Merge branch 'main' into gitlab-sso

backend/src/routes/v1/auth.ts

@@ -1,6 +1,5 @@
 import express from "express";
 const router = express.Router();
-import { body } from "express-validator";
 import { requireAuth, validateRequest } from "../../middleware";
 import { authController } from "../../controllers/v1";
 import { authLimiter } from "../../helpers/rateLimiter";
@@ -12,9 +11,6 @@ router.post(
   // TODO endpoint: deprecate (moved to api/v3/auth/login1)
   "/login1",
   authLimiter,
-  body("email").exists().trim().notEmpty().toLowerCase(),
-  body("clientPublicKey").exists().trim().notEmpty(),
-  validateRequest,
   authController.login1
 );
 
@@ -22,9 +18,6 @@ router.post(
   // TODO endpoint: deprecate (moved to api/v3/auth/login2)
   "/login2",
   authLimiter,
-  body("email").exists().trim().notEmpty().toLowerCase(),
-  body("clientProof").exists().trim().notEmpty(),
-  validateRequest,
   authController.login2
 );
 

backend/src/routes/v1/bot.ts

@@ -1,41 +1,25 @@
 import express from "express";
 const router = express.Router();
-import { body, param } from "express-validator";
 import {
-    requireAuth,
-    requireBotAuth,
-    requireWorkspaceAuth,
-    validateRequest,
+  requireAuth
 } from "../../middleware";
 import { botController } from "../../controllers/v1";
-import { ADMIN, AuthMode, MEMBER } from "../../variables";
+import { AuthMode } from "../../variables";
 
 router.get(
-    "/:workspaceId",
-	requireAuth({
-        acceptedAuthModes: [AuthMode.JWT],
-    }),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-        locationWorkspaceId: "params",
-	}),
-    param("workspaceId").exists().trim().notEmpty(),
-    validateRequest,
-    botController.getBotByWorkspaceId
+  "/:workspaceId",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  botController.getBotByWorkspaceId
 );
 
 router.patch(
-    "/:botId/active",
-	requireAuth({
-        acceptedAuthModes: [AuthMode.JWT],
-    }),
-    requireBotAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-    }),
-    body("isActive").exists().isBoolean(),
-    body("botKey"),
-    validateRequest,
-    botController.setBotActiveState
+  "/:botId/active",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  botController.setBotActiveState
 );
 
-export default router;
+export default router;

backend/src/routes/v1/index.ts

@@ -16,7 +16,7 @@ import integration from "./integration";
 import integrationAuth from "./integrationAuth";
 import secretsFolder from "./secretsFolder";
 import webhooks from "./webhook";
-import secretImport from "./secretImport";
+import secretImps from "./secretImps";
 
 export {
   signup,
@@ -37,5 +37,5 @@ export {
   integrationAuth,
   secretsFolder,
   webhooks,
-  secretImport
+  secretImps
 };

backend/src/routes/v1/integration.ts

@@ -1,45 +1,14 @@
 import express from "express";
 const router = express.Router();
-import {
-  requireAuth,
-  requireIntegrationAuth,
-  requireIntegrationAuthorizationAuth,
-  requireWorkspaceAuth,
-  validateRequest,
-} from "../../middleware";
-import {
-  ADMIN,
-  AuthMode,
-  MEMBER
-} from "../../variables";
-import { body, param } from "express-validator";
+import { requireAuth } from "../../middleware";
+import { AuthMode } from "../../variables";
 import { integrationController } from "../../controllers/v1";
 
 router.post(
   "/",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
   }),
-  requireIntegrationAuthorizationAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    location: "body",
-  }),
-  body("integrationAuthId").exists().isString().trim(),
-  body("app").trim(),
-  body("isActive").exists().isBoolean(),
-  body("appId").trim(),
-  body("secretPath").default("/").isString().trim(),
-  body("sourceEnvironment").trim(),
-  body("targetEnvironment").trim(),
-  body("targetEnvironmentId").trim(),
-  body("targetService").trim(),
-  body("targetServiceId").trim(),
-  body("owner").trim(),
-  body("path").trim(),
-  body("region").trim(),
-  body("metadata").optional().isObject().withMessage("Metadata should be an object"),
-  body("metadata.secretSuffix").optional().isString().withMessage("Suffix should be a string"),
-  validateRequest,
   integrationController.createIntegration
 );
 
@@ -48,18 +17,6 @@ router.patch(
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT]
   }),
-  requireIntegrationAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-  }),
-  param("integrationId").exists().trim(),
-  body("isActive").exists().isBoolean(),
-  body("app").exists().trim(),
-  body("secretPath").default("/").isString().trim(),
-  body("environment").exists().trim(),
-  body("appId").exists(),
-  body("targetEnvironment").exists(),
-  body("owner").exists(),
-  validateRequest,
   integrationController.updateIntegration
 );
 
@@ -68,11 +25,6 @@ router.delete(
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT]
   }),
-  requireIntegrationAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-  }),
-  param("integrationId").exists().trim(),
-  validateRequest,
   integrationController.deleteIntegration
 );
 
@@ -81,13 +33,6 @@ router.post(
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "body",
-  }),
-  body("environment").isString().exists().trim(),
-  body("workspaceId").exists().trim(),
-  validateRequest,
   integrationController.manualSync
 );
 

backend/src/routes/v1/integrationAuth.ts

@@ -1,199 +1,159 @@
 import express from "express";
 const router = express.Router();
-import { body, param, query } from "express-validator";
-import {
-	requireAuth,
-	requireIntegrationAuthorizationAuth,
-	requireWorkspaceAuth,
-	validateRequest,
-} from "../../middleware";
-import {
-	ADMIN, 
-	AuthMode,
-	MEMBER
-} from "../../variables";
+import { requireAuth } from "../../middleware";
+import { AuthMode } from "../../variables";
 import { integrationAuthController } from "../../controllers/v1";
 
 router.get(
-	"/integration-options",
-	requireAuth({
-        acceptedAuthModes: [AuthMode.JWT],
-    }),
-	integrationAuthController.getIntegrationOptions
+  "/integration-options",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  integrationAuthController.getIntegrationOptions
 );
 
 router.get(
-	"/:integrationAuthId",
-	requireAuth({
-        acceptedAuthModes: [AuthMode.JWT],
-    }),
-	requireIntegrationAuthorizationAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-	}),
-	param("integrationAuthId"),
-	validateRequest,
-	integrationAuthController.getIntegrationAuth	
+  "/:integrationAuthId",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  integrationAuthController.getIntegrationAuth
 );
 
 router.post(
-	"/oauth-token",
-	requireAuth({
-        acceptedAuthModes: [AuthMode.JWT],
-    }),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		locationWorkspaceId: "body",
-	}),
-	body("workspaceId").exists().trim().notEmpty(),
-	body("code").exists().trim().notEmpty(),
-	body("integration").exists().trim().notEmpty(),
-	validateRequest,
-	integrationAuthController.oAuthExchange
+  "/oauth-token",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  integrationAuthController.oAuthExchange
 );
 
 router.post(
-	"/access-token",
-	body("workspaceId").exists().trim().notEmpty(),
-	body("accessId").trim(),
-	body("accessToken").exists().trim().notEmpty(),
-	body("url").trim(),
-	body("namespace").trim(),
-	body("integration").exists().trim().notEmpty(),
-	validateRequest,
-	requireAuth({
-        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
-    }),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		locationWorkspaceId: "body",
-	}),
-	integrationAuthController.saveIntegrationAccessToken
+  "/access-token",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  integrationAuthController.saveIntegrationToken
 );
 
 router.get(
-	"/:integrationAuthId/apps",
-	requireAuth({
-        acceptedAuthModes: [AuthMode.JWT],
-    }),
-	requireIntegrationAuthorizationAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-	}),
-	param("integrationAuthId"),
-	query("teamId"),
-	query("workspaceSlug"),
-	validateRequest,
-	integrationAuthController.getIntegrationAuthApps
+  "/:integrationAuthId/apps",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  integrationAuthController.getIntegrationAuthApps
 );
 
 router.get(
-	"/:integrationAuthId/teams",
-	requireAuth({
-        acceptedAuthModes: [AuthMode.JWT],
-    }),
-	requireIntegrationAuthorizationAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-	}),
-	param("integrationAuthId"),
-	validateRequest,
-	integrationAuthController.getIntegrationAuthTeams
+  "/:integrationAuthId/teams",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  integrationAuthController.getIntegrationAuthTeams
 );
 
 router.get(
-	"/:integrationAuthId/vercel/branches",
-	requireAuth({
-        acceptedAuthModes: [AuthMode.JWT],
-    }),
-	requireIntegrationAuthorizationAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-	}),
-	param("integrationAuthId").exists().isString(),
-	query("appId").exists().isString(),
-	query("teamId").optional().isString(),
-	validateRequest,
-	integrationAuthController.getIntegrationAuthVercelBranches
+  "/:integrationAuthId/vercel/branches",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  integrationAuthController.getIntegrationAuthVercelBranches
 );
 
 router.get(
-	"/:integrationAuthId/railway/environments",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	requireIntegrationAuthorizationAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-	}),
-	param("integrationAuthId").exists().isString(),
-	query("appId").exists().isString(),
-	validateRequest,
-	integrationAuthController.getIntegrationAuthRailwayEnvironments
+  "/:integrationAuthId/qovery/orgs",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  integrationAuthController.getIntegrationAuthQoveryOrgs
 );
 
 router.get(
-	"/:integrationAuthId/railway/services",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	requireIntegrationAuthorizationAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-	}),
-	param("integrationAuthId").exists().isString(),
-	query("appId").exists().isString(),
-	validateRequest,
-	integrationAuthController.getIntegrationAuthRailwayServices
+  "/:integrationAuthId/qovery/projects",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  integrationAuthController.getIntegrationAuthQoveryProjects
 );
 
 router.get(
-	"/:integrationAuthId/bitbucket/workspaces",
-	requireAuth({
-        acceptedAuthModes: [AuthMode.JWT],
-    }),
-	requireIntegrationAuthorizationAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-	}),
-	param("integrationAuthId").exists().isString(),
-	validateRequest,
-	integrationAuthController.getIntegrationAuthBitBucketWorkspaces
+  "/:integrationAuthId/qovery/environments",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  integrationAuthController.getIntegrationAuthQoveryEnvironments
 );
 
 router.get(
-	"/:integrationAuthId/northflank/secret-groups",
-	requireAuth({
-        acceptedAuthModes: [AuthMode.JWT],
-    }),
-	requireIntegrationAuthorizationAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-	}),
-	param("integrationAuthId").exists().isString(),
-	query("appId").exists().isString(),
-	validateRequest,
-	integrationAuthController.getIntegrationAuthNorthflankSecretGroups
+  "/:integrationAuthId/qovery/apps",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  integrationAuthController.getIntegrationAuthQoveryApps
 );
 
 router.get(
-	"/:integrationAuthId/teamcity/build-configs",
-	requireAuth({
-        acceptedAuthModes: [AuthMode.JWT],
-    }),
-	requireIntegrationAuthorizationAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-	}),
-	param("integrationAuthId").exists().isString(),
-	query("appId").exists().isString(),
-	validateRequest,
-	integrationAuthController.getIntegrationAuthTeamCityBuildConfigs
+  "/:integrationAuthId/qovery/containers",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  integrationAuthController.getIntegrationAuthQoveryContainers
+);
+
+router.get(
+  "/:integrationAuthId/qovery/jobs",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  integrationAuthController.getIntegrationAuthQoveryJobs
+);
+
+router.get(
+  "/:integrationAuthId/railway/environments",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  integrationAuthController.getIntegrationAuthRailwayEnvironments
+);
+
+router.get(
+  "/:integrationAuthId/railway/services",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  integrationAuthController.getIntegrationAuthRailwayServices
+);
+
+router.get(
+  "/:integrationAuthId/bitbucket/workspaces",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  integrationAuthController.getIntegrationAuthBitBucketWorkspaces
+);
+
+router.get(
+  "/:integrationAuthId/northflank/secret-groups",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  integrationAuthController.getIntegrationAuthNorthflankSecretGroups
+);
+
+router.get(
+  "/:integrationAuthId/teamcity/build-configs",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  integrationAuthController.getIntegrationAuthTeamCityBuildConfigs
 );
 
 router.delete(
-	"/:integrationAuthId",
-	requireAuth({
-        acceptedAuthModes: [AuthMode.JWT],
-    }),
-	requireIntegrationAuthorizationAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		attachAccessToken: false,
-	}),
-	param("integrationAuthId"),
-	validateRequest,
-	integrationAuthController.deleteIntegrationAuth
+  "/:integrationAuthId",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  integrationAuthController.deleteIntegrationAuth
 );
 
 export default router;

backend/src/routes/v1/inviteOrg.ts

@@ -8,23 +8,20 @@ import { AuthMode } from "../../variables";
 // TODO endpoint: consider moving these endpoints to be under /organization to be more RESTful
 
 router.post(
-	"/signup",
-	requireAuth({
-        acceptedAuthModes: [AuthMode.JWT],
-    }),
-	body("inviteeEmail").exists().trim().notEmpty().isEmail(),
-	body("organizationId").exists().trim().notEmpty(),
-	validateRequest,
-	membershipOrgController.inviteUserToOrganization
+  "/signup",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  membershipOrgController.inviteUserToOrganization
 );
 
 router.post(
-	"/verify",
-	body("email").exists().trim().notEmpty(),
-	body("organizationId").exists().trim().notEmpty(),
-	body("code").exists().trim().notEmpty(),
-	validateRequest,
-	membershipOrgController.verifyUserToOrganization
+  "/verify",
+  body("email").exists().trim().notEmpty(),
+  body("organizationId").exists().trim().notEmpty(),
+  body("code").exists().trim().notEmpty(),
+  validateRequest,
+  membershipOrgController.verifyUserToOrganization
 );
 
 export default router;

backend/src/routes/v1/key.ts

@@ -1,43 +1,26 @@
 import express from "express";
 const router = express.Router();
-import {
-	requireAuth,
-	requireWorkspaceAuth,
-	validateRequest,
-} from "../../middleware";
-import { body, param } from "express-validator";
-import { ADMIN, AuthMode, MEMBER } from "../../variables";
+import { requireAuth } from "../../middleware";
+import { AuthMode } from "../../variables";
 import { keyController } from "../../controllers/v1";
 
 // TODO endpoint: consider moving these endpoints to be under /workspaces to be more RESTful
 
 router.post(
-	"/:workspaceId",
-	requireAuth({
-        acceptedAuthModes: [AuthMode.JWT],
-    }),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		locationWorkspaceId: "params",
-	}),
-	param("workspaceId").exists().trim(),
-	body("key").exists(),
-	validateRequest,
-	keyController.uploadKey
+  "/:workspaceId",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  keyController.uploadKey
 );
 
-router.get( // TODO endpoint: deprecate (note: move frontend to v2/workspace/key or something)
-	"/:workspaceId/latest",
-	requireAuth({
-        acceptedAuthModes: [AuthMode.JWT],
-    }),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		locationWorkspaceId: "params",
-	}),
-	param("workspaceId"),
-	validateRequest,
-	keyController.getLatestKey
+router.get(
+  // TODO endpoint: deprecate (note: move frontend to v2/workspace/key or something)
+  "/:workspaceId/latest",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  keyController.getLatestKey
 );
 
 export default router;

backend/src/routes/v1/membership.ts

@@ -1,53 +1,37 @@
 import express from "express";
 const router = express.Router();
-import { body, param } from "express-validator";
-import { requireAuth, validateRequest } from "../../middleware";
+import { requireAuth } from "../../middleware";
 import { membershipController } from "../../controllers/v1";
-import { membershipController as EEMembershipControllers } from "../../ee/controllers/v1";
 import { AuthMode } from "../../variables";
 
 // note: ALL DEPRECIATED (moved to api/v2/workspace/:workspaceId/memberships/:membershipId)
 // TODO endpoint: consider moving these endpoints to be under /workspace to be more RESTful
 
-router.get( // TODO endpoint: deprecate - used for old CLI (deprecate)
-	"/:workspaceId/connect",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	param("workspaceId").exists().trim(),
-	validateRequest,
-	membershipController.validateMembership
+router.get(
+  // TODO endpoint: deprecate - used for old CLI (deprecate)
+  "/:workspaceId/connect",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  membershipController.validateMembership
 );
 
-router.delete( // TODO endpoint: check dashboard
-	"/:membershipId",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	param("membershipId").exists().trim(),
-	validateRequest,
-	membershipController.deleteMembership
+router.delete(
+  // TODO endpoint: check dashboard
+  "/:membershipId",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  membershipController.deleteMembership
 );
 
-router.post( // TODO endpoint: check dashboard
-	"/:membershipId/change-role",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	body("role").exists().trim(),
-	validateRequest,
-	membershipController.changeMembershipRole
-);
-
-router.post( // TODO endpoint: check dashboard
-	"/:membershipId/deny-permissions",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	param("membershipId").isMongoId().exists().trim(),
-	body("permissions").isArray().exists(),
-	validateRequest,
-	EEMembershipControllers.denyMembershipPermissions
+router.post(
+  // TODO endpoint: check dashboard
+  "/:membershipId/change-role",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  membershipController.changeMembershipRole
 );
 
 export default router;

backend/src/routes/v1/membershipOrg.ts

@@ -5,24 +5,23 @@ import { requireAuth, validateRequest } from "../../middleware";
 import { membershipOrgController } from "../../controllers/v1";
 import { AuthMode } from "../../variables";
 
-router.post( // TODO endpoint: check dashboard
-	"/membershipOrg/:membershipOrgId/change-role",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	param("membershipOrgId"),
-	validateRequest,
-	membershipOrgController.changeMembershipOrgRole
+router.post(
+  // TODO endpoint: check dashboard
+  "/membershipOrg/:membershipOrgId/change-role",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  param("membershipOrgId"),
+  validateRequest,
+  membershipOrgController.changeMembershipOrgRole
 );
 
 router.delete(
-	"/:membershipOrgId", // TODO endpoint: check dashboard
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	param("membershipOrgId").exists().trim(),
-	validateRequest,
-	membershipOrgController.deleteMembershipOrg
+  "/:membershipOrgId", // TODO endpoint: check dashboard
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  membershipOrgController.deleteMembershipOrg
 );
 
 export default router;

backend/src/routes/v1/organization.ts

@@ -1,166 +1,99 @@
 import express from "express";
 const router = express.Router();
-import { body, param } from "express-validator";
-import {
-	requireAuth,
-	requireOrganizationAuth,
-	validateRequest,
-} from "../../middleware";
-import {
-	ACCEPTED, 
-	ADMIN, 
-	AuthMode,
-	MEMBER,
-	OWNER
-} from "../../variables";
+import { requireAuth } from "../../middleware";
+import { AuthMode } from "../../variables";
 import { organizationController } from "../../controllers/v1";
 
-router.get( // TODO endpoint: deprecate (moved to api/v2/users/me/organizations)
-	"/",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	organizationController.getOrganizations
+router.get(
+  // TODO endpoint: deprecate (moved to api/v2/users/me/organizations)
+  "/",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationController.getOrganizations
 );
 
-router.post( // not used on frontend
-	"/",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	body("organizationName").exists().trim().notEmpty(),
-	validateRequest,
-	organizationController.createOrganization
+router.post(
+  // not used on frontend
+  "/",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationController.createOrganization
 );
 
 router.get(
-	"/:organizationId",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	requireOrganizationAuth({
-		acceptedRoles: [OWNER, ADMIN, MEMBER],
-		acceptedStatuses: [ACCEPTED],
-	}),
-	param("organizationId").exists().trim(),
-	validateRequest,
-	organizationController.getOrganization
+  "/:organizationId",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationController.getOrganization
 );
 
-router.get( // TODO endpoint: deprecate (moved to api/v2/organizations/:organizationId/memberships)
-	"/:organizationId/users",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	requireOrganizationAuth({
-		acceptedRoles: [OWNER, ADMIN, MEMBER],
-		acceptedStatuses: [ACCEPTED],
-	}),
-	param("organizationId").exists().trim(),
-	validateRequest,
-	organizationController.getOrganizationMembers
+router.get(
+  // TODO endpoint: deprecate (moved to api/v2/organizations/:organizationId/memberships)
+  "/:organizationId/users",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationController.getOrganizationMembers
 );
 
-router.get( // TODO endpoint: move to /v2/users/me/organizations/:organizationId/workspaces
-	"/:organizationId/my-workspaces", // deprecated (moved to api/v2/organizations/:organizationId/workspaces)
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	requireOrganizationAuth({
-		acceptedRoles: [OWNER, ADMIN, MEMBER],
-		acceptedStatuses: [ACCEPTED],
-	}),
-	param("organizationId").exists().trim(),
-	validateRequest,
-	organizationController.getOrganizationWorkspaces
+router.get(
+  // TODO endpoint: move to /v2/users/me/organizations/:organizationId/workspaces
+  "/:organizationId/my-workspaces", // deprecated (moved to api/v2/organizations/:organizationId/workspaces)
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationController.getOrganizationWorkspaces
 );
 
 router.patch(
-	"/:organizationId/name",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	requireOrganizationAuth({
-		acceptedRoles: [OWNER, ADMIN, MEMBER],
-		acceptedStatuses: [ACCEPTED],
-	}),
-	param("organizationId").exists().trim(),
-	body("name").exists().trim().notEmpty(),
-	validateRequest,
-	organizationController.changeOrganizationName
+  "/:organizationId/name",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationController.changeOrganizationName
 );
 
 router.get(
-	"/:organizationId/incidentContactOrg",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	requireOrganizationAuth({
-		acceptedRoles: [OWNER, ADMIN, MEMBER],
-		acceptedStatuses: [ACCEPTED],
-	}),
-	param("organizationId").exists().trim(),
-	validateRequest,
-	organizationController.getOrganizationIncidentContacts
+  "/:organizationId/incidentContactOrg",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationController.getOrganizationIncidentContacts
 );
 
 router.post(
-	"/:organizationId/incidentContactOrg",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	requireOrganizationAuth({
-		acceptedRoles: [OWNER, ADMIN, MEMBER],
-		acceptedStatuses: [ACCEPTED],
-	}),
-	param("organizationId").exists().trim(),
-	body("email").exists().trim().notEmpty(),
-	validateRequest,
-	organizationController.addOrganizationIncidentContact
+  "/:organizationId/incidentContactOrg",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationController.addOrganizationIncidentContact
 );
 
 router.delete(
-	"/:organizationId/incidentContactOrg",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	requireOrganizationAuth({
-		acceptedRoles: [OWNER, ADMIN, MEMBER],
-		acceptedStatuses: [ACCEPTED],
-	}),
-	param("organizationId").exists().trim(),
-	body("email").exists().trim().notEmpty(),
-	validateRequest,
-	organizationController.deleteOrganizationIncidentContact
+  "/:organizationId/incidentContactOrg",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationController.deleteOrganizationIncidentContact
 );
 
 router.post(
-	"/:organizationId/customer-portal-session", // TODO endpoint: move to EE
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	requireOrganizationAuth({
-		acceptedRoles: [OWNER, ADMIN, MEMBER],
-		acceptedStatuses: [ACCEPTED],
-	}),
-	param("organizationId").exists().trim(),
-	validateRequest,
-	organizationController.createOrganizationPortalSession
+  "/:organizationId/customer-portal-session", // TODO endpoint: move to EE
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationController.createOrganizationPortalSession
 );
 
 router.get(
-	"/:organizationId/workspace-memberships",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT]
-	}),
-	requireOrganizationAuth({
-		acceptedRoles: [OWNER, ADMIN, MEMBER],
-		acceptedStatuses: [ACCEPTED],
-	}),
-	param("organizationId").exists().trim(),
-	validateRequest,
-	organizationController.getOrganizationMembersAndTheirWorkspaces
+  "/:organizationId/workspace-memberships",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  organizationController.getOrganizationMembersAndTheirWorkspaces
 );
 
-
 export default router;

backend/src/routes/v1/password.ts

@@ -1,93 +1,51 @@
 import express from "express";
 const router = express.Router();
-import { body } from "express-validator";
-import { requireAuth, requireSignupAuth, validateRequest } from "../../middleware";
+import { requireAuth, requireSignupAuth } from "../../middleware";
 import { passwordController } from "../../controllers/v1";
 import { passwordLimiter } from "../../helpers/rateLimiter";
 import { AuthMode } from "../../variables";
 
 router.post(
-	"/srp1",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	body("clientPublicKey").exists().isString().trim().notEmpty(),
-	validateRequest,
-	passwordController.srp1
+  "/srp1",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  passwordController.srp1
 );
 
 router.post(
-	"/change-password",
-	passwordLimiter,
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	body("clientProof").exists().trim().notEmpty(),
-	body("protectedKey").exists().isString().trim().notEmpty(),
-	body("protectedKeyIV").exists().isString().trim().notEmpty(),
-	body("protectedKeyTag").exists().isString().trim().notEmpty(),
-	body("encryptedPrivateKey").exists().isString().trim().notEmpty(), // private key encrypted under new pwd
-	body("encryptedPrivateKeyIV").exists().isString().trim().notEmpty(), // new iv for private key
-	body("encryptedPrivateKeyTag").exists().isString().trim().notEmpty(), // new tag for private key
-	body("salt").exists().isString().trim().notEmpty(), // part of new pwd
-	body("verifier").exists().isString().trim().notEmpty(), // part of new pwd
-	validateRequest,
-	passwordController.changePassword
+  "/change-password",
+  passwordLimiter,
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  passwordController.changePassword
 );
 
-router.post(
-	"/email/password-reset",
-	passwordLimiter,
-	body("email").exists().isString().trim().notEmpty().isEmail(),
-	validateRequest,
-	passwordController.emailPasswordReset
-);
+router.post("/email/password-reset", passwordLimiter, passwordController.emailPasswordReset);
 
 router.post(
-	"/email/password-reset-verify",
-	passwordLimiter,
-	body("email").exists().isString().trim().notEmpty().isEmail(),
-	body("code").exists().isString().trim().notEmpty(),
-	validateRequest,
-	passwordController.emailPasswordResetVerify
+  "/email/password-reset-verify",
+  passwordLimiter,
+  passwordController.emailPasswordResetVerify
 );
 
 router.get(
-	"/backup-private-key",
-	passwordLimiter,
-	requireSignupAuth,
-	passwordController.getBackupPrivateKey
+  "/backup-private-key",
+  passwordLimiter,
+  requireSignupAuth,
+  passwordController.getBackupPrivateKey
 );
 
 router.post(
-	"/backup-private-key",
-	passwordLimiter,
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	body("clientProof").exists().isString().trim().notEmpty(),
-	body("encryptedPrivateKey").exists().isString().trim().notEmpty(), // (backup) private key encrypted under a strong key
-	body("iv").exists().isString().trim().notEmpty(), // new iv for (backup) private key
-	body("tag").exists().isString().trim().notEmpty(), // new tag for (backup) private key
-	body("salt").exists().isString().trim().notEmpty(), // salt generated from strong key
-	body("verifier").exists().isString().trim().notEmpty(), // salt generated from strong key
-	validateRequest,
-	passwordController.createBackupPrivateKey
+  "/backup-private-key",
+  passwordLimiter,
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  passwordController.createBackupPrivateKey
 );
 
-router.post(
-	"/password-reset",
-	requireSignupAuth,
-	body("protectedKey").exists().isString().trim().notEmpty(),
-	body("protectedKeyIV").exists().isString().trim().notEmpty(),
-	body("protectedKeyTag").exists().isString().trim().notEmpty(),
-	body("encryptedPrivateKey").exists().isString().trim().notEmpty(), // private key encrypted under new pwd
-	body("encryptedPrivateKeyIV").exists().isString().trim().notEmpty(), // new iv for private key
-	body("encryptedPrivateKeyTag").exists().isString().trim().notEmpty(), // new tag for private key 
-	body("salt").exists().isString().trim().notEmpty(), // part of new pwd
-	body("verifier").exists().isString().trim().notEmpty(), // part of new pwd
-	validateRequest,
-	passwordController.resetPassword
-);
+router.post("/password-reset", requireSignupAuth, passwordController.resetPassword);
 
-export default router;
+export default router;

backend/src/routes/v1/secretImport.ts

@@ -1,84 +0,0 @@
-import express from "express";
-import { body, param, query } from "express-validator";
-import { secretImportController } from "../../controllers/v1";
-import { requireAuth, requireWorkspaceAuth, validateRequest } from "../../middleware";
-import { ADMIN, AuthMode, MEMBER } from "../../variables";
-const router = express.Router();
-
-router.post(
-  "/",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.JWT,AuthMode.SERVICE_TOKEN]
-  }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "body"
-  }),
-  body("workspaceId").exists().isString().trim().notEmpty(),
-  body("environment").exists().isString().trim().notEmpty(),
-  body("folderId").default("root").isString().trim(),
-  body("secretImport").exists().isObject(),
-  body("secretImport.environment").isString().exists().trim(),
-  body("secretImport.secretPath").isString().exists().trim(),
-  validateRequest,
-  secretImportController.createSecretImport
-);
-
-router.put(
-  "/:id",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.JWT,AuthMode.SERVICE_TOKEN]
-  }),
-  param("id").exists().isString().trim(),
-  body("secretImports").exists().isArray(),
-  body("secretImports.*.environment").isString().exists().trim(),
-  body("secretImports.*.secretPath").isString().exists().trim(),
-  validateRequest,
-  secretImportController.updateSecretImport
-);
-
-router.delete(
-  "/:id",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.JWT,AuthMode.SERVICE_TOKEN]
-  }),
-  param("id").exists().isString().trim(),
-  body("secretImportPath").isString().exists().trim(),
-  body("secretImportEnv").isString().exists().trim(),
-  validateRequest,
-  secretImportController.deleteSecretImport
-);
-
-router.get(
-  "/",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.JWT,AuthMode.SERVICE_TOKEN]
-  }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "query"
-  }),
-  query("workspaceId").exists().isString().trim().notEmpty(),
-  query("environment").exists().isString().trim().notEmpty(),
-  query("folderId").default("root").isString().trim(),
-  validateRequest,
-  secretImportController.getSecretImports
-);
-
-router.get(
-  "/secrets",
-  requireAuth({
-    acceptedAuthModes: [AuthMode.JWT,AuthMode.SERVICE_TOKEN]
-  }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "query"
-  }),
-  query("workspaceId").exists().isString().trim().notEmpty(),
-  query("environment").exists().isString().trim().notEmpty(),
-  query("folderId").default("root").isString().trim(),
-  validateRequest,
-  secretImportController.getAllSecretsFromImport
-);
-
-export default router;

backend/src/routes/v1/secretImps.ts

@@ -0,0 +1,47 @@
+import express from "express";
+const router = express.Router();
+import { requireAuth } from "../../middleware";
+import { secretImpsController } from "../../controllers/v1";
+import { AuthMode } from "../../variables";
+
+router.post(
+  "/",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN]
+  }),
+  secretImpsController.createSecretImp
+);
+
+router.put(
+  "/:id",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN]
+  }),
+  secretImpsController.updateSecretImport
+);
+
+router.delete(
+  "/:id",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN]
+  }),
+  secretImpsController.deleteSecretImport
+);
+
+router.get(
+  "/",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN]
+  }),
+  secretImpsController.getSecretImports
+);
+
+router.get(
+  "/secrets",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN]
+  }),
+  secretImpsController.getAllSecretsFromImport
+);
+
+export default router;

backend/src/routes/v1/secretsFolder.ts

@@ -1,66 +1,43 @@
 import express from "express";
-import { body, param, query } from "express-validator";
+const router = express.Router();
+import { requireAuth } from "../../middleware";
 import {
   createFolder,
   deleteFolder,
   getFolders,
   updateFolderById
 } from "../../controllers/v1/secretsFolderController";
-import { requireAuth, requireWorkspaceAuth, validateRequest } from "../../middleware";
-import { ADMIN, AuthMode, MEMBER } from "../../variables";
-const router = express.Router();
+import { AuthMode } from "../../variables";
 
 router.post(
   "/",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT,AuthMode.SERVICE_TOKEN]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "body"
-  }),
-  body("workspaceId").exists(),
-  body("environment").exists(),
-  body("folderName").exists(),
-  body("parentFolderId"),
-  validateRequest,
   createFolder
 );
 
 router.patch(
   "/:folderId",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT,AuthMode.SERVICE_TOKEN]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN]
   }),
-  body("workspaceId").exists(),
-  body("environment").exists(),
-  param("folderId").not().isIn(["root"]).exists(),
-  validateRequest,
   updateFolderById
 );
 
 router.delete(
   "/:folderId",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT,AuthMode.SERVICE_TOKEN]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN]
   }),
-  body("workspaceId").exists(),
-  body("environment").exists(),
-  param("folderId").not().isIn(["root"]).exists(),
-  validateRequest,
   deleteFolder
 );
 
 router.get(
   "/",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT,AuthMode.SERVICE_TOKEN]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN]
   }),
-  query("workspaceId").exists().isString().trim(),
-  query("environment").exists().isString().trim(),
-  query("parentFolderId").optional().isString().trim(),
-  query("parentFolderPath").optional().isString().trim(),
-  validateRequest,
   getFolders
 );
 

backend/src/routes/v1/signup.ts

@@ -1,27 +1,21 @@
 import express from "express";
 const router = express.Router();
-import { body } from "express-validator";
-import { validateRequest } from "../../middleware";
 import { signupController } from "../../controllers/v1";
 import { authLimiter } from "../../helpers/rateLimiter";
 
 // TODO: consider moving to users/v3/signup
 
-router.post( // TODO endpoint: consider moving to v3/users/signup/mail
-	"/email/signup",
-	authLimiter,
-	body("email").exists().trim().notEmpty().isEmail(),
-	validateRequest,
-	signupController.beginEmailSignup
+router.post(
+  // TODO endpoint: consider moving to v3/users/signup/mail
+  "/email/signup",
+  authLimiter,
+  signupController.beginEmailSignup
 );
 
 router.post(
-	"/email/verify", // TODO endpoint: consider moving to v3/users/signup/verify
-	authLimiter,
-	body("email").exists().trim().notEmpty().isEmail(),
-	body("code").exists().trim().notEmpty(),
-	validateRequest,
-	signupController.verifyEmailSignup
+  "/email/verify", // TODO endpoint: consider moving to v3/users/signup/verify
+  authLimiter,
+  signupController.verifyEmailSignup
 );
 
-export default router;
+export default router;

backend/src/routes/v1/userAction.ts

@@ -1,29 +1,25 @@
 import express from "express";
 const router = express.Router();
-import { requireAuth, validateRequest } from "../../middleware";
-import { body, query } from "express-validator";
+import { requireAuth } from "../../middleware";
 import { userActionController } from "../../controllers/v1";
 import { AuthMode } from "../../variables";
 
 // note: [userAction] will be deprecated in /v2 in favor of [action]
-router.post( // TODO endpoint: move this into /users/me
-	"/",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	body("action"),
-	validateRequest,
-	userActionController.addUserAction
+router.post(
+  // TODO endpoint: move this into /users/me
+  "/",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  userActionController.addUserAction
 );
 
 router.get(
-	"/",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	query("action"),
-	validateRequest,
-	userActionController.getUserAction
+  "/",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  userActionController.getUserAction
 );
 
 export default router;

backend/src/routes/v1/webhook.ts

@@ -1,74 +1,46 @@
 import express from "express";
 const router = express.Router();
-import { requireAuth, requireWorkspaceAuth, validateRequest } from "../../middleware";
-import { body, param, query } from "express-validator";
-import { ADMIN, AuthMode, MEMBER } from "../../variables";
+import { requireAuth } from "../../middleware";
+import { AuthMode } from "../../variables";
 import { webhookController } from "../../controllers/v1";
 
 router.post(
   "/",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT],
+    acceptedAuthModes: [AuthMode.JWT]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "body",
-    locationEnvironment: "body"
-  }),
-  body("workspaceId").exists().isString().trim(),
-  body("environment").exists().isString().trim(),
-  body("webhookUrl").exists().isString().isURL().trim(),
-  body("webhookSecretKey").isString().trim(),
-  body("secretPath").default("/").isString().trim(),
-  validateRequest,
   webhookController.createWebhook
 );
 
 router.patch(
   "/:webhookId",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT],
+    acceptedAuthModes: [AuthMode.JWT]
   }),
-  param("webhookId").exists().isString().trim(),
-  body("isDisabled").default(false).isBoolean(),
-  validateRequest,
   webhookController.updateWebhook
 );
 
 router.post(
   "/:webhookId/test",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT],
+    acceptedAuthModes: [AuthMode.JWT]
   }),
-  param("webhookId").exists().isString().trim(),
-  validateRequest,
   webhookController.testWebhook
 );
 
 router.delete(
   "/:webhookId",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT],
+    acceptedAuthModes: [AuthMode.JWT]
   }),
-  param("webhookId").exists().isString().trim(),
-  validateRequest,
   webhookController.deleteWebhook
 );
 
 router.get(
   "/",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT],
+    acceptedAuthModes: [AuthMode.JWT]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "query",
-    locationEnvironment: "query"
-  }),
-  query("workspaceId").exists().isString().trim(),
-  query("environment").optional().isString().trim(),
-  query("secretPath").optional().isString().trim(),
-  validateRequest,
   webhookController.listWebhooks
 );
 

backend/src/routes/v1/workspace.ts

@@ -1,163 +1,95 @@
 import express from "express";
 const router = express.Router();
-import { body, param } from "express-validator";
-import {
-	requireAuth,
-	requireWorkspaceAuth,
-	validateRequest,
-} from "../../middleware";
-import {
-	ADMIN, 
-	AuthMode,
-	MEMBER
-} from "../../variables";
+import { requireAuth } from "../../middleware";
+import { AuthMode } from "../../variables";
 import { membershipController, workspaceController } from "../../controllers/v1";
 
 router.get(
-	"/:workspaceId/keys",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		locationWorkspaceId: "params",
-	}),
-	param("workspaceId").exists().trim(),
-	validateRequest,
-	workspaceController.getWorkspacePublicKeys
+  "/:workspaceId/keys",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  workspaceController.getWorkspacePublicKeys
 );
 
 router.get(
-	"/:workspaceId/users",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		locationWorkspaceId: "params",
-	}),
-	param("workspaceId").exists().trim(),
-	validateRequest,
-	workspaceController.getWorkspaceMemberships
+  "/:workspaceId/users",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  workspaceController.getWorkspaceMemberships
 );
 
 router.get(
-	"/", 
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
-	}), 
-	workspaceController.getWorkspaces
+  "/",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  workspaceController.getWorkspaces
 );
 
 router.get(
-	"/:workspaceId",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		locationWorkspaceId: "params",
-	}),
-	param("workspaceId").exists().trim(),
-	validateRequest,
-	workspaceController.getWorkspace
+  "/:workspaceId",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  workspaceController.getWorkspace
 );
 
 router.post(
-	"/",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	body("workspaceName").exists().trim().notEmpty(),
-	body("organizationId").exists().trim().notEmpty(),
-	validateRequest,
-	workspaceController.createWorkspace
+  "/",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  workspaceController.createWorkspace
 );
 
 router.delete(
-	"/:workspaceId",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN],
-		locationWorkspaceId: "params",
-	}),
-	param("workspaceId").exists().trim(),
-	validateRequest,
-	workspaceController.deleteWorkspace
+  "/:workspaceId",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  workspaceController.deleteWorkspace
 );
 
 router.post(
-	"/:workspaceId/name",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		locationWorkspaceId: "params",
-	}),
-	param("workspaceId").exists().trim(),
-	body("name").exists().trim().notEmpty(),
-	validateRequest,
-	workspaceController.changeWorkspaceName
+  "/:workspaceId/name",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  workspaceController.changeWorkspaceName
 );
 
 router.post(
-	"/:workspaceId/invite-signup",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		locationWorkspaceId: "params",
-	}),
-	param("workspaceId").exists().trim(),
-	body("email").exists().trim().notEmpty(),
-	validateRequest,
-	membershipController.inviteUserToWorkspace
+  "/:workspaceId/invite-signup",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  membershipController.inviteUserToWorkspace
 );
 
 router.get(
-	"/:workspaceId/integrations",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		locationWorkspaceId: "params",
-	}),
-	param("workspaceId").exists().trim(),
-	validateRequest,
-	workspaceController.getWorkspaceIntegrations
+  "/:workspaceId/integrations",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  workspaceController.getWorkspaceIntegrations
 );
 
 router.get(
-	"/:workspaceId/authorizations",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		locationWorkspaceId: "params",
-	}),
-	param("workspaceId").exists().trim(),
-	validateRequest,
-	workspaceController.getWorkspaceIntegrationAuthorizations
+  "/:workspaceId/authorizations",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  workspaceController.getWorkspaceIntegrationAuthorizations
 );
 
 router.get(
-	"/:workspaceId/service-tokens", // TODO endpoint: deprecate
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		locationWorkspaceId: "params",
-	}),
-	param("workspaceId").exists().trim(),
-	validateRequest,
-	workspaceController.getWorkspaceServiceTokens
+  "/:workspaceId/service-tokens", // TODO endpoint: deprecate
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  workspaceController.getWorkspaceServiceTokens
 );
 
 export default router;

backend/src/routes/v2/auth.ts

@@ -5,7 +5,8 @@ import { requireMfaAuth, validateRequest } from "../../middleware";
 import { authController } from "../../controllers/v2";
 import { authLimiter } from "../../helpers/rateLimiter";
 
-router.post( // TODO: deprecate (moved to api/v3/auth/login1)
+router.post(
+  // TODO: deprecate (moved to api/v3/auth/login1)
   "/login1",
   authLimiter,
   body("email").isString().trim().notEmpty().toLowerCase(),
@@ -14,7 +15,8 @@ router.post( // TODO: deprecate (moved to api/v3/auth/login1)
   authController.login1
 );
 
-router.post( // TODO: deprecate (moved to api/v3/auth/login1)
+router.post(
+  // TODO: deprecate (moved to api/v3/auth/login1)
   "/login2",
   authLimiter,
   body("email").isString().trim().notEmpty().toLowerCase(),
@@ -23,22 +25,9 @@ router.post( // TODO: deprecate (moved to api/v3/auth/login1)
   authController.login2
 );
 
-router.post(
-  "/mfa/send",
-  authLimiter,
-  body("email").isString().trim().notEmpty().isEmail(),
-  validateRequest,
-  authController.sendMfaToken
-);
+//remove above ones after depreciation
+router.post("/mfa/send", authLimiter, authController.sendMfaToken);
 
-router.post(
-  "/mfa/verify",
-  authLimiter,
-  requireMfaAuth,
-  body("email").isString().trim().notEmpty(),
-  body("mfaToken").isString().trim().notEmpty(),
-  validateRequest,
-  authController.verifyMfaToken
-);
+router.post("/mfa/verify", authLimiter, requireMfaAuth, authController.verifyMfaToken);
 
-export default router;
+export default router;

backend/src/routes/v2/environment.ts

@@ -1,96 +1,47 @@
 import express from "express";
 const router = express.Router();
-import { body, param } from "express-validator";
 import { environmentController } from "../../controllers/v2";
-import {
-  requireAuth,
-  requireWorkspaceAuth,
-  validateRequest,
-} from "../../middleware";
-import {
-  ADMIN, 
-  AuthMode,
-  MEMBER
-} from "../../variables";
+import { requireAuth } from "../../middleware";
+import { AuthMode } from "../../variables";
 
 router.post(
   "/:workspaceId/environments",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "params",
-  }),
-  param("workspaceId").exists().trim(),
-  body("environmentSlug").exists().trim(),
-  body("environmentName").exists().trim(),
-  validateRequest,
   environmentController.createWorkspaceEnvironment
 );
 
 router.put(
   "/:workspaceId/environments",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "params",
-  }),
-  param("workspaceId").exists().trim(),
-  body("environmentSlug").exists().trim(),
-  body("environmentName").exists().trim(),
-  body("oldEnvironmentSlug").exists().trim(),
-  validateRequest,
   environmentController.renameWorkspaceEnvironment
 );
 
 router.patch(
   "/:workspaceId/environments",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "params",
-  }),
-  param("workspaceId").exists().trim(),
-  body("environmentSlug").exists().isString().trim(),
-  body("environmentName").exists().isString().trim(),
-  body("otherEnvironmentSlug").exists().isString().trim(),
-  body("otherEnvironmentName").exists().isString().trim(),
-  validateRequest,
   environmentController.reorderWorkspaceEnvironments
 );
 
 router.delete(
   "/:workspaceId/environments",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN],
-    locationWorkspaceId: "params",
-  }),
-  param("workspaceId").exists().trim(),
-  body("environmentSlug").exists().trim(),
-  validateRequest,
   environmentController.deleteWorkspaceEnvironment
 );
 
 router.get(
   "/:workspaceId/environments",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [MEMBER, ADMIN],
-    locationWorkspaceId: "params",
-  }),
-  param("workspaceId").exists().trim(),
-  validateRequest,
   environmentController.getAllAccessibleEnvironmentsOfWorkspace
 );
 
-export default router;
+export default router;

backend/src/routes/v2/organizations.ts

@@ -1,102 +1,57 @@
 import express from "express";
 const router = express.Router();
 import {
-    requireAuth,
-    requireMembershipOrgAuth,
-    requireOrganizationAuth,
-    validateRequest,
+  requireAuth,
+  requireOrganizationAuth
 } from "../../middleware";
-import { body, param } from "express-validator";
-import { 
-    ACCEPTED, 
-    ADMIN, 
-    AuthMode,
-    MEMBER,
-    OWNER
-} from "../../variables";
+import { ACCEPTED, ADMIN, AuthMode } from "../../variables";
 import { organizationsController } from "../../controllers/v2";
 
 // TODO: /POST to create membership
 
 router.get(
-    "/:organizationId/memberships",
-    param("organizationId").exists().trim(),
-    validateRequest,
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
-    }),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN, MEMBER],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    organizationsController.getOrganizationMemberships
+  "/:organizationId/memberships",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  organizationsController.getOrganizationMemberships
 );
 
 router.patch(
-    "/:organizationId/memberships/:membershipId",
-    param("organizationId").exists().trim(),
-    param("membershipId").exists().trim(),
-    body("role").exists().isString().trim().isIn([OWNER, ADMIN, MEMBER]),
-    validateRequest,
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
-    }),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    requireMembershipOrgAuth({
-        acceptedRoles: [OWNER, ADMIN],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    organizationsController.updateOrganizationMembership
+  "/:organizationId/memberships/:membershipId",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  organizationsController.updateOrganizationMembership
 );
 
 router.delete(
-    "/:organizationId/memberships/:membershipId",
-    param("organizationId").exists().trim(),
-    param("membershipId").exists().trim(),
-    validateRequest,
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
-    }),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    requireMembershipOrgAuth({
-        acceptedRoles: [OWNER, ADMIN],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    organizationsController.deleteOrganizationMembership
+  "/:organizationId/memberships/:membershipId",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  organizationsController.deleteOrganizationMembership
 );
 
 router.get(
-    "/:organizationId/workspaces",
-    param("organizationId").exists().trim(),
-    validateRequest,
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
-    }),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    organizationsController.getOrganizationWorkspaces
+  "/:organizationId/workspaces",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  organizationsController.getOrganizationWorkspaces
 );
 
-router.get( // TODO endpoint: deprecate service accounts
-    "/:organizationId/service-accounts",
-    param("organizationId").exists().trim(),
-    validateRequest,
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT]
-    }),
-    requireOrganizationAuth({
-        acceptedRoles: [OWNER, ADMIN],
-        acceptedStatuses: [ACCEPTED],
-    }),
-    organizationsController.getOrganizationServiceAccounts
+router.get(
+  // TODO endpoint: deprecate service accounts
+  "/:organizationId/service-accounts",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  requireOrganizationAuth({
+    acceptedRoles: [ADMIN],
+    acceptedStatuses: [ACCEPTED]
+  }),
+  organizationsController.getOrganizationServiceAccounts
 );
 
-export default router;
+export default router;

backend/src/routes/v2/secrets.ts

@@ -1,14 +1,12 @@
 import express from "express";
 const router = express.Router();
-import { Types } from "mongoose";
 import {
   requireAuth,
   requireSecretsAuth,
   requireWorkspaceAuth,
   validateRequest
 } from "../../middleware";
-import { validateClientForSecrets } from "../../validation";
-import { body, query } from "express-validator";
+import { body } from "express-validator";
 import { secretsController } from "../../controllers/v2";
 import {
   ADMIN,
@@ -19,44 +17,18 @@ import {
   SECRET_PERSONAL,
   SECRET_SHARED
 } from "../../variables";
-import { BatchSecretRequest } from "../../types/secret";
 
-router.post( // TODO endpoint: strongly consider deprecation in favor of a single operation experience on dashboard
+router.post(
+  // TODO endpoint: strongly consider deprecation in favor of a single operation experience on dashboard
   "/batch",
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "body"
-  }),
-  body("workspaceId").exists().isString().trim(),
-  body("folderId").default("root").isString().trim(),
-  body("environment").exists().isString().trim(),
-  body("secretPath").optional().isString().trim(),
-  body("requests")
-    .exists()
-    .custom(async (requests: BatchSecretRequest[], { req }) => {
-      if (Array.isArray(requests)) {
-        const secretIds = requests
-          .map((request) => request.secret._id)
-          .filter((secretId) => secretId !== undefined);
-
-        if (secretIds.length > 0) {
-          req.secrets = await validateClientForSecrets({
-            authData: req.authData,
-            secretIds: secretIds.map((secretId: string) => new Types.ObjectId(secretId)),
-            requiredPermissions: []
-          });
-        }
-      }
-      return true;
-    }),
-  validateRequest,
   secretsController.batchSecrets
 );
 
-router.post( // TODO endpoint: deprecate (moved to POST api/v3/secrets)
+router.post(
+  // TODO endpoint: deprecate (moved to POST api/v3/secrets)
   "/",
   body("workspaceId").exists().isString().trim(),
   body("environment").exists().isString().trim(),
@@ -117,15 +89,9 @@ router.post( // TODO endpoint: deprecate (moved to POST api/v3/secrets)
   secretsController.createSecrets
 );
 
-router.get( // TODO endpoint: deprecate (moved to GET api/v3/secrets)
+router.get(
+  // TODO endpoint: deprecate (moved to GET api/v3/secrets)
   "/",
-  query("workspaceId").exists().trim(),
-  query("environment").exists().trim(),
-  query("tagSlugs"),
-  query("folderId").default("root").isString().trim(),
-  query("secretPath").optional().isString().trim(),
-  query("include_imports").optional().default(false).isBoolean(),
-  validateRequest,
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN]
   }),
@@ -138,7 +104,8 @@ router.get( // TODO endpoint: deprecate (moved to GET api/v3/secrets)
   secretsController.getSecrets
 );
 
-router.patch( // TODO endpoint: deprecate (moved to PATCH api/v3/secrets)
+router.patch(
+  // TODO endpoint: deprecate (moved to PATCH api/v3/secrets)
   "/",
   body("secrets")
     .exists()
@@ -173,7 +140,8 @@ router.patch( // TODO endpoint: deprecate (moved to PATCH api/v3/secrets)
   secretsController.updateSecrets
 );
 
-router.delete( // TODO endpoint: deprecate (moved to DELETE api/v3/secrets)
+router.delete(
+  // TODO endpoint: deprecate (moved to DELETE api/v3/secrets)
   "/",
   body("secretIds")
     .exists()

backend/src/routes/v2/serviceTokenData.ts

@@ -1,18 +1,9 @@
 import express from "express";
 const router = express.Router();
 import {
-  requireAuth,
-  requireServiceTokenDataAuth,
-  requireWorkspaceAuth,
-  validateRequest
+  requireAuth
 } from "../../middleware";
-import { body, param } from "express-validator";
-import {
-  ADMIN,
-  AuthMode,
-  MEMBER,
-  PERMISSION_WRITE_SECRETS
-} from "../../variables";
+import { AuthMode } from "../../variables";
 import { serviceTokenDataController } from "../../controllers/v2";
 
 router.get(
@@ -28,33 +19,6 @@ router.post(
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "body",
-    locationEnvironment: "body",
-    requiredPermissions: [PERMISSION_WRITE_SECRETS]
-  }),
-  body("name").exists().isString().trim(),
-  body("workspaceId").exists().isString().trim(),
-  body("scopes").exists().isArray(),
-  body("scopes.*.environment").exists().isString().trim(),
-  body("scopes.*.secretPath").exists().isString().trim(),
-  body("encryptedKey").exists().isString().trim(),
-  body("iv").exists().isString().trim(),
-  body("tag").exists().isString().trim(),
-  body("expiresIn").exists().isNumeric(), // measured in ms
-  body("permissions")
-    .isArray({ min: 1 })
-    .custom((value: string[]) => {
-      const allowedPermissions = ["read", "write"];
-      const invalidValues = value.filter((v) => !allowedPermissions.includes(v));
-      if (invalidValues.length > 0) {
-        throw new Error(`permissions contains invalid values: ${invalidValues.join(", ")}`);
-      }
-
-      return true;
-    }),
-  validateRequest,
   serviceTokenDataController.createServiceTokenData
 );
 
@@ -63,11 +27,6 @@ router.delete(
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT]
   }),
-  requireServiceTokenDataAuth({
-    acceptedRoles: [ADMIN, MEMBER]
-  }),
-  param("serviceTokenDataId").exists().trim(),
-  validateRequest,
   serviceTokenDataController.deleteServiceTokenData
 );
 

backend/src/routes/v2/tags.ts

@@ -1,56 +1,30 @@
 import express from "express";
 const router = express.Router();
-import { body, param } from "express-validator";
 import { tagController } from "../../controllers/v2";
-import {
-  requireAuth,
-  requireWorkspaceAuth,
-  validateRequest,
-} from "../../middleware";
-import { 
-  ADMIN, 
-  AuthMode,
-  MEMBER
-} from "../../variables";
+import { requireAuth } from "../../middleware";
+import { AuthMode } from "../../variables";
 
 router.get(
   "/:workspaceId/tags",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT],
+    acceptedAuthModes: [AuthMode.JWT]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [MEMBER, ADMIN],
-    locationWorkspaceId: "params",
-  }),
-  param("workspaceId").exists().trim(),
-  validateRequest,
   tagController.getWorkspaceTags
 );
 
 router.delete(
   "/tags/:tagId",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT],
+    acceptedAuthModes: [AuthMode.JWT]
   }),
-  param("tagId").exists().trim(),
-  validateRequest,
   tagController.deleteWorkspaceTag
 );
 
 router.post(
   "/:workspaceId/tags",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT],
+    acceptedAuthModes: [AuthMode.JWT]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [MEMBER, ADMIN],
-    locationWorkspaceId: "params",
-  }),
-  param("workspaceId").exists().trim(),
-  body("name").exists().trim(),
-  body("tagColor").exists().trim(),
-  body("slug").exists().trim(),
-  validateRequest,
   tagController.createWorkspaceTag
 );
 

backend/src/routes/v2/users.ts

@@ -1,43 +1,31 @@
 import express from "express";
 const router = express.Router();
-import {
-    requireAuth,
-    validateRequest,
-} from "../../middleware";
-import { body, param } from "express-validator";
+import { requireAuth } from "../../middleware";
 import { usersController } from "../../controllers/v2";
 import { AuthMode } from "../../variables";
-import {
-    AuthMethod
-} from "../../models";
 
 router.get(
-    "/me",
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
-    }),
-    usersController.getMe
+  "/me",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  usersController.getMe
 );
 
 router.patch(
-    "/me/mfa",
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
-    }),
-    body("isMfaEnabled").exists().isBoolean(),
-    validateRequest,
-    usersController.updateMyMfaEnabled
+  "/me/mfa",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  usersController.updateMyMfaEnabled
 );
 
 router.patch(
-    "/me/name",
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
-    }),
-    body("firstName").exists().isString(),
-    body("lastName").isString(),
-    validateRequest,
-    usersController.updateName
+  "/me/name",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  usersController.updateName
 );
 
 router.put(
@@ -60,56 +48,51 @@ router.put(
 );
 
 router.get(
-    "/me/organizations",
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
-    }),
-    usersController.getMyOrganizations
+  "/me/organizations",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  usersController.getMyOrganizations
 );
 
 router.get(
-    "/me/api-keys",
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT]
-    }),
-    usersController.getMyAPIKeys
+  "/me/api-keys",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  usersController.getMyAPIKeys
 );
 
 router.post(
-    "/me/api-keys",
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT]
-    }),
-    body("name").exists().isString().trim(),
-    body("expiresIn").isNumeric(),
-    validateRequest,
-    usersController.createAPIKey
+  "/me/api-keys",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  usersController.createAPIKey
 );
 
 router.delete(
-    "/me/api-keys/:apiKeyDataId",
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT]
-    }),
-    param("apiKeyDataId").exists().trim(),
-    validateRequest,
-    usersController.deleteAPIKey
+  "/me/api-keys/:apiKeyDataId",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  usersController.deleteAPIKey
 );
 
 router.get(
-    "/me/sessions",
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT]
-    }), 
-    usersController.getMySessions
+  "/me/sessions",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  usersController.getMySessions
 );
 
 router.delete(
-    "/me/sessions",
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT]
-    }), 
-    usersController.deleteMySessions
+  "/me/sessions",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  usersController.deleteMySessions
 );
 
-export default router;
+export default router;

backend/src/routes/v2/workspace.ts

@@ -1,147 +1,96 @@
 import express from "express";
 const router = express.Router();
 import { body, param, query } from "express-validator";
-import {
-	requireAuth,
-	requireMembershipAuth,
-	requireWorkspaceAuth,
-	validateRequest,
-} from "../../middleware";
-import {
-	ADMIN, 
-	AuthMode,
-	MEMBER
-} from "../../variables";
+import { requireAuth, requireWorkspaceAuth, validateRequest } from "../../middleware";
+import { ADMIN, AuthMode, MEMBER } from "../../variables";
 import { workspaceController } from "../../controllers/v2";
 
-router.post( // TODO endpoint: deprecate (moved to POST v3/secrets)
-	"/:workspaceId/secrets",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		locationWorkspaceId: "params",
-	}),
-	body("secrets").exists(),
-	body("keys").exists(),
-	body("environment").exists().trim().notEmpty(),
-	body("channel"),
-	param("workspaceId").exists().trim(),
-	validateRequest,
-	workspaceController.pushWorkspaceSecrets
-);
-
-router.get( // TODO endpoint: deprecate (moved to GET v3/secrets)
-	"/:workspaceId/secrets",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN],
-	}),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		locationWorkspaceId: "params",
-	}),
-	query("environment").exists().trim(),
-	query("channel"),
-	param("workspaceId").exists().trim(),
-	validateRequest,
-	workspaceController.pullSecrets
-);
-
-router.get( // TODO endpoint: consider moving to v3/users/me/workspaces/:workspaceId/key
-	"/:workspaceId/encrypted-key",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
-	}),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		locationWorkspaceId: "params",
-	}),
-	param("workspaceId").exists().trim(),
-	validateRequest,
-	workspaceController.getWorkspaceKey
+router.post(
+  // TODO endpoint: deprecate (moved to POST v3/secrets)
+  "/:workspaceId/secrets",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  requireWorkspaceAuth({
+    acceptedRoles: [ADMIN, MEMBER],
+    locationWorkspaceId: "params"
+  }),
+  body("secrets").exists(),
+  body("keys").exists(),
+  body("environment").exists().trim().notEmpty(),
+  body("channel"),
+  param("workspaceId").exists().trim(),
+  validateRequest,
+  workspaceController.pushWorkspaceSecrets
 );
 
 router.get(
-	"/:workspaceId/service-token-data",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT],
-	}),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		locationWorkspaceId: "params",
-	}),
-	param("workspaceId").exists().trim(),
-	validateRequest,
-	workspaceController.getWorkspaceServiceTokenData
+  // TODO endpoint: deprecate (moved to GET v3/secrets)
+  "/:workspaceId/secrets",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN]
+  }),
+  requireWorkspaceAuth({
+    acceptedRoles: [ADMIN, MEMBER],
+    locationWorkspaceId: "params"
+  }),
+  query("environment").exists().trim(),
+  query("channel"),
+  param("workspaceId").exists().trim(),
+  validateRequest,
+  workspaceController.pullSecrets
 );
 
-router.get( // new - TODO: rewire dashboard to this route
-	"/:workspaceId/memberships",
-	param("workspaceId").exists().trim(),
-	validateRequest,
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
-	}),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		locationWorkspaceId: "params",
-	}),
-	workspaceController.getWorkspaceMemberships
+router.get(
+  // TODO endpoint: consider moving to v3/users/me/workspaces/:workspaceId/key
+  "/:workspaceId/encrypted-key",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  workspaceController.getWorkspaceKey
 );
 
-router.patch( // TODO - rewire dashboard to this route
-	"/:workspaceId/memberships/:membershipId",
-	param("workspaceId").exists().trim(),
-	param("membershipId").exists().trim(),
-	body("role").exists().isString().trim().isIn([ADMIN, MEMBER]),
-	validateRequest,
-	requireAuth({
-        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
-    }),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN],
-		locationWorkspaceId: "params",
-	}),
-	requireMembershipAuth({
-		acceptedRoles: [ADMIN],
-		locationMembershipId: "params",
-	}),
-	workspaceController.updateWorkspaceMembership
+router.get(
+  "/:workspaceId/service-token-data",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  workspaceController.getWorkspaceServiceTokenData
 );
 
-router.delete( // TODO - rewire dashboard to this route
-	"/:workspaceId/memberships/:membershipId",
-	param("workspaceId").exists().trim(),
-	param("membershipId").exists().trim(),
-	validateRequest,
-	requireAuth({
-        acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY],
-    }),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN],
-		locationWorkspaceId: "params",
-	}),
-	requireMembershipAuth({
-		acceptedRoles: [ADMIN],
-		locationMembershipId: "params",
-	}),
-	workspaceController.deleteWorkspaceMembership
+router.get(
+  // new - TODO: rewire dashboard to this route
+  "/:workspaceId/memberships",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  workspaceController.getWorkspaceMemberships
 );
 
 router.patch(
-	"/:workspaceId/auto-capitalization",
-	requireAuth({
-		acceptedAuthModes: [AuthMode.JWT]
-	}),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		locationWorkspaceId: "params",
-	}),
-	param("workspaceId").exists().trim(),
-	body("autoCapitalization").exists().trim().notEmpty(),
-	validateRequest,
-	workspaceController.toggleAutoCapitalization
+  // TODO - rewire dashboard to this route
+  "/:workspaceId/memberships/:membershipId",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  workspaceController.updateWorkspaceMembership
+);
+
+router.delete(
+  // TODO - rewire dashboard to this route
+  "/:workspaceId/memberships/:membershipId",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+  }),
+  workspaceController.deleteWorkspaceMembership
+);
+
+router.patch(
+  "/:workspaceId/auto-capitalization",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  workspaceController.toggleAutoCapitalization
 );
 
 export default router;

backend/src/routes/v3/auth.ts

@@ -1,29 +1,11 @@
 import express from "express";
-import { body } from "express-validator";
-import { validateRequest } from "../../middleware";
 import { authController } from "../../controllers/v3";
 import { authLimiter } from "../../helpers/rateLimiter";
 
 const router = express.Router();
 
-router.post(
-    "/login1",
-    authLimiter,
-    body("email").isString().trim().toLowerCase(),
-    body("providerAuthToken").isString().trim().optional({nullable: true}),
-    body("clientPublicKey").isString().trim().notEmpty(),
-    validateRequest,
-    authController.login1
-);
+router.post("/login1", authLimiter, authController.login1);
 
-router.post(
-    "/login2",
-    authLimiter,
-    body("email").isString().trim().toLowerCase(),
-    body("providerAuthToken").isString().trim().optional({nullable: true}),
-    body("clientProof").isString().trim().notEmpty(),
-    validateRequest,
-    authController.login2
-);
+router.post("/login2", authLimiter, authController.login2);
 
 export default router;

backend/src/routes/v3/secrets.ts

@@ -1,288 +1,130 @@
 import express from "express";
 const router = express.Router();
-import { requireAuth, requireWorkspaceAuth, validateRequest } from "../../middleware";
-import { body, param, query } from "express-validator";
+import {
+  requireAuth,
+  requireBlindIndicesEnabled,
+  requireE2EEOff
+} from "../../middleware";
 import { secretsController } from "../../controllers/v3";
 import {
-  ADMIN,
-  AuthMode,
-  MEMBER,
-  PERMISSION_READ_SECRETS,
-  PERMISSION_WRITE_SECRETS,
-  SECRET_PERSONAL,
-  SECRET_SHARED
+  AuthMode
 } from "../../variables";
 
 router.get(
   "/raw",
-  query("workspaceId").optional().isString().trim(),
-  query("environment").optional().isString().trim(),
-  query("folderId").optional().isString().trim(),
-  query("secretPath").default("/").isString().trim(),
-  query("include_imports").optional().isBoolean().default(false),
-  validateRequest,
   requireAuth({
-    acceptedAuthModes: [
-      AuthMode.JWT,
-      AuthMode.API_KEY,
-      AuthMode.SERVICE_TOKEN
-    ]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN]
   }),
   secretsController.getSecretsRaw
 );
 
 router.get(
   "/raw/:secretName",
-  param("secretName").exists().isString().trim(),
-  query("workspaceId").exists().isString().trim(),
-  query("environment").exists().isString().trim(),
-  query("secretPath").default("/").isString().trim(),
-  query("type").optional().isIn([SECRET_SHARED, SECRET_PERSONAL]),
-  validateRequest,
   requireAuth({
-    acceptedAuthModes: [
-      AuthMode.JWT,
-      AuthMode.API_KEY,
-      AuthMode.SERVICE_TOKEN
-    ]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "query",
-    locationEnvironment: "query",
-    requiredPermissions: [PERMISSION_READ_SECRETS],
-    requireBlindIndicesEnabled: true,
-    requireE2EEOff: true,
-    checkIPAllowlist: false
+  requireBlindIndicesEnabled({
+    locationWorkspaceId: "query"
+  }),
+  requireE2EEOff({
+    locationWorkspaceId: "query"
   }),
   secretsController.getSecretByNameRaw
 );
 
 router.post(
   "/raw/:secretName",
-  body("workspaceId").exists().isString().trim(),
-  body("environment").exists().isString().trim(),
-  body("type").exists().isIn([SECRET_SHARED, SECRET_PERSONAL]),
-  body("secretValue").exists().isString().trim(),
-  body("secretComment").default("").isString().trim(),
-  body("secretPath").default("/").isString().trim(),
-  validateRequest,
   requireAuth({
-    acceptedAuthModes: [
-      AuthMode.JWT,
-      AuthMode.API_KEY,
-      AuthMode.SERVICE_TOKEN
-    ]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "body",
-    locationEnvironment: "body",
-    requiredPermissions: [PERMISSION_WRITE_SECRETS],
-    requireBlindIndicesEnabled: true,
-    requireE2EEOff: true,
-    checkIPAllowlist: false
+  requireBlindIndicesEnabled({
+    locationWorkspaceId: "body"
+  }),
+  requireE2EEOff({
+    locationWorkspaceId: "body"
   }),
   secretsController.createSecretRaw
 );
 
 router.patch(
   "/raw/:secretName",
-  param("secretName").exists().isString().trim(),
-  body("workspaceId").exists().isString().trim(),
-  body("environment").exists().isString().trim(),
-  body("type").exists().isIn([SECRET_SHARED, SECRET_PERSONAL]),
-  body("secretValue").exists().isString().trim(),
-  body("secretPath").default("/").isString().trim(),
-  validateRequest,
   requireAuth({
-    acceptedAuthModes: [
-      AuthMode.JWT,
-      AuthMode.API_KEY,
-      AuthMode.SERVICE_TOKEN
-    ]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "body",
-    locationEnvironment: "body",
-    requiredPermissions: [PERMISSION_WRITE_SECRETS],
-    requireBlindIndicesEnabled: true,
-    requireE2EEOff: true,
-    checkIPAllowlist: false
+  requireBlindIndicesEnabled({
+    locationWorkspaceId: "body"
+  }),
+  requireE2EEOff({
+    locationWorkspaceId: "body"
   }),
   secretsController.updateSecretByNameRaw
 );
 
 router.delete(
   "/raw/:secretName",
-  param("secretName").exists().isString().trim(),
-  body("workspaceId").exists().isString().trim(),
-  body("environment").exists().isString().trim(),
-  body("secretPath").default("/").isString().trim(),
-  body("type").exists().isIn([SECRET_SHARED, SECRET_PERSONAL]),
-  validateRequest,
   requireAuth({
-    acceptedAuthModes: [
-      AuthMode.JWT,
-      AuthMode.API_KEY,
-      AuthMode.SERVICE_TOKEN
-    ]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "body",
-    locationEnvironment: "body",
-    requiredPermissions: [PERMISSION_WRITE_SECRETS],
-    requireBlindIndicesEnabled: true,
-    requireE2EEOff: true,
-    checkIPAllowlist: false
+  requireBlindIndicesEnabled({
+    locationWorkspaceId: "body"
+  }),
+  requireE2EEOff({
+    locationWorkspaceId: "body"
   }),
   secretsController.deleteSecretByNameRaw
 );
 
 router.get(
   "/",
-  query("workspaceId").exists().isString().trim(),
-  query("environment").exists().isString().trim(),
-  query("folderId").optional().isString().trim(),
-  query("secretPath").default("/").isString().trim(),
-  validateRequest,
   requireAuth({
-    acceptedAuthModes: [
-      AuthMode.JWT,
-      AuthMode.API_KEY,
-      AuthMode.SERVICE_TOKEN
-    ]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "query",
-    locationEnvironment: "query",
-    requiredPermissions: [PERMISSION_READ_SECRETS],
-    requireBlindIndicesEnabled: true,
-    requireE2EEOff: false,
-    checkIPAllowlist: false
+  requireBlindIndicesEnabled({
+    locationWorkspaceId: "query"
   }),
   secretsController.getSecrets
 );
 
 router.post(
   "/:secretName",
-  body("workspaceId").exists().isString().trim(),
-  body("environment").exists().isString().trim(),
-  body("type").exists().isIn([SECRET_SHARED, SECRET_PERSONAL]),
-  body("secretKeyCiphertext").exists().isString().trim(),
-  body("secretKeyIV").exists().isString().trim(),
-  body("secretKeyTag").exists().isString().trim(),
-  body("secretValueCiphertext").exists().isString().trim(),
-  body("secretValueIV").exists().isString().trim(),
-  body("secretValueTag").exists().isString().trim(),
-  body("secretCommentCiphertext").optional().isString().trim(),
-  body("secretCommentIV").optional().isString().trim(),
-  body("secretCommentTag").optional().isString().trim(),
-  body("secretPath").default("/").isString().trim(),
-  body("metadata").optional().isObject().withMessage("Metadata should be an object"),
-  body("metadata.source").optional().isString().withMessage("Source should be a string"),
-  validateRequest,
   requireAuth({
-    acceptedAuthModes: [
-      AuthMode.JWT,
-      AuthMode.API_KEY,
-      AuthMode.SERVICE_TOKEN
-    ]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "body",
-    locationEnvironment: "body",
-    requiredPermissions: [PERMISSION_WRITE_SECRETS],
-    requireBlindIndicesEnabled: true,
-    requireE2EEOff: false,
-    checkIPAllowlist: false
+  requireBlindIndicesEnabled({
+    locationWorkspaceId: "body"
   }),
   secretsController.createSecret
 );
 
 router.get(
   "/:secretName",
-  param("secretName").exists().isString().trim(),
-  query("workspaceId").exists().isString().trim(),
-  query("environment").exists().isString().trim(),
-  query("secretPath").default("/").isString().trim(),
-  query("type").optional().isIn([SECRET_SHARED, SECRET_PERSONAL]),
-  validateRequest,
   requireAuth({
-    acceptedAuthModes: [
-      AuthMode.JWT,
-      AuthMode.API_KEY,
-      AuthMode.SERVICE_TOKEN
-    ]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "query",
-    locationEnvironment: "query",
-    requiredPermissions: [PERMISSION_READ_SECRETS],
-    requireBlindIndicesEnabled: true,
-    checkIPAllowlist: false
+  requireBlindIndicesEnabled({
+    locationWorkspaceId: "query"
   }),
   secretsController.getSecretByName
 );
 
 router.patch(
   "/:secretName",
-  param("secretName").exists().isString().trim(),
-  body("workspaceId").exists().isString().trim(),
-  body("environment").exists().isString().trim(),
-  body("type").exists().isIn([SECRET_SHARED, SECRET_PERSONAL]),
-  body("secretValueCiphertext").exists().isString().trim(),
-  body("secretValueIV").exists().isString().trim(),
-  body("secretValueTag").exists().isString().trim(),
-  body("secretPath").default("/").isString().trim(),
-  validateRequest,
   requireAuth({
-    acceptedAuthModes: [
-      AuthMode.JWT,
-      AuthMode.API_KEY,
-      AuthMode.SERVICE_TOKEN
-    ]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "body",
-    locationEnvironment: "body",
-    requiredPermissions: [PERMISSION_WRITE_SECRETS],
-    requireBlindIndicesEnabled: true,
-    requireE2EEOff: false,
-    checkIPAllowlist: false
+  requireBlindIndicesEnabled({
+    locationWorkspaceId: "body"
   }),
   secretsController.updateSecretByName
 );
 
 router.delete(
   "/:secretName",
-  param("secretName").exists().isString().trim(),
-  body("workspaceId").exists().isString().trim(),
-  body("environment").exists().isString().trim(),
-  body("secretPath").default("/").isString().trim(),
-  body("type").exists().isIn([SECRET_SHARED, SECRET_PERSONAL]),
-  validateRequest,
   requireAuth({
-    acceptedAuthModes: [
-      AuthMode.JWT,
-      AuthMode.API_KEY,
-      AuthMode.SERVICE_TOKEN
-    ]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN]
   }),
-  requireWorkspaceAuth({
-    acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: "body",
-    locationEnvironment: "body",
-    requiredPermissions: [PERMISSION_WRITE_SECRETS],
-    requireBlindIndicesEnabled: true,
-    requireE2EEOff: false,
-    checkIPAllowlist: false
+  requireBlindIndicesEnabled({
+    locationWorkspaceId: "body"
   }),
   secretsController.deleteSecretByName
 );

backend/src/routes/v3/signup.ts

@@ -1,30 +1,14 @@
 import express from "express";
 const router = express.Router();
-import { body } from "express-validator";
 import { signupController } from "../../controllers/v3";
 import { authLimiter } from "../../helpers/rateLimiter";
 import { validateRequest } from "../../middleware";
 
 router.post(
-    "/complete-account/signup", // TODO: consider moving endpoint to v3/users/new/complete-account/signup
-    authLimiter,
-    body("email").exists().isString().trim().notEmpty().isEmail(),
-	body("firstName").exists().isString().trim().notEmpty(),
-	body("lastName").exists().isString().trim().optional({nullable: true}),
-	body("protectedKey").exists().isString().trim().notEmpty(),
-	body("protectedKeyIV").exists().isString().trim().notEmpty(),
-	body("protectedKeyTag").exists().isString().trim().notEmpty(),
-	body("publicKey").exists().isString().trim().notEmpty(),
-	body("encryptedPrivateKey").exists().isString().trim().notEmpty(),
-	body("encryptedPrivateKeyIV").exists().isString().trim().notEmpty(),
-	body("encryptedPrivateKeyTag").exists().isString().trim().notEmpty(),
-	body("salt").exists().isString().trim().notEmpty(),
-	body("verifier").exists().isString().trim().notEmpty(),
-	body("organizationName").exists().isString().trim().notEmpty(),
-	body("providerAuthToken").isString().trim().optional({ nullable: true }),
-	body("attributionSource").optional().isString().trim(),
-    validateRequest,
-    signupController.completeAccountSignup,
+  "/complete-account/signup", // TODO: consider moving endpoint to v3/users/new/complete-account/signup
+  authLimiter,
+  validateRequest,
+  signupController.completeAccountSignup
 );
 
 export default router;

backend/src/routes/v3/workspaces.ts

@@ -1,79 +1,37 @@
 import express from "express";
 const router = express.Router();
-import {
-    requireAuth,
-    requireWorkspaceAuth,
-    validateRequest,
-} from "../../middleware";
+import { requireAuth } from "../../middleware";
 import { workspacesController } from "../../controllers/v3";
-import {
-    ADMIN,
-    AuthMode
-} from "../../variables";
-import { body, param } from "express-validator";
+import { AuthMode } from "../../variables";
 
 // -- migration to blind indices endpoints
 
 router.get(
-    "/:workspaceId/secrets/blind-index-status",
-    param("workspaceId").exists().isString().trim(),
-    validateRequest,
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT],
-    }),
-    requireWorkspaceAuth({
-        acceptedRoles: [ADMIN],
-        locationWorkspaceId: "params",
-    }),
-    workspacesController.getWorkspaceBlindIndexStatus
+  "/:workspaceId/secrets/blind-index-status",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  workspacesController.getWorkspaceBlindIndexStatus
 );
 
-router.get( // allow admins to get all workspace secrets (part of blind indices migration)
-    "/:workspaceId/secrets",
-    param("workspaceId").exists().isString().trim(),
-    validateRequest,
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT],
-    }),
-    requireWorkspaceAuth({
-        acceptedRoles: [ADMIN],
-        locationWorkspaceId: "params",
-    }),
-    workspacesController.getWorkspaceSecrets
+router.get(
+  // allow admins to get all workspace secrets (part of blind indices migration)
+  "/:workspaceId/secrets",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  workspacesController.getWorkspaceSecrets
 );
 
-router.post( // allow admins to name all workspace secrets (part of blind indices migration)
-    "/:workspaceId/secrets/names",
-    param("workspaceId").exists().isString().trim(),
-    body("secretsToUpdate")
-        .exists()
-        .isArray()
-        .withMessage("secretsToUpdate must be an array")
-        .customSanitizer((value) => {
-            return value.map((secret: any) => ({
-                secretName: secret.secretName,
-                _id: secret._id,
-            }));
-        }),
-    body("secretsToUpdate.*.secretName")
-        .exists()
-        .isString()
-        .withMessage("secretName must be a string"),
-    body("secretsToUpdate.*._id")
-        .exists()
-        .isString()
-        .withMessage("secretId must be a string"),
-    validateRequest,
-    requireAuth({
-        acceptedAuthModes: [AuthMode.JWT],
-    }),
-    requireWorkspaceAuth({
-        acceptedRoles: [ADMIN],
-        locationWorkspaceId: "params",
-    }),
-    workspacesController.nameWorkspaceSecrets
+router.post(
+  // allow admins to name all workspace secrets (part of blind indices migration)
+  "/:workspaceId/secrets/names",
+  requireAuth({
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
+  workspacesController.nameWorkspaceSecrets
 );
 
 // --
 
-export default router;
+export default router;