
-  requireOrganizationAuth,
-  validateRequest,
-} from "../../../middleware";
-import { body, param } from "express-validator";
-import { createInstallationSession, getCurrentOrganizationInstallationStatus, getRisksForOrganization, linkInstallationToOrganization, updateRisksStatus } from "../../../controllers/v1/secretScanningController";
-import { ACCEPTED, ADMIN, AuthMode, MEMBER, OWNER } from "../../../variables";
+  createInstallationSession,
+  getCurrentOrganizationInstallationStatus,
+  getRisksForOrganization,
+  linkInstallationToOrganization,
+  updateRisksStatus
+} from "../../../controllers/v1/secretScanningController";
+import { AuthMode } from "../../../variables";
 
 router.post(
   "/create-installation-session/organization/:organizationId",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT],
+    acceptedAuthModes: [AuthMode.JWT]
   }),
-  param("organizationId").exists().trim(),
-  requireOrganizationAuth({
-    acceptedRoles: [OWNER, ADMIN, MEMBER],
-    acceptedStatuses: [ACCEPTED],
-  }),
-  validateRequest,
   createInstallationSession
 );
 
 router.post(
   "/link-installation",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT],
+    acceptedAuthModes: [AuthMode.JWT]
   }),
-  body("installationId").exists().trim(),
-  body("sessionId").exists().trim(),
-  validateRequest,
   linkInstallationToOrganization
 );
 
 router.get(
   "/installation-status/organization/:organizationId",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT],
+    acceptedAuthModes: [AuthMode.JWT]
   }),
-  param("organizationId").exists().trim(),
-  requireOrganizationAuth({
-    acceptedRoles: [OWNER, ADMIN, MEMBER],
-    acceptedStatuses: [ACCEPTED],
-  }),
-  validateRequest,
   getCurrentOrganizationInstallationStatus
 );
 
 router.get(
   "/organization/:organizationId/risks",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT],
+    acceptedAuthModes: [AuthMode.JWT]
   }),
-  param("organizationId").exists().trim(),
-  requireOrganizationAuth({
-    acceptedRoles: [OWNER, ADMIN, MEMBER],
-    acceptedStatuses: [ACCEPTED],
-  }),
-  validateRequest,
   getRisksForOrganization
 );
 
 router.post(
   "/organization/:organizationId/risks/:riskId/status",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT],
+    acceptedAuthModes: [AuthMode.JWT]
   }),
-  param("organizationId").exists().trim(),
-  param("riskId").exists().trim(),
-  body("status").exists(),
-  requireOrganizationAuth({
-    acceptedRoles: [OWNER, ADMIN, MEMBER],
-    acceptedStatuses: [ACCEPTED],
-  }),
-  validateRequest,
   updateRisksStatus
 );
 
-export default router;
+export default router;

backend/src/ee/routes/v1/secretSnapshot.ts

@@ -1,27 +1,15 @@
 import express from "express";
 const router = express.Router();
-import {
-    requireSecretSnapshotAuth,
-} from "../../middleware";
-import {
-    requireAuth,
-    validateRequest,
-} from "../../../middleware";
-import { param } from "express-validator";
-import { ADMIN, AuthMode, MEMBER } from "../../../variables";
+import { requireAuth } from "../../../middleware";
+import { AuthMode } from "../../../variables";
 import { secretSnapshotController } from "../../controllers/v1";
 
 router.get(
-    "/:secretSnapshotId",
-    requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-    requireSecretSnapshotAuth({
-        acceptedRoles: [ADMIN, MEMBER],
-    }),
-    param("secretSnapshotId").exists().trim(),
-    validateRequest,
-    secretSnapshotController.getSecretSnapshot
+  "/:secretSnapshotId",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  secretSnapshotController.getSecretSnapshot
 );
 
-export default router;
+export default router;

backend/src/ee/routes/v1/sso.ts

@@ -1,66 +1,49 @@
 import express from "express";
 const router = express.Router();
 import passport from "passport";
-import {
-  AuthProvider
-} from "../../models";
-import {
-    requireAuth,
-    requireOrganizationAuth,
-    validateRequest,
-} from "../../../middleware";
-import { body, query } from "express-validator";
+import { requireAuth } from "../../../middleware";
 import { ssoController } from "../../controllers/v1";
 import { authLimiter } from "../../../helpers/rateLimiter";
-import {
-    ACCEPTED,
-    ADMIN,
-    AuthMode,
-    OWNER
-} from "../../../variables";
+import { AuthMode } from "../../../variables";
 
-router.get(
-  "/redirect/google",
-  authLimiter,
-  (req, res, next) => {
-    passport.authenticate("google", {
-      scope: ["profile", "email"],
-      session: false,
-      ...(req.query.callback_port ? {
-        state: req.query.callback_port as string
-      } : {})
-    })(req, res, next);
-  }
-);
+router.get("/redirect/google", authLimiter, (req, res, next) => {
+  passport.authenticate("google", {
+    scope: ["profile", "email"],
+    session: false,
+    ...(req.query.callback_port
+      ? {
+          state: req.query.callback_port as string
+        }
+      : {})
+  })(req, res, next);
+});
 
 router.get(
   "/google",
-  passport.authenticate("google", { 
-    failureRedirect: "/login/provider/error", 
-    session: false 
+  passport.authenticate("google", {
+    failureRedirect: "/login/provider/error",
+    session: false
   }),
   ssoController.redirectSSO
 );
 
-router.get(
-  "/redirect/github",
-  authLimiter,
-  (req, res, next) => {
-    passport.authenticate("github", {
-      session: false,
-      ...(req.query.callback_port ? {
-        state: req.query.callback_port as string
-      } : {})
-    })(req, res, next);
-  }
-);
+router.get("/redirect/github", authLimiter, (req, res, next) => {
+  passport.authenticate("github", {
+    session: false,
+    ...(req.query.callback_port
+      ? {
+          state: req.query.callback_port as string
+        }
+      : {})
+  })(req, res, next);
+});
 
 router.get(
   "/github",
   authLimiter,
-  passport.authenticate("github", { 
-    failureRedirect: "/login/provider/error", 
-    session: false 
+  passport.authenticate("github", {
+    failureRedirect: "/login/provider/error",
+    session: false
   }),
   ssoController.redirectSSO
 );
@@ -102,68 +85,38 @@ router.get(
   }
 );
 
-router.post("/saml2/:ssoIdentifier",
-  passport.authenticate("saml", { 
-    failureRedirect: "/login/provider/error", 
-    failureFlash: true, 
+router.post(
+  "/saml2/:ssoIdentifier",
+  passport.authenticate("saml", {
+    failureRedirect: "/login/provider/error",
+    failureFlash: true,
     session: false
   }),
   ssoController.redirectSSO
 );
 
 router.get(
-    "/config",
-    requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN],
-        acceptedStatuses: [ACCEPTED],
-        locationOrganizationId: "query"
-    }),
-    query("organizationId").exists().trim(),
-    validateRequest,
-    ssoController.getSSOConfig
+  "/config",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  ssoController.getSSOConfig
 );
 
 router.post(
-    "/config",
-    requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN],
-        acceptedStatuses: [ACCEPTED],
-        locationOrganizationId: "body"
-    }),
-    body("organizationId").exists().trim(),
-    body("authProvider").exists().isString().isIn([AuthProvider.OKTA_SAML]),
-    body("isActive").exists().isBoolean(),
-    body("entryPoint").exists().isString(),
-    body("issuer").exists().isString(),
-    body("cert").exists().isString(),
-    validateRequest,
-    ssoController.createSSOConfig
+  "/config",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  ssoController.createSSOConfig
 );
 
 router.patch(
-    "/config",
-    requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN],
-        acceptedStatuses: [ACCEPTED],
-        locationOrganizationId: "body"
-    }),
-    body("organizationId").exists().trim(),
-    body("authProvider").optional().isString(),
-    body("isActive").optional().isBoolean(),
-    body("entryPoint").optional().isString(),
-    body("issuer").optional().isString(),
-    body("cert").optional().isString(),
-    validateRequest,
-    ssoController.updateSSOConfig
+  "/config",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  ssoController.updateSSOConfig
 );
 
-export default router;
+export default router;

backend/src/ee/routes/v1/workspace.ts

@@ -1,182 +1,85 @@
 import express from "express";
 const router = express.Router();
-import {
-  requireAuth,
-  requireWorkspaceAuth,
-  validateRequest,
-} from "../../../middleware";
-import { body, param, query } from "express-validator";
-import {
-  ADMIN, 
-  AuthMode,
-  MEMBER
-} from "../../../variables";
+import { requireAuth } from "../../../middleware";
+import { AuthMode } from "../../../variables";
 import { workspaceController } from "../../controllers/v1";
-import { EventType, UserAgentType } from "../../models";
 
 router.get(
   "/:workspaceId/secret-snapshots",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "params",
-  }),
-  param("workspaceId").exists().trim(),
-  query("environment").isString().exists().trim(),
-  query("folderId").default("root").isString().trim(),
-  query("offset").exists().isInt(),
-  query("limit").exists().isInt(),
-  validateRequest,
   workspaceController.getWorkspaceSecretSnapshots
 );
 
 router.get(
   "/:workspaceId/secret-snapshots/count",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT],
+    acceptedAuthModes: [AuthMode.JWT]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "params",
-  }),
-  param("workspaceId").exists().trim(),
-  query("environment").isString().exists().trim(),
-  query("folderId").default("root").isString().trim(),
-  validateRequest,
   workspaceController.getWorkspaceSecretSnapshotsCount
 );
 
 router.post(
   "/:workspaceId/secret-snapshots/rollback",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "params",
-  }),
-  param("workspaceId").exists().trim(),
-  body("environment").isString().exists().trim(),
-  query("folderId").default("root").isString().exists().trim(),
-  body("version").exists().isInt(),
-  validateRequest,
   workspaceController.rollbackWorkspaceSecretSnapshot
 );
 
 router.get(
   "/:workspaceId/logs",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "params",
-  }),
-  param("workspaceId").exists().trim(),
-  query("offset").exists().isInt(),
-  query("limit").exists().isInt(),
-  query("sortBy"),
-  query("userId"),
-  query("actionNames"),
-  validateRequest,
   workspaceController.getWorkspaceLogs
 );
 
 router.get(
   "/:workspaceId/audit-logs",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "params",
-  }),
-  param("workspaceId").exists().trim(),
-  query("eventType").isString().isIn(Object.values(EventType)).optional({ nullable: true }),
-  query("userAgentType").isString().isIn(Object.values(UserAgentType)).optional({ nullable: true }),
-  query("actor").optional({ nullable: true }),
-  query("startDate").isISO8601().withMessage("Invalid start date format").optional({ nullable: true }),
-  query("endDate").isISO8601().withMessage("Invalid end date format").optional({ nullable: true }),
-  query("offset"),
-  query("limit"),
-  validateRequest,
   workspaceController.getWorkspaceAuditLogs
 );
 
 router.get(
   "/:workspaceId/audit-logs/filters/actors",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "params",
-  }),
-  param("workspaceId").exists().trim(),
-  validateRequest,
   workspaceController.getWorkspaceAuditLogActorFilterOpts
 );
 
 router.get(
   "/:workspaceId/trusted-ips",
-  param("workspaceId").exists().isString().trim(),
   requireAuth({
-      acceptedAuthModes: [AuthMode.JWT],
-  }),
-  requireWorkspaceAuth({
-      acceptedRoles: [ADMIN, MEMBER],
-      locationWorkspaceId: "params",
+    acceptedAuthModes: [AuthMode.JWT]
   }),
   workspaceController.getWorkspaceTrustedIps
 );
 
 router.post(
   "/:workspaceId/trusted-ips",
-  param("workspaceId").exists().isString().trim(),
-  body("ipAddress").exists().isString().trim(),
-  body("comment").default("").isString().trim(),
-  body("isActive").exists().isBoolean(),
-  validateRequest,
   requireAuth({
-      acceptedAuthModes: [AuthMode.JWT],
-  }),
-  requireWorkspaceAuth({
-      acceptedRoles: [ADMIN],
-      locationWorkspaceId: "params",
+    acceptedAuthModes: [AuthMode.JWT]
   }),
   workspaceController.addWorkspaceTrustedIp
 );
 
 router.patch(
   "/:workspaceId/trusted-ips/:trustedIpId",
-  param("workspaceId").exists().isString().trim(),
-  param("trustedIpId").exists().isString().trim(),
-  body("ipAddress").isString().trim().default(""),
-  body("comment").default("").isString().trim(),
-  validateRequest,
   requireAuth({
-      acceptedAuthModes: [AuthMode.JWT],
-  }),
-  requireWorkspaceAuth({
-      acceptedRoles: [ADMIN],
-      locationWorkspaceId: "params",
+    acceptedAuthModes: [AuthMode.JWT]
   }),
   workspaceController.updateWorkspaceTrustedIp
 );
 
 router.delete(
   "/:workspaceId/trusted-ips/:trustedIpId",
-  param("workspaceId").exists().isString().trim(),
-  param("trustedIpId").exists().isString().trim(),
-  validateRequest,
   requireAuth({
-      acceptedAuthModes: [AuthMode.JWT],
-  }),
-  requireWorkspaceAuth({
-      acceptedRoles: [ADMIN],
-      locationWorkspaceId: "params",
+    acceptedAuthModes: [AuthMode.JWT]
   }),
   workspaceController.deleteWorkspaceTrustedIp
 );