[SM-919] Add project people access policy management endpoints (#3285)

* Expose access policy discriminators

* Add people policy model and auth handler

* Add unit tests for authz handler

* Add people policies support in repo

* Add new endpoints and request/response models

* Update tests

src/Api/SecretsManager/Controllers/AccessPoliciesController.cs

@@ -1,11 +1,9 @@
 using Bit.Api.Models.Response;
 using Bit.Api.SecretsManager.Models.Request;
 using Bit.Api.SecretsManager.Models.Response;
-using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Context;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;
-using Bit.Core.Repositories;
 using Bit.Core.SecretsManager.AuthorizationRequirements;
 using Bit.Core.SecretsManager.Commands.AccessPolicies.Interfaces;
 using Bit.Core.SecretsManager.Entities;
@@ -25,8 +23,6 @@ public class AccessPoliciesController : Controller
     private readonly ICreateAccessPoliciesCommand _createAccessPoliciesCommand;
     private readonly ICurrentContext _currentContext;
     private readonly IDeleteAccessPolicyCommand _deleteAccessPolicyCommand;
-    private readonly IGroupRepository _groupRepository;
-    private readonly IOrganizationUserRepository _organizationUserRepository;
     private readonly IProjectRepository _projectRepository;
     private readonly IServiceAccountRepository _serviceAccountRepository;
     private readonly IUpdateAccessPolicyCommand _updateAccessPolicyCommand;
@@ -39,9 +35,7 @@ public class AccessPoliciesController : Controller
         ICurrentContext currentContext,
         IAccessPolicyRepository accessPolicyRepository,
         IServiceAccountRepository serviceAccountRepository,
-        IGroupRepository groupRepository,
         IProjectRepository projectRepository,
-        IOrganizationUserRepository organizationUserRepository,
         ICreateAccessPoliciesCommand createAccessPoliciesCommand,
         IDeleteAccessPolicyCommand deleteAccessPolicyCommand,
         IUpdateAccessPolicyCommand updateAccessPolicyCommand)
@@ -51,8 +45,6 @@ public class AccessPoliciesController : Controller
         _currentContext = currentContext;
         _serviceAccountRepository = serviceAccountRepository;
         _projectRepository = projectRepository;
-        _groupRepository = groupRepository;
-        _organizationUserRepository = organizationUserRepository;
         _accessPolicyRepository = accessPolicyRepository;
         _createAccessPoliciesCommand = createAccessPoliciesCommand;
         _deleteAccessPolicyCommand = deleteAccessPolicyCommand;
@@ -243,15 +235,11 @@ public class AccessPoliciesController : Controller
             throw new NotFoundException();
         }
 
-        var groups = await _groupRepository.GetManyByOrganizationIdAsync(id);
-        var groupResponses = groups.Select(g => new PotentialGranteeResponseModel(g));
-
-        var organizationUsers =
-            await _organizationUserRepository.GetManyDetailsByOrganizationAsync(id);
-        var userResponses = organizationUsers
-            .Where(user => user.AccessSecretsManager && user.Status == OrganizationUserStatusType.Confirmed)
-            .Select(userDetails => new PotentialGranteeResponseModel(userDetails));
+        var userId = _userService.GetProperUserId(User).Value;
+        var peopleGrantees = await _accessPolicyRepository.GetPeopleGranteesAsync(id, userId);
 
+        var userResponses = peopleGrantees.UserGrantees.Select(ug => new PotentialGranteeResponseModel(ug));
+        var groupResponses = peopleGrantees.GroupGrantees.Select(g => new PotentialGranteeResponseModel(g));
         return new ListResponseModel<PotentialGranteeResponseModel>(userResponses.Concat(groupResponses));
     }
 
@@ -287,6 +275,40 @@ public class AccessPoliciesController : Controller
         return new ListResponseModel<PotentialGranteeResponseModel>(projectResponses);
     }
 
+    [HttpGet("/projects/{id}/access-policies/people")]
+    public async Task<ProjectPeopleAccessPoliciesResponseModel> GetProjectPeopleAccessPoliciesAsync([FromRoute] Guid id)
+    {
+        var project = await _projectRepository.GetByIdAsync(id);
+        var (_, userId) = await CheckUserHasWriteAccessToProjectAsync(project);
+        var results = await _accessPolicyRepository.GetPeoplePoliciesByGrantedProjectIdAsync(id, userId);
+        return new ProjectPeopleAccessPoliciesResponseModel(results, userId);
+    }
+
+    [HttpPut("/projects/{id}/access-policies/people")]
+    public async Task<ProjectPeopleAccessPoliciesResponseModel> PutProjectPeopleAccessPoliciesAsync([FromRoute] Guid id,
+        [FromBody] PeopleAccessPoliciesRequestModel request)
+    {
+        var project = await _projectRepository.GetByIdAsync(id);
+        if (project == null)
+        {
+            throw new NotFoundException();
+        }
+
+        var peopleAccessPolicies = request.ToProjectPeopleAccessPolicies(id, project.OrganizationId);
+
+        var authorizationResult = await _authorizationService.AuthorizeAsync(User, peopleAccessPolicies,
+            ProjectPeopleAccessPoliciesOperations.Replace);
+        if (!authorizationResult.Succeeded)
+        {
+            throw new NotFoundException();
+        }
+
+        var userId = _userService.GetProperUserId(User).Value;
+        var results = await _accessPolicyRepository.ReplaceProjectPeopleAsync(peopleAccessPolicies, userId);
+        return new ProjectPeopleAccessPoliciesResponseModel(results, userId);
+    }
+
+
     private async Task<(AccessClientType AccessClientType, Guid UserId)> CheckUserHasWriteAccessToProjectAsync(Project project)
     {
         if (project == null)

src/Api/SecretsManager/Models/Request/PeopleAccessPoliciesRequestModel.cs

@@ -0,0 +1,64 @@
+using Bit.Core.Exceptions;
+using Bit.Core.SecretsManager.Entities;
+using Bit.Core.SecretsManager.Models.Data;
+
+namespace Bit.Api.SecretsManager.Models.Request;
+
+public class PeopleAccessPoliciesRequestModel
+{
+    public IEnumerable<AccessPolicyRequest> UserAccessPolicyRequests { get; set; }
+
+    public IEnumerable<AccessPolicyRequest> GroupAccessPolicyRequests { get; set; }
+
+    private static void CheckForDistinctAccessPolicies(IReadOnlyCollection<BaseAccessPolicy> accessPolicies)
+    {
+        var distinctAccessPolicies = accessPolicies.DistinctBy(baseAccessPolicy =>
+        {
+            return baseAccessPolicy switch
+            {
+                UserProjectAccessPolicy ap => new Tuple<Guid?, Guid?>(ap.OrganizationUserId, ap.GrantedProjectId),
+                GroupProjectAccessPolicy ap => new Tuple<Guid?, Guid?>(ap.GroupId, ap.GrantedProjectId),
+                ServiceAccountProjectAccessPolicy ap => new Tuple<Guid?, Guid?>(ap.ServiceAccountId,
+                    ap.GrantedProjectId),
+                UserServiceAccountAccessPolicy ap => new Tuple<Guid?, Guid?>(ap.OrganizationUserId,
+                    ap.GrantedServiceAccountId),
+                GroupServiceAccountAccessPolicy ap => new Tuple<Guid?, Guid?>(ap.GroupId, ap.GrantedServiceAccountId),
+                _ => throw new ArgumentException("Unsupported access policy type provided.", nameof(baseAccessPolicy))
+            };
+        }).ToList();
+
+        if (accessPolicies.Count != distinctAccessPolicies.Count)
+        {
+            throw new BadRequestException("Resources must be unique");
+        }
+    }
+
+    public ProjectPeopleAccessPolicies ToProjectPeopleAccessPolicies(Guid grantedProjectId, Guid organizationId)
+    {
+        var userAccessPolicies = UserAccessPolicyRequests?
+            .Select(x => x.ToUserProjectAccessPolicy(grantedProjectId, organizationId)).ToList();
+
+        var groupAccessPolicies = GroupAccessPolicyRequests?
+            .Select(x => x.ToGroupProjectAccessPolicy(grantedProjectId, organizationId)).ToList();
+        var policies = new List<BaseAccessPolicy>();
+        if (userAccessPolicies != null)
+        {
+            policies.AddRange(userAccessPolicies);
+        }
+
+        if (groupAccessPolicies != null)
+        {
+            policies.AddRange(groupAccessPolicies);
+        }
+
+        CheckForDistinctAccessPolicies(policies);
+
+        return new ProjectPeopleAccessPolicies
+        {
+            Id = grantedProjectId,
+            OrganizationId = organizationId,
+            UserAccessPolicies = userAccessPolicies,
+            GroupAccessPolicies = groupAccessPolicies
+        };
+    }
+}

src/Api/SecretsManager/Models/Response/AccessPolicyResponseModel.cs

@@ -34,10 +34,13 @@ public class UserProjectAccessPolicyResponseModel : BaseAccessPolicyResponseMode
 
     public UserProjectAccessPolicyResponseModel(UserProjectAccessPolicy accessPolicy) : base(accessPolicy, _objectName)
     {
-        OrganizationUserId = accessPolicy.OrganizationUserId;
-        GrantedProjectId = accessPolicy.GrantedProjectId;
-        OrganizationUserName = GetUserDisplayName(accessPolicy.User);
-        UserId = accessPolicy.User?.Id;
+        SetProperties(accessPolicy);
+    }
+
+    public UserProjectAccessPolicyResponseModel(UserProjectAccessPolicy accessPolicy, Guid currentUserId) : base(accessPolicy, _objectName)
+    {
+        CurrentUser = currentUserId == accessPolicy.User?.Id;
+        SetProperties(accessPolicy);
     }
 
     public UserProjectAccessPolicyResponseModel() : base(new UserProjectAccessPolicy(), _objectName)
@@ -48,6 +51,15 @@ public class UserProjectAccessPolicyResponseModel : BaseAccessPolicyResponseMode
     public string? OrganizationUserName { get; set; }
     public Guid? UserId { get; set; }
     public Guid? GrantedProjectId { get; set; }
+    public bool? CurrentUser { get; set; }
+
+    private void SetProperties(UserProjectAccessPolicy accessPolicy)
+    {
+        OrganizationUserId = accessPolicy.OrganizationUserId;
+        GrantedProjectId = accessPolicy.GrantedProjectId;
+        OrganizationUserName = GetUserDisplayName(accessPolicy.User);
+        UserId = accessPolicy.User?.Id;
+    }
 }
 
 public class UserServiceAccountAccessPolicyResponseModel : BaseAccessPolicyResponseModel

src/Api/SecretsManager/Models/Response/PotentialGranteeResponseModel.cs

@@ -1,7 +1,6 @@
-using Bit.Core.AdminConsole.Entities;
-using Bit.Core.Models.Api;
-using Bit.Core.Models.Data.Organizations.OrganizationUsers;
+using Bit.Core.Models.Api;
 using Bit.Core.SecretsManager.Entities;
+using Bit.Core.SecretsManager.Models.Data;
 
 namespace Bit.Api.SecretsManager.Models.Response;
 
@@ -9,31 +8,33 @@ public class PotentialGranteeResponseModel : ResponseModel
 {
     private const string _objectName = "potentialGrantee";
 
-    public PotentialGranteeResponseModel(Group group)
+    public PotentialGranteeResponseModel(GroupGrantee grantee)
         : base(_objectName)
     {
-        if (group == null)
+        if (grantee == null)
         {
-            throw new ArgumentNullException(nameof(group));
+            throw new ArgumentNullException(nameof(grantee));
         }
 
-        Id = group.Id;
-        Name = group.Name;
         Type = "group";
+        Id = grantee.GroupId;
+        Name = grantee.Name;
+        CurrentUserInGroup = grantee.CurrentUserInGroup;
     }
 
-    public PotentialGranteeResponseModel(OrganizationUserUserDetails user)
+    public PotentialGranteeResponseModel(UserGrantee grantee)
         : base(_objectName)
     {
-        if (user == null)
+        if (grantee == null)
         {
-            throw new ArgumentNullException(nameof(user));
+            throw new ArgumentNullException(nameof(grantee));
         }
 
-        Id = user.Id;
-        Name = user.Name;
-        Email = user.Email;
         Type = "user";
+        Id = grantee.OrganizationUserId;
+        Name = grantee.Name;
+        Email = grantee.Email;
+        CurrentUser = grantee.CurrentUser;
     }
 
     public PotentialGranteeResponseModel(ServiceAccount serviceAccount)
@@ -67,9 +68,9 @@ public class PotentialGranteeResponseModel : ResponseModel
     }
 
     public Guid Id { get; set; }
-
     public string Name { get; set; }
-
     public string Type { get; set; }
     public string Email { get; set; }
+    public bool CurrentUserInGroup { get; set; }
+    public bool CurrentUser { get; set; }
 }

src/Api/SecretsManager/Models/Response/ProjectPeopleAccessPoliciesResponseModel.cs

@@ -0,0 +1,34 @@
+using Bit.Core.Models.Api;
+using Bit.Core.SecretsManager.Entities;
+
+namespace Bit.Api.SecretsManager.Models.Response;
+
+public class ProjectPeopleAccessPoliciesResponseModel : ResponseModel
+{
+    private const string _objectName = "projectPeopleAccessPolicies";
+
+    public ProjectPeopleAccessPoliciesResponseModel(IEnumerable<BaseAccessPolicy> baseAccessPolicies, Guid userId)
+        : base(_objectName)
+    {
+        foreach (var baseAccessPolicy in baseAccessPolicies)
+        {
+            switch (baseAccessPolicy)
+            {
+                case UserProjectAccessPolicy accessPolicy:
+                    UserAccessPolicies.Add(new UserProjectAccessPolicyResponseModel(accessPolicy, userId));
+                    break;
+                case GroupProjectAccessPolicy accessPolicy:
+                    GroupAccessPolicies.Add(new GroupProjectAccessPolicyResponseModel(accessPolicy));
+                    break;
+            }
+        }
+    }
+
+    public ProjectPeopleAccessPoliciesResponseModel() : base(_objectName)
+    {
+    }
+
+    public List<UserProjectAccessPolicyResponseModel> UserAccessPolicies { get; set; } = new();
+
+    public List<GroupProjectAccessPolicyResponseModel> GroupAccessPolicies { get; set; } = new();
+}

src/Core/SecretsManager/AuthorizationRequirements/ProjectPeopleAccessPoliciesOperationRequirement.cs

@@ -0,0 +1,12 @@
+using Microsoft.AspNetCore.Authorization.Infrastructure;
+
+namespace Bit.Core.SecretsManager.AuthorizationRequirements;
+
+public class ProjectPeopleAccessPoliciesOperationRequirement : OperationAuthorizationRequirement
+{
+}
+
+public static class ProjectPeopleAccessPoliciesOperations
+{
+    public static readonly ProjectPeopleAccessPoliciesOperationRequirement Replace = new() { Name = nameof(Replace) };
+}

src/Core/SecretsManager/Models/Data/PeopleGrantees.cs

@@ -0,0 +1,22 @@
+namespace Bit.Core.SecretsManager.Models.Data;
+
+public class PeopleGrantees
+{
+    public IEnumerable<UserGrantee> UserGrantees { get; set; }
+    public IEnumerable<GroupGrantee> GroupGrantees { get; set; }
+}
+
+public class UserGrantee
+{
+    public Guid OrganizationUserId { get; set; }
+    public string Name { get; set; }
+    public string Email { get; set; }
+    public bool CurrentUser { get; set; }
+}
+
+public class GroupGrantee
+{
+    public Guid GroupId { get; set; }
+    public string Name { get; set; }
+    public bool CurrentUserInGroup { get; set; }
+}

src/Core/SecretsManager/Models/Data/ProjectPeopleAccessPolicies.cs

@@ -0,0 +1,27 @@
+using Bit.Core.SecretsManager.Entities;
+
+namespace Bit.Core.SecretsManager.Models.Data;
+
+public class ProjectPeopleAccessPolicies
+{
+    public Guid Id { get; set; }
+    public Guid OrganizationId { get; set; }
+    public IEnumerable<UserProjectAccessPolicy> UserAccessPolicies { get; set; }
+    public IEnumerable<GroupProjectAccessPolicy> GroupAccessPolicies { get; set; }
+
+    public IEnumerable<BaseAccessPolicy> ToBaseAccessPolicies()
+    {
+        var policies = new List<BaseAccessPolicy>();
+        if (UserAccessPolicies != null && UserAccessPolicies.Any())
+        {
+            policies.AddRange(UserAccessPolicies);
+        }
+
+        if (GroupAccessPolicies != null && GroupAccessPolicies.Any())
+        {
+            policies.AddRange(GroupAccessPolicies);
+        }
+
+        return policies;
+    }
+}

src/Core/SecretsManager/Repositories/IAccessPolicyRepository.cs

@@ -1,6 +1,7 @@
 #nullable enable
 using Bit.Core.Enums;
 using Bit.Core.SecretsManager.Entities;
+using Bit.Core.SecretsManager.Models.Data;
 
 namespace Bit.Core.SecretsManager.Repositories;
 
@@ -15,4 +16,7 @@ public interface IAccessPolicyRepository
         AccessClientType accessType);
     Task ReplaceAsync(BaseAccessPolicy baseAccessPolicy);
     Task DeleteAsync(Guid id);
+    Task<IEnumerable<BaseAccessPolicy>> GetPeoplePoliciesByGrantedProjectIdAsync(Guid id, Guid userId);
+    Task<IEnumerable<BaseAccessPolicy>> ReplaceProjectPeopleAsync(ProjectPeopleAccessPolicies peopleAccessPolicies, Guid userId);
+    Task<PeopleGrantees> GetPeopleGranteesAsync(Guid organizationId, Guid currentUserId);
 }

src/Infrastructure.EntityFramework/SecretsManager/Configurations/AccessPolicyEntityTypeConfiguration.cs

@@ -1,4 +1,5 @@
-using Bit.Infrastructure.EntityFramework.SecretsManager.Models;
+using Bit.Infrastructure.EntityFramework.SecretsManager.Discriminators;
+using Bit.Infrastructure.EntityFramework.SecretsManager.Models;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.EntityFrameworkCore.Metadata.Builders;
 
@@ -10,11 +11,11 @@ public class AccessPolicyEntityTypeConfiguration : IEntityTypeConfiguration<Acce
     {
         builder
             .HasDiscriminator<string>("Discriminator")
-            .HasValue<UserProjectAccessPolicy>("user_project")
-            .HasValue<UserServiceAccountAccessPolicy>("user_service_account")
-            .HasValue<GroupProjectAccessPolicy>("group_project")
-            .HasValue<GroupServiceAccountAccessPolicy>("group_service_account")
-            .HasValue<ServiceAccountProjectAccessPolicy>("service_account_project");
+            .HasValue<UserProjectAccessPolicy>(AccessPolicyDiscriminator.UserProject)
+            .HasValue<UserServiceAccountAccessPolicy>(AccessPolicyDiscriminator.UserServiceAccount)
+            .HasValue<GroupProjectAccessPolicy>(AccessPolicyDiscriminator.GroupProject)
+            .HasValue<GroupServiceAccountAccessPolicy>(AccessPolicyDiscriminator.GroupServiceAccount)
+            .HasValue<ServiceAccountProjectAccessPolicy>(AccessPolicyDiscriminator.ServiceAccountProject);
 
         builder
             .Property(s => s.Id)

src/Infrastructure.EntityFramework/SecretsManager/Discriminators/AccessPolicyDiscriminator.cs

@@ -0,0 +1,11 @@
+namespace Bit.Infrastructure.EntityFramework.SecretsManager.Discriminators;
+
+public static class AccessPolicyDiscriminator
+{
+    public const string UserProject = "user_project";
+    public const string UserServiceAccount = "user_service_account";
+    public const string GroupProject = "group_project";
+    public const string GroupServiceAccount = "group_service_account";
+    public const string ServiceAccountProject = "service_account_project";
+
+}