1
0
mirror of https://github.com/bitwarden/server.git synced 2025-06-30 07:36:14 -05:00

[PM-19585] Use Authorize attributes for simple role authorization (#5555)

- Add Authorize<T> attribute
- Add IOrganizationRequirement and example implementation
- Add OrganizationRequirementHandler
- Add extension methods (replacing ICurrentContext)
- Move custom permissions claim definitions

---
Co-authored-by: Justin Baur <19896123+justindbaur@users.noreply.github.com>
Co-authored-by:  Audrey  <ajensen@bitwarden.com>
This commit is contained in:
Thomas Rittson
2025-04-15 14:36:00 +10:00
committed by GitHub
parent c9a42d861c
commit 84a984a9e6
16 changed files with 590 additions and 16 deletions

View File

@ -0,0 +1,60 @@
using System.Security.Claims;
using Bit.Api.AdminConsole.Authorization;
using Bit.Core.Context;
using Bit.Core.Entities;
using Bit.Core.Enums;
using Bit.Core.Test.AdminConsole.Helpers;
using Bit.Core.Utilities;
using Bit.Test.Common.AutoFixture.Attributes;
using Bit.Test.Common.Helpers;
using Xunit;
namespace Bit.Api.Test.AdminConsole.Authorization;
public class OrganizationClaimsExtensionsTests
{
[Theory, BitMemberAutoData(nameof(GetTestOrganizations))]
public void GetCurrentContextOrganization_ParsesOrganizationFromClaims(CurrentContextOrganization expected, User user)
{
var claims = CoreHelpers.BuildIdentityClaims(user, [expected], [], false)
.Select(c => new Claim(c.Key, c.Value));
var claimsPrincipal = new ClaimsPrincipal();
claimsPrincipal.AddIdentities([new ClaimsIdentity(claims)]);
var actual = claimsPrincipal.GetCurrentContextOrganization(expected.Id);
AssertHelper.AssertPropertyEqual(expected, actual);
}
public static IEnumerable<object[]> GetTestOrganizations()
{
var roles = new List<OrganizationUserType> { OrganizationUserType.Owner, OrganizationUserType.Admin, OrganizationUserType.User };
foreach (var role in roles)
{
yield return
[
new CurrentContextOrganization
{
Id = Guid.NewGuid(),
Type = role,
AccessSecretsManager = true
}
];
}
var permissions = PermissionsHelpers.GetAllPermissions();
foreach (var permission in permissions)
{
yield return
[
new CurrentContextOrganization
{
Id = Guid.NewGuid(),
Type = OrganizationUserType.Custom,
Permissions = permission
}
];
}
}
}