[SM-495] Access Policies - Individual Service Account - Project Tab (#2697)

* New endpoints to support sa projects tab

* Refactor create; Add tests

* Add creation request limit

test/Api.IntegrationTest/SecretsManager/Controllers/AccessPoliciesControllerTest.cs

@@ -157,7 +157,7 @@ public class AccessPoliciesControllerTest : IClassFixture<ApiApplicationFactory>
     {
         // Create a new account as a user
         var (org, _) = await _organizationHelper.Initialize(true, true);
-        var (email, orgUser) = await _organizationHelper.CreateNewUser(OrganizationUserType.User, true);
+        var (email, _) = await _organizationHelper.CreateNewUser(OrganizationUserType.User, true);
         await LoginAsync(email);
 
         var project = await _projectRepository.CreateAsync(new Project
@@ -207,7 +207,7 @@ public class AccessPoliciesControllerTest : IClassFixture<ApiApplicationFactory>
     public async Task UpdateAccessPolicy_NoPermission()
     {
         // Create a new account as a user
-        var (org, _) = await _organizationHelper.Initialize(true, true);
+        await _organizationHelper.Initialize(true, true);
         var (email, orgUser) = await _organizationHelper.CreateNewUser(OrganizationUserType.User, true);
         await LoginAsync(email);
 
@@ -284,7 +284,7 @@ public class AccessPoliciesControllerTest : IClassFixture<ApiApplicationFactory>
     public async Task DeleteAccessPolicy_NoPermission()
     {
         // Create a new account as a user
-        var (org, _) = await _organizationHelper.Initialize(true, true);
+        await _organizationHelper.Initialize(true, true);
         var (email, orgUser) = await _organizationHelper.CreateNewUser(OrganizationUserType.User, true);
         await LoginAsync(email);
 
@@ -344,8 +344,8 @@ public class AccessPoliciesControllerTest : IClassFixture<ApiApplicationFactory>
 
         Assert.NotNull(result);
         Assert.Empty(result!.UserAccessPolicies);
-        Assert.Empty(result!.GroupAccessPolicies);
-        Assert.Empty(result!.ServiceAccountAccessPolicies);
+        Assert.Empty(result.GroupAccessPolicies);
+        Assert.Empty(result.ServiceAccountAccessPolicies);
     }
 
     [Theory]
@@ -356,6 +356,7 @@ public class AccessPoliciesControllerTest : IClassFixture<ApiApplicationFactory>
     {
         var (org, _) = await _organizationHelper.Initialize(useSecrets, accessSecrets);
         await LoginAsync(_email);
+
         var initData = await SetupAccessPolicyRequest(org.Id);
 
         var response = await _client.GetAsync($"/projects/{initData.ProjectId}/access-policies");
@@ -366,7 +367,7 @@ public class AccessPoliciesControllerTest : IClassFixture<ApiApplicationFactory>
     public async Task GetProjectAccessPolicies_NoPermission()
     {
         // Create a new account as a user
-        var (org, _) = await _organizationHelper.Initialize(true, true);
+        await _organizationHelper.Initialize(true, true);
         var (email, orgUser) = await _organizationHelper.CreateNewUser(OrganizationUserType.User, true);
         await LoginAsync(email);
 
@@ -434,7 +435,7 @@ public class AccessPoliciesControllerTest : IClassFixture<ApiApplicationFactory>
 
         if (permissionType == PermissionType.RunAsUserWithPermission)
         {
-            var (email, orgUser) = await _organizationHelper.CreateNewUser(OrganizationUserType.User, true);
+            var (email, _) = await _organizationHelper.CreateNewUser(OrganizationUserType.User, true);
             await LoginAsync(email);
         }
 
@@ -469,10 +470,10 @@ public class AccessPoliciesControllerTest : IClassFixture<ApiApplicationFactory>
     {
         // Create a new account as a user
         var (org, _) = await _organizationHelper.Initialize(true, true);
-        var (email, orgUser) = await _organizationHelper.CreateNewUser(OrganizationUserType.User, true);
+        var (email, _) = await _organizationHelper.CreateNewUser(OrganizationUserType.User, true);
         await LoginAsync(email);
 
-        var serviceAccount = await _serviceAccountRepository.CreateAsync(new ServiceAccount
+        await _serviceAccountRepository.CreateAsync(new ServiceAccount
         {
             OrganizationId = org.Id,
             Name = _mockEncryptedString,
@@ -531,7 +532,85 @@ public class AccessPoliciesControllerTest : IClassFixture<ApiApplicationFactory>
 
         Assert.NotNull(result?.Data);
         Assert.NotEmpty(result!.Data);
-        Assert.Equal(serviceAccount.Id.ToString(), result!.Data.First(x => x.Id == serviceAccount.Id.ToString()).Id);
+        Assert.Equal(serviceAccount.Id.ToString(), result.Data.First(x => x.Id == serviceAccount.Id.ToString()).Id);
+    }
+
+    [Theory]
+    [InlineData(false, false)]
+    [InlineData(true, false)]
+    [InlineData(false, true)]
+    public async Task GetProjectPotentialGrantees_SmNotEnabled_NotFound(bool useSecrets, bool accessSecrets)
+    {
+        var (org, _) = await _organizationHelper.Initialize(useSecrets, accessSecrets);
+        await LoginAsync(_email);
+
+        var response =
+            await _client.GetAsync(
+                $"/organizations/{org.Id}/access-policies/projects/potential-grantees");
+        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task GetProjectPotentialGrantees_OnlyReturnsProjectsWithWriteAccess()
+    {
+        // Create a new account as a user
+        var (org, _) = await _organizationHelper.Initialize(true, true);
+        var (email, _) = await _organizationHelper.CreateNewUser(OrganizationUserType.User, true);
+        await LoginAsync(email);
+
+        await _projectRepository.CreateAsync(new Project { OrganizationId = org.Id, Name = _mockEncryptedString });
+
+
+        var response =
+            await _client.GetAsync(
+                $"/organizations/{org.Id}/access-policies/projects/potential-grantees");
+        response.EnsureSuccessStatusCode();
+
+        var result = await response.Content.ReadFromJsonAsync<ListResponseModel<PotentialGranteeResponseModel>>();
+
+        Assert.NotNull(result?.Data);
+        Assert.Empty(result!.Data);
+    }
+
+    [Theory]
+    [InlineData(PermissionType.RunAsAdmin)]
+    [InlineData(PermissionType.RunAsUserWithPermission)]
+    public async Task GetProjectPotentialGrantees_Success(PermissionType permissionType)
+    {
+        var (org, _) = await _organizationHelper.Initialize(true, true);
+        await LoginAsync(_email);
+
+        var project = await _projectRepository.CreateAsync(new Project
+        {
+            OrganizationId = org.Id,
+            Name = _mockEncryptedString,
+        });
+
+        if (permissionType == PermissionType.RunAsUserWithPermission)
+        {
+            var (email, orgUser) = await _organizationHelper.CreateNewUser(OrganizationUserType.User, true);
+            await LoginAsync(email);
+
+            await _accessPolicyRepository.CreateManyAsync(
+                new List<BaseAccessPolicy>
+                {
+                    new UserProjectAccessPolicy
+                    {
+                        GrantedProjectId = project.Id, OrganizationUserId = orgUser.Id, Read = true, Write = true,
+                    },
+                });
+        }
+
+        var response =
+            await _client.GetAsync(
+                $"/organizations/{org.Id}/access-policies/projects/potential-grantees");
+        response.EnsureSuccessStatusCode();
+
+        var result = await response.Content.ReadFromJsonAsync<ListResponseModel<PotentialGranteeResponseModel>>();
+
+        Assert.NotNull(result?.Data);
+        Assert.NotEmpty(result!.Data);
+        Assert.Equal(project.Id.ToString(), result.Data.First(x => x.Id == project.Id.ToString()).Id);
     }
 
     [Theory]
@@ -696,14 +775,14 @@ public class AccessPoliciesControllerTest : IClassFixture<ApiApplicationFactory>
 
         Assert.NotNull(result);
         Assert.Empty(result!.UserAccessPolicies);
-        Assert.Empty(result!.GroupAccessPolicies);
+        Assert.Empty(result.GroupAccessPolicies);
     }
 
     [Fact]
     public async Task GetServiceAccountAccessPolicies_NoPermission()
     {
         // Create a new account as a user
-        var (org, _) = await _organizationHelper.Initialize(true, true);
+        await _organizationHelper.Initialize(true, true);
         var (email, orgUser) = await _organizationHelper.CreateNewUser(OrganizationUserType.User, true);
         await LoginAsync(email);
 
@@ -763,6 +842,208 @@ public class AccessPoliciesControllerTest : IClassFixture<ApiApplicationFactory>
             result.UserAccessPolicies.First(x => x.OrganizationUserId == owerOrgUser.Id).OrganizationUserId);
     }
 
+    [Theory]
+    [InlineData(false, false)]
+    [InlineData(true, false)]
+    [InlineData(false, true)]
+    public async Task CreateServiceAccountGrantedPolicies_SmNotEnabled_NotFound(bool useSecrets, bool accessSecrets)
+    {
+        var (org, _) = await _organizationHelper.Initialize(useSecrets, accessSecrets);
+        await LoginAsync(_email);
+
+        var serviceAccount = await _serviceAccountRepository.CreateAsync(new ServiceAccount
+        {
+            OrganizationId = org.Id,
+            Name = _mockEncryptedString,
+        });
+
+        var request = new List<GrantedAccessPolicyRequest> { new() { GrantedId = new Guid() } };
+
+        var response =
+            await _client.PostAsJsonAsync($"/service-accounts/{serviceAccount.Id}/granted-policies", request);
+        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
+    }
+
+    [Theory]
+    [InlineData(PermissionType.RunAsAdmin)]
+    [InlineData(PermissionType.RunAsUserWithPermission)]
+    public async Task CreateServiceAccountGrantedPolicies(PermissionType permissionType)
+    {
+        var (org, orgUser) = await _organizationHelper.Initialize(true, true);
+        await LoginAsync(_email);
+        var ownerOrgUserId = orgUser.Id;
+
+        var serviceAccount = await _serviceAccountRepository.CreateAsync(new ServiceAccount
+        {
+            OrganizationId = org.Id,
+            Name = _mockEncryptedString,
+        });
+
+        var project = await _projectRepository.CreateAsync(new Project
+        {
+            OrganizationId = org.Id,
+            Name = _mockEncryptedString,
+        });
+
+        var request =
+            new List<GrantedAccessPolicyRequest> { new() { GrantedId = project.Id, Read = true, Write = true } };
+
+
+        if (permissionType == PermissionType.RunAsUserWithPermission)
+        {
+            var (email, newOrgUser) = await _organizationHelper.CreateNewUser(OrganizationUserType.User, true);
+            await LoginAsync(email);
+            var accessPolicies = new List<BaseAccessPolicy>
+            {
+                new UserProjectAccessPolicy
+                {
+                    GrantedProjectId = project.Id, OrganizationUserId = newOrgUser.Id, Read = true, Write = true,
+                },
+            };
+            await _accessPolicyRepository.CreateManyAsync(accessPolicies);
+        }
+
+
+        var response =
+            await _client.PostAsJsonAsync($"/service-accounts/{serviceAccount.Id}/granted-policies", request);
+        response.EnsureSuccessStatusCode();
+
+        var result = await response.Content
+            .ReadFromJsonAsync<ListResponseModel<ServiceAccountProjectAccessPolicyResponseModel>>();
+
+        Assert.NotNull(result);
+        Assert.NotEmpty(result!.Data);
+        Assert.Equal(project.Id, result.Data.First().GrantedProjectId);
+
+        var createdAccessPolicy =
+            await _accessPolicyRepository.GetByIdAsync(result.Data.First().Id);
+        Assert.NotNull(createdAccessPolicy);
+        Assert.Equal(result.Data.First().Read, createdAccessPolicy!.Read);
+        Assert.Equal(result.Data.First().Write, createdAccessPolicy.Write);
+        Assert.Equal(result.Data.First().Id, createdAccessPolicy.Id);
+        AssertHelper.AssertRecent(createdAccessPolicy.CreationDate);
+        AssertHelper.AssertRecent(createdAccessPolicy.RevisionDate);
+    }
+
+    [Fact]
+    public async Task CreateServiceAccountGrantedPolicies_NoPermission()
+    {
+        // Create a new account as a user
+        var (org, _) = await _organizationHelper.Initialize(true, true);
+        var (email, _) = await _organizationHelper.CreateNewUser(OrganizationUserType.User, true);
+        await LoginAsync(email);
+
+        var serviceAccount = await _serviceAccountRepository.CreateAsync(new ServiceAccount
+        {
+            OrganizationId = org.Id,
+            Name = _mockEncryptedString,
+        });
+
+        var project = await _projectRepository.CreateAsync(new Project
+        {
+            OrganizationId = org.Id,
+            Name = _mockEncryptedString,
+        });
+
+        var request =
+            new List<GrantedAccessPolicyRequest> { new() { GrantedId = project.Id, Read = true, Write = true } };
+
+        var response =
+            await _client.PostAsJsonAsync($"/service-accounts/{serviceAccount.Id}/granted-policies", request);
+        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
+    }
+
+    [Theory]
+    [InlineData(false, false)]
+    [InlineData(true, false)]
+    [InlineData(false, true)]
+    public async Task GetServiceAccountGrantedPolicies_SmNotEnabled_NotFound(bool useSecrets, bool accessSecrets)
+    {
+        var (org, _) = await _organizationHelper.Initialize(useSecrets, accessSecrets);
+        await LoginAsync(_email);
+        var initData = await SetupAccessPolicyRequest(org.Id);
+
+        var response = await _client.GetAsync($"/service-accounts/{initData.ServiceAccountId}/granted-policies");
+        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task GetServiceAccountGrantedPolicies_ReturnsEmpty()
+    {
+        var (org, _) = await _organizationHelper.Initialize(true, true);
+        await LoginAsync(_email);
+
+        var serviceAccount = await _serviceAccountRepository.CreateAsync(new ServiceAccount
+        {
+            OrganizationId = org.Id,
+            Name = _mockEncryptedString,
+        });
+
+        var response = await _client.GetAsync($"/service-accounts/{serviceAccount.Id}/granted-policies");
+        response.EnsureSuccessStatusCode();
+
+        var result = await response.Content
+            .ReadFromJsonAsync<ListResponseModel<ServiceAccountProjectAccessPolicyResponseModel>>();
+
+        Assert.NotNull(result);
+        Assert.Empty(result!.Data);
+    }
+
+    [Fact]
+    public async Task GetServiceAccountGrantedPolicies_NoPermission_ReturnsEmpty()
+    {
+        // Create a new account as a user
+        await _organizationHelper.Initialize(true, true);
+        var (email, orgUser) = await _organizationHelper.CreateNewUser(OrganizationUserType.User, true);
+        await LoginAsync(email);
+
+        var initData = await SetupAccessPolicyRequest(orgUser.OrganizationId);
+
+        var response = await _client.GetAsync($"/service-accounts/{initData.ServiceAccountId}/granted-policies");
+
+        var result = await response.Content
+            .ReadFromJsonAsync<ListResponseModel<ServiceAccountProjectAccessPolicyResponseModel>>();
+
+        Assert.NotNull(result);
+        Assert.Empty(result!.Data);
+    }
+
+    [Theory]
+    [InlineData(PermissionType.RunAsAdmin)]
+    [InlineData(PermissionType.RunAsUserWithPermission)]
+    public async Task GetServiceAccountGrantedPolicies(PermissionType permissionType)
+    {
+        var (org, _) = await _organizationHelper.Initialize(true, true);
+        await LoginAsync(_email);
+        var initData = await SetupAccessPolicyRequest(org.Id);
+
+        if (permissionType == PermissionType.RunAsUserWithPermission)
+        {
+            var (email, orgUser) = await _organizationHelper.CreateNewUser(OrganizationUserType.User, true);
+            await LoginAsync(email);
+            var accessPolicies = new List<BaseAccessPolicy>
+            {
+                new UserProjectAccessPolicy
+                {
+                    GrantedProjectId = initData.ProjectId, OrganizationUserId = orgUser.Id, Read = true, Write = true,
+                },
+            };
+            await _accessPolicyRepository.CreateManyAsync(accessPolicies);
+        }
+
+        var response = await _client.GetAsync($"/service-accounts/{initData.ServiceAccountId}/granted-policies");
+        response.EnsureSuccessStatusCode();
+
+        var result = await response.Content
+            .ReadFromJsonAsync<ListResponseModel<ServiceAccountProjectAccessPolicyResponseModel>>();
+
+        Assert.NotNull(result?.Data);
+        Assert.NotEmpty(result!.Data);
+        Assert.Equal(initData.ServiceAccountId, result.Data.First().ServiceAccountId);
+        Assert.NotNull(result.Data.First().ServiceAccountName);
+        Assert.NotNull(result.Data.First().GrantedProjectName);
+    }
+
     private async Task<RequestSetupData> SetupAccessPolicyRequest(Guid organizationId)
     {
         var project = await _projectRepository.CreateAsync(new Project

test/Api.Test/SecretsManager/Controllers/AccessPoliciesControllerTests.cs

@@ -26,6 +26,30 @@ namespace Bit.Api.Test.SecretsManager.Controllers;
 [JsonDocumentCustomize]
 public class AccessPoliciesControllerTests
 {
+    private const int _overMax = 16;
+
+    private static AccessPoliciesCreateRequest AddRequestsOverMax(AccessPoliciesCreateRequest request)
+    {
+        var newRequests = new List<AccessPolicyRequest>();
+        for (var i = 0; i < _overMax; i++)
+        {
+            newRequests.Add(new AccessPolicyRequest { GranteeId = new Guid(), Read = true, Write = true });
+        }
+
+        request.UserAccessPolicyRequests = newRequests;
+        return request;
+    }
+
+    private static List<GrantedAccessPolicyRequest> AddRequestsOverMax(List<GrantedAccessPolicyRequest> request)
+    {
+        for (var i = 0; i < _overMax; i++)
+        {
+            request.Add(new GrantedAccessPolicyRequest { GrantedId = new Guid() });
+        }
+
+        return request;
+    }
+
     private static void SetupAdmin(SutProvider<AccessPoliciesController> sutProvider, Guid organizationId)
     {
         sutProvider.GetDependency<ICurrentContext>().AccessSecretsManager(default).ReturnsForAnyArgs(true);
@@ -50,7 +74,8 @@ public class AccessPoliciesControllerTests
         sutProvider.GetDependency<ICurrentContext>().OrganizationUser(default).ReturnsForAnyArgs(true);
     }
 
-    private static void SetupPermission(SutProvider<AccessPoliciesController> sutProvider, PermissionType permissionType, Guid orgId)
+    private static void SetupPermission(SutProvider<AccessPoliciesController> sutProvider,
+        PermissionType permissionType, Guid orgId)
     {
         switch (permissionType)
         {
@@ -61,7 +86,6 @@ public class AccessPoliciesControllerTests
                 SetupUserWithPermission(sutProvider, orgId);
                 break;
         }
-
     }
 
     [Theory]
@@ -280,22 +304,139 @@ public class AccessPoliciesControllerTests
             .GetManyByGrantedServiceAccountIdAsync(Arg.Any<Guid>());
     }
 
+    [Theory]
+    [BitAutoData(PermissionType.RunAsAdmin)]
+    [BitAutoData(PermissionType.RunAsUserWithPermission)]
+    public async void GetServiceAccountGrantedPolicies_ReturnsEmptyList(
+        PermissionType permissionType,
+        SutProvider<AccessPoliciesController> sutProvider,
+        Guid id, ServiceAccount data)
+    {
+        sutProvider.GetDependency<IServiceAccountRepository>().GetByIdAsync(data.Id).ReturnsForAnyArgs(data);
+
+        switch (permissionType)
+        {
+            case PermissionType.RunAsAdmin:
+                SetupAdmin(sutProvider, data.OrganizationId);
+                break;
+            case PermissionType.RunAsUserWithPermission:
+                SetupUserWithPermission(sutProvider, data.OrganizationId);
+                sutProvider.GetDependency<IServiceAccountRepository>()
+                    .UserHasWriteAccessToServiceAccount(default, default)
+                    .ReturnsForAnyArgs(true);
+                break;
+        }
+
+        var result = await sutProvider.Sut.GetServiceAccountGrantedPoliciesAsync(id);
+
+        await sutProvider.GetDependency<IAccessPolicyRepository>().Received(1)
+            .GetManyByServiceAccountIdAsync(Arg.Is(AssertHelper.AssertPropertyEqual(id)), Arg.Any<Guid>(),
+                Arg.Any<AccessClientType>());
+
+        Assert.Empty(result.Data);
+    }
+
+    [Theory]
+    [BitAutoData(PermissionType.RunAsAdmin)]
+    [BitAutoData(PermissionType.RunAsUserWithPermission)]
+    public async void GetServiceAccountGrantedPolicies_Success(
+        PermissionType permissionType,
+        SutProvider<AccessPoliciesController> sutProvider,
+        Guid id,
+        ServiceAccount data,
+        ServiceAccountProjectAccessPolicy resultAccessPolicy)
+    {
+        sutProvider.GetDependency<IServiceAccountRepository>().GetByIdAsync(default).ReturnsForAnyArgs(data);
+        switch (permissionType)
+        {
+            case PermissionType.RunAsAdmin:
+                SetupAdmin(sutProvider, data.OrganizationId);
+                break;
+            case PermissionType.RunAsUserWithPermission:
+                SetupUserWithPermission(sutProvider, data.OrganizationId);
+                break;
+        }
+
+        sutProvider.GetDependency<IAccessPolicyRepository>().GetManyByServiceAccountIdAsync(default, default, default)
+            .ReturnsForAnyArgs(new List<BaseAccessPolicy> { resultAccessPolicy });
+
+        var result = await sutProvider.Sut.GetServiceAccountGrantedPoliciesAsync(id);
+
+        await sutProvider.GetDependency<IAccessPolicyRepository>().Received(1)
+            .GetManyByServiceAccountIdAsync(Arg.Is(AssertHelper.AssertPropertyEqual(id)), Arg.Any<Guid>(),
+                Arg.Any<AccessClientType>());
+
+        Assert.NotEmpty(result.Data);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async void CreateProjectAccessPolicies_RequestMoreThanMax_Throws(
+        SutProvider<AccessPoliciesController> sutProvider,
+        Guid id,
+        Project mockProject,
+        UserProjectAccessPolicy data,
+        AccessPoliciesCreateRequest request)
+    {
+        sutProvider.GetDependency<IProjectRepository>().GetByIdAsync(default).ReturnsForAnyArgs(mockProject);
+        sutProvider.GetDependency<ICurrentContext>().AccessSecretsManager(default).ReturnsForAnyArgs(true);
+        sutProvider.GetDependency<IUserService>().GetProperUserId(default).ReturnsForAnyArgs(Guid.NewGuid());
+        sutProvider.GetDependency<ICreateAccessPoliciesCommand>().CreateManyAsync(default, default, default)
+            .ReturnsForAnyArgs(new List<BaseAccessPolicy> { data });
+
+        request = AddRequestsOverMax(request);
+
+        await Assert.ThrowsAsync<BadRequestException>(() =>
+            sutProvider.Sut.CreateProjectAccessPoliciesAsync(id, request));
+
+        await sutProvider.GetDependency<ICreateAccessPoliciesCommand>().DidNotReceiveWithAnyArgs()
+            .CreateManyAsync(Arg.Any<List<BaseAccessPolicy>>(), Arg.Any<Guid>(), Arg.Any<AccessClientType>());
+    }
+
     [Theory]
     [BitAutoData]
     public async void CreateProjectAccessPolicies_Success(
         SutProvider<AccessPoliciesController> sutProvider,
         Guid id,
+        Project mockProject,
         UserProjectAccessPolicy data,
         AccessPoliciesCreateRequest request)
     {
+        sutProvider.GetDependency<IProjectRepository>().GetByIdAsync(default).ReturnsForAnyArgs(mockProject);
+        sutProvider.GetDependency<ICurrentContext>().AccessSecretsManager(default).ReturnsForAnyArgs(true);
         sutProvider.GetDependency<IUserService>().GetProperUserId(default).ReturnsForAnyArgs(Guid.NewGuid());
-        sutProvider.GetDependency<ICreateAccessPoliciesCommand>().CreateForProjectAsync(default, default, default)
+        sutProvider.GetDependency<ICreateAccessPoliciesCommand>().CreateManyAsync(default, default, default)
             .ReturnsForAnyArgs(new List<BaseAccessPolicy> { data });
 
         await sutProvider.Sut.CreateProjectAccessPoliciesAsync(id, request);
 
         await sutProvider.GetDependency<ICreateAccessPoliciesCommand>().Received(1)
-            .CreateForProjectAsync(Arg.Any<Guid>(), Arg.Any<List<BaseAccessPolicy>>(), Arg.Any<Guid>());
+            .CreateManyAsync(Arg.Any<List<BaseAccessPolicy>>(), Arg.Any<Guid>(), Arg.Any<AccessClientType>());
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async void CreateServiceAccountAccessPolicies_RequestMoreThanMax_Throws(
+        SutProvider<AccessPoliciesController> sutProvider,
+        Guid id,
+        ServiceAccount serviceAccount,
+        UserServiceAccountAccessPolicy data,
+        AccessPoliciesCreateRequest request)
+    {
+        sutProvider.GetDependency<IServiceAccountRepository>().GetByIdAsync(default).ReturnsForAnyArgs(serviceAccount);
+        sutProvider.GetDependency<ICurrentContext>().AccessSecretsManager(default).ReturnsForAnyArgs(true);
+        sutProvider.GetDependency<IUserService>().GetProperUserId(default).ReturnsForAnyArgs(Guid.NewGuid());
+        sutProvider.GetDependency<ICreateAccessPoliciesCommand>()
+            .CreateManyAsync(default, default, default)
+            .ReturnsForAnyArgs(new List<BaseAccessPolicy> { data });
+
+        request = AddRequestsOverMax(request);
+
+        await Assert.ThrowsAsync<BadRequestException>(() =>
+            sutProvider.Sut.CreateServiceAccountAccessPoliciesAsync(id, request));
+
+        await sutProvider.GetDependency<ICreateAccessPoliciesCommand>().DidNotReceiveWithAnyArgs()
+            .CreateManyAsync(Arg.Any<List<BaseAccessPolicy>>(), Arg.Any<Guid>(), Arg.Any<AccessClientType>());
     }
 
     [Theory]
@@ -303,18 +444,68 @@ public class AccessPoliciesControllerTests
     public async void CreateServiceAccountAccessPolicies_Success(
         SutProvider<AccessPoliciesController> sutProvider,
         Guid id,
+        ServiceAccount serviceAccount,
         UserServiceAccountAccessPolicy data,
         AccessPoliciesCreateRequest request)
     {
+        sutProvider.GetDependency<IServiceAccountRepository>().GetByIdAsync(default).ReturnsForAnyArgs(serviceAccount);
+        sutProvider.GetDependency<ICurrentContext>().AccessSecretsManager(default).ReturnsForAnyArgs(true);
         sutProvider.GetDependency<IUserService>().GetProperUserId(default).ReturnsForAnyArgs(Guid.NewGuid());
         sutProvider.GetDependency<ICreateAccessPoliciesCommand>()
-            .CreateForServiceAccountAsync(default, default, default)
+            .CreateManyAsync(default, default, default)
             .ReturnsForAnyArgs(new List<BaseAccessPolicy> { data });
 
         await sutProvider.Sut.CreateServiceAccountAccessPoliciesAsync(id, request);
 
         await sutProvider.GetDependency<ICreateAccessPoliciesCommand>().Received(1)
-            .CreateForServiceAccountAsync(Arg.Any<Guid>(), Arg.Any<List<BaseAccessPolicy>>(), Arg.Any<Guid>());
+            .CreateManyAsync(Arg.Any<List<BaseAccessPolicy>>(), Arg.Any<Guid>(), Arg.Any<AccessClientType>());
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async void CreateServiceAccountGrantedPolicies_RequestMoreThanMax_Throws(
+        SutProvider<AccessPoliciesController> sutProvider,
+        Guid id,
+        ServiceAccount serviceAccount,
+        ServiceAccountProjectAccessPolicy data,
+        List<GrantedAccessPolicyRequest> request)
+    {
+        sutProvider.GetDependency<IServiceAccountRepository>().GetByIdAsync(default).ReturnsForAnyArgs(serviceAccount);
+        sutProvider.GetDependency<ICurrentContext>().AccessSecretsManager(default).ReturnsForAnyArgs(true);
+        sutProvider.GetDependency<IUserService>().GetProperUserId(default).ReturnsForAnyArgs(Guid.NewGuid());
+        sutProvider.GetDependency<ICreateAccessPoliciesCommand>()
+            .CreateManyAsync(default, default, default)
+            .ReturnsForAnyArgs(new List<BaseAccessPolicy> { data });
+
+        request = AddRequestsOverMax(request);
+
+        await Assert.ThrowsAsync<BadRequestException>(() =>
+            sutProvider.Sut.CreateServiceAccountGrantedPoliciesAsync(id, request));
+
+        await sutProvider.GetDependency<ICreateAccessPoliciesCommand>().DidNotReceiveWithAnyArgs()
+            .CreateManyAsync(Arg.Any<List<BaseAccessPolicy>>(), Arg.Any<Guid>(), Arg.Any<AccessClientType>());
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async void CreateServiceAccountGrantedPolicies_Success(
+        SutProvider<AccessPoliciesController> sutProvider,
+        Guid id,
+        ServiceAccount serviceAccount,
+        ServiceAccountProjectAccessPolicy data,
+        List<GrantedAccessPolicyRequest> request)
+    {
+        sutProvider.GetDependency<IServiceAccountRepository>().GetByIdAsync(default).ReturnsForAnyArgs(serviceAccount);
+        sutProvider.GetDependency<ICurrentContext>().AccessSecretsManager(default).ReturnsForAnyArgs(true);
+        sutProvider.GetDependency<IUserService>().GetProperUserId(default).ReturnsForAnyArgs(Guid.NewGuid());
+        sutProvider.GetDependency<ICreateAccessPoliciesCommand>()
+            .CreateManyAsync(default, default, default)
+            .ReturnsForAnyArgs(new List<BaseAccessPolicy> { data });
+
+        await sutProvider.Sut.CreateServiceAccountGrantedPoliciesAsync(id, request);
+
+        await sutProvider.GetDependency<ICreateAccessPoliciesCommand>().Received(1)
+            .CreateManyAsync(Arg.Any<List<BaseAccessPolicy>>(), Arg.Any<Guid>(), Arg.Any<AccessClientType>());
     }
 
     [Theory]
@@ -459,8 +650,9 @@ public class AccessPoliciesControllerTests
         ServiceAccount mockServiceAccount)
     {
         SetupPermission(sutProvider, permissionType, id);
-        sutProvider.GetDependency<IServiceAccountRepository>().GetManyByOrganizationIdWriteAccessAsync(default, default, default)
-             .ReturnsForAnyArgs(new List<ServiceAccount> { mockServiceAccount });
+        sutProvider.GetDependency<IServiceAccountRepository>()
+            .GetManyByOrganizationIdWriteAccessAsync(default, default, default)
+            .ReturnsForAnyArgs(new List<ServiceAccount> { mockServiceAccount });
 
         var result = await sutProvider.Sut.GetServiceAccountsPotentialGranteesAsync(id);
 
@@ -471,4 +663,63 @@ public class AccessPoliciesControllerTests
 
         Assert.NotEmpty(result.Data);
     }
+
+    [Theory]
+    [BitAutoData(PermissionType.RunAsAdmin)]
+    [BitAutoData(PermissionType.RunAsUserWithPermission)]
+    public async void GetProjectPotentialGrantees_ReturnsEmptyList(
+        PermissionType permissionType,
+        SutProvider<AccessPoliciesController> sutProvider,
+        Guid id)
+    {
+        SetupPermission(sutProvider, permissionType, id);
+        var result = await sutProvider.Sut.GetProjectPotentialGranteesAsync(id);
+
+        await sutProvider.GetDependency<IProjectRepository>().Received(1)
+            .GetManyByOrganizationIdWriteAccessAsync(Arg.Is(AssertHelper.AssertPropertyEqual(id)),
+                Arg.Is(AssertHelper.AssertPropertyEqual(id)),
+                Arg.Any<AccessClientType>());
+
+        Assert.Empty(result.Data);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async void GetProjectPotentialGrantees_UserWithoutPermission_Throws(
+        SutProvider<AccessPoliciesController> sutProvider,
+        Guid id)
+    {
+        sutProvider.GetDependency<ICurrentContext>().OrganizationAdmin(id).Returns(false);
+        sutProvider.GetDependency<ICurrentContext>().AccessSecretsManager(default).ReturnsForAnyArgs(false);
+        sutProvider.GetDependency<IUserService>().GetProperUserId(default).ReturnsForAnyArgs(Guid.NewGuid());
+
+        await Assert.ThrowsAsync<NotFoundException>(() => sutProvider.Sut.GetProjectPotentialGranteesAsync(id));
+
+        await sutProvider.GetDependency<IProjectRepository>().DidNotReceiveWithAnyArgs()
+            .GetManyByOrganizationIdWriteAccessAsync(Arg.Any<Guid>(), Arg.Any<Guid>(), Arg.Any<AccessClientType>());
+    }
+
+    [Theory]
+    [BitAutoData(PermissionType.RunAsAdmin)]
+    [BitAutoData(PermissionType.RunAsUserWithPermission)]
+    public async void GetProjectPotentialGrantees_Success(
+        PermissionType permissionType,
+        SutProvider<AccessPoliciesController> sutProvider,
+        Guid id,
+        Project mockProject)
+    {
+        SetupPermission(sutProvider, permissionType, id);
+        sutProvider.GetDependency<IProjectRepository>()
+            .GetManyByOrganizationIdWriteAccessAsync(default, default, default)
+            .ReturnsForAnyArgs(new List<Project> { mockProject });
+
+        var result = await sutProvider.Sut.GetProjectPotentialGranteesAsync(id);
+
+        await sutProvider.GetDependency<IProjectRepository>().Received(1)
+            .GetManyByOrganizationIdWriteAccessAsync(Arg.Is(AssertHelper.AssertPropertyEqual(id)),
+                Arg.Is(AssertHelper.AssertPropertyEqual(id)),
+                Arg.Any<AccessClientType>());
+
+        Assert.NotEmpty(result.Data);
+    }
 }