nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-05-28 23:04:50 -05:00
Code

rework permission checks on org apis

Browse Source
This commit is contained in:
Kyle Spearrin 2017-04-06 13:21:26 -04:00
parent 1eaba7ac00
commit 8ab363cc73
1 changed files with 44 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
src/Api/Controllers/OrganizationsController.cs
View File

@ -38,12 +38,38 @@ namespace Bit.Api.Controllers
[HttpGet("{id}")] [HttpGet("{id}")]
public async Task<OrganizationResponseModel> Get(string id) public async Task<OrganizationResponseModel> Get(string id)
{ {
var organization = await _organizationRepository.GetByIdAsync(new Guid(id)); var orgIdGuid = new Guid(id);
if(organization == null || !_currentContext.OrganizationAdmin(organization.Id)) if(!_currentContext.OrganizationOwner(orgIdGuid))
{ {
throw new NotFoundException(); throw new NotFoundException();
} }
var organization = await _organizationRepository.GetByIdAsync(orgIdGuid);
if(organization == null)
{
throw new NotFoundException();
}
return new OrganizationResponseModel(organization);
}
[HttpGet("{id}/billing")]
public async Task<OrganizationResponseModel> GetBilling(string id)
{
var orgIdGuid = new Guid(id);
if(!_currentContext.OrganizationOwner(orgIdGuid))
{
throw new NotFoundException();
}
var organization = await _organizationRepository.GetByIdAsync(orgIdGuid);
if(organization == null)
{
throw new NotFoundException();
}
// TODO: billing stuff
return new OrganizationResponseModel(organization); return new OrganizationResponseModel(organization);
} }
@ -69,8 +95,14 @@ namespace Bit.Api.Controllers
[HttpPost("{id}")] [HttpPost("{id}")]
public async Task<OrganizationResponseModel> Put(string id, [FromBody]OrganizationUpdateRequestModel model) public async Task<OrganizationResponseModel> Put(string id, [FromBody]OrganizationUpdateRequestModel model)
{ {
var organization = await _organizationRepository.GetByIdAsync(new Guid(id)); var orgIdGuid = new Guid(id);
if(organization == null || !_currentContext.OrganizationAdmin(organization.Id)) if(!_currentContext.OrganizationOwner(orgIdGuid))
{
throw new NotFoundException();
}
var organization = await _organizationRepository.GetByIdAsync(orgIdGuid);
if(organization == null)
{ {
throw new NotFoundException(); throw new NotFoundException();
} }
@ -83,8 +115,14 @@ namespace Bit.Api.Controllers
[HttpPost("{id}/delete")] [HttpPost("{id}/delete")]
public async Task Delete(string id) public async Task Delete(string id)
{ {
var organization = await _organizationRepository.GetByIdAsync(new Guid(id)); var orgIdGuid = new Guid(id);
if(organization == null || !_currentContext.OrganizationAdmin(organization.Id)) if(!_currentContext.OrganizationOwner(orgIdGuid))
{
throw new NotFoundException();
}
var organization = await _organizationRepository.GetByIdAsync(orgIdGuid);
if(organization == null)
{ {
throw new NotFoundException(); throw new NotFoundException();
} }