mirror of
https://github.com/bitwarden/server.git
synced 2025-07-02 00:22:50 -05:00
Trusted Device Encryption feature (#3151)
* [PM-1203] feat: allow verification for all passwordless accounts (#3038) * [PM-1033] Org invite user creation flow 1 (#3028) * [PM-1033] feat: remove user verification from password enrollment * [PM-1033] feat: auto accept invitation when enrolling into password reset * [PM-1033] fix: controller tests * [PM-1033] refactor: `UpdateUserResetPasswordEnrollmentCommand` * [PM-1033] refactor(wip): make `AcceptUserCommand` * Revert "[PM-1033] refactor(wip): make `AcceptUserCommand`" This reverts commitdc1319e7fa. * Revert "[PM-1033] refactor: `UpdateUserResetPasswordEnrollmentCommand`" This reverts commit43df689c7f. * [PM-1033] refactor: move invite accept to controller This avoids creating yet another method that depends on having `IUserService` passed in as a parameter * [PM-1033] fix: add missing changes * [PM-1381] Add Trusted Device Keys to Auth Response (#3066) * Return Keys for Trusted Device - Check whether the current logging in device is trusted - Return their keys on successful login * Formatting * Address PR Feedback * Add Remarks Comment * [PM-1338] `AuthRequest` Event Logs (#3046) * Update AuthRequestController - Only allow AdminApproval Requests to be created from authed endpoint - Add endpoint that has authentication to be able to create admin approval * Add PasswordlessAuthSettings - Add settings for customizing expiration times * Add new EventTypes * Add Logic for AdminApproval Type - Add logic for validating AdminApproval expiration - Add event logging for Approval/Disapproval of AdminApproval - Add logic for creating AdminApproval types * Add Test Helpers - Change BitAutoData to allow you to use string representations of common types. * Add/Update AuthRequestService Tests * Run Formatting * Switch to 7 Days * Add Test Covering ResponseDate Being Set * Address PR Feedback - Create helper for checking if date is expired - Move validation logic into smaller methods * Switch to User Event Type - Make RequestDeviceApproval user type - User types will log for each org user is in * [PM-2998] Move Approving Device Check (#3101) * Move Check for Approving Devices - Exclude currently logging in device - Remove old way of checking - Add tests asserting behavior * Update DeviceType list * Update Naming & Address PR Feedback * Fix Tests * Address PR Feedback * Formatting * Now Fully Update Naming? * Feature/auth/pm 2759/add can reset password to user decryption options (#3113) * PM-2759 - BaseRequestValidator.cs - CreateUserDecryptionOptionsAsync - Add new hasManageResetPasswordPermission for post SSO redirect logic required on client. * PM-2759 - Update IdentityServerSsoTests.cs to all pass based on the addition of HasManageResetPasswordPermission to TrustedDeviceUserDecryptionOption * IdentityServerSsoTests.cs - fix typo in test name: LoggingApproval --> LoginApproval * PM1259 - Add test case for verifying that TrustedDeviceOption.hasManageResetPasswordPermission is set properly based on user permission * dotnet format run * Feature/auth/pm 2759/add can reset password to user decryption options fix jit users (#3120) * PM-2759 - IdentityServer - CreateUserDecryptionOptionsAsync - hasManageResetPasswordPermission set logic was broken for JIT provisioned users as I assumed we would always have a list of at least 1 org during the SSO process. Added TODO for future test addition but getting this out there now as QA is blocked by being unable to create JIT provisioned users. * dotnet format * Tiny tweak * [PM-1339] Allow Rotating Device Keys (#3096) * Allow Rotation of Trusted Device Keys - Add endpoint for getting keys relating to rotation - Add endpoint for rotating your current device - In the same endpoint allow a list of other devices to rotate * Formatting * Use Extension Method * Add Tests from PR Co-authored-by: Jared Snider <jsnider@bitwarden.com> --------- Co-authored-by: Jared Snider <jsnider@bitwarden.com> * Check the user directly if they have the ResetPasswordKey (#3153) * PM-3327 - UpdateKeyAsync must exempt the currently calling device from the logout notification in order to prevent prematurely logging the user out before the client side key rotation process can complete. The calling device will log itself out once it is done. (#3170) * Allow OTP Requests When Users Are On TDE (#3184) * [PM-3356][PM-3292] Allow OTP For All (#3188) * Allow OTP For All - On a trusted device isn't a good check because a user might be using a trusted device locally but not trusted it long term - The logic wasn't working for KC users anyways * Remove Old Comment * [AC-1601] Added RequireSso policy as a dependency of TDE (#3209) * Added RequireSso policy as a dependency of TDE. * Added test for RequireSso for TDE. * Added save. * Fixed policy name. --------- Co-authored-by: Andreas Coroiu <acoroiu@bitwarden.com> Co-authored-by: Justin Baur <19896123+justindbaur@users.noreply.github.com> Co-authored-by: Vincent Salucci <vincesalucci21@gmail.com> Co-authored-by: Jared Snider <116684653+JaredSnider-Bitwarden@users.noreply.github.com> Co-authored-by: Jared Snider <jsnider@bitwarden.com>
This commit is contained in:
Todd Martin
@ -1,4 +1,5 @@
|
||||
using Bit.Core.Auth.Entities;
|
||||
using Bit.Core.Auth.Enums;
|
||||
using Bit.Core.Auth.Exceptions;
|
||||
using Bit.Core.Auth.Models.Api.Request.AuthRequest;
|
||||
using Bit.Core.Auth.Services.Implementations;
|
||||
@ -11,6 +12,7 @@ using Bit.Core.Services;
|
||||
using Bit.Core.Settings;
|
||||
using Bit.Test.Common.AutoFixture;
|
||||
using Bit.Test.Common.AutoFixture.Attributes;
|
||||
using Bit.Test.Common.Helpers;
|
||||
using NSubstitute;
|
||||
using Xunit;
|
||||
|
||||
@ -69,12 +71,23 @@ public class AuthRequestServiceTests
|
||||
Assert.Null(foundAuthRequest);
|
||||
}
|
||||
|
||||
[Theory, BitAutoData]
|
||||
/// <summary>
|
||||
/// Story: AdminApproval AuthRequests should have a longer expiration time by default and non-AdminApproval ones
|
||||
/// should expire after 15 minutes by default.
|
||||
/// </summary>
|
||||
[Theory]
|
||||
[BitAutoData(AuthRequestType.AdminApproval, "-10.00:00:00")]
|
||||
[BitAutoData(AuthRequestType.AuthenticateAndUnlock, "-00:16:00")]
|
||||
[BitAutoData(AuthRequestType.Unlock, "-00:16:00")]
|
||||
public async Task GetValidatedAuthRequestAsync_IfExpired_ReturnsNull(
|
||||
AuthRequestType authRequestType,
|
||||
TimeSpan creationTimeBeforeNow,
|
||||
SutProvider<AuthRequestService> sutProvider,
|
||||
AuthRequest authRequest)
|
||||
{
|
||||
authRequest.CreationDate = DateTime.UtcNow.AddHours(-1);
|
||||
authRequest.Type = authRequestType;
|
||||
authRequest.CreationDate = DateTime.UtcNow.Add(creationTimeBeforeNow);
|
||||
authRequest.Approved = false;
|
||||
|
||||
sutProvider.GetDependency<IAuthRequestRepository>()
|
||||
.GetByIdAsync(authRequest.Id)
|
||||
@ -85,6 +98,29 @@ public class AuthRequestServiceTests
|
||||
Assert.Null(foundAuthRequest);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Story: Once a AdminApproval type has been approved it has a different expiration time based on time
|
||||
/// after the response.
|
||||
/// </summary>
|
||||
[Theory]
|
||||
[BitAutoData]
|
||||
public async Task GetValidatedAuthRequestAsync_AdminApprovalApproved_HasLongerExpiration_ReturnsRequest(
|
||||
SutProvider<AuthRequestService> sutProvider,
|
||||
AuthRequest authRequest)
|
||||
{
|
||||
authRequest.Type = AuthRequestType.AdminApproval;
|
||||
authRequest.Approved = true;
|
||||
authRequest.ResponseDate = DateTime.UtcNow.Add(TimeSpan.FromHours(-13));
|
||||
|
||||
sutProvider.GetDependency<IAuthRequestRepository>()
|
||||
.GetByIdAsync(authRequest.Id)
|
||||
.Returns(authRequest);
|
||||
|
||||
var validatedAuthRequest = await sutProvider.Sut.GetValidatedAuthRequestAsync(authRequest.Id, authRequest.AccessCode);
|
||||
|
||||
Assert.Null(validatedAuthRequest);
|
||||
}
|
||||
|
||||
[Theory, BitAutoData]
|
||||
public async Task GetValidatedAuthRequestAsync_IfValid_ReturnsAuthRequest(
|
||||
SutProvider<AuthRequestService> sutProvider,
|
||||
@ -96,6 +132,10 @@ public class AuthRequestServiceTests
|
||||
.GetByIdAsync(authRequest.Id)
|
||||
.Returns(authRequest);
|
||||
|
||||
sutProvider.GetDependency<IGlobalSettings>()
|
||||
.PasswordlessAuth
|
||||
.Returns(new Settings.GlobalSettings.PasswordlessAuthSettings());
|
||||
|
||||
var foundAuthRequest = await sutProvider.Sut.GetValidatedAuthRequestAsync(authRequest.Id, authRequest.AccessCode);
|
||||
|
||||
Assert.NotNull(foundAuthRequest);
|
||||
@ -136,13 +176,22 @@ public class AuthRequestServiceTests
|
||||
await Assert.ThrowsAsync<BadRequestException>(() => sutProvider.Sut.CreateAuthRequestAsync(createModel));
|
||||
}
|
||||
|
||||
[Theory, BitAutoData]
|
||||
/// <summary>
|
||||
/// Story: Non-AdminApproval requests should be created without a known device if the settings is set to <c>false</c>
|
||||
/// Non-AdminApproval ones should also have a push notification sent about them.
|
||||
/// </summary>
|
||||
[Theory]
|
||||
[BitAutoData(AuthRequestType.AuthenticateAndUnlock)]
|
||||
[BitAutoData(AuthRequestType.Unlock)]
|
||||
[BitAutoData(new object?[1] { null })]
|
||||
public async Task CreateAuthRequestAsync_CreatesAuthRequest(
|
||||
AuthRequestType? authRequestType,
|
||||
SutProvider<AuthRequestService> sutProvider,
|
||||
AuthRequestCreateRequestModel createModel,
|
||||
User user)
|
||||
{
|
||||
user.Email = createModel.Email;
|
||||
createModel.Type = authRequestType;
|
||||
|
||||
sutProvider.GetDependency<IUserRepository>()
|
||||
.GetByEmailAsync(createModel.Email)
|
||||
@ -152,28 +201,44 @@ public class AuthRequestServiceTests
|
||||
.DeviceType
|
||||
.Returns(DeviceType.Android);
|
||||
|
||||
sutProvider.GetDependency<ICurrentContext>()
|
||||
.IpAddress
|
||||
.Returns("1.1.1.1");
|
||||
|
||||
sutProvider.GetDependency<IGlobalSettings>()
|
||||
.PasswordlessAuth.KnownDevicesOnly
|
||||
.Returns(false);
|
||||
|
||||
await sutProvider.Sut.CreateAuthRequestAsync(createModel);
|
||||
sutProvider.GetDependency<IAuthRequestRepository>()
|
||||
.CreateAsync(Arg.Any<AuthRequest>())
|
||||
.Returns(c => c.ArgAt<AuthRequest>(0));
|
||||
|
||||
var createdAuthRequest = await sutProvider.Sut.CreateAuthRequestAsync(createModel);
|
||||
|
||||
await sutProvider.GetDependency<IPushNotificationService>()
|
||||
.Received()
|
||||
.PushAuthRequestAsync(Arg.Any<AuthRequest>());
|
||||
.PushAuthRequestAsync(createdAuthRequest);
|
||||
|
||||
await sutProvider.GetDependency<IAuthRequestRepository>()
|
||||
.Received()
|
||||
.CreateAsync(Arg.Any<AuthRequest>());
|
||||
.CreateAsync(createdAuthRequest);
|
||||
}
|
||||
|
||||
[Theory, BitAutoData]
|
||||
/// <summary>
|
||||
/// Story: Since an AllowAnonymous endpoint calls this method we need
|
||||
/// to verify that a device was able to be found via ICurrentContext
|
||||
/// </summary>
|
||||
[Theory]
|
||||
[BitAutoData(AuthRequestType.AuthenticateAndUnlock)]
|
||||
[BitAutoData(AuthRequestType.Unlock)]
|
||||
public async Task CreateAuthRequestAsync_NoDeviceType_ThrowsBadRequest(
|
||||
AuthRequestType authRequestType,
|
||||
SutProvider<AuthRequestService> sutProvider,
|
||||
AuthRequestCreateRequestModel createModel,
|
||||
User user)
|
||||
{
|
||||
user.Email = createModel.Email;
|
||||
createModel.Type = authRequestType;
|
||||
|
||||
sutProvider.GetDependency<IUserRepository>()
|
||||
.GetByEmailAsync(createModel.Email)
|
||||
@ -186,13 +251,92 @@ public class AuthRequestServiceTests
|
||||
await Assert.ThrowsAsync<BadRequestException>(() => sutProvider.Sut.CreateAuthRequestAsync(createModel));
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Story: If a user happens to exist to more than one organization, we will send the device approval request to
|
||||
/// each of them.
|
||||
/// </summary>
|
||||
[Theory, BitAutoData]
|
||||
public async Task CreateAuthRequestAsync_AdminApproval_CreatesForEachOrganization(
|
||||
SutProvider<AuthRequestService> sutProvider,
|
||||
AuthRequestCreateRequestModel createModel,
|
||||
User user,
|
||||
OrganizationUser organizationUser1,
|
||||
OrganizationUser organizationUser2)
|
||||
{
|
||||
createModel.Type = AuthRequestType.AdminApproval;
|
||||
user.Email = createModel.Email;
|
||||
organizationUser1.UserId = user.Id;
|
||||
organizationUser2.UserId = user.Id;
|
||||
|
||||
sutProvider.GetDependency<IUserRepository>()
|
||||
.GetByEmailAsync(user.Email)
|
||||
.Returns(user);
|
||||
|
||||
sutProvider.GetDependency<ICurrentContext>()
|
||||
.DeviceType
|
||||
.Returns(DeviceType.ChromeExtension);
|
||||
|
||||
sutProvider.GetDependency<ICurrentContext>()
|
||||
.UserId
|
||||
.Returns(user.Id);
|
||||
|
||||
sutProvider.GetDependency<IGlobalSettings>()
|
||||
.PasswordlessAuth.KnownDevicesOnly
|
||||
.Returns(false);
|
||||
|
||||
|
||||
sutProvider.GetDependency<IOrganizationUserRepository>()
|
||||
.GetManyByUserAsync(user.Id)
|
||||
.Returns(new List<OrganizationUser>
|
||||
{
|
||||
organizationUser1,
|
||||
organizationUser2,
|
||||
});
|
||||
|
||||
sutProvider.GetDependency<IAuthRequestRepository>()
|
||||
.CreateAsync(Arg.Any<AuthRequest>())
|
||||
.Returns(c => c.ArgAt<AuthRequest>(0));
|
||||
|
||||
var authRequest = await sutProvider.Sut.CreateAuthRequestAsync(createModel);
|
||||
|
||||
Assert.Equal(organizationUser1.OrganizationId, authRequest.OrganizationId);
|
||||
|
||||
await sutProvider.GetDependency<IAuthRequestRepository>()
|
||||
.Received(1)
|
||||
.CreateAsync(Arg.Is<AuthRequest>(o => o.OrganizationId == organizationUser1.OrganizationId));
|
||||
|
||||
await sutProvider.GetDependency<IAuthRequestRepository>()
|
||||
.Received(1)
|
||||
.CreateAsync(Arg.Is<AuthRequest>(o => o.OrganizationId == organizationUser2.OrganizationId));
|
||||
|
||||
await sutProvider.GetDependency<IAuthRequestRepository>()
|
||||
.Received(2)
|
||||
.CreateAsync(Arg.Any<AuthRequest>());
|
||||
|
||||
await sutProvider.GetDependency<IEventService>()
|
||||
.Received(1)
|
||||
.LogUserEventAsync(user.Id, EventType.User_RequestedDeviceApproval);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Story: When an <see cref="AuthRequest"> is approved we want to update it in the database so it cannot have
|
||||
/// it's status changed again and we want to push a notification to let the user know of the approval.
|
||||
/// In the case of the AdminApproval we also want to log an event.
|
||||
/// </summary>
|
||||
[Theory]
|
||||
[BitAutoData(AuthRequestType.AdminApproval, "7b055ea1-38be-42d0-b2e4-becb2340f8df")]
|
||||
[BitAutoData(AuthRequestType.Unlock, null)]
|
||||
[BitAutoData(AuthRequestType.AuthenticateAndUnlock, null)]
|
||||
public async Task UpdateAuthRequestAsync_ValidResponse_SendsResponse(
|
||||
AuthRequestType authRequestType,
|
||||
Guid? organizationId,
|
||||
SutProvider<AuthRequestService> sutProvider,
|
||||
AuthRequest authRequest)
|
||||
{
|
||||
authRequest.CreationDate = DateTime.UtcNow.AddMinutes(-10);
|
||||
authRequest.Approved = null;
|
||||
authRequest.OrganizationId = organizationId;
|
||||
authRequest.Type = authRequestType;
|
||||
|
||||
sutProvider.GetDependency<IAuthRequestRepository>()
|
||||
.GetByIdAsync(authRequest.Id)
|
||||
@ -208,6 +352,18 @@ public class AuthRequestServiceTests
|
||||
.GetByIdentifierAsync(device.Identifier, authRequest.UserId)
|
||||
.Returns(device);
|
||||
|
||||
sutProvider.GetDependency<IOrganizationUserRepository>()
|
||||
.GetByOrganizationAsync(Arg.Any<Guid>(), Arg.Any<Guid>())
|
||||
.Returns(new OrganizationUser
|
||||
{
|
||||
UserId = authRequest.UserId,
|
||||
OrganizationId = organizationId.GetValueOrDefault(),
|
||||
});
|
||||
|
||||
sutProvider.GetDependency<IGlobalSettings>()
|
||||
.PasswordlessAuth
|
||||
.Returns(new Settings.GlobalSettings.PasswordlessAuthSettings());
|
||||
|
||||
var updateModel = new AuthRequestUpdateRequestModel
|
||||
{
|
||||
Key = "test_key",
|
||||
@ -220,37 +376,75 @@ public class AuthRequestServiceTests
|
||||
|
||||
Assert.Equal("my_hash", udpatedAuthRequest.MasterPasswordHash);
|
||||
|
||||
// On approval, the response date should be set to current date
|
||||
Assert.NotNull(udpatedAuthRequest.ResponseDate);
|
||||
AssertHelper.AssertRecent(udpatedAuthRequest.ResponseDate!.Value);
|
||||
|
||||
await sutProvider.GetDependency<IAuthRequestRepository>()
|
||||
.Received()
|
||||
.Received(1)
|
||||
.ReplaceAsync(udpatedAuthRequest);
|
||||
|
||||
await sutProvider.GetDependency<IPushNotificationService>()
|
||||
.Received()
|
||||
.Received(1)
|
||||
.PushAuthRequestResponseAsync(udpatedAuthRequest);
|
||||
|
||||
var expectedNumberOfCalls = organizationId.HasValue ? 1 : 0;
|
||||
await sutProvider.GetDependency<IEventService>()
|
||||
.Received(expectedNumberOfCalls)
|
||||
.LogOrganizationUserEventAsync(
|
||||
Arg.Is<OrganizationUser>(ou => ou.UserId == authRequest.UserId && ou.OrganizationId == organizationId),
|
||||
EventType.OrganizationUser_ApprovedAuthRequest);
|
||||
}
|
||||
|
||||
[Theory, BitAutoData]
|
||||
/// <summary>
|
||||
/// Story: When an <see cref="AuthRequest"> is rejected we want to update it in the database so it cannot have
|
||||
/// it's status changed again but we do not want to send a push notification to the original device
|
||||
/// so as to not leak that it was rejected. In the case of an AdminApproval type we do want to log an event though
|
||||
/// </summary>
|
||||
[Theory]
|
||||
[BitAutoData(AuthRequestType.AdminApproval, "7b055ea1-38be-42d0-b2e4-becb2340f8df")]
|
||||
[BitAutoData(AuthRequestType.Unlock, null)]
|
||||
[BitAutoData(AuthRequestType.AuthenticateAndUnlock, null)]
|
||||
public async Task UpdateAuthRequestAsync_ResponseNotApproved_DoesNotLeakRejection(
|
||||
AuthRequestType authRequestType,
|
||||
Guid? organizationId,
|
||||
SutProvider<AuthRequestService> sutProvider,
|
||||
AuthRequest authRequest)
|
||||
{
|
||||
// Give it a recent creation time which is valid for all types of AuthRequests
|
||||
authRequest.CreationDate = DateTime.UtcNow.AddMinutes(-10);
|
||||
authRequest.Type = authRequestType;
|
||||
// Has not been decided already
|
||||
authRequest.Approved = null;
|
||||
authRequest.OrganizationId = organizationId;
|
||||
|
||||
sutProvider.GetDependency<IAuthRequestRepository>()
|
||||
.GetByIdAsync(authRequest.Id)
|
||||
.Returns(authRequest);
|
||||
|
||||
// Setup a device for all requests even though it will not be called for verification in a AdminApproval
|
||||
var device = new Device
|
||||
{
|
||||
Id = Guid.NewGuid(),
|
||||
Identifier = "test_identifier",
|
||||
};
|
||||
|
||||
sutProvider.GetDependency<IGlobalSettings>()
|
||||
.PasswordlessAuth
|
||||
.Returns(new Settings.GlobalSettings.PasswordlessAuthSettings());
|
||||
|
||||
sutProvider.GetDependency<IDeviceRepository>()
|
||||
.GetByIdentifierAsync(device.Identifier, authRequest.UserId)
|
||||
.Returns(device);
|
||||
|
||||
sutProvider.GetDependency<IOrganizationUserRepository>()
|
||||
.GetByOrganizationAsync(Arg.Any<Guid>(), Arg.Any<Guid>())
|
||||
.Returns(new OrganizationUser
|
||||
{
|
||||
UserId = authRequest.UserId,
|
||||
OrganizationId = organizationId.GetValueOrDefault(),
|
||||
});
|
||||
|
||||
var updateModel = new AuthRequestUpdateRequestModel
|
||||
{
|
||||
Key = "test_key",
|
||||
@ -262,6 +456,9 @@ public class AuthRequestServiceTests
|
||||
var udpatedAuthRequest = await sutProvider.Sut.UpdateAuthRequestAsync(authRequest.Id, authRequest.UserId, updateModel);
|
||||
|
||||
Assert.Equal(udpatedAuthRequest.MasterPasswordHash, authRequest.MasterPasswordHash);
|
||||
Assert.False(udpatedAuthRequest.Approved);
|
||||
Assert.NotNull(udpatedAuthRequest.ResponseDate);
|
||||
AssertHelper.AssertRecent(udpatedAuthRequest.ResponseDate!.Value);
|
||||
|
||||
await sutProvider.GetDependency<IAuthRequestRepository>()
|
||||
.Received()
|
||||
@ -270,17 +467,37 @@ public class AuthRequestServiceTests
|
||||
await sutProvider.GetDependency<IPushNotificationService>()
|
||||
.DidNotReceiveWithAnyArgs()
|
||||
.PushAuthRequestResponseAsync(udpatedAuthRequest);
|
||||
|
||||
var expectedNumberOfCalls = organizationId.HasValue ? 1 : 0;
|
||||
|
||||
await sutProvider.GetDependency<IEventService>()
|
||||
.Received(expectedNumberOfCalls)
|
||||
.LogOrganizationUserEventAsync(
|
||||
Arg.Is<OrganizationUser>(ou => ou.UserId == authRequest.UserId && ou.OrganizationId == organizationId),
|
||||
EventType.OrganizationUser_RejectedAuthRequest);
|
||||
}
|
||||
|
||||
[Theory, BitAutoData]
|
||||
/// <summary>
|
||||
/// Story: A bad actor is able to get ahold of the request id of a valid <see cref="AuthRequest" />
|
||||
/// and tries to approve it from their own Bitwarden account. We need to validate that the currently signed in user
|
||||
/// is the same user that originally created the request and we want to pretend it does not exist at all by throwing
|
||||
/// NotFoundException.
|
||||
/// </summary>
|
||||
[Theory]
|
||||
[BitAutoData(AuthRequestType.AuthenticateAndUnlock)]
|
||||
[BitAutoData(AuthRequestType.Unlock)]
|
||||
public async Task UpdateAuthRequestAsync_InvalidUser_ThrowsNotFound(
|
||||
AuthRequestType authRequestType,
|
||||
SutProvider<AuthRequestService> sutProvider,
|
||||
AuthRequest authRequest,
|
||||
Guid userId)
|
||||
Guid authenticatedUserId)
|
||||
{
|
||||
// Give it a recent creation date so that it is valid
|
||||
authRequest.CreationDate = DateTime.UtcNow.AddMinutes(-10);
|
||||
authRequest.Approved = false;
|
||||
// The request hasn't been Approved/Disapproved already
|
||||
authRequest.Approved = null;
|
||||
// Has an type that needs the UserId property validated
|
||||
authRequest.Type = authRequestType;
|
||||
|
||||
// Auth request should not be null
|
||||
sutProvider.GetDependency<IAuthRequestRepository>()
|
||||
@ -297,23 +514,39 @@ public class AuthRequestServiceTests
|
||||
|
||||
// Give it a randomly generated userId such that it won't be valid for the AuthRequest
|
||||
await Assert.ThrowsAsync<NotFoundException>(
|
||||
async () => await sutProvider.Sut.UpdateAuthRequestAsync(authRequest.Id, userId, updateModel));
|
||||
async () => await sutProvider.Sut.UpdateAuthRequestAsync(authRequest.Id, authenticatedUserId, updateModel));
|
||||
}
|
||||
|
||||
[Theory, BitAutoData]
|
||||
/// <summary>
|
||||
/// Story: A user created this auth request and does not approve/reject the request
|
||||
/// for 16 minutes, which is past the default expiration time. This auth request
|
||||
/// will be purged from the database soon but might exist for some amount of time after it's expiration
|
||||
/// this method should throw a NotFoundException since it theoretically should not exist, this
|
||||
/// could be a user finally clicking Approve after the request sitting on their phone for a while.
|
||||
/// </summary>
|
||||
[Theory]
|
||||
[BitAutoData(AuthRequestType.AuthenticateAndUnlock, "-00:16:00")]
|
||||
[BitAutoData(AuthRequestType.Unlock, "-00:16:00")]
|
||||
[BitAutoData(AuthRequestType.AdminApproval, "-8.00:00:00")]
|
||||
public async Task UpdateAuthRequestAsync_OldAuthRequest_ThrowsNotFound(
|
||||
AuthRequestType authRequestType,
|
||||
TimeSpan timeBeforeCreation,
|
||||
SutProvider<AuthRequestService> sutProvider,
|
||||
AuthRequest authRequest)
|
||||
{
|
||||
// AuthRequest's have a valid lifetime of only 15 minutes, make it older than that
|
||||
authRequest.CreationDate = DateTime.UtcNow.AddMinutes(-16);
|
||||
authRequest.Approved = false;
|
||||
// AuthRequest's have a default valid lifetime of only 15 minutes, make it older than that
|
||||
authRequest.CreationDate = DateTime.UtcNow.Add(timeBeforeCreation);
|
||||
// Make it so that the user has not made a decision on this request
|
||||
authRequest.Approved = null;
|
||||
// Make it one of the types that doesn't have longer expiration i.e AdminApproval
|
||||
authRequest.Type = authRequestType;
|
||||
|
||||
// Auth request should not be null
|
||||
// The item should still exist in the database
|
||||
sutProvider.GetDependency<IAuthRequestRepository>()
|
||||
.GetByIdAsync(authRequest.Id)
|
||||
.Returns(authRequest);
|
||||
|
||||
// Represents the user finally clicking approve.
|
||||
var updateModel = new AuthRequestUpdateRequestModel
|
||||
{
|
||||
Key = "test_key",
|
||||
@ -322,27 +555,38 @@ public class AuthRequestServiceTests
|
||||
MasterPasswordHash = "my_hash",
|
||||
};
|
||||
|
||||
// Give it a randomly generated userId such that it won't be valid for the AuthRequest
|
||||
await Assert.ThrowsAsync<NotFoundException>(
|
||||
async () => await sutProvider.Sut.UpdateAuthRequestAsync(authRequest.Id, authRequest.UserId, updateModel));
|
||||
}
|
||||
|
||||
[Theory, BitAutoData]
|
||||
/// <summary>
|
||||
/// Story: non-AdminApproval types need to validate that the device used to respond to the
|
||||
/// request is a known device to the authenticated user.
|
||||
/// </summary>
|
||||
[Theory]
|
||||
[BitAutoData(AuthRequestType.AuthenticateAndUnlock)]
|
||||
[BitAutoData(AuthRequestType.Unlock)]
|
||||
public async Task UpdateAuthRequestAsync_InvalidDeviceIdentifier_ThrowsBadRequest(
|
||||
AuthRequestType authRequestType,
|
||||
SutProvider<AuthRequestService> sutProvider,
|
||||
AuthRequest authRequest)
|
||||
{
|
||||
authRequest.CreationDate = DateTime.UtcNow.AddMinutes(-10);
|
||||
authRequest.Approved = null;
|
||||
authRequest.Type = authRequestType;
|
||||
|
||||
sutProvider.GetDependency<IAuthRequestRepository>()
|
||||
.GetByIdAsync(authRequest.Id)
|
||||
.Returns(authRequest);
|
||||
|
||||
sutProvider.GetDependency<IDeviceRepository>()
|
||||
.GetByIdentifierAsync(Arg.Any<string>(), authRequest.UserId)
|
||||
.GetByIdentifierAsync("invalid_identifier", authRequest.UserId)
|
||||
.Returns((Device?)null);
|
||||
|
||||
sutProvider.GetDependency<IGlobalSettings>()
|
||||
.PasswordlessAuth
|
||||
.Returns(new Settings.GlobalSettings.PasswordlessAuthSettings());
|
||||
|
||||
var updateModel = new AuthRequestUpdateRequestModel
|
||||
{
|
||||
Key = "test_key",
|
||||
@ -355,29 +599,21 @@ public class AuthRequestServiceTests
|
||||
async () => await sutProvider.Sut.UpdateAuthRequestAsync(authRequest.Id, authRequest.UserId, updateModel));
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Story: Once the destiny of an AuthRequest has been decided, it should be considered immutable
|
||||
/// and new update request should be blocked.
|
||||
/// </summary>
|
||||
[Theory, BitAutoData]
|
||||
public async Task UpdateAuthRequestAsync_AlreadyApprovedOrRejected_ThrowsDuplicateAuthRequestException(
|
||||
SutProvider<AuthRequestService> sutProvider,
|
||||
AuthRequest authRequest)
|
||||
{
|
||||
// Set CreationDate to a valid recent value and Approved to a non-null value
|
||||
authRequest.CreationDate = DateTime.UtcNow.AddMinutes(-10);
|
||||
authRequest.Approved = true;
|
||||
|
||||
sutProvider.GetDependency<IAuthRequestRepository>()
|
||||
.GetByIdAsync(authRequest.Id)
|
||||
.Returns(authRequest);
|
||||
|
||||
var device = new Device
|
||||
{
|
||||
Id = Guid.NewGuid(),
|
||||
Identifier = "test_identifier",
|
||||
};
|
||||
|
||||
sutProvider.GetDependency<IDeviceRepository>()
|
||||
.GetByIdentifierAsync(device.Identifier, authRequest.UserId)
|
||||
.Returns(device);
|
||||
|
||||
var updateModel = new AuthRequestUpdateRequestModel
|
||||
{
|
||||
Key = "test_key",
|
||||
@ -390,4 +626,69 @@ public class AuthRequestServiceTests
|
||||
async () => await sutProvider.Sut.UpdateAuthRequestAsync(authRequest.Id, authRequest.UserId, updateModel));
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Story: An admin approves a request for one of their org users. For auditing purposes we need to
|
||||
/// log an event that correlates the action for who the request was approved for. On approval we also need to
|
||||
/// push the notification to the user.
|
||||
/// </summary>
|
||||
[Theory, BitAutoData]
|
||||
public async Task UpdateAuthRequestAsync_AdminApproved_LogsEvent(
|
||||
SutProvider<AuthRequestService> sutProvider,
|
||||
AuthRequest authRequest,
|
||||
OrganizationUser organizationUser)
|
||||
{
|
||||
authRequest.CreationDate = DateTime.UtcNow.AddMinutes(-10);
|
||||
authRequest.Type = AuthRequestType.AdminApproval;
|
||||
authRequest.OrganizationId = organizationUser.OrganizationId;
|
||||
authRequest.Approved = null;
|
||||
|
||||
sutProvider.GetDependency<IAuthRequestRepository>()
|
||||
.GetByIdAsync(authRequest.Id)
|
||||
.Returns(authRequest);
|
||||
|
||||
sutProvider.GetDependency<IOrganizationUserRepository>()
|
||||
.GetByOrganizationAsync(authRequest.OrganizationId!.Value, authRequest.UserId)
|
||||
.Returns(organizationUser);
|
||||
|
||||
sutProvider.GetDependency<IGlobalSettings>()
|
||||
.PasswordlessAuth
|
||||
.Returns(new Settings.GlobalSettings.PasswordlessAuthSettings());
|
||||
|
||||
var updateModel = new AuthRequestUpdateRequestModel
|
||||
{
|
||||
Key = "test_key",
|
||||
RequestApproved = true,
|
||||
MasterPasswordHash = "my_hash",
|
||||
};
|
||||
|
||||
var updatedAuthRequest = await sutProvider.Sut.UpdateAuthRequestAsync(authRequest.Id, authRequest.UserId, updateModel);
|
||||
|
||||
Assert.Equal("my_hash", updatedAuthRequest.MasterPasswordHash);
|
||||
Assert.Equal("test_key", updatedAuthRequest.Key);
|
||||
Assert.True(updatedAuthRequest.Approved);
|
||||
Assert.NotNull(updatedAuthRequest.ResponseDate);
|
||||
AssertHelper.AssertRecent(updatedAuthRequest.ResponseDate!.Value);
|
||||
|
||||
await sutProvider.GetDependency<IEventService>()
|
||||
.Received(1)
|
||||
.LogOrganizationUserEventAsync(
|
||||
Arg.Is(organizationUser), Arg.Is(EventType.OrganizationUser_ApprovedAuthRequest));
|
||||
|
||||
await sutProvider.GetDependency<IPushNotificationService>()
|
||||
.Received(1)
|
||||
.PushAuthRequestResponseAsync(authRequest);
|
||||
}
|
||||
|
||||
[Theory, BitAutoData]
|
||||
public async Task UpdateAuthRequestAsync_BadId_ThrowsNotFound(
|
||||
SutProvider<AuthRequestService> sutProvider,
|
||||
Guid authRequestId)
|
||||
{
|
||||
sutProvider.GetDependency<IAuthRequestRepository>()
|
||||
.GetByIdAsync(authRequestId)
|
||||
.Returns((AuthRequest?)null);
|
||||
|
||||
await Assert.ThrowsAsync<NotFoundException>(async () => await sutProvider.Sut.UpdateAuthRequestAsync(
|
||||
authRequestId, Guid.NewGuid(), new AuthRequestUpdateRequestModel()));
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,12 +1,18 @@
|
||||
using Bit.Core.Entities;
|
||||
using System.Runtime.CompilerServices;
|
||||
using Bit.Core.Auth.Models.Api.Request;
|
||||
using Bit.Core.Entities;
|
||||
using Bit.Core.Enums;
|
||||
using Bit.Core.Exceptions;
|
||||
using Bit.Core.Repositories;
|
||||
using Bit.Core.Services;
|
||||
using Bit.Test.Common.AutoFixture;
|
||||
using Bit.Test.Common.AutoFixture.Attributes;
|
||||
using NSubstitute;
|
||||
using Xunit;
|
||||
|
||||
namespace Bit.Core.Test.Services;
|
||||
|
||||
[SutProviderCustomize]
|
||||
public class DeviceServiceTests
|
||||
{
|
||||
[Fact]
|
||||
@ -33,4 +39,227 @@ public class DeviceServiceTests
|
||||
await pushRepo.Received().CreateOrUpdateRegistrationAsync("testtoken", id.ToString(),
|
||||
userId.ToString(), "testid", DeviceType.Android);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Story: A user choosed to keep trust in one of their current trusted devices, but not in another one of their
|
||||
/// devices. We will rotate the trust of the currently signed in device as well as the device they chose but will
|
||||
/// remove the trust of the device they didn't give new keys for.
|
||||
/// </summary>
|
||||
[Theory, BitAutoData]
|
||||
public async Task UpdateDevicesTrustAsync_Works(
|
||||
SutProvider<DeviceService> sutProvider,
|
||||
Guid currentUserId,
|
||||
Device deviceOne,
|
||||
Device deviceTwo,
|
||||
Device deviceThree)
|
||||
{
|
||||
SetupOldTrust(deviceOne);
|
||||
SetupOldTrust(deviceTwo);
|
||||
SetupOldTrust(deviceThree);
|
||||
|
||||
deviceOne.Identifier = "current_device";
|
||||
|
||||
sutProvider.GetDependency<IDeviceRepository>()
|
||||
.GetManyByUserIdAsync(currentUserId)
|
||||
.Returns(new List<Device>
|
||||
{
|
||||
deviceOne,
|
||||
deviceTwo,
|
||||
deviceThree,
|
||||
});
|
||||
|
||||
var currentDeviceModel = new DeviceKeysUpdateRequestModel
|
||||
{
|
||||
EncryptedPublicKey = "current_encrypted_public_key",
|
||||
EncryptedUserKey = "current_encrypted_user_key",
|
||||
};
|
||||
|
||||
var alteredDeviceModels = new List<OtherDeviceKeysUpdateRequestModel>
|
||||
{
|
||||
new OtherDeviceKeysUpdateRequestModel
|
||||
{
|
||||
DeviceId = deviceTwo.Id,
|
||||
EncryptedPublicKey = "encrypted_public_key_two",
|
||||
EncryptedUserKey = "encrypted_user_key_two",
|
||||
},
|
||||
};
|
||||
|
||||
await sutProvider.Sut.UpdateDevicesTrustAsync("current_device", currentUserId, currentDeviceModel, alteredDeviceModels);
|
||||
|
||||
// Updating trust, "current" or "other" only needs to change the EncryptedPublicKey & EncryptedUserKey
|
||||
await sutProvider.GetDependency<IDeviceRepository>()
|
||||
.Received(1)
|
||||
.UpsertAsync(Arg.Is<Device>(d =>
|
||||
d.Id == deviceOne.Id &&
|
||||
d.EncryptedPublicKey == "current_encrypted_public_key" &&
|
||||
d.EncryptedUserKey == "current_encrypted_user_key" &&
|
||||
d.EncryptedPrivateKey == "old_private_deviceOne"));
|
||||
|
||||
await sutProvider.GetDependency<IDeviceRepository>()
|
||||
.Received(1)
|
||||
.UpsertAsync(Arg.Is<Device>(d =>
|
||||
d.Id == deviceTwo.Id &&
|
||||
d.EncryptedPublicKey == "encrypted_public_key_two" &&
|
||||
d.EncryptedUserKey == "encrypted_user_key_two" &&
|
||||
d.EncryptedPrivateKey == "old_private_deviceTwo"));
|
||||
|
||||
// Clearing trust should remove all key values
|
||||
await sutProvider.GetDependency<IDeviceRepository>()
|
||||
.Received(1)
|
||||
.UpsertAsync(Arg.Is<Device>(d =>
|
||||
d.Id == deviceThree.Id &&
|
||||
d.EncryptedPublicKey == null &&
|
||||
d.EncryptedUserKey == null &&
|
||||
d.EncryptedPrivateKey == null));
|
||||
|
||||
// Should have recieved a total of 3 calls, the ones asserted above
|
||||
await sutProvider.GetDependency<IDeviceRepository>()
|
||||
.Received(3)
|
||||
.UpsertAsync(Arg.Any<Device>());
|
||||
|
||||
// TODO: .NET 8: Use nameof for parameter name.
|
||||
static void SetupOldTrust(Device device, [CallerArgumentExpression("device")] string expression = null)
|
||||
{
|
||||
device.EncryptedPublicKey = $"old_public_{expression}";
|
||||
device.EncryptedPrivateKey = $"old_private_{expression}";
|
||||
device.EncryptedUserKey = $"old_user_{expression}";
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Story: This could result from a poor implementation of this method, if they attempt add trust to a device
|
||||
/// that doesn't already have trust. They would have to create brand new values and for that values to be accurate
|
||||
/// they would technically have all the values needed to trust a device, that is why we don't consider this bad
|
||||
/// enough to throw but do skip it because we'd rather keep number of ways for trust to be added to the endpoint we
|
||||
/// already have.
|
||||
/// </summary>
|
||||
[Theory, BitAutoData]
|
||||
public async Task UpdateDevicesTrustAsync_DoesNotUpdateUntrustedDevices(
|
||||
SutProvider<DeviceService> sutProvider,
|
||||
Guid currentUserId,
|
||||
Device deviceOne,
|
||||
Device deviceTwo)
|
||||
{
|
||||
deviceOne.Identifier = "current_device";
|
||||
|
||||
// Make deviceTwo untrusted
|
||||
deviceTwo.EncryptedUserKey = string.Empty;
|
||||
deviceTwo.EncryptedPublicKey = string.Empty;
|
||||
deviceTwo.EncryptedPrivateKey = string.Empty;
|
||||
|
||||
sutProvider.GetDependency<IDeviceRepository>()
|
||||
.GetManyByUserIdAsync(currentUserId)
|
||||
.Returns(new List<Device>
|
||||
{
|
||||
deviceOne,
|
||||
deviceTwo,
|
||||
});
|
||||
|
||||
var currentDeviceModel = new DeviceKeysUpdateRequestModel
|
||||
{
|
||||
EncryptedPublicKey = "current_encrypted_public_key",
|
||||
EncryptedUserKey = "current_encrypted_user_key",
|
||||
};
|
||||
|
||||
var alteredDeviceModels = new List<OtherDeviceKeysUpdateRequestModel>
|
||||
{
|
||||
new OtherDeviceKeysUpdateRequestModel
|
||||
{
|
||||
DeviceId = deviceTwo.Id,
|
||||
EncryptedPublicKey = "encrypted_public_key_two",
|
||||
EncryptedUserKey = "encrypted_user_key_two",
|
||||
},
|
||||
};
|
||||
|
||||
await sutProvider.Sut.UpdateDevicesTrustAsync("current_device", currentUserId, currentDeviceModel, alteredDeviceModels);
|
||||
|
||||
// Check that UpsertAsync was called for the trusted device
|
||||
await sutProvider.GetDependency<IDeviceRepository>()
|
||||
.Received(1)
|
||||
.UpsertAsync(Arg.Is<Device>(d =>
|
||||
d.Id == deviceOne.Id &&
|
||||
d.EncryptedPublicKey == "current_encrypted_public_key" &&
|
||||
d.EncryptedUserKey == "current_encrypted_user_key"));
|
||||
|
||||
// Check that UpsertAsync was not called for the untrusted device
|
||||
await sutProvider.GetDependency<IDeviceRepository>()
|
||||
.DidNotReceive()
|
||||
.UpsertAsync(Arg.Is<Device>(d => d.Id == deviceTwo.Id));
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Story: This should only happen if someone were to take the access token from a different device and try to rotate
|
||||
/// a device that they don't actually have.
|
||||
/// </summary>
|
||||
[Theory, BitAutoData]
|
||||
public async Task UpdateDevicesTrustAsync_ThrowsNotFoundException_WhenCurrentDeviceIdentifierDoesNotExist(
|
||||
SutProvider<DeviceService> sutProvider,
|
||||
Guid currentUserId,
|
||||
Device deviceOne,
|
||||
Device deviceTwo)
|
||||
{
|
||||
deviceOne.Identifier = "some_other_device";
|
||||
deviceTwo.Identifier = "another_device";
|
||||
|
||||
sutProvider.GetDependency<IDeviceRepository>()
|
||||
.GetManyByUserIdAsync(currentUserId)
|
||||
.Returns(new List<Device>
|
||||
{
|
||||
deviceOne,
|
||||
deviceTwo,
|
||||
});
|
||||
|
||||
var currentDeviceModel = new DeviceKeysUpdateRequestModel
|
||||
{
|
||||
EncryptedPublicKey = "current_encrypted_public_key",
|
||||
EncryptedUserKey = "current_encrypted_user_key",
|
||||
};
|
||||
|
||||
await Assert.ThrowsAsync<NotFoundException>(() =>
|
||||
sutProvider.Sut.UpdateDevicesTrustAsync("current_device", currentUserId, currentDeviceModel,
|
||||
Enumerable.Empty<OtherDeviceKeysUpdateRequestModel>()));
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Story: This should only happen from a poorly implemented user of this method but important to enforce someone
|
||||
/// using the method correctly, a device should only be rotated intentionally and including it as both the current
|
||||
/// device and one of the users other device would mean they could rotate it twice and we aren't sure
|
||||
/// which one they would want to win out.
|
||||
/// </summary>
|
||||
[Theory, BitAutoData]
|
||||
public async Task UpdateDevicesTrustAsync_ThrowsBadRequestException_WhenCurrentDeviceIsIncludedInAlteredDevices(
|
||||
SutProvider<DeviceService> sutProvider,
|
||||
Guid currentUserId,
|
||||
Device deviceOne,
|
||||
Device deviceTwo)
|
||||
{
|
||||
deviceOne.Identifier = "current_device";
|
||||
|
||||
sutProvider.GetDependency<IDeviceRepository>()
|
||||
.GetManyByUserIdAsync(currentUserId)
|
||||
.Returns(new List<Device>
|
||||
{
|
||||
deviceOne,
|
||||
deviceTwo,
|
||||
});
|
||||
|
||||
var currentDeviceModel = new DeviceKeysUpdateRequestModel
|
||||
{
|
||||
EncryptedPublicKey = "current_encrypted_public_key",
|
||||
EncryptedUserKey = "current_encrypted_user_key",
|
||||
};
|
||||
|
||||
var alteredDeviceModels = new List<OtherDeviceKeysUpdateRequestModel>
|
||||
{
|
||||
new OtherDeviceKeysUpdateRequestModel
|
||||
{
|
||||
DeviceId = deviceOne.Id, // current device is included in alteredDevices
|
||||
EncryptedPublicKey = "encrypted_public_key_one",
|
||||
EncryptedUserKey = "encrypted_user_key_one",
|
||||
},
|
||||
};
|
||||
|
||||
await Assert.ThrowsAsync<BadRequestException>(() =>
|
||||
sutProvider.Sut.UpdateDevicesTrustAsync("current_device", currentUserId, currentDeviceModel, alteredDeviceModels));
|
||||
}
|
||||
}
|
||||
|
||||
@ -406,7 +406,7 @@ public class PolicyServiceTests
|
||||
[BitAutoData(true, false)]
|
||||
[BitAutoData(false, true)]
|
||||
[BitAutoData(false, false)]
|
||||
public async Task SaveAsync_PolicyRequiredByTrustedDeviceEncryption_DisablePolicyOrDisableAutomaticEnrollment_ThrowsBadRequest(
|
||||
public async Task SaveAsync_ResetPasswordPolicyRequiredByTrustedDeviceEncryption_DisablePolicyOrDisableAutomaticEnrollment_ThrowsBadRequest(
|
||||
bool policyEnabled,
|
||||
bool autoEnrollEnabled,
|
||||
[PolicyFixtures.Policy(PolicyType.ResetPassword)] Policy policy,
|
||||
@ -448,6 +448,43 @@ public class PolicyServiceTests
|
||||
.LogPolicyEventAsync(default, default, default);
|
||||
}
|
||||
|
||||
[Theory, BitAutoData]
|
||||
public async Task SaveAsync_RequireSsoPolicyRequiredByTrustedDeviceEncryption_DisablePolicy_ThrowsBadRequest(
|
||||
[PolicyFixtures.Policy(PolicyType.RequireSso)] Policy policy,
|
||||
SutProvider<PolicyService> sutProvider)
|
||||
{
|
||||
policy.Enabled = false;
|
||||
|
||||
SetupOrg(sutProvider, policy.OrganizationId, new Organization
|
||||
{
|
||||
Id = policy.OrganizationId,
|
||||
UsePolicies = true,
|
||||
});
|
||||
|
||||
var ssoConfig = new SsoConfig { Enabled = true };
|
||||
ssoConfig.SetData(new SsoConfigurationData { MemberDecryptionType = MemberDecryptionType.TrustedDeviceEncryption });
|
||||
|
||||
sutProvider.GetDependency<ISsoConfigRepository>()
|
||||
.GetByOrganizationIdAsync(policy.OrganizationId)
|
||||
.Returns(ssoConfig);
|
||||
|
||||
var badRequestException = await Assert.ThrowsAsync<BadRequestException>(
|
||||
() => sutProvider.Sut.SaveAsync(policy,
|
||||
Substitute.For<IUserService>(),
|
||||
Substitute.For<IOrganizationService>(),
|
||||
Guid.NewGuid()));
|
||||
|
||||
Assert.Contains("Trusted device encryption is on and requires this policy.", badRequestException.Message, StringComparison.OrdinalIgnoreCase);
|
||||
|
||||
await sutProvider.GetDependency<IPolicyRepository>()
|
||||
.DidNotReceiveWithAnyArgs()
|
||||
.UpsertAsync(default);
|
||||
|
||||
await sutProvider.GetDependency<IEventService>()
|
||||
.DidNotReceiveWithAnyArgs()
|
||||
.LogPolicyEventAsync(default, default, default);
|
||||
}
|
||||
|
||||
[Theory, BitAutoData]
|
||||
public async Task SaveAsync_PolicyRequiredForAccountRecovery_NotEnabled_ThrowsBadRequestAsync(
|
||||
[PolicyFixtures.Policy(Enums.PolicyType.ResetPassword)] Policy policy, SutProvider<PolicyService> sutProvider)
|
||||
|
||||
@ -1,15 +1,23 @@
|
||||
using System.Text.Json;
|
||||
using Bit.Core.Auth.Enums;
|
||||
using Bit.Core.Auth.Models;
|
||||
using Bit.Core.Context;
|
||||
using Bit.Core.Entities;
|
||||
using Bit.Core.Models.Business;
|
||||
using Bit.Core.Models.Data.Organizations;
|
||||
using Bit.Core.Repositories;
|
||||
using Bit.Core.Services;
|
||||
using Bit.Core.Settings;
|
||||
using Bit.Core.Tools.Services;
|
||||
using Bit.Core.Vault.Repositories;
|
||||
using Bit.Test.Common.AutoFixture;
|
||||
using Bit.Test.Common.AutoFixture.Attributes;
|
||||
using Bit.Test.Common.Helpers;
|
||||
using Fido2NetLib;
|
||||
using Microsoft.AspNetCore.DataProtection;
|
||||
using Microsoft.AspNetCore.Identity;
|
||||
using Microsoft.Extensions.Logging;
|
||||
using Microsoft.Extensions.Options;
|
||||
using NSubstitute;
|
||||
using NSubstitute.ReceivedExtensions;
|
||||
using Xunit;
|
||||
@ -134,7 +142,7 @@ public class UserServiceTests
|
||||
}
|
||||
|
||||
[Theory, BitAutoData]
|
||||
public async void HasPremiumFromOrganization_Returns_False_If_No_Orgs(SutProvider<UserService> sutProvider, User user)
|
||||
public async Task HasPremiumFromOrganization_Returns_False_If_No_Orgs(SutProvider<UserService> sutProvider, User user)
|
||||
{
|
||||
sutProvider.GetDependency<IOrganizationUserRepository>().GetManyByUserAsync(user.Id).Returns(new List<OrganizationUser>());
|
||||
Assert.False(await sutProvider.Sut.HasPremiumFromOrganization(user));
|
||||
@ -144,7 +152,7 @@ public class UserServiceTests
|
||||
[Theory]
|
||||
[BitAutoData(false, true)]
|
||||
[BitAutoData(true, false)]
|
||||
public async void HasPremiumFromOrganization_Returns_False_If_Org_Not_Eligible(bool orgEnabled, bool orgUsersGetPremium, SutProvider<UserService> sutProvider, User user, OrganizationUser orgUser, Organization organization)
|
||||
public async Task HasPremiumFromOrganization_Returns_False_If_Org_Not_Eligible(bool orgEnabled, bool orgUsersGetPremium, SutProvider<UserService> sutProvider, User user, OrganizationUser orgUser, Organization organization)
|
||||
{
|
||||
orgUser.OrganizationId = organization.Id;
|
||||
organization.Enabled = orgEnabled;
|
||||
@ -158,7 +166,7 @@ public class UserServiceTests
|
||||
}
|
||||
|
||||
[Theory, BitAutoData]
|
||||
public async void HasPremiumFromOrganization_Returns_True_If_Org_Eligible(SutProvider<UserService> sutProvider, User user, OrganizationUser orgUser, Organization organization)
|
||||
public async Task HasPremiumFromOrganization_Returns_True_If_Org_Eligible(SutProvider<UserService> sutProvider, User user, OrganizationUser orgUser, Organization organization)
|
||||
{
|
||||
orgUser.OrganizationId = organization.Id;
|
||||
organization.Enabled = true;
|
||||
@ -170,4 +178,145 @@ public class UserServiceTests
|
||||
|
||||
Assert.True(await sutProvider.Sut.HasPremiumFromOrganization(user));
|
||||
}
|
||||
|
||||
[Flags]
|
||||
public enum ShouldCheck
|
||||
{
|
||||
Password = 0x1,
|
||||
OTP = 0x2,
|
||||
}
|
||||
|
||||
[Theory]
|
||||
// A user who has a password, and the password is valid should only check for that password
|
||||
[BitAutoData(true, "test_password", true, ShouldCheck.Password)]
|
||||
// A user who does not have a password, should only check if the OTP is valid
|
||||
[BitAutoData(false, "otp_token", true, ShouldCheck.OTP)]
|
||||
// A user who has a password but supplied a OTP, it will check password first and then try OTP
|
||||
[BitAutoData(true, "otp_token", true, ShouldCheck.Password | ShouldCheck.OTP)]
|
||||
// A user who does not have a password and supplied an invalid OTP token, should only check OTP and return invalid
|
||||
[BitAutoData(false, "bad_otp_token", false, ShouldCheck.OTP)]
|
||||
// A user who does have a password but they supply a bad one, we will check both but it will still be invalid
|
||||
[BitAutoData(true, "bad_test_password", false, ShouldCheck.Password | ShouldCheck.OTP)]
|
||||
public async Task VerifySecretAsync_Works(
|
||||
bool shouldHavePassword, string secret, bool expectedIsVerified, ShouldCheck shouldCheck, // inline theory data
|
||||
SutProvider<UserService> sutProvider, User user) // AutoFixture injected data
|
||||
{
|
||||
// Arrange
|
||||
var tokenProvider = SetupFakeTokenProvider(sutProvider, user);
|
||||
SetupUserAndDevice(user, shouldHavePassword);
|
||||
|
||||
// Setup the fake password verification
|
||||
var substitutedUserPasswordStore = Substitute.For<IUserPasswordStore<User>>();
|
||||
substitutedUserPasswordStore
|
||||
.GetPasswordHashAsync(user, Arg.Any<CancellationToken>())
|
||||
.Returns((ci) =>
|
||||
{
|
||||
return Task.FromResult("hashed_test_password");
|
||||
});
|
||||
|
||||
sutProvider.SetDependency<IUserStore<User>>(substitutedUserPasswordStore, "store");
|
||||
|
||||
sutProvider.GetDependency<IPasswordHasher<User>>("passwordHasher")
|
||||
.VerifyHashedPassword(user, "hashed_test_password", "test_password")
|
||||
.Returns((ci) =>
|
||||
{
|
||||
return PasswordVerificationResult.Success;
|
||||
});
|
||||
|
||||
// HACK: SutProvider is being weird about not injecting the IPasswordHasher that I configured
|
||||
var sut = new UserService(
|
||||
sutProvider.GetDependency<IUserRepository>(),
|
||||
sutProvider.GetDependency<ICipherRepository>(),
|
||||
sutProvider.GetDependency<IOrganizationUserRepository>(),
|
||||
sutProvider.GetDependency<IOrganizationRepository>(),
|
||||
sutProvider.GetDependency<IMailService>(),
|
||||
sutProvider.GetDependency<IPushNotificationService>(),
|
||||
sutProvider.GetDependency<IUserStore<User>>(),
|
||||
sutProvider.GetDependency<IOptions<IdentityOptions>>(),
|
||||
sutProvider.GetDependency<IPasswordHasher<User>>(),
|
||||
sutProvider.GetDependency<IEnumerable<IUserValidator<User>>>(),
|
||||
sutProvider.GetDependency<IEnumerable<IPasswordValidator<User>>>(),
|
||||
sutProvider.GetDependency<ILookupNormalizer>(),
|
||||
sutProvider.GetDependency<IdentityErrorDescriber>(),
|
||||
sutProvider.GetDependency<IServiceProvider>(),
|
||||
sutProvider.GetDependency<ILogger<UserManager<User>>>(),
|
||||
sutProvider.GetDependency<ILicensingService>(),
|
||||
sutProvider.GetDependency<IEventService>(),
|
||||
sutProvider.GetDependency<IApplicationCacheService>(),
|
||||
sutProvider.GetDependency<IDataProtectionProvider>(),
|
||||
sutProvider.GetDependency<IPaymentService>(),
|
||||
sutProvider.GetDependency<IPolicyRepository>(),
|
||||
sutProvider.GetDependency<IPolicyService>(),
|
||||
sutProvider.GetDependency<IReferenceEventService>(),
|
||||
sutProvider.GetDependency<IFido2>(),
|
||||
sutProvider.GetDependency<ICurrentContext>(),
|
||||
sutProvider.GetDependency<IGlobalSettings>(),
|
||||
sutProvider.GetDependency<IOrganizationService>(),
|
||||
sutProvider.GetDependency<IProviderUserRepository>(),
|
||||
sutProvider.GetDependency<IStripeSyncService>());
|
||||
|
||||
var actualIsVerified = await sut.VerifySecretAsync(user, secret);
|
||||
|
||||
Assert.Equal(expectedIsVerified, actualIsVerified);
|
||||
|
||||
await tokenProvider
|
||||
.Received(shouldCheck.HasFlag(ShouldCheck.OTP) ? 1 : 0)
|
||||
.ValidateAsync(Arg.Any<string>(), secret, Arg.Any<UserManager<User>>(), user);
|
||||
|
||||
sutProvider.GetDependency<IPasswordHasher<User>>()
|
||||
.Received(shouldCheck.HasFlag(ShouldCheck.Password) ? 1 : 0)
|
||||
.VerifyHashedPassword(user, "hashed_test_password", secret);
|
||||
}
|
||||
|
||||
private static void SetupUserAndDevice(User user,
|
||||
bool shouldHavePassword)
|
||||
{
|
||||
if (shouldHavePassword)
|
||||
{
|
||||
user.MasterPassword = "test_password";
|
||||
}
|
||||
else
|
||||
{
|
||||
user.MasterPassword = null;
|
||||
}
|
||||
}
|
||||
|
||||
private static IUserTwoFactorTokenProvider<User> SetupFakeTokenProvider(SutProvider<UserService> sutProvider, User user)
|
||||
{
|
||||
var fakeUserTwoFactorProvider = Substitute.For<IUserTwoFactorTokenProvider<User>>();
|
||||
|
||||
fakeUserTwoFactorProvider
|
||||
.GenerateAsync(Arg.Any<string>(), Arg.Any<UserManager<User>>(), user)
|
||||
.Returns("OTP_TOKEN");
|
||||
|
||||
fakeUserTwoFactorProvider
|
||||
.ValidateAsync(Arg.Any<string>(), Arg.Is<string>(s => s != "otp_token"), Arg.Any<UserManager<User>>(), user)
|
||||
.Returns(false);
|
||||
|
||||
fakeUserTwoFactorProvider
|
||||
.ValidateAsync(Arg.Any<string>(), "otp_token", Arg.Any<UserManager<User>>(), user)
|
||||
.Returns(true);
|
||||
|
||||
sutProvider.GetDependency<IOptions<IdentityOptions>>()
|
||||
.Value.Returns(new IdentityOptions
|
||||
{
|
||||
Tokens = new TokenOptions
|
||||
{
|
||||
ProviderMap = new Dictionary<string, TokenProviderDescriptor>()
|
||||
{
|
||||
["Email"] = new TokenProviderDescriptor(typeof(IUserTwoFactorTokenProvider<User>))
|
||||
{
|
||||
ProviderInstance = fakeUserTwoFactorProvider,
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
// The above arranging of dependencies is used in the constructor of UserManager
|
||||
// ref: https://github.com/dotnet/aspnetcore/blob/bfeb3bf9005c36b081d1e48725531ee0e15a9dfb/src/Identity/Extensions.Core/src/UserManager.cs#L103-L120
|
||||
// since the constructor of the Sut has ran already (when injected) I need to recreate it to get it to run again
|
||||
sutProvider.Create();
|
||||
|
||||
return fakeUserTwoFactorProvider;
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user