[AC-2731] Remove AccessAll - Collection and Cipher functions (#4469)

* Remove AccessAll logic from UserCollectionDetails and UserCipherDetails
  and EF equivalents

src/Infrastructure.EntityFramework/Repositories/CollectionRepository.cs

@@ -227,7 +227,7 @@ public class CollectionRepository : Repository<Core.Entities.Collection, Collect
         {
             var dbContext = GetDatabaseContext(scope);
 
-            var baseCollectionQuery = new UserCollectionDetailsQuery(userId, useFlexibleCollections).Run(dbContext);
+            var baseCollectionQuery = new UserCollectionDetailsQuery(userId).Run(dbContext);
 
             if (dbContext.Database.IsSqlite())
             {

src/Infrastructure.EntityFramework/Repositories/Queries/UserCipherDetailsQuery.cs

@@ -8,87 +8,12 @@ namespace Bit.Infrastructure.EntityFramework.Repositories.Queries;
 public class UserCipherDetailsQuery : IQuery<CipherDetails>
 {
     private readonly Guid? _userId;
-    private readonly bool _useFlexibleCollections;
+    public UserCipherDetailsQuery(Guid? userId)
-    public UserCipherDetailsQuery(Guid? userId, bool useFlexibleCollections)
     {
         _userId = userId;
-        _useFlexibleCollections = useFlexibleCollections;
     }
 
     public virtual IQueryable<CipherDetails> Run(DatabaseContext dbContext)
-    {
-        return _useFlexibleCollections
-            ? Run_VNext(dbContext)
-            : Run_VCurrent(dbContext);
-    }
-
-    private IQueryable<CipherDetails> Run_VCurrent(DatabaseContext dbContext)
-    {
-        var query = from c in dbContext.Ciphers
-
-                    join ou in dbContext.OrganizationUsers
-                        on new { CipherUserId = c.UserId, c.OrganizationId, UserId = _userId, Status = OrganizationUserStatusType.Confirmed } equals
-                           new { CipherUserId = (Guid?)null, OrganizationId = (Guid?)ou.OrganizationId, ou.UserId, ou.Status }
-
-                    join o in dbContext.Organizations
-                        on new { c.OrganizationId, OuOrganizationId = ou.OrganizationId, Enabled = true } equals
-                           new { OrganizationId = (Guid?)o.Id, OuOrganizationId = o.Id, o.Enabled }
-
-                    join cc in dbContext.CollectionCiphers
-                        on new { ou.AccessAll, CipherId = c.Id } equals
-                           new { AccessAll = false, cc.CipherId } into cc_g
-                    from cc in cc_g.DefaultIfEmpty()
-
-                    join cu in dbContext.CollectionUsers
-                        on new { cc.CollectionId, OrganizationUserId = ou.Id } equals
-                           new { cu.CollectionId, cu.OrganizationUserId } into cu_g
-                    from cu in cu_g.DefaultIfEmpty()
-
-                    join gu in dbContext.GroupUsers
-                        on new { CollectionId = (Guid?)cu.CollectionId, ou.AccessAll, OrganizationUserId = ou.Id } equals
-                           new { CollectionId = (Guid?)null, AccessAll = false, gu.OrganizationUserId } into gu_g
-                    from gu in gu_g.DefaultIfEmpty()
-
-                    join g in dbContext.Groups
-                        on gu.GroupId equals g.Id into g_g
-                    from g in g_g.DefaultIfEmpty()
-
-                    join cg in dbContext.CollectionGroups
-                        on new { g.AccessAll, cc.CollectionId, gu.GroupId } equals
-                           new { AccessAll = false, cg.CollectionId, cg.GroupId } into cg_g
-                    from cg in cg_g.DefaultIfEmpty()
-
-                    where ou.AccessAll || cu.CollectionId != null || g.AccessAll || cg.CollectionId != null
-
-                    select c;
-
-        var query2 = from c in dbContext.Ciphers
-                     where c.UserId == _userId
-                     select c;
-
-        var union = query.Union(query2).Select(c => new CipherDetails
-        {
-            Id = c.Id,
-            UserId = c.UserId,
-            OrganizationId = c.OrganizationId,
-            Type = c.Type,
-            Data = c.Data,
-            Attachments = c.Attachments,
-            CreationDate = c.CreationDate,
-            RevisionDate = c.RevisionDate,
-            DeletedDate = c.DeletedDate,
-            Favorite = _userId.HasValue && c.Favorites != null && c.Favorites.ToLowerInvariant().Contains($"\"{_userId}\":true"),
-            FolderId = GetFolderId(_userId, c),
-            Edit = true,
-            Reprompt = c.Reprompt,
-            ViewPassword = true,
-            OrganizationUseTotp = false,
-            Key = c.Key
-        });
-        return union;
-    }
-
-    private IQueryable<CipherDetails> Run_VNext(DatabaseContext dbContext)
     {
         var query = from c in dbContext.Ciphers
 

src/Infrastructure.EntityFramework/Repositories/Queries/UserCollectionDetailsQuery.cs

@@ -6,22 +6,13 @@ namespace Bit.Infrastructure.EntityFramework.Repositories.Queries;
 public class UserCollectionDetailsQuery : IQuery<CollectionDetails>
 {
     private readonly Guid? _userId;
-    private readonly bool _useFlexibleCollections;
 
-    public UserCollectionDetailsQuery(Guid? userId, bool useFlexibleCollections)
+    public UserCollectionDetailsQuery(Guid? userId)
     {
         _userId = userId;
-        _useFlexibleCollections = useFlexibleCollections;
     }
 
     public virtual IQueryable<CollectionDetails> Run(DatabaseContext dbContext)
-    {
-        return _useFlexibleCollections
-            ? Run_vNext(dbContext)
-            : Run_vLegacy(dbContext);
-    }
-
-    private IQueryable<CollectionDetails> Run_vNext(DatabaseContext dbContext)
     {
         var query = from c in dbContext.Collections
 
@@ -69,56 +60,4 @@ public class UserCollectionDetailsQuery : IQuery<CollectionDetails>
             Manage = (bool?)x.cu.Manage ?? (bool?)x.cg.Manage ?? false,
         });
     }
-
-    private IQueryable<CollectionDetails> Run_vLegacy(DatabaseContext dbContext)
-    {
-        var query = from c in dbContext.Collections
-
-                    join ou in dbContext.OrganizationUsers
-                        on c.OrganizationId equals ou.OrganizationId
-
-                    join o in dbContext.Organizations
-                        on c.OrganizationId equals o.Id
-
-                    join cu in dbContext.CollectionUsers
-                        on new { ou.AccessAll, CollectionId = c.Id, OrganizationUserId = ou.Id } equals
-                           new { AccessAll = false, cu.CollectionId, cu.OrganizationUserId } into cu_g
-                    from cu in cu_g.DefaultIfEmpty()
-
-                    join gu in dbContext.GroupUsers
-                        on new { CollectionId = (Guid?)cu.CollectionId, ou.AccessAll, OrganizationUserId = ou.Id } equals
-                           new { CollectionId = (Guid?)null, AccessAll = false, gu.OrganizationUserId } into gu_g
-                    from gu in gu_g.DefaultIfEmpty()
-
-                    join g in dbContext.Groups
-                        on gu.GroupId equals g.Id into g_g
-                    from g in g_g.DefaultIfEmpty()
-
-                    join cg in dbContext.CollectionGroups
-                        on new { g.AccessAll, CollectionId = c.Id, gu.GroupId } equals
-                           new { AccessAll = false, cg.CollectionId, cg.GroupId } into cg_g
-                    from cg in cg_g.DefaultIfEmpty()
-
-                    where ou.UserId == _userId &&
-                        ou.Status == OrganizationUserStatusType.Confirmed &&
-                        o.Enabled &&
-                        (ou.AccessAll || cu.CollectionId != null || g.AccessAll || cg.CollectionId != null)
-                    select new { c, ou, o, cu, gu, g, cg };
-
-        return query.Select(x => new CollectionDetails
-        {
-            Id = x.c.Id,
-            OrganizationId = x.c.OrganizationId,
-            Name = x.c.Name,
-            ExternalId = x.c.ExternalId,
-            CreationDate = x.c.CreationDate,
-            RevisionDate = x.c.RevisionDate,
-            ReadOnly = x.ou.AccessAll || x.g.AccessAll ||
-                !((bool?)x.cu.ReadOnly ?? (bool?)x.cg.ReadOnly ?? false) ? false : true,
-            HidePasswords = x.ou.AccessAll || x.g.AccessAll ||
-                !((bool?)x.cu.HidePasswords ?? (bool?)x.cg.HidePasswords ?? false) ? false : true,
-            Manage = x.ou.AccessAll || x.g.AccessAll ||
-                     !((bool?)x.cu.Manage ?? (bool?)x.cg.Manage ?? false) ? false : true,
-        });
-    }
 }

src/Infrastructure.EntityFramework/Vault/Repositories/CipherRepository.cs

@@ -308,7 +308,7 @@ public class CipherRepository : Repository<Core.Vault.Entities.Cipher, Cipher, G
         using (var scope = ServiceScopeFactory.CreateScope())
         {
             var dbContext = GetDatabaseContext(scope);
-            var userCipherDetails = new UserCipherDetailsQuery(userId, false);
+            var userCipherDetails = new UserCipherDetailsQuery(userId);
             var data = await userCipherDetails.Run(dbContext).FirstOrDefaultAsync(c => c.Id == id);
             return data;
         }
@@ -365,7 +365,7 @@ public class CipherRepository : Repository<Core.Vault.Entities.Cipher, Cipher, G
         {
             var dbContext = GetDatabaseContext(scope);
             IQueryable<CipherDetails> cipherDetailsView = withOrganizations ?
-                new UserCipherDetailsQuery(userId, useFlexibleCollections).Run(dbContext) :
+                new UserCipherDetailsQuery(userId).Run(dbContext) :
                 new CipherDetailsQuery(userId).Run(dbContext);
             if (!withOrganizations)
             {
@@ -413,7 +413,7 @@ public class CipherRepository : Repository<Core.Vault.Entities.Cipher, Cipher, G
         {
             var dbContext = GetDatabaseContext(scope);
             var cipherEntities = dbContext.Ciphers.Where(c => ids.Contains(c.Id));
-            var userCipherDetails = new UserCipherDetailsQuery(userId, false).Run(dbContext);
+            var userCipherDetails = new UserCipherDetailsQuery(userId).Run(dbContext);
             var idsToMove = from ucd in userCipherDetails
                             join c in cipherEntities
                                 on ucd.Id equals c.Id
@@ -694,7 +694,7 @@ public class CipherRepository : Repository<Core.Vault.Entities.Cipher, Cipher, G
         using (var scope = ServiceScopeFactory.CreateScope())
         {
             var dbContext = GetDatabaseContext(scope);
-            var userCipherDetailsQuery = new UserCipherDetailsQuery(userId, false);
+            var userCipherDetailsQuery = new UserCipherDetailsQuery(userId);
             var cipherEntitiesToCheck = await (dbContext.Ciphers.Where(c => ids.Contains(c.Id))).ToListAsync();
             var query = from ucd in await (userCipherDetailsQuery.Run(dbContext)).ToListAsync()
                         join c in cipherEntitiesToCheck

src/Sql/Vault/dbo/Functions/UserCipherDetails.sql

@@ -4,8 +4,7 @@ AS RETURN
 WITH [CTE] AS (
     SELECT
         [Id],
-        [OrganizationId],
+        [OrganizationId]
-        [AccessAll]
     FROM
         [OrganizationUser]
     WHERE
@@ -15,20 +14,14 @@ WITH [CTE] AS (
 SELECT
     C.*,
     CASE
-        WHEN
+        WHEN COALESCE(CU.[ReadOnly], CG.[ReadOnly], 0) = 0
-            OU.[AccessAll] = 1
-            OR G.[AccessAll] = 1
-            OR COALESCE(CU.[ReadOnly], CG.[ReadOnly], 0) = 0
         THEN 1
         ELSE 0
     END [Edit],
     CASE
-        WHEN
+    	WHEN COALESCE(CU.[HidePasswords], CG.[HidePasswords], 0) = 0
-            OU.[AccessAll] = 1
+    	THEN 1
-            OR G.[AccessAll] = 1
+    	ELSE 0
-            OR COALESCE(CU.[HidePasswords], CG.[HidePasswords], 0) = 0
-        THEN 1
-        ELSE 0
     END [ViewPassword],
     CASE
         WHEN O.[UseTotp] = 1
@@ -42,19 +35,17 @@ INNER JOIN
 INNER JOIN
     [dbo].[Organization] O ON O.[Id] = OU.[OrganizationId] AND O.[Id] = C.[OrganizationId] AND O.[Enabled] = 1
 LEFT JOIN
-    [dbo].[CollectionCipher] CC ON OU.[AccessAll] = 0 AND CC.[CipherId] = C.[Id]
+    [dbo].[CollectionCipher] CC ON CC.[CipherId] = C.[Id]
 LEFT JOIN
     [dbo].[CollectionUser] CU ON CU.[CollectionId] = CC.[CollectionId] AND CU.[OrganizationUserId] = OU.[Id]
 LEFT JOIN
-    [dbo].[GroupUser] GU ON CU.[CollectionId] IS NULL AND OU.[AccessAll] = 0 AND GU.[OrganizationUserId] = OU.[Id]
+    [dbo].[GroupUser] GU ON CU.[CollectionId] IS NULL AND GU.[OrganizationUserId] = OU.[Id]
 LEFT JOIN
     [dbo].[Group] G ON G.[Id] = GU.[GroupId]
 LEFT JOIN
-    [dbo].[CollectionGroup] CG ON G.[AccessAll] = 0 AND CG.[CollectionId] = CC.[CollectionId] AND CG.[GroupId] = GU.[GroupId]
+    [dbo].[CollectionGroup] CG ON CG.[CollectionId] = CC.[CollectionId] AND CG.[GroupId] = GU.[GroupId]
 WHERE
-    OU.[AccessAll] = 1
+    CU.[CollectionId] IS NOT NULL
-    OR CU.[CollectionId] IS NOT NULL
-    OR G.[AccessAll] = 1
     OR CG.[CollectionId] IS NOT NULL
 
 UNION ALL

src/Sql/dbo/Functions/UserCollectionDetails.sql

@@ -5,25 +5,19 @@ SELECT
     C.*,
     CASE
         WHEN
-            OU.[AccessAll] = 1
+            COALESCE(CU.[ReadOnly], CG.[ReadOnly], 0) = 0
-            OR G.[AccessAll] = 1
-            OR COALESCE(CU.[ReadOnly], CG.[ReadOnly], 0) = 0
         THEN 0
         ELSE 1
     END [ReadOnly],
     CASE
         WHEN
-            OU.[AccessAll] = 1
+            COALESCE(CU.[HidePasswords], CG.[HidePasswords], 0) = 0
-            OR G.[AccessAll] = 1
-            OR COALESCE(CU.[HidePasswords], CG.[HidePasswords], 0) = 0
         THEN 0
         ELSE 1
     END [HidePasswords],
     CASE
         WHEN
-            OU.[AccessAll] = 1
+            COALESCE(CU.[Manage], CG.[Manage], 0) = 0
-            OR G.[AccessAll] = 1
-            OR COALESCE(CU.[Manage], CG.[Manage], 0) = 0
         THEN 0
         ELSE 1
     END [Manage]
@@ -34,20 +28,18 @@ INNER JOIN
 INNER JOIN
     [dbo].[Organization] O ON O.[Id] = C.[OrganizationId]
 LEFT JOIN
-    [dbo].[CollectionUser] CU ON OU.[AccessAll] = 0 AND CU.[CollectionId] = C.[Id] AND CU.[OrganizationUserId] = [OU].[Id]
+    [dbo].[CollectionUser] CU ON CU.[CollectionId] = C.[Id] AND CU.[OrganizationUserId] = [OU].[Id]
 LEFT JOIN
-    [dbo].[GroupUser] GU ON CU.[CollectionId] IS NULL AND OU.[AccessAll] = 0 AND GU.[OrganizationUserId] = OU.[Id]
+    [dbo].[GroupUser] GU ON CU.[CollectionId] IS NULL AND GU.[OrganizationUserId] = OU.[Id]
 LEFT JOIN
     [dbo].[Group] G ON G.[Id] = GU.[GroupId]
 LEFT JOIN
-    [dbo].[CollectionGroup] CG ON G.[AccessAll] = 0 AND CG.[CollectionId] = C.[Id] AND CG.[GroupId] = GU.[GroupId]
+    [dbo].[CollectionGroup] CG ON CG.[CollectionId] = C.[Id] AND CG.[GroupId] = GU.[GroupId]
 WHERE
     OU.[UserId] = @UserId
     AND OU.[Status] = 2 -- 2 = Confirmed
     AND O.[Enabled] = 1
     AND (
-        OU.[AccessAll] = 1
+        CU.[CollectionId] IS NOT NULL
-        OR CU.[CollectionId] IS NOT NULL
-        OR G.[AccessAll] = 1
         OR CG.[CollectionId] IS NOT NULL
     )

util/Migrator/DbScripts/2024-07-09_01_CipherAndCollectionFunctionsRemoveAccessAll.sql

@@ -0,0 +1,115 @@
+-- Remove AccessAll from CollectionCipher sprocs
+-- We created v2 versions of these, but the feature is now fully released, so this copies v2 changes back to non-versioned sproc
+
+-- UserCollectionDetails
+CREATE OR ALTER FUNCTION [dbo].[UserCollectionDetails](@UserId UNIQUEIDENTIFIER)
+RETURNS TABLE
+AS RETURN
+SELECT
+    C.*,
+    CASE
+        WHEN
+            COALESCE(CU.[ReadOnly], CG.[ReadOnly], 0) = 0
+        THEN 0
+        ELSE 1
+    END [ReadOnly],
+    CASE
+        WHEN
+            COALESCE(CU.[HidePasswords], CG.[HidePasswords], 0) = 0
+        THEN 0
+        ELSE 1
+    END [HidePasswords],
+    CASE
+        WHEN
+            COALESCE(CU.[Manage], CG.[Manage], 0) = 0
+        THEN 0
+        ELSE 1
+    END [Manage]
+FROM
+    [dbo].[CollectionView] C
+INNER JOIN
+    [dbo].[OrganizationUser] OU ON C.[OrganizationId] = OU.[OrganizationId]
+INNER JOIN
+    [dbo].[Organization] O ON O.[Id] = C.[OrganizationId]
+LEFT JOIN
+    [dbo].[CollectionUser] CU ON CU.[CollectionId] = C.[Id] AND CU.[OrganizationUserId] = [OU].[Id]
+LEFT JOIN
+    [dbo].[GroupUser] GU ON CU.[CollectionId] IS NULL AND GU.[OrganizationUserId] = OU.[Id]
+LEFT JOIN
+    [dbo].[Group] G ON G.[Id] = GU.[GroupId]
+LEFT JOIN
+    [dbo].[CollectionGroup] CG ON CG.[CollectionId] = C.[Id] AND CG.[GroupId] = GU.[GroupId]
+WHERE
+    OU.[UserId] = @UserId
+    AND OU.[Status] = 2 -- 2 = Confirmed
+    AND O.[Enabled] = 1
+    AND (
+        CU.[CollectionId] IS NOT NULL
+        OR CG.[CollectionId] IS NOT NULL
+    )
+GO
+
+-- UserCipherDetails
+CREATE OR ALTER FUNCTION [dbo].[UserCipherDetails](@UserId UNIQUEIDENTIFIER)
+RETURNS TABLE
+AS RETURN
+WITH [CTE] AS (
+    SELECT
+        [Id],
+        [OrganizationId]
+    FROM
+        [OrganizationUser]
+    WHERE
+        [UserId] = @UserId
+        AND [Status] = 2 -- Confirmed
+)
+SELECT
+    C.*,
+    CASE
+        WHEN COALESCE(CU.[ReadOnly], CG.[ReadOnly], 0) = 0
+        THEN 1
+        ELSE 0
+    END [Edit],
+    CASE
+    	WHEN COALESCE(CU.[HidePasswords], CG.[HidePasswords], 0) = 0
+    	THEN 1
+    	ELSE 0
+    END [ViewPassword],
+    CASE
+        WHEN O.[UseTotp] = 1
+        THEN 1
+        ELSE 0
+    END [OrganizationUseTotp]
+FROM
+    [dbo].[CipherDetails](@UserId) C
+INNER JOIN
+    [CTE] OU ON C.[UserId] IS NULL AND C.[OrganizationId] IN (SELECT [OrganizationId] FROM [CTE])
+INNER JOIN
+    [dbo].[Organization] O ON O.[Id] = OU.[OrganizationId] AND O.[Id] = C.[OrganizationId] AND O.[Enabled] = 1
+LEFT JOIN
+    [dbo].[CollectionCipher] CC ON CC.[CipherId] = C.[Id]
+LEFT JOIN
+    [dbo].[CollectionUser] CU ON CU.[CollectionId] = CC.[CollectionId] AND CU.[OrganizationUserId] = OU.[Id]
+LEFT JOIN
+    [dbo].[GroupUser] GU ON CU.[CollectionId] IS NULL AND GU.[OrganizationUserId] = OU.[Id]
+LEFT JOIN
+    [dbo].[Group] G ON G.[Id] = GU.[GroupId]
+LEFT JOIN
+    [dbo].[CollectionGroup] CG ON CG.[CollectionId] = CC.[CollectionId] AND CG.[GroupId] = GU.[GroupId]
+WHERE
+    CU.[CollectionId] IS NOT NULL
+    OR CG.[CollectionId] IS NOT NULL
+
+UNION ALL
+
+SELECT
+    *,
+    1 [Edit],
+    1 [ViewPassword],
+    0 [OrganizationUseTotp]
+FROM
+    [dbo].[CipherDetails](@UserId)
+WHERE
+    [UserId] = @UserId
+
+GO