mirror of
https://github.com/bitwarden/server.git
synced 2025-04-04 20:50:21 -05:00
[AC-2679] Adding a revoked, invited member with Can Manage access does not resolve unmanaged collections (#4397)
* Added check for revoked users * removed check for users as any user status with can manage access should hide the add access badge * updated comments
This commit is contained in:
parent
43afcd8968
commit
c390a6b589
@ -1,5 +1,4 @@
|
||||
using Bit.Core.Enums;
|
||||
using Bit.Core.Models.Data;
|
||||
using Bit.Core.Models.Data;
|
||||
|
||||
namespace Bit.Infrastructure.EntityFramework.Repositories.Queries;
|
||||
|
||||
@ -47,11 +46,11 @@ public class CollectionAdminDetailsQuery : IQuery<CollectionAdminDetails>
|
||||
from cg in cg_g.DefaultIfEmpty()
|
||||
select new { c, cu, cg };
|
||||
|
||||
// Subqueries to determine if a colection is managed by an active user or group.
|
||||
// Subqueries to determine if a collection is managed by a user or group.
|
||||
var activeUserManageRights = from cu in dbContext.CollectionUsers
|
||||
join ou in dbContext.OrganizationUsers
|
||||
on cu.OrganizationUserId equals ou.Id
|
||||
where ou.Status == OrganizationUserStatusType.Confirmed && cu.Manage
|
||||
where cu.Manage
|
||||
select cu.CollectionId;
|
||||
|
||||
var activeGroupManageRights = from cg in dbContext.CollectionGroups
|
||||
|
@ -34,14 +34,13 @@ BEGIN
|
||||
END) AS [Assigned],
|
||||
CASE
|
||||
WHEN
|
||||
-- No active user or group has manage rights
|
||||
-- No user or group has manage rights
|
||||
NOT EXISTS(
|
||||
SELECT 1
|
||||
FROM [dbo].[CollectionUser] CU2
|
||||
JOIN [dbo].[OrganizationUser] OU2 ON CU2.[OrganizationUserId] = OU2.[Id]
|
||||
WHERE
|
||||
CU2.[CollectionId] = C.[Id] AND
|
||||
OU2.[Status] = 2 AND
|
||||
CU2.[Manage] = 1
|
||||
)
|
||||
AND NOT EXISTS (
|
||||
|
@ -34,14 +34,13 @@ BEGIN
|
||||
END) AS [Assigned],
|
||||
CASE
|
||||
WHEN
|
||||
-- No active user or group has manage rights
|
||||
-- No user or group has manage rights
|
||||
NOT EXISTS(
|
||||
SELECT 1
|
||||
FROM [dbo].[CollectionUser] CU2
|
||||
JOIN [dbo].[OrganizationUser] OU2 ON CU2.[OrganizationUserId] = OU2.[Id]
|
||||
WHERE
|
||||
CU2.[CollectionId] = C.[Id] AND
|
||||
OU2.[Status] = 2 AND
|
||||
CU2.[Manage] = 1
|
||||
)
|
||||
AND NOT EXISTS (
|
||||
|
@ -0,0 +1,169 @@
|
||||
CREATE OR ALTER PROCEDURE [dbo].[Collection_ReadByOrganizationIdWithPermissions]
|
||||
@OrganizationId UNIQUEIDENTIFIER,
|
||||
@UserId UNIQUEIDENTIFIER,
|
||||
@IncludeAccessRelationships BIT
|
||||
AS
|
||||
BEGIN
|
||||
SET NOCOUNT ON
|
||||
|
||||
SELECT
|
||||
C.*,
|
||||
MIN(CASE
|
||||
WHEN
|
||||
COALESCE(CU.[ReadOnly], CG.[ReadOnly], 0) = 0
|
||||
THEN 0
|
||||
ELSE 1
|
||||
END) AS [ReadOnly],
|
||||
MIN(CASE
|
||||
WHEN
|
||||
COALESCE(CU.[HidePasswords], CG.[HidePasswords], 0) = 0
|
||||
THEN 0
|
||||
ELSE 1
|
||||
END) AS [HidePasswords],
|
||||
MAX(CASE
|
||||
WHEN
|
||||
COALESCE(CU.[Manage], CG.[Manage], 0) = 0
|
||||
THEN 0
|
||||
ELSE 1
|
||||
END) AS [Manage],
|
||||
MAX(CASE
|
||||
WHEN
|
||||
CU.[CollectionId] IS NULL AND CG.[CollectionId] IS NULL
|
||||
THEN 0
|
||||
ELSE 1
|
||||
END) AS [Assigned],
|
||||
CASE
|
||||
WHEN
|
||||
-- No user or group has manage rights
|
||||
NOT EXISTS(
|
||||
SELECT 1
|
||||
FROM [dbo].[CollectionUser] CU2
|
||||
JOIN [dbo].[OrganizationUser] OU2 ON CU2.[OrganizationUserId] = OU2.[Id]
|
||||
WHERE
|
||||
CU2.[CollectionId] = C.[Id] AND
|
||||
CU2.[Manage] = 1
|
||||
)
|
||||
AND NOT EXISTS (
|
||||
SELECT 1
|
||||
FROM [dbo].[CollectionGroup] CG2
|
||||
WHERE
|
||||
CG2.[CollectionId] = C.[Id] AND
|
||||
CG2.[Manage] = 1
|
||||
)
|
||||
THEN 1
|
||||
ELSE 0
|
||||
END AS [Unmanaged]
|
||||
FROM
|
||||
[dbo].[CollectionView] C
|
||||
LEFT JOIN
|
||||
[dbo].[OrganizationUser] OU ON C.[OrganizationId] = OU.[OrganizationId] AND OU.[UserId] = @UserId
|
||||
LEFT JOIN
|
||||
[dbo].[CollectionUser] CU ON CU.[CollectionId] = C.[Id] AND CU.[OrganizationUserId] = [OU].[Id]
|
||||
LEFT JOIN
|
||||
[dbo].[GroupUser] GU ON CU.[CollectionId] IS NULL AND GU.[OrganizationUserId] = OU.[Id]
|
||||
LEFT JOIN
|
||||
[dbo].[Group] G ON G.[Id] = GU.[GroupId]
|
||||
LEFT JOIN
|
||||
[dbo].[CollectionGroup] CG ON CG.[CollectionId] = C.[Id] AND CG.[GroupId] = GU.[GroupId]
|
||||
WHERE
|
||||
C.[OrganizationId] = @OrganizationId
|
||||
GROUP BY
|
||||
C.[Id],
|
||||
C.[OrganizationId],
|
||||
C.[Name],
|
||||
C.[CreationDate],
|
||||
C.[RevisionDate],
|
||||
C.[ExternalId]
|
||||
|
||||
IF (@IncludeAccessRelationships = 1)
|
||||
BEGIN
|
||||
EXEC [dbo].[CollectionGroup_ReadByOrganizationId] @OrganizationId
|
||||
EXEC [dbo].[CollectionUser_ReadByOrganizationId] @OrganizationId
|
||||
END
|
||||
END
|
||||
GO
|
||||
|
||||
CREATE OR ALTER PROCEDURE [dbo].[Collection_ReadByIdWithPermissions]
|
||||
@CollectionId UNIQUEIDENTIFIER,
|
||||
@UserId UNIQUEIDENTIFIER,
|
||||
@IncludeAccessRelationships BIT
|
||||
AS
|
||||
BEGIN
|
||||
SET NOCOUNT ON
|
||||
|
||||
SELECT
|
||||
C.*,
|
||||
MIN(CASE
|
||||
WHEN
|
||||
COALESCE(CU.[ReadOnly], CG.[ReadOnly], 0) = 0
|
||||
THEN 0
|
||||
ELSE 1
|
||||
END) AS [ReadOnly],
|
||||
MIN (CASE
|
||||
WHEN
|
||||
COALESCE(CU.[HidePasswords], CG.[HidePasswords], 0) = 0
|
||||
THEN 0
|
||||
ELSE 1
|
||||
END) AS [HidePasswords],
|
||||
MAX(CASE
|
||||
WHEN
|
||||
COALESCE(CU.[Manage], CG.[Manage], 0) = 0
|
||||
THEN 0
|
||||
ELSE 1
|
||||
END) AS [Manage],
|
||||
MAX(CASE
|
||||
WHEN
|
||||
CU.[CollectionId] IS NULL AND CG.[CollectionId] IS NULL
|
||||
THEN 0
|
||||
ELSE 1
|
||||
END) AS [Assigned],
|
||||
CASE
|
||||
WHEN
|
||||
-- No user or group has manage rights
|
||||
NOT EXISTS(
|
||||
SELECT 1
|
||||
FROM [dbo].[CollectionUser] CU2
|
||||
JOIN [dbo].[OrganizationUser] OU2 ON CU2.[OrganizationUserId] = OU2.[Id]
|
||||
WHERE
|
||||
CU2.[CollectionId] = C.[Id] AND
|
||||
CU2.[Manage] = 1
|
||||
)
|
||||
AND NOT EXISTS (
|
||||
SELECT 1
|
||||
FROM [dbo].[CollectionGroup] CG2
|
||||
WHERE
|
||||
CG2.[CollectionId] = C.[Id] AND
|
||||
CG2.[Manage] = 1
|
||||
)
|
||||
THEN 1
|
||||
ELSE 0
|
||||
END AS [Unmanaged]
|
||||
FROM
|
||||
[dbo].[CollectionView] C
|
||||
LEFT JOIN
|
||||
[dbo].[OrganizationUser] OU ON C.[OrganizationId] = OU.[OrganizationId] AND OU.[UserId] = @UserId
|
||||
LEFT JOIN
|
||||
[dbo].[CollectionUser] CU ON CU.[CollectionId] = C.[Id] AND CU.[OrganizationUserId] = [OU].[Id]
|
||||
LEFT JOIN
|
||||
[dbo].[GroupUser] GU ON CU.[CollectionId] IS NULL AND GU.[OrganizationUserId] = OU.[Id]
|
||||
LEFT JOIN
|
||||
[dbo].[Group] G ON G.[Id] = GU.[GroupId]
|
||||
LEFT JOIN
|
||||
[dbo].[CollectionGroup] CG ON CG.[CollectionId] = C.[Id] AND CG.[GroupId] = GU.[GroupId]
|
||||
WHERE
|
||||
C.[Id] = @CollectionId
|
||||
GROUP BY
|
||||
C.[Id],
|
||||
C.[OrganizationId],
|
||||
C.[Name],
|
||||
C.[CreationDate],
|
||||
C.[RevisionDate],
|
||||
C.[ExternalId]
|
||||
|
||||
IF (@IncludeAccessRelationships = 1)
|
||||
BEGIN
|
||||
EXEC [dbo].[CollectionGroup_ReadByCollectionId] @CollectionId
|
||||
EXEC [dbo].[CollectionUser_ReadByCollectionId] @CollectionId
|
||||
END
|
||||
END
|
||||
GO
|
Loading…
x
Reference in New Issue
Block a user