Subvault APIs

src/Api/Controllers/FoldersController.cs

@@ -35,7 +35,7 @@ namespace Bit.Api.Controllers
         public async Task<FolderResponseModel> Get(string id)
         {
             var userId = _userService.GetProperUserId(User).Value;
-            var folder = await _cipherRepository.GetByIdAsync(new Guid(id), _userService.GetProperUserId(User).Value);
+            var folder = await _cipherRepository.GetByIdAsync(new Guid(id), userId);
             if(folder == null || folder.Type != Core.Enums.CipherType.Folder)
             {
                 throw new NotFoundException();

src/Api/Controllers/SubvaultsController.cs

@@ -0,0 +1,96 @@
+using System;
+using System.Linq;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Mvc;
+using Bit.Core.Repositories;
+using Microsoft.AspNetCore.Authorization;
+using Bit.Api.Models;
+using Bit.Core.Exceptions;
+using Bit.Core.Services;
+
+namespace Bit.Api.Controllers
+{
+    [Route("subvaults")]
+    [Authorize("Application")]
+    public class SubvaultsController : Controller
+    {
+        private readonly ISubvaultRepository _subvaultRepository;
+        private readonly IUserService _userService;
+
+        public SubvaultsController(
+            ISubvaultRepository subvaultRepository,
+            IUserService userService)
+        {
+            _subvaultRepository = subvaultRepository;
+            _userService = userService;
+        }
+
+        [HttpGet("{id}")]
+        public async Task<SubvaultResponseModel> Get(string id)
+        {
+            var userId = _userService.GetProperUserId(User).Value;
+            var subvault = await _subvaultRepository.GetByIdAdminUserIdAsync(new Guid(id), userId);
+            if(subvault == null)
+            {
+                throw new NotFoundException();
+            }
+
+            return new SubvaultResponseModel(subvault);
+        }
+
+        [HttpGet("")]
+        public async Task<ListResponseModel<SubvaultResponseModel>> Get()
+        {
+            var subvaults = await _subvaultRepository.GetManyByUserIdAsync(_userService.GetProperUserId(User).Value);
+            var responses = subvaults.Select(s => new SubvaultResponseModel(s));
+            return new ListResponseModel<SubvaultResponseModel>(responses);
+        }
+
+        [HttpGet("organization/{organizationId}")]
+        public async Task<ListResponseModel<SubvaultResponseModel>> GetByOrganization(string organizationId)
+        {
+            var subvaults = await _subvaultRepository.GetManyByOrganizationIdAdminUserIdAsync(new Guid(organizationId),
+                _userService.GetProperUserId(User).Value);
+            var responses = subvaults.Select(s => new SubvaultResponseModel(s));
+            return new ListResponseModel<SubvaultResponseModel>(responses);
+        }
+
+        [HttpPost("")]
+        public async Task<SubvaultResponseModel> Post([FromBody]SubvaultCreateRequestModel model)
+        {
+            // TODO: permission check
+            var subvault = model.ToSubvault();
+            await _subvaultRepository.CreateAsync(subvault);
+            return new SubvaultResponseModel(subvault);
+        }
+
+        [HttpPut("{id}")]
+        [HttpPost("{id}")]
+        public async Task<SubvaultResponseModel> Put(string id, [FromBody]SubvaultUpdateRequestModel model)
+        {
+            var subvault = await _subvaultRepository.GetByIdAdminUserIdAsync(new Guid(id),
+                _userService.GetProperUserId(User).Value);
+            if(subvault == null)
+            {
+                throw new NotFoundException();
+            }
+
+            await _subvaultRepository.ReplaceAsync(model.ToSubvault(subvault));
+            return new SubvaultResponseModel(subvault);
+        }
+
+        [HttpDelete("{id}")]
+        [HttpPost("{id}/delete")]
+        public async Task Delete(string id)
+        {
+            var subvault = await _subvaultRepository.GetByIdAdminUserIdAsync(new Guid(id),
+                _userService.GetProperUserId(User).Value);
+            if(subvault == null)
+            {
+                throw new NotFoundException();
+            }
+
+            await _subvaultRepository.DeleteAsync(subvault);
+        }
+    }
+}

src/Api/Models/Request/SubvaultRequestModel.cs

@@ -0,0 +1,35 @@
+using System;
+using System.ComponentModel.DataAnnotations;
+using Bit.Api.Utilities;
+using Bit.Core.Domains;
+using Newtonsoft.Json;
+
+namespace Bit.Api.Models
+{
+    public class SubvaultCreateRequestModel : SubvaultUpdateRequestModel
+    {
+        public string OrganizationId { get; set; }
+
+        public Subvault ToSubvault()
+        {
+            return ToSubvault(new Subvault
+            {
+                OrganizationId = new Guid(OrganizationId)
+            });
+        }
+    }
+
+    public class SubvaultUpdateRequestModel
+    {
+        [Required]
+        [EncryptedString]
+        [StringLength(300)]
+        public string Name { get; set; }
+
+        public Subvault ToSubvault(Subvault existingSubvault)
+        {
+            existingSubvault.Name = Name;
+            return existingSubvault;
+        }
+    }
+}

src/Api/Models/Response/SubvaultResponseModel.cs

@@ -0,0 +1,25 @@
+using System;
+using Bit.Core.Domains;
+
+namespace Bit.Api.Models
+{
+    public class SubvaultResponseModel : ResponseModel
+    {
+        public SubvaultResponseModel(Subvault subvault)
+            : base("subvault")
+        {
+            if(subvault == null)
+            {
+                throw new ArgumentNullException(nameof(subvault));
+            }
+
+            Id = subvault.Id.ToString();
+            OrganizationId = subvault.OrganizationId.ToString();
+            Name = subvault.Name;
+        }
+
+        public string Id { get; set; }
+        public string OrganizationId { get; set; }
+        public string Name { get; set; }
+    }
+}

src/Api/Startup.cs

@@ -78,6 +78,8 @@ namespace Bit.Api
             services.AddSingleton<IGrantRepository, SqlServerRepos.GrantRepository>();
             services.AddSingleton<IOrganizationRepository, SqlServerRepos.OrganizationRepository>();
             services.AddSingleton<IOrganizationUserRepository, SqlServerRepos.OrganizationUserRepository>();
+            services.AddSingleton<ISubvaultRepository, SqlServerRepos.SubvaultRepository>();
+            services.AddSingleton<ISubvaultUserRepository, SqlServerRepos.SubvaultUserRepository>();
 
             // Context
             services.AddScoped<CurrentContext>();

src/Core/Domains/Subvault.cs

@@ -0,0 +1,19 @@
+using System;
+using Bit.Core.Utilities;
+
+namespace Bit.Core.Domains
+{
+    public class Subvault : IDataObject<Guid>
+    {
+        public Guid Id { get; set; }
+        public Guid OrganizationId { get; set; }
+        public string Name { get; set; }
+        public DateTime CreationDate { get; internal set; } = DateTime.UtcNow;
+        public DateTime RevisionDate { get; internal set; } = DateTime.UtcNow;
+
+        public void SetNewId()
+        {
+            Id = CoreHelpers.GenerateComb();
+        }
+    }
+}

src/Core/Domains/SubvaultUser.cs

@@ -0,0 +1,21 @@
+using System;
+using Bit.Core.Utilities;
+
+namespace Bit.Core.Domains
+{
+    public class SubvaultUser : IDataObject<Guid>
+    {
+        public Guid Id { get; set; }
+        public Guid SubvaultId { get; set; }
+        public Guid UserId { get; set; }
+        public bool Admin { get; set; }
+        public bool ReadOnly { get; set; }
+        public DateTime CreationDate { get; internal set; } = DateTime.UtcNow;
+        public DateTime RevisionDate { get; internal set; } = DateTime.UtcNow;
+
+        public void SetNewId()
+        {
+            Id = CoreHelpers.GenerateComb();
+        }
+    }
+}

src/Core/Repositories/ISubvaultRepository.cs

@@ -0,0 +1,15 @@
+using System;
+using System.Threading.Tasks;
+using Bit.Core.Domains;
+using System.Collections.Generic;
+
+namespace Bit.Core.Repositories
+{
+    public interface ISubvaultRepository : IRepository<Subvault, Guid>
+    {
+        Task<Subvault> GetByIdAdminUserIdAsync(Guid id, Guid userId);
+        Task<ICollection<Subvault>> GetManyByOrganizationIdAdminUserIdAsync(Guid organizationId, Guid userId);
+        Task<ICollection<Subvault>> GetManyByUserIdAsync(Guid userId);
+
+    }
+}

src/Core/Repositories/ISubvaultUserRepository.cs

@@ -0,0 +1,11 @@
+using System;
+using System.Threading.Tasks;
+using Bit.Core.Domains;
+
+namespace Bit.Core.Repositories
+{
+    public interface ISubvaultUserRepository : IRepository<SubvaultUser, Guid>
+    {
+        
+    }
+}

src/Core/Repositories/SqlServer/SubvaultRepository.cs

@@ -0,0 +1,61 @@
+using System;
+using Bit.Core.Domains;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using System.Data.SqlClient;
+using System.Data;
+using Dapper;
+using System.Linq;
+
+namespace Bit.Core.Repositories.SqlServer
+{
+    public class SubvaultRepository : Repository<Subvault, Guid>, ISubvaultRepository
+    {
+        public SubvaultRepository(GlobalSettings globalSettings)
+            : this(globalSettings.SqlServer.ConnectionString)
+        { }
+
+        public SubvaultRepository(string connectionString)
+            : base(connectionString)
+        { }
+
+        public async Task<Subvault> GetByIdAdminUserIdAsync(Guid id, Guid userId)
+        {
+            using(var connection = new SqlConnection(ConnectionString))
+            {
+                var results = await connection.QueryAsync<Subvault>(
+                    $"[{Schema}].[{Table}_ReadByIdAdminUserId]",
+                    new { Id = id, UserId = userId },
+                    commandType: CommandType.StoredProcedure);
+
+                return results.FirstOrDefault();
+            }
+        }
+
+        public async Task<ICollection<Subvault>> GetManyByOrganizationIdAdminUserIdAsync(Guid organizationId, Guid userId)
+        {
+            using(var connection = new SqlConnection(ConnectionString))
+            {
+                var results = await connection.QueryAsync<Subvault>(
+                    $"[{Schema}].[{Table}_ReadByOrganizationIdAdminUserId]",
+                    new { OrganizationId = organizationId, UserId = userId },
+                    commandType: CommandType.StoredProcedure);
+
+                return results.ToList();
+            }
+        }
+
+        public async Task<ICollection<Subvault>> GetManyByUserIdAsync(Guid userId)
+        {
+            using(var connection = new SqlConnection(ConnectionString))
+            {
+                var results = await connection.QueryAsync<Subvault>(
+                    $"[{Schema}].[{Table}_ReadByUserId]",
+                    new { UserId = userId },
+                    commandType: CommandType.StoredProcedure);
+
+                return results.ToList();
+            }
+        }
+    }
+}

src/Core/Repositories/SqlServer/SubvaultUserRepository.cs

@@ -0,0 +1,16 @@
+using System;
+using Bit.Core.Domains;
+
+namespace Bit.Core.Repositories.SqlServer
+{
+    public class SubvaultUserRepository : Repository<SubvaultUser, Guid>, ISubvaultUserRepository
+    {
+        public SubvaultUserRepository(GlobalSettings globalSettings)
+            : this(globalSettings.SqlServer.ConnectionString)
+        { }
+
+        public SubvaultUserRepository(string connectionString)
+            : base(connectionString)
+        { }
+    }
+}

src/Sql/Sql.sqlproj

@@ -148,5 +148,9 @@
     <Build Include="dbo\Stored Procedures\User_ReadPublicKeyById.sql" />
     <Build Include="dbo\Stored Procedures\OrganizationUserOrganizationDetails_ReadByUserId.sql" />
     <Build Include="dbo\Views\OrganizationUserOrganizationDetailsView.sql" />
+    <Build Include="dbo\Stored Procedures\Subvault_ReadByIdAdminUserId.sql" />
+    <Build Include="dbo\Views\SubvaultView.sql" />
+    <Build Include="dbo\Stored Procedures\Subvault_ReadByUserId.sql" />
+    <Build Include="dbo\Stored Procedures\Subvault_ReadByOrganizationIdAdminUserId.sql" />
   </ItemGroup>
 </Project>

src/Sql/dbo/Stored Procedures/Subvault_ReadByIdAdminUserId.sql

@@ -0,0 +1,18 @@
+CREATE PROCEDURE [dbo].[Subvault_ReadByIdAdminUserId]
+    @Id UNIQUEIDENTIFIER,
+    @UserId UNIQUEIDENTIFIER
+AS
+BEGIN
+    SET NOCOUNT ON
+
+    SELECT
+        S.*
+    FROM
+        [dbo].[SubvaultView] S
+    INNER JOIN
+        [OrganizationUser] OU ON OU.[OrganizationId] = S.[OrganizationId]
+    WHERE
+        S.[Id] = @Id
+        AND OU.[UserId] = @UserId
+        AND OU.[Type] <= 1 -- Owner and admin
+END

src/Sql/dbo/Stored Procedures/Subvault_ReadByOrganizationIdAdminUserId.sql

@@ -0,0 +1,18 @@
+CREATE PROCEDURE [dbo].[Subvault_ReadByOrganizationIdAdminUserId]
+    @OrganizationId UNIQUEIDENTIFIER,
+    @UserId UNIQUEIDENTIFIER
+AS
+BEGIN
+    SET NOCOUNT ON
+
+    SELECT
+        S.*
+    FROM
+        [dbo].[SubvaultView] S
+    INNER JOIN
+        [OrganizationUser] OU ON OU.[OrganizationId] = S.[OrganizationId]
+    WHERE
+        S.[OrganizationId] = @OrganizationId
+        AND OU.[UserId] = @UserId
+        AND OU.[Type] <= 1 -- Owner and admin
+END

src/Sql/dbo/Stored Procedures/Subvault_ReadByUserId.sql

@@ -0,0 +1,15 @@
+CREATE PROCEDURE [dbo].[Subvault_ReadByUserId]
+    @UserId UNIQUEIDENTIFIER
+AS
+BEGIN
+    SET NOCOUNT ON
+
+    SELECT
+        S.*
+    FROM
+        [dbo].[SubvaultView] S
+    INNER JOIN
+        [SubvaultUser] SU ON SU.[SubvaultId] = S.[Id]
+    WHERE
+        SU.[UserId] = @UserId
+END

src/Sql/dbo/Views/SubvaultView.sql

@@ -0,0 +1,6 @@
+CREATE VIEW [dbo].[SubvaultView]
+AS
+SELECT
+    *
+FROM
+    [dbo].[Subvault]