[SM-473] Access Policies - Service Accounts (#2658)

* Add service account access policy endpoints

* Add unit & integration tests for new endpoints

* Fix formatting on response models

* Cleanup unit tests

src/Api/SecretsManager/Controllers/AccessPoliciesController.cs

@@ -20,13 +20,13 @@ namespace Bit.Api.SecretsManager.Controllers;
 public class AccessPoliciesController : Controller
 {
     private readonly IAccessPolicyRepository _accessPolicyRepository;
+    private readonly IServiceAccountRepository _serviceAccountRepository;
     private readonly ICreateAccessPoliciesCommand _createAccessPoliciesCommand;
     private readonly ICurrentContext _currentContext;
     private readonly IDeleteAccessPolicyCommand _deleteAccessPolicyCommand;
     private readonly IGroupRepository _groupRepository;
     private readonly IOrganizationUserRepository _organizationUserRepository;
     private readonly IProjectRepository _projectRepository;
-    private readonly IServiceAccountRepository _serviceAccountRepository;
     private readonly IUpdateAccessPolicyCommand _updateAccessPolicyCommand;
     private readonly IUserService _userService;
 
@@ -74,6 +74,26 @@ public class AccessPoliciesController : Controller
         return new ProjectAccessPoliciesResponseModel(results);
     }
 
+    [HttpPost("/service-accounts/{id}/access-policies")]
+    public async Task<ServiceAccountAccessPoliciesResponseModel> CreateServiceAccountAccessPoliciesAsync([FromRoute] Guid id,
+        [FromBody] AccessPoliciesCreateRequest request)
+    {
+        var userId = _userService.GetProperUserId(User).Value;
+        var policies = request.ToBaseAccessPoliciesForServiceAccount(id);
+        var results = await _createAccessPoliciesCommand.CreateForServiceAccountAsync(id, policies, userId);
+        return new ServiceAccountAccessPoliciesResponseModel(results);
+    }
+
+    [HttpGet("/service-accounts/{id}/access-policies")]
+    public async Task<ServiceAccountAccessPoliciesResponseModel> GetServiceAccountAccessPoliciesAsync([FromRoute] Guid id)
+    {
+        var serviceAccount = await _serviceAccountRepository.GetByIdAsync(id);
+        await CheckUserHasWriteAccessToServiceAccountAsync(serviceAccount);
+
+        var results = await _accessPolicyRepository.GetManyByGrantedServiceAccountIdAsync(id);
+        return new ServiceAccountAccessPoliciesResponseModel(results);
+    }
+
     [HttpPut("{id}")]
     public async Task<BaseAccessPolicyResponseModel> UpdateAccessPolicyAsync([FromRoute] Guid id,
         [FromBody] AccessPolicyUpdateRequest request)
@@ -84,7 +104,9 @@ public class AccessPoliciesController : Controller
         return result switch
         {
             UserProjectAccessPolicy accessPolicy => new UserProjectAccessPolicyResponseModel(accessPolicy),
+            UserServiceAccountAccessPolicy accessPolicy => new UserServiceAccountAccessPolicyResponseModel(accessPolicy),
             GroupProjectAccessPolicy accessPolicy => new GroupProjectAccessPolicyResponseModel(accessPolicy),
+            GroupServiceAccountAccessPolicy accessPolicy => new GroupServiceAccountAccessPolicyResponseModel(accessPolicy),
             ServiceAccountProjectAccessPolicy accessPolicy => new ServiceAccountProjectAccessPolicyResponseModel(
                 accessPolicy),
             _ => throw new ArgumentException("Unsupported access policy type provided."),
@@ -163,4 +185,27 @@ public class AccessPoliciesController : Controller
             throw new NotFoundException();
         }
     }
+
+    private async Task CheckUserHasWriteAccessToServiceAccountAsync(ServiceAccount serviceAccount)
+    {
+        if (serviceAccount == null || !_currentContext.AccessSecretsManager(serviceAccount.OrganizationId))
+        {
+            throw new NotFoundException();
+        }
+        var userId = _userService.GetProperUserId(User).Value;
+        var orgAdmin = await _currentContext.OrganizationAdmin(serviceAccount.OrganizationId);
+        var accessClient = AccessClientHelper.ToAccessClient(_currentContext.ClientType, orgAdmin);
+
+        var hasAccess = accessClient switch
+        {
+            AccessClientType.NoAccessCheck => true,
+            AccessClientType.User => await _serviceAccountRepository.UserHasWriteAccessToServiceAccount(serviceAccount.Id, userId),
+            _ => false,
+        };
+
+        if (!hasAccess)
+        {
+            throw new NotFoundException();
+        }
+    }
 }

src/Api/SecretsManager/Models/Request/AccessPoliciesCreateRequest.cs

@@ -13,7 +13,7 @@ public class AccessPoliciesCreateRequest
 
     public IEnumerable<AccessPolicyRequest>? ServiceAccountAccessPolicyRequests { get; set; }
 
-    public List<BaseAccessPolicy> ToBaseAccessPoliciesForProject(Guid projectId)
+    public List<BaseAccessPolicy> ToBaseAccessPoliciesForProject(Guid grantedProjectId)
     {
         if (UserAccessPolicyRequests == null && GroupAccessPolicyRequests == null && ServiceAccountAccessPolicyRequests == null)
         {
@@ -21,18 +21,55 @@ public class AccessPoliciesCreateRequest
         }
 
         var userAccessPolicies = UserAccessPolicyRequests?
-            .Select(x => x.ToUserProjectAccessPolicy(projectId)).ToList();
+            .Select(x => x.ToUserProjectAccessPolicy(grantedProjectId)).ToList();
 
         var groupAccessPolicies = GroupAccessPolicyRequests?
-            .Select(x => x.ToGroupProjectAccessPolicy(projectId)).ToList();
+            .Select(x => x.ToGroupProjectAccessPolicy(grantedProjectId)).ToList();
 
         var serviceAccountAccessPolicies = ServiceAccountAccessPolicyRequests?
-            .Select(x => x.ToServiceAccountProjectAccessPolicy(projectId)).ToList();
+            .Select(x => x.ToServiceAccountProjectAccessPolicy(grantedProjectId)).ToList();
 
         var policies = new List<BaseAccessPolicy>();
-        if (userAccessPolicies != null) { policies.AddRange(userAccessPolicies); }
-        if (groupAccessPolicies != null) { policies.AddRange(groupAccessPolicies); }
-        if (serviceAccountAccessPolicies != null) { policies.AddRange(serviceAccountAccessPolicies); }
+        if (userAccessPolicies != null)
+        {
+            policies.AddRange(userAccessPolicies);
+        }
+
+        if (groupAccessPolicies != null)
+        {
+            policies.AddRange(groupAccessPolicies);
+        }
+
+        if (serviceAccountAccessPolicies != null)
+        {
+            policies.AddRange(serviceAccountAccessPolicies);
+        }
+        return policies;
+    }
+
+    public List<BaseAccessPolicy> ToBaseAccessPoliciesForServiceAccount(Guid grantedServiceAccountId)
+    {
+        if (UserAccessPolicyRequests == null && GroupAccessPolicyRequests == null)
+        {
+            throw new BadRequestException("No creation requests provided.");
+        }
+
+        var userAccessPolicies = UserAccessPolicyRequests?
+            .Select(x => x.ToUserServiceAccountAccessPolicy(grantedServiceAccountId)).ToList();
+
+        var groupAccessPolicies = GroupAccessPolicyRequests?
+            .Select(x => x.ToGroupServiceAccountAccessPolicy(grantedServiceAccountId)).ToList();
+
+        var policies = new List<BaseAccessPolicy>();
+        if (userAccessPolicies != null)
+        {
+            policies.AddRange(userAccessPolicies);
+        }
+
+        if (groupAccessPolicies != null)
+        {
+            policies.AddRange(groupAccessPolicies);
+        }
         return policies;
     }
 }
@@ -74,4 +111,22 @@ public class AccessPolicyRequest
             Read = Read,
             Write = Write
         };
+
+    public UserServiceAccountAccessPolicy ToUserServiceAccountAccessPolicy(Guid id) =>
+        new()
+        {
+            OrganizationUserId = GranteeId,
+            GrantedServiceAccountId = id,
+            Read = Read,
+            Write = Write
+        };
+
+    public GroupServiceAccountAccessPolicy ToGroupServiceAccountAccessPolicy(Guid id) =>
+        new()
+        {
+            GroupId = GranteeId,
+            GrantedServiceAccountId = id,
+            Read = Read,
+            Write = Write
+        };
 }

src/Api/SecretsManager/Models/Response/ProjectAccessPoliciesResponseModel.cs

@@ -11,6 +11,7 @@ public class ProjectAccessPoliciesResponseModel : ResponseModel
         : base(_objectName)
     {
         foreach (var baseAccessPolicy in baseAccessPolicies)
+        {
             switch (baseAccessPolicy)
             {
                 case UserProjectAccessPolicy accessPolicy:
@@ -24,6 +25,7 @@ public class ProjectAccessPoliciesResponseModel : ResponseModel
                         new ServiceAccountProjectAccessPolicyResponseModel(accessPolicy));
                     break;
             }
+        }
     }
 
     public ProjectAccessPoliciesResponseModel() : base(_objectName)

src/Api/SecretsManager/Models/Response/ServiceAccountAccessPoliciesResponseModel.cs

@@ -0,0 +1,39 @@
+using Bit.Core.Models.Api;
+using Bit.Core.SecretsManager.Entities;
+
+namespace Bit.Api.SecretsManager.Models.Response;
+
+public class ServiceAccountAccessPoliciesResponseModel : ResponseModel
+{
+    private const string _objectName = "serviceAccountAccessPolicies";
+
+    public ServiceAccountAccessPoliciesResponseModel(IEnumerable<BaseAccessPolicy> baseAccessPolicies)
+        : base(_objectName)
+    {
+        if (baseAccessPolicies == null)
+        {
+            return;
+        }
+
+        foreach (var baseAccessPolicy in baseAccessPolicies)
+        {
+            switch (baseAccessPolicy)
+            {
+                case UserServiceAccountAccessPolicy accessPolicy:
+                    UserAccessPolicies.Add(new UserServiceAccountAccessPolicyResponseModel(accessPolicy));
+                    break;
+                case GroupServiceAccountAccessPolicy accessPolicy:
+                    GroupAccessPolicies.Add(new GroupServiceAccountAccessPolicyResponseModel(accessPolicy));
+                    break;
+            }
+        }
+    }
+
+    public ServiceAccountAccessPoliciesResponseModel() : base(_objectName)
+    {
+    }
+
+    public List<UserServiceAccountAccessPolicyResponseModel> UserAccessPolicies { get; set; } = new();
+
+    public List<GroupServiceAccountAccessPolicyResponseModel> GroupAccessPolicies { get; set; } = new();
+}