Add support for Emergency Access (#1000)

* Add support for Emergency Access

* Add migration script

* Review comments

* Ensure grantor has premium when inviting new grantees.

* Resolve review comments

* Remove two factor references

src/Api/Controllers/EmergencyAccessController.cs

@@ -0,0 +1,157 @@
+using System;
+using System.Linq;
+using System.Threading.Tasks;
+using Bit.Core.Exceptions;
+using Bit.Core.Models.Api;
+using Bit.Core.Models.Api.Request;
+using Bit.Core.Models.Api.Response;
+using Bit.Core.Repositories;
+using Bit.Core.Services;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace Bit.Api.Controllers
+{
+    [Route("emergency-access")]
+    [Authorize("Application")]
+    public class EmergencyAccessController : Controller
+    {
+        private readonly IUserService _userService;
+        private readonly IEmergencyAccessRepository _emergencyAccessRepository;
+        private readonly IEmergencyAccessService _emergencyAccessService;
+
+        public EmergencyAccessController(
+            IUserService userService,
+            IEmergencyAccessRepository emergencyAccessRepository,
+            IEmergencyAccessService emergencyAccessService)
+        {
+            _userService = userService;
+            _emergencyAccessRepository = emergencyAccessRepository;
+            _emergencyAccessService = emergencyAccessService;
+        }
+
+        [HttpGet("trusted")]
+        public async Task<ListResponseModel<EmergencyAccessGranteeDetailsResponseModel>> GetContacts()
+        {
+            var userId = _userService.GetProperUserId(User);
+            var granteeDetails = await _emergencyAccessRepository.GetManyDetailsByGrantorIdAsync(userId.Value);
+
+            var responses = granteeDetails.Select(d =>
+                new EmergencyAccessGranteeDetailsResponseModel(d));
+
+            return new ListResponseModel<EmergencyAccessGranteeDetailsResponseModel>(responses);
+        }
+
+        [HttpGet("granted")]
+        public async Task<ListResponseModel<EmergencyAccessGrantorDetailsResponseModel>> GetGrantees()
+        {
+            var userId = _userService.GetProperUserId(User);
+            var granteeDetails = await _emergencyAccessRepository.GetManyDetailsByGranteeIdAsync(userId.Value);
+
+            var responses = granteeDetails.Select(d => new EmergencyAccessGrantorDetailsResponseModel(d));
+
+            return new ListResponseModel<EmergencyAccessGrantorDetailsResponseModel>(responses);
+        }
+
+        [HttpGet("{id}")]
+        public async Task<EmergencyAccessGranteeDetailsResponseModel> Get(string id)
+        {
+            var userId = _userService.GetProperUserId(User);
+            var result = await _emergencyAccessService.GetAsync(new Guid(id), userId.Value);
+            return new EmergencyAccessGranteeDetailsResponseModel(result);
+        }
+        
+        [HttpPut("{id}")]
+        [HttpPost("{id}")]
+        public async Task Put(string id, [FromBody]EmergencyAccessUpdateRequestModel model)
+        {
+            var emergencyAccess = await _emergencyAccessRepository.GetByIdAsync(new Guid(id));
+            if (emergencyAccess == null)
+            {
+                throw new NotFoundException();
+            }
+
+            var userId = _userService.GetProperUserId(User);
+            await _emergencyAccessService.SaveAsync(model.ToEmergencyAccess(emergencyAccess), userId.Value);
+        }
+        
+        [HttpDelete("{id}")]
+        [HttpPost("{id}/delete")]
+        public async Task Delete(string id)
+        {
+            var userId = _userService.GetProperUserId(User);
+            await _emergencyAccessService.DeleteAsync(new Guid(id), userId.Value);
+        }
+        
+        [HttpPost("invite")]
+        public async Task Invite([FromBody] EmergencyAccessInviteRequestModel model)
+        {
+            var user = await _userService.GetUserByPrincipalAsync(User);
+            await _emergencyAccessService.InviteAsync(user, user.Name, model.Email, model.Type.Value, model.WaitTimeDays);
+        }
+
+        [HttpPost("{id}/reinvite")]
+        public async Task Reinvite(string id)
+        {
+            var user = await _userService.GetUserByPrincipalAsync(User);
+            await _emergencyAccessService.ResendInviteAsync(user.Id, new Guid(id), user.Name);
+        }
+
+        [HttpPost("{id}/accept")]
+        public async Task Accept(string id, [FromBody] OrganizationUserAcceptRequestModel model)
+        {
+            var user = await _userService.GetUserByPrincipalAsync(User);
+            await _emergencyAccessService.AcceptUserAsync(new Guid(id), user, model.Token, _userService);
+        }
+
+        [HttpPost("{id}/confirm")]
+        public async Task Confirm(string id, [FromBody] OrganizationUserConfirmRequestModel model)
+        {
+            var userId = _userService.GetProperUserId(User);
+            await _emergencyAccessService.ConfirmUserAsync(new Guid(id), model.Key, userId.Value);
+        }
+
+        [HttpPost("{id}/initiate")]
+        public async Task Initiate(string id)
+        {
+            var user = await _userService.GetUserByPrincipalAsync(User);
+            await _emergencyAccessService.InitiateAsync(new Guid(id), user);
+        }
+
+        [HttpPost("{id}/approve")]
+        public async Task Accept(string id)
+        {
+            var user = await _userService.GetUserByPrincipalAsync(User);
+            await _emergencyAccessService.ApproveAsync(new Guid(id), user);
+        }
+        
+        [HttpPost("{id}/reject")]
+        public async Task Reject(string id)
+        {
+            var user = await _userService.GetUserByPrincipalAsync(User);
+            await _emergencyAccessService.RejectAsync(new Guid(id), user);
+        }
+
+        [HttpPost("{id}/takeover")]
+        public async Task<EmergencyAccessTakeoverResponseModel> Takeover(string id)
+        {
+            var user = await _userService.GetUserByPrincipalAsync(User);
+            var (result, grantor) = await _emergencyAccessService.TakeoverAsync(new Guid(id), user);
+            return new EmergencyAccessTakeoverResponseModel(result, grantor);
+        }
+        
+        [HttpPost("{id}/password")]
+        public async Task Password(string id, [FromBody] EmergencyAccessPasswordRequestModel model)
+        {
+            var user = await _userService.GetUserByPrincipalAsync(User);
+            await _emergencyAccessService.PasswordAsync(new Guid(id), user, model.NewMasterPasswordHash, model.Key);
+        }
+        
+        [HttpPost("{id}/view")]
+        public async Task<EmergencyAccessViewResponseModel> ViewCiphers(string id)
+        {
+            var user = await _userService.GetUserByPrincipalAsync(User);
+            return await _emergencyAccessService.ViewAsync(new Guid(id), user);
+        }
+    }
+}

src/Api/Jobs/EmergencyAccessNotificationJob.cs

@@ -0,0 +1,27 @@
+using System.Threading.Tasks;
+using Bit.Core.Jobs;
+using Bit.Core.Services;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Quartz;
+
+namespace Bit.Api.Jobs
+{
+    public class EmergencyAccessNotificationJob : BaseJob
+    {
+        private readonly IServiceScopeFactory _serviceScopeFactory;
+
+        public EmergencyAccessNotificationJob(IServiceScopeFactory serviceScopeFactory, ILogger<EmergencyAccessNotificationJob> logger)
+            : base(logger)
+        {
+            _serviceScopeFactory = serviceScopeFactory;
+        }
+
+        protected override async Task ExecuteJobAsync(IJobExecutionContext context)
+        {
+            using var scope = _serviceScopeFactory.CreateScope();
+            var emergencyAccessService = scope.ServiceProvider.GetService(typeof(IEmergencyAccessService)) as IEmergencyAccessService;
+            await emergencyAccessService.SendNotificationsAsync();
+        }
+    }
+}

src/Api/Jobs/EmergencyAccessTimeoutJob.cs

@@ -0,0 +1,27 @@
+using System.Threading.Tasks;
+using Bit.Core.Jobs;
+using Bit.Core.Services;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Quartz;
+
+namespace Bit.Api.Jobs
+{
+    public class EmergencyAccessTimeoutJob : BaseJob
+    {
+        private readonly IServiceScopeFactory _serviceScopeFactory;
+
+        public EmergencyAccessTimeoutJob(IServiceScopeFactory serviceScopeFactory, ILogger<EmergencyAccessNotificationJob> logger)
+            : base(logger)
+        {
+            _serviceScopeFactory = serviceScopeFactory;
+        }
+
+        protected override async Task ExecuteJobAsync(IJobExecutionContext context)
+        {
+            using var scope = _serviceScopeFactory.CreateScope();
+            var emergencyAccessService = scope.ServiceProvider.GetService(typeof(IEmergencyAccessService)) as IEmergencyAccessService;
+            await emergencyAccessService.HandleTimedOutRequestsAsync();
+        }
+    }
+}

src/Api/Jobs/JobsHostedService.cs

@@ -23,6 +23,14 @@ namespace Bit.Api.Jobs
                 .StartNow()
                 .WithCronSchedule("0 0 * * * ?")
                 .Build();
+            var emergencyAccessNotificationTrigger = TriggerBuilder.Create()
+                .StartNow()
+                .WithCronSchedule("0 * * * * ?")
+                .Build();
+            var emergencyAccessTimeoutTrigger  = TriggerBuilder.Create()
+                .StartNow()
+                .WithCronSchedule("0 * * * * ?")
+                .Build();
             var everyTopOfTheSixthHourTrigger = TriggerBuilder.Create()
                 .StartNow()
                 .WithCronSchedule("0 0 */6 * * ?")
@@ -35,6 +43,8 @@ namespace Bit.Api.Jobs
             Jobs = new List<Tuple<Type, ITrigger>>
             {
                 new Tuple<Type, ITrigger>(typeof(AliveJob), everyTopOfTheHourTrigger),
+                new Tuple<Type, ITrigger>(typeof(EmergencyAccessNotificationJob), emergencyAccessNotificationTrigger),
+                new Tuple<Type, ITrigger>(typeof(EmergencyAccessTimeoutJob), emergencyAccessTimeoutTrigger),
                 new Tuple<Type, ITrigger>(typeof(ValidateUsersJob), everyTopOfTheSixthHourTrigger),
                 new Tuple<Type, ITrigger>(typeof(ValidateOrganizationsJob), everyTwelfthHourAndThirtyMinutesTrigger)
             };
@@ -45,6 +55,8 @@ namespace Bit.Api.Jobs
         public static void AddJobsServices(IServiceCollection services)
         {
             services.AddTransient<AliveJob>();
+            services.AddTransient<EmergencyAccessNotificationJob>();
+            services.AddTransient<EmergencyAccessTimeoutJob>();
             services.AddTransient<ValidateUsersJob>();
             services.AddTransient<ValidateOrganizationsJob>();
         }

src/Api/Startup.cs

@@ -126,6 +126,8 @@ namespace Bit.Api
             });
 
             services.AddSwagger(globalSettings);
+            Jobs.JobsHostedService.AddJobsServices(services);
+            services.AddHostedService<Jobs.JobsHostedService>();
 
             if (globalSettings.SelfHosted)
             {