[PM-3779] idor allow the attacker to delete the victim domain (#3308)

* [PM-3779] Added IOrganizationDomainRepository.GetDomainByIdAndOrganizationIdAsync and SQL stored procedure

* [PM-3779] Changed GetOrganizationDomainByIdQuery to also take OrgId as a parameter. Updated existing unit tests and added new. Updated controller to match command changes

* [PM-3779] Removed type from url routes

* [PM-3779] Renamed IGetOrganizationDomainByIdAndOrganizationIdQuery to IGetOrganizationDomainByIdOrganizationIdQuery

* [PM-3779] Renamed GetOrganizationDomainByIdOrganizationIdQueryTests file and added more tests

src/Api/Controllers/OrganizationDomainController.cs

@@ -19,7 +19,7 @@ public class OrganizationDomainController : Controller
     private readonly ICreateOrganizationDomainCommand _createOrganizationDomainCommand;
     private readonly IVerifyOrganizationDomainCommand _verifyOrganizationDomainCommand;
     private readonly IDeleteOrganizationDomainCommand _deleteOrganizationDomainCommand;
-    private readonly IGetOrganizationDomainByIdQuery _getOrganizationDomainByIdQuery;
+    private readonly IGetOrganizationDomainByIdOrganizationIdQuery _getOrganizationDomainByIdAndOrganizationIdQuery;
     private readonly IGetOrganizationDomainByOrganizationIdQuery _getOrganizationDomainByOrganizationIdQuery;
     private readonly ICurrentContext _currentContext;
     private readonly IOrganizationRepository _organizationRepository;
@@ -29,7 +29,7 @@ public class OrganizationDomainController : Controller
         ICreateOrganizationDomainCommand createOrganizationDomainCommand,
         IVerifyOrganizationDomainCommand verifyOrganizationDomainCommand,
         IDeleteOrganizationDomainCommand deleteOrganizationDomainCommand,
-        IGetOrganizationDomainByIdQuery getOrganizationDomainByIdQuery,
+        IGetOrganizationDomainByIdOrganizationIdQuery getOrganizationDomainByIdAndOrganizationIdQuery,
         IGetOrganizationDomainByOrganizationIdQuery getOrganizationDomainByOrganizationIdQuery,
         ICurrentContext currentContext,
         IOrganizationRepository organizationRepository,
@@ -38,7 +38,7 @@ public class OrganizationDomainController : Controller
         _createOrganizationDomainCommand = createOrganizationDomainCommand;
         _verifyOrganizationDomainCommand = verifyOrganizationDomainCommand;
         _deleteOrganizationDomainCommand = deleteOrganizationDomainCommand;
-        _getOrganizationDomainByIdQuery = getOrganizationDomainByIdQuery;
+        _getOrganizationDomainByIdAndOrganizationIdQuery = getOrganizationDomainByIdAndOrganizationIdQuery;
         _getOrganizationDomainByOrganizationIdQuery = getOrganizationDomainByOrganizationIdQuery;
         _currentContext = currentContext;
         _organizationRepository = organizationRepository;
@@ -46,71 +46,78 @@ public class OrganizationDomainController : Controller
     }
 
     [HttpGet("{orgId}/domain")]
-    public async Task<ListResponseModel<OrganizationDomainResponseModel>> Get(string orgId)
+    public async Task<ListResponseModel<OrganizationDomainResponseModel>> Get(Guid orgId)
     {
-        var orgIdGuid = new Guid(orgId);
+        await ValidateOrganizationAccessAsync(orgId);
-        await ValidateOrganizationAccessAsync(orgIdGuid);
 
         var domains = await _getOrganizationDomainByOrganizationIdQuery
-            .GetDomainsByOrganizationId(orgIdGuid);
+            .GetDomainsByOrganizationIdAsync(orgId);
         var response = domains.Select(x => new OrganizationDomainResponseModel(x)).ToList();
         return new ListResponseModel<OrganizationDomainResponseModel>(response);
     }
 
     [HttpGet("{orgId}/domain/{id}")]
-    public async Task<OrganizationDomainResponseModel> Get(string orgId, string id)
+    public async Task<OrganizationDomainResponseModel> Get(Guid orgId, Guid id)
     {
-        var orgIdGuid = new Guid(orgId);
+        await ValidateOrganizationAccessAsync(orgId);
-        var IdGuid = new Guid(id);
-        await ValidateOrganizationAccessAsync(orgIdGuid);
 
-        var domain = await _getOrganizationDomainByIdQuery.GetOrganizationDomainById(IdGuid);
+        var organizationDomain = await _getOrganizationDomainByIdAndOrganizationIdQuery
+            .GetOrganizationDomainByIdOrganizationIdAsync(id, orgId);
+        if (organizationDomain is null)
+        {
+            throw new NotFoundException();
+        }
+
+        return new OrganizationDomainResponseModel(organizationDomain);
+    }
+
+    [HttpPost("{orgId}/domain")]
+    public async Task<OrganizationDomainResponseModel> Post(Guid orgId,
+        [FromBody] OrganizationDomainRequestModel model)
+    {
+        await ValidateOrganizationAccessAsync(orgId);
+
+        var organizationDomain = new OrganizationDomain
+        {
+            OrganizationId = orgId,
+            Txt = model.Txt,
+            DomainName = model.DomainName.ToLower()
+        };
+
+        organizationDomain = await _createOrganizationDomainCommand.CreateAsync(organizationDomain);
+
+        return new OrganizationDomainResponseModel(organizationDomain);
+    }
+
+    [HttpPost("{orgId}/domain/{id}/verify")]
+    public async Task<OrganizationDomainResponseModel> Verify(Guid orgId, Guid id)
+    {
+        await ValidateOrganizationAccessAsync(orgId);
+
+        var organizationDomain = await _organizationDomainRepository.GetDomainByIdOrganizationIdAsync(id, orgId);
+        if (organizationDomain is null)
+        {
+            throw new NotFoundException();
+        }
+
+        organizationDomain = await _verifyOrganizationDomainCommand.VerifyOrganizationDomainAsync(organizationDomain);
+
+        return new OrganizationDomainResponseModel(organizationDomain);
+    }
+
+    [HttpDelete("{orgId}/domain/{id}")]
+    [HttpPost("{orgId}/domain/{id}/remove")]
+    public async Task RemoveDomain(Guid orgId, Guid id)
+    {
+        await ValidateOrganizationAccessAsync(orgId);
+
+        var domain = await _organizationDomainRepository.GetDomainByIdOrganizationIdAsync(id, orgId);
         if (domain is null)
         {
             throw new NotFoundException();
         }
 
-        return new OrganizationDomainResponseModel(domain);
+        await _deleteOrganizationDomainCommand.DeleteAsync(domain);
-    }
-
-    [HttpPost("{orgId}/domain")]
-    public async Task<OrganizationDomainResponseModel> Post(string orgId,
-        [FromBody] OrganizationDomainRequestModel model)
-    {
-        var orgIdGuid = new Guid(orgId);
-        await ValidateOrganizationAccessAsync(orgIdGuid);
-
-        var organizationDomain = new OrganizationDomain
-        {
-            OrganizationId = orgIdGuid,
-            Txt = model.Txt,
-            DomainName = model.DomainName.ToLower()
-        };
-
-        var domain = await _createOrganizationDomainCommand.CreateAsync(organizationDomain);
-        return new OrganizationDomainResponseModel(domain);
-    }
-
-    [HttpPost("{orgId}/domain/{id}/verify")]
-    public async Task<OrganizationDomainResponseModel> Verify(string orgId, string id)
-    {
-        var orgIdGuid = new Guid(orgId);
-        var idGuid = new Guid(id);
-        await ValidateOrganizationAccessAsync(orgIdGuid);
-
-        var domain = await _verifyOrganizationDomainCommand.VerifyOrganizationDomain(idGuid);
-        return new OrganizationDomainResponseModel(domain);
-    }
-
-    [HttpDelete("{orgId}/domain/{id}")]
-    [HttpPost("{orgId}/domain/{id}/remove")]
-    public async Task RemoveDomain(string orgId, string id)
-    {
-        var orgIdGuid = new Guid(orgId);
-        var idGuid = new Guid(id);
-        await ValidateOrganizationAccessAsync(orgIdGuid);
-
-        await _deleteOrganizationDomainCommand.DeleteAsync(idGuid);
     }
 
     [AllowAnonymous]

src/Core/OrganizationFeatures/OrganizationDomains/DeleteOrganizationDomainCommand.cs

@@ -1,5 +1,5 @@
-using Bit.Core.Enums;
+using Bit.Core.Entities;
-using Bit.Core.Exceptions;
+using Bit.Core.Enums;
 using Bit.Core.OrganizationFeatures.OrganizationDomains.Interfaces;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
@@ -18,15 +18,9 @@ public class DeleteOrganizationDomainCommand : IDeleteOrganizationDomainCommand
         _eventService = eventService;
     }
 
-    public async Task DeleteAsync(Guid id)
+    public async Task DeleteAsync(OrganizationDomain organizationDomain)
     {
-        var domain = await _organizationDomainRepository.GetByIdAsync(id);
+        await _organizationDomainRepository.DeleteAsync(organizationDomain);
-        if (domain is null)
+        await _eventService.LogOrganizationDomainEventAsync(organizationDomain, EventType.OrganizationDomain_Removed);
-        {
-            throw new NotFoundException();
-        }
-
-        await _organizationDomainRepository.DeleteAsync(domain);
-        await _eventService.LogOrganizationDomainEventAsync(domain, EventType.OrganizationDomain_Removed);
     }
 }

src/Core/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByIdOrganizationIdQuery.cs

@@ -4,15 +4,15 @@ using Bit.Core.Repositories;
 
 namespace Bit.Core.OrganizationFeatures.OrganizationDomains;
 
-public class GetOrganizationDomainByIdQuery : IGetOrganizationDomainByIdQuery
+public class GetOrganizationDomainByIdOrganizationIdQuery : IGetOrganizationDomainByIdOrganizationIdQuery
 {
     private readonly IOrganizationDomainRepository _organizationDomainRepository;
 
-    public GetOrganizationDomainByIdQuery(IOrganizationDomainRepository organizationDomainRepository)
+    public GetOrganizationDomainByIdOrganizationIdQuery(IOrganizationDomainRepository organizationDomainRepository)
     {
         _organizationDomainRepository = organizationDomainRepository;
     }
 
-    public async Task<OrganizationDomain> GetOrganizationDomainById(Guid id)
+    public async Task<OrganizationDomain> GetOrganizationDomainByIdOrganizationIdAsync(Guid id, Guid organizationId)
-        => await _organizationDomainRepository.GetByIdAsync(id);
+        => await _organizationDomainRepository.GetDomainByIdOrganizationIdAsync(id, organizationId);
 }

src/Core/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByOrganizationIdQuery.cs

@@ -13,6 +13,6 @@ public class GetOrganizationDomainByOrganizationIdQuery : IGetOrganizationDomain
         _organizationDomainRepository = organizationDomainRepository;
     }
 
-    public async Task<ICollection<OrganizationDomain>> GetDomainsByOrganizationId(Guid orgId)
+    public async Task<ICollection<OrganizationDomain>> GetDomainsByOrganizationIdAsync(Guid orgId)
         => await _organizationDomainRepository.GetDomainsByOrganizationIdAsync(orgId);
 }

src/Core/OrganizationFeatures/OrganizationDomains/Interfaces/IDeleteOrganizationDomainCommand.cs

@@ -1,6 +1,8 @@
-namespace Bit.Core.OrganizationFeatures.OrganizationDomains.Interfaces;
+using Bit.Core.Entities;
+
+namespace Bit.Core.OrganizationFeatures.OrganizationDomains.Interfaces;
 
 public interface IDeleteOrganizationDomainCommand
 {
-    Task DeleteAsync(Guid id);
+    Task DeleteAsync(OrganizationDomain organizationDomain);
 }

src/Core/OrganizationFeatures/OrganizationDomains/Interfaces/IGetOrganizationDomainByIdOrganizationIdQuery.cs

@@ -0,0 +1,8 @@
+using Bit.Core.Entities;
+
+namespace Bit.Core.OrganizationFeatures.OrganizationDomains.Interfaces;
+
+public interface IGetOrganizationDomainByIdOrganizationIdQuery
+{
+    Task<OrganizationDomain> GetOrganizationDomainByIdOrganizationIdAsync(Guid id, Guid organizationId);
+}

src/Core/OrganizationFeatures/OrganizationDomains/Interfaces/IGetOrganizationDomainByIdQuery.cs

@@ -1,8 +0,0 @@
-using Bit.Core.Entities;
-
-namespace Bit.Core.OrganizationFeatures.OrganizationDomains.Interfaces;
-
-public interface IGetOrganizationDomainByIdQuery
-{
-    Task<OrganizationDomain> GetOrganizationDomainById(Guid id);
-}

src/Core/OrganizationFeatures/OrganizationDomains/Interfaces/IGetOrganizationDomainByOrganizationIdQuery.cs

@@ -4,5 +4,5 @@ namespace Bit.Core.OrganizationFeatures.OrganizationDomains.Interfaces;
 
 public interface IGetOrganizationDomainByOrganizationIdQuery
 {
-    Task<ICollection<OrganizationDomain>> GetDomainsByOrganizationId(Guid orgId);
+    Task<ICollection<OrganizationDomain>> GetDomainsByOrganizationIdAsync(Guid orgId);
 }

src/Core/OrganizationFeatures/OrganizationDomains/Interfaces/IVerifyOrganizationDomainCommand.cs

@@ -4,5 +4,5 @@ namespace Bit.Core.OrganizationFeatures.OrganizationDomains.Interfaces;
 
 public interface IVerifyOrganizationDomainCommand
 {
-    Task<OrganizationDomain> VerifyOrganizationDomain(Guid id);
+    Task<OrganizationDomain> VerifyOrganizationDomainAsync(OrganizationDomain organizationDomain);
 }

src/Core/OrganizationFeatures/OrganizationDomains/VerifyOrganizationDomainCommand.cs

@@ -27,14 +27,8 @@ public class VerifyOrganizationDomainCommand : IVerifyOrganizationDomainCommand
         _logger = logger;
     }
 
-    public async Task<OrganizationDomain> VerifyOrganizationDomain(Guid id)
+    public async Task<OrganizationDomain> VerifyOrganizationDomainAsync(OrganizationDomain domain)
     {
-        var domain = await _organizationDomainRepository.GetByIdAsync(id);
-        if (domain is null)
-        {
-            throw new NotFoundException();
-        }
-
         if (domain.VerifiedDate is not null)
         {
             domain.SetLastCheckedDate();

src/Core/OrganizationFeatures/OrganizationServiceCollectionExtensions.cs

@@ -118,7 +118,7 @@ public static class OrganizationServiceCollectionExtensions
     {
         services.AddScoped<ICreateOrganizationDomainCommand, CreateOrganizationDomainCommand>();
         services.AddScoped<IVerifyOrganizationDomainCommand, VerifyOrganizationDomainCommand>();
-        services.AddScoped<IGetOrganizationDomainByIdQuery, GetOrganizationDomainByIdQuery>();
+        services.AddScoped<IGetOrganizationDomainByIdOrganizationIdQuery, GetOrganizationDomainByIdOrganizationIdQuery>();
         services.AddScoped<IGetOrganizationDomainByOrganizationIdQuery, GetOrganizationDomainByOrganizationIdQuery>();
         services.AddScoped<IDeleteOrganizationDomainCommand, DeleteOrganizationDomainCommand>();
     }

src/Core/Repositories/IOrganizationDomainRepository.cs

@@ -9,6 +9,7 @@ public interface IOrganizationDomainRepository : IRepository<OrganizationDomain,
     Task<ICollection<OrganizationDomain>> GetDomainsByOrganizationIdAsync(Guid orgId);
     Task<ICollection<OrganizationDomain>> GetManyByNextRunDateAsync(DateTime date);
     Task<OrganizationDomainSsoDetailsData> GetOrganizationDomainSsoDetailsAsync(string email);
+    Task<OrganizationDomain> GetDomainByIdOrganizationIdAsync(Guid id, Guid organizationId);
     Task<OrganizationDomain> GetDomainByOrgIdAndDomainNameAsync(Guid orgId, string domainName);
     Task<ICollection<OrganizationDomain>> GetExpiredOrganizationDomainsAsync();
     Task<bool> DeleteExpiredAsync(int expirationPeriod);

src/Infrastructure.Dapper/Repositories/OrganizationDomainRepository.cs

@@ -69,6 +69,20 @@ public class OrganizationDomainRepository : Repository<OrganizationDomain, Guid>
         }
     }
 
+    public async Task<OrganizationDomain> GetDomainByIdOrganizationIdAsync(Guid id, Guid orgId)
+    {
+        using (var connection = new SqlConnection(ConnectionString))
+        {
+            var results = await connection
+                .QueryAsync<OrganizationDomain>(
+                    $"[{Schema}].[OrganizationDomain_ReadByIdOrganizationId]",
+                    new { Id = id, OrganizationId = orgId },
+                    commandType: CommandType.StoredProcedure);
+
+            return results.SingleOrDefault();
+        }
+    }
+
     public async Task<OrganizationDomain> GetDomainByOrgIdAndDomainNameAsync(Guid orgId, string domainName)
     {
         using (var connection = new SqlConnection(ConnectionString))

src/Infrastructure.EntityFramework/Repositories/OrganizationDomainRepository.cs

@@ -93,6 +93,18 @@ public class OrganizationDomainRepository : Repository<Core.Entities.Organizatio
         return ssoDetails;
     }
 
+    public async Task<Core.Entities.OrganizationDomain> GetDomainByIdOrganizationIdAsync(Guid id, Guid orgId)
+    {
+        using var scope = ServiceScopeFactory.CreateScope();
+        var dbContext = GetDatabaseContext(scope);
+        var domain = await dbContext.OrganizationDomains
+            .Where(x => x.Id == id && x.OrganizationId == orgId)
+            .AsNoTracking()
+            .FirstOrDefaultAsync();
+
+        return Mapper.Map<Core.Entities.OrganizationDomain>(domain);
+    }
+
     public async Task<Core.Entities.OrganizationDomain> GetDomainByOrgIdAndDomainNameAsync(Guid orgId, string domainName)
     {
         using var scope = ServiceScopeFactory.CreateScope();

src/Sql/dbo/Stored Procedures/OrganizationDomain_ReadByIdOrganizationId.sql

@@ -0,0 +1,16 @@
+CREATE PROCEDURE [dbo].[OrganizationDomain_ReadByIdOrganizationId]
+    @Id UNIQUEIDENTIFIER,
+    @OrganizationId UNIQUEIDENTIFIER
+AS
+BEGIN
+    SET NOCOUNT ON
+
+SELECT
+    *
+FROM
+    [dbo].[OrganizationDomain]
+WHERE
+    [Id] = @Id
+  AND
+    [OrganizationId] = @OrganizationId
+END

test/Api.Test/Controllers/OrganizationDomainControllerTests.cs

@@ -4,6 +4,7 @@ using Bit.Api.Models.Request.Organizations;
 using Bit.Api.Models.Response;
 using Bit.Api.Models.Response.Organizations;
 using Bit.Core.Context;
+using Bit.Core.Entities;
 using Bit.Core.Exceptions;
 using Bit.Core.Models.Data.Organizations;
 using Bit.Core.OrganizationFeatures.OrganizationDomains.Interfaces;
@@ -13,8 +14,6 @@ using Bit.Test.Common.AutoFixture.Attributes;
 using NSubstitute;
 using NSubstitute.ReturnsExtensions;
 using Xunit;
-using Organization = Bit.Core.Entities.Organization;
-using OrganizationDomain = Bit.Core.Entities.OrganizationDomain;
 
 namespace Bit.Api.Test.Controllers;
 
@@ -28,7 +27,7 @@ public class OrganizationDomainControllerTests
     {
         sutProvider.GetDependency<ICurrentContext>().ManageSso(orgId).Returns(false);
 
-        var requestAction = async () => await sutProvider.Sut.Get(orgId.ToString());
+        var requestAction = async () => await sutProvider.Sut.Get(orgId);
 
         await Assert.ThrowsAsync<UnauthorizedAccessException>(requestAction);
     }
@@ -40,7 +39,7 @@ public class OrganizationDomainControllerTests
         sutProvider.GetDependency<ICurrentContext>().ManageSso(orgId).Returns(true);
         sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(orgId).ReturnsNull();
 
-        var requestAction = async () => await sutProvider.Sut.Get(orgId.ToString());
+        var requestAction = async () => await sutProvider.Sut.Get(orgId);
 
         await Assert.ThrowsAsync<NotFoundException>(requestAction);
     }
@@ -52,7 +51,7 @@ public class OrganizationDomainControllerTests
         sutProvider.GetDependency<ICurrentContext>().ManageSso(orgId).Returns(true);
         sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(orgId).Returns(new Organization());
         sutProvider.GetDependency<IGetOrganizationDomainByOrganizationIdQuery>()
-            .GetDomainsByOrganizationId(orgId).Returns(new List<OrganizationDomain>
+            .GetDomainsByOrganizationIdAsync(orgId).Returns(new List<OrganizationDomain>
             {
                 new()
                 {
@@ -64,7 +63,7 @@ public class OrganizationDomainControllerTests
                 }
             });
 
-        var result = await sutProvider.Sut.Get(orgId.ToString());
+        var result = await sutProvider.Sut.Get(orgId);
 
         Assert.IsType<ListResponseModel<OrganizationDomainResponseModel>>(result);
         Assert.Equal(orgId, result.Data.Select(x => x.OrganizationId).FirstOrDefault());
@@ -76,7 +75,7 @@ public class OrganizationDomainControllerTests
     {
         sutProvider.GetDependency<ICurrentContext>().ManageSso(orgId).Returns(false);
 
-        var requestAction = async () => await sutProvider.Sut.Get(orgId.ToString(), id.ToString());
+        var requestAction = async () => await sutProvider.Sut.Get(orgId, id);
 
         await Assert.ThrowsAsync<UnauthorizedAccessException>(requestAction);
     }
@@ -88,7 +87,7 @@ public class OrganizationDomainControllerTests
         sutProvider.GetDependency<ICurrentContext>().ManageSso(orgId).Returns(true);
         sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(orgId).ReturnsNull();
 
-        var requestAction = async () => await sutProvider.Sut.Get(orgId.ToString(), id.ToString());
+        var requestAction = async () => await sutProvider.Sut.Get(orgId, id);
 
         await Assert.ThrowsAsync<NotFoundException>(requestAction);
     }
@@ -99,9 +98,24 @@ public class OrganizationDomainControllerTests
     {
         sutProvider.GetDependency<ICurrentContext>().ManageSso(orgId).Returns(true);
         sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(orgId).Returns(new Organization());
-        sutProvider.GetDependency<IGetOrganizationDomainByIdQuery>().GetOrganizationDomainById(id).ReturnsNull();
+        sutProvider.GetDependency<IGetOrganizationDomainByIdOrganizationIdQuery>().GetOrganizationDomainByIdOrganizationIdAsync(id, orgId).ReturnsNull();
 
-        var requestAction = async () => await sutProvider.Sut.Get(orgId.ToString(), id.ToString());
+        var requestAction = async () => await sutProvider.Sut.Get(orgId, id);
+
+        await Assert.ThrowsAsync<NotFoundException>(requestAction);
+    }
+
+    [Theory, BitAutoData]
+    public async Task GetByOrgIdAndId_ShouldThrowNotFound_WhenOrgIdDoesNotMatch(OrganizationDomain organizationDomain,
+        SutProvider<OrganizationDomainController> sutProvider)
+    {
+        sutProvider.GetDependency<ICurrentContext>().ManageSso(organizationDomain.OrganizationId).Returns(true);
+        sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(organizationDomain.OrganizationId).Returns(new Organization());
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .GetDomainByIdOrganizationIdAsync(organizationDomain.Id, organizationDomain.OrganizationId)
+            .ReturnsNull();
+
+        var requestAction = async () => await sutProvider.Sut.Get(organizationDomain.OrganizationId, organizationDomain.Id);
 
         await Assert.ThrowsAsync<NotFoundException>(requestAction);
     }
@@ -112,7 +126,7 @@ public class OrganizationDomainControllerTests
     {
         sutProvider.GetDependency<ICurrentContext>().ManageSso(orgId).Returns(true);
         sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(orgId).Returns(new Organization());
-        sutProvider.GetDependency<IGetOrganizationDomainByIdQuery>().GetOrganizationDomainById(id)
+        sutProvider.GetDependency<IGetOrganizationDomainByIdOrganizationIdQuery>().GetOrganizationDomainByIdOrganizationIdAsync(id, orgId)
             .Returns(new OrganizationDomain
             {
                 Id = Guid.NewGuid(),
@@ -122,7 +136,7 @@ public class OrganizationDomainControllerTests
                 Txt = "btw+12342"
             });
 
-        var result = await sutProvider.Sut.Get(orgId.ToString(), id.ToString());
+        var result = await sutProvider.Sut.Get(orgId, id);
 
         Assert.IsType<OrganizationDomainResponseModel>(result);
         Assert.Equal(orgId, result.OrganizationId);
@@ -134,7 +148,7 @@ public class OrganizationDomainControllerTests
     {
         sutProvider.GetDependency<ICurrentContext>().ManageSso(orgId).Returns(false);
 
-        var requestAction = async () => await sutProvider.Sut.Post(orgId.ToString(), model);
+        var requestAction = async () => await sutProvider.Sut.Post(orgId, model);
 
         await Assert.ThrowsAsync<UnauthorizedAccessException>(requestAction);
     }
@@ -146,7 +160,7 @@ public class OrganizationDomainControllerTests
         sutProvider.GetDependency<ICurrentContext>().ManageSso(orgId).Returns(true);
         sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(orgId).ReturnsNull();
 
-        var requestAction = async () => await sutProvider.Sut.Post(orgId.ToString(), model);
+        var requestAction = async () => await sutProvider.Sut.Post(orgId, model);
 
         await Assert.ThrowsAsync<NotFoundException>(requestAction);
     }
@@ -160,7 +174,7 @@ public class OrganizationDomainControllerTests
         sutProvider.GetDependency<ICreateOrganizationDomainCommand>().CreateAsync(Arg.Any<OrganizationDomain>())
             .Returns(new OrganizationDomain());
 
-        var result = await sutProvider.Sut.Post(orgId.ToString(), model);
+        var result = await sutProvider.Sut.Post(orgId, model);
 
         await sutProvider.GetDependency<ICreateOrganizationDomainCommand>().ReceivedWithAnyArgs(1)
             .CreateAsync(Arg.Any<OrganizationDomain>());
@@ -173,7 +187,7 @@ public class OrganizationDomainControllerTests
     {
         sutProvider.GetDependency<ICurrentContext>().ManageSso(orgId).Returns(false);
 
-        var requestAction = async () => await sutProvider.Sut.Verify(orgId.ToString(), id.ToString());
+        var requestAction = async () => await sutProvider.Sut.Verify(orgId, id);
 
         await Assert.ThrowsAsync<UnauthorizedAccessException>(requestAction);
     }
@@ -185,24 +199,42 @@ public class OrganizationDomainControllerTests
         sutProvider.GetDependency<ICurrentContext>().ManageSso(orgId).Returns(true);
         sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(orgId).ReturnsNull();
 
-        var requestAction = async () => await sutProvider.Sut.Verify(orgId.ToString(), id.ToString());
+        var requestAction = async () => await sutProvider.Sut.Verify(orgId, id);
 
         await Assert.ThrowsAsync<NotFoundException>(requestAction);
     }
 
     [Theory, BitAutoData]
-    public async Task Verify_WhenRequestIsValid(Guid orgId, Guid id,
+    public async Task VerifyOrganizationDomain_ShouldThrowNotFound_WhenOrgIdDoesNotMatch(OrganizationDomain organizationDomain,
         SutProvider<OrganizationDomainController> sutProvider)
     {
-        sutProvider.GetDependency<ICurrentContext>().ManageSso(orgId).Returns(true);
+        sutProvider.GetDependency<ICurrentContext>().ManageSso(organizationDomain.OrganizationId).Returns(true);
-        sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(orgId).Returns(new Organization());
+        sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(organizationDomain.OrganizationId).Returns(new Organization());
-        sutProvider.GetDependency<IVerifyOrganizationDomainCommand>().VerifyOrganizationDomain(id)
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .GetDomainByIdOrganizationIdAsync(organizationDomain.Id, organizationDomain.OrganizationId)
+            .ReturnsNull();
+
+        var requestAction = async () => await sutProvider.Sut.Verify(organizationDomain.OrganizationId, organizationDomain.Id);
+
+        await Assert.ThrowsAsync<NotFoundException>(requestAction);
+    }
+
+    [Theory, BitAutoData]
+    public async Task Verify_WhenRequestIsValid(OrganizationDomain organizationDomain,
+        SutProvider<OrganizationDomainController> sutProvider)
+    {
+        sutProvider.GetDependency<ICurrentContext>().ManageSso(organizationDomain.OrganizationId).Returns(true);
+        sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(organizationDomain.OrganizationId).Returns(new Organization());
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .GetDomainByIdOrganizationIdAsync(organizationDomain.Id, organizationDomain.OrganizationId)
+            .Returns(organizationDomain);
+        sutProvider.GetDependency<IVerifyOrganizationDomainCommand>().VerifyOrganizationDomainAsync(organizationDomain)
             .Returns(new OrganizationDomain());
 
-        var result = await sutProvider.Sut.Verify(orgId.ToString(), id.ToString());
+        var result = await sutProvider.Sut.Verify(organizationDomain.OrganizationId, organizationDomain.Id);
 
         await sutProvider.GetDependency<IVerifyOrganizationDomainCommand>().Received(1)
-            .VerifyOrganizationDomain(id);
+            .VerifyOrganizationDomainAsync(organizationDomain);
         Assert.IsType<OrganizationDomainResponseModel>(result);
     }
 
@@ -212,7 +244,7 @@ public class OrganizationDomainControllerTests
     {
         sutProvider.GetDependency<ICurrentContext>().ManageSso(orgId).Returns(false);
 
-        var requestAction = async () => await sutProvider.Sut.RemoveDomain(orgId.ToString(), id.ToString());
+        var requestAction = async () => await sutProvider.Sut.RemoveDomain(orgId, id);
 
         await Assert.ThrowsAsync<UnauthorizedAccessException>(requestAction);
     }
@@ -224,22 +256,40 @@ public class OrganizationDomainControllerTests
         sutProvider.GetDependency<ICurrentContext>().ManageSso(orgId).Returns(true);
         sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(orgId).ReturnsNull();
 
-        var requestAction = async () => await sutProvider.Sut.RemoveDomain(orgId.ToString(), id.ToString());
+        var requestAction = async () => await sutProvider.Sut.RemoveDomain(orgId, id);
 
         await Assert.ThrowsAsync<NotFoundException>(requestAction);
     }
 
     [Theory, BitAutoData]
-    public async Task RemoveDomain_WhenRequestIsValid(Guid orgId, Guid id,
+    public async Task RemoveDomain_ShouldThrowNotFound_WhenOrgIdDoesNotMatch(OrganizationDomain organizationDomain,
         SutProvider<OrganizationDomainController> sutProvider)
     {
-        sutProvider.GetDependency<ICurrentContext>().ManageSso(orgId).Returns(true);
+        sutProvider.GetDependency<ICurrentContext>().ManageSso(organizationDomain.OrganizationId).Returns(true);
-        sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(orgId).Returns(new Organization());
+        sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(organizationDomain.OrganizationId).Returns(new Organization());
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .GetDomainByIdOrganizationIdAsync(organizationDomain.Id, organizationDomain.OrganizationId)
+            .ReturnsNull();
 
-        await sutProvider.Sut.RemoveDomain(orgId.ToString(), id.ToString());
+        var requestAction = async () => await sutProvider.Sut.RemoveDomain(organizationDomain.OrganizationId, organizationDomain.Id);
+
+        await Assert.ThrowsAsync<NotFoundException>(requestAction);
+    }
+
+    [Theory, BitAutoData]
+    public async Task RemoveDomain_WhenRequestIsValid(OrganizationDomain organizationDomain,
+        SutProvider<OrganizationDomainController> sutProvider)
+    {
+        sutProvider.GetDependency<ICurrentContext>().ManageSso(organizationDomain.OrganizationId).Returns(true);
+        sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(organizationDomain.OrganizationId).Returns(new Organization());
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .GetDomainByIdOrganizationIdAsync(organizationDomain.Id, organizationDomain.OrganizationId)
+            .Returns(organizationDomain);
+
+        await sutProvider.Sut.RemoveDomain(organizationDomain.OrganizationId, organizationDomain.Id);
 
         await sutProvider.GetDependency<IDeleteOrganizationDomainCommand>().Received(1)
-            .DeleteAsync(id);
+            .DeleteAsync(organizationDomain);
     }
 
     [Theory, BitAutoData]

test/Core.Test/OrganizationFeatures/OrganizationDomains/DeleteOrganizationDomainCommandTests.cs

@@ -1,13 +1,11 @@
 using Bit.Core.Entities;
 using Bit.Core.Enums;
-using Bit.Core.Exceptions;
 using Bit.Core.OrganizationFeatures.OrganizationDomains;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using NSubstitute;
-using NSubstitute.ReturnsExtensions;
 using Xunit;
 
 namespace Bit.Core.Test.OrganizationFeatures.OrganizationDomains;
@@ -15,17 +13,6 @@ namespace Bit.Core.Test.OrganizationFeatures.OrganizationDomains;
 [SutProviderCustomize]
 public class DeleteOrganizationDomainCommandTests
 {
-    [Theory, BitAutoData]
-    public async Task DeleteAsync_ShouldThrowNotFoundException_WhenIdDoesNotExist(Guid id,
-        SutProvider<DeleteOrganizationDomainCommand> sutProvider)
-    {
-        sutProvider.GetDependency<IOrganizationDomainRepository>().GetByIdAsync(id).ReturnsNull();
-
-        var requestAction = async () => await sutProvider.Sut.DeleteAsync(id);
-
-        await Assert.ThrowsAsync<NotFoundException>(requestAction);
-    }
-
     [Theory, BitAutoData]
     public async Task DeleteAsync_Success(Guid id, SutProvider<DeleteOrganizationDomainCommand> sutProvider)
     {
@@ -36,9 +23,8 @@ public class DeleteOrganizationDomainCommandTests
             DomainName = "Test Domain",
             Txt = "btw+test18383838383"
         };
-        sutProvider.GetDependency<IOrganizationDomainRepository>().GetByIdAsync(id).Returns(expected);
 
-        await sutProvider.Sut.DeleteAsync(id);
+        await sutProvider.Sut.DeleteAsync(expected);
 
         await sutProvider.GetDependency<IOrganizationDomainRepository>().Received(1).DeleteAsync(expected);
         await sutProvider.GetDependency<IEventService>().Received(1)

test/Core.Test/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByIdOrganizationIdQueryTests.cs

@@ -0,0 +1,80 @@
+using Bit.Core.Entities;
+using Bit.Core.OrganizationFeatures.OrganizationDomains;
+using Bit.Core.Repositories;
+using Bit.Test.Common.AutoFixture;
+using Bit.Test.Common.AutoFixture.Attributes;
+using NSubstitute;
+using Xunit;
+
+namespace Bit.Core.Test.OrganizationFeatures.OrganizationDomains;
+
+[SutProviderCustomize]
+public class GetOrganizationDomainByIdOrganizationIdQueryTests
+{
+    [Theory, BitAutoData]
+    public async Task GetOrganizationDomainByIdAndOrganizationIdAsync_WithExistingParameters_ReturnsExpectedEntity(
+        OrganizationDomain organizationDomain, SutProvider<GetOrganizationDomainByIdOrganizationIdQuery> sutProvider)
+    {
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .GetDomainByIdOrganizationIdAsync(organizationDomain.Id, organizationDomain.OrganizationId)
+            .Returns(organizationDomain);
+
+        var result = await sutProvider.Sut.GetOrganizationDomainByIdOrganizationIdAsync(organizationDomain.Id, organizationDomain.OrganizationId);
+
+        await sutProvider.GetDependency<IOrganizationDomainRepository>().Received(1)
+            .GetDomainByIdOrganizationIdAsync(organizationDomain.Id, organizationDomain.OrganizationId);
+
+        Assert.Equal(organizationDomain, result);
+    }
+
+    [Theory, BitAutoData]
+    public async Task GetOrganizationDomainByIdAndOrganizationIdAsync_WithNonExistingParameters_ReturnsNull(
+        Guid id, Guid organizationId, OrganizationDomain organizationDomain,
+        SutProvider<GetOrganizationDomainByIdOrganizationIdQuery> sutProvider)
+    {
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .GetDomainByIdOrganizationIdAsync(organizationDomain.Id, organizationDomain.OrganizationId)
+            .Returns(organizationDomain);
+
+        var result = await sutProvider.Sut.GetOrganizationDomainByIdOrganizationIdAsync(id, organizationId);
+
+        await sutProvider.GetDependency<IOrganizationDomainRepository>().Received(1)
+            .GetDomainByIdOrganizationIdAsync(id, organizationId);
+
+        Assert.Null(result);
+    }
+
+    [Theory, BitAutoData]
+    public async Task GetOrganizationDomainByIdAndOrganizationIdAsync_WithNonExistingId_ReturnsNull(
+        Guid id, OrganizationDomain organizationDomain,
+        SutProvider<GetOrganizationDomainByIdOrganizationIdQuery> sutProvider)
+    {
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .GetDomainByIdOrganizationIdAsync(organizationDomain.Id, organizationDomain.OrganizationId)
+            .Returns(organizationDomain);
+
+        var result = await sutProvider.Sut.GetOrganizationDomainByIdOrganizationIdAsync(id, organizationDomain.OrganizationId);
+
+        await sutProvider.GetDependency<IOrganizationDomainRepository>().Received(1)
+            .GetDomainByIdOrganizationIdAsync(id, organizationDomain.OrganizationId);
+
+        Assert.Null(result);
+    }
+
+    [Theory, BitAutoData]
+    public async Task GetOrganizationDomainByIdAndOrganizationIdAsync_WithNonExistingOrgId_ReturnsNull(
+        Guid organizationId, OrganizationDomain organizationDomain,
+        SutProvider<GetOrganizationDomainByIdOrganizationIdQuery> sutProvider)
+    {
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .GetDomainByIdOrganizationIdAsync(organizationDomain.Id, organizationDomain.OrganizationId)
+            .Returns(organizationDomain);
+
+        var result = await sutProvider.Sut.GetOrganizationDomainByIdOrganizationIdAsync(organizationDomain.Id, organizationId);
+
+        await sutProvider.GetDependency<IOrganizationDomainRepository>().Received(1)
+            .GetDomainByIdOrganizationIdAsync(organizationDomain.Id, organizationId);
+
+        Assert.Null(result);
+    }
+}

test/Core.Test/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByIdQueryTests.cs

@@ -1,22 +0,0 @@
-using Bit.Core.OrganizationFeatures.OrganizationDomains;
-using Bit.Core.Repositories;
-using Bit.Test.Common.AutoFixture;
-using Bit.Test.Common.AutoFixture.Attributes;
-using NSubstitute;
-using Xunit;
-
-namespace Bit.Core.Test.OrganizationFeatures.OrganizationDomains;
-
-[SutProviderCustomize]
-public class GetOrganizationDomainByIdQueryTests
-{
-    [Theory, BitAutoData]
-    public async Task GetOrganizationDomainById_CallsGetByIdAsync(Guid id,
-        SutProvider<GetOrganizationDomainByIdQuery> sutProvider)
-    {
-        await sutProvider.Sut.GetOrganizationDomainById(id);
-
-        await sutProvider.GetDependency<IOrganizationDomainRepository>().Received(1)
-            .GetByIdAsync(id);
-    }
-}

test/Core.Test/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByOrganizationIdQueryTests.cs

@@ -14,7 +14,7 @@ public class GetOrganizationDomainByOrganizationIdQueryTests
     public async Task GetDomainsByOrganizationId_CallsGetDomainsByOrganizationIdAsync(Guid orgId,
         SutProvider<GetOrganizationDomainByOrganizationIdQuery> sutProvider)
     {
-        await sutProvider.Sut.GetDomainsByOrganizationId(orgId);
+        await sutProvider.Sut.GetDomainsByOrganizationIdAsync(orgId);
 
         await sutProvider.GetDependency<IOrganizationDomainRepository>().Received(1)
             .GetDomainsByOrganizationIdAsync(orgId);

test/Core.Test/OrganizationFeatures/OrganizationDomains/VerifyOrganizationDomainCommandTests.cs

@@ -7,8 +7,6 @@ using Bit.Core.Services;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using NSubstitute;
-using NSubstitute.ReceivedExtensions;
-using NSubstitute.ReturnsExtensions;
 using Xunit;
 
 namespace Bit.Core.Test.OrganizationFeatures.OrganizationDomains;
@@ -16,19 +14,6 @@ namespace Bit.Core.Test.OrganizationFeatures.OrganizationDomains;
 [SutProviderCustomize]
 public class VerifyOrganizationDomainCommandTests
 {
-    [Theory, BitAutoData]
-    public async Task VerifyOrganizationDomain_ShouldThrowNotFound_WhenDomainDoesNotExist(Guid id,
-        SutProvider<VerifyOrganizationDomainCommand> sutProvider)
-    {
-        sutProvider.GetDependency<IOrganizationDomainRepository>()
-            .GetByIdAsync(id)
-            .ReturnsNull();
-
-        var requestAction = async () => await sutProvider.Sut.VerifyOrganizationDomain(id);
-
-        await Assert.ThrowsAsync<NotFoundException>(requestAction);
-    }
-
     [Theory, BitAutoData]
     public async Task VerifyOrganizationDomain_ShouldThrowConflict_WhenDomainHasBeenClaimed(Guid id,
         SutProvider<VerifyOrganizationDomainCommand> sutProvider)
@@ -45,7 +30,7 @@ public class VerifyOrganizationDomainCommandTests
             .GetByIdAsync(id)
             .Returns(expected);
 
-        var requestAction = async () => await sutProvider.Sut.VerifyOrganizationDomain(id);
+        var requestAction = async () => await sutProvider.Sut.VerifyOrganizationDomainAsync(expected);
 
         var exception = await Assert.ThrowsAsync<ConflictException>(requestAction);
         Assert.Contains("Domain has already been verified.", exception.Message);
@@ -69,7 +54,7 @@ public class VerifyOrganizationDomainCommandTests
             .GetClaimedDomainsByDomainNameAsync(expected.DomainName)
             .Returns(new List<OrganizationDomain> { expected });
 
-        var requestAction = async () => await sutProvider.Sut.VerifyOrganizationDomain(id);
+        var requestAction = async () => await sutProvider.Sut.VerifyOrganizationDomainAsync(expected);
 
         var exception = await Assert.ThrowsAsync<ConflictException>(requestAction);
         Assert.Contains("The domain is not available to be claimed.", exception.Message);
@@ -96,7 +81,7 @@ public class VerifyOrganizationDomainCommandTests
             .ResolveAsync(expected.DomainName, Arg.Any<string>())
             .Returns(true);
 
-        var result = await sutProvider.Sut.VerifyOrganizationDomain(id);
+        var result = await sutProvider.Sut.VerifyOrganizationDomainAsync(expected);
 
         Assert.NotNull(result.VerifiedDate);
         await sutProvider.GetDependency<IOrganizationDomainRepository>().Received(1)
@@ -126,7 +111,7 @@ public class VerifyOrganizationDomainCommandTests
             .ResolveAsync(expected.DomainName, Arg.Any<string>())
             .Returns(false);
 
-        var result = await sutProvider.Sut.VerifyOrganizationDomain(id);
+        var result = await sutProvider.Sut.VerifyOrganizationDomainAsync(expected);
 
         Assert.Null(result.VerifiedDate);
         await sutProvider.GetDependency<IEventService>().Received(1)

util/Migrator/DbScripts/2023-09-29_00_OrgDomainReadByIdOrgId.sql

@@ -0,0 +1,17 @@
+CREATE OR ALTER PROCEDURE [dbo].[OrganizationDomain_ReadByIdOrganizationId]
+    @Id UNIQUEIDENTIFIER,
+    @OrganizationId UNIQUEIDENTIFIER
+AS
+BEGIN
+    SET NOCOUNT ON
+
+SELECT
+    *
+FROM
+    [dbo].[OrganizationDomain]
+WHERE
+    [Id] = @Id
+  AND
+    [OrganizationId] = @OrganizationId
+END
+GO