1
0
mirror of https://github.com/bitwarden/server.git synced 2024-12-04 14:13:28 +01:00
bitwarden-server/test/Core.Test/Services/PolicyServiceTests.cs

401 lines
15 KiB
C#
Raw Normal View History

using Bit.Core.Entities;
2021-12-16 15:35:09 +01:00
using Bit.Core.Enums;
using Bit.Core.Exceptions;
using Bit.Core.Models.Data;
using Bit.Core.Repositories;
using Bit.Core.Services;
2021-12-16 15:35:09 +01:00
using Bit.Test.Common.AutoFixture;
using Bit.Test.Common.AutoFixture.Attributes;
using NSubstitute;
using Xunit;
2021-12-16 15:35:09 +01:00
using PolicyFixtures = Bit.Core.Test.AutoFixture.PolicyFixtures;
2022-08-29 22:06:55 +02:00
namespace Bit.Core.Test.Services;
[SutProviderCustomize]
public class PolicyServiceTests
{
2022-08-29 22:06:55 +02:00
[Theory, BitAutoData]
public async Task SaveAsync_OrganizationDoesNotExist_ThrowsBadRequest(
[PolicyFixtures.Policy(PolicyType.DisableSend)] Policy policy, SutProvider<PolicyService> sutProvider)
{
2022-08-29 22:06:55 +02:00
SetupOrg(sutProvider, policy.OrganizationId, null);
2022-08-29 22:06:55 +02:00
var badRequestException = await Assert.ThrowsAsync<BadRequestException>(
() => sutProvider.Sut.SaveAsync(policy,
Substitute.For<IUserService>(),
Substitute.For<IOrganizationService>(),
Guid.NewGuid()));
2022-08-29 22:06:55 +02:00
Assert.Contains("Organization not found", badRequestException.Message, StringComparison.OrdinalIgnoreCase);
2022-08-29 22:06:55 +02:00
await sutProvider.GetDependency<IPolicyRepository>()
.DidNotReceiveWithAnyArgs()
.UpsertAsync(default);
2022-08-29 22:06:55 +02:00
await sutProvider.GetDependency<IEventService>()
.DidNotReceiveWithAnyArgs()
.LogPolicyEventAsync(default, default, default);
}
2022-08-29 22:06:55 +02:00
[Theory, BitAutoData]
public async Task SaveAsync_OrganizationCannotUsePolicies_ThrowsBadRequest(
[PolicyFixtures.Policy(PolicyType.DisableSend)] Policy policy, SutProvider<PolicyService> sutProvider)
{
var orgId = Guid.NewGuid();
SetupOrg(sutProvider, policy.OrganizationId, new Organization
{
2022-08-29 22:06:55 +02:00
UsePolicies = false,
});
2022-08-29 22:06:55 +02:00
var badRequestException = await Assert.ThrowsAsync<BadRequestException>(
() => sutProvider.Sut.SaveAsync(policy,
Substitute.For<IUserService>(),
Substitute.For<IOrganizationService>(),
Guid.NewGuid()));
2022-08-29 22:06:55 +02:00
Assert.Contains("cannot use policies", badRequestException.Message, StringComparison.OrdinalIgnoreCase);
2022-08-29 22:06:55 +02:00
await sutProvider.GetDependency<IPolicyRepository>()
.DidNotReceiveWithAnyArgs()
.UpsertAsync(default);
2022-08-29 22:06:55 +02:00
await sutProvider.GetDependency<IEventService>()
.DidNotReceiveWithAnyArgs()
.LogPolicyEventAsync(default, default, default);
}
2022-08-29 22:06:55 +02:00
[Theory, BitAutoData]
public async Task SaveAsync_SingleOrg_RequireSsoEnabled_ThrowsBadRequest(
[PolicyFixtures.Policy(PolicyType.SingleOrg)] Policy policy, SutProvider<PolicyService> sutProvider)
{
policy.Enabled = false;
2022-08-29 22:06:55 +02:00
SetupOrg(sutProvider, policy.OrganizationId, new Organization
{
2022-08-29 22:06:55 +02:00
Id = policy.OrganizationId,
UsePolicies = true,
});
2022-08-29 22:06:55 +02:00
sutProvider.GetDependency<IPolicyRepository>()
.GetByOrganizationIdTypeAsync(policy.OrganizationId, PolicyType.RequireSso)
.Returns(Task.FromResult(new Policy { Enabled = true }));
2022-08-29 22:06:55 +02:00
var badRequestException = await Assert.ThrowsAsync<BadRequestException>(
() => sutProvider.Sut.SaveAsync(policy,
Substitute.For<IUserService>(),
Substitute.For<IOrganizationService>(),
Guid.NewGuid()));
2022-08-29 22:06:55 +02:00
Assert.Contains("Single Sign-On Authentication policy is enabled.", badRequestException.Message, StringComparison.OrdinalIgnoreCase);
2022-08-29 22:06:55 +02:00
await sutProvider.GetDependency<IPolicyRepository>()
.DidNotReceiveWithAnyArgs()
.UpsertAsync(default);
2022-08-29 22:06:55 +02:00
await sutProvider.GetDependency<IEventService>()
.DidNotReceiveWithAnyArgs()
.LogPolicyEventAsync(default, default, default);
}
2022-08-29 22:06:55 +02:00
[Theory, BitAutoData]
public async Task SaveAsync_SingleOrg_VaultTimeoutEnabled_ThrowsBadRequest([PolicyFixtures.Policy(Enums.PolicyType.SingleOrg)] Policy policy, SutProvider<PolicyService> sutProvider)
{
policy.Enabled = false;
2022-08-29 22:06:55 +02:00
SetupOrg(sutProvider, policy.OrganizationId, new Organization
{
2022-08-29 22:06:55 +02:00
Id = policy.OrganizationId,
UsePolicies = true,
});
2022-08-29 20:53:16 +02:00
2022-08-29 22:06:55 +02:00
sutProvider.GetDependency<IPolicyRepository>()
.GetByOrganizationIdTypeAsync(policy.OrganizationId, Enums.PolicyType.MaximumVaultTimeout)
.Returns(new Policy { Enabled = true });
var badRequestException = await Assert.ThrowsAsync<BadRequestException>(
() => sutProvider.Sut.SaveAsync(policy,
Substitute.For<IUserService>(),
Substitute.For<IOrganizationService>(),
Guid.NewGuid()));
Assert.Contains("Maximum Vault Timeout policy is enabled.", badRequestException.Message, StringComparison.OrdinalIgnoreCase);
await sutProvider.GetDependency<IPolicyRepository>()
.DidNotReceiveWithAnyArgs()
.UpsertAsync(default);
}
[Theory]
[BitAutoData(PolicyType.SingleOrg)]
[BitAutoData(PolicyType.RequireSso)]
public async Task SaveAsync_PolicyRequiredByKeyConnector_DisablePolicy_ThrowsBadRequest(
Enums.PolicyType policyType,
Policy policy,
SutProvider<PolicyService> sutProvider)
{
policy.Enabled = false;
policy.Type = policyType;
2022-08-29 22:06:55 +02:00
SetupOrg(sutProvider, policy.OrganizationId, new Organization
{
2022-08-29 22:06:55 +02:00
Id = policy.OrganizationId,
UsePolicies = true,
});
2022-08-29 22:06:55 +02:00
var ssoConfig = new SsoConfig { Enabled = true };
var data = new SsoConfigurationData { KeyConnectorEnabled = true };
ssoConfig.SetData(data);
2022-08-29 22:06:55 +02:00
sutProvider.GetDependency<ISsoConfigRepository>()
.GetByOrganizationIdAsync(policy.OrganizationId)
.Returns(ssoConfig);
2022-08-29 22:06:55 +02:00
var badRequestException = await Assert.ThrowsAsync<BadRequestException>(
() => sutProvider.Sut.SaveAsync(policy,
Substitute.For<IUserService>(),
Substitute.For<IOrganizationService>(),
Guid.NewGuid()));
2022-08-29 22:06:55 +02:00
Assert.Contains("Key Connector is enabled.", badRequestException.Message, StringComparison.OrdinalIgnoreCase);
2022-08-29 22:06:55 +02:00
await sutProvider.GetDependency<IPolicyRepository>()
.DidNotReceiveWithAnyArgs()
.UpsertAsync(default);
}
2022-08-29 22:06:55 +02:00
[Theory, BitAutoData]
public async Task SaveAsync_RequireSsoPolicy_NotEnabled_ThrowsBadRequestAsync(
[PolicyFixtures.Policy(Enums.PolicyType.RequireSso)] Policy policy, SutProvider<PolicyService> sutProvider)
{
policy.Enabled = true;
2022-08-29 22:06:55 +02:00
SetupOrg(sutProvider, policy.OrganizationId, new Organization
{
2022-08-29 22:06:55 +02:00
Id = policy.OrganizationId,
UsePolicies = true,
});
2022-08-29 22:06:55 +02:00
sutProvider.GetDependency<IPolicyRepository>()
.GetByOrganizationIdTypeAsync(policy.OrganizationId, PolicyType.SingleOrg)
.Returns(Task.FromResult(new Policy { Enabled = false }));
2022-08-29 22:06:55 +02:00
var badRequestException = await Assert.ThrowsAsync<BadRequestException>(
() => sutProvider.Sut.SaveAsync(policy,
Substitute.For<IUserService>(),
Substitute.For<IOrganizationService>(),
Guid.NewGuid()));
2022-08-29 22:06:55 +02:00
Assert.Contains("Single Organization policy not enabled.", badRequestException.Message, StringComparison.OrdinalIgnoreCase);
2022-08-29 22:06:55 +02:00
await sutProvider.GetDependency<IPolicyRepository>()
.DidNotReceiveWithAnyArgs()
.UpsertAsync(default);
2022-08-29 22:06:55 +02:00
await sutProvider.GetDependency<IEventService>()
.DidNotReceiveWithAnyArgs()
.LogPolicyEventAsync(default, default, default);
}
2022-08-29 22:06:55 +02:00
[Theory, BitAutoData]
public async Task SaveAsync_NewPolicy_Created(
[PolicyFixtures.Policy(PolicyType.ResetPassword)] Policy policy, SutProvider<PolicyService> sutProvider)
{
policy.Id = default;
2022-08-29 22:06:55 +02:00
SetupOrg(sutProvider, policy.OrganizationId, new Organization
{
2022-08-29 22:06:55 +02:00
Id = policy.OrganizationId,
UsePolicies = true,
});
2022-08-29 22:06:55 +02:00
var utcNow = DateTime.UtcNow;
2022-08-29 22:06:55 +02:00
await sutProvider.Sut.SaveAsync(policy, Substitute.For<IUserService>(), Substitute.For<IOrganizationService>(), Guid.NewGuid());
2022-08-29 22:06:55 +02:00
await sutProvider.GetDependency<IEventService>().Received()
.LogPolicyEventAsync(policy, EventType.Policy_Updated);
2022-08-29 22:06:55 +02:00
await sutProvider.GetDependency<IPolicyRepository>().Received()
.UpsertAsync(policy);
2022-08-29 22:06:55 +02:00
Assert.True(policy.CreationDate - utcNow < TimeSpan.FromSeconds(1));
Assert.True(policy.RevisionDate - utcNow < TimeSpan.FromSeconds(1));
}
2022-08-29 22:06:55 +02:00
[Theory, BitAutoData]
public async Task SaveAsync_VaultTimeoutPolicy_NotEnabled_ThrowsBadRequestAsync(
[PolicyFixtures.Policy(PolicyType.MaximumVaultTimeout)] Policy policy, SutProvider<PolicyService> sutProvider)
{
policy.Enabled = true;
2022-08-29 22:06:55 +02:00
SetupOrg(sutProvider, policy.OrganizationId, new Organization
{
2022-08-29 22:06:55 +02:00
Id = policy.OrganizationId,
UsePolicies = true,
});
2022-08-29 22:06:55 +02:00
sutProvider.GetDependency<IPolicyRepository>()
.GetByOrganizationIdTypeAsync(policy.OrganizationId, Enums.PolicyType.SingleOrg)
.Returns(Task.FromResult(new Policy { Enabled = false }));
2022-08-29 22:06:55 +02:00
var badRequestException = await Assert.ThrowsAsync<BadRequestException>(
() => sutProvider.Sut.SaveAsync(policy,
Substitute.For<IUserService>(),
Substitute.For<IOrganizationService>(),
Guid.NewGuid()));
2022-08-29 22:06:55 +02:00
Assert.Contains("Single Organization policy not enabled.", badRequestException.Message, StringComparison.OrdinalIgnoreCase);
2022-08-29 22:06:55 +02:00
await sutProvider.GetDependency<IPolicyRepository>()
.DidNotReceiveWithAnyArgs()
.UpsertAsync(default);
2022-08-29 22:06:55 +02:00
await sutProvider.GetDependency<IEventService>()
.DidNotReceiveWithAnyArgs()
.LogPolicyEventAsync(default, default, default);
}
2022-08-29 22:06:55 +02:00
[Theory, BitAutoData]
public async Task SaveAsync_ExistingPolicy_UpdateTwoFactor(
[PolicyFixtures.Policy(PolicyType.TwoFactorAuthentication)] Policy policy, SutProvider<PolicyService> sutProvider)
{
// If the policy that this is updating isn't enabled then do some work now that the current one is enabled
2022-08-29 22:06:55 +02:00
var org = new Organization
{
2022-08-29 22:06:55 +02:00
Id = policy.OrganizationId,
UsePolicies = true,
Name = "TEST",
};
2022-08-29 22:06:55 +02:00
SetupOrg(sutProvider, policy.OrganizationId, org);
sutProvider.GetDependency<IPolicyRepository>()
.GetByIdAsync(policy.Id)
.Returns(new Policy
{
2022-08-29 22:06:55 +02:00
Id = policy.Id,
Type = PolicyType.TwoFactorAuthentication,
Enabled = false,
});
var orgUserDetail = new Core.Models.Data.Organizations.OrganizationUsers.OrganizationUserUserDetails
{
Id = Guid.NewGuid(),
Status = OrganizationUserStatusType.Accepted,
Type = OrganizationUserType.User,
// Needs to be different from what is passed in as the savingUserId to Sut.SaveAsync
Email = "test@bitwarden.com",
Name = "TEST",
UserId = Guid.NewGuid(),
};
sutProvider.GetDependency<IOrganizationUserRepository>()
.GetManyDetailsByOrganizationAsync(policy.OrganizationId)
.Returns(new List<Core.Models.Data.Organizations.OrganizationUsers.OrganizationUserUserDetails>
{
2022-08-29 22:06:55 +02:00
orgUserDetail,
});
2022-08-29 22:06:55 +02:00
var userService = Substitute.For<IUserService>();
var organizationService = Substitute.For<IOrganizationService>();
2022-08-29 22:06:55 +02:00
userService.TwoFactorIsEnabledAsync(orgUserDetail)
.Returns(false);
2022-08-29 22:06:55 +02:00
var utcNow = DateTime.UtcNow;
2022-08-29 22:06:55 +02:00
var savingUserId = Guid.NewGuid();
2022-08-29 22:06:55 +02:00
await sutProvider.Sut.SaveAsync(policy, userService, organizationService, savingUserId);
2022-08-29 22:06:55 +02:00
await organizationService.Received()
.DeleteUserAsync(policy.OrganizationId, orgUserDetail.Id, savingUserId);
2022-08-29 22:06:55 +02:00
await sutProvider.GetDependency<IMailService>().Received()
.SendOrganizationUserRemovedForPolicyTwoStepEmailAsync(org.Name, orgUserDetail.Email);
2022-08-29 22:06:55 +02:00
await sutProvider.GetDependency<IEventService>().Received()
.LogPolicyEventAsync(policy, EventType.Policy_Updated);
2022-08-29 22:06:55 +02:00
await sutProvider.GetDependency<IPolicyRepository>().Received()
.UpsertAsync(policy);
2022-08-29 22:06:55 +02:00
Assert.True(policy.CreationDate - utcNow < TimeSpan.FromSeconds(1));
Assert.True(policy.RevisionDate - utcNow < TimeSpan.FromSeconds(1));
}
2022-08-29 22:06:55 +02:00
[Theory, BitAutoData]
public async Task SaveAsync_ExistingPolicy_UpdateSingleOrg(
[PolicyFixtures.Policy(PolicyType.TwoFactorAuthentication)] Policy policy, SutProvider<PolicyService> sutProvider)
{
// If the policy that this is updating isn't enabled then do some work now that the current one is enabled
2022-08-29 22:06:55 +02:00
var org = new Organization
{
2022-08-29 22:06:55 +02:00
Id = policy.OrganizationId,
UsePolicies = true,
Name = "TEST",
};
2022-08-29 22:06:55 +02:00
SetupOrg(sutProvider, policy.OrganizationId, org);
sutProvider.GetDependency<IPolicyRepository>()
.GetByIdAsync(policy.Id)
.Returns(new Policy
2022-08-29 20:53:16 +02:00
{
2022-08-29 22:06:55 +02:00
Id = policy.Id,
Type = PolicyType.SingleOrg,
Enabled = false,
});
2022-08-29 22:06:55 +02:00
var orgUserDetail = new Core.Models.Data.Organizations.OrganizationUsers.OrganizationUserUserDetails
{
Id = Guid.NewGuid(),
Status = OrganizationUserStatusType.Accepted,
Type = OrganizationUserType.User,
// Needs to be different from what is passed in as the savingUserId to Sut.SaveAsync
Email = "test@bitwarden.com",
Name = "TEST",
UserId = Guid.NewGuid(),
};
sutProvider.GetDependency<IOrganizationUserRepository>()
.GetManyDetailsByOrganizationAsync(policy.OrganizationId)
.Returns(new List<Core.Models.Data.Organizations.OrganizationUsers.OrganizationUserUserDetails>
{
orgUserDetail,
});
2022-08-29 22:06:55 +02:00
var userService = Substitute.For<IUserService>();
var organizationService = Substitute.For<IOrganizationService>();
2022-08-29 22:06:55 +02:00
userService.TwoFactorIsEnabledAsync(orgUserDetail)
.Returns(false);
2022-08-29 22:06:55 +02:00
var utcNow = DateTime.UtcNow;
2022-08-29 22:06:55 +02:00
var savingUserId = Guid.NewGuid();
2022-08-29 22:06:55 +02:00
await sutProvider.Sut.SaveAsync(policy, userService, organizationService, savingUserId);
2022-08-29 22:06:55 +02:00
await sutProvider.GetDependency<IEventService>().Received()
.LogPolicyEventAsync(policy, EventType.Policy_Updated);
2022-08-29 22:06:55 +02:00
await sutProvider.GetDependency<IPolicyRepository>().Received()
.UpsertAsync(policy);
2022-08-29 22:06:55 +02:00
Assert.True(policy.CreationDate - utcNow < TimeSpan.FromSeconds(1));
Assert.True(policy.RevisionDate - utcNow < TimeSpan.FromSeconds(1));
}
2022-08-29 22:06:55 +02:00
private static void SetupOrg(SutProvider<PolicyService> sutProvider, Guid organizationId, Organization organization)
{
sutProvider.GetDependency<IOrganizationRepository>()
.GetByIdAsync(organizationId)
.Returns(Task.FromResult(organization));
}
}