From 8c0996efec9d1b97dd6a0fdad4bbc5c76f16108b Mon Sep 17 00:00:00 2001
From: Thomas Avery <43214426+Thomas-Avery@users.noreply.github.com>
Date: Mon, 18 Jul 2022 09:05:26 -0500
Subject: [PATCH] [SM-82] Add HttpController Attribute to protect secrets
 manager controllers during development (#2117)

* Adding development only attribute for sm API

* dotnet format changes

* Swapping attribute name to SecretsManager
---
 src/Api/Utilities/SecretsManagerAttribute.cs | 22 ++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 src/Api/Utilities/SecretsManagerAttribute.cs

diff --git a/src/Api/Utilities/SecretsManagerAttribute.cs b/src/Api/Utilities/SecretsManagerAttribute.cs
new file mode 100644
index 0000000000..44ba465861
--- /dev/null
+++ b/src/Api/Utilities/SecretsManagerAttribute.cs
@@ -0,0 +1,22 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Filters;
+
+namespace Bit.Api.Utilities
+{
+
+    [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
+    public class SecretsManagerAttribute : Attribute, IResourceFilter
+    {
+        public void OnResourceExecuting(ResourceExecutingContext context)
+        {
+            var env = context.HttpContext.RequestServices.GetService<IHostEnvironment>();
+            if (!env.IsDevelopment())
+            {
+                context.Result = new NotFoundResult();
+            }
+        }
+
+        public void OnResourceExecuted(ResourceExecutedContext context) { }
+    }
+}
+