bitwarden/server
1
0
Fork 0
mirror of https://github.com/bitwarden/server synced 2025-12-06 00:03:34 +00:00
Code Issues Releases Wiki Activity

[PM-20010] Fix purge logic to skip claimed user check for organization vault (#6107)

Browse Source 
* Implement unit tests for PostPurge method in CiphersController to handle various scenarios

* Refactor PostPurge method in CiphersController to use Guid for organizationId parameter and update related unit tests

* Refactor PostPurge method in CiphersController to skip checking if user is claimed if its purging the org vault
This commit is contained in:
Rui Tomé
2025-07-29 16:17:16 +01:00
committed by GitHub
parent 47237fa88f
commit 43372b7168
2 changed files with 129 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

121
test/Api.Test/Vault/Controllers/CiphersControllerTests.cs
View File

@@ -1,5 +1,6 @@
using System.Security.Claims;
using System.Text.Json;
using Bit.Api.Auth.Models.Request.Accounts;
using Bit.Api.Vault.Controllers;
using Bit.Api.Vault.Models;
using Bit.Api.Vault.Models.Request;
@@ -1789,5 +1790,123 @@ public class CiphersControllerTests
);
}
}
[Theory, BitAutoData]
public async Task PostPurge_WhenUserNotFound_ThrowsUnauthorizedAccessException(
SecretVerificationRequestModel model,
SutProvider<CiphersController> sutProvider)
{
sutProvider.GetDependency<IUserService>()
.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>())
.Returns((User)null);
await Assert.ThrowsAsync<UnauthorizedAccessException>(() => sutProvider.Sut.PostPurge(model));
}
[Theory, BitAutoData]
public async Task PostPurge_WhenUserVerificationFails_ThrowsBadRequestException(
User user,
SecretVerificationRequestModel model,
SutProvider<CiphersController> sutProvider)
{
sutProvider.GetDependency<IUserService>()
.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>())
.Returns(user);
sutProvider.GetDependency<IUserService>()
.VerifySecretAsync(user, model.Secret)
.Returns(false);
await Assert.ThrowsAsync<BadRequestException>(() => sutProvider.Sut.PostPurge(model));
}
[Theory, BitAutoData]
public async Task PostPurge_UserPurge_WithClaimedUser_ThrowsBadRequestException(
User user,
SecretVerificationRequestModel model,
SutProvider<CiphersController> sutProvider)
{
sutProvider.GetDependency<IUserService>()
.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>())
.Returns(user);
sutProvider.GetDependency<IUserService>()
.VerifySecretAsync(user, model.Secret)
.Returns(true);
sutProvider.GetDependency<IUserService>()
.IsClaimedByAnyOrganizationAsync(user.Id)
.Returns(true);
await Assert.ThrowsAsync<BadRequestException>(() => sutProvider.Sut.PostPurge(model));
}
[Theory, BitAutoData]
public async Task PostPurge_UserPurge_WithUnclaimedUser_Successful(
User user,
SecretVerificationRequestModel model,
SutProvider<CiphersController> sutProvider)
{
sutProvider.GetDependency<IUserService>()
.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>())
.Returns(user);
sutProvider.GetDependency<IUserService>()
.VerifySecretAsync(user, model.Secret)
.Returns(true);
sutProvider.GetDependency<IUserService>()
.IsClaimedByAnyOrganizationAsync(user.Id)
.Returns(false);
await sutProvider.Sut.PostPurge(model);
await sutProvider.GetDependency<ICipherRepository>()
.Received(1)
.DeleteByUserIdAsync(user.Id);
}
[Theory, BitAutoData]
public async Task PostPurge_OrganizationPurge_WithEditAnyCollectionPermission_Successful(
User user,
SecretVerificationRequestModel model,
Guid organizationId,
SutProvider<CiphersController> sutProvider)
{
sutProvider.GetDependency<IUserService>()
.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>())
.Returns(user);
sutProvider.GetDependency<IUserService>()
.VerifySecretAsync(user, model.Secret)
.Returns(true);
sutProvider.GetDependency<IUserService>()
.IsClaimedByAnyOrganizationAsync(user.Id)
.Returns(true);
sutProvider.GetDependency<ICurrentContext>()
.EditAnyCollection(organizationId)
.Returns(true);
await sutProvider.Sut.PostPurge(model, organizationId);
await sutProvider.GetDependency<ICipherService>()
.Received(1)
.PurgeAsync(organizationId);
}
[Theory, BitAutoData]
public async Task PostPurge_OrganizationPurge_WithInsufficientPermissions_ThrowsNotFoundException(
User user,
Guid organizationId,
SecretVerificationRequestModel model,
SutProvider<CiphersController> sutProvider)
{
sutProvider.GetDependency<IUserService>()
.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>())
.Returns(user);
sutProvider.GetDependency<IUserService>()
.VerifySecretAsync(user, model.Secret)
.Returns(true);
sutProvider.GetDependency<IUserService>()
.IsClaimedByAnyOrganizationAsync(user.Id)
.Returns(false);
sutProvider.GetDependency<ICurrentContext>()
.EditAnyCollection(organizationId)
.Returns(false);
await Assert.ThrowsAsync<NotFoundException>(() => sutProvider.Sut.PostPurge(model, organizationId));
}
}