Skip to content

Commit e273bb5

Browse files
jrmccannonjrmccannon
committed
Removing not scim check from api-key and rotate-api-key
1 parent e758ca2 commit e273bb5

2 files changed

Lines changed: 120 additions & 15 deletions

File tree

‎src/Api/AdminConsole/Controllers/OrganizationsController.cs‎

Lines changed: 9 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -407,17 +407,14 @@ public async Task<ApiKeyResponseModel> ApiKey(string id, [FromBody] Organization
407407
throw new UnauthorizedAccessException();
408408
}
409409

410-
if (model.Type != OrganizationApiKeyType.Scim
411-
&& !await _userService.VerifySecretAsync(user, model.Secret))
410+
if (!await _userService.VerifySecretAsync(user, model.Secret))
412411
{
413412
await Task.Delay(2000);
414413
throw new BadRequestException("MasterPasswordHash", "Invalid password.");
415414
}
416-
else
417-
{
418-
var response = new ApiKeyResponseModel(organizationApiKey);
419-
return response;
420-
}
415+
416+
var response = new ApiKeyResponseModel(organizationApiKey);
417+
return response;
421418
}
422419

423420
[HttpGet("{id}/api-key-information/{type?}")]
@@ -460,18 +457,15 @@ public async Task<ApiKeyResponseModel> RotateApiKey(string id, [FromBody] Organi
460457
throw new UnauthorizedAccessException();
461458
}
462459

463-
if (model.Type != OrganizationApiKeyType.Scim
464-
&& !await _userService.VerifySecretAsync(user, model.Secret))
460+
if (!await _userService.VerifySecretAsync(user, model.Secret))
465461
{
466462
await Task.Delay(2000);
467463
throw new BadRequestException("MasterPasswordHash", "Invalid password.");
468464
}
469-
else
470-
{
471-
await _rotateOrganizationApiKeyCommand.RotateApiKeyAsync(organizationApiKey);
472-
var response = new ApiKeyResponseModel(organizationApiKey);
473-
return response;
474-
}
465+
466+
await _rotateOrganizationApiKeyCommand.RotateApiKeyAsync(organizationApiKey);
467+
var response = new ApiKeyResponseModel(organizationApiKey);
468+
return response;
475469
}
476470

477471
private async Task<bool> HasApiKeyAccessAsync(Guid orgId, OrganizationApiKeyType? type)

‎test/Api.Test/AdminConsole/Controllers/OrganizationsControllerTests.cs‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
using System.Security.Claims;
22
using Bit.Api.AdminConsole.Controllers;
3+
using Bit.Api.AdminConsole.Models.Request.Organizations;
34
using Bit.Api.Auth.Models.Request.Accounts;
45
using Bit.Api.Models.Request.Organizations;
56
using Bit.Core;
@@ -8,6 +9,7 @@
89
using Bit.Core.AdminConsole.Enums.Provider;
910
using Bit.Core.AdminConsole.Models.Business;
1011
using Bit.Core.AdminConsole.Models.Data.Organizations.Policies;
12+
using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationApiKeys.Interfaces;
1113
using Bit.Core.AdminConsole.OrganizationFeatures.Organizations.Interfaces;
1214
using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
1315
using Bit.Core.AdminConsole.OrganizationFeatures.Policies;
@@ -257,4 +259,113 @@ await sutProvider.GetDependency<IOrganizationService>()
257259
s.LimitItemDeletion == model.LimitItemDeletion &&
258260
s.AllowAdminAccessToAllCollectionItems == model.AllowAdminAccessToAllCollectionItems));
259261
}
262+
263+
[Theory, BitAutoData]
264+
public async Task ApiKey_ScimType_InvalidSecret_ThrowsBadRequest(
265+
SutProvider<OrganizationsController> sutProvider,
266+
Organization organization,
267+
OrganizationApiKey organizationApiKey,
268+
User user)
269+
{
270+
organization.PlanType = PlanType.EnterpriseAnnually;
271+
var model = new OrganizationApiKeyRequestModel
272+
{
273+
Type = OrganizationApiKeyType.Scim,
274+
MasterPasswordHash = "invalid-hash"
275+
};
276+
277+
sutProvider.GetDependency<ICurrentContext>().ManageScim(organization.Id).Returns(true);
278+
sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(organization.Id).Returns(organization);
279+
sutProvider.GetDependency<IGetOrganizationApiKeyQuery>()
280+
.GetOrganizationApiKeyAsync(organization.Id, OrganizationApiKeyType.Scim)
281+
.Returns(organizationApiKey);
282+
283+
var userService = sutProvider.GetDependency<IUserService>();
284+
userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
285+
userService.VerifySecretAsync(user, model.Secret).Returns(false);
286+
287+
await Assert.ThrowsAsync<BadRequestException>(
288+
() => sutProvider.Sut.ApiKey(organization.Id.ToString(), model));
289+
}
290+
291+
[Theory, BitAutoData]
292+
public async Task ApiKey_ScimType_ValidSecret_ReturnsApiKey(
293+
SutProvider<OrganizationsController> sutProvider,
294+
Organization organization,
295+
OrganizationApiKey organizationApiKey,
296+
User user)
297+
{
298+
organization.PlanType = PlanType.EnterpriseAnnually;
299+
var model = new OrganizationApiKeyRequestModel
300+
{
301+
Type = OrganizationApiKeyType.Scim,
302+
MasterPasswordHash = "valid-hash"
303+
};
304+
305+
sutProvider.GetDependency<ICurrentContext>().ManageScim(organization.Id).Returns(true);
306+
sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(organization.Id).Returns(organization);
307+
sutProvider.GetDependency<IGetOrganizationApiKeyQuery>()
308+
.GetOrganizationApiKeyAsync(organization.Id, OrganizationApiKeyType.Scim)
309+
.Returns(organizationApiKey);
310+
var userService = sutProvider.GetDependency<IUserService>();
311+
userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
312+
userService.VerifySecretAsync(user, model.Secret).Returns(true);
313+
314+
var result = await sutProvider.Sut.ApiKey(organization.Id.ToString(), model);
315+
316+
Assert.Equal(organizationApiKey.ApiKey, result.ApiKey);
317+
}
318+
319+
[Theory, BitAutoData]
320+
public async Task RotateApiKey_ScimType_InvalidSecret_ThrowsBadRequest(
321+
SutProvider<OrganizationsController> sutProvider,
322+
Organization organization,
323+
OrganizationApiKey organizationApiKey,
324+
User user)
325+
{
326+
var model = new OrganizationApiKeyRequestModel
327+
{
328+
Type = OrganizationApiKeyType.Scim,
329+
MasterPasswordHash = "invalid-hash"
330+
};
331+
332+
sutProvider.GetDependency<ICurrentContext>().ManageScim(organization.Id).Returns(true);
333+
sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(organization.Id).Returns(organization);
334+
sutProvider.GetDependency<IGetOrganizationApiKeyQuery>()
335+
.GetOrganizationApiKeyAsync(organization.Id, OrganizationApiKeyType.Scim)
336+
.Returns(organizationApiKey);
337+
var userService = sutProvider.GetDependency<IUserService>();
338+
userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
339+
userService.VerifySecretAsync(user, model.Secret).Returns(false);
340+
341+
await Assert.ThrowsAsync<BadRequestException>(
342+
() => sutProvider.Sut.RotateApiKey(organization.Id.ToString(), model));
343+
}
344+
345+
[Theory, BitAutoData]
346+
public async Task RotateApiKey_ScimType_ValidSecret_ReturnsApiKey(
347+
SutProvider<OrganizationsController> sutProvider,
348+
Organization organization,
349+
OrganizationApiKey organizationApiKey,
350+
User user)
351+
{
352+
var model = new OrganizationApiKeyRequestModel
353+
{
354+
Type = OrganizationApiKeyType.Scim,
355+
MasterPasswordHash = "valid-hash"
356+
};
357+
358+
sutProvider.GetDependency<ICurrentContext>().ManageScim(organization.Id).Returns(true);
359+
sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(organization.Id).Returns(organization);
360+
sutProvider.GetDependency<IGetOrganizationApiKeyQuery>()
361+
.GetOrganizationApiKeyAsync(organization.Id, OrganizationApiKeyType.Scim)
362+
.Returns(organizationApiKey);
363+
var userService = sutProvider.GetDependency<IUserService>();
364+
userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
365+
userService.VerifySecretAsync(user, model.Secret).Returns(true);
366+
367+
var result = await sutProvider.Sut.RotateApiKey(organization.Id.ToString(), model);
368+
369+
Assert.Equal(organizationApiKey.ApiKey, result.ApiKey);
370+
}
260371
}

0 commit comments

Comments
 (0)