[SM-704] Extract Authorization For ServiceAccounts (#2869)

* Move to access query for project commands

* Swap to hasAccess method per action

* Swap to authorization handler pattern

* Move ProjectOperationRequirement to Core

* Add default throw + tests

* Extract authorization out of commands

* Unit tests for authorization handler

* Formatting

* Swap to reflection for testing switch

* Swap to check read & reflections in test

* fix wording on exception

* Refactor GetAccessClient into its own query

* Use accessClientQuery in project handler

src/Core/SecretsManager/AuthorizationRequirements/ServiceAccountOperationRequirement.cs

@@ -0,0 +1,14 @@
+using Microsoft.AspNetCore.Authorization.Infrastructure;
+
+namespace Bit.Core.SecretsManager.AuthorizationRequirements;
+
+public class ServiceAccountOperationRequirement : OperationAuthorizationRequirement
+{
+}
+
+public static class ServiceAccountOperations
+{
+    public static readonly ServiceAccountOperationRequirement Create = new() { Name = nameof(Create) };
+    public static readonly ServiceAccountOperationRequirement Read = new() { Name = nameof(Read) };
+    public static readonly ServiceAccountOperationRequirement Update = new() { Name = nameof(Update) };
+}

src/Core/SecretsManager/Commands/ServiceAccounts/Interfaces/IUpdateServiceAccountCommand.cs

@@ -4,5 +4,5 @@ namespace Bit.Core.SecretsManager.Commands.ServiceAccounts.Interfaces;
 
 public interface IUpdateServiceAccountCommand
 {
-    Task<ServiceAccount> UpdateAsync(ServiceAccount serviceAccount, Guid userId);
+    Task<ServiceAccount> UpdateAsync(ServiceAccount serviceAccount);
 }

src/Core/SecretsManager/Queries/Interfaces/IAccessClientQuery.cs

@@ -0,0 +1,9 @@
+using System.Security.Claims;
+using Bit.Core.Enums;
+
+namespace Bit.Core.SecretsManager.Queries.Interfaces;
+
+public interface IAccessClientQuery
+{
+    Task<(AccessClientType AccessClientType, Guid UserId)> GetAccessClientAsync(ClaimsPrincipal claimsPrincipal, Guid organizationId);
+}

src/Core/SecretsManager/Repositories/IServiceAccountRepository.cs

@@ -14,4 +14,5 @@ public interface IServiceAccountRepository
     Task<bool> UserHasReadAccessToServiceAccount(Guid id, Guid userId);
     Task<bool> UserHasWriteAccessToServiceAccount(Guid id, Guid userId);
     Task<IEnumerable<ServiceAccount>> GetManyByOrganizationIdWriteAccessAsync(Guid organizationId, Guid userId, AccessClientType accessType);
+    Task<(bool Read, bool Write)> AccessToServiceAccountAsync(Guid id, Guid userId, AccessClientType accessType);
 }