1
0
mirror of https://github.com/bitwarden/server synced 2025-12-26 13:13:24 +00:00
Files
server/src/Sql/dbo/Stored Procedures/Collection_UpdateWithUsers.sql
Jared McCannon de504d800b [PM-24055] - Collection Users and Groups null on Public response (#6713)
* Integration test around getting and saving collection with group/user permissions

* This adds groups to the collections returned.

* Added new stored procedures so we don't accidentally wipe out access due to null parameters.

* wrapping all calls in transaction in the event that there is an error.
2025-12-17 11:34:17 -06:00

75 lines
1.9 KiB
Transact-SQL

CREATE PROCEDURE [dbo].[Collection_UpdateWithUsers]
@Id UNIQUEIDENTIFIER,
@OrganizationId UNIQUEIDENTIFIER,
@Name VARCHAR(MAX),
@ExternalId NVARCHAR(300),
@CreationDate DATETIME2(7),
@RevisionDate DATETIME2(7),
@Users AS [dbo].[CollectionAccessSelectionType] READONLY,
@DefaultUserCollectionEmail NVARCHAR(256) = NULL,
@Type TINYINT = 0
AS
BEGIN
SET NOCOUNT ON
EXEC [dbo].[Collection_Update] @Id, @OrganizationId, @Name, @ExternalId, @CreationDate, @RevisionDate, @DefaultUserCollectionEmail, @Type
-- Users
-- Delete users that are no longer in source
DELETE
cu
FROM
[dbo].[CollectionUser] cu
LEFT JOIN
@Users u ON cu.OrganizationUserId = u.Id
WHERE
cu.CollectionId = @Id
AND u.Id IS NULL;
-- Update existing users
UPDATE
cu
SET
cu.ReadOnly = u.ReadOnly,
cu.HidePasswords = u.HidePasswords,
cu.Manage = u.Manage
FROM
[dbo].[CollectionUser] cu
INNER JOIN
@Users u ON cu.OrganizationUserId = u.Id
WHERE
cu.CollectionId = @Id
AND (
cu.ReadOnly != u.ReadOnly
OR cu.HidePasswords != u.HidePasswords
OR cu.Manage != u.Manage
);
-- Insert new users
INSERT INTO [dbo].[CollectionUser]
(
[CollectionId],
[OrganizationUserId],
[ReadOnly],
[HidePasswords],
[Manage]
)
SELECT
@Id,
u.Id,
u.ReadOnly,
u.HidePasswords,
u.Manage
FROM
@Users u
INNER JOIN
[dbo].[OrganizationUser] ou ON ou.Id = u.Id
LEFT JOIN
[dbo].[CollectionUser] cu ON cu.CollectionId = @Id AND cu.OrganizationUserId = u.Id
WHERE
ou.OrganizationId = @OrganizationId
AND cu.CollectionId IS NULL;
EXEC [dbo].[User_BumpAccountRevisionDateByCollectionId] @Id, @OrganizationId
END