From 0be40d1bd9d35627f8156df6897a36535c7ae9ab Mon Sep 17 00:00:00 2001 From: Alex Morask <144709477+amorask-bitwarden@users.noreply.github.com> Date: Mon, 20 May 2024 10:22:16 -0400 Subject: [PATCH] [AC-2489] Resolve SM Standalone issues with SCIM & Directory Connector (#4011) * Add auto-scale support to standalone SM for SCIM * Mark users for SM when using SM Stadalone with Directory Connector --- bitwarden_license/src/Scim/Users/PostUserCommand.cs | 13 ++++++++++++- .../test/Scim.Test/Users/PostUserCommandTests.cs | 13 +++++++++---- .../AdminConsole/Services/IOrganizationService.cs | 2 +- .../Services/Implementations/OrganizationService.cs | 12 ++++++++---- src/Core/Services/IPaymentService.cs | 1 + .../Implementations/StripePaymentService.cs | 12 ++++++++++++ 6 files changed, 43 insertions(+), 10 deletions(-) diff --git a/bitwarden_license/src/Scim/Users/PostUserCommand.cs b/bitwarden_license/src/Scim/Users/PostUserCommand.cs index 920ca6c77b..a96633e013 100644 --- a/bitwarden_license/src/Scim/Users/PostUserCommand.cs +++ b/bitwarden_license/src/Scim/Users/PostUserCommand.cs @@ -14,17 +14,23 @@ namespace Bit.Scim.Users; public class PostUserCommand : IPostUserCommand { + private readonly IOrganizationRepository _organizationRepository; private readonly IOrganizationUserRepository _organizationUserRepository; private readonly IOrganizationService _organizationService; + private readonly IPaymentService _paymentService; private readonly IScimContext _scimContext; public PostUserCommand( + IOrganizationRepository organizationRepository, IOrganizationUserRepository organizationUserRepository, IOrganizationService organizationService, + IPaymentService paymentService, IScimContext scimContext) { + _organizationRepository = organizationRepository; _organizationUserRepository = organizationUserRepository; _organizationService = organizationService; + _paymentService = paymentService; _scimContext = scimContext; } @@ -80,8 +86,13 @@ public class PostUserCommand : IPostUserCommand throw new ConflictException(); } + var organization = await _organizationRepository.GetByIdAsync(organizationId); + + var hasStandaloneSecretsManager = await _paymentService.HasSecretsManagerStandalone(organization); + var invitedOrgUser = await _organizationService.InviteUserAsync(organizationId, EventSystemUser.SCIM, email, - OrganizationUserType.User, false, externalId, new List(), new List()); + OrganizationUserType.User, false, externalId, new List(), new List(), hasStandaloneSecretsManager); + var orgUser = await _organizationUserRepository.GetDetailsByIdAsync(invitedOrgUser.Id); return orgUser; diff --git a/bitwarden_license/test/Scim.Test/Users/PostUserCommandTests.cs b/bitwarden_license/test/Scim.Test/Users/PostUserCommandTests.cs index 304a290709..4c67f0173e 100644 --- a/bitwarden_license/test/Scim.Test/Users/PostUserCommandTests.cs +++ b/bitwarden_license/test/Scim.Test/Users/PostUserCommandTests.cs @@ -1,4 +1,5 @@ -using Bit.Core.Enums; +using Bit.Core.AdminConsole.Entities; +using Bit.Core.Enums; using Bit.Core.Exceptions; using Bit.Core.Models.Data; using Bit.Core.Models.Data.Organizations.OrganizationUsers; @@ -19,7 +20,7 @@ public class PostUserCommandTests { [Theory] [BitAutoData] - public async Task PostUser_Success(SutProvider sutProvider, string externalId, Guid organizationId, List emails, ICollection organizationUsers, Core.Entities.OrganizationUser newUser) + public async Task PostUser_Success(SutProvider sutProvider, string externalId, Guid organizationId, List emails, ICollection organizationUsers, Core.Entities.OrganizationUser newUser, Organization organization) { var scimUserRequestModel = new ScimUserRequestModel { @@ -33,16 +34,20 @@ public class PostUserCommandTests .GetManyDetailsByOrganizationAsync(organizationId) .Returns(organizationUsers); + sutProvider.GetDependency().GetByIdAsync(organizationId).Returns(organization); + + sutProvider.GetDependency().HasSecretsManagerStandalone(organization).Returns(true); + sutProvider.GetDependency() .InviteUserAsync(organizationId, EventSystemUser.SCIM, scimUserRequestModel.PrimaryEmail.ToLowerInvariant(), OrganizationUserType.User, false, externalId, Arg.Any>(), - Arg.Any>()) + Arg.Any>(), true) .Returns(newUser); var user = await sutProvider.Sut.PostUserAsync(organizationId, scimUserRequestModel); await sutProvider.GetDependency().Received(1).InviteUserAsync(organizationId, EventSystemUser.SCIM, scimUserRequestModel.PrimaryEmail.ToLowerInvariant(), - OrganizationUserType.User, false, scimUserRequestModel.ExternalId, Arg.Any>(), Arg.Any>()); + OrganizationUserType.User, false, scimUserRequestModel.ExternalId, Arg.Any>(), Arg.Any>(), true); await sutProvider.GetDependency().Received(1).GetDetailsByIdAsync(newUser.Id); } diff --git a/src/Core/AdminConsole/Services/IOrganizationService.cs b/src/Core/AdminConsole/Services/IOrganizationService.cs index 32e3ca0ef1..86611bdd5d 100644 --- a/src/Core/AdminConsole/Services/IOrganizationService.cs +++ b/src/Core/AdminConsole/Services/IOrganizationService.cs @@ -49,7 +49,7 @@ public interface IOrganizationService Task InviteUserAsync(Guid organizationId, Guid? invitingUserId, string email, OrganizationUserType type, bool accessAll, string externalId, ICollection collections, IEnumerable groups); Task InviteUserAsync(Guid organizationId, EventSystemUser systemUser, string email, - OrganizationUserType type, bool accessAll, string externalId, IEnumerable collections, IEnumerable groups); + OrganizationUserType type, bool accessAll, string externalId, IEnumerable collections, IEnumerable groups, bool accessSecretsManager); Task>> ResendInvitesAsync(Guid organizationId, Guid? invitingUserId, IEnumerable organizationUsersId); Task ResendInviteAsync(Guid organizationId, Guid? invitingUserId, Guid organizationUserId, bool initOrganization = false); Task ConfirmUserAsync(Guid organizationId, Guid organizationUserId, string key, diff --git a/src/Core/AdminConsole/Services/Implementations/OrganizationService.cs b/src/Core/AdminConsole/Services/Implementations/OrganizationService.cs index b4a243d706..8bf86a8eee 100644 --- a/src/Core/AdminConsole/Services/Implementations/OrganizationService.cs +++ b/src/Core/AdminConsole/Services/Implementations/OrganizationService.cs @@ -1679,14 +1679,14 @@ public class OrganizationService : IOrganizationService public async Task InviteUserAsync(Guid organizationId, EventSystemUser systemUser, string email, OrganizationUserType type, bool accessAll, string externalId, IEnumerable collections, - IEnumerable groups) + IEnumerable groups, bool accessSecretsManager) { // Collection associations validation not required as they are always an empty list - created via system user (scim) - return await SaveUserSendInviteAsync(organizationId, invitingUserId: null, systemUser, email, type, accessAll, externalId, collections, groups); + return await SaveUserSendInviteAsync(organizationId, invitingUserId: null, systemUser, email, type, accessAll, externalId, collections, groups, accessSecretsManager); } private async Task SaveUserSendInviteAsync(Guid organizationId, Guid? invitingUserId, EventSystemUser? systemUser, string email, - OrganizationUserType type, bool accessAll, string externalId, IEnumerable collections, IEnumerable groups) + OrganizationUserType type, bool accessAll, string externalId, IEnumerable collections, IEnumerable groups, bool accessSecretsManager = false) { var invite = new OrganizationUserInvite() { @@ -1694,7 +1694,8 @@ public class OrganizationService : IOrganizationService Type = type, AccessAll = accessAll, Collections = collections, - Groups = groups + Groups = groups, + AccessSecretsManager = accessSecretsManager }; var results = systemUser.HasValue ? await InviteUsersAsync(organizationId, systemUser.Value, new (OrganizationUserInvite, string)[] { (invite, externalId) }) : await InviteUsersAsync(organizationId, invitingUserId, @@ -1793,6 +1794,8 @@ public class OrganizationService : IOrganizationService enoughSeatsAvailable = seatsAvailable >= usersToAdd.Count; } + var hasStandaloneSecretsManager = await _paymentService.HasSecretsManagerStandalone(organization); + var userInvites = new List<(OrganizationUserInvite, string)>(); foreach (var user in newUsers) { @@ -1809,6 +1812,7 @@ public class OrganizationService : IOrganizationService Type = OrganizationUserType.User, AccessAll = false, Collections = new List(), + AccessSecretsManager = hasStandaloneSecretsManager }; userInvites.Add((invite, user.ExternalId)); } diff --git a/src/Core/Services/IPaymentService.cs b/src/Core/Services/IPaymentService.cs index e0d2e95dc9..3c78c585f9 100644 --- a/src/Core/Services/IPaymentService.cs +++ b/src/Core/Services/IPaymentService.cs @@ -57,4 +57,5 @@ public interface IPaymentService Task AddSecretsManagerToSubscription(Organization org, Plan plan, int additionalSmSeats, int additionalServiceAccount, DateTime? prorationDate = null); Task RisksSubscriptionFailure(Organization organization); + Task HasSecretsManagerStandalone(Organization organization); } diff --git a/src/Core/Services/Implementations/StripePaymentService.cs b/src/Core/Services/Implementations/StripePaymentService.cs index a0ab2378be..cc2bee06bb 100644 --- a/src/Core/Services/Implementations/StripePaymentService.cs +++ b/src/Core/Services/Implementations/StripePaymentService.cs @@ -1800,6 +1800,18 @@ public class StripePaymentService : IPaymentService return paymentSource == null; } + public async Task HasSecretsManagerStandalone(Organization organization) + { + if (string.IsNullOrEmpty(organization.GatewayCustomerId)) + { + return false; + } + + var customer = await _stripeAdapter.CustomerGetAsync(organization.GatewayCustomerId); + + return customer?.Discount?.Coupon?.Id == SecretsManagerStandaloneDiscountId; + } + private PaymentMethod GetLatestCardPaymentMethod(string customerId) { var cardPaymentMethods = _stripeAdapter.PaymentMethodListAutoPaging(