mirror of
https://github.com/bitwarden/server.git
synced 2025-06-30 15:42:48 -05:00
[PM-11360] Remove export permission for providers (#5051)
- also fix managed collections export from CLI
This commit is contained in:
Thomas Rittson
@ -0,0 +1,95 @@
|
||||
using System.Security.Claims;
|
||||
using Bit.Api.Tools.Authorization;
|
||||
using Bit.Core.AdminConsole.OrganizationFeatures.Shared.Authorization;
|
||||
using Bit.Core.Context;
|
||||
using Bit.Core.Enums;
|
||||
using Bit.Core.Models.Data;
|
||||
using Bit.Core.Test.AdminConsole.Helpers;
|
||||
using Bit.Test.Common.AutoFixture;
|
||||
using Bit.Test.Common.AutoFixture.Attributes;
|
||||
using Microsoft.AspNetCore.Authorization;
|
||||
using NSubstitute;
|
||||
using Xunit;
|
||||
|
||||
namespace Bit.Api.Test.Tools.Authorization;
|
||||
|
||||
[SutProviderCustomize]
|
||||
public class VaultExportAuthorizationHandlerTests
|
||||
{
|
||||
public static IEnumerable<object[]> CanExportWholeVault => new List<CurrentContextOrganization>
|
||||
{
|
||||
new () { Type = OrganizationUserType.Owner },
|
||||
new () { Type = OrganizationUserType.Admin },
|
||||
new ()
|
||||
{
|
||||
Type = OrganizationUserType.Custom, Permissions = new Permissions { AccessImportExport = true }
|
||||
}
|
||||
}.Select(org => new[] { org });
|
||||
|
||||
[Theory]
|
||||
[BitMemberAutoData(nameof(CanExportWholeVault))]
|
||||
public async Task ExportAll_PermittedRoles_Success(CurrentContextOrganization org, OrganizationScope orgScope, ClaimsPrincipal user,
|
||||
SutProvider<VaultExportAuthorizationHandler> sutProvider)
|
||||
{
|
||||
org.Id = orgScope;
|
||||
sutProvider.GetDependency<ICurrentContext>().GetOrganization(orgScope).Returns(org);
|
||||
|
||||
var authContext = new AuthorizationHandlerContext(new[] { VaultExportOperations.ExportWholeVault }, user, orgScope);
|
||||
await sutProvider.Sut.HandleAsync(authContext);
|
||||
|
||||
Assert.True(authContext.HasSucceeded);
|
||||
}
|
||||
|
||||
public static IEnumerable<object[]> CannotExportWholeVault => new List<CurrentContextOrganization>
|
||||
{
|
||||
new () { Type = OrganizationUserType.User },
|
||||
new ()
|
||||
{
|
||||
Type = OrganizationUserType.Custom, Permissions = new Permissions { AccessImportExport = true }.Invert()
|
||||
}
|
||||
}.Select(org => new[] { org });
|
||||
|
||||
[Theory]
|
||||
[BitMemberAutoData(nameof(CannotExportWholeVault))]
|
||||
public async Task ExportAll_NotPermitted_Failure(CurrentContextOrganization org, OrganizationScope orgScope, ClaimsPrincipal user,
|
||||
SutProvider<VaultExportAuthorizationHandler> sutProvider)
|
||||
{
|
||||
org.Id = orgScope;
|
||||
sutProvider.GetDependency<ICurrentContext>().GetOrganization(orgScope).Returns(org);
|
||||
|
||||
var authContext = new AuthorizationHandlerContext(new[] { VaultExportOperations.ExportWholeVault }, user, orgScope);
|
||||
await sutProvider.Sut.HandleAsync(authContext);
|
||||
|
||||
Assert.False(authContext.HasSucceeded);
|
||||
}
|
||||
|
||||
public static IEnumerable<object[]> CanExportManagedCollections =>
|
||||
AuthorizationHelpers.AllRoles().Select(o => new[] { o });
|
||||
|
||||
[Theory]
|
||||
[BitMemberAutoData(nameof(CanExportManagedCollections))]
|
||||
public async Task ExportManagedCollections_PermittedRoles_Success(CurrentContextOrganization org, OrganizationScope orgScope, ClaimsPrincipal user,
|
||||
SutProvider<VaultExportAuthorizationHandler> sutProvider)
|
||||
{
|
||||
org.Id = orgScope;
|
||||
sutProvider.GetDependency<ICurrentContext>().GetOrganization(orgScope).Returns(org);
|
||||
|
||||
var authContext = new AuthorizationHandlerContext(new[] { VaultExportOperations.ExportManagedCollections }, user, orgScope);
|
||||
await sutProvider.Sut.HandleAsync(authContext);
|
||||
|
||||
Assert.True(authContext.HasSucceeded);
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[BitAutoData([null])]
|
||||
public async Task ExportManagedCollections_NotPermitted_Failure(CurrentContextOrganization org, OrganizationScope orgScope, ClaimsPrincipal user,
|
||||
SutProvider<VaultExportAuthorizationHandler> sutProvider)
|
||||
{
|
||||
sutProvider.GetDependency<ICurrentContext>().GetOrganization(orgScope).Returns(org);
|
||||
|
||||
var authContext = new AuthorizationHandlerContext(new[] { VaultExportOperations.ExportManagedCollections }, user, orgScope);
|
||||
await sutProvider.Sut.HandleAsync(authContext);
|
||||
|
||||
Assert.False(authContext.HasSucceeded);
|
||||
}
|
||||
}
|
||||
52
test/Core.Test/AdminConsole/Helpers/AuthorizationHelpers.cs
Normal file
52
test/Core.Test/AdminConsole/Helpers/AuthorizationHelpers.cs
Normal file
@ -0,0 +1,52 @@
|
||||
using Bit.Core.Context;
|
||||
using Bit.Core.Enums;
|
||||
using Bit.Core.Models.Data;
|
||||
|
||||
namespace Bit.Core.Test.AdminConsole.Helpers;
|
||||
|
||||
public static class AuthorizationHelpers
|
||||
{
|
||||
/// <summary>
|
||||
/// Return a new Permission object with inverted permissions.
|
||||
/// This is useful to test negative cases, e.g. "all other permissions should fail".
|
||||
/// </summary>
|
||||
/// <param name="permissions"></param>
|
||||
/// <returns></returns>
|
||||
public static Permissions Invert(this Permissions permissions)
|
||||
{
|
||||
// Get all false boolean properties of input object
|
||||
var inputsToFlip = permissions
|
||||
.GetType()
|
||||
.GetProperties()
|
||||
.Where(p =>
|
||||
p.PropertyType == typeof(bool) &&
|
||||
(bool)p.GetValue(permissions, null)! == false)
|
||||
.Select(p => p.Name);
|
||||
|
||||
var result = new Permissions();
|
||||
|
||||
// Set these to true on the result object
|
||||
result
|
||||
.GetType()
|
||||
.GetProperties()
|
||||
.Where(p => inputsToFlip.Contains(p.Name))
|
||||
.ToList()
|
||||
.ForEach(p => p.SetValue(result, true));
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Returns a sequence of all possible roles and permissions represented as CurrentContextOrganization objects.
|
||||
/// Used largely for authorization testing.
|
||||
/// </summary>
|
||||
/// <returns></returns>
|
||||
public static IEnumerable<CurrentContextOrganization> AllRoles() => new List<CurrentContextOrganization>
|
||||
{
|
||||
new () { Type = OrganizationUserType.Owner },
|
||||
new () { Type = OrganizationUserType.Admin },
|
||||
new () { Type = OrganizationUserType.Custom, Permissions = new Permissions() },
|
||||
new () { Type = OrganizationUserType.Custom, Permissions = new Permissions().Invert() },
|
||||
new () { Type = OrganizationUserType.User },
|
||||
};
|
||||
}
|
||||
@ -0,0 +1,38 @@
|
||||
using Bit.Core.Models.Data;
|
||||
using Xunit;
|
||||
|
||||
namespace Bit.Core.Test.AdminConsole.Helpers;
|
||||
|
||||
public class AuthorizationHelpersTests
|
||||
{
|
||||
[Fact]
|
||||
public void Permissions_Invert_InvertsAllPermissions()
|
||||
{
|
||||
var sut = new Permissions
|
||||
{
|
||||
AccessEventLogs = true,
|
||||
AccessReports = true,
|
||||
DeleteAnyCollection = true,
|
||||
ManagePolicies = true,
|
||||
ManageScim = true
|
||||
};
|
||||
|
||||
var result = sut.Invert();
|
||||
|
||||
Assert.True(result is
|
||||
{
|
||||
AccessEventLogs: false,
|
||||
AccessImportExport: true,
|
||||
AccessReports: false,
|
||||
CreateNewCollections: true,
|
||||
EditAnyCollection: true,
|
||||
DeleteAnyCollection: false,
|
||||
ManageGroups: true,
|
||||
ManagePolicies: false,
|
||||
ManageSso: true,
|
||||
ManageUsers: true,
|
||||
ManageResetPassword: true,
|
||||
ManageScim: false
|
||||
});
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,92 @@
|
||||
using AutoFixture;
|
||||
using Bit.Core.Entities;
|
||||
using Bit.Core.Repositories;
|
||||
using Bit.Core.Vault.Models.Data;
|
||||
using Bit.Core.Vault.Queries;
|
||||
using Bit.Core.Vault.Repositories;
|
||||
using Bit.Test.Common.AutoFixture;
|
||||
using Bit.Test.Common.AutoFixture.Attributes;
|
||||
using NSubstitute;
|
||||
using Xunit;
|
||||
|
||||
namespace Bit.Core.Test.Vault.Queries;
|
||||
|
||||
[SutProviderCustomize]
|
||||
public class OrganizationCiphersQueryTests
|
||||
{
|
||||
[Theory, BitAutoData]
|
||||
public async Task GetOrganizationCiphersInCollections_ReturnsFilteredCiphers(
|
||||
Guid organizationId, SutProvider<OrganizationCiphersQuery> sutProvider)
|
||||
{
|
||||
var fixture = new Fixture();
|
||||
|
||||
var otherCollectionId = Guid.NewGuid();
|
||||
var targetCollectionId = Guid.NewGuid();
|
||||
|
||||
var otherCipher = fixture.Create<CipherOrganizationDetails>();
|
||||
var targetCipher = fixture.Create<CipherOrganizationDetails>();
|
||||
var bothCipher = fixture.Create<CipherOrganizationDetails>();
|
||||
var noCipher = fixture.Create<CipherOrganizationDetails>();
|
||||
|
||||
var ciphers = new List<CipherOrganizationDetails>
|
||||
{
|
||||
otherCipher, // not in the target collection
|
||||
targetCipher, // in the target collection
|
||||
bothCipher, // in both collections
|
||||
noCipher // not in any collection
|
||||
};
|
||||
ciphers.ForEach(c =>
|
||||
{
|
||||
c.OrganizationId = organizationId;
|
||||
c.UserId = null;
|
||||
});
|
||||
|
||||
var otherCollectionCipher = new CollectionCipher
|
||||
{
|
||||
CollectionId = otherCollectionId,
|
||||
CipherId = otherCipher.Id
|
||||
};
|
||||
var targetCollectionCipher = new CollectionCipher
|
||||
{
|
||||
CollectionId = targetCollectionId,
|
||||
CipherId = targetCipher.Id
|
||||
};
|
||||
var bothCollectionCipher1 = new CollectionCipher
|
||||
{
|
||||
CollectionId = targetCollectionId,
|
||||
CipherId = bothCipher.Id
|
||||
};
|
||||
var bothCollectionCipher2 = new CollectionCipher
|
||||
{
|
||||
CollectionId = otherCollectionId,
|
||||
CipherId = bothCipher.Id
|
||||
};
|
||||
|
||||
sutProvider.GetDependency<ICipherRepository>().GetManyOrganizationDetailsByOrganizationIdAsync(organizationId)
|
||||
.Returns(ciphers);
|
||||
|
||||
sutProvider.GetDependency<ICollectionCipherRepository>().GetManyByOrganizationIdAsync(organizationId).Returns(
|
||||
[
|
||||
targetCollectionCipher,
|
||||
otherCollectionCipher,
|
||||
bothCollectionCipher1,
|
||||
bothCollectionCipher2
|
||||
]);
|
||||
|
||||
var result = await sutProvider
|
||||
.Sut
|
||||
.GetOrganizationCiphersByCollectionIds(organizationId, [targetCollectionId]);
|
||||
result = result.ToList();
|
||||
|
||||
Assert.Equal(2, result.Count());
|
||||
Assert.Contains(result, c =>
|
||||
c.Id == targetCipher.Id &&
|
||||
c.CollectionIds.Count() == 1 &&
|
||||
c.CollectionIds.Any(cId => cId == targetCollectionId));
|
||||
Assert.Contains(result, c =>
|
||||
c.Id == bothCipher.Id &&
|
||||
c.CollectionIds.Count() == 2 &&
|
||||
c.CollectionIds.Any(cId => cId == targetCollectionId) &&
|
||||
c.CollectionIds.Any(cId => cId == otherCollectionId));
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user