[AC-2774] Consolidated issues for Consolidated Billing (#4201)

* Add BaseProviderController, update some endpoints to ServiceUser permissions

* Prevent service user from scaling provider seats above seat minimum

* Expand invoice response to include DueDate

src/Api/Billing/Controllers/BaseProviderController.cs

@@ -0,0 +1,50 @@
+using Bit.Core;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.Billing.Extensions;
+using Bit.Core.Context;
+using Bit.Core.Services;
+using Microsoft.AspNetCore.Mvc;
+
+namespace Bit.Api.Billing.Controllers;
+
+public abstract class BaseProviderController(
+    ICurrentContext currentContext,
+    IFeatureService featureService,
+    IProviderRepository providerRepository) : Controller
+{
+    protected Task<(Provider, IResult)> TryGetBillableProviderForAdminOperation(
+        Guid providerId) => TryGetBillableProviderAsync(providerId, currentContext.ProviderProviderAdmin);
+
+    protected Task<(Provider, IResult)> TryGetBillableProviderForServiceUserOperation(
+        Guid providerId) => TryGetBillableProviderAsync(providerId, currentContext.ProviderUser);
+
+    private async Task<(Provider, IResult)> TryGetBillableProviderAsync(
+        Guid providerId,
+        Func<Guid, bool> checkAuthorization)
+    {
+        if (!featureService.IsEnabled(FeatureFlagKeys.EnableConsolidatedBilling))
+        {
+            return (null, TypedResults.NotFound());
+        }
+
+        var provider = await providerRepository.GetByIdAsync(providerId);
+
+        if (provider == null)
+        {
+            return (null, TypedResults.NotFound());
+        }
+
+        if (!checkAuthorization(providerId))
+        {
+            return (null, TypedResults.Unauthorized());
+        }
+
+        if (!provider.IsBillable())
+        {
+            return (null, TypedResults.Unauthorized());
+        }
+
+        return (provider, null);
+    }
+}

src/Api/Billing/Controllers/ProviderBillingController.cs

@@ -1,10 +1,7 @@
 using Bit.Api.Billing.Models.Requests;
 using Bit.Api.Billing.Models.Responses;
-using Bit.Core;
-using Bit.Core.AdminConsole.Entities.Provider;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Billing.Constants;
-using Bit.Core.Billing.Extensions;
 using Bit.Core.Billing.Models;
 using Bit.Core.Billing.Services;
 using Bit.Core.Context;
@@ -23,12 +20,12 @@ public class ProviderBillingController(
     IProviderBillingService providerBillingService,
     IProviderRepository providerRepository,
     IStripeAdapter stripeAdapter,
-    ISubscriberService subscriberService) : Controller
+    ISubscriberService subscriberService) : BaseProviderController(currentContext, featureService, providerRepository)
 {
     [HttpGet("invoices")]
     public async Task<IResult> GetInvoicesAsync([FromRoute] Guid providerId)
     {
-        var (provider, result) = await GetAuthorizedBillableProviderOrResultAsync(providerId);
+        var (provider, result) = await TryGetBillableProviderForAdminOperation(providerId);
 
         if (provider == null)
         {
@@ -45,7 +42,7 @@ public class ProviderBillingController(
     [HttpGet("invoices/{invoiceId}")]
     public async Task<IResult> GenerateClientInvoiceReportAsync([FromRoute] Guid providerId, string invoiceId)
     {
-        var (provider, result) = await GetAuthorizedBillableProviderOrResultAsync(providerId);
+        var (provider, result) = await TryGetBillableProviderForAdminOperation(providerId);
 
         if (provider == null)
         {
@@ -67,7 +64,7 @@ public class ProviderBillingController(
     [HttpGet("payment-information")]
     public async Task<IResult> GetPaymentInformationAsync([FromRoute] Guid providerId)
     {
-        var (provider, result) = await GetAuthorizedBillableProviderOrResultAsync(providerId);
+        var (provider, result) = await TryGetBillableProviderForAdminOperation(providerId);
 
         if (provider == null)
         {
@@ -89,7 +86,7 @@ public class ProviderBillingController(
     [HttpGet("payment-method")]
     public async Task<IResult> GetPaymentMethodAsync([FromRoute] Guid providerId)
     {
-        var (provider, result) = await GetAuthorizedBillableProviderOrResultAsync(providerId);
+        var (provider, result) = await TryGetBillableProviderForAdminOperation(providerId);
 
         if (provider == null)
         {
@@ -113,7 +110,7 @@ public class ProviderBillingController(
         [FromRoute] Guid providerId,
         [FromBody] TokenizedPaymentMethodRequestBody requestBody)
     {
-        var (provider, result) = await GetAuthorizedBillableProviderOrResultAsync(providerId);
+        var (provider, result) = await TryGetBillableProviderForAdminOperation(providerId);
 
         if (provider == null)
         {
@@ -141,7 +138,7 @@ public class ProviderBillingController(
         [FromRoute] Guid providerId,
         [FromBody] VerifyBankAccountRequestBody requestBody)
     {
-        var (provider, result) = await GetAuthorizedBillableProviderOrResultAsync(providerId);
+        var (provider, result) = await TryGetBillableProviderForAdminOperation(providerId);
 
         if (provider == null)
         {
@@ -156,7 +153,7 @@ public class ProviderBillingController(
     [HttpGet("subscription")]
     public async Task<IResult> GetSubscriptionAsync([FromRoute] Guid providerId)
     {
-        var (provider, result) = await GetAuthorizedBillableProviderOrResultAsync(providerId);
+        var (provider, result) = await TryGetBillableProviderForServiceUserOperation(providerId);
 
         if (provider == null)
         {
@@ -178,7 +175,7 @@ public class ProviderBillingController(
     [HttpGet("tax-information")]
     public async Task<IResult> GetTaxInformationAsync([FromRoute] Guid providerId)
     {
-        var (provider, result) = await GetAuthorizedBillableProviderOrResultAsync(providerId);
+        var (provider, result) = await TryGetBillableProviderForAdminOperation(providerId);
 
         if (provider == null)
         {
@@ -202,7 +199,7 @@ public class ProviderBillingController(
         [FromRoute] Guid providerId,
         [FromBody] TaxInformationRequestBody requestBody)
     {
-        var (provider, result) = await GetAuthorizedBillableProviderOrResultAsync(providerId);
+        var (provider, result) = await TryGetBillableProviderForAdminOperation(providerId);
 
         if (provider == null)
         {
@@ -222,31 +219,4 @@ public class ProviderBillingController(
 
         return TypedResults.Ok();
     }
-
-    private async Task<(Provider, IResult)> GetAuthorizedBillableProviderOrResultAsync(Guid providerId)
-    {
-        if (!featureService.IsEnabled(FeatureFlagKeys.EnableConsolidatedBilling))
-        {
-            return (null, TypedResults.NotFound());
-        }
-
-        var provider = await providerRepository.GetByIdAsync(providerId);
-
-        if (provider == null)
-        {
-            return (null, TypedResults.NotFound());
-        }
-
-        if (!currentContext.ProviderProviderAdmin(providerId))
-        {
-            return (null, TypedResults.Unauthorized());
-        }
-
-        if (!provider.IsBillable())
-        {
-            return (null, TypedResults.Unauthorized());
-        }
-
-        return (provider, null);
-    }
 }

src/Api/Billing/Controllers/ProviderClientsController.cs

@@ -1,5 +1,4 @@
 using Bit.Api.Billing.Models.Requests;
-using Bit.Core;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.AdminConsole.Services;
 using Bit.Core.Billing.Services;
@@ -22,16 +21,18 @@ public class ProviderClientsController(
     IProviderOrganizationRepository providerOrganizationRepository,
     IProviderRepository providerRepository,
     IProviderService providerService,
-    IUserService userService) : Controller
+    IUserService userService) : BaseProviderController(currentContext, featureService, providerRepository)
 {
     [HttpPost]
     public async Task<IResult> CreateAsync(
         [FromRoute] Guid providerId,
         [FromBody] CreateClientOrganizationRequestBody requestBody)
     {
-        if (!featureService.IsEnabled(FeatureFlagKeys.EnableConsolidatedBilling))
+        var (provider, result) = await TryGetBillableProviderForAdminOperation(providerId);
+
+        if (provider == null)
         {
-            return TypedResults.NotFound();
+            return result;
         }
 
         var user = await userService.GetUserByPrincipalAsync(User);
@@ -41,18 +42,6 @@ public class ProviderClientsController(
             return TypedResults.Unauthorized();
         }
 
-        if (!currentContext.ManageProviderOrganizations(providerId))
-        {
-            return TypedResults.Unauthorized();
-        }
-
-        var provider = await providerRepository.GetByIdAsync(providerId);
-
-        if (provider == null)
-        {
-            return TypedResults.NotFound();
-        }
-
         var organizationSignup = new OrganizationSignup
         {
             Name = requestBody.Name,
@@ -103,21 +92,16 @@ public class ProviderClientsController(
         [FromRoute] Guid providerOrganizationId,
         [FromBody] UpdateClientOrganizationRequestBody requestBody)
     {
-        if (!featureService.IsEnabled(FeatureFlagKeys.EnableConsolidatedBilling))
-        {
-            return TypedResults.NotFound();
-        }
+        var (provider, result) = await TryGetBillableProviderForServiceUserOperation(providerId);
 
-        if (!currentContext.ProviderProviderAdmin(providerId))
+        if (provider == null)
         {
-            return TypedResults.Unauthorized();
+            return result;
         }
 
-        var provider = await providerRepository.GetByIdAsync(providerId);
-
         var providerOrganization = await providerOrganizationRepository.GetByIdAsync(providerOrganizationId);
 
-        if (provider == null || providerOrganization == null)
+        if (providerOrganization == null)
         {
             return TypedResults.NotFound();
         }

src/Api/Billing/Models/Responses/InvoicesResponse.cs

@@ -18,6 +18,7 @@ public record InvoiceDTO(
     string Number,
     decimal Total,
     string Status,
+    DateTime? DueDate,
     string Url,
     string PdfUrl)
 {
@@ -27,6 +28,7 @@ public record InvoiceDTO(
         invoice.Number,
         invoice.Total / 100M,
         invoice.Status,
+        invoice.DueDate,
         invoice.HostedInvoiceUrl,
         invoice.InvoicePdf);
 }