nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-07-05 01:52:49 -05:00
Code Activity

[AC-1139] Fixed Provider AuthorizationHandler logic for Groups and OrganizationUsers

Browse Source
This commit is contained in:
Rui Tome
2023-10-25 16:20:13 +01:00
parent e57469859c
commit 5c56b012c9
2 changed files with 51 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
src/Api/Vault/AuthorizationHandlers/Groups/GroupAuthorizationHandler.cs
View File

@ -48,13 +48,7 @@ public class GroupAuthorizationHandler : AuthorizationHandler<GroupOperationRequ
return; return;
} }
// Acting user is not a member of the target organization, fail
var org = _currentContext.GetOrganization(targetOrganizationId); var org = _currentContext.GetOrganization(targetOrganizationId);
if (org == null)
{
context.Fail();
return;
}
switch (requirement) switch (requirement)
{ {
@ -67,15 +61,31 @@ public class GroupAuthorizationHandler : AuthorizationHandler<GroupOperationRequ
private async Task CanReadAllAsync(AuthorizationHandlerContext context, GroupOperationRequirement requirement, private async Task CanReadAllAsync(AuthorizationHandlerContext context, GroupOperationRequirement requirement,
CurrentContextOrganization org) CurrentContextOrganization org)
{ {
if (org.Type is OrganizationUserType.Owner or OrganizationUserType.Admin || if (org != null)
org.Permissions.ManageGroups ||
org.Permissions.ManageUsers ||
org.Permissions.EditAnyCollection ||
org.Permissions.DeleteAnyCollection ||
org.Permissions.AccessImportExport ||
await _currentContext.ProviderUserForOrgAsync(org.Id))
{ {
context.Succeed(requirement); // Acting user is a member of the target organization, check permissions
if (org.Type is OrganizationUserType.Owner or OrganizationUserType.Admin ||
org.Permissions.ManageGroups ||
org.Permissions.ManageUsers ||
org.Permissions.EditAnyCollection ||
org.Permissions.DeleteAnyCollection ||
org.Permissions.AccessImportExport)
{
context.Succeed(requirement);
return;
}
} }
else
{
// Check if acting user is a provider user for the target organization
if (await _currentContext.ProviderUserForOrgAsync(requirement.OrganizationId))
{
context.Succeed(requirement);
return;
}
}
// Acting user is neither a member of the target organization or a provider user, fail
context.Fail();
} }
} }

40
src/Api/Vault/AuthorizationHandlers/OrganizationUsers/OrganizationUserAuthorizationHandler.cs
View File

@ -16,6 +16,8 @@ public class OrganizationUserAuthorizationHandler : AuthorizationHandler<Organiz
private readonly ICurrentContext _currentContext; private readonly ICurrentContext _currentContext;
private readonly IFeatureService _featureService; private readonly IFeatureService _featureService;
private bool FlexibleCollectionsIsEnabled => _featureService.IsEnabled(FeatureFlagKeys.FlexibleCollections, _currentContext);
public OrganizationUserAuthorizationHandler( public OrganizationUserAuthorizationHandler(
ICurrentContext currentContext, ICurrentContext currentContext,
IFeatureService featureService) IFeatureService featureService)
@ -27,7 +29,7 @@ public class OrganizationUserAuthorizationHandler : AuthorizationHandler<Organiz
protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context,
OrganizationUserOperationRequirement requirement) OrganizationUserOperationRequirement requirement)
{ {
if (!_featureService.IsEnabled(FeatureFlagKeys.FlexibleCollections, _currentContext)) if (!FlexibleCollectionsIsEnabled)
{ {
// Flexible collections is OFF, should not be using this handler // Flexible collections is OFF, should not be using this handler
throw new FeatureUnavailableException("Flexible collections is OFF when it should be ON."); throw new FeatureUnavailableException("Flexible collections is OFF when it should be ON.");
@ -40,15 +42,14 @@ public class OrganizationUserAuthorizationHandler : AuthorizationHandler<Organiz
} }
var targetOrganizationId = requirement.OrganizationId; var targetOrganizationId = requirement.OrganizationId;
if (targetOrganizationId == default)
// Acting user is not a member of the target organization, fail
var org = _currentContext.GetOrganization(targetOrganizationId);
if (org == null)
{ {
context.Fail(); context.Fail();
return; return;
} }
var org = _currentContext.GetOrganization(targetOrganizationId);
switch (requirement) switch (requirement)
{ {
case not null when requirement.Name == nameof(OrganizationUserOperations.ReadAll): case not null when requirement.Name == nameof(OrganizationUserOperations.ReadAll):
@ -60,17 +61,30 @@ public class OrganizationUserAuthorizationHandler : AuthorizationHandler<Organiz
private async Task CanReadAllAsync(AuthorizationHandlerContext context, OrganizationUserOperationRequirement requirement, private async Task CanReadAllAsync(AuthorizationHandlerContext context, OrganizationUserOperationRequirement requirement,
CurrentContextOrganization org) CurrentContextOrganization org)
{ {
if (org.Type is OrganizationUserType.Owner or OrganizationUserType.Admin || if (org != null)
org.Permissions.ManageGroups ||
org.Permissions.ManageUsers ||
org.Permissions.EditAnyCollection ||
org.Permissions.DeleteAnyCollection ||
await _currentContext.ProviderUserForOrgAsync(org.Id))
{ {
context.Succeed(requirement); // Acting user is a member of the target organization, check permissions
return; if (org.Type is OrganizationUserType.Owner or OrganizationUserType.Admin ||
org.Permissions.ManageGroups ||
org.Permissions.ManageUsers ||
org.Permissions.EditAnyCollection ||
org.Permissions.DeleteAnyCollection)
{
context.Succeed(requirement);
return;
}
}
else
{
// Check if acting user is a provider user for the target organization
if (await _currentContext.ProviderUserForOrgAsync(requirement.OrganizationId))
{
context.Succeed(requirement);
return;
}
} }
// Acting user is neither a member of the target organization or a provider user, fail
context.Fail(); context.Fail();
} }
} }