nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-06-30 15:42:48 -05:00
Code Activity

SM-655: Add Authorizations and Tests for the SM Porting Controller (#2802)

Browse Source 
* SM-655: Add Authorize attribute for secrets on the SM Porting Controller

* SM-655: Add access secrets manager check to SM Import and Export

* SM-655: Add tests for export and import endpoints
This commit is contained in:
Colton Hurst
2023-03-15 11:51:01 -04:00
committed by GitHub
parent 388caa28f8
commit 1dc9aad1f1
2 changed files with 83 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/Api/SecretsManager/Controllers/SecretsManagerPortingController.cs
View File

@ -6,11 +6,13 @@ using Bit.Core.Exceptions;
using Bit.Core.SecretsManager.Commands.Porting.Interfaces;
using Bit.Core.SecretsManager.Repositories;
using Bit.Core.Services;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
namespace Bit.Api.SecretsManager.Controllers;
[SecretsManager]
[Authorize("secrets")]
public class SecretsManagerPortingController : Controller
{
private readonly ISecretRepository _secretRepository;
@ -31,7 +33,7 @@ public class SecretsManagerPortingController : Controller
[HttpGet("sm/{organizationId}/export")]
public async Task<SMExportResponseModel> Export([FromRoute] Guid organizationId, [FromRoute] string format = "json")
{
if (!await _currentContext.OrganizationAdmin(organizationId))
if (!await _currentContext.OrganizationAdmin(organizationId) || !_currentContext.AccessSecretsManager(organizationId))
{
throw new NotFoundException();
}
@ -51,7 +53,7 @@ public class SecretsManagerPortingController : Controller
[HttpPost("sm/{organizationId}/import")]
public async Task Import([FromRoute] Guid organizationId, [FromBody] SMImportRequestModel importRequest)
{
if (!await _currentContext.OrganizationAdmin(organizationId))
if (!await _currentContext.OrganizationAdmin(organizationId) || !_currentContext.AccessSecretsManager(organizationId))
{
throw new NotFoundException();
}