* [PM-1203] feat: allow verification for all passwordless accounts (#3038)
* [PM-1033] Org invite user creation flow 1 (#3028)
* [PM-1033] feat: remove user verification from password enrollment
* [PM-1033] feat: auto accept invitation when enrolling into password reset
* [PM-1033] fix: controller tests
* [PM-1033] refactor: `UpdateUserResetPasswordEnrollmentCommand`
* [PM-1033] refactor(wip): make `AcceptUserCommand`
* Revert "[PM-1033] refactor(wip): make `AcceptUserCommand`"
This reverts commit dc1319e7fa70c4844bbc70e0b01089b682ac2843.
* Revert "[PM-1033] refactor: `UpdateUserResetPasswordEnrollmentCommand`"
This reverts commit 43df689c7f244af4f7ffec1f9768a72081a624c3.
* [PM-1033] refactor: move invite accept to controller
This avoids creating yet another method that depends on having `IUserService` passed in as a parameter
* [PM-1033] fix: add missing changes
* [PM-1381] Add Trusted Device Keys to Auth Response (#3066)
* Return Keys for Trusted Device
- Check whether the current logging in device is trusted
- Return their keys on successful login
* Formatting
* Address PR Feedback
* Add Remarks Comment
* [PM-1338] `AuthRequest` Event Logs (#3046)
* Update AuthRequestController
- Only allow AdminApproval Requests to be created from authed endpoint
- Add endpoint that has authentication to be able to create admin approval
* Add PasswordlessAuthSettings
- Add settings for customizing expiration times
* Add new EventTypes
* Add Logic for AdminApproval Type
- Add logic for validating AdminApproval expiration
- Add event logging for Approval/Disapproval of AdminApproval
- Add logic for creating AdminApproval types
* Add Test Helpers
- Change BitAutoData to allow you to use string representations of common types.
* Add/Update AuthRequestService Tests
* Run Formatting
* Switch to 7 Days
* Add Test Covering ResponseDate Being Set
* Address PR Feedback
- Create helper for checking if date is expired
- Move validation logic into smaller methods
* Switch to User Event Type
- Make RequestDeviceApproval user type
- User types will log for each org user is in
* [PM-2998] Move Approving Device Check (#3101)
* Move Check for Approving Devices
- Exclude currently logging in device
- Remove old way of checking
- Add tests asserting behavior
* Update DeviceType list
* Update Naming & Address PR Feedback
* Fix Tests
* Address PR Feedback
* Formatting
* Now Fully Update Naming?
* Feature/auth/pm 2759/add can reset password to user decryption options (#3113)
* PM-2759 - BaseRequestValidator.cs - CreateUserDecryptionOptionsAsync - Add new hasManageResetPasswordPermission for post SSO redirect logic required on client.
* PM-2759 - Update IdentityServerSsoTests.cs to all pass based on the addition of HasManageResetPasswordPermission to TrustedDeviceUserDecryptionOption
* IdentityServerSsoTests.cs - fix typo in test name: LoggingApproval --> LoginApproval
* PM1259 - Add test case for verifying that TrustedDeviceOption.hasManageResetPasswordPermission is set properly based on user permission
* dotnet format run
* Feature/auth/pm 2759/add can reset password to user decryption options fix jit users (#3120)
* PM-2759 - IdentityServer - CreateUserDecryptionOptionsAsync - hasManageResetPasswordPermission set logic was broken for JIT provisioned users as I assumed we would always have a list of at least 1 org during the SSO process. Added TODO for future test addition but getting this out there now as QA is blocked by being unable to create JIT provisioned users.
* dotnet format
* Tiny tweak
* [PM-1339] Allow Rotating Device Keys (#3096)
* Allow Rotation of Trusted Device Keys
- Add endpoint for getting keys relating to rotation
- Add endpoint for rotating your current device
- In the same endpoint allow a list of other devices to rotate
* Formatting
* Use Extension Method
* Add Tests from PR
Co-authored-by: Jared Snider <jsnider@bitwarden.com>
---------
Co-authored-by: Jared Snider <jsnider@bitwarden.com>
* Check the user directly if they have the ResetPasswordKey (#3153)
* PM-3327 - UpdateKeyAsync must exempt the currently calling device from the logout notification in order to prevent prematurely logging the user out before the client side key rotation process can complete. The calling device will log itself out once it is done. (#3170)
* Allow OTP Requests When Users Are On TDE (#3184)
* [PM-3356][PM-3292] Allow OTP For All (#3188)
* Allow OTP For All
- On a trusted device isn't a good check because a user might be using a trusted device locally but not trusted it long term
- The logic wasn't working for KC users anyways
* Remove Old Comment
* [AC-1601] Added RequireSso policy as a dependency of TDE (#3209)
* Added RequireSso policy as a dependency of TDE.
* Added test for RequireSso for TDE.
* Added save.
* Fixed policy name.
---------
Co-authored-by: Andreas Coroiu <acoroiu@bitwarden.com>
Co-authored-by: Justin Baur <19896123+justindbaur@users.noreply.github.com>
Co-authored-by: Vincent Salucci <vincesalucci21@gmail.com>
Co-authored-by: Jared Snider <116684653+JaredSnider-Bitwarden@users.noreply.github.com>
Co-authored-by: Jared Snider <jsnider@bitwarden.com>
* Update ProviderService tests
* Use BitAutoData in CipherService tests
* Simplify UserCipher fixture
Because we use a single customizer for all ciphers, they all have the same userId.
* Clean up more cipher fixtures
* Swap Cipher Fixtures to BitCustomizeAttribute
* Clean up collection fixtures
* Clean up GroupFixtures
* Move SendService Tests to BitAutoData
* Clean up Organization Fixtures
TODO: The customize attributes should not be customizing more than one class
* Name files after the class they contain
* Clear up usage of CustomAutoDataAttribute in tests
* Clean up usages of InlineCustomAutoData
* format
* Manually merge with file-scoped-namespace changes
* Added UnknownDeviceVerificationEnabled on User that is turned off when emergency contact takes over the account. Also added endpoints to get and update 2fa device verification settings. And Updated migrations & tests
* Applied dotnet format
* Fixed method rename call on TwoFactorController
* PS-589 Format fixes
* PS-589 changed UnknownDeviceVerificationEnabled to be non-nullable
* EC-198 added global setting flag for 2FA email on new device login feature
* EC-198 Removed is development environment check on 2FA email new device login given that we can now rely on the global settings feature flag
* EC-198 Improved IGlobalSettings and UserService code for testing
* Start switch to System.Text.Json
* Work on switching to System.Text.Json
* Main work on STJ refactor
* Fix build errors
* Run formatting
* Delete unused file
* Use legacy for two factor providers
* Run formatter
* Add TokenProviderTests
* Run formatting
* Fix merge issues
* Switch to use JsonSerializer
* Address PR feedback
* Fix formatting
* Ran formatter
* Switch to async
* Ensure Enums are serialized as strings
* Fix formatting
* Enqueue single items as arrays
* Remove CreateAsync method on AzureQueueService
* Get limited life attachment download URL
This change limits url download to a 1min lifetime.
This requires moving to a new container to allow for non-public blob
access.
Clients will have to call GetAttachmentData api function to receive the download
URL. For backwards compatibility, attachment URLs are still present, but will not
work for attachments stored in non-public access blobs.
* Make GlobalSettings interface for testing
* Test LocalAttachmentStorageService equivalence
* Remove comment
* Add missing globalSettings using
* Simplify default attachment container
* Default to attachments containe for existing methods
A new upload method will be made for uploading to attachments-v2.
For compatibility for clients which don't use these new methods, we need
to still use the old container. The new container will be used only for
new uploads
* Remove Default MetaData fixture.
* Keep attachments container blob-level security for all instances
* Close unclosed FileStream
* Favor default value for noop services
* Add Disable Send policy
* Test DisableSend policy
* PR Review
* Update tests for using CurrentContext
This required making an interface for CurrentContext and mocking out
the members used. The interface can be expanded as needed for tests.
I moved CurrentContext to a folder, which changes the namespace
and causes a lot of file touches, but most are just adding a reference
* Fix failing test
* Update exemption to include all exempt users
* Move all CurrentContext usages to ICurrentContext
* PR review. Match messaging with Web
* Initial commit of accept user during set password flow
* changed new org user from accepted to invited // moved another check to token accept function
* Revised some white space // Moved business logic to UserService
* Fixed UserServiceTest
* Removed some white-space
* Removed more white-space
* Final white-space issues
Following the paradigms illustrated in "Working Effectively with Legacy
Code", this commit introduces at least one test for each service class
implementation. This test is a simple construction test -- we just
create each service and assert that it exists. Each test suite includes
a comment instructing the developer who comes next to remove the
constructor test. We don't want to keep these tests as the codebase
matures, as they aren't useful in the longterm. They only prove that we
have that class under test.
Where test suites failed to construct their associated classes, we skip
the test but leave behind the implementation. This is by design, so that
as the constructors for those classes change, we are forced to keep the
test suite current by leaning on the compiler.
