mirror of
https://github.com/bitwarden/server.git
synced 2024-11-27 13:05:23 +01:00
1c3afcdffc
* [PM-1203] feat: allow verification for all passwordless accounts (#3038) * [PM-1033] Org invite user creation flow 1 (#3028) * [PM-1033] feat: remove user verification from password enrollment * [PM-1033] feat: auto accept invitation when enrolling into password reset * [PM-1033] fix: controller tests * [PM-1033] refactor: `UpdateUserResetPasswordEnrollmentCommand` * [PM-1033] refactor(wip): make `AcceptUserCommand` * Revert "[PM-1033] refactor(wip): make `AcceptUserCommand`" This reverts commitdc1319e7fa
. * Revert "[PM-1033] refactor: `UpdateUserResetPasswordEnrollmentCommand`" This reverts commit43df689c7f
. * [PM-1033] refactor: move invite accept to controller This avoids creating yet another method that depends on having `IUserService` passed in as a parameter * [PM-1033] fix: add missing changes * [PM-1381] Add Trusted Device Keys to Auth Response (#3066) * Return Keys for Trusted Device - Check whether the current logging in device is trusted - Return their keys on successful login * Formatting * Address PR Feedback * Add Remarks Comment * [PM-1338] `AuthRequest` Event Logs (#3046) * Update AuthRequestController - Only allow AdminApproval Requests to be created from authed endpoint - Add endpoint that has authentication to be able to create admin approval * Add PasswordlessAuthSettings - Add settings for customizing expiration times * Add new EventTypes * Add Logic for AdminApproval Type - Add logic for validating AdminApproval expiration - Add event logging for Approval/Disapproval of AdminApproval - Add logic for creating AdminApproval types * Add Test Helpers - Change BitAutoData to allow you to use string representations of common types. * Add/Update AuthRequestService Tests * Run Formatting * Switch to 7 Days * Add Test Covering ResponseDate Being Set * Address PR Feedback - Create helper for checking if date is expired - Move validation logic into smaller methods * Switch to User Event Type - Make RequestDeviceApproval user type - User types will log for each org user is in * [PM-2998] Move Approving Device Check (#3101) * Move Check for Approving Devices - Exclude currently logging in device - Remove old way of checking - Add tests asserting behavior * Update DeviceType list * Update Naming & Address PR Feedback * Fix Tests * Address PR Feedback * Formatting * Now Fully Update Naming? * Feature/auth/pm 2759/add can reset password to user decryption options (#3113) * PM-2759 - BaseRequestValidator.cs - CreateUserDecryptionOptionsAsync - Add new hasManageResetPasswordPermission for post SSO redirect logic required on client. * PM-2759 - Update IdentityServerSsoTests.cs to all pass based on the addition of HasManageResetPasswordPermission to TrustedDeviceUserDecryptionOption * IdentityServerSsoTests.cs - fix typo in test name: LoggingApproval --> LoginApproval * PM1259 - Add test case for verifying that TrustedDeviceOption.hasManageResetPasswordPermission is set properly based on user permission * dotnet format run * Feature/auth/pm 2759/add can reset password to user decryption options fix jit users (#3120) * PM-2759 - IdentityServer - CreateUserDecryptionOptionsAsync - hasManageResetPasswordPermission set logic was broken for JIT provisioned users as I assumed we would always have a list of at least 1 org during the SSO process. Added TODO for future test addition but getting this out there now as QA is blocked by being unable to create JIT provisioned users. * dotnet format * Tiny tweak * [PM-1339] Allow Rotating Device Keys (#3096) * Allow Rotation of Trusted Device Keys - Add endpoint for getting keys relating to rotation - Add endpoint for rotating your current device - In the same endpoint allow a list of other devices to rotate * Formatting * Use Extension Method * Add Tests from PR Co-authored-by: Jared Snider <jsnider@bitwarden.com> --------- Co-authored-by: Jared Snider <jsnider@bitwarden.com> * Check the user directly if they have the ResetPasswordKey (#3153) * PM-3327 - UpdateKeyAsync must exempt the currently calling device from the logout notification in order to prevent prematurely logging the user out before the client side key rotation process can complete. The calling device will log itself out once it is done. (#3170) * Allow OTP Requests When Users Are On TDE (#3184) * [PM-3356][PM-3292] Allow OTP For All (#3188) * Allow OTP For All - On a trusted device isn't a good check because a user might be using a trusted device locally but not trusted it long term - The logic wasn't working for KC users anyways * Remove Old Comment * [AC-1601] Added RequireSso policy as a dependency of TDE (#3209) * Added RequireSso policy as a dependency of TDE. * Added test for RequireSso for TDE. * Added save. * Fixed policy name. --------- Co-authored-by: Andreas Coroiu <acoroiu@bitwarden.com> Co-authored-by: Justin Baur <19896123+justindbaur@users.noreply.github.com> Co-authored-by: Vincent Salucci <vincesalucci21@gmail.com> Co-authored-by: Jared Snider <116684653+JaredSnider-Bitwarden@users.noreply.github.com> Co-authored-by: Jared Snider <jsnider@bitwarden.com>
238 lines
9.2 KiB
C#
238 lines
9.2 KiB
C#
using System.Collections;
|
|
using System.Diagnostics;
|
|
using System.Linq.Expressions;
|
|
using System.Reflection;
|
|
using System.Text.Json;
|
|
using Bit.Core.Utilities;
|
|
using Microsoft.AspNetCore.Http;
|
|
using Xunit;
|
|
using Xunit.Sdk;
|
|
|
|
namespace Bit.Test.Common.Helpers;
|
|
|
|
public static class AssertHelper
|
|
{
|
|
public static void AssertPropertyEqual(object expected, object actual, params string[] excludedPropertyStrings)
|
|
{
|
|
var relevantExcludedProperties = excludedPropertyStrings.Where(name => !name.Contains('.')).ToList();
|
|
if (expected == null)
|
|
{
|
|
Assert.Null(actual);
|
|
return;
|
|
}
|
|
|
|
if (actual == null)
|
|
{
|
|
throw new Exception("Actual object is null but expected is not");
|
|
}
|
|
|
|
foreach (var expectedPropInfo in expected.GetType().GetProperties().Where(pi => !relevantExcludedProperties.Contains(pi.Name) && !pi.GetIndexParameters().Any()))
|
|
{
|
|
var actualPropInfo = actual.GetType().GetProperty(expectedPropInfo.Name);
|
|
|
|
if (actualPropInfo == null)
|
|
{
|
|
throw new Exception(string.Concat($"Expected actual object to contain a property named {expectedPropInfo.Name}, but it does not\n",
|
|
$"Expected:\n{JsonSerializer.Serialize(expected, JsonHelpers.Indented)}\n",
|
|
$"Actual:\n{JsonSerializer.Serialize(actual, JsonHelpers.Indented)}"));
|
|
}
|
|
|
|
if (typeof(IComparable).IsAssignableFrom(expectedPropInfo.PropertyType) || expectedPropInfo.PropertyType.IsPrimitive || expectedPropInfo.PropertyType.IsValueType)
|
|
{
|
|
Assert.Equal(expectedPropInfo.GetValue(expected), actualPropInfo.GetValue(actual));
|
|
}
|
|
else if (expectedPropInfo.PropertyType == typeof(JsonDocument) && actualPropInfo.PropertyType == typeof(JsonDocument))
|
|
{
|
|
static string JsonDocString(PropertyInfo info, object obj) => JsonSerializer.Serialize(info.GetValue(obj));
|
|
Assert.Equal(JsonDocString(expectedPropInfo, expected), JsonDocString(actualPropInfo, actual));
|
|
}
|
|
else if (typeof(IEnumerable).IsAssignableFrom(expectedPropInfo.PropertyType) && typeof(IEnumerable).IsAssignableFrom(actualPropInfo.PropertyType))
|
|
{
|
|
var expectedItems = ((IEnumerable)expectedPropInfo.GetValue(expected)).Cast<object>();
|
|
var actualItems = ((IEnumerable)actualPropInfo.GetValue(actual)).Cast<object>();
|
|
|
|
AssertPropertyEqualPredicate(expectedItems, excludedPropertyStrings)(actualItems);
|
|
}
|
|
else
|
|
{
|
|
var prefix = $"{expectedPropInfo.PropertyType.Name}.";
|
|
var nextExcludedProperties = excludedPropertyStrings.Where(name => name.StartsWith(prefix))
|
|
.Select(name => name[prefix.Length..]).ToArray();
|
|
AssertPropertyEqual(expectedPropInfo.GetValue(expected), actualPropInfo.GetValue(actual), nextExcludedProperties);
|
|
}
|
|
}
|
|
}
|
|
|
|
private static Predicate<T> AssertPropertyEqualPredicate<T>(T expected, params string[] excludedPropertyStrings) => (actual) =>
|
|
{
|
|
AssertPropertyEqual(expected, actual, excludedPropertyStrings);
|
|
return true;
|
|
};
|
|
|
|
public static Expression<Predicate<T>> AssertPropertyEqual<T>(T expected, params string[] excludedPropertyStrings) =>
|
|
(T actual) => AssertPropertyEqualPredicate(expected, excludedPropertyStrings)(actual);
|
|
|
|
private static Predicate<IEnumerable<T>> AssertPropertyEqualPredicate<T>(IEnumerable<T> expected, params string[] excludedPropertyStrings) => (actual) =>
|
|
{
|
|
// IEnumerable.Zip doesn't account for different lengths, we need to check this ourselves
|
|
if (actual.Count() != expected.Count())
|
|
{
|
|
throw new Exception(string.Concat($"Actual IEnumerable does not have the expected length.\n",
|
|
$"Expected: {expected.Count()}\n",
|
|
$"Actual: {actual.Count()}"));
|
|
}
|
|
|
|
var elements = expected.Zip(actual);
|
|
foreach (var (expectedEl, actualEl) in elements)
|
|
{
|
|
AssertPropertyEqual(expectedEl, actualEl, excludedPropertyStrings);
|
|
}
|
|
|
|
return true;
|
|
};
|
|
|
|
public static Expression<Predicate<IEnumerable<T>>> AssertPropertyEqual<T>(IEnumerable<T> expected, params string[] excludedPropertyStrings) =>
|
|
(actual) => AssertPropertyEqualPredicate(expected, excludedPropertyStrings)(actual);
|
|
|
|
private static Predicate<T> AssertEqualExpectedPredicate<T>(T expected) => (actual) =>
|
|
{
|
|
Assert.Equal(expected, actual);
|
|
return true;
|
|
};
|
|
|
|
public static Expression<Predicate<T>> AssertEqualExpected<T>(T expected) =>
|
|
(T actual) => AssertEqualExpectedPredicate(expected)(actual);
|
|
|
|
[StackTraceHidden]
|
|
public static JsonElement AssertJsonProperty(JsonElement element, string propertyName, JsonValueKind jsonValueKind)
|
|
{
|
|
if (!element.TryGetProperty(propertyName, out var subElement))
|
|
{
|
|
throw new XunitException($"Could not find property by name '{propertyName}'");
|
|
}
|
|
|
|
Assert.Equal(jsonValueKind, subElement.ValueKind);
|
|
return subElement;
|
|
}
|
|
|
|
public static void AssertEqualJson(JsonElement a, JsonElement b)
|
|
{
|
|
switch (a.ValueKind)
|
|
{
|
|
case JsonValueKind.Array:
|
|
Assert.Equal(JsonValueKind.Array, b.ValueKind);
|
|
AssertEqualJsonArray(a, b);
|
|
break;
|
|
case JsonValueKind.Object:
|
|
Assert.Equal(JsonValueKind.Object, b.ValueKind);
|
|
AssertEqualJsonObject(a, b);
|
|
break;
|
|
case JsonValueKind.False:
|
|
Assert.Equal(JsonValueKind.False, b.ValueKind);
|
|
break;
|
|
case JsonValueKind.True:
|
|
Assert.Equal(JsonValueKind.True, b.ValueKind);
|
|
break;
|
|
case JsonValueKind.Number:
|
|
Assert.Equal(JsonValueKind.Number, b.ValueKind);
|
|
Assert.Equal(a.GetDouble(), b.GetDouble());
|
|
break;
|
|
case JsonValueKind.String:
|
|
Assert.Equal(JsonValueKind.String, b.ValueKind);
|
|
Assert.Equal(a.GetString(), b.GetString());
|
|
break;
|
|
case JsonValueKind.Null:
|
|
Assert.Equal(JsonValueKind.Null, b.ValueKind);
|
|
break;
|
|
default:
|
|
throw new XunitException($"Bad JsonValueKind '{a.ValueKind}'");
|
|
}
|
|
}
|
|
|
|
private static void AssertEqualJsonObject(JsonElement a, JsonElement b)
|
|
{
|
|
Debug.Assert(a.ValueKind == JsonValueKind.Object && b.ValueKind == JsonValueKind.Object);
|
|
|
|
var aObjectEnumerator = a.EnumerateObject();
|
|
var bObjectEnumerator = b.EnumerateObject();
|
|
|
|
while (true)
|
|
{
|
|
var aCanMove = aObjectEnumerator.MoveNext();
|
|
var bCanMove = bObjectEnumerator.MoveNext();
|
|
|
|
if (aCanMove)
|
|
{
|
|
Assert.True(bCanMove, $"a was able to enumerate over object '{a}' but b was NOT able to '{b}'");
|
|
}
|
|
else
|
|
{
|
|
Assert.False(bCanMove, $"a was NOT able to enumerate over object '{a}' but b was able to '{b}'");
|
|
}
|
|
|
|
if (aCanMove == false && bCanMove == false)
|
|
{
|
|
// They both can't continue to enumerate at the same time, that is valid
|
|
break;
|
|
}
|
|
|
|
var aProp = aObjectEnumerator.Current;
|
|
var bProp = bObjectEnumerator.Current;
|
|
|
|
Assert.Equal(aProp.Name, bProp.Name);
|
|
// Recursion!
|
|
AssertEqualJson(aProp.Value, bProp.Value);
|
|
}
|
|
}
|
|
|
|
private static void AssertEqualJsonArray(JsonElement a, JsonElement b)
|
|
{
|
|
Debug.Assert(a.ValueKind == JsonValueKind.Array && b.ValueKind == JsonValueKind.Array);
|
|
|
|
var aArrayEnumerator = a.EnumerateArray();
|
|
var bArrayEnumerator = b.EnumerateArray();
|
|
|
|
while (true)
|
|
{
|
|
var aCanMove = aArrayEnumerator.MoveNext();
|
|
var bCanMove = bArrayEnumerator.MoveNext();
|
|
|
|
if (aCanMove)
|
|
{
|
|
Assert.True(bCanMove, $"a was able to enumerate over array '{a}' but b was NOT able to '{b}'");
|
|
}
|
|
else
|
|
{
|
|
Assert.False(bCanMove, $"a was NOT able to enumerate over array '{a}' but b was able to '{b}'");
|
|
}
|
|
|
|
if (aCanMove == false && bCanMove == false)
|
|
{
|
|
// They both can't continue to enumerate at the same time, that is valid
|
|
break;
|
|
}
|
|
|
|
var aElement = aArrayEnumerator.Current;
|
|
var bElement = bArrayEnumerator.Current;
|
|
|
|
// Recursion!
|
|
AssertEqualJson(aElement, bElement);
|
|
}
|
|
}
|
|
|
|
public async static Task<T> AssertResponseTypeIs<T>(HttpContext context)
|
|
{
|
|
return await JsonSerializer.DeserializeAsync<T>(context.Response.Body);
|
|
}
|
|
|
|
public static TimeSpan AssertRecent(DateTime dateTime, int skewSeconds = 2)
|
|
=> AssertRecent(dateTime, TimeSpan.FromSeconds(skewSeconds));
|
|
|
|
public static TimeSpan AssertRecent(DateTime dateTime, TimeSpan skew)
|
|
{
|
|
var difference = DateTime.UtcNow - dateTime;
|
|
Assert.True(difference < skew);
|
|
return difference;
|
|
}
|
|
}
|