nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-05-20 11:04:31 -05:00
Code

Resolved an issue where the API required users to be organization owners when accessing the members page (#4534)

Browse Source
This commit is contained in:
Conner Turnbull 2024-07-19 10:24:48 -04:00 committed by GitHub
parent 81477303e3
commit 9b9f202f79
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
4 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/Api/Billing/Controllers/OrganizationBillingController.cs
View File

@ -20,7 +20,7 @@ public class OrganizationBillingController(
[HttpGet("metadata")] [HttpGet("metadata")]
public async Task<IResult> GetMetadataAsync([FromRoute] Guid organizationId) public async Task<IResult> GetMetadataAsync([FromRoute] Guid organizationId)
{ {
if (!await currentContext.ViewBillingHistory(organizationId)) if (!await currentContext.AccessMembersTab(organizationId))
{ {
return TypedResults.Unauthorized(); return TypedResults.Unauthorized();
} }

5
src/Core/Context/CurrentContext.cs
View File

@ -383,6 +383,11 @@ public class CurrentContext : ICurrentContext
return await EditSubscription(orgId); return await EditSubscription(orgId);
} }
public async Task<bool> AccessMembersTab(Guid orgId)
{
return await OrganizationAdmin(orgId) || await ManageUsers(orgId) || await ManageResetPassword(orgId);
}
public bool ProviderProviderAdmin(Guid providerId) public bool ProviderProviderAdmin(Guid providerId)
{ {
return Providers?.Any(o => o.Id == providerId && o.Type == ProviderUserType.ProviderAdmin) ?? false; return Providers?.Any(o => o.Id == providerId && o.Type == ProviderUserType.ProviderAdmin) ?? false;

1
src/Core/Context/ICurrentContext.cs
View File

@ -48,6 +48,7 @@ public interface ICurrentContext
Task<bool> ManagePolicies(Guid orgId); Task<bool> ManagePolicies(Guid orgId);
Task<bool> ManageSso(Guid orgId); Task<bool> ManageSso(Guid orgId);
Task<bool> ManageUsers(Guid orgId); Task<bool> ManageUsers(Guid orgId);
Task<bool> AccessMembersTab(Guid orgId);
Task<bool> ManageScim(Guid orgId); Task<bool> ManageScim(Guid orgId);
Task<bool> ManageResetPassword(Guid orgId); Task<bool> ManageResetPassword(Guid orgId);
Task<bool> ViewSubscription(Guid orgId); Task<bool> ViewSubscription(Guid orgId);

6
test/Api.Test/Billing/Controllers/OrganizationBillingControllerTests.cs
View File

@ -23,7 +23,7 @@ public class OrganizationBillingControllerTests
Guid organizationId, Guid organizationId,
SutProvider<OrganizationBillingController> sutProvider) SutProvider<OrganizationBillingController> sutProvider)
{ {
sutProvider.GetDependency<ICurrentContext>().ViewBillingHistory(organizationId).Returns(false); sutProvider.GetDependency<ICurrentContext>().AccessMembersTab(organizationId).Returns(false);
var result = await sutProvider.Sut.GetMetadataAsync(organizationId); var result = await sutProvider.Sut.GetMetadataAsync(organizationId);
@ -35,7 +35,7 @@ public class OrganizationBillingControllerTests
Guid organizationId, Guid organizationId,
SutProvider<OrganizationBillingController> sutProvider) SutProvider<OrganizationBillingController> sutProvider)
{ {
sutProvider.GetDependency<ICurrentContext>().ViewBillingHistory(organizationId).Returns(true); sutProvider.GetDependency<ICurrentContext>().AccessMembersTab(organizationId).Returns(true);
sutProvider.GetDependency<IOrganizationBillingService>().GetMetadata(organizationId).Returns((OrganizationMetadataDTO)null); sutProvider.GetDependency<IOrganizationBillingService>().GetMetadata(organizationId).Returns((OrganizationMetadataDTO)null);
var result = await sutProvider.Sut.GetMetadataAsync(organizationId); var result = await sutProvider.Sut.GetMetadataAsync(organizationId);
@ -48,7 +48,7 @@ public class OrganizationBillingControllerTests
Guid organizationId, Guid organizationId,
SutProvider<OrganizationBillingController> sutProvider) SutProvider<OrganizationBillingController> sutProvider)
{ {
sutProvider.GetDependency<ICurrentContext>().ViewBillingHistory(organizationId).Returns(true); sutProvider.GetDependency<ICurrentContext>().AccessMembersTab(organizationId).Returns(true);
sutProvider.GetDependency<IOrganizationBillingService>().GetMetadata(organizationId) sutProvider.GetDependency<IOrganizationBillingService>().GetMetadata(organizationId)
.Returns(new OrganizationMetadataDTO(true)); .Returns(new OrganizationMetadataDTO(true));