* Expanded Teams and Enterprise plan with provider seat data
* Updated provider setup process with new plan information
* Updated provider subscription retrieval and update with new plan information
* Updated client invoice report with new plan information
* Fixed tests
* Fix broken test
* Add BaseProviderController, update some endpoints to ServiceUser permissions
* Prevent service user from scaling provider seats above seat minimum
* Expand invoice response to include DueDate
* PM-3833 - API - AccountsController.cs && AccountsController.cs - remove prelogin and register endpoints.
* PM-3833 - Move Request and Response models that were used for Prelogin and PostRegister from API to Identity.
* PM-3833 - FIX LINT
* PM-3833 - Fix issues after merge conflict fixes.
* PM-3833 - Another test fix
* Renamed ProductType to ProductTierType
* Renamed Product properties to ProductTier
* Moved ProductTierType to Bit.Core.Billing.Enums namespace from Bit.Core.Enums
* Moved PlanType enum to Bit.Core.Billing.Enums
* Moved StaticStore to Bit.Core.Billing.Models.StaticStore namespace
* Added ProductType enum
* dotnet format
* Add authz handling for secret access policy reads
* Add the ability to fetch secret access polices from the repository
* refactor response models
* Add new endpoint
* inital changes
* add provider GatewayType migrations
* db provider migrations
* removed duo migrations added v2 metadata to duo response
* removed helper scripts
* remove signature from org duo
* added backward compatibility for Duo v2
* added tests for duo request + response models
* refactors to TwoFactorController
* updated test methods to be compartmentalized by usage
* fix organization add duo
* Assert.Empty() fix for validator
* Removed prorationDate as it wasn't used, and wasn't needed
* Fixed logic to detect if a subscription was sponsored
* Moved OrganizationSponsorshipsController.cs to Billing folder
* Refactored GET provider subscription
Refactoring this endpoint and its associated tests in preparation for the addition of more endpoints that share similar patterns
* Replaced StripePaymentService call in AccountsController, OrganizationsController
This was made in error during a previous PR. Since this is not related to Consolidated Billing, we want to try not to include it in these changes.
* Removing GetPaymentInformation call from ProviderBillingService
This method is a good call for the SubscriberService as we'll want to extend the functionality to all subscriber types
* Refactored GetTaxInformation to use Billing owned DTO
* Add UpdateTaxInformation to SubscriberService
* Added GetTaxInformation and UpdateTaxInformation endpoints to ProviderBillingController
* Added controller to manage creation of Stripe SetupIntents
With the deprecation of the Sources API, we need to move the bank account creation process to using SetupIntents. This controller brings both the creation of "card" and "us_bank_account" SetupIntents
under billing management.
* Added UpdatePaymentMethod method to SubscriberService
This method utilizes the SetupIntents created by the StripeController from the previous commit when a customer adds a card or us_bank_account payment method (Stripe). We need to cache the most recent SetupIntent for the subscriber so that we know which PaymentMethod is their most recent even when it hasn't been confirmed yet.
* Refactored GetPaymentMethod to use billing owned DTO and check setup intents
* Added GetPaymentMethod and UpdatePaymentMethod endpoints to ProviderBillingController
* Re-added GetPaymentInformation endpoint to consolidate API calls on the payment method page
* Added VerifyBankAccount endpoint to ProviderBillingController in order to finalize bank account payment methods
* Updated BitPayInvoiceRequestModel to support providers
* run dotnet format
* Conner's feedback
* Run dotnet format'
* Add check to verify the vault state for rotation is not obviously desynced (empty)
* Add unit test for key rotation guardrail
* Move de-synced vault detection to validators
* Add tests
* Define a model for updating many auth requests
In order to facilitate a command method that can update many auth
requests at one time a new model must be defined that accepts valid
input for the command's needs. To achieve this a new file has been
created at
`Core/AdminConsole/OrganizationAuth/Models/OrganizationAuthRequestUpdateCommandModel.cs`
that contains a class of the same name. It's properties match those that
need to come from any calling API request models to fulfill the request.
* Declare a new command interface method
Calling API functions of the `UpdateOrganizationAuthRequestCommand` need
a function that can accept many auth request response objects and
process them as approved or denied. To achieve this a new function has
been added to `IUpdateOrganizationAuthRequestCommand` called
`UpdateManyAsync()` that accepts an
`IEnumberable<OrganizationAuthRequest>` and returns a `Task`.
Implementations of this interface method will be used to bulk process
auth requests as approved or denied.
* Stub out method implementation for unit testing
To facilitate a bulk device login request approval workflow in the admin
console `UpdateOrganizationAuthRequestCommand` needs to be updated to
include an `UpdateMany()` method. It should accept a list of
`OrganizationAuthRequestUpdateCommandModel` objects, perform some simple
data validation checks, and then pass those along to
`AuthRequestRepository` for updating in the database.
This commit stubs out this method for the purpose of writing unit tests.
At this stage the method throws a `NotImplementedException()`. It will
be expand after writing assertions.
* Inject `IAuthRequestRepository` into `UpdateOrganizationAuthCommand`
The updates to `UpdateOrganizationAuthRequestCommand` require a new
direct dependency on `IAuthRequestRepository`. This commit simply
registers this dependency in the `UpdateOrganizationAuthRequest`
constructor for use in unit tests and the `UpdateManyAsync()`
implementation.
* Write tests
* Rename `UpdateManyAsync()` to `UpdateAsync`
* Drop the `CommandModel` suffix
* Invert business logic update filters
* Rework everything to be more model-centric
* Bulk send push notifications
* Write tests that validate the command as a whole
* Fix a test that I broke by mistake
* Swap to using await instead of chained methods for processing
* Seperate a function arguement into a variable declaration
* Ungeneric-ify the processor
* Adjust ternary formatting
* Adjust naming of methods regarding logging organization events
* Throw an exception if Process is called with no auth request loaded
* Rename `_updates` -> `_update`
* Rename email methods
* Stop returning `this`
* Allow callbacks to be null
* Make some assertions about the state of a processed auth request
* Be more terse about arguements in happy path test
* Remove unneeded null check
* Expose an endpoint for bulk processing of organization auth requests (#4077)
---------
Co-authored-by: Thomas Rittson <31796059+eliykat@users.noreply.github.com>
* Add new stored procedure for reading reset password details for multiple organization user IDs
* Add method IOrganizationUserRepository.GetManyResetPasswordDetailsByOrganizationUserAsync
* Add new API endpoint for getting reset password details for multiple organization users
* Add unit tests for bulk OrganizationUsersController.GetResetPasswordDetails
* Add alias to sql query result column
* Add constructor for automatic mapping
* Fix http method type for endpoint
* dotnet format
* Simplify the constructor in the OrganizationUserResetPasswordDetails
* Refactor stored procedure and repository method names for retrieving account recovery details
* Add integration tests for GetManyAccountRecoveryDetailsByOrganizationUserAsync
* Lock endpoint behind BulkDeviceApproval feature flag
* Update feature flag key value
* Replace SubscriberQueries with SubscriberService
* Replace OrganizationBillingQueries with OrganizationBillingService
* Replace ProviderBillingQueries with ProviderBillingService, move to Commercial
* Replace AssignSeatsToClientOrganizationCommand with ProviderBillingService, move to commercial
* Replace ScaleSeatsCommand with ProviderBillingService and move to Commercial
* Replace CancelSubscriptionCommand with SubscriberService
* Replace CreateCustomerCommand with ProviderBillingService and move to Commercial
* Replace StartSubscriptionCommand with ProviderBillingService and moved to Commercial
* Replaced RemovePaymentMethodCommand with SubscriberService
* Formatting
* Used dotnet format this time
* Changing ProviderBillingService to scoped
* Found circular dependency'
* One more time with feeling
* Formatting
* Fix error in remove org from provider
* Missed test fix in conflit
* [AC-1937] Server: Implement endpoint to retrieve provider payment information (#4107)
* Move the gettax and paymentmethod from stripepayment class
Signed-off-by: Cy Okeke <cokeke@bitwarden.com>
* Add the method to retrieve the tax and payment details
Signed-off-by: Cy Okeke <cokeke@bitwarden.com>
* Add unit tests for the paymentInformation method
Signed-off-by: Cy Okeke <cokeke@bitwarden.com>
* Add the endpoint to retrieve paymentinformation
Signed-off-by: Cy Okeke <cokeke@bitwarden.com>
* Add unit tests to the SubscriberService
Signed-off-by: Cy Okeke <cokeke@bitwarden.com>
* Remove the getTaxInfoAsync update reference
Signed-off-by: Cy Okeke <cokeke@bitwarden.com>
---------
Signed-off-by: Cy Okeke <cokeke@bitwarden.com>
---------
Signed-off-by: Cy Okeke <cokeke@bitwarden.com>
Co-authored-by: cyprain-okeke <108260115+cyprain-okeke@users.noreply.github.com>
* For SM Trial orgs, now scaling PM seat count with SM seat count adjustments
* Split Billing related organization endpoints into billing owned controller
* Updated billing organizations controller to use a primary constructor to reduce boilerplate
* Fixed error where ID couldn't be mapped to subscription endpoint guid param
* Updated billing OrganizationController endpoints to not manually create the GUID from the string ID
* Banished magic string back to the pit from whence it came
* Resolved errors in unit tests
* [AC-2274] Introduce CanEditAnyCiphersAsAdminAsync helper to replace EditAnyCollection usage
* [AC-2274] Add unit tests for CanEditAnyCiphersAsAdmin helper
* [AC-2274] Add Jira ticket
* [AC-1707] Add feature flag
* [AC-1707] Update CanEditAnyCiphersAsAdmin to fail for providers when the feature flag is enabled
* [AC-2274] Undo change to purge endpoint
* [AC-2274] Update admin checks to account for unassigned ciphers
* [AC-1707] Fix provider auth checks after merge with main
* [AC-1707] Fix tests after merge
* [AC-1707] Adjust CanEditCipherAsAdmin method to properly account for admin user types
- Fix associated unit tests
* [AC-1707] Formatting
* Add new models
* Update repositories
* Add new authz handler
* Add new query
* Add new command
* Add authz, command, and query to DI
* Add new endpoint to controller
* Add query unit tests
* Add api unit tests
* Add api integration tests
* Add the ability to get multi projects access
* Add access policy helper + tests
* Add new data/request models
* Add access policy operations to repo
* Add authz handler for new operations
* Add new controller endpoints
* add updating service account revision
* Fix issue where ManageUsers custom permission could not
grant access to collections
* Split ModifyAccess operation to ModifyUserAccess and
ModifyGroupAccess to reflect more granular operations
* update OrganizationUsersController PUT and POST
* enforces new collection access checks when updating members
* refactor BulkCollectionAuthorizationHandler to avoid repeated db calls
* [PM-3176] Extract IOrganizationService.SaveUserAsync to a command
* [PM-3176] Enabled nullable on command
* [PM-3176] Removed check that was not working
* Add new endpoint for creating client organizations in consolidated billing
* Create empty org and then assign seats for code re-use
* Fixes made from debugging client side
* few more small fixes
* Vincent's feedback
* Restrict admins from adding themselves to groups
Updated OrganizationUsersController only, GroupsController to be updated
separately
* Delete unused api method
* [AC-2154] Logging organization data before migrating for flexible collections
* [AC-2154] Refactored logging command to perform the data migration
* [AC-2154] Moved validation inside the command
* [AC-2154] PR feedback
* [AC-2154] Changed logging level to warning
* [AC-2154] Fixed unit test
* [AC-2154] Removed logging unnecessary data
* [AC-2154] Removed primary constructor
* [AC-2154] Added comments
* Added offboarding survey response to cancellation when FF is on.
* Removed service methods to prevent unnecessary upstream registrations
* Forgot to actually remove the injected command in the services
* Rui's feedback
* Add missing summary
* Missed [FromBody]
* [AC-2068] Allow any member of an org to read all users for that organization with flexible collections
* [AC-2068] Allow any member of an org to read all groups for that organization with flexible collections
* [AC-2068] Formatting
* [Ac-1890] Return CollectionDetailsResponseModel for collection PUT/POST endpoints when a userId is available in the current context
* [AC-1890] Fix broken tests
* [AC-1890] Update to use Organization FC column
* Update optionality to use org.FlexibleCollections
Also break old feature flag key to ensure it's never enabled
* Add logic to set defaults for collection management setting
* Update optionality logic to use org property
* Add comments
* Add helper method for getting individual orgAbility
* Fix validate user update permissions interface
* Fix tests
* dotnet format
* Fix more tests
* Simplify self-hosted update logic
* Fix mapping
* Use new getOrganizationAbility method
* Refactor invite and save orgUser methods
Pass in whole organization object instead of using OrganizationAbility
* fix CipherService tests
* dotnet format
* Remove manager check to simplify this set of changes
* Misc cleanup before review
* Fix undefined variable
* Refactor bulk-access endpoint to avoid early repo call
* Restore manager check
* Add tests for UpdateOrganizationLicenseCommand
* Add nullable regions
* Delete unused dependency
* dotnet format
* Fix test
* Add reset password validator with tests
* add organization user rotation methods to repository
- move organization user TVP helper to admin console ownership
* rename account recovery to reset password
* formatting
* move registration of RotateUserKeyCommand to Core and make internal
* add admin console ValidatorServiceCollectionExtensions
* [PM-4619] feat: scaffold new create options command
* [PM-4169] feat: implement credential create options command
* [PM-4619] feat: create command for credential creation
* [PM-4619] feat: create assertion options command
* [PM-4619] chore: clean-up unused argument
* [PM-4619] feat: implement assertion command
* [PM-4619] feat: migrate to commands
* [PM-4619] fix: lint
* [PM-4169] fix: use constant
* [PM-4619] fix: lint
I have no idea what this commit acutally changes, but the file seems to have some character encoding issues. This fix was generated by `dotnet format`
* [AC-1117] Add manage permission (#3126)
* Update sql files to add Manage permission
* Add migration script
* Rename collection manage migration file to remove duplicate migration date
* Migrations
* Add manage to models
* Add manage to repository
* Add constraint to Manage columns
* Migration lint fixes
* Add manage to OrganizationUserUserDetails_ReadWithCollectionsById
* Add missing manage fields
* Add 'Manage' to UserCollectionDetails
* Use CREATE OR ALTER where possible
* [AC-1374] Limit collection creation/deletion to Owner/Admin (#3145)
* feat: update org table with new column, write migration, refs AC-1374
* feat: update views with new column, refs AC-1374
* feat: Alter sprocs (org create/update) to include new column, refs AC-1374
* feat: update entity/data/request/response models to handle new column, refs AC-1374
* feat: update necessary Provider related views during migration, refs AC-1374
* fix: update org create to default new column to false, refs AC-1374
* feat: added new API/request model for collection management and removed property from update request model, refs AC-1374
* fix: renamed migration script to be after secrets manage beta column changes, refs AC-1374
* fix: dotnet format, refs AC-1374
* feat: add ef migrations to reflect mssql changes, refs AC-1374
* fix: dotnet format, refs AC-1374
* feat: update API signature to accept Guid and explain Cd verbiage, refs AC-1374
* fix: merge conflict resolution
* [AC-1174] CollectionUser and CollectionGroup authorization handlers (#3194)
* [AC-1174] Introduce BulkAuthorizationHandler.cs
* [AC-1174] Introduce CollectionUserAuthorizationHandler
* [AC-1174] Add CreateForNewCollection CollectionUser requirement
* [AC-1174] Add some more details to CollectionCustomization
* [AC-1174] Formatting
* [AC-1174] Add CollectionGroupOperation.cs
* [AC-1174] Introduce CollectionGroupAuthorizationHandler.cs
* [AC-1174] Cleanup CollectionFixture customization
Implement and use re-usable extension method to support seeded Guids
* [AC-1174] Introduce WithValueFromList AutoFixtureExtensions
Modify CollectionCustomization to use multiple organization Ids for auto generated test data
* [AC-1174] Simplify CollectionUserAuthorizationHandler.cs
Modify the authorization handler to only perform authorization logic. Validation logic will need to be handled by any calling commands/controllers instead.
* [AC-1174] Introduce shared CollectionAccessAuthorizationHandlerBase
A shared base authorization handler was created for both CollectionUser and CollectionGroup resources, as they share the same underlying management authorization logic.
* [AC-1174] Update CollectionUserAuthorizationHandler and CollectionGroupAuthorizationHandler to use the new CollectionAccessAuthorizationHandlerBase class
* [AC-1174] Formatting
* [AC-1174] Cleanup typo and redundant ToList() call
* [AC-1174] Add check for provider users
* [AC-1174] Reduce nested loops
* [AC-1174] Introduce ICollectionAccess.cs
* [AC-1174] Remove individual CollectionGroup and CollectionUser auth handlers and use base class instead
* [AC-1174] Tweak unit test to fail minimally
* [AC-1174] Reorganize authorization handlers in Core project
* [AC-1174] Introduce new AddCoreAuthorizationHandlers() extension method
* [AC-1174] Move CollectionAccessAuthorizationHandler into Api project
* [AC-1174] Move CollectionFixture to Vault folder
* [AC-1174] Rename operation to CreateUpdateDelete
* [AC-1174] Require single organization for collection access authorization handler
- Add requirement that all target collections must belong to the same organization
- Simplify logic related to multiple organizations
- Update tests and helpers
- Use ToHashSet to improve lookup time
* [AC-1174] Fix null reference exception
* [AC-1174] Throw bad request exception when collections belong to different organizations
* [AC-1174] Switch to CollectionAuthorizationHandler instead of CollectionAccessAuthorizationHandler to reduce complexity
* Fix improper merge conflict resolution
* fix: add permission check for collection management api, refs AC-1647 (#3252)
* [AC-1125] Enforce org setting for creating/deleting collections (#3241)
* [AC-1117] Add manage permission (#3126)
* Update sql files to add Manage permission
* Add migration script
* Rename collection manage migration file to remove duplicate migration date
* Migrations
* Add manage to models
* Add manage to repository
* Add constraint to Manage columns
* Migration lint fixes
* Add manage to OrganizationUserUserDetails_ReadWithCollectionsById
* Add missing manage fields
* Add 'Manage' to UserCollectionDetails
* Use CREATE OR ALTER where possible
* [AC-1374] Limit collection creation/deletion to Owner/Admin (#3145)
* feat: update org table with new column, write migration, refs AC-1374
* feat: update views with new column, refs AC-1374
* feat: Alter sprocs (org create/update) to include new column, refs AC-1374
* feat: update entity/data/request/response models to handle new column, refs AC-1374
* feat: update necessary Provider related views during migration, refs AC-1374
* fix: update org create to default new column to false, refs AC-1374
* feat: added new API/request model for collection management and removed property from update request model, refs AC-1374
* fix: renamed migration script to be after secrets manage beta column changes, refs AC-1374
* fix: dotnet format, refs AC-1374
* feat: add ef migrations to reflect mssql changes, refs AC-1374
* fix: dotnet format, refs AC-1374
* feat: update API signature to accept Guid and explain Cd verbiage, refs AC-1374
* feat: created collection auth handler/operations, added LimitCollectionCdOwnerAdmin to CurrentContentOrganization, refs AC-1125
* feat: create vault service collection extensions and register with base services, refs AC-1125
* feat: deprecated CurrentContext.CreateNewCollections, refs AC-1125
* feat: deprecate DeleteAnyCollection for single resource usages, refs AC-1125
* feat: move service registration to api, update references, refs AC-1125
* feat: add bulk delete authorization handler, refs AC-1125
* feat: always assign user and give manage access on create, refs AC-1125
* fix: updated CurrentContextOrganization type, refs AC-1125
* feat: combined existing collection authorization handlers/operations, refs AC-1125
* fix: OrganizationServiceTests -> CurrentContentOrganization typo, refs AC-1125
* fix: format, refs AC-1125
* fix: update collection controller tests, refs AC-1125
* fix: dotnet format, refs AC-1125
* feat: removed extra BulkAuthorizationHandler, refs AC-1125
* fix: dotnet format, refs AC-1125
* fix: change string to guid for org id, update bulk delete request model, refs AC-1125
* fix: remove delete many collection check, refs AC-1125
* fix: clean up collection auth handler, refs AC-1125
* fix: format fix for CollectionOperations, refs AC-1125
* fix: removed unnecessary owner check, add org null check to custom permission validation, refs AC-1125
* fix: remove unused methods in CurrentContext, refs AC-1125
* fix: removed obsolete test, fixed failling delete many test, refs AC-1125
* fix: CollectionAuthorizationHandlerTests fixes, refs AC-1125
* fix: OrganizationServiceTests fix broken test by mocking GetOrganization, refs AC-1125
* fix: CollectionAuthorizationHandler - remove unused repository, refs AC-1125
* feat: moved UserId null check to common method, refs AC-1125
* fix: updated auth handler tests to remove dependency on requirement for common code checks, refs AC-1125
* feat: updated conditionals/comments for create/delete methods within colleciton auth handler, refs AC-1125
* feat: added create/delete collection auth handler success methods, refs AC-1125
* fix: new up permissions to prevent excessive null checks, refs AC-1125
* fix: remove old reference to CreateNewCollections, refs AC-1125
* fix: typo within ViewAssignedCollections method, refs AC-1125
---------
Co-authored-by: Robyn MacCallum <robyntmaccallum@gmail.com>
* refactor: remove organizationId from CollectionBulkDeleteRequestModel, refs AC-1649 (#3282)
* [AC-1174] Bulk Collection Management (#3229)
* [AC-1174] Update SelectionReadOnlyRequestModel to use Guid for Id property
* [AC-1174] Introduce initial bulk-access collection endpoint
* [AC-1174] Introduce BulkAddCollectionAccessCommand and validation logic/tests
* [AC-1174] Add CreateOrUpdateAccessMany method to CollectionRepository
* [AC-1174] Add event logs for bulk add collection access command
* [AC-1174] Add User_BumpAccountRevisionDateByCollectionIds and database migration script
* [AC-1174] Implement EF repository method
* [AC-1174] Improve null checks
* [AC-1174] Remove unnecessary BulkCollectionAccessRequestModel helpers
* [AC-1174] Add unit tests for new controller endpoint
* [AC-1174] Fix formatting
* [AC-1174] Remove comment
* [AC-1174] Remove redundant organizationId parameter
* [AC-1174] Ensure user and group Ids are distinct
* [AC-1174] Cleanup tests based on PR feedback
* [AC-1174] Formatting
* [AC-1174] Update CollectionGroup alias in the sproc
* [AC-1174] Add some additional comments to SQL sproc
* [AC-1174] Add comment explaining additional SaveChangesAsync call
---------
Co-authored-by: Thomas Rittson <trittson@bitwarden.com>
* [AC-1646] Rename LimitCollectionCdOwnerAdmin column (#3300)
* Rename LimitCollectionCdOwnerAdmin -> LimitCollectionCreationDeletion
* Rename and bump migration script
* [AC-1666] Removed EditAnyCollection from Create/Delete permission checks (#3301)
* fix: remove EditAnyCollection from Create/Delete permission check, refs AC-1666
* fix: updated comment, refs AC-1666
* Add feature flags constants and flag new route
* Update feature flag keys
* Create LegacyCollectionsAuthorizationHandler and start to re-implement old logic
* [AC-1669] Bug - Remove obsolete assignUserId from CollectionService.SaveAsync(...) (#3312)
* fix: remove AssignUserId from CollectionService.SaveAsync, refs AC-1669
* fix: add manage access conditional before creating collection, refs AC-1669
* fix: move access logic for create/update, fix all tests, refs AC-1669
* fix: add CollectionAccessSelection fixture, update tests, update bad reqeuest message, refs AC-1669
* fix: format, refs AC-1669
* fix: update null params with specific arg.is null checks, refs Ac-1669
* fix: update attribute class name, refs AC-1669
* Revert "Create LegacyCollectionsAuthorizationHandler and start to re-implement old logic"
This reverts commit fbb19cdadd.
* Restore old logic behind flags
* Add missing flags
* Fix logic, add comment
* Fix tests
* Add EnableFeatureFlag extension method for tests
* Restore legacy tests
* Add FeatureServiceFixtures to set feature flags in test
* Remove unused method
* Fix formatting
* Set feature flag to ON for auth handler tests
* Use fixture instead of calling nsubstitute directly
* Change FlexibleCollectionsIsEnabled method to property
Co-authored-by: Rui Tomé <108268980+r-tome@users.noreply.github.com>
* Finish changing to property
* [AC-1139] Marked as obsolete the methods EditAssignedCollections, DeleteAssignedCollections and ViewAssignedCollections on ICurrentContext
* [AC-1139] Disabled the ability to set the custom permissions 'Delete/Edit Assigned Collections' if flexible collections feature flag is enabled
* [AC-1713] [Flexible collections] Add feature flags to server (#3334)
* Add feature flags for FlexibleCollections and BulkCollectionAccess
* Flag new routes and behaviour
---------
Co-authored-by: Rui Tomé <108268980+r-tome@users.noreply.github.com>
* [AC-1748] Updated CurrentContext EditAssignedCollections, DeleteAssignedCollections, ViewAssignedCollections to check for flexible collections feature flag
* [AC-1748] Created GroupAuthorizationHandler and modified GroupsController.Get to use it if flexible collections feature flag is enabled
* [AC-1748] Created OrganizationUserAuthorizationHandler and modified OrganizationUsersController.Get to use that if flexible collections feature flag is enabled
* [AC-1748] Reverted changes on OrganizationService
* [AC-1748] Removed GroupAuthorizationHandler
* [AC-1748] Set resource as null when reading OrganizationUserUserDetailsResponseModel list
* [AC-1139] Updated CollectionsController GetManyWithDetails and Get to check for flexible collections flag
* [AC-1139] Modified CollectionsController.Get to check access before getting collections
* [AC-1139] Updated CollectionsController to use CollectionAuthorizationHandler in all endpoints if flag is enabled
* [AC-1139] Lining up collection access data with Manage = true if feature flag is off
* Add joint codeownership for auth handlers (#3346)
* [AC-1139] Separated flexible collections logic from old logic in CollectionsController; Refactored CollectionAuthorizationHandler
* [AC-1139] Fixed formatting on OrganizationUsersController; renamed OrganizationUserOperations.Read to ReadAll
* [AC-1748] Fixed logic to set manage = true for collections if user has EditAssignedCollection permission
* [AC-1717] Update default values for LimitCollectionCreationDeletion (#3365)
* Change default value in organization create sproc to 1
* Drop old column name still present in some QA instances
* Set LimitCollectionCreationDeletion value in code based on feature flag
* Fix: add missing namespace after merging in master
* Fix: add missing namespace after merging in master
* [AC-1683] Fix DB migrations for new Manage permission (#3307)
* [AC-1683] Update migration script and introduce V2 procedures and types
* [AC-1683] Update repository calls to use new V2 procedures / types
* [AC-1684] Update bulk add collection migration script to use new V2 type
* [AC-1683] Undo Manage changes to more original procedures
* [AC-1683] Restore whitespace changes
* [AC-1683] Clarify comments regarding explicit column lists
* [AC-1683] Update migration script dates
* [AC-1683] Split the migration script for readability
* [AC-1683] Re-name SelectReadOnlyArray_V2 to CollectionAccessSelectionType
* [AC-1139] Added permission checks for GroupsController.Get if FC feature flag is enabled
* [AC-1139] Added an AuthorizationHandler for Collections and renamed existing to BulkCollectionAuthorizationHandler
* [AC-1648] [Flexible Collections] Bump migration scripts before feature branch merge (#3371)
* Bump dates on sql migration scripts
* Bump date on ef migrations
* [AC-1139] Renamed existing CollectionAuthorizationHandler to BulkCollectionAuthorizationHandler for collections and created CollectionAuthorizationHandler for single item access. Fixed unit tests and created more
* [AC-1139] Fixed Provider AuthorizationHandler logic for Groups and OrganizationUsers
* [AC-1139] Fixed CollectionAuthorizationHandler unit tests
* [AC-1139] Added unit tests for GroupAuthorizationHandler and OrganizationUserAuthorizationHandler
* [AC-1139] Added unit test to test setting users with EditAssignedCollections with Manage permission when saving a collection
* [AC-1139] Added unit tests for OrganizationService InviteUser and SaveUser with EditAssignedCollections = true
* [AC-1139] Reverted changes on OrganizationService
* [AC-1139] Marked obsolete Permissions EditAssignedCollections and DeleteAssignedCollections
* [AC-1139] Renamed FlexibleCollectionsIsEnabled properties to UseFlexibleCollections
* [AC-1139] Renamed new flexible collections controller methods to have 'vNext' in the name to indicate its a new version
* [AC-1139] Created AuthorizationServiceExtensions to have an extension method for AuthorizeAsync where the resource is null
* [AC-1139] Renamed CollectionsController method to delete collection users from 'Delete' to 'DeleteUser'
* [AC-1139] Refactored BulkCollectionAuthorizationHandler.CheckCollectionPermissionsAsync
* [AC-1139] Created new CollectionOperation ReadAccess and changed GetUsers_vNext to use it
* [AC-1139] Created new CollectionOperationRequirement ReadAllWithAccess
* [AC-1139] Addressing PR suggestions
* [AC-1139] Unit tests refactors and added tests
* [AC-1139] Updated BulkCollectionAuthorizationHandler to not fail if the resource list is null or empty.
* [AC-1139] Modified authorization handlers to not fail in case the resource is null
* [AC-1139] Reverted changes made to CollectionService and OrganizationService
* [AC-1139] Reverted changes to CollectionServiceTests and OrganizationServiceTests
* [AC-1139] Fixed OrganizationUser.ReadAll permissions
---------
Co-authored-by: Robyn MacCallum <robyntmaccallum@gmail.com>
Co-authored-by: Vincent Salucci <26154748+vincentsalucci@users.noreply.github.com>
Co-authored-by: Vincent Salucci <vincesalucci21@gmail.com>
Co-authored-by: Shane Melton <smelton@bitwarden.com>
Co-authored-by: Thomas Rittson <trittson@bitwarden.com>
Co-authored-by: Thomas Rittson <31796059+eliykat@users.noreply.github.com>
* refactoring replace logic
* model for policies + authz handler + unit tests
* update AP repository
* add new endpoints to controller
* update unit tests and integration tests
---------
Co-authored-by: cd-bitwarden <106776772+cd-bitwarden@users.noreply.github.com>
## Type of change
<!-- (mark with an `X`) -->
```
- [ ] Bug fix
- [ ] New feature development
- [x] Tech debt (refactoring, code cleanup, dependency upgrades, etc)
- [ ] Build/deploy pipeline (DevOps)
- [ ] Other
```
## Objective
<!--Describe what the purpose of this PR is. For example: what bug you're fixing or what new feature you're adding-->
Previous PR: #3434
Adds ciphers and folders to the new key rotation.
## Code changes
<!--Explain the changes you've made to each file or major component. This should help the reviewer understand your changes-->
<!--Also refer to any related changes or PRs in other repositories-->
* **file.ext:** Description of what was changed and why
## Before you submit
- Please check for formatting errors (`dotnet format --verify-no-changes`) (required)
- If making database changes - make sure you also update Entity Framework queries and/or migrations
- Please add **unit tests** where it makes sense to do so (encouraged but not required)
- If this change requires a **documentation update** - notify the documentation team
- If this change has particular **deployment requirements** - notify the DevOps team
## Type of change
<!-- (mark with an `X`) -->
```
- [ ] Bug fix
- [ ] New feature development
- [x] Tech debt (refactoring, code cleanup, dependency upgrades, etc)
- [ ] Build/deploy pipeline (DevOps)
- [ ] Other
```
## Objective
<!--Describe what the purpose of this PR is. For example: what bug you're fixing or what new feature you're adding-->
See #3425 for part 1 and background.
This PR adds emergency access to the rotation. All new code is hidden behind a feature flag.
The Accounts controller has also been moved to Auth ownership.
## Code changes
<!--Explain the changes you've made to each file or major component. This should help the reviewer understand your changes-->
<!--Also refer to any related changes or PRs in other repositories-->
* **file.ext:** Description of what was changed and why
* **AccountsController.cs:** Moved to Auth ownership. Emergency access validation was added (as well as initializing empty lists to avoid errors).
* **EmergencyAccessRotationValidator.cs:** Performs validation on the provided list of new emergency access keys.
* **EmergencyAccessRepository.cs:** Adds a method to rotate encryption keys. This is added to a list in the `RotateUserKeyCommand` that the `UserRepository` calls so it doesn't have to know about all the domains.
## Before you submit
- Please check for formatting errors (`dotnet format --verify-no-changes`) (required)
- If making database changes - make sure you also update Entity Framework queries and/or migrations
- Please add **unit tests** where it makes sense to do so (encouraged but not required)
- If this change requires a **documentation update** - notify the documentation team
- If this change has particular **deployment requirements** - notify the DevOps team
* Create UserCipherDetails_v2 and update logic to remove AccessAll
* Create v2 variants of all sprocs that rely on it
* Add feature flag logic to call old or new sproc
* Make equivalent changes to EF queries
* [AC-1117] Add manage permission (#3126)
* Update sql files to add Manage permission
* Add migration script
* Rename collection manage migration file to remove duplicate migration date
* Migrations
* Add manage to models
* Add manage to repository
* Add constraint to Manage columns
* Migration lint fixes
* Add manage to OrganizationUserUserDetails_ReadWithCollectionsById
* Add missing manage fields
* Add 'Manage' to UserCollectionDetails
* Use CREATE OR ALTER where possible
* [AC-1374] Limit collection creation/deletion to Owner/Admin (#3145)
* feat: update org table with new column, write migration, refs AC-1374
* feat: update views with new column, refs AC-1374
* feat: Alter sprocs (org create/update) to include new column, refs AC-1374
* feat: update entity/data/request/response models to handle new column, refs AC-1374
* feat: update necessary Provider related views during migration, refs AC-1374
* fix: update org create to default new column to false, refs AC-1374
* feat: added new API/request model for collection management and removed property from update request model, refs AC-1374
* fix: renamed migration script to be after secrets manage beta column changes, refs AC-1374
* fix: dotnet format, refs AC-1374
* feat: add ef migrations to reflect mssql changes, refs AC-1374
* fix: dotnet format, refs AC-1374
* feat: update API signature to accept Guid and explain Cd verbiage, refs AC-1374
* fix: merge conflict resolution
* [AC-1174] CollectionUser and CollectionGroup authorization handlers (#3194)
* [AC-1174] Introduce BulkAuthorizationHandler.cs
* [AC-1174] Introduce CollectionUserAuthorizationHandler
* [AC-1174] Add CreateForNewCollection CollectionUser requirement
* [AC-1174] Add some more details to CollectionCustomization
* [AC-1174] Formatting
* [AC-1174] Add CollectionGroupOperation.cs
* [AC-1174] Introduce CollectionGroupAuthorizationHandler.cs
* [AC-1174] Cleanup CollectionFixture customization
Implement and use re-usable extension method to support seeded Guids
* [AC-1174] Introduce WithValueFromList AutoFixtureExtensions
Modify CollectionCustomization to use multiple organization Ids for auto generated test data
* [AC-1174] Simplify CollectionUserAuthorizationHandler.cs
Modify the authorization handler to only perform authorization logic. Validation logic will need to be handled by any calling commands/controllers instead.
* [AC-1174] Introduce shared CollectionAccessAuthorizationHandlerBase
A shared base authorization handler was created for both CollectionUser and CollectionGroup resources, as they share the same underlying management authorization logic.
* [AC-1174] Update CollectionUserAuthorizationHandler and CollectionGroupAuthorizationHandler to use the new CollectionAccessAuthorizationHandlerBase class
* [AC-1174] Formatting
* [AC-1174] Cleanup typo and redundant ToList() call
* [AC-1174] Add check for provider users
* [AC-1174] Reduce nested loops
* [AC-1174] Introduce ICollectionAccess.cs
* [AC-1174] Remove individual CollectionGroup and CollectionUser auth handlers and use base class instead
* [AC-1174] Tweak unit test to fail minimally
* [AC-1174] Reorganize authorization handlers in Core project
* [AC-1174] Introduce new AddCoreAuthorizationHandlers() extension method
* [AC-1174] Move CollectionAccessAuthorizationHandler into Api project
* [AC-1174] Move CollectionFixture to Vault folder
* [AC-1174] Rename operation to CreateUpdateDelete
* [AC-1174] Require single organization for collection access authorization handler
- Add requirement that all target collections must belong to the same organization
- Simplify logic related to multiple organizations
- Update tests and helpers
- Use ToHashSet to improve lookup time
* [AC-1174] Fix null reference exception
* [AC-1174] Throw bad request exception when collections belong to different organizations
* [AC-1174] Switch to CollectionAuthorizationHandler instead of CollectionAccessAuthorizationHandler to reduce complexity
* Fix improper merge conflict resolution
* fix: add permission check for collection management api, refs AC-1647 (#3252)
* [AC-1125] Enforce org setting for creating/deleting collections (#3241)
* [AC-1117] Add manage permission (#3126)
* Update sql files to add Manage permission
* Add migration script
* Rename collection manage migration file to remove duplicate migration date
* Migrations
* Add manage to models
* Add manage to repository
* Add constraint to Manage columns
* Migration lint fixes
* Add manage to OrganizationUserUserDetails_ReadWithCollectionsById
* Add missing manage fields
* Add 'Manage' to UserCollectionDetails
* Use CREATE OR ALTER where possible
* [AC-1374] Limit collection creation/deletion to Owner/Admin (#3145)
* feat: update org table with new column, write migration, refs AC-1374
* feat: update views with new column, refs AC-1374
* feat: Alter sprocs (org create/update) to include new column, refs AC-1374
* feat: update entity/data/request/response models to handle new column, refs AC-1374
* feat: update necessary Provider related views during migration, refs AC-1374
* fix: update org create to default new column to false, refs AC-1374
* feat: added new API/request model for collection management and removed property from update request model, refs AC-1374
* fix: renamed migration script to be after secrets manage beta column changes, refs AC-1374
* fix: dotnet format, refs AC-1374
* feat: add ef migrations to reflect mssql changes, refs AC-1374
* fix: dotnet format, refs AC-1374
* feat: update API signature to accept Guid and explain Cd verbiage, refs AC-1374
* feat: created collection auth handler/operations, added LimitCollectionCdOwnerAdmin to CurrentContentOrganization, refs AC-1125
* feat: create vault service collection extensions and register with base services, refs AC-1125
* feat: deprecated CurrentContext.CreateNewCollections, refs AC-1125
* feat: deprecate DeleteAnyCollection for single resource usages, refs AC-1125
* feat: move service registration to api, update references, refs AC-1125
* feat: add bulk delete authorization handler, refs AC-1125
* feat: always assign user and give manage access on create, refs AC-1125
* fix: updated CurrentContextOrganization type, refs AC-1125
* feat: combined existing collection authorization handlers/operations, refs AC-1125
* fix: OrganizationServiceTests -> CurrentContentOrganization typo, refs AC-1125
* fix: format, refs AC-1125
* fix: update collection controller tests, refs AC-1125
* fix: dotnet format, refs AC-1125
* feat: removed extra BulkAuthorizationHandler, refs AC-1125
* fix: dotnet format, refs AC-1125
* fix: change string to guid for org id, update bulk delete request model, refs AC-1125
* fix: remove delete many collection check, refs AC-1125
* fix: clean up collection auth handler, refs AC-1125
* fix: format fix for CollectionOperations, refs AC-1125
* fix: removed unnecessary owner check, add org null check to custom permission validation, refs AC-1125
* fix: remove unused methods in CurrentContext, refs AC-1125
* fix: removed obsolete test, fixed failling delete many test, refs AC-1125
* fix: CollectionAuthorizationHandlerTests fixes, refs AC-1125
* fix: OrganizationServiceTests fix broken test by mocking GetOrganization, refs AC-1125
* fix: CollectionAuthorizationHandler - remove unused repository, refs AC-1125
* feat: moved UserId null check to common method, refs AC-1125
* fix: updated auth handler tests to remove dependency on requirement for common code checks, refs AC-1125
* feat: updated conditionals/comments for create/delete methods within colleciton auth handler, refs AC-1125
* feat: added create/delete collection auth handler success methods, refs AC-1125
* fix: new up permissions to prevent excessive null checks, refs AC-1125
* fix: remove old reference to CreateNewCollections, refs AC-1125
* fix: typo within ViewAssignedCollections method, refs AC-1125
---------
Co-authored-by: Robyn MacCallum <robyntmaccallum@gmail.com>
* refactor: remove organizationId from CollectionBulkDeleteRequestModel, refs AC-1649 (#3282)
* [AC-1174] Bulk Collection Management (#3229)
* [AC-1174] Update SelectionReadOnlyRequestModel to use Guid for Id property
* [AC-1174] Introduce initial bulk-access collection endpoint
* [AC-1174] Introduce BulkAddCollectionAccessCommand and validation logic/tests
* [AC-1174] Add CreateOrUpdateAccessMany method to CollectionRepository
* [AC-1174] Add event logs for bulk add collection access command
* [AC-1174] Add User_BumpAccountRevisionDateByCollectionIds and database migration script
* [AC-1174] Implement EF repository method
* [AC-1174] Improve null checks
* [AC-1174] Remove unnecessary BulkCollectionAccessRequestModel helpers
* [AC-1174] Add unit tests for new controller endpoint
* [AC-1174] Fix formatting
* [AC-1174] Remove comment
* [AC-1174] Remove redundant organizationId parameter
* [AC-1174] Ensure user and group Ids are distinct
* [AC-1174] Cleanup tests based on PR feedback
* [AC-1174] Formatting
* [AC-1174] Update CollectionGroup alias in the sproc
* [AC-1174] Add some additional comments to SQL sproc
* [AC-1174] Add comment explaining additional SaveChangesAsync call
---------
Co-authored-by: Thomas Rittson <trittson@bitwarden.com>
* [AC-1646] Rename LimitCollectionCdOwnerAdmin column (#3300)
* Rename LimitCollectionCdOwnerAdmin -> LimitCollectionCreationDeletion
* Rename and bump migration script
* [AC-1666] Removed EditAnyCollection from Create/Delete permission checks (#3301)
* fix: remove EditAnyCollection from Create/Delete permission check, refs AC-1666
* fix: updated comment, refs AC-1666
* [AC-1669] Bug - Remove obsolete assignUserId from CollectionService.SaveAsync(...) (#3312)
* fix: remove AssignUserId from CollectionService.SaveAsync, refs AC-1669
* fix: add manage access conditional before creating collection, refs AC-1669
* fix: move access logic for create/update, fix all tests, refs AC-1669
* fix: add CollectionAccessSelection fixture, update tests, update bad reqeuest message, refs AC-1669
* fix: format, refs AC-1669
* fix: update null params with specific arg.is null checks, refs Ac-1669
* fix: update attribute class name, refs AC-1669
* [AC-1713] [Flexible collections] Add feature flags to server (#3334)
* Add feature flags for FlexibleCollections and BulkCollectionAccess
* Flag new routes and behaviour
---------
Co-authored-by: Rui Tomé <108268980+r-tome@users.noreply.github.com>
* Add joint codeownership for auth handlers (#3346)
* [AC-1717] Update default values for LimitCollectionCreationDeletion (#3365)
* Change default value in organization create sproc to 1
* Drop old column name still present in some QA instances
* Set LimitCollectionCreationDeletion value in code based on feature flag
* Fix: add missing namespace after merging in master
* Fix: add missing namespace after merging in master
* [AC-1683] Fix DB migrations for new Manage permission (#3307)
* [AC-1683] Update migration script and introduce V2 procedures and types
* [AC-1683] Update repository calls to use new V2 procedures / types
* [AC-1684] Update bulk add collection migration script to use new V2 type
* [AC-1683] Undo Manage changes to more original procedures
* [AC-1683] Restore whitespace changes
* [AC-1683] Clarify comments regarding explicit column lists
* [AC-1683] Update migration script dates
* [AC-1683] Split the migration script for readability
* [AC-1683] Re-name SelectReadOnlyArray_V2 to CollectionAccessSelectionType
* [AC-1648] [Flexible Collections] Bump migration scripts before feature branch merge (#3371)
* Bump dates on sql migration scripts
* Bump date on ef migrations
* [AC-1696] Rework collection auth handler to account for provider users
- Add additional check for providers only if the org membership is null, and if the user is a provider, do not early return
- Modify conditionals to use pattern matching to allow for null organization contexts from provider users
- Save the target organization id as a private field to avoid additional parameter passing because org can now be null
* [AC-1696] Add unit tests to collection auth handler for provider users
Includes helper test method/enum for creating an xUnit theory for each collection operation.
* [AC-1696] Further refactor private methods and remove provider check from public method
Updates logic in private methods to only use context.Succeed() to allow for fallback permission checking for provider access.
* [AC-1696] Ensure the correct organization id is provided when testing
* [AC-1696] Refactor provider test to remove additional operation enum
* [AC-1696] Formatting
---------
Co-authored-by: Robyn MacCallum <robyntmaccallum@gmail.com>
Co-authored-by: Vincent Salucci <26154748+vincentsalucci@users.noreply.github.com>
Co-authored-by: Vincent Salucci <vincesalucci21@gmail.com>
Co-authored-by: Thomas Rittson <trittson@bitwarden.com>
Co-authored-by: Thomas Rittson <31796059+eliykat@users.noreply.github.com>
Co-authored-by: Rui Tomé <108268980+r-tome@users.noreply.github.com>
