[SM-429] Add permission checks to access policy endpoints (#2628)

* Add permission checks to access policy endpoints

* Fix unit tests

* Add service account grant permission checks

* Add service account grant tests

* Add new endpoint unit tests

* Cleanup unit tests add integration tests

* User permission enum in create tests

* Swap to NotFoundException for access checks

* Add filter for potential grantees

* Add in AccessSecretsManager check and test it

* Add code review updates

* Code review updates

* Refactor potential grantees endpoint

* Code review updates

src/Core/SecretsManager/Commands/AccessPolicies/Interfaces/ICreateAccessPoliciesCommand.cs

@@ -4,5 +4,5 @@ namespace Bit.Core.SecretsManager.Commands.AccessPolicies.Interfaces;
 
 public interface ICreateAccessPoliciesCommand
 {
-    Task<List<BaseAccessPolicy>> CreateAsync(List<BaseAccessPolicy> accessPolicies);
+    Task<IEnumerable<BaseAccessPolicy>> CreateForProjectAsync(Guid projectId, List<BaseAccessPolicy> accessPolicies, Guid userId);
 }

src/Core/SecretsManager/Commands/AccessPolicies/Interfaces/IDeleteAccessPolicyCommand.cs

@@ -2,5 +2,5 @@
 
 public interface IDeleteAccessPolicyCommand
 {
-    Task DeleteAsync(Guid id);
+    Task DeleteAsync(Guid id, Guid userId);
 }

src/Core/SecretsManager/Commands/AccessPolicies/Interfaces/IUpdateAccessPolicyCommand.cs

@@ -4,5 +4,5 @@ namespace Bit.Core.SecretsManager.Commands.AccessPolicies.Interfaces;
 
 public interface IUpdateAccessPolicyCommand
 {
-    public Task<BaseAccessPolicy> UpdateAsync(Guid id, bool read, bool write);
+    public Task<BaseAccessPolicy> UpdateAsync(Guid id, bool read, bool write, Guid userId);
 }

src/Core/SecretsManager/Entities/AccessPolicy.cs

@@ -24,34 +24,39 @@ public abstract class BaseAccessPolicy
 public class UserProjectAccessPolicy : BaseAccessPolicy
 {
     public Guid? OrganizationUserId { get; set; }
-    public Guid? GrantedProjectId { get; set; }
     public User? User { get; set; }
+    public Guid? GrantedProjectId { get; set; }
+    public Project? GrantedProject { get; set; }
 }
 
 public class UserServiceAccountAccessPolicy : BaseAccessPolicy
 {
     public Guid? OrganizationUserId { get; set; }
-    public Guid? GrantedServiceAccountId { get; set; }
     public User? User { get; set; }
+    public Guid? GrantedServiceAccountId { get; set; }
+    public ServiceAccount? GrantedServiceAccount { get; set; }
 }
 
 public class GroupProjectAccessPolicy : BaseAccessPolicy
 {
     public Guid? GroupId { get; set; }
-    public Guid? GrantedProjectId { get; set; }
     public Group? Group { get; set; }
+    public Guid? GrantedProjectId { get; set; }
+    public Project? GrantedProject { get; set; }
 }
 
 public class GroupServiceAccountAccessPolicy : BaseAccessPolicy
 {
     public Guid? GroupId { get; set; }
-    public Guid? GrantedServiceAccountId { get; set; }
     public Group? Group { get; set; }
+    public Guid? GrantedServiceAccountId { get; set; }
+    public ServiceAccount? GrantedServiceAccount { get; set; }
 }
 
 public class ServiceAccountProjectAccessPolicy : BaseAccessPolicy
 {
     public Guid? ServiceAccountId { get; set; }
-    public Guid? GrantedProjectId { get; set; }
     public ServiceAccount? ServiceAccount { get; set; }
+    public Guid? GrantedProjectId { get; set; }
+    public Project? GrantedProject { get; set; }
 }

src/Core/SecretsManager/Repositories/IServiceAccountRepository.cs

@@ -11,4 +11,5 @@ public interface IServiceAccountRepository
     Task ReplaceAsync(ServiceAccount serviceAccount);
     Task<bool> UserHasReadAccessToServiceAccount(Guid id, Guid userId);
     Task<bool> UserHasWriteAccessToServiceAccount(Guid id, Guid userId);
+    Task<IEnumerable<ServiceAccount>> GetManyByOrganizationIdWriteAccessAsync(Guid organizationId, Guid userId, AccessClientType accessType);
 }