Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[AC-292] Public Api - allow configuration of custom permissions #4022

Merged
merged 35 commits into from
May 30, 2024

Conversation

eliykat
Copy link
Member

@eliykat eliykat commented Apr 26, 2024

Type of change

- [ ] Bug fix
- [ ] New feature development
- [ ] Tech debt (refactoring, code cleanup, dependency upgrades, etc)
- [ ] Build/deploy pipeline (DevOps)
- [ ] Other

Objective

Allow users to configure custom permissions via the Public API.

This also involved refactoring the OrganizationService invite user methods so that I wasn't adding to existing tech debt. I also considered extracting this to a command, however this turned out to be non-trivial, so I think it's best tackled separately.

Code changes

Following the commits in order:

  • b183325 - OrganizationService had too many very similar methods for inviting users - InviteUserAsync (x2 overloads), SaveUserSendInviteAsync, InviteUsersAsync (x2 overloads), and SaveUsersSendInvitesAsync. It was difficult to keep track of the control flow and understand where changes needed to happen. I remember we did this originally to avoid exposing nullable parameters to outside callers, however I think the result has overall been worse for it. I combined several of these methods so that we just have InviteUserAsync (single) -> InviteUsersAsync (multiple) -> private SaveUsersSendInvitesAsync.
    • I think a better solution here is to have a LogSubject wrapper which can represent an OrgUser or an EventUser and that's only unwrapped once it reaches EventService - but out of scope here.
  • 82fb3f8 - InviteUserAsync took an increasing number of parameters and I didn't want to add Permissions here. Refactor it to take an OrganizationUserInvite object, similar to InviteUsersAsync. Refactor calling locations to create this object (often from an existing request object) and pass it in.
  • 4e65cb9 - finally :) add the custom permissions to the Public API request and response models. It is optional in all cases because we don't want to break existing scripts that aren't using it (either by throwing errors or by blasting away existing values).
  • 32a3525 - if a custom user is being invited, but Permissions have not been specified, use a default Permissions object. This was prompted by AC-2318 which pointed out that our logic does not gracefully handle nulls here. That only occurred due to manipulation of the private API, however now that we're exposing it to the Public API we need to make sure we handle this case.
  • add tests, minor tweaks

Before you submit

  • Please check for formatting errors (dotnet format --verify-no-changes) (required)
  • If making database changes - make sure you also update Entity Framework queries and/or migrations
  • Please add unit tests where it makes sense to do so (encouraged but not required)
  • If this change requires a documentation update - notify the documentation team
  • If this change has particular deployment requirements - notify the DevOps team

@eliykat eliykat changed the title Ac/ac 292/public api configure custom permission v2 [AC-292] Public Api - allow configuration of custom permissions Apr 26, 2024
Copy link

codecov bot commented Apr 26, 2024

Codecov Report

Attention: Patch coverage is 86.58537% with 22 lines in your changes are missing coverage. Please review.

Project coverage is 39.97%. Comparing base (0189952) to head (2b5c414).

Files Patch % Lines
.../Public/Models/Request/MemberCreateRequestModel.cs 60.00% 4 Missing and 2 partials ⚠️
.../Public/Models/Request/MemberUpdateRequestModel.cs 50.00% 3 Missing and 2 partials ⚠️
...le/Services/Implementations/OrganizationService.cs 83.87% 3 Missing and 2 partials ⚠️
...en_license/src/Scim/Models/ScimUserRequestModel.cs 91.42% 1 Missing and 2 partials ⚠️
...Api/AdminConsole/Public/Models/PermissionsModel.cs 93.75% 2 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4022      +/-   ##
==========================================
+ Coverage   39.31%   39.97%   +0.66%     
==========================================
  Files        1210     1211       +1     
  Lines       58332    58421      +89     
  Branches     5366     5375       +9     
==========================================
+ Hits        22932    23354     +422     
+ Misses      34322    33968     -354     
- Partials     1078     1099      +21     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copy link
Contributor

github-actions bot commented Apr 26, 2024

Logo
Checkmarx One – Scan Summary & Details1100da6d-c29f-4eb7-8797-1ecf99cb3125

Fixed Issues

Severity Issue Source File / Package
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [628](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L628)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [628](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L628)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [628](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L628)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [628](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L628)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/ProvidersController.cs: [82](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/ProvidersController.cs# L82)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [607](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L607)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [607](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L607)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [607](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L607)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [607](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L607)
MEDIUM CSRF /src/Api/Public/Controllers/CollectionsController.cs: [87](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Public/Controllers/CollectionsController.cs# L87)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: [132](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/GroupsController.cs# L132)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/ProvidersController.cs: [143](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/ProvidersController.cs# L143)
MEDIUM CSRF /src/Api/SecretsManager/Controllers/AccessPoliciesController.cs: [229](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/SecretsManager/Controllers/AccessPoliciesController.cs# L229)
MEDIUM CSRF /src/Admin/AdminConsole/Controllers/ProvidersController.cs: [319](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Admin/AdminConsole/Controllers/ProvidersController.cs# L319)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: [163](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/GroupsController.cs# L163)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: [163](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/GroupsController.cs# L163)
MEDIUM CSRF /src/Api/Billing/Controllers/ProviderClientsController.cs: [28](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Billing/Controllers/ProviderClientsController.cs# L28)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [205](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L205)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [348](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L348)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [348](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L348)
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: [212](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/CollectionsController.cs# L212)
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: [270](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/CollectionsController.cs# L270)
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: [270](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/CollectionsController.cs# L270)
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: [212](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/CollectionsController.cs# L212)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [665](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L665)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [707](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L707)
MEDIUM CSRF /src/Api/Vault/Controllers/FoldersController.cs: [45](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/FoldersController.cs# L45)
MEDIUM CSRF /src/Api/Controllers/SelfHosted/SelfHostedOrganizationLicensesController.cs: [51](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/SelfHosted/SelfHostedOrganizationLicensesController.cs# L51)
MEDIUM CSRF /src/Api/Controllers/UsersController.cs: [22](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/UsersController.cs# L22)
MEDIUM CSRF /src/Api/Controllers/DevicesController.cs: [70](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/DevicesController.cs# L70)
MEDIUM CSRF /src/Api/Controllers/DevicesController.cs: [57](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/DevicesController.cs# L57)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/PoliciesController.cs: [69](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/PoliciesController.cs# L69)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/PoliciesController.cs: [49](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/PoliciesController.cs# L49)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/OrganizationController.cs: [42](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/OrganizationController.cs# L42)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/GroupsController.cs: [92](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/GroupsController.cs# L92)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/GroupsController.cs: [49](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/GroupsController.cs# L49)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/ProviderUsersController.cs: [142](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/ProviderUsersController.cs# L142)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/PoliciesController.cs: [148](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/PoliciesController.cs# L148)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/PoliciesController.cs: [78](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/PoliciesController.cs# L78)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/PoliciesController.cs: [61](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/PoliciesController.cs# L61)
MEDIUM CSRF /bitwarden_license/src/Sso/Controllers/AccountController.cs: [163](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//bitwarden_license/src/Sso/Controllers/AccountController.cs# L163)
MEDIUM CSRF /bitwarden_license/src/Sso/Controllers/AccountController.cs: [96](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//bitwarden_license/src/Sso/Controllers/AccountController.cs# L96)
MEDIUM CSRF /bitwarden_license/src/Scim/Controllers/v2/UsersController.cs: [50](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//bitwarden_license/src/Scim/Controllers/v2/UsersController.cs# L50)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/GroupsController.cs: [161](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/GroupsController.cs# L161)
MEDIUM CSRF /src/Api/Auth/Controllers/EmergencyAccessController.cs: [159](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/EmergencyAccessController.cs# L159)
MEDIUM CSRF /bitwarden_license/src/Scim/Controllers/v2/GroupsController.cs: [98](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//bitwarden_license/src/Scim/Controllers/v2/GroupsController.cs# L98)
MEDIUM CSRF /bitwarden_license/src/Scim/Controllers/v2/GroupsController.cs: [88](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//bitwarden_license/src/Scim/Controllers/v2/GroupsController.cs# L88)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/OrganizationController.cs: [42](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/OrganizationController.cs# L42)
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: [323](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/CollectionsController.cs# L323)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/ProviderUsersController.cs: [188](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/ProviderUsersController.cs# L188)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [928](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L928)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [855](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L855)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [541](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L541)
MEDIUM CSRF /src/Api/Auth/Controllers/TwoFactorController.cs: [403](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/TwoFactorController.cs# L403)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [570](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L570)
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: [375](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/CollectionsController.cs# L375)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [841](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L841)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/GroupsController.cs: [133](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/GroupsController.cs# L133)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [193](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L193)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [1096](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L1096)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [1096](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L1096)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [174](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L174)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [657](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L657)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [657](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L657)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [261](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L261)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [920](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L920)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [778](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L778)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [1130](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L1130)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [1047](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L1047)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [1047](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L1047)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [301](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L301)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [861](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L861)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [308](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L308)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [961](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L961)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [144](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L144)
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: [411](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/CollectionsController.cs# L411)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [816](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L816)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: [260](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/GroupsController.cs# L260)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/ProviderUsersController.cs: [175](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/ProviderUsersController.cs# L175)
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: [303](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/CollectionsController.cs# L303)
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: [375](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/CollectionsController.cs# L375)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [1150](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L1150)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [87](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L87)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/MembersController.cs: [187](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/MembersController.cs# L187)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [222](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L222)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [428](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L428)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [570](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L570)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [583](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L583)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [583](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L583)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [752](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L752)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [193](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L193)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationsController.cs: [315](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationsController.cs# L315)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [283](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L283)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [301](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L301)
MEDIUM CSRF /src/Api/Controllers/SettingsController.cs: [36](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/SettingsController.cs# L36)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [261](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L261)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [357](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L357)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [217](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L217)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: [277](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/GroupsController.cs# L277)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [1073](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L1073)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [1073](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L1073)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [464](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L464)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [316](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L316)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [568](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L568)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/MembersController.cs: [150](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/MembersController.cs# L150)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/MembersController.cs: [150](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/MembersController.cs# L150)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [526](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L526)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [159](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L159)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [770](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L770)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [222](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L222)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [403](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L403)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationsController.cs: [315](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationsController.cs# L315)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationsController.cs: [315](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationsController.cs# L315)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationsController.cs: [315](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationsController.cs# L315)
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: [303](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/CollectionsController.cs# L303)
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: [411](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/CollectionsController.cs# L411)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/OrganizationController.cs: [42](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/OrganizationController.cs# L42)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/OrganizationController.cs: [42](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/OrganizationController.cs# L42)
MEDIUM CSRF /src/Admin/AdminConsole/Controllers/OrganizationsController.cs: [334](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Admin/AdminConsole/Controllers/OrganizationsController.cs# L334)
MEDIUM CSRF /src/Admin/AdminConsole/Controllers/ProvidersController.cs: [243](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Admin/AdminConsole/Controllers/ProvidersController.cs# L243)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: [81](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/GroupsController.cs# L81)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: [118](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/GroupsController.cs# L118)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationsController.cs: [118](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationsController.cs# L118)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationsController.cs: [315](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationsController.cs# L315)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [233](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L233)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [315](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L315)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [333](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L333)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/ProviderOrganizationsController.cs: [48](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/ProviderOrganizationsController.cs# L48)
MEDIUM CSRF /src/Identity/Controllers/AccountsController.cs: [50](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Identity/Controllers/AccountsController.cs# L50)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/MembersController.cs: [59](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/MembersController.cs# L59)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/MembersController.cs: [127](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/MembersController.cs# L127)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [515](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L515)
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: [156](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/CollectionsController.cs# L156)
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: [187](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/CollectionsController.cs# L187)
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: [196](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/CollectionsController.cs# L196)
MEDIUM CSRF /src/Api/Public/Controllers/CollectionsController.cs: [64](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Public/Controllers/CollectionsController.cs# L64)
MEDIUM CSRF /src/Api/Tools/Controllers/ImportCiphersController.cs: [48](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Tools/Controllers/ImportCiphersController.cs# L48)
MEDIUM CSRF /src/Api/Tools/Controllers/ImportCiphersController.cs: [64](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Tools/Controllers/ImportCiphersController.cs# L64)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [111](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L111)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [125](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L125)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [992](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L992)
MEDIUM CSRF /src/Identity/Controllers/AccountsController.cs: [72](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Identity/Controllers/AccountsController.cs# L72)
MEDIUM CSRF /src/Admin/AdminConsole/Controllers/ProviderOrganizationsController.cs: [35](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Admin/AdminConsole/Controllers/ProviderOrganizationsController.cs# L35)
MEDIUM CSRF /src/Api/Auth/Controllers/WebAuthnController.cs: [130](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/WebAuthnController.cs# L130)
MEDIUM

More results are available on AST platform

@eliykat eliykat marked this pull request as ready for review May 7, 2024 03:58
@eliykat eliykat requested a review from a team as a code owner May 7, 2024 03:58
Copy link
Contributor

@r-tome r-tome left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Everything looks great to me! I noticed we don't have integration tests for the public MembersController. Is it feasible to add tests on this PR for the Post action?

@eliykat eliykat requested a review from a team as a code owner May 10, 2024 05:59
@eliykat eliykat removed the request for review from a team May 13, 2024 03:58
@eliykat eliykat requested a review from r-tome May 21, 2024 00:12
@eliykat
Copy link
Member Author

eliykat commented May 21, 2024

I had to reapply changes from #4011 in the last merge commit. PostUserCommand now sets invite.AccessSecretsManager rather than adding another parameter to the invite user method. @r-tome please just look at that carefully in your review to ensure I've maintained that fix.

@eliykat eliykat removed the request for review from vincentsalucci May 21, 2024 00:28
r-tome
r-tome previously approved these changes May 21, 2024
Copy link
Contributor

@r-tome r-tome left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Excellent work on these integration tests!
Suggestion: on the teardown we could delete the inserted data

@eliykat
Copy link
Member Author

eliykat commented May 22, 2024

All test data is created with unique GUIDS, I think deleting data from the database would just make the tests run longer (and integration tests are already slow).

I fixed a bug where it was checking the OrganizationUserType before the transitional logic for deprecated permissions. Now it checks it after the user type is translated, so if a custom user is being mapped to a regular User, it won't return a permissions object.

@eliykat eliykat requested a review from r-tome May 22, 2024 23:45
@eliykat eliykat removed the needs-qa label May 30, 2024
@eliykat eliykat merged commit 357ac4f into main May 30, 2024
44 of 45 checks passed
@eliykat eliykat deleted the ac/ac-292/public-api---configure-custom-permission-v2 branch May 30, 2024 23:23
cyprain-okeke pushed a commit that referenced this pull request May 31, 2024
* Also refactor OrganizationService user invite methods
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants