nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-07-09 03:43:51 -05:00
Code Activity

Add validation in CollectionService to prevent modification of DefaultUserCollection type

Browse Source 
* Implemented a check in DeleteUserAsync to throw a BadRequestException if an attempt is made to modify member access for collections of type DefaultUserCollection.
* Added a unit test to ensure the exception is thrown with the correct message when this condition is met.
This commit is contained in:
Rui Tome
2025-06-13 15:00:01 +01:00
parent f1afc653e3
commit 4d36e87b6f
2 changed files with 23 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
test/Core.Test/Services/CollectionServiceTests.cs
View File

@ -49,4 +49,22 @@ public class CollectionServiceTest
await sutProvider.GetDependency<IEventService>().DidNotReceiveWithAnyArgs()
.LogOrganizationUserEventAsync<OrganizationUser>(default, default);
}
[Theory, BitAutoData]
public async Task DeleteUserAsync_WithDefaultUserCollectionType_ThrowsBadRequest(Collection collection,
Organization organization, OrganizationUser organizationUser, SutProvider<CollectionService> sutProvider)
{
collection.Type = CollectionType.DefaultUserCollection;
collection.OrganizationId = organization.Id;
organizationUser.OrganizationId = organization.Id;
var exception = await Assert.ThrowsAsync<BadRequestException>(() =>
sutProvider.Sut.DeleteUserAsync(collection, organizationUser.Id));
Assert.Contains("You cannot modify member access for collections with the type as DefaultUserCollection.", exception.Message);
await sutProvider.GetDependency<IOrganizationUserRepository>().DidNotReceiveWithAnyArgs().GetByIdAsync(default);
await sutProvider.GetDependency<ICollectionRepository>().DidNotReceiveWithAnyArgs().DeleteUserAsync(default, default);
await sutProvider.GetDependency<IEventService>().DidNotReceiveWithAnyArgs()
.LogOrganizationUserEventAsync<OrganizationUser>(default, default);
}
}