Browse Source
* SqlServer split manage collection permission * Clarify names * Test claims generation * Test permission serialization * Simplify claims building * Use new collections permissions * Throw on use of deprecated permissions * Lower case all claims * Remove todos * Clean nonexistent project from test solution * JsonIgnore for both system and newtonsoft json * Make migrations more robust to multiple runs * remove duplicate usings * Remove obsolete permissions * Test solutions separately to detect failures * Handle dos line endings * Fix collections create/update permissions * Change restore cipher to edit permissions * Improve formatting * Simplify map * Refactor testpull/1619/head
Matt Gibson
4 years ago
committed by
GitHub
25 changed files with 3638 additions and 128 deletions
@ -0,0 +1,56 @@
@@ -0,0 +1,56 @@
|
||||
using System; |
||||
using System.Text.Json; |
||||
using AutoFixture.Xunit2; |
||||
using Bit.Core.Models.Data; |
||||
using Bit.Core.Models.Table; |
||||
using Bit.Core.Utilities; |
||||
using Newtonsoft.Json; |
||||
using Newtonsoft.Json.Serialization; |
||||
using Xunit; |
||||
|
||||
namespace Bit.Core.Test.Models |
||||
{ |
||||
public class PermissionsTests |
||||
{ |
||||
private static readonly string _exampleSerializedPermissions = string.Concat( |
||||
"{", |
||||
"\"accessBusinessPortal\": false,", |
||||
"\"accessEventLogs\": false,", |
||||
"\"accessImportExport\": false,", |
||||
"\"accessReports\": false,", |
||||
"\"manageAllCollections\": true,", // exists for backwards compatibility |
||||
"\"createNewCollections\": true,", |
||||
"\"editAnyCollection\": true,", |
||||
"\"deleteAnyCollection\": true,", |
||||
"\"manageAssignedCollections\": false,", // exists for backwards compatibility |
||||
"\"editAssignedCollections\": false,", |
||||
"\"deleteAssignedCollections\": false,", |
||||
"\"manageGroups\": false,", |
||||
"\"managePolicies\": false,", |
||||
"\"manageSso\": false,", |
||||
"\"manageUsers\": false,", |
||||
"\"manageResetPassword\": false", |
||||
"}"); |
||||
|
||||
[Fact] |
||||
public void Serialization_Success() |
||||
{ |
||||
// minify expected json |
||||
var expected = JsonConvert.SerializeObject(JsonConvert.DeserializeObject(_exampleSerializedPermissions)); |
||||
|
||||
DefaultContractResolver contractResolver = new DefaultContractResolver |
||||
{ |
||||
NamingStrategy = new CamelCaseNamingStrategy() |
||||
}; |
||||
|
||||
var actual = JsonConvert.SerializeObject( |
||||
CoreHelpers.LoadClassFromJsonData<Permissions>(_exampleSerializedPermissions), new JsonSerializerSettings |
||||
{ |
||||
ContractResolver = contractResolver, |
||||
}); |
||||
|
||||
Console.WriteLine(actual); |
||||
Assert.Equal(expected, actual); |
||||
} |
||||
} |
||||
} |
||||
@ -0,0 +1 @@
@@ -0,0 +1 @@
|
||||
Contents of embeddedResource.txt |
||||
@ -0,0 +1,64 @@
@@ -0,0 +1,64 @@
|
||||
-- Split Manage Assigned Collections into edit and delete |
||||
UPDATE [vault_dev].[dbo].[OrganizationUser] |
||||
SET [Permissions] = |
||||
JSON_MODIFY( |
||||
JSON_MODIFY( |
||||
[Permissions], |
||||
'$.editAssignedCollections', |
||||
CAST(ISNULL( |
||||
ISNULL( |
||||
JSON_VALUE([Permissions], '$.editAssignedCollections'), |
||||
JSON_VALUE([Permissions], '$.manageAssignedCollections') |
||||
), |
||||
0) AS BIT) |
||||
), |
||||
'$.deleteAssignedCollections', |
||||
CAST(ISNULL( |
||||
ISNULL( |
||||
JSON_VALUE([Permissions], '$.deleteAssignedCollections'), |
||||
JSON_VALUE([Permissions], '$.manageAssignedCollections')), |
||||
0) AS BIT) |
||||
) |
||||
WHERE [Permissions] IS NOT NULL |
||||
AND ISJSON([Permissions]) > 0 |
||||
AND ( |
||||
JSON_VALUE([Permissions], '$.editAssignedCollections') IS NULL |
||||
OR JSON_VALUE([Permissions], '$.deleteAssignedCollections') IS NULL |
||||
) |
||||
|
||||
-- Split Manage All Collections into create, edit, and delete |
||||
UPDATE [vault_dev].[dbo].[OrganizationUser] |
||||
SET [Permissions] = |
||||
JSON_MODIFY( |
||||
JSON_MODIFY( |
||||
JSON_MODIFY( |
||||
[Permissions], |
||||
'$.createNewCollections', |
||||
CAST(ISNULL( |
||||
ISNULL( |
||||
JSON_VALUE([Permissions], '$.createNewCollections'), |
||||
JSON_VALUE([Permissions], '$.manageAllCollections')), |
||||
0) AS BIT) |
||||
), |
||||
'$.editAnyCollection', |
||||
CAST(ISNULL( |
||||
ISNULL( |
||||
JSON_VALUE([Permissions], '$.editAnyCollection'), |
||||
JSON_VALUE([Permissions], '$.manageAllCollections')), |
||||
0) AS BIT) |
||||
), |
||||
'$.deleteAnyCollection', |
||||
CAST(ISNULL( |
||||
ISNULL( |
||||
JSON_VALUE([Permissions], '$.deleteAnyCollection'), |
||||
JSON_VALUE([Permissions], '$.manageAllCollections')), |
||||
0) AS BIT) |
||||
) |
||||
WHERE [Permissions] IS NOT NULL |
||||
AND ISJSON([Permissions]) > 0 |
||||
AND ( |
||||
JSON_VALUE([Permissions], '$.createNewCollections') IS NULL |
||||
OR JSON_VALUE([Permissions], '$.editAnyCollection') IS NULL |
||||
OR JSON_VALUE([Permissions], '$.deleteAnyCollection') IS NULL |
||||
) |
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,22 @@
@@ -0,0 +1,22 @@
|
||||
using System; |
||||
using Bit.Core.Utilities; |
||||
using Microsoft.EntityFrameworkCore.Migrations; |
||||
|
||||
namespace Bit.MySqlMigrations.Migrations |
||||
{ |
||||
public partial class SplitManageCollectionsPermissions : Migration |
||||
{ |
||||
private const string _scriptLocation = |
||||
"MySqlMigrations.Scripts.2021-09-21_00_SplitManageCollectionsPermission.sql"; |
||||
|
||||
protected override void Up(MigrationBuilder migrationBuilder) |
||||
{ |
||||
migrationBuilder.Sql(CoreHelpers.GetEmbeddedResourceContentsAsync(_scriptLocation)); |
||||
} |
||||
|
||||
protected override void Down(MigrationBuilder migrationBuilder) |
||||
{ |
||||
throw new Exception("Irreversible migration"); |
||||
} |
||||
} |
||||
} |
||||
@ -0,0 +1,56 @@
@@ -0,0 +1,56 @@
|
||||
-- Split Manage Assigned Collections into edit and delete |
||||
UPDATE `bw-vault`.`OrganizationUser` |
||||
SET `Permissions` = |
||||
JSON_INSERT( |
||||
`Permissions`, |
||||
'$.editAssignedCollections', |
||||
IFNULL( |
||||
IFNULL( |
||||
JSON_EXTRACT(`Permissions`,'$.editAssignedCollections'), |
||||
JSON_EXTRACT(`Permissions`, '$.manageAssignedCollections')), |
||||
false), |
||||
'$.deleteAssignedCollections', |
||||
IFNULL( |
||||
IFNULL( |
||||
JSON_EXTRACT(`Permissions`, '$.deleteAssignedCollections'), |
||||
JSON_EXTRACT(`Permissions`, '$.manageAssignedCollections')), |
||||
false) |
||||
) |
||||
WHERE `Permissions` IS NOT NULL |
||||
AND JSON_VALID(`Permissions`) > 0 |
||||
AND ( |
||||
JSON_EXTRACT(`Permissions`, '$.editAssignedCollections') IS NULL |
||||
OR JSON_EXTRACT(`Permissions`, '$.deleteAssignedCollections') IS NULL |
||||
); |
||||
|
||||
-- Split Manage All Collections into create, edit, and delete |
||||
UPDATE `bw-vault`.`OrganizationUser` |
||||
SET `Permissions` = |
||||
JSON_INSERT( |
||||
`Permissions`, |
||||
'$.createNewCollections', |
||||
IFNULL( |
||||
IFNULL( |
||||
JSON_EXTRACT(`Permissions`, '$.createNewColletions'), |
||||
JSON_EXTRACT(`Permissions`, '$.manageAllCollections')), |
||||
false), |
||||
'$.editAnyCollection', |
||||
IFNULL( |
||||
IFNULL( |
||||
JSON_EXTRACT(`Permissions`, '$.editAnyCollection'), |
||||
JSON_EXTRACT(`Permissions`, '$.manageAllCollections')), |
||||
false), |
||||
'$.deleteAnyCollection', |
||||
IFNULL( |
||||
IFNULL( |
||||
JSON_EXTRACT(`Permissions`, '$.deleteAnyCollection'), |
||||
JSON_EXTRACT(`Permissions`, '$.manageAllCollections')), |
||||
false) |
||||
) |
||||
WHERE `Permissions` IS NOT NULL |
||||
AND JSON_VALID(`Permissions`) > 0 |
||||
AND ( |
||||
JSON_EXTRACT(`Permissions`, '$.createNewCollections') IS NULL |
||||
OR JSON_EXTRACT(`Permissions`, '$.editAnyCollection') IS NULL |
||||
OR JSON_EXTRACT(`Permissions`, '$.deleteAnyCollection') IS NULL |
||||
); |
||||
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,22 @@
@@ -0,0 +1,22 @@
|
||||
using System; |
||||
using Bit.Core.Utilities; |
||||
using Microsoft.EntityFrameworkCore.Migrations; |
||||
|
||||
namespace Bit.PostgresMigrations.Migrations |
||||
{ |
||||
public partial class SplitManageCollectionsPermissions : Migration |
||||
{ |
||||
private const string _scriptLocation = |
||||
"PostgresMigration.Scripts.2021-09-21_00_SplitManageCollectionsPermission.psql"; |
||||
|
||||
protected override void Up(MigrationBuilder migrationBuilder) |
||||
{ |
||||
migrationBuilder.Sql(CoreHelpers.GetEmbeddedResourceContentsAsync(_scriptLocation)); |
||||
} |
||||
|
||||
protected override void Down(MigrationBuilder migrationBuilder) |
||||
{ |
||||
throw new Exception("Irreversible migration"); |
||||
} |
||||
} |
||||
} |
||||
@ -0,0 +1,42 @@
@@ -0,0 +1,42 @@
|
||||
CREATE OR REPLACE FUNCTION updatePermissionsJson(permissions jsonb) returns jsonb LANGUAGE plpgsql AS $$ |
||||
DECLARE manageAllCollections jsonb := COALESCE(jsonb_extract_path(permissions, 'manageAllCollections'), 'false'); |
||||
DECLARE manageAssignedCollections jsonb := COALESCE(jsonb_extract_path(permissions, 'manageAssignedCollections'), 'false'); |
||||
|
||||
DECLARE createNewCollections jsonb := COALESCE(jsonb_extract_path(permissions, 'createNewCollections'), manageAllCollections); |
||||
DECLARE editAnyCollection jsonb := COALESCE(jsonb_extract_path(permissions, 'editAnyCollection'), manageAllCollections); |
||||
DECLARE deleteAnyCollection jsonb := COALESCE(jsonb_extract_path(permissions, 'deleteAnyCollection'), manageAllCollections); |
||||
|
||||
DECLARE editAssignedCollections jsonb := COALESCE(jsonb_extract_path(permissions, 'editAssignedCollections'), manageAssignedCollections); |
||||
DECLARE deleteAssignedCollections jsonb := COALESCE(jsonb_extract_path(permissions, 'deleteAssignedCollections'), manageAssignedCollections); |
||||
|
||||
BEGIN |
||||
RETURN |
||||
jsonb_set( |
||||
jsonb_set( |
||||
jsonb_set( |
||||
jsonb_set( |
||||
jsonb_set( |
||||
permissions, |
||||
'{createNewCollections}', |
||||
createNewCollections |
||||
), |
||||
'{editAnyCollection}', |
||||
editAnyCollection |
||||
), |
||||
'{deleteAnyCollection}', |
||||
deleteAnyCollection |
||||
), |
||||
'{editAssignedCollections}', |
||||
editAssignedCollections |
||||
), |
||||
'{deleteAssignedCollections}', |
||||
deleteAssignedCollections |
||||
); |
||||
END |
||||
$$; |
||||
|
||||
UPDATE public."OrganizationUser" |
||||
SET "Permissions" = updatePermissionsJson("Permissions"::jsonb)::text |
||||
WHERE "Permissions" IS NOT NULL; |
||||
|
||||
DROP FUNCTION updatePermissionsJson(jsonb); |
||||
Loading…
Reference in new issue