bitwarden/server
1
0
Fork 0
mirror of https://github.com/bitwarden/server synced 2026-01-04 17:43:53 +00:00
Code Issues Releases Wiki Activity

[PM-23981] Fix DefaultUserCollection filtering in organization user updates (#6161)

Browse Source 
* Refactor UpdateOrganizationUserCommand to validate and filter out DefaultUserCollections during user updates.

* Enhance UpdateOrganizationUserCommandTests to filter out DefaultUserCollections during user updates, ensuring only shared collections are processed. Updated test logic to reflect new filtering behavior.

* Add integration test for updating organization user with existing default collection. The test verifies successful updates to user permissions, group access, and collection access, ensuring correct handling of shared and default collections.

* Refactor UpdateOrganizationUserCommand to separate the collection validation and DefaultUserCollection filtering

* Refactored integration test setup/assertion for clarity
This commit is contained in:
Rui Tomé
2025-08-07 11:12:45 +01:00
committed by GitHub
parent e61a5cc83a
commit 9d05105dc0
3 changed files with 174 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/UpdateOrganizationUserCommand.cs
View File

@@ -89,7 +89,7 @@ public class UpdateOrganizationUserCommand : IUpdateOrganizationUserCommand
if (collectionAccessList.Count != 0)
{
await ValidateCollectionAccessAsync(originalOrganizationUser, collectionAccessList);
collectionAccessList = await ValidateAccessAndFilterDefaultUserCollectionsAsync(originalOrganizationUser, collectionAccessList);
}
if (groupAccess?.Any() == true)
@@ -179,11 +179,19 @@ public class UpdateOrganizationUserCommand : IUpdateOrganizationUserCommand
throw new BadRequestException("User can only be an admin of one free organization.");
}
private async Task ValidateCollectionAccessAsync(OrganizationUser originalUser,
ICollection<CollectionAccessSelection> collectionAccess)
private async Task<List<CollectionAccessSelection>> ValidateAccessAndFilterDefaultUserCollectionsAsync(
OrganizationUser originalUser, List<CollectionAccessSelection> collectionAccess)
{
var collections = await _collectionRepository
.GetManyByManyIdsAsync(collectionAccess.Select(c => c.Id));
ValidateCollections(originalUser, collectionAccess, collections);
return ExcludeDefaultUserCollections(collectionAccess, collections);
}
private static void ValidateCollections(OrganizationUser originalUser, List<CollectionAccessSelection> collectionAccess, ICollection<Collection> collections)
{
var collectionIds = collections.Select(c => c.Id);
var missingCollection = collectionAccess
@@ -199,13 +207,14 @@ public class UpdateOrganizationUserCommand : IUpdateOrganizationUserCommand
// Use generic error message to avoid enumeration
throw new NotFoundException();
}
if (collections.Any(c => c.Type == CollectionType.DefaultUserCollection))
{
throw new BadRequestException("You cannot modify member access for collections with the type as DefaultUserCollection.");
}
}
private static List<CollectionAccessSelection> ExcludeDefaultUserCollections(
List<CollectionAccessSelection> collectionAccess, ICollection<Collection> collections) =>
collectionAccess
.Where(cas => collections.Any(c => c.Id == cas.Id && c.Type != CollectionType.DefaultUserCollection))
.ToList();
private async Task ValidateGroupAccessAsync(OrganizationUser originalUser,
ICollection<Guid> groupAccess)
{