nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-06-30 07:36:14 -05:00
Code Activity

[SM-1293] Add endpoint to fetch secret's access policies (#4146)

Browse Source 
* Add authz handling for secret access policy reads

* Add the ability to fetch secret access polices from the repository

* refactor response models

* Add new endpoint
This commit is contained in:
Thomas Avery
2024-06-07 12:08:38 -05:00
committed by GitHub
parent a1d609b208
commit 36705790ad
17 changed files with 554 additions and 143 deletions
Download Patch File Download Diff File Expand all files Collapse all files

65
test/Api.Test/SecretsManager/Controllers/AccessPoliciesControllerTests.cs
View File

@ -827,7 +827,6 @@ public class AccessPoliciesControllerTests
SutProvider<AccessPoliciesController> sutProvider,
Project data)
{
// FIX ME
SetupProjectAccessPoliciesTest(sutProvider, data, accessClientType);
sutProvider.GetDependency<IAccessPolicyRepository>()
@ -953,6 +952,61 @@ public class AccessPoliciesControllerTests
.UpdateAsync(Arg.Any<ProjectServiceAccountsAccessPoliciesUpdates>());
}
[Theory]
[BitAutoData]
public async Task GetSecretAccessPoliciesAsync_NoAccess_ThrowsNotFound(
SutProvider<AccessPoliciesController> sutProvider,
Secret data)
{
sutProvider.GetDependency<ISecretRepository>().GetByIdAsync(data.Id).Returns(data);
sutProvider.GetDependency<IAuthorizationService>()
.AuthorizeAsync(Arg.Any<ClaimsPrincipal>(), data,
Arg.Any<IEnumerable<IAuthorizationRequirement>>()).ReturnsForAnyArgs(AuthorizationResult.Failed());
await Assert.ThrowsAsync<NotFoundException>(() =>
sutProvider.Sut.GetSecretAccessPoliciesAsync(data.Id));
await sutProvider.GetDependency<IAccessPolicyRepository>().Received(0)
.GetSecretAccessPoliciesAsync(Arg.Any<Guid>(), Arg.Any<Guid>());
}
[Theory]
[BitAutoData]
public async Task GetSecretAccessPoliciesAsync_HasAccessNoPolicies_ReturnsEmptyList(
SutProvider<AccessPoliciesController> sutProvider,
Secret data)
{
SetupSecretAccessPoliciesTest(sutProvider, data);
sutProvider.GetDependency<IAccessPolicyRepository>()
.GetSecretAccessPoliciesAsync(Arg.Any<Guid>(), Arg.Any<Guid>())
.ReturnsNull();
var result = await sutProvider.Sut.GetSecretAccessPoliciesAsync(data.Id);
Assert.Empty(result.UserAccessPolicies);
Assert.Empty(result.GroupAccessPolicies);
Assert.Empty(result.ServiceAccountAccessPolicies);
}
[Theory]
[BitAutoData]
public async Task GetSecretAccessPoliciesAsync_HasAccess_Success(
SutProvider<AccessPoliciesController> sutProvider,
SecretAccessPolicies policies,
Secret data)
{
SetupSecretAccessPoliciesTest(sutProvider, data);
sutProvider.GetDependency<IAccessPolicyRepository>()
.GetSecretAccessPoliciesAsync(Arg.Any<Guid>(), Arg.Any<Guid>())
.Returns(policies);
var result = await sutProvider.Sut.GetSecretAccessPoliciesAsync(data.Id);
Assert.NotEmpty(result.UserAccessPolicies);
Assert.NotEmpty(result.GroupAccessPolicies);
Assert.NotEmpty(result.ServiceAccountAccessPolicies);
}
private static PeopleAccessPoliciesRequestModel SetRequestToCanReadWrite(PeopleAccessPoliciesRequestModel request)
{
foreach (var ap in request.UserAccessPolicyRequests)
@ -1005,4 +1059,13 @@ public class AccessPoliciesControllerTests
.GetAccessClientAsync(Arg.Any<ClaimsPrincipal>(), Arg.Any<Guid>())
.ReturnsForAnyArgs((accessClientType, Guid.NewGuid()));
}
private static void SetupSecretAccessPoliciesTest(SutProvider<AccessPoliciesController> sutProvider, Secret data)
{
sutProvider.GetDependency<ISecretRepository>().GetByIdAsync(data.Id).Returns(data);
sutProvider.GetDependency<IAuthorizationService>()
.AuthorizeAsync(Arg.Any<ClaimsPrincipal>(), data,
Arg.Any<IEnumerable<IAuthorizationRequirement>>()).ReturnsForAnyArgs(AuthorizationResult.Success());
sutProvider.GetDependency<IUserService>().GetProperUserId(Arg.Any<ClaimsPrincipal>()).Returns(Guid.NewGuid());
}
}