mirror of
https://github.com/bitwarden/server.git
synced 2025-07-01 16:12:49 -05:00
Merge branch 'master' into flexible-collections/deprecate-custom-collection-perm
This commit is contained in:
Rui Tome
@ -1,6 +1,8 @@
|
||||
using System.Security.Claims;
|
||||
using AutoFixture.Xunit2;
|
||||
using Bit.Api.AdminConsole.Controllers;
|
||||
using Bit.Api.AdminConsole.Models.Request.Organizations;
|
||||
using Bit.Api.Models.Request.Organizations;
|
||||
using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationApiKeys.Interfaces;
|
||||
using Bit.Core.AdminConsole.Repositories;
|
||||
using Bit.Core.Auth.Entities;
|
||||
@ -10,13 +12,17 @@ using Bit.Core.Auth.Repositories;
|
||||
using Bit.Core.Auth.Services;
|
||||
using Bit.Core.Context;
|
||||
using Bit.Core.Entities;
|
||||
using Bit.Core.Enums;
|
||||
using Bit.Core.Exceptions;
|
||||
using Bit.Core.Models.Business;
|
||||
using Bit.Core.Models.Data.Organizations.OrganizationUsers;
|
||||
using Bit.Core.OrganizationFeatures.OrganizationLicenses.Interfaces;
|
||||
using Bit.Core.OrganizationFeatures.OrganizationSubscriptions.Interface;
|
||||
using Bit.Core.Repositories;
|
||||
using Bit.Core.Services;
|
||||
using Bit.Core.Settings;
|
||||
using NSubstitute;
|
||||
using NSubstitute.ReturnsExtensions;
|
||||
using Xunit;
|
||||
|
||||
namespace Bit.Api.Test.AdminConsole.Controllers;
|
||||
@ -145,4 +151,194 @@ public class OrganizationsControllerTests : IDisposable
|
||||
await _organizationService.DeleteUserAsync(orgId, user.Id);
|
||||
await _organizationService.Received(1).DeleteUserAsync(orgId, user.Id);
|
||||
}
|
||||
|
||||
[Theory, AutoData]
|
||||
public async Task OrganizationsController_PostUpgrade_UserCannotEditSubscription_ThrowsNotFoundException(
|
||||
Guid organizationId,
|
||||
OrganizationUpgradeRequestModel model)
|
||||
{
|
||||
_currentContext.EditSubscription(organizationId).Returns(false);
|
||||
|
||||
await Assert.ThrowsAsync<NotFoundException>(() => _sut.PostUpgrade(organizationId.ToString(), model));
|
||||
}
|
||||
|
||||
[Theory, AutoData]
|
||||
public async Task OrganizationsController_PostUpgrade_NonSMUpgrade_ReturnsCorrectResponse(
|
||||
Guid organizationId,
|
||||
OrganizationUpgradeRequestModel model,
|
||||
bool success,
|
||||
string paymentIntentClientSecret)
|
||||
{
|
||||
model.UseSecretsManager = false;
|
||||
|
||||
_currentContext.EditSubscription(organizationId).Returns(true);
|
||||
|
||||
_upgradeOrganizationPlanCommand.UpgradePlanAsync(organizationId, Arg.Any<OrganizationUpgrade>())
|
||||
.Returns(new Tuple<bool, string>(success, paymentIntentClientSecret));
|
||||
|
||||
var response = await _sut.PostUpgrade(organizationId.ToString(), model);
|
||||
|
||||
Assert.Equal(success, response.Success);
|
||||
Assert.Equal(paymentIntentClientSecret, response.PaymentIntentClientSecret);
|
||||
}
|
||||
|
||||
[Theory, AutoData]
|
||||
public async Task OrganizationsController_PostUpgrade_SMUpgrade_ProvidesAccess_ReturnsCorrectResponse(
|
||||
Guid organizationId,
|
||||
Guid userId,
|
||||
OrganizationUpgradeRequestModel model,
|
||||
bool success,
|
||||
string paymentIntentClientSecret,
|
||||
OrganizationUser organizationUser)
|
||||
{
|
||||
model.UseSecretsManager = true;
|
||||
organizationUser.AccessSecretsManager = false;
|
||||
|
||||
_currentContext.EditSubscription(organizationId).Returns(true);
|
||||
|
||||
_upgradeOrganizationPlanCommand.UpgradePlanAsync(organizationId, Arg.Any<OrganizationUpgrade>())
|
||||
.Returns(new Tuple<bool, string>(success, paymentIntentClientSecret));
|
||||
|
||||
_userService.GetProperUserId(Arg.Any<ClaimsPrincipal>()).Returns(userId);
|
||||
|
||||
_organizationUserRepository.GetByOrganizationAsync(organizationId, userId).Returns(organizationUser);
|
||||
|
||||
var response = await _sut.PostUpgrade(organizationId.ToString(), model);
|
||||
|
||||
Assert.Equal(success, response.Success);
|
||||
Assert.Equal(paymentIntentClientSecret, response.PaymentIntentClientSecret);
|
||||
|
||||
await _organizationUserRepository.Received(1).ReplaceAsync(Arg.Is<OrganizationUser>(orgUser =>
|
||||
orgUser.Id == organizationUser.Id && orgUser.AccessSecretsManager == true));
|
||||
}
|
||||
|
||||
[Theory, AutoData]
|
||||
public async Task OrganizationsController_PostUpgrade_SMUpgrade_NullOrgUser_ReturnsCorrectResponse(
|
||||
Guid organizationId,
|
||||
Guid userId,
|
||||
OrganizationUpgradeRequestModel model,
|
||||
bool success,
|
||||
string paymentIntentClientSecret)
|
||||
{
|
||||
model.UseSecretsManager = true;
|
||||
|
||||
_currentContext.EditSubscription(organizationId).Returns(true);
|
||||
|
||||
_upgradeOrganizationPlanCommand.UpgradePlanAsync(organizationId, Arg.Any<OrganizationUpgrade>())
|
||||
.Returns(new Tuple<bool, string>(success, paymentIntentClientSecret));
|
||||
|
||||
_userService.GetProperUserId(Arg.Any<ClaimsPrincipal>()).Returns(userId);
|
||||
|
||||
_organizationUserRepository.GetByOrganizationAsync(organizationId, userId).ReturnsNull();
|
||||
|
||||
var response = await _sut.PostUpgrade(organizationId.ToString(), model);
|
||||
|
||||
Assert.Equal(success, response.Success);
|
||||
Assert.Equal(paymentIntentClientSecret, response.PaymentIntentClientSecret);
|
||||
|
||||
await _organizationUserRepository.DidNotReceiveWithAnyArgs().ReplaceAsync(Arg.Any<OrganizationUser>());
|
||||
}
|
||||
|
||||
[Theory, AutoData]
|
||||
public async Task OrganizationsController_PostSubscribeSecretsManagerAsync_NullOrg_ThrowsNotFoundException(
|
||||
Guid organizationId,
|
||||
SecretsManagerSubscribeRequestModel model)
|
||||
{
|
||||
_organizationRepository.GetByIdAsync(organizationId).ReturnsNull();
|
||||
|
||||
await Assert.ThrowsAsync<NotFoundException>(() => _sut.PostSubscribeSecretsManagerAsync(organizationId, model));
|
||||
}
|
||||
|
||||
[Theory, AutoData]
|
||||
public async Task OrganizationsController_PostSubscribeSecretsManagerAsync_UserCannotEditSubscription_ThrowsNotFoundException(
|
||||
Guid organizationId,
|
||||
SecretsManagerSubscribeRequestModel model,
|
||||
Organization organization)
|
||||
{
|
||||
_organizationRepository.GetByIdAsync(organizationId).Returns(organization);
|
||||
|
||||
_currentContext.EditSubscription(organizationId).Returns(false);
|
||||
|
||||
await Assert.ThrowsAsync<NotFoundException>(() => _sut.PostSubscribeSecretsManagerAsync(organizationId, model));
|
||||
}
|
||||
|
||||
[Theory, AutoData]
|
||||
public async Task OrganizationsController_PostSubscribeSecretsManagerAsync_ProvidesAccess_ReturnsCorrectResponse(
|
||||
Guid organizationId,
|
||||
SecretsManagerSubscribeRequestModel model,
|
||||
Organization organization,
|
||||
Guid userId,
|
||||
OrganizationUser organizationUser,
|
||||
OrganizationUserOrganizationDetails organizationUserOrganizationDetails)
|
||||
{
|
||||
organizationUser.AccessSecretsManager = false;
|
||||
|
||||
var ssoConfigurationData = new SsoConfigurationData
|
||||
{
|
||||
MemberDecryptionType = MemberDecryptionType.KeyConnector,
|
||||
KeyConnectorUrl = "https://example.com"
|
||||
};
|
||||
|
||||
organizationUserOrganizationDetails.Permissions = string.Empty;
|
||||
organizationUserOrganizationDetails.SsoConfig = ssoConfigurationData.Serialize();
|
||||
|
||||
_organizationRepository.GetByIdAsync(organizationId).Returns(organization);
|
||||
|
||||
_currentContext.EditSubscription(organizationId).Returns(true);
|
||||
|
||||
_userService.GetProperUserId(Arg.Any<ClaimsPrincipal>()).Returns(userId);
|
||||
|
||||
_organizationUserRepository.GetByOrganizationAsync(organization.Id, userId).Returns(organizationUser);
|
||||
|
||||
_organizationUserRepository.GetDetailsByUserAsync(userId, organization.Id, OrganizationUserStatusType.Confirmed)
|
||||
.Returns(organizationUserOrganizationDetails);
|
||||
|
||||
var response = await _sut.PostSubscribeSecretsManagerAsync(organizationId, model);
|
||||
|
||||
Assert.Equal(response.Id, organizationUserOrganizationDetails.OrganizationId);
|
||||
Assert.Equal(response.Name, organizationUserOrganizationDetails.Name);
|
||||
|
||||
await _addSecretsManagerSubscriptionCommand.Received(1)
|
||||
.SignUpAsync(organization, model.AdditionalSmSeats, model.AdditionalServiceAccounts);
|
||||
await _organizationUserRepository.Received(1).ReplaceAsync(Arg.Is<OrganizationUser>(orgUser =>
|
||||
orgUser.Id == organizationUser.Id && orgUser.AccessSecretsManager == true));
|
||||
}
|
||||
|
||||
[Theory, AutoData]
|
||||
public async Task OrganizationsController_PostSubscribeSecretsManagerAsync_NullOrgUser_ReturnsCorrectResponse(
|
||||
Guid organizationId,
|
||||
SecretsManagerSubscribeRequestModel model,
|
||||
Organization organization,
|
||||
Guid userId,
|
||||
OrganizationUserOrganizationDetails organizationUserOrganizationDetails)
|
||||
{
|
||||
var ssoConfigurationData = new SsoConfigurationData
|
||||
{
|
||||
MemberDecryptionType = MemberDecryptionType.KeyConnector,
|
||||
KeyConnectorUrl = "https://example.com"
|
||||
};
|
||||
|
||||
organizationUserOrganizationDetails.Permissions = string.Empty;
|
||||
organizationUserOrganizationDetails.SsoConfig = ssoConfigurationData.Serialize();
|
||||
|
||||
_organizationRepository.GetByIdAsync(organizationId).Returns(organization);
|
||||
|
||||
_currentContext.EditSubscription(organizationId).Returns(true);
|
||||
|
||||
_userService.GetProperUserId(Arg.Any<ClaimsPrincipal>()).Returns(userId);
|
||||
|
||||
_organizationUserRepository.GetByOrganizationAsync(organization.Id, userId).ReturnsNull();
|
||||
|
||||
_organizationUserRepository.GetDetailsByUserAsync(userId, organization.Id, OrganizationUserStatusType.Confirmed)
|
||||
.Returns(organizationUserOrganizationDetails);
|
||||
|
||||
var response = await _sut.PostSubscribeSecretsManagerAsync(organizationId, model);
|
||||
|
||||
Assert.Equal(response.Id, organizationUserOrganizationDetails.OrganizationId);
|
||||
Assert.Equal(response.Name, organizationUserOrganizationDetails.Name);
|
||||
|
||||
await _addSecretsManagerSubscriptionCommand.Received(1)
|
||||
.SignUpAsync(organization, model.AdditionalSmSeats, model.AdditionalServiceAccounts);
|
||||
await _organizationUserRepository.DidNotReceiveWithAnyArgs().ReplaceAsync(Arg.Any<OrganizationUser>());
|
||||
}
|
||||
}
|
||||
|
||||
@ -3,6 +3,7 @@ using Bit.Api.Auth.Models.Request.Accounts;
|
||||
using Bit.Api.Auth.Models.Request.Webauthn;
|
||||
using Bit.Core.Auth.Models.Business.Tokenables;
|
||||
using Bit.Core.Entities;
|
||||
using Bit.Core.Enums;
|
||||
using Bit.Core.Exceptions;
|
||||
using Bit.Core.Services;
|
||||
using Bit.Core.Tokens;
|
||||
@ -22,7 +23,7 @@ public class WebAuthnControllerTests
|
||||
[Theory, BitAutoData]
|
||||
public async Task Get_UserNotFound_ThrowsUnauthorizedAccessException(SutProvider<WebAuthnController> sutProvider)
|
||||
{
|
||||
// Arrange
|
||||
// Arrange
|
||||
sutProvider.GetDependency<IUserService>().GetUserByPrincipalAsync(default).ReturnsNullForAnyArgs();
|
||||
|
||||
// Act
|
||||
@ -35,7 +36,7 @@ public class WebAuthnControllerTests
|
||||
[Theory, BitAutoData]
|
||||
public async Task PostOptions_UserNotFound_ThrowsUnauthorizedAccessException(SecretVerificationRequestModel requestModel, SutProvider<WebAuthnController> sutProvider)
|
||||
{
|
||||
// Arrange
|
||||
// Arrange
|
||||
sutProvider.GetDependency<IUserService>().GetUserByPrincipalAsync(default).ReturnsNullForAnyArgs();
|
||||
|
||||
// Act
|
||||
@ -59,10 +60,25 @@ public class WebAuthnControllerTests
|
||||
await Assert.ThrowsAsync<BadRequestException>(result);
|
||||
}
|
||||
|
||||
[Theory, BitAutoData]
|
||||
public async Task PostOptions_RequireSsoPolicyApplicable_ThrowsBadRequestException(
|
||||
SecretVerificationRequestModel requestModel, User user, SutProvider<WebAuthnController> sutProvider)
|
||||
{
|
||||
// Arrange
|
||||
sutProvider.GetDependency<IUserService>().GetUserByPrincipalAsync(default).ReturnsForAnyArgs(user);
|
||||
sutProvider.GetDependency<IUserService>().VerifySecretAsync(user, default).ReturnsForAnyArgs(true);
|
||||
sutProvider.GetDependency<IPolicyService>().AnyPoliciesApplicableToUserAsync(user.Id, PolicyType.RequireSso).ReturnsForAnyArgs(true);
|
||||
|
||||
// Act & Assert
|
||||
var exception = await Assert.ThrowsAsync<BadRequestException>(
|
||||
() => sutProvider.Sut.PostOptions(requestModel));
|
||||
Assert.Contains("Passkeys cannot be created for your account. SSO login is required", exception.Message);
|
||||
}
|
||||
|
||||
[Theory, BitAutoData]
|
||||
public async Task Post_UserNotFound_ThrowsUnauthorizedAccessException(WebAuthnCredentialRequestModel requestModel, SutProvider<WebAuthnController> sutProvider)
|
||||
{
|
||||
// Arrange
|
||||
// Arrange
|
||||
sutProvider.GetDependency<IUserService>().GetUserByPrincipalAsync(default).ReturnsNullForAnyArgs();
|
||||
|
||||
// Act
|
||||
@ -113,10 +129,36 @@ public class WebAuthnControllerTests
|
||||
// Nothing to assert since return is void
|
||||
}
|
||||
|
||||
[Theory, BitAutoData]
|
||||
public async Task Post_RequireSsoPolicyApplicable_ThrowsBadRequestException(
|
||||
WebAuthnCredentialRequestModel requestModel,
|
||||
CredentialCreateOptions createOptions,
|
||||
User user,
|
||||
SutProvider<WebAuthnController> sutProvider)
|
||||
{
|
||||
// Arrange
|
||||
var token = new WebAuthnCredentialCreateOptionsTokenable(user, createOptions);
|
||||
sutProvider.GetDependency<IUserService>()
|
||||
.GetUserByPrincipalAsync(default)
|
||||
.ReturnsForAnyArgs(user);
|
||||
sutProvider.GetDependency<IUserService>()
|
||||
.CompleteWebAuthLoginRegistrationAsync(user, requestModel.Name, createOptions, Arg.Any<AuthenticatorAttestationRawResponse>())
|
||||
.Returns(true);
|
||||
sutProvider.GetDependency<IDataProtectorTokenFactory<WebAuthnCredentialCreateOptionsTokenable>>()
|
||||
.Unprotect(requestModel.Token)
|
||||
.Returns(token);
|
||||
sutProvider.GetDependency<IPolicyService>().AnyPoliciesApplicableToUserAsync(user.Id, PolicyType.RequireSso).ReturnsForAnyArgs(true);
|
||||
|
||||
// Act & Assert
|
||||
var exception = await Assert.ThrowsAsync<BadRequestException>(
|
||||
() => sutProvider.Sut.Post(requestModel));
|
||||
Assert.Contains("Passkeys cannot be created for your account. SSO login is required", exception.Message);
|
||||
}
|
||||
|
||||
[Theory, BitAutoData]
|
||||
public async Task Delete_UserNotFound_ThrowsUnauthorizedAccessException(Guid credentialId, SecretVerificationRequestModel requestModel, SutProvider<WebAuthnController> sutProvider)
|
||||
{
|
||||
// Arrange
|
||||
// Arrange
|
||||
sutProvider.GetDependency<IUserService>().GetUserByPrincipalAsync(default).ReturnsNullForAnyArgs();
|
||||
|
||||
// Act
|
||||
|
||||
Reference in New Issue
Block a user