From 72bb06a9d766a758c530cbd276cc96c71d759b23 Mon Sep 17 00:00:00 2001
From: Jared Snider <116684653+JaredSnider-Bitwarden@users.noreply.github.com>
Date: Fri, 10 Jan 2025 21:55:34 -0500
Subject: [PATCH] Auth/PM-16947 - Device Management - Adjust Device + pending
 auth request get query (#5250)

* Added userId check on query

* Added required field to inner select

* PM-16947 - Update to filter inner subquery on user id per discussion with Robert

* Updated to use new query with ROW_NUMBER

* More query optimizations to eliminate returning old requests for a device

* Fixed approval condition to be NULL as 0 means denied.

* Added negation of @ExpirationMinutes

---------

Co-authored-by: Todd Martin <tmartin@bitwarden.com>
---
 ...dActiveWithPendingAuthRequestsByUserId.sql | 25 +++++++++-------
 ...dActiveWithPendingAuthRequestsByUserId.sql | 29 +++++++++++++++++++
 2 files changed, 43 insertions(+), 11 deletions(-)
 create mode 100644 util/Migrator/DbScripts/2025-01-10_00_ReadActiveWithPendingAuthRequestsByUserId.sql

diff --git a/src/Sql/Auth/dbo/Stored Procedures/Device_ReadActiveWithPendingAuthRequestsByUserId.sql b/src/Sql/Auth/dbo/Stored Procedures/Device_ReadActiveWithPendingAuthRequestsByUserId.sql
index 015d0f7c1f..f40e9149c0 100644
--- a/src/Sql/Auth/dbo/Stored Procedures/Device_ReadActiveWithPendingAuthRequestsByUserId.sql	
+++ b/src/Sql/Auth/dbo/Stored Procedures/Device_ReadActiveWithPendingAuthRequestsByUserId.sql	
@@ -10,18 +10,21 @@ BEGIN
         AR.Id as AuthRequestId,
         AR.CreationDate as AuthRequestCreationDate
     FROM dbo.DeviceView D
-             LEFT JOIN (
-        SELECT TOP 1 -- Take only the top record sorted by auth request creation date
-                     Id,
-                     CreationDate,
-                     RequestDeviceIdentifier
+    LEFT JOIN (
+        SELECT 
+            Id,
+            CreationDate,
+            RequestDeviceIdentifier,
+            Approved,
+            ROW_NUMBER() OVER (PARTITION BY RequestDeviceIdentifier ORDER BY CreationDate DESC) as rn
         FROM dbo.AuthRequestView
-        WHERE Type IN (0, 1) -- Include only AuthenticateAndUnlock and Unlock types, excluding Admin Approval (type 2)
-          AND CreationDate >= DATEADD(MINUTE, -@ExpirationMinutes, GETUTCDATE()) -- Ensure the request hasn't expired
-          AND Approved IS NULL -- Include only requests that haven't been acknowledged or approved
-        ORDER BY CreationDate DESC
-    ) AR ON D.Identifier = AR.RequestDeviceIdentifier
+        WHERE Type IN (0, 1)  -- AuthenticateAndUnlock and Unlock types only
+            AND CreationDate >= DATEADD(MINUTE, -@ExpirationMinutes, GETUTCDATE()) -- Ensure the request hasn't expired
+            AND UserId = @UserId --  Requests for this user only
+    ) AR -- This join will get the most recent request per device, regardless of approval status 
+    ON D.Identifier = AR.RequestDeviceIdentifier AND AR.rn = 1 AND AR.Approved IS NULL  -- Get only the most recent unapproved request per device
     WHERE
-        D.UserId = @UserId
+        D.UserId = @UserId -- Include only devices for this user
       AND D.Active = 1; -- Include only active devices
 END;
+
diff --git a/util/Migrator/DbScripts/2025-01-10_00_ReadActiveWithPendingAuthRequestsByUserId.sql b/util/Migrator/DbScripts/2025-01-10_00_ReadActiveWithPendingAuthRequestsByUserId.sql
new file mode 100644
index 0000000000..10319f3207
--- /dev/null
+++ b/util/Migrator/DbScripts/2025-01-10_00_ReadActiveWithPendingAuthRequestsByUserId.sql
@@ -0,0 +1,29 @@
+CREATE OR ALTER PROCEDURE [dbo].[Device_ReadActiveWithPendingAuthRequestsByUserId]
+    @UserId UNIQUEIDENTIFIER,
+    @ExpirationMinutes INT
+AS
+BEGIN
+    SET NOCOUNT ON;
+
+    SELECT
+        D.*,
+        AR.Id as AuthRequestId,
+        AR.CreationDate as AuthRequestCreationDate
+    FROM dbo.DeviceView D
+    LEFT JOIN (
+        SELECT 
+            Id,
+            CreationDate,
+            RequestDeviceIdentifier,
+            Approved,
+            ROW_NUMBER() OVER (PARTITION BY RequestDeviceIdentifier ORDER BY CreationDate DESC) as rn
+        FROM dbo.AuthRequestView
+        WHERE Type IN (0, 1)  -- AuthenticateAndUnlock and Unlock types only
+            AND CreationDate >= DATEADD(MINUTE, -@ExpirationMinutes, GETUTCDATE()) -- Ensure the request hasn't expired
+            AND UserId = @UserId --  Requests for this user only
+    ) AR -- This join will get the most recent request per device, regardless of approval status 
+    ON D.Identifier = AR.RequestDeviceIdentifier AND AR.rn = 1 AND AR.Approved IS NULL  -- Get only the most recent unapproved request per device
+    WHERE
+        D.UserId = @UserId -- Include only devices for this user
+      AND D.Active = 1; -- Include only active devices
+END;