Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[AC-292] Public Api - allow configuration of custom permissions #4022

Open
wants to merge 33 commits into
base: main
Choose a base branch
from

Conversation

eliykat
Copy link
Member

@eliykat eliykat commented Apr 26, 2024

Type of change

- [ ] Bug fix
- [ ] New feature development
- [ ] Tech debt (refactoring, code cleanup, dependency upgrades, etc)
- [ ] Build/deploy pipeline (DevOps)
- [ ] Other

Objective

Allow users to configure custom permissions via the Public API.

This also involved refactoring the OrganizationService invite user methods so that I wasn't adding to existing tech debt. I also considered extracting this to a command, however this turned out to be non-trivial, so I think it's best tackled separately.

Code changes

Following the commits in order:

  • b183325 - OrganizationService had too many very similar methods for inviting users - InviteUserAsync (x2 overloads), SaveUserSendInviteAsync, InviteUsersAsync (x2 overloads), and SaveUsersSendInvitesAsync. It was difficult to keep track of the control flow and understand where changes needed to happen. I remember we did this originally to avoid exposing nullable parameters to outside callers, however I think the result has overall been worse for it. I combined several of these methods so that we just have InviteUserAsync (single) -> InviteUsersAsync (multiple) -> private SaveUsersSendInvitesAsync.
    • I think a better solution here is to have a LogSubject wrapper which can represent an OrgUser or an EventUser and that's only unwrapped once it reaches EventService - but out of scope here.
  • 82fb3f8 - InviteUserAsync took an increasing number of parameters and I didn't want to add Permissions here. Refactor it to take an OrganizationUserInvite object, similar to InviteUsersAsync. Refactor calling locations to create this object (often from an existing request object) and pass it in.
  • 4e65cb9 - finally :) add the custom permissions to the Public API request and response models. It is optional in all cases because we don't want to break existing scripts that aren't using it (either by throwing errors or by blasting away existing values).
  • 32a3525 - if a custom user is being invited, but Permissions have not been specified, use a default Permissions object. This was prompted by AC-2318 which pointed out that our logic does not gracefully handle nulls here. That only occurred due to manipulation of the private API, however now that we're exposing it to the Public API we need to make sure we handle this case.
  • add tests, minor tweaks

Before you submit

  • Please check for formatting errors (dotnet format --verify-no-changes) (required)
  • If making database changes - make sure you also update Entity Framework queries and/or migrations
  • Please add unit tests where it makes sense to do so (encouraged but not required)
  • If this change requires a documentation update - notify the documentation team
  • If this change has particular deployment requirements - notify the DevOps team

@eliykat eliykat changed the title Ac/ac 292/public api configure custom permission v2 [AC-292] Public Api - allow configuration of custom permissions Apr 26, 2024
Copy link

codecov bot commented Apr 26, 2024

Codecov Report

Attention: Patch coverage is 86.58537% with 22 lines in your changes are missing coverage. Please review.

Project coverage is 39.75%. Comparing base (0d2e953) to head (117bd3a).

Files Patch % Lines
.../Public/Models/Request/MemberCreateRequestModel.cs 60.00% 4 Missing and 2 partials ⚠️
.../Public/Models/Request/MemberUpdateRequestModel.cs 50.00% 3 Missing and 2 partials ⚠️
...le/Services/Implementations/OrganizationService.cs 83.87% 3 Missing and 2 partials ⚠️
...en_license/src/Scim/Models/ScimUserRequestModel.cs 91.42% 1 Missing and 2 partials ⚠️
...Api/AdminConsole/Public/Models/PermissionsModel.cs 93.75% 2 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4022      +/-   ##
==========================================
+ Coverage   39.09%   39.75%   +0.66%     
==========================================
  Files        1202     1203       +1     
  Lines       58110    58199      +89     
  Branches     5349     5358       +9     
==========================================
+ Hits        22717    23139     +422     
+ Misses      34323    33970     -353     
- Partials     1070     1090      +20     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copy link
Contributor

github-actions bot commented Apr 26, 2024

Logo
Checkmarx One – Scan Summary & Details19ba2891-ba4c-46df-8324-e77e53d206f6

New Issues

Severity Issue Source File / Package Checkmarx Insight
MEDIUM CSRF /src/Api/Public/Controllers/CollectionsController.cs: [87](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Public/Controllers/CollectionsController.cs# L87) Attack Vector
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: [270](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/CollectionsController.cs# L270) Attack Vector
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: [270](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/CollectionsController.cs# L270) Attack Vector
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: [212](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/CollectionsController.cs# L212) Attack Vector
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: [212](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/CollectionsController.cs# L212) Attack Vector
MEDIUM Privacy_Violation /src/Api/Controllers/DevicesController.cs: [155](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/DevicesController.cs# L155) Attack Vector
MEDIUM Privacy_Violation /src/Api/AdminConsole/Controllers/OrganizationsController.cs: [375](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationsController.cs# L375) Attack Vector
MEDIUM Privacy_Violation /src/Api/AdminConsole/Controllers/OrganizationsController.cs: [428](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationsController.cs# L428) Attack Vector
LOW Log_Forging /src/Api/Vault/Controllers/CiphersController.cs: [222](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L222) Attack Vector
LOW Log_Forging /src/Api/Controllers/DevicesController.cs: [146](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/DevicesController.cs# L146) Attack Vector
LOW Log_Forging /src/Api/AdminConsole/Controllers/OrganizationsController.cs: [340](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationsController.cs# L340) Attack Vector
LOW Log_Forging /src/Api/AdminConsole/Controllers/OrganizationsController.cs: [403](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationsController.cs# L403) Attack Vector
LOW Missing_CSP_Header /src/Core/MailTemplates/Handlebars/InitiateDeleteOrganzation.html.hbs: [10](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Core/MailTemplates/Handlebars/InitiateDeleteOrganzation.html.hbs# L10) Attack Vector

Fixed Issues

Severity Issue Source File / Package
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [628](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L628)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [628](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L628)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [628](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L628)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [628](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L628)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/ProvidersController.cs: [82](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/ProvidersController.cs# L82)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [607](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L607)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [607](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L607)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [607](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L607)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [607](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L607)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: [132](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/GroupsController.cs# L132)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/ProvidersController.cs: [143](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/ProvidersController.cs# L143)
MEDIUM CSRF /src/Api/SecretsManager/Controllers/AccessPoliciesController.cs: [229](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/SecretsManager/Controllers/AccessPoliciesController.cs# L229)
MEDIUM CSRF /src/Admin/AdminConsole/Controllers/ProvidersController.cs: [319](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Admin/AdminConsole/Controllers/ProvidersController.cs# L319)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: [163](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/GroupsController.cs# L163)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: [163](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/GroupsController.cs# L163)
MEDIUM CSRF /src/Api/Billing/Controllers/ProviderClientsController.cs: [28](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Billing/Controllers/ProviderClientsController.cs# L28)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [205](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L205)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [348](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L348)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [348](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L348)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [665](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L665)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [641](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L641)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [707](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L707)
MEDIUM CSRF /src/Api/Vault/Controllers/FoldersController.cs: [45](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/FoldersController.cs# L45)
MEDIUM CSRF /src/Api/Controllers/SelfHosted/SelfHostedOrganizationLicensesController.cs: [51](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/SelfHosted/SelfHostedOrganizationLicensesController.cs# L51)
MEDIUM CSRF /src/Api/Controllers/UsersController.cs: [22](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/UsersController.cs# L22)
MEDIUM CSRF /src/Api/Controllers/DevicesController.cs: [70](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/DevicesController.cs# L70)
MEDIUM CSRF /src/Api/Controllers/DevicesController.cs: [57](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/DevicesController.cs# L57)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/PoliciesController.cs: [69](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/PoliciesController.cs# L69)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/PoliciesController.cs: [49](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/PoliciesController.cs# L49)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/OrganizationController.cs: [42](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/OrganizationController.cs# L42)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/GroupsController.cs: [92](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/GroupsController.cs# L92)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/GroupsController.cs: [49](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/GroupsController.cs# L49)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/ProviderUsersController.cs: [142](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/ProviderUsersController.cs# L142)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/PoliciesController.cs: [148](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/PoliciesController.cs# L148)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/PoliciesController.cs: [78](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/PoliciesController.cs# L78)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/PoliciesController.cs: [61](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/PoliciesController.cs# L61)
MEDIUM CSRF /bitwarden_license/src/Sso/Controllers/AccountController.cs: [163](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//bitwarden_license/src/Sso/Controllers/AccountController.cs# L163)
MEDIUM CSRF /bitwarden_license/src/Sso/Controllers/AccountController.cs: [96](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//bitwarden_license/src/Sso/Controllers/AccountController.cs# L96)
MEDIUM CSRF /bitwarden_license/src/Scim/Controllers/v2/UsersController.cs: [50](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//bitwarden_license/src/Scim/Controllers/v2/UsersController.cs# L50)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/GroupsController.cs: [161](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/GroupsController.cs# L161)
MEDIUM CSRF /src/Api/Auth/Controllers/EmergencyAccessController.cs: [159](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/EmergencyAccessController.cs# L159)
MEDIUM CSRF /bitwarden_license/src/Scim/Controllers/v2/GroupsController.cs: [98](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//bitwarden_license/src/Scim/Controllers/v2/GroupsController.cs# L98)
MEDIUM CSRF /bitwarden_license/src/Scim/Controllers/v2/GroupsController.cs: [88](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//bitwarden_license/src/Scim/Controllers/v2/GroupsController.cs# L88)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [1073](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L1073)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [1073](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L1073)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [464](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L464)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [316](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L316)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [541](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L541)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [428](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L428)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [222](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L222)
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: [303](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/CollectionsController.cs# L303)
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: [411](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/CollectionsController.cs# L411)
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: [323](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/CollectionsController.cs# L323)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [159](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L159)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/MembersController.cs: [150](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/MembersController.cs# L150)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/MembersController.cs: [150](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/MembersController.cs# L150)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [855](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L855)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/ProviderUsersController.cs: [188](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/ProviderUsersController.cs# L188)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [570](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L570)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: [260](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/GroupsController.cs# L260)
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: [375](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/CollectionsController.cs# L375)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [841](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L841)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [217](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L217)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [193](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L193)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/ProviderUsersController.cs: [175](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/ProviderUsersController.cs# L175)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [283](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L283)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [261](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L261)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [928](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L928)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [174](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L174)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [357](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L357)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [301](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L301)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [920](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L920)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [778](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L778)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [1130](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L1130)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [568](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L568)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [861](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L861)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/GroupsController.cs: [133](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/GroupsController.cs# L133)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [403](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L403)
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: [411](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/CollectionsController.cs# L411)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [1047](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L1047)
MEDIUM CSRF /src/Admin/AdminConsole/Controllers/OrganizationsController.cs: [334](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Admin/AdminConsole/Controllers/OrganizationsController.cs# L334)
MEDIUM CSRF /src/Admin/AdminConsole/Controllers/ProvidersController.cs: [243](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Admin/AdminConsole/Controllers/ProvidersController.cs# L243)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [1047](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L1047)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [816](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L816)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [770](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L770)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: [81](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/GroupsController.cs# L81)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: [118](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/GroupsController.cs# L118)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationsController.cs: [118](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationsController.cs# L118)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationsController.cs: [315](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationsController.cs# L315)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/OrganizationController.cs: [42](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/OrganizationController.cs# L42)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [87](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L87)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [1096](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L1096)
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: [303](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/CollectionsController.cs# L303)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [1150](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L1150)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [657](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L657)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [657](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L657)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationsController.cs: [315](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationsController.cs# L315)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationsController.cs: [315](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationsController.cs# L315)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [222](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L222)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [570](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L570)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [308](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L308)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [193](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L193)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [261](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L261)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationsController.cs: [315](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationsController.cs# L315)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [583](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L583)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [583](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L583)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [301](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L301)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/MembersController.cs: [187](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/MembersController.cs# L187)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [752](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L752)
MEDIUM CSRF /src/Api/Auth/Controllers/TwoFactorController.cs: [403](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/TwoFactorController.cs# L403)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [526](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L526)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationsController.cs: [315](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationsController.cs# L315)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [144](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L144)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [233](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L233)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [315](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L315)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: [333](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/OrganizationUsersController.cs# L333)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/ProviderOrganizationsController.cs: [48](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/ProviderOrganizationsController.cs# L48)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/OrganizationController.cs: [42](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/OrganizationController.cs# L42)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [1096](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L1096)
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/OrganizationController.cs: [42](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Public/Controllers/OrganizationController.cs# L42)
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: [961](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Vault/Controllers/CiphersController.cs# L961)
MEDIUM CSRF /src/Api/Controllers/SettingsController.cs: [36](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/SettingsController.cs# L36)
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: [375](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Controllers/CollectionsController.cs# L375)
MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: [277](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/AdminConsole/Controllers/GroupsController.cs# L277)
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: [515](https://github.com/bitwarden/server/blob/ac/ac-292/public-api---configure-custom-permission-v2//src/Api/Auth/Controllers/AccountsController.cs# L515)
MEDIUM CSRF

More results are available on AST platform

@eliykat eliykat marked this pull request as ready for review May 7, 2024 03:58
@eliykat eliykat requested a review from a team as a code owner May 7, 2024 03:58
Copy link
Contributor

@r-tome r-tome left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Everything looks great to me! I noticed we don't have integration tests for the public MembersController. Is it feasible to add tests on this PR for the Post action?

@eliykat eliykat requested a review from a team as a code owner May 10, 2024 05:59
@eliykat eliykat removed the request for review from a team May 13, 2024 03:58
@eliykat eliykat requested a review from r-tome May 21, 2024 00:12
@eliykat
Copy link
Member Author

eliykat commented May 21, 2024

I had to reapply changes from #4011 in the last merge commit. PostUserCommand now sets invite.AccessSecretsManager rather than adding another parameter to the invite user method. @r-tome please just look at that carefully in your review to ensure I've maintained that fix.

@eliykat eliykat removed the request for review from vincentsalucci May 21, 2024 00:28
r-tome
r-tome previously approved these changes May 21, 2024
Copy link
Contributor

@r-tome r-tome left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Excellent work on these integration tests!
Suggestion: on the teardown we could delete the inserted data

@eliykat
Copy link
Member Author

eliykat commented May 22, 2024

All test data is created with unique GUIDS, I think deleting data from the database would just make the tests run longer (and integration tests are already slow).

I fixed a bug where it was checking the OrganizationUserType before the transitional logic for deprecated permissions. Now it checks it after the user type is translated, so if a custom user is being mapped to a regular User, it won't return a permissions object.

@eliykat eliykat requested a review from r-tome May 22, 2024 23:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants