* feat(pm-15015) :
* Add `CountryName` column to AuthRequest Table in Database, and refreshing AuthRequestView
* Modify database stored procedures and Entity Framework migrations for AuthRequest Repositories
* Add property to `ICurrentContext` and response models.
* Add stored procedure to read organization user details by role
* Add OrganizationUserRepository method to retrieve OrganizationUser details by role
* Enhance AuthRequestService to send notifications to custom users with ManageResetPassword permission
* Enhance AuthRequestServiceTests to include custom user permissions and validate notification email recipients
* chore: set up a `CODEOWNERS` space for platform
* chore: move sql objects for `Installation` to platform's domain
* chore: move `Installation` and `PushRelay` code to platform's domain
* Add HasConfirmedOwnersExceptQuery class, interface and unit tests
* Register IHasConfirmedOwnersExceptQuery for dependency injection
* Replace OrganizationService.HasConfirmedOwnersExceptAsync with HasConfirmedOwnersExceptQuery
* Refactor DeleteManagedOrganizationUserAccountCommand to use IHasConfirmedOwnersExceptQuery
* Fix unit tests
* Extract IOrganizationService.RemoveUserAsync into IRemoveOrganizationUserCommand; Update unit tests
* Extract IOrganizationService.RemoveUsersAsync into IRemoveOrganizationUserCommand; Update unit tests
* Refactor RemoveUserAsync(Guid organizationId, Guid userId) to use ValidateDeleteUser
* Refactor RemoveOrganizationUserCommandTests to use more descriptive method names
* Refactor controller actions to accept Guid directly instead of parsing strings
* Add unit tests for removing OrganizationUser by UserId
* Refactor remove OrganizationUser by UserId method
* Add summary to IHasConfirmedOwnersExceptQuery
* Rename IDeleteOrganizationUserCommand to IRemoveOrganizationUserCommand
* Rename IOrganizationService DeleteUser methods to RemoveUser
* Rename API endpoints for deleting organization users to "Remove"
* chore: Rename Delete method to Remove in MembersController
Remove FlexibleCollections feature flag logic for repository methods:
* CiphersController.GetByIdAsync
* CipherRepository.DeleteAsync
* CipherRepository.MoveAsync
* RestoreAsync
* SoftDeleteAsync
This feature flag was never turned on and we will update the sprocs
directly as required.
* Create UserCipherDetails_v2 and update logic to remove AccessAll
* Create v2 variants of all sprocs that rely on it
* Add feature flag logic to call old or new sproc
* Make equivalent changes to EF queries
* [PM-1203] feat: allow verification for all passwordless accounts (#3038)
* [PM-1033] Org invite user creation flow 1 (#3028)
* [PM-1033] feat: remove user verification from password enrollment
* [PM-1033] feat: auto accept invitation when enrolling into password reset
* [PM-1033] fix: controller tests
* [PM-1033] refactor: `UpdateUserResetPasswordEnrollmentCommand`
* [PM-1033] refactor(wip): make `AcceptUserCommand`
* Revert "[PM-1033] refactor(wip): make `AcceptUserCommand`"
This reverts commit dc1319e7fa70c4844bbc70e0b01089b682ac2843.
* Revert "[PM-1033] refactor: `UpdateUserResetPasswordEnrollmentCommand`"
This reverts commit 43df689c7f244af4f7ffec1f9768a72081a624c3.
* [PM-1033] refactor: move invite accept to controller
This avoids creating yet another method that depends on having `IUserService` passed in as a parameter
* [PM-1033] fix: add missing changes
* [PM-1381] Add Trusted Device Keys to Auth Response (#3066)
* Return Keys for Trusted Device
- Check whether the current logging in device is trusted
- Return their keys on successful login
* Formatting
* Address PR Feedback
* Add Remarks Comment
* [PM-1338] `AuthRequest` Event Logs (#3046)
* Update AuthRequestController
- Only allow AdminApproval Requests to be created from authed endpoint
- Add endpoint that has authentication to be able to create admin approval
* Add PasswordlessAuthSettings
- Add settings for customizing expiration times
* Add new EventTypes
* Add Logic for AdminApproval Type
- Add logic for validating AdminApproval expiration
- Add event logging for Approval/Disapproval of AdminApproval
- Add logic for creating AdminApproval types
* Add Test Helpers
- Change BitAutoData to allow you to use string representations of common types.
* Add/Update AuthRequestService Tests
* Run Formatting
* Switch to 7 Days
* Add Test Covering ResponseDate Being Set
* Address PR Feedback
- Create helper for checking if date is expired
- Move validation logic into smaller methods
* Switch to User Event Type
- Make RequestDeviceApproval user type
- User types will log for each org user is in
* [PM-2998] Move Approving Device Check (#3101)
* Move Check for Approving Devices
- Exclude currently logging in device
- Remove old way of checking
- Add tests asserting behavior
* Update DeviceType list
* Update Naming & Address PR Feedback
* Fix Tests
* Address PR Feedback
* Formatting
* Now Fully Update Naming?
* Feature/auth/pm 2759/add can reset password to user decryption options (#3113)
* PM-2759 - BaseRequestValidator.cs - CreateUserDecryptionOptionsAsync - Add new hasManageResetPasswordPermission for post SSO redirect logic required on client.
* PM-2759 - Update IdentityServerSsoTests.cs to all pass based on the addition of HasManageResetPasswordPermission to TrustedDeviceUserDecryptionOption
* IdentityServerSsoTests.cs - fix typo in test name: LoggingApproval --> LoginApproval
* PM1259 - Add test case for verifying that TrustedDeviceOption.hasManageResetPasswordPermission is set properly based on user permission
* dotnet format run
* Feature/auth/pm 2759/add can reset password to user decryption options fix jit users (#3120)
* PM-2759 - IdentityServer - CreateUserDecryptionOptionsAsync - hasManageResetPasswordPermission set logic was broken for JIT provisioned users as I assumed we would always have a list of at least 1 org during the SSO process. Added TODO for future test addition but getting this out there now as QA is blocked by being unable to create JIT provisioned users.
* dotnet format
* Tiny tweak
* [PM-1339] Allow Rotating Device Keys (#3096)
* Allow Rotation of Trusted Device Keys
- Add endpoint for getting keys relating to rotation
- Add endpoint for rotating your current device
- In the same endpoint allow a list of other devices to rotate
* Formatting
* Use Extension Method
* Add Tests from PR
Co-authored-by: Jared Snider <jsnider@bitwarden.com>
---------
Co-authored-by: Jared Snider <jsnider@bitwarden.com>
* Check the user directly if they have the ResetPasswordKey (#3153)
* PM-3327 - UpdateKeyAsync must exempt the currently calling device from the logout notification in order to prevent prematurely logging the user out before the client side key rotation process can complete. The calling device will log itself out once it is done. (#3170)
* Allow OTP Requests When Users Are On TDE (#3184)
* [PM-3356][PM-3292] Allow OTP For All (#3188)
* Allow OTP For All
- On a trusted device isn't a good check because a user might be using a trusted device locally but not trusted it long term
- The logic wasn't working for KC users anyways
* Remove Old Comment
* [AC-1601] Added RequireSso policy as a dependency of TDE (#3209)
* Added RequireSso policy as a dependency of TDE.
* Added test for RequireSso for TDE.
* Added save.
* Fixed policy name.
---------
Co-authored-by: Andreas Coroiu <acoroiu@bitwarden.com>
Co-authored-by: Justin Baur <19896123+justindbaur@users.noreply.github.com>
Co-authored-by: Vincent Salucci <vincesalucci21@gmail.com>
Co-authored-by: Jared Snider <116684653+JaredSnider-Bitwarden@users.noreply.github.com>
Co-authored-by: Jared Snider <jsnider@bitwarden.com>
* [AC-1435] Automatically enable Single Org policy when selecting TDE
* [AC-1435] Add test for automatic policy enablement
* [AC-1435] Prevent disabling single org when account recovery is enabled
* [AC-1435] Require Single Org policy when enabling Account recovery
* [AC-1435] Add unit test to check for account recovery policy when attempting to disable single org
* [AC-1435] Add test to verify single org policy is enabled for account recovery policy
* [AC-1435] Fix failing test
* [AC-1192] Create new OrganizationAuthRequestsController.cs
* [AC-1192] Introduce OrganizationAdminAuthRequest model
* [AC-1192] Add GetManyPendingByOrganizationId method to AuthRequest repository
* [AC-1192] Add new list pending organization auth requests endpoint
* [AC-1192] Add new GetManyAdminApprovalsByManyIdsAsync method to the AuthRequestRepository
* [AC-1192] Make the response device identifier optional for admin approval requests
* [AC-1192] Add endpoint for bulk denying admin device auth requests
* [AC-1192] Add OrganizationUserId to PendingOrganizationAuthRequestResponseModel
* [AC-1192] Add UpdateAuthRequest endpoint and logic to OrganizationAuthRequestsController
* [AC-1192] Secure new endpoints behind TDE feature flag
* [AC-1192] Formatting
* [AC-1192] Add sql migration script
* [AC-1192] Add optional OrganizationId column to AuthRequest entity
- Rename migration script to match existing formatting
- Add new column
- Add migration scripts
- Update new sprocs to filter/join on OrganizationId
- Update old sprocs to include OrganizationId
* [AC-1192] Format migration scripts
* [AC-1192] Fix failing AuthRequest EF unit test
* [AC-1192] Make OrganizationId optional in updated AuthRequest sprocs for backwards compatability
* [AC-1192] Fix missing comma in migration file
* [AC-1192] Rename Key to EncryptedUserKey to be more descriptive
* [AC-1192] Move request validation into helper method to reduce repetition
* [AC-1192] Return UnauthorizedAccessException instead of NotFound when user is missing permission
* [AC-1192] Introduce FeatureUnavailableException
* [AC-1192] Introduce RequireFeatureAttribute
* [AC-1192] Utilize the new RequireFeatureAttribute in the OrganizationAuthRequestsController
* [AC-1192] Attempt to fix out of sync database migration by moving new OrganizationId column
* [AC-1192] More attempts to sync database migrations
* [AC-1192] Formatting
* [AC-1192] Remove unused reference to FeatureService
* [AC-1192] Change Id types from String to Guid
* [AC-1192] Add EncryptedString attribute
* [AC-1192] Remove redundant OrganizationId property
* [AC-1192] Switch to projection for OrganizationAdminAuthRequest mapping
- Add new OrganizationUser relationship to EF entity
- Replace AuthRequest DBContext config with new IEntityTypeConfiguration
- Add navigation property to AuthRequest entity configuration for OrganizationUser
- Update EF AuthRequestRepository to use new mapping and navigation properties
* [AC-1192] Remove OrganizationUser navigation property
* [AC-1145] Add TDE feature flag
* [AC-1145] Update .gitignore to ignore flags.json in the Api project
* [AC-1145] Introduce MemberDecryptionType property on SsoConfigurationData
* [AC-1145] Add MemberDecryptionType to the SsoConfigurationDataRequest model
* [AC-1145] Automatically enable password reset policy on TDE selection
* [AC-1145] Remove references to obsolete KeyConnectorEnabled field
* [AC-1145] Formatting
* [AC-1145] Update XML doc reference to MemberDecryptionType
* Refactor AuthRequest Logic into Service
* Add Tests & Run Formatting
* Register Service
* Add Tests From PR Feedback
Co-authored-by: Jared Snider <jsnider@bitwarden.com>
---------
Co-authored-by: Jared Snider <jsnider@bitwarden.com>
