nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-04-05 05:00:19 -05:00
Code

Updated auth for phishing domain endpoints to either require api, or licensing claims to support both web and browser clients, and selfhost api clients

Browse Source
This commit is contained in:
Conner Turnbull 2025-03-18 08:54:09 -04:00
parent 3ae97155ab
commit 7baa788484
No known key found for this signature in database
3 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/Api/Controllers/PhishingDomainsController.cs
View File

@ -5,7 +5,7 @@ using Microsoft.AspNetCore.Mvc;
namespace Bit.Api.Controllers;
[Route("phishing-domains")]
[Authorize("Application")]
[Authorize("PhishingDomains")]
public class PhishingDomainsController(IPhishingDomainRepository phishingDomainRepository) : Controller
{
[HttpGet]

8
src/Api/Startup.cs
View File

@ -143,6 +143,14 @@ public class Startup
(c.Value.Contains(ApiScopes.Api) || c.Value.Contains(ApiScopes.ApiSecrets))
));
});
config.AddPolicy("PhishingDomains", policy =>
{
policy.RequireAuthenticatedUser();
policy.RequireAssertion(ctx =>
ctx.User.HasClaim(c => c.Type == JwtClaimTypes.Scope &&
(c.Value == ApiScopes.ApiLicensing || c.Value == ApiScopes.Api))
);
});
});
services.AddScoped<AuthenticatorTokenProvider>();

2
src/Core/PhishingDomainFeatures/CloudPhishingDomainRelayQuery.cs
View File

@ -21,7 +21,7 @@ public class CloudPhishingDomainRelayQuery : BaseIdentityClientService, ICloudPh
httpFactory,
globalSettings.Installation.ApiUri,
globalSettings.Installation.IdentityUri,
"api.installation",
"api.licensing",
$"installation.{globalSettings.Installation.Id}",
globalSettings.Installation.Key,
logger)