Use sas token for attachment downloads (#1153)

* Get limited life attachment download URL

This change limits url download to a 1min lifetime.
This requires moving to a new container to allow for non-public blob
access.

Clients will have to call GetAttachmentData api function to receive the download
URL. For backwards compatibility, attachment URLs are still present, but will not
work for attachments stored in non-public access blobs.

* Make GlobalSettings interface for testing

* Test LocalAttachmentStorageService equivalence

* Remove comment

* Add missing globalSettings using

* Simplify default attachment container

* Default to attachments containe for existing methods

A new upload method will be made for uploading to attachments-v2.
For compatibility for clients which don't use these new methods, we need
to still use the old container. The new container will be used only for
new uploads

* Remove Default MetaData fixture.

* Keep attachments container blob-level security for all instances

* Close unclosed FileStream

* Favor default value for noop services

src/Core/Context/CurrentContext.cs

@@ -9,6 +9,7 @@ using System.Threading.Tasks;
 using System.Security.Claims;
 using Bit.Core.Utilities;
 using Bit.Core.Models.Data;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Context
 {

src/Core/Context/ICurrentContext.cs

@@ -5,6 +5,7 @@ using System.Threading.Tasks;
 using Bit.Core.Enums;
 using Bit.Core.Models.Table;
 using Bit.Core.Repositories;
+using Bit.Core.Settings;
 using Microsoft.AspNetCore.Http;
 
 namespace Bit.Core.Context

src/Core/HostedServices/ApplicationCacheHostedService.cs

@@ -4,6 +4,7 @@ using System.Threading.Tasks;
 using Bit.Core.Enums;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
+using Bit.Core.Settings;
 using Bit.Core.Utilities;
 using Microsoft.Azure.ServiceBus;
 using Microsoft.Azure.ServiceBus.Management;

src/Core/Identity/DuoWebTokenProvider.cs

@@ -7,6 +7,7 @@ using Bit.Core.Models;
 using System;
 using Microsoft.Extensions.DependencyInjection;
 using Bit.Core.Services;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Identity
 {

src/Core/Identity/OrganizationDuoWebTokenProvider.cs

@@ -3,6 +3,7 @@ using Bit.Core.Models.Table;
 using Bit.Core.Enums;
 using Bit.Core.Utilities.Duo;
 using Bit.Core.Models;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Identity
 {

src/Core/Identity/U2fTokenProvider.cs

@@ -13,6 +13,7 @@ using U2F.Core.Exceptions;
 using U2F.Core.Utils;
 using System;
 using Bit.Core.Services;
+using Bit.Core.Settings;
 using Microsoft.Extensions.DependencyInjection;
 
 namespace Bit.Core.Identity

src/Core/Identity/UserStore.cs

@@ -6,6 +6,7 @@ using Bit.Core.Models.Table;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Core.Context;
+using Bit.Core.Settings;
 using Microsoft.Extensions.DependencyInjection;
 
 namespace Bit.Core.Identity

src/Core/Identity/YubicoOtpTokenProvider.cs

@@ -5,6 +5,7 @@ using Bit.Core.Enums;
 using YubicoDotNetClient;
 using System.Linq;
 using Bit.Core.Services;
+using Bit.Core.Settings;
 using System;
 using Microsoft.Extensions.DependencyInjection;
 

src/Core/IdentityServer/ApiClient.cs

@@ -1,6 +1,7 @@
 using IdentityServer4.Models;
 using System.Collections.Generic;
 using System.Linq;
+using Bit.Core.Settings;
 
 namespace Bit.Core.IdentityServer
 {

src/Core/IdentityServer/BaseRequestValidator.cs

@@ -18,6 +18,7 @@ using System.Reflection;
 using Microsoft.Extensions.Logging;
 using Bit.Core.Models.Api;
 using Bit.Core.Context;
+using Bit.Core.Settings;
 
 namespace Bit.Core.IdentityServer
 {

src/Core/IdentityServer/ClientStore.cs

@@ -9,6 +9,7 @@ using IdentityModel;
 using Bit.Core.Utilities;
 using System.Security.Claims;
 using Bit.Core.Services;
+using Bit.Core.Settings;
 using Bit.Core.Context;
 using System.Collections.ObjectModel;
 

src/Core/IdentityServer/ConfigureOpenIdConnectDistributedOptions.cs

@@ -4,6 +4,7 @@ using Microsoft.AspNetCore.Authentication.Cookies;
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.Caching.Redis;
 using Microsoft.Extensions.Options;
+using Bit.Core.Settings;
 
 namespace Bit.Core.IdentityServer
 {

src/Core/IdentityServer/CustomTokenRequestValidator.cs

@@ -6,6 +6,7 @@ using System.Collections.Generic;
 using System.Security.Claims;
 using System.Threading.Tasks;
 using Bit.Core.Services;
+using Bit.Core.Settings;
 using Bit.Core.Context;
 using System.Linq;
 using Bit.Core.Identity;

src/Core/IdentityServer/OidcIdentityClient.cs

@@ -1,6 +1,7 @@
 using IdentityServer4;
 using IdentityServer4.Models;
 using System.Collections.Generic;
+using Bit.Core.Settings;
 
 namespace Bit.Core.IdentityServer
 {

src/Core/IdentityServer/ProfileService.cs

@@ -10,6 +10,7 @@ using System;
 using IdentityModel;
 using Bit.Core.Utilities;
 using Bit.Core.Context;
+using Bit.Core.Settings;
 
 namespace Bit.Core.IdentityServer
 {

src/Core/IdentityServer/ResourceOwnerPasswordValidator.cs

@@ -9,6 +9,7 @@ using System.Threading.Tasks;
 using Bit.Core.Services;
 using Bit.Core.Identity;
 using Bit.Core.Context;
+using Bit.Core.Settings;
 using Microsoft.Extensions.Logging;
 
 namespace Bit.Core.IdentityServer

src/Core/IdentityServer/StaticClientStore.cs

@@ -1,6 +1,7 @@
 using IdentityServer4.Models;
 using System.Collections.Generic;
 using System.Linq;
+using Bit.Core.Settings;
 
 namespace Bit.Core.IdentityServer
 {

src/Core/IdentityServer/VaultCorsPolicyService.cs

@@ -1,6 +1,7 @@
 using Bit.Core.Utilities;
 using IdentityServer4.Services;
 using System.Threading.Tasks;
+using Bit.Core.Settings;
 
 namespace Bit.Core.IdentityServer
 {

src/Core/Jobs/BaseJobsHostedService.cs

@@ -8,6 +8,7 @@ using Microsoft.Extensions.Logging;
 using Quartz;
 using Quartz.Impl;
 using Quartz.Impl.Matchers;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Jobs
 {

src/Core/Models/Api/Request/Accounts/PremiumRequestModel.cs

@@ -2,6 +2,8 @@
 using System.ComponentModel.DataAnnotations;
 using System.Collections.Generic;
 using Bit.Core.Enums;
+using Bit.Core.Settings;
+
 
 namespace Bit.Core.Models.Api
 {

src/Core/Models/Api/Request/BitPayInvoiceRequestModel.cs

@@ -1,6 +1,7 @@
 using System;
 using System.Collections.Generic;
 using System.ComponentModel.DataAnnotations;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Models.Api
 {

src/Core/Models/Api/Request/Organizations/OrganizationUpdateRequestModel.cs

@@ -1,5 +1,6 @@
 using Bit.Core.Models.Data;
 using Bit.Core.Models.Table;
+using Bit.Core.Settings;
 using System.ComponentModel.DataAnnotations;
 
 namespace Bit.Core.Models.Api

src/Core/Models/Api/Response/AttachmentResponseModel.cs

@@ -2,6 +2,7 @@
 using Bit.Core.Models.Table;
 using System.Collections.Generic;
 using System.Linq;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Models.Api
 {

src/Core/Models/Api/Response/CipherResponseModel.cs

@@ -5,6 +5,7 @@ using Bit.Core.Models.Table;
 using System.Linq;
 using Newtonsoft.Json;
 using Bit.Core.Models.Data;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Models.Api
 {

src/Core/Models/Api/Response/EmergencyAccessResponseModel.cs

@@ -4,6 +4,7 @@ using System.Linq;
 using Bit.Core.Enums;
 using Bit.Core.Models.Data;
 using Bit.Core.Models.Table;
+using Bit.Core.Settings;
 using Core.Models.Data;
 
 namespace Bit.Core.Models.Api.Response

src/Core/Models/Api/Response/SendAccessResponseModel.cs

@@ -3,6 +3,7 @@ using Bit.Core.Enums;
 using Bit.Core.Models.Data;
 using Bit.Core.Models.Table;
 using Bit.Core.Utilities;
+using Bit.Core.Settings;
 using Newtonsoft.Json;
 
 namespace Bit.Core.Models.Api

src/Core/Models/Api/Response/SendResponseModel.cs

@@ -3,6 +3,7 @@ using Bit.Core.Enums;
 using Bit.Core.Models.Data;
 using Bit.Core.Models.Table;
 using Bit.Core.Utilities;
+using Bit.Core.Settings;
 using Newtonsoft.Json;
 
 namespace Bit.Core.Models.Api

src/Core/Models/Api/Response/SyncResponseModel.cs

@@ -3,6 +3,7 @@ using System.Collections.Generic;
 using System.Linq;
 using Bit.Core.Models.Data;
 using Bit.Core.Models.Table;
+using Bit.Core.Settings;
 using Core.Models.Data;
 
 namespace Bit.Core.Models.Api

src/Core/Models/Api/SendFileModel.cs

@@ -1,5 +1,6 @@
 using Bit.Core.Models.Data;
 using Bit.Core.Utilities;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Models.Api
 {

src/Core/Models/Business/OrganizationLicense.cs

@@ -1,6 +1,7 @@
 using Bit.Core.Enums;
 using Bit.Core.Models.Table;
 using Bit.Core.Services;
+using Bit.Core.Settings;
 using Newtonsoft.Json;
 using System;
 using System.Linq;

src/Core/Models/Data/CipherAttachment.cs

@@ -32,6 +32,12 @@ namespace Bit.Core.Models.Data
 
             public string FileName { get; set; }
             public string Key { get; set; }
+
+            public string ContainerName { get; set; } = "attachments";
+
+            // This is stored alongside metadata as an identifier. It does not need repeating in serialization
+            [JsonIgnore]
+            public string AttachmentId { get; set; }
         }
     }
 }

src/Core/Models/Data/EventMessage.cs

@@ -1,6 +1,7 @@
 using System;
 using Bit.Core.Enums;
 using Bit.Core.Context;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Models.Data
 {

src/Core/Models/Table/Cipher.cs

@@ -42,6 +42,10 @@ namespace Bit.Core.Models.Table
             try
             {
                 _attachmentData = JsonConvert.DeserializeObject<Dictionary<string, CipherAttachment.MetaData>>(Attachments);
+                foreach (var kvp in _attachmentData)
+                {
+                    kvp.Value.AttachmentId = kvp.Key;
+                }
                 return _attachmentData;
             }
             catch

src/Core/Repositories/PostgreSql/UserRepository.cs

@@ -5,6 +5,7 @@ using System.Linq;
 using System.Threading.Tasks;
 using Bit.Core.Models.Data;
 using Bit.Core.Models.Table;
+using Bit.Core.Settings;
 using Dapper;
 using Npgsql;
 

src/Core/Repositories/SqlServer/CipherRepository.cs

@@ -10,6 +10,7 @@ using Core.Models.Data;
 using Bit.Core.Utilities;
 using Newtonsoft.Json;
 using Bit.Core.Models.Data;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Repositories.SqlServer
 {

src/Core/Repositories/SqlServer/CollectionCipherRepository.cs

@@ -7,6 +7,7 @@ using System.Data;
 using Dapper;
 using System.Linq;
 using Bit.Core.Utilities;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Repositories.SqlServer
 {

src/Core/Repositories/SqlServer/CollectionRepository.cs

@@ -9,6 +9,7 @@ using System.Linq;
 using Newtonsoft.Json;
 using Bit.Core.Utilities;
 using Bit.Core.Models.Data;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Repositories.SqlServer
 {

src/Core/Repositories/SqlServer/DeviceRepository.cs

@@ -4,6 +4,7 @@ using System.Collections.Generic;
 using System.Data.SqlClient;
 using System.Threading.Tasks;
 using Bit.Core.Models.Table;
+using Bit.Core.Settings;
 using System.Data;
 using Dapper;
 

src/Core/Repositories/SqlServer/EmergencyAccessRepository.cs

@@ -7,6 +7,7 @@ using Dapper;
 using System.Linq;
 using System.Collections.Generic;
 using Bit.Core.Models.Data;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Repositories.SqlServer
 {

src/Core/Repositories/SqlServer/EventRepository.cs

@@ -3,6 +3,7 @@ using Bit.Core.Models.Table;
 using System.Threading.Tasks;
 using System.Collections.Generic;
 using Bit.Core.Models.Data;
+using Bit.Core.Settings;
 using System.Data.SqlClient;
 using System.Linq;
 using System.Data;

src/Core/Repositories/SqlServer/FolderRepository.cs

@@ -1,5 +1,6 @@
 using System;
 using Bit.Core.Models.Table;
+using Bit.Core.Settings;
 using System.Threading.Tasks;
 using System.Collections.Generic;
 using System.Data;

src/Core/Repositories/SqlServer/GrantRepository.cs

@@ -4,6 +4,7 @@ using System.Data.SqlClient;
 using System.Linq;
 using System.Threading.Tasks;
 using Bit.Core.Models.Table;
+using Bit.Core.Settings;
 using Dapper;
 
 namespace Bit.Core.Repositories.SqlServer

src/Core/Repositories/SqlServer/GroupRepository.cs

@@ -9,6 +9,7 @@ using System.Linq;
 using Newtonsoft.Json;
 using Bit.Core.Utilities;
 using Bit.Core.Models.Data;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Repositories.SqlServer
 {

src/Core/Repositories/SqlServer/InstallationRepository.cs

@@ -1,5 +1,6 @@
 using System;
 using Bit.Core.Models.Table;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Repositories.SqlServer
 {

src/Core/Repositories/SqlServer/MaintenanceRepository.cs

@@ -2,6 +2,7 @@
 using System.Data.SqlClient;
 using System.Threading.Tasks;
 using Dapper;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Repositories.SqlServer
 {

src/Core/Repositories/SqlServer/OrganizationRepository.cs

@@ -7,6 +7,7 @@ using Dapper;
 using System.Linq;
 using System.Collections.Generic;
 using Bit.Core.Models.Data;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Repositories.SqlServer
 {

src/Core/Repositories/SqlServer/OrganizationUserRepository.cs

@@ -9,6 +9,7 @@ using Bit.Core.Models.Data;
 using System.Collections.Generic;
 using Bit.Core.Enums;
 using Bit.Core.Utilities;
+using Bit.Core.Settings;
 using Newtonsoft.Json;
 
 namespace Bit.Core.Repositories.SqlServer

src/Core/Repositories/SqlServer/PolicyRepository.cs

@@ -7,6 +7,7 @@ using System.Data;
 using Dapper;
 using System.Linq;
 using Bit.Core.Enums;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Repositories.SqlServer
 {

src/Core/Repositories/SqlServer/SendRepository.cs

@@ -1,5 +1,6 @@
 using System;
 using Bit.Core.Models.Table;
+using Bit.Core.Settings;
 using System.Threading.Tasks;
 using System.Collections.Generic;
 using System.Data;

src/Core/Repositories/SqlServer/SsoConfigRepository.cs

@@ -1,5 +1,6 @@
 using System;
 using Bit.Core.Models.Table;
+using Bit.Core.Settings;
 using System.Threading.Tasks;
 using System.Data.SqlClient;
 using System.Data;

src/Core/Repositories/SqlServer/SsoUserRepository.cs

@@ -1,4 +1,5 @@
 using Bit.Core.Models.Table;
+using Bit.Core.Settings;
 using Dapper;
 using System;
 using System.Threading.Tasks;

src/Core/Repositories/SqlServer/TaxRateRepository.cs

@@ -1,4 +1,5 @@
 using Bit.Core.Models.Table;
+using Bit.Core.Settings;
 using System.Threading.Tasks;
 using System.Collections.Generic;
 using System.Data;

src/Core/Repositories/SqlServer/TransactionRepository.cs

@@ -7,6 +7,7 @@ using System.Data;
 using System.Data.SqlClient;
 using System.Linq;
 using Bit.Core.Enums;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Repositories.SqlServer
 {

src/Core/Repositories/SqlServer/U2fRepository.cs

@@ -4,6 +4,7 @@ using System.Collections.Generic;
 using System.Data.SqlClient;
 using System.Threading.Tasks;
 using Bit.Core.Models.Table;
+using Bit.Core.Settings;
 using System.Data;
 using Dapper;
 

src/Core/Repositories/SqlServer/UserRepository.cs

@@ -6,6 +6,7 @@ using System.Linq;
 using System.Threading.Tasks;
 using Bit.Core.Models.Data;
 using Bit.Core.Models.Table;
+using Bit.Core.Settings;
 using Dapper;
 
 namespace Bit.Core.Repositories.SqlServer

src/Core/Repositories/TableStorage/EventRepository.cs

@@ -6,6 +6,7 @@ using Bit.Core.Models.Data;
 using Bit.Core.Models.Table;
 using Bit.Core.Utilities;
 using Microsoft.Azure.Cosmos.Table;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Repositories.TableStorage
 {

src/Core/Repositories/TableStorage/InstallationDeviceRepository.cs

@@ -3,6 +3,7 @@ using System.Linq;
 using System.Net;
 using System.Threading.Tasks;
 using Bit.Core.Models.Data;
+using Bit.Core.Settings;
 using Microsoft.Azure.Cosmos.Table;
 
 namespace Bit.Core.Repositories.TableStorage

src/Core/Repositories/TableStorage/MetaDataRepository.cs

@@ -3,6 +3,7 @@ using System.Linq;
 using System.Net;
 using System.Threading.Tasks;
 using Bit.Core.Models.Data;
+using Bit.Core.Settings;
 using Microsoft.Azure.Cosmos.Table;
 
 namespace Bit.Core.Repositories.TableStorage

src/Core/Services/IAttachmentStorageService.cs

@@ -1,4 +1,5 @@
-using Bit.Core.Models.Table;
+using Bit.Core.Models.Data;
+using Bit.Core.Models.Table;
 using System;
 using System.IO;
 using System.Threading.Tasks;
@@ -7,14 +8,15 @@ namespace Bit.Core.Services
 {
     public interface IAttachmentStorageService
     {
-        Task UploadNewAttachmentAsync(Stream stream, Cipher cipher, string attachmentId);
-        Task UploadShareAttachmentAsync(Stream stream, Guid cipherId, Guid organizationId, string attachmentId);
-        Task StartShareAttachmentAsync(Guid cipherId, Guid organizationId, string attachmentId);
-        Task RollbackShareAttachmentAsync(Guid cipherId, Guid organizationId, string attachmentId);
+        Task UploadNewAttachmentAsync(Stream stream, Cipher cipher, CipherAttachment.MetaData attachment);
+        Task UploadShareAttachmentAsync(Stream stream, Guid cipherId, Guid organizationId, CipherAttachment.MetaData attachment);
+        Task StartShareAttachmentAsync(Guid cipherId, Guid organizationId, CipherAttachment.MetaData attachmentData);
+        Task RollbackShareAttachmentAsync(Guid cipherId, Guid organizationId, CipherAttachment.MetaData attachmentData, string originalContainer);
         Task CleanupAsync(Guid cipherId);
-        Task DeleteAttachmentAsync(Guid cipherId, string attachmentId);
+        Task DeleteAttachmentAsync(Guid cipherId, CipherAttachment.MetaData attachment);
         Task DeleteAttachmentsForCipherAsync(Guid cipherId);
         Task DeleteAttachmentsForOrganizationAsync(Guid organizationId);
         Task DeleteAttachmentsForUserAsync(Guid userId);
+        Task<string> GetAttachmentDownloadUrlAsync(Cipher cipher, CipherAttachment.MetaData attachmentData);
     }
 }

src/Core/Services/Implementations/AmazonSesMailDeliveryService.cs

@@ -2,6 +2,7 @@
 using System.Collections.Generic;
 using System.Threading.Tasks;
 using Bit.Core.Models.Mail;
+using Bit.Core.Settings;
 using System.Linq;
 using Amazon.SimpleEmail;
 using Amazon;

src/Core/Services/Implementations/AmazonSqsBlockIpService.cs

@@ -2,6 +2,7 @@
 using System;
 using Amazon.SQS;
 using Amazon;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Services
 {

src/Core/Services/Implementations/AppleIapService.cs

@@ -5,6 +5,7 @@ using System.Net.Http;
 using System.Threading.Tasks;
 using Bit.Billing.Models;
 using Bit.Core.Repositories;
+using Bit.Core.Settings;
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Logging;

src/Core/Services/Implementations/AzureAttachmentStorageService.cs

@@ -1,18 +1,22 @@
-using System.Threading.Tasks;
+using System.Threading.Tasks;
 using Microsoft.Azure.Storage;
 using Microsoft.Azure.Storage.Blob;
 using System.IO;
 using System;
+using Bit.Core.Models.Data;
 using Bit.Core.Models.Table;
+using Bit.Core.Settings;
+using System.Collections.Generic;
 
 namespace Bit.Core.Services
 {
     public class AzureAttachmentStorageService : IAttachmentStorageService
     {
-        private const string AttchmentContainerName = "attachments";
-
+        private const string _defaultContainerName = "attachments";
+        private readonly static string[] _attachmentContainerName = { "attachments", "attachments-v2" };
+        private static readonly TimeSpan downloadLinkLiveTime = TimeSpan.FromMinutes(1);
         private readonly CloudBlobClient _blobClient;
-        private CloudBlobContainer _attachmentsContainer;
+        private readonly Dictionary<string, CloudBlobContainer> _attachmentContainers = new Dictionary<string, CloudBlobContainer>();
 
         public AzureAttachmentStorageService(
             GlobalSettings globalSettings)
@@ -21,10 +25,24 @@ namespace Bit.Core.Services
             _blobClient = storageAccount.CreateCloudBlobClient();
         }
 
-        public async Task UploadNewAttachmentAsync(Stream stream, Cipher cipher, string attachmentId)
+        public async Task<string> GetAttachmentDownloadUrlAsync(Cipher cipher, CipherAttachment.MetaData attachmentData)
         {
-            await InitAsync();
-            var blob = _attachmentsContainer.GetBlockBlobReference($"{cipher.Id}/{attachmentId}");
+            await InitAsync(attachmentData.ContainerName);
+            var blob = _attachmentContainers[attachmentData.ContainerName].GetBlockBlobReference($"{cipher.Id}/{attachmentData.AttachmentId}");
+            var accessPolicy = new SharedAccessBlobPolicy()
+            {
+                SharedAccessExpiryTime = DateTime.UtcNow.Add(downloadLinkLiveTime),
+                Permissions = SharedAccessBlobPermissions.Read
+            };
+
+            return blob.Uri + blob.GetSharedAccessSignature(accessPolicy);
+        }
+
+        public async Task UploadNewAttachmentAsync(Stream stream, Cipher cipher, CipherAttachment.MetaData attachment)
+        {
+            attachment.ContainerName = _defaultContainerName;
+            await InitAsync(_defaultContainerName);
+            var blob = _attachmentContainers[_defaultContainerName].GetBlockBlobReference($"{cipher.Id}/{attachment.AttachmentId}");
             blob.Metadata.Add("cipherId", cipher.Id.ToString());
             if (cipher.UserId.HasValue)
             {
@@ -34,36 +52,38 @@ namespace Bit.Core.Services
             {
                 blob.Metadata.Add("organizationId", cipher.OrganizationId.Value.ToString());
             }
-            blob.Properties.ContentDisposition = $"attachment; filename=\"{attachmentId}\"";
+            blob.Properties.ContentDisposition = $"attachment; filename=\"{attachment.AttachmentId}\"";
             await blob.UploadFromStreamAsync(stream);
         }
 
-        public async Task UploadShareAttachmentAsync(Stream stream, Guid cipherId, Guid organizationId, string attachmentId)
+        public async Task UploadShareAttachmentAsync(Stream stream, Guid cipherId, Guid organizationId, CipherAttachment.MetaData attachmentData)
         {
-            await InitAsync();
-            var blob = _attachmentsContainer.GetBlockBlobReference($"temp/{cipherId}/{organizationId}/{attachmentId}");
+            attachmentData.ContainerName = _defaultContainerName;
+            await InitAsync(_defaultContainerName);
+            var blob = _attachmentContainers[_defaultContainerName].GetBlockBlobReference($"temp/{cipherId}/{organizationId}/{attachmentData.AttachmentId}");
             blob.Metadata.Add("cipherId", cipherId.ToString());
             blob.Metadata.Add("organizationId", organizationId.ToString());
-            blob.Properties.ContentDisposition = $"attachment; filename=\"{attachmentId}\"";
+            blob.Properties.ContentDisposition = $"attachment; filename=\"{attachmentData.AttachmentId}\"";
             await blob.UploadFromStreamAsync(stream);
         }
 
-        public async Task StartShareAttachmentAsync(Guid cipherId, Guid organizationId, string attachmentId)
+        public async Task StartShareAttachmentAsync(Guid cipherId, Guid organizationId, CipherAttachment.MetaData data)
         {
-            await InitAsync();
-            var source = _attachmentsContainer.GetBlockBlobReference($"temp/{cipherId}/{organizationId}/{attachmentId}");
+            await InitAsync(data.ContainerName);
+            var source = _attachmentContainers[data.ContainerName].GetBlockBlobReference($"temp/{cipherId}/{organizationId}/{data.AttachmentId}");
             if (!(await source.ExistsAsync()))
             {
                 return;
             }
 
-            var dest = _attachmentsContainer.GetBlockBlobReference($"{cipherId}/{attachmentId}");
+            await InitAsync(_defaultContainerName);
+            var dest = _attachmentContainers[_defaultContainerName].GetBlockBlobReference($"{cipherId}/{data.AttachmentId}");
             if (!(await dest.ExistsAsync()))
             {
                 return;
             }
 
-            var original = _attachmentsContainer.GetBlockBlobReference($"temp/{cipherId}/{attachmentId}");
+            var original = _attachmentContainers[_defaultContainerName].GetBlockBlobReference($"temp/{cipherId}/{data.AttachmentId}");
             await original.DeleteIfExistsAsync();
             await original.StartCopyAsync(dest);
 
@@ -71,98 +91,88 @@ namespace Bit.Core.Services
             await dest.StartCopyAsync(source);
         }
 
-        public async Task RollbackShareAttachmentAsync(Guid cipherId, Guid organizationId, string attachmentId)
+        public async Task RollbackShareAttachmentAsync(Guid cipherId, Guid organizationId, CipherAttachment.MetaData attachmentData, string originalContainer)
         {
-            await InitAsync();
-            var source = _attachmentsContainer.GetBlockBlobReference($"temp/{cipherId}/{organizationId}/{attachmentId}");
+            await InitAsync(attachmentData.ContainerName);
+            var source = _attachmentContainers[attachmentData.ContainerName].GetBlockBlobReference($"temp/{cipherId}/{organizationId}/{attachmentData.AttachmentId}");
             await source.DeleteIfExistsAsync();
 
-            var original = _attachmentsContainer.GetBlockBlobReference($"temp/{cipherId}/{attachmentId}");
+            await InitAsync(originalContainer);
+            var original = _attachmentContainers[originalContainer].GetBlockBlobReference($"temp/{cipherId}/{attachmentData.AttachmentId}");
             if (!(await original.ExistsAsync()))
             {
                 return;
             }
 
-            var dest = _attachmentsContainer.GetBlockBlobReference($"{cipherId}/{attachmentId}");
+            var dest = _attachmentContainers[originalContainer].GetBlockBlobReference($"{cipherId}/{attachmentData.AttachmentId}");
             await dest.DeleteIfExistsAsync();
             await dest.StartCopyAsync(original);
             await original.DeleteIfExistsAsync();
         }
 
-        public async Task DeleteAttachmentAsync(Guid cipherId, string attachmentId)
+        public async Task DeleteAttachmentAsync(Guid cipherId, CipherAttachment.MetaData attachment)
         {
-            await InitAsync();
-            var blobName = $"{cipherId}/{attachmentId}";
-            var blob = _attachmentsContainer.GetBlockBlobReference(blobName);
+            await InitAsync(attachment.ContainerName);
+            var blobName = $"{cipherId}/{attachment.AttachmentId}";
+            var blob = _attachmentContainers[attachment.ContainerName].GetBlockBlobReference(blobName);
             await blob.DeleteIfExistsAsync();
         }
 
-        public async Task CleanupAsync(Guid cipherId)
+        private async Task DeleteAttachmentsForPathAsync(string path)
         {
-            await InitAsync();
-            var segment = await _attachmentsContainer.ListBlobsSegmentedAsync($"temp/{cipherId}", true,
-                BlobListingDetails.None, 100, null, null, null);
-
-            while (true)
+            foreach (var container in _attachmentContainerName)
             {
-                foreach (var blob in segment.Results)
+                await InitAsync(container);
+                var segment = await _attachmentContainers[container].ListBlobsSegmentedAsync(path, true, BlobListingDetails.None, 100, null, null, null);
+
+                while (true)
                 {
-                    if (blob is CloudBlockBlob blockBlob)
+                    foreach (var blob in segment.Results)
                     {
-                        await blockBlob.DeleteIfExistsAsync();
+                        if (blob is CloudBlockBlob blockBlob)
+                        {
+                            await blockBlob.DeleteIfExistsAsync();
+                        }
                     }
-                }
 
-                if (segment.ContinuationToken == null)
-                {
-                    break;
-                }
+                    if (segment.ContinuationToken == null)
+                    {
+                        break;
+                    }
 
-                segment = await _attachmentsContainer.ListBlobsSegmentedAsync(segment.ContinuationToken);
+                    segment = await _attachmentContainers[container].ListBlobsSegmentedAsync(segment.ContinuationToken);
+                }
             }
         }
 
-        public async Task DeleteAttachmentsForCipherAsync(Guid cipherId)
-        {
-            await InitAsync();
-            var segment = await _attachmentsContainer.ListBlobsSegmentedAsync(cipherId.ToString(), true,
-                BlobListingDetails.None, 100, null, null, null);
 
-            while (true)
-            {
-                foreach (var blob in segment.Results)
-                {
-                    if (blob is CloudBlockBlob blockBlob)
-                    {
-                        await blockBlob.DeleteIfExistsAsync();
-                    }
-                }
+        public async Task CleanupAsync(Guid cipherId) => await DeleteAttachmentsForPathAsync($"temp/{cipherId}");
 
-                if (segment.ContinuationToken == null)
-                {
-                    break;
-                }
-
-                segment = await _attachmentsContainer.ListBlobsSegmentedAsync(segment.ContinuationToken);
-            }
-        }
+        public async Task DeleteAttachmentsForCipherAsync(Guid cipherId) => await DeleteAttachmentsForPathAsync(cipherId.ToString());
 
         public async Task DeleteAttachmentsForOrganizationAsync(Guid organizationId)
         {
-            await InitAsync();
+            await InitAsync(_defaultContainerName);
         }
 
         public async Task DeleteAttachmentsForUserAsync(Guid userId)
         {
-            await InitAsync();
+            await InitAsync(_defaultContainerName);
         }
 
-        private async Task InitAsync()
+        private async Task InitAsync(string containerName)
         {
-            if (_attachmentsContainer == null)
+            if (!_attachmentContainers.ContainsKey(containerName) || _attachmentContainers[containerName] == null)
             {
-                _attachmentsContainer = _blobClient.GetContainerReference(AttchmentContainerName);
-                await _attachmentsContainer.CreateIfNotExistsAsync(BlobContainerPublicAccessType.Blob, null, null);
+                _attachmentContainers[containerName] = _blobClient.GetContainerReference(containerName);
+                if (containerName == "attachments")
+                {
+                    await _attachmentContainers[containerName].CreateIfNotExistsAsync(BlobContainerPublicAccessType.Blob, null, null);
+                }
+                else
+                {
+                    await _attachmentContainers[containerName].CreateIfNotExistsAsync(BlobContainerPublicAccessType.Off, null, null);
+                }
             }
         }
     }

src/Core/Services/Implementations/AzureQueueBlockIpService.cs

@@ -1,6 +1,7 @@
 using System.Threading.Tasks;
 using System;
 using Azure.Storage.Queues;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Services
 {

src/Core/Services/Implementations/AzureQueueEventWriteService.cs

@@ -3,6 +3,7 @@ using System.Collections.Generic;
 using Azure.Storage.Queues;
 using Newtonsoft.Json;
 using Bit.Core.Models.Data;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Services
 {

src/Core/Services/Implementations/AzureQueuePushNotificationService.cs

@@ -1,10 +1,11 @@
 using System;
 using System.Threading.Tasks;
 using Bit.Core.Context;
-using Bit.Core.Models.Table;
 using Bit.Core.Enums;
-using Newtonsoft.Json;
 using Bit.Core.Models;
+using Bit.Core.Models.Table;
+using Bit.Core.Settings;
+using Newtonsoft.Json;
 using Azure.Storage.Queues;
 using Microsoft.AspNetCore.Http;
 using System.Collections.Generic;

src/Core/Services/Implementations/AzureQueueReferenceEventService.cs

@@ -3,6 +3,7 @@ using System.Text;
 using System.Threading.Tasks;
 using Azure.Storage.Queues;
 using Bit.Core.Models.Business;
+using Bit.Core.Settings;
 using Newtonsoft.Json;
 
 namespace Bit.Core.Services

src/Core/Services/Implementations/AzureSendFileStorageService.cs

@@ -4,6 +4,7 @@ using Microsoft.Azure.Storage.Blob;
 using System.IO;
 using System;
 using Bit.Core.Models.Table;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Services
 {

src/Core/Services/Implementations/CipherService.cs

@@ -11,6 +11,7 @@ using Newtonsoft.Json;
 using System.IO;
 using Bit.Core.Enums;
 using Bit.Core.Utilities;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Services
 {
@@ -216,17 +217,18 @@ namespace Bit.Core.Services
             }
 
             var attachmentId = Utilities.CoreHelpers.SecureRandomString(32, upper: false, special: false);
-            await _attachmentStorageService.UploadNewAttachmentAsync(stream, cipher, attachmentId);
+            var data = new CipherAttachment.MetaData
+            {
+                AttachmentId = attachmentId,
+                FileName = fileName,
+                Key = key,
+                Size = stream.Length
+            };
+
+            await _attachmentStorageService.UploadNewAttachmentAsync(stream, cipher, data);
 
             try
             {
-                var data = new CipherAttachment.MetaData
-                {
-                    FileName = fileName,
-                    Key = key,
-                    Size = stream.Length
-                };
-
                 var attachment = new CipherAttachment
                 {
                     Id = cipher.Id,
@@ -243,7 +245,7 @@ namespace Bit.Core.Services
             catch
             {
                 // Clean up since this is not transactional
-                await _attachmentStorageService.DeleteAttachmentAsync(cipher.Id, attachmentId);
+                await _attachmentStorageService.DeleteAttachmentAsync(cipher.Id, data);
                 throw;
             }
 
@@ -283,8 +285,26 @@ namespace Bit.Core.Services
                     throw new BadRequestException("Not enough storage available for this organization.");
                 }
 
+                var attachments = cipher.GetAttachments();
+                if (!attachments.ContainsKey(attachmentId))
+                {
+                    throw new BadRequestException($"Cipher does not own specified attachment");
+                }
+
                 await _attachmentStorageService.UploadShareAttachmentAsync(stream, cipher.Id, organizationId,
-                    attachmentId);
+                    attachments[attachmentId]);
+
+                // Previous call may alter metadata
+                var updatedAttachment = new CipherAttachment
+                {
+                    Id = cipher.Id,
+                    UserId = cipher.UserId,
+                    OrganizationId = cipher.OrganizationId,
+                    AttachmentId = attachmentId,
+                    AttachmentData = JsonConvert.SerializeObject(attachments[attachmentId])
+                };
+
+                await _cipherRepository.UpdateAttachmentAsync(updatedAttachment);
             }
             catch
             {
@@ -350,9 +370,10 @@ namespace Bit.Core.Services
                 throw new NotFoundException();
             }
 
+            var data = cipher.GetAttachments()[attachmentId];
             await _cipherRepository.DeleteAttachmentAsync(cipher.Id, attachmentId);
             cipher.DeleteAttachment(attachmentId);
-            await _attachmentStorageService.DeleteAttachmentAsync(cipher.Id, attachmentId);
+            await _attachmentStorageService.DeleteAttachmentAsync(cipher.Id, data);
             await _eventService.LogCipherEventAsync(cipher, Enums.EventType.Cipher_AttachmentDeleted);
 
             // push
@@ -421,6 +442,7 @@ namespace Bit.Core.Services
             var hasOldAttachments = attachments?.Any(a => a.Key == null) ?? false;
             var updatedCipher = false;
             var migratedAttachments = false;
+            var originalAttachments = CoreHelpers.CloneObject(attachments);
 
             try
             {
@@ -471,7 +493,7 @@ namespace Bit.Core.Services
                     foreach (var attachment in attachments.Where(a => a.Key == null))
                     {
                         await _attachmentStorageService.StartShareAttachmentAsync(cipher.Id, organizationId,
-                            attachment.Key);
+                            attachment.Value);
                         migratedAttachments = true;
                     }
 
@@ -504,7 +526,7 @@ namespace Bit.Core.Services
                 foreach (var attachment in attachments.Where(a => a.Key == null))
                 {
                     await _attachmentStorageService.RollbackShareAttachmentAsync(cipher.Id, organizationId,
-                        attachment.Key);
+                        attachment.Value, originalAttachments[attachment.Key].ContainerName);
                 }
 
                 await _attachmentStorageService.CleanupAsync(cipher.Id);

src/Core/Services/Implementations/EmergencyAccessService.cs

@@ -10,6 +10,7 @@ using Bit.Core.Models.Data;
 using Bit.Core.Models.Table;
 using Bit.Core.Repositories;
 using Bit.Core.Utilities;
+using Bit.Core.Settings;
 using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.Identity;
 

src/Core/Services/Implementations/EventService.cs

@@ -7,6 +7,7 @@ using System.Linq;
 using System.Collections.Generic;
 using Bit.Core.Models.Table;
 using Bit.Core.Context;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Services
 {

src/Core/Services/Implementations/HandlebarsMailService.cs

@@ -3,6 +3,7 @@ using System.Collections.Generic;
 using System.Threading.Tasks;
 using Bit.Core.Models.Table;
 using Bit.Core.Models.Mail;
+using Bit.Core.Settings;
 using System.IO;
 using System.Net;
 using Bit.Core.Utilities;

src/Core/Services/Implementations/InMemoryServiceBusApplicationCacheService.cs

@@ -4,6 +4,7 @@ using Bit.Core.Enums;
 using Bit.Core.Models.Table;
 using Bit.Core.Repositories;
 using Bit.Core.Utilities;
+using Bit.Core.Settings;
 using Microsoft.Azure.ServiceBus;
 
 namespace Bit.Core.Services

src/Core/Services/Implementations/LicensingService.cs

@@ -2,6 +2,7 @@
 using Bit.Core.Models.Table;
 using Bit.Core.Repositories;
 using Bit.Core.Utilities;
+using Bit.Core.Settings;
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.Extensions.Logging;
 using Microsoft.Azure.Storage;

src/Core/Services/Implementations/LocalAttachmentStorageService.cs

@@ -2,63 +2,73 @@
 using System.IO;
 using System;
 using Bit.Core.Models.Table;
+using Bit.Core.Models.Data;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Services
 {
     public class LocalAttachmentStorageService : IAttachmentStorageService
     {
+        private readonly string _baseAttachmentUrl;
         private readonly string _baseDirPath;
         private readonly string _baseTempDirPath;
 
         public LocalAttachmentStorageService(
-            GlobalSettings globalSettings)
+            IGlobalSettings globalSettings)
         {
             _baseDirPath = globalSettings.Attachment.BaseDirectory;
             _baseTempDirPath = $"{_baseDirPath}/temp";
+            _baseAttachmentUrl = globalSettings.Attachment.BaseUrl;
         }
 
-        public async Task UploadNewAttachmentAsync(Stream stream, Cipher cipher, string attachmentId)
+        public async Task<string> GetAttachmentDownloadUrlAsync(Cipher cipher, CipherAttachment.MetaData attachmentData)
         {
             await InitAsync();
-            var cipherDirPath = $"{_baseDirPath}/{cipher.Id}";
+            return $"{_baseAttachmentUrl}/{cipher.Id}/{attachmentData.AttachmentId}";
+        }
+
+        public async Task UploadNewAttachmentAsync(Stream stream, Cipher cipher, CipherAttachment.MetaData attachmentData)
+        {
+            await InitAsync();
+            var cipherDirPath = CipherDirectoryPath(cipher.Id, temp: false);
             CreateDirectoryIfNotExists(cipherDirPath);
 
-            using (var fs = File.Create($"{cipherDirPath}/{attachmentId}"))
+            using (var fs = File.Create(AttachmentFilePath(cipherDirPath, attachmentData.AttachmentId)))
             {
                 stream.Seek(0, SeekOrigin.Begin);
                 await stream.CopyToAsync(fs);
             }
         }
 
-        public async Task UploadShareAttachmentAsync(Stream stream, Guid cipherId, Guid organizationId, string attachmentId)
+        public async Task UploadShareAttachmentAsync(Stream stream, Guid cipherId, Guid organizationId, CipherAttachment.MetaData attachmentData)
         {
             await InitAsync();
-            var tempCipherOrgDirPath = $"{_baseTempDirPath}/{cipherId}/{organizationId}";
+            var tempCipherOrgDirPath = OrganizationDirectoryPath(cipherId, organizationId, temp: true);
             CreateDirectoryIfNotExists(tempCipherOrgDirPath);
 
-            using (var fs = File.Create($"{tempCipherOrgDirPath}/{attachmentId}"))
+            using (var fs = File.Create(AttachmentFilePath(tempCipherOrgDirPath, attachmentData.AttachmentId)))
             {
                 stream.Seek(0, SeekOrigin.Begin);
                 await stream.CopyToAsync(fs);
             }
         }
 
-        public async Task StartShareAttachmentAsync(Guid cipherId, Guid organizationId, string attachmentId)
+        public async Task StartShareAttachmentAsync(Guid cipherId, Guid organizationId, CipherAttachment.MetaData attachmentData)
         {
             await InitAsync();
-            var sourceFilePath = $"{_baseTempDirPath}/{cipherId}/{organizationId}/{attachmentId}";
+            var sourceFilePath = AttachmentFilePath(attachmentData.AttachmentId, cipherId, organizationId, temp: true);
             if (!File.Exists(sourceFilePath))
             {
                 return;
             }
 
-            var destFilePath = $"{_baseDirPath}/{cipherId}/{attachmentId}";
+            var destFilePath = AttachmentFilePath(attachmentData.AttachmentId, cipherId, temp: false);
             if (!File.Exists(destFilePath))
             {
                 return;
             }
 
-            var originalFilePath = $"{_baseTempDirPath}/{cipherId}/{attachmentId}";
+            var originalFilePath = AttachmentFilePath(attachmentData.AttachmentId, cipherId, temp: true);
             DeleteFileIfExists(originalFilePath);
 
             File.Move(destFilePath, originalFilePath);
@@ -67,40 +77,40 @@ namespace Bit.Core.Services
             File.Move(sourceFilePath, destFilePath);
         }
 
-        public async Task RollbackShareAttachmentAsync(Guid cipherId, Guid organizationId, string attachmentId)
+        public async Task RollbackShareAttachmentAsync(Guid cipherId, Guid organizationId, CipherAttachment.MetaData attachmentData, string originalContainer)
         {
             await InitAsync();
-            DeleteFileIfExists($"{_baseTempDirPath}/{cipherId}/{organizationId}/{attachmentId}");
+            DeleteFileIfExists(AttachmentFilePath(attachmentData.AttachmentId, cipherId, organizationId, temp: true));
 
-            var originalFilePath = $"{_baseTempDirPath}/{cipherId}/{attachmentId}";
+            var originalFilePath = AttachmentFilePath(attachmentData.AttachmentId, cipherId, temp: true);
             if (!File.Exists(originalFilePath))
             {
                 return;
             }
 
-            var destFilePath = $"{_baseDirPath}/{cipherId}/{attachmentId}";
+            var destFilePath = AttachmentFilePath(attachmentData.AttachmentId, cipherId, temp: false);
             DeleteFileIfExists(destFilePath);
 
             File.Move(originalFilePath, destFilePath);
             DeleteFileIfExists(originalFilePath);
         }
 
-        public async Task DeleteAttachmentAsync(Guid cipherId, string attachmentId)
+        public async Task DeleteAttachmentAsync(Guid cipherId, CipherAttachment.MetaData attachmentData)
         {
             await InitAsync();
-            DeleteFileIfExists($"{_baseDirPath}/{cipherId}/{attachmentId}");
+            DeleteFileIfExists(AttachmentFilePath(attachmentData.AttachmentId, cipherId, temp: false));
         }
 
         public async Task CleanupAsync(Guid cipherId)
         {
             await InitAsync();
-            DeleteDirectoryIfExists($"{_baseTempDirPath}/{cipherId}");
+            DeleteDirectoryIfExists(CipherDirectoryPath(cipherId, temp: true));
         }
 
         public async Task DeleteAttachmentsForCipherAsync(Guid cipherId)
         {
             await InitAsync();
-            DeleteDirectoryIfExists($"{_baseDirPath}/{cipherId}");
+            DeleteDirectoryIfExists(CipherDirectoryPath(cipherId, temp: false));
         }
 
         public async Task DeleteAttachmentsForOrganizationAsync(Guid organizationId)
@@ -151,5 +161,18 @@ namespace Bit.Core.Services
 
             return Task.FromResult(0);
         }
+
+        private string CipherDirectoryPath(Guid cipherId, bool temp = false) =>
+            Path.Combine(temp ? _baseTempDirPath : _baseDirPath, cipherId.ToString());
+        private string OrganizationDirectoryPath(Guid cipherId, Guid organizationId, bool temp = false) =>
+            Path.Combine(temp ? _baseTempDirPath : _baseDirPath, cipherId.ToString(), organizationId.ToString());
+
+        private string AttachmentFilePath(string dir, string attachmentId) => Path.Combine(dir, attachmentId);
+        private string AttachmentFilePath(string attachmentId, Guid cipherId, Guid? organizationId = null,
+            bool temp = false) =>
+            organizationId.HasValue ?
+            AttachmentFilePath(OrganizationDirectoryPath(cipherId, organizationId.Value, temp), attachmentId) :
+            AttachmentFilePath(CipherDirectoryPath(cipherId, temp), attachmentId);
+
     }
 }

src/Core/Services/Implementations/LocalSendStorageService.cs

@@ -2,6 +2,7 @@
 using System.IO;
 using System;
 using Bit.Core.Models.Table;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Services
 {

src/Core/Services/Implementations/MailKitSmtpMailDeliveryService.cs

@@ -1,6 +1,7 @@
 using System;
 using System.Threading.Tasks;
 using Bit.Core.Utilities;
+using Bit.Core.Settings;
 using MailKit.Net.Smtp;
 using Microsoft.Extensions.Logging;
 using MimeKit;

src/Core/Services/Implementations/MultiServicePushNotificationService.cs

@@ -7,6 +7,7 @@ using Microsoft.AspNetCore.Http;
 using Bit.Core.Utilities;
 using Microsoft.Extensions.Logging;
 using Bit.Core.Repositories;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Services
 {

src/Core/Services/Implementations/NotificationHubPushNotificationService.cs

@@ -10,6 +10,7 @@ using Microsoft.AspNetCore.Http;
 using Bit.Core.Models;
 using Bit.Core.Models.Data;
 using Bit.Core.Repositories;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Services
 {

src/Core/Services/Implementations/NotificationHubPushRegistrationService.cs

@@ -6,6 +6,7 @@ using System.Linq;
 using System;
 using Bit.Core.Models.Data;
 using Bit.Core.Repositories;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Services
 {

src/Core/Services/Implementations/NotificationsApiPushNotificationService.cs

@@ -3,6 +3,7 @@ using System.Threading.Tasks;
 using Bit.Core.Context;
 using Bit.Core.Models.Table;
 using Bit.Core.Enums;
+using Bit.Core.Settings;
 using Newtonsoft.Json;
 using Bit.Core.Models;
 using Microsoft.AspNetCore.Http;

src/Core/Services/Implementations/OrganizationService.cs

@@ -11,6 +11,7 @@ using Microsoft.AspNetCore.DataProtection;
 using Stripe;
 using Bit.Core.Enums;
 using Bit.Core.Models.Data;
+using Bit.Core.Settings;
 using System.IO;
 using Newtonsoft.Json;
 using System.Text.Json;

src/Core/Services/Implementations/RelayPushNotificationService.cs

@@ -10,6 +10,7 @@ using Bit.Core.Models.Api;
 using Microsoft.Extensions.Logging;
 using System.Collections.Generic;
 using Bit.Core.Repositories;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Services
 {

src/Core/Services/Implementations/RelayPushRegistrationService.cs

@@ -3,6 +3,7 @@ using System.Threading.Tasks;
 using System.Net.Http;
 using Bit.Core.Models.Api;
 using Bit.Core.Enums;
+using Bit.Core.Settings;
 using System.Linq;
 using Microsoft.Extensions.Logging;
 

src/Core/Services/Implementations/SendService.cs

@@ -8,6 +8,7 @@ using Bit.Core.Exceptions;
 using Bit.Core.Models.Data;
 using Bit.Core.Models.Table;
 using Bit.Core.Repositories;
+using Bit.Core.Settings;
 using Microsoft.AspNetCore.Identity;
 using Newtonsoft.Json;
 

src/Core/Services/Implementations/StripePaymentService.cs

@@ -5,11 +5,12 @@ using Stripe;
 using System.Collections.Generic;
 using Bit.Core.Exceptions;
 using System.Linq;
+using Bit.Billing.Models;
 using Bit.Core.Models.Business;
 using Bit.Core.Enums;
 using Bit.Core.Repositories;
+using Bit.Core.Settings;
 using Microsoft.Extensions.Logging;
-using Bit.Billing.Models;
 using StripeTaxRate = Stripe.TaxRate;
 using TaxRate = Bit.Core.Models.Table.TaxRate;
 

src/Core/Services/Implementations/UserService.cs

@@ -17,6 +17,7 @@ using U2F.Core.Utils;
 using Bit.Core.Context;
 using Bit.Core.Exceptions;
 using Bit.Core.Utilities;
+using Bit.Core.Settings;
 using System.IO;
 using Newtonsoft.Json;
 using Microsoft.AspNetCore.DataProtection;

src/Core/Services/NoopImplementations/NoopAttachmentStorageService.cs

@@ -1,6 +1,7 @@
 using System;
 using System.IO;
 using System.Threading.Tasks;
+using Bit.Core.Models.Data;
 using Bit.Core.Models.Table;
 
 namespace Bit.Core.Services
@@ -12,7 +13,7 @@ namespace Bit.Core.Services
             return Task.FromResult(0);
         }
 
-        public Task DeleteAttachmentAsync(Guid cipherId, string attachmentId)
+        public Task DeleteAttachmentAsync(Guid cipherId, CipherAttachment.MetaData attachmentData)
         {
             return Task.FromResult(0);
         }
@@ -32,24 +33,30 @@ namespace Bit.Core.Services
             return Task.FromResult(0);
         }
 
-        public Task RollbackShareAttachmentAsync(Guid cipherId, Guid organizationId, string attachmentId)
+        public Task RollbackShareAttachmentAsync(Guid cipherId, Guid organizationId, CipherAttachment.MetaData attachmentData, string originalContainer)
         {
             return Task.FromResult(0);
         }
 
-        public Task StartShareAttachmentAsync(Guid cipherId, Guid organizationId, string attachmentId)
+        public Task StartShareAttachmentAsync(Guid cipherId, Guid organizationId, CipherAttachment.MetaData attachmentData)
         {
             return Task.FromResult(0);
         }
 
-        public Task UploadNewAttachmentAsync(Stream stream, Cipher cipher, string attachmentId)
+        public Task UploadNewAttachmentAsync(Stream stream, Cipher cipher, CipherAttachment.MetaData attachmentData)
         {
             return Task.FromResult(0);
         }
 
-        public Task UploadShareAttachmentAsync(Stream stream, Guid cipherId, Guid organizationId, string attachmentId)
+        public Task UploadShareAttachmentAsync(Stream stream, Guid cipherId, Guid organizationId, CipherAttachment.MetaData attachmentData)
         {
             return Task.FromResult(0);
         }
+
+        public Task<string> GetAttachmentDownloadUrlAsync(Cipher cipher, CipherAttachment.MetaData attachmentData)
+        {
+            return Task.FromResult((string)null);
+        }
+
     }
 }

src/Core/Services/NoopImplementations/NoopLicensingService.cs

@@ -2,6 +2,7 @@
 using Microsoft.AspNetCore.Hosting;
 using System;
 using Bit.Core.Models.Business;
+using Bit.Core.Settings;
 using System.Threading.Tasks;
 using Microsoft.Extensions.Hosting;
 

src/Core/Settings/GlobalSettings.cs

@@ -1,9 +1,9 @@
 using System;
 using Bit.Core.Enums;
 
-namespace Bit.Core
+namespace Bit.Core.Settings
 {
-    public class GlobalSettings
+    public class GlobalSettings : IGlobalSettings
     {
         public bool SelfHosted { get; set; }
         public virtual string KnownProxies { get; set; }
@@ -29,7 +29,7 @@ namespace Bit.Core
         public virtual ConnectionStringSettings Storage { get; set; } = new ConnectionStringSettings();
         public virtual ConnectionStringSettings Events { get; set; } = new ConnectionStringSettings();
         public virtual NotificationsSettings Notifications { get; set; } = new NotificationsSettings();
-        public virtual FileStorageSettings Attachment { get; set; } = new FileStorageSettings();
+        public virtual IFileStorageSettings Attachment { get; set; } = new FileStorageSettings();
         public virtual FileStorageSettings Send { get; set; } = new FileStorageSettings();
         public virtual IdentityServerSettings IdentityServer { get; set; } = new IdentityServerSettings();
         public virtual DataProtectionSettings DataProtection { get; set; } = new DataProtectionSettings();
@@ -112,7 +112,7 @@ namespace Bit.Core
             }
         }
 
-        public class FileStorageSettings
+        public class FileStorageSettings : IFileStorageSettings
         {
             private string _connectionString;
 

src/Core/Settings/IFileStorageSettings.cs

@@ -0,0 +1,9 @@
+namespace Bit.Core.Settings
+{
+    public interface IFileStorageSettings
+    {
+        string ConnectionString { get; set; }
+        string BaseDirectory { get; set; }
+        string BaseUrl { get; set; }
+    }
+}

src/Core/Settings/IGlobalSettings.cs

@@ -0,0 +1,8 @@
+namespace Bit.Core.Settings
+{
+    public interface IGlobalSettings
+    {
+        // This interface exists for testing. Add settings here as needed for testing
+        IFileStorageSettings Attachment { get; set; }
+    }
+}

src/Core/Utilities/BitPayClient.cs

@@ -1,5 +1,6 @@
 using System;
 using System.Threading.Tasks;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Utilities
 {

src/Core/Utilities/CoreHelpers.cs

@@ -14,6 +14,7 @@ using Dapper;
 using System.Globalization;
 using System.Web;
 using Microsoft.AspNetCore.DataProtection;
+using Bit.Core.Settings;
 using Bit.Core.Enums;
 using Bit.Core.Context;
 using System.Threading.Tasks;

src/Core/Utilities/CurrentContextMiddleware.cs

@@ -1,6 +1,7 @@
 using Microsoft.AspNetCore.Http;
 using System.Threading.Tasks;
 using Bit.Core.Context;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Utilities
 {

src/Core/Utilities/LoggerFactoryExtensions.cs

@@ -9,6 +9,7 @@ using Serilog.Sinks.Syslog;
 using System;
 using System.Security.Authentication;
 using System.Security.Cryptography.X509Certificates;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Utilities
 {

src/Core/Utilities/SelfHostedAttribute.cs

@@ -1,6 +1,7 @@
 using Microsoft.AspNetCore.Mvc.Filters;
 using Microsoft.Extensions.DependencyInjection;
 using Bit.Core.Exceptions;
+using Bit.Core.Settings;
 
 namespace Bit.Core.Utilities
 {

src/Core/Utilities/ServiceCollectionExtensions.cs

@@ -13,6 +13,7 @@ using Bit.Core.Models.Table;
 using Bit.Core.Repositories;
 using Bit.Core.Resources;
 using Bit.Core.Services;
+using Bit.Core.Settings;
 using Bit.Core.Utilities;
 using IdentityModel;
 using IdentityServer4.AccessTokenValidation;
@@ -422,6 +423,7 @@ namespace Bit.Core.Utilities
             var globalSettings = new GlobalSettings();
             ConfigurationBinder.Bind(configuration.GetSection("GlobalSettings"), globalSettings);
             services.AddSingleton(s => globalSettings);
+            services.AddSingleton<IGlobalSettings, GlobalSettings>();
             return globalSettings;
         }