vaultwarden
/
bitwarden-estensione-browser
mirror of https://github.com/bitwarden/browser
1
0
Fork 0
Code Issues 1 Releases Wiki Activity

[AC-1139] Flexible collections: deprecate Manage/Edit/Delete Assigned Collections custom permissions (#6906) 

* [AC-1139] Add new layout for MemberDialogComponent when FC feature flag is enabled

* [AC-1139] Deprecated Organization canEditAssignedCollections, canDeleteAssignedCollections, canViewAssignedCollections

* [AC-1139] Checking if FC feature flag is enabled when using canDeleteAssignedCollections or canViewAssignedCollections

* [AC-1139] Added missing parameter to customRedirect

* [AC-1139] Fixed canEdit permission

* [AC-1139] Fixed CanDelete logic

* [AC-1139] Changed canAccessVaultTab function to receive configService

* Override deprecated values on sync

* [AC-1139] Reverted change that introduced ConfigService as a parameter to canAccessVaultTab

* [AC-1139] Fixed circular dependency

* [AC-1139] Moved overriding of deprecated values to syncService

* Revert "[AC-1139] Fixed circular dependency"

This reverts commit 6484420976.

* Revert "Override deprecated values on sync"

This reverts commit f0c25a6996.

* [AC-1139] Added back the deprecation of methods canEditAssignedCollections, canDeleteAssignedCollections, canViewAssignedCollections

* [AC-1139] Reverted change on syncService

* [AC-1139] Override deprecated values on sync

* [AC-1139] Fix canDelete logic in
collection-dialog.component.ts and
bulk-delete-dialog.component.ts

* [AC-1139] Moved override logic from syncService to organizationService

* [AC-1139] Add ability to have titlecase titles on nested-checkbox.component checkboxes; use on member-dialog.component

* Revert "[AC-1139] Add ability to have titlecase titles on nested-checkbox.component checkboxes; use on member-dialog.component"

This reverts commit 9ede0fc5ac.

* [AC-1139] Fix bulk delete functionality

* [AC-1139] Refactor canEdit and canDelete to use ternary operator

* [AC-1139] Fix canDelete condition in VaultComponent

---------

Co-authored-by: Thomas Rittson <trittson@bitwarden.com>
Co-authored-by: Thomas Rittson <31796059+eliykat@users.noreply.github.com>
This commit is contained in:
Rui Tomé 2023-12-08 18:07:52 +00:00 committed by GitHub
parent 7c285c5990
commit 483a197e4d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
20 changed files with 305 additions and 118 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
apps/browser/src/background/main.background.ts
View File

@ -539,6 +539,7 @@ export default class MainBackground {
this.folderApiService,
this.organizationService,
this.sendApiService,
this.configService,
logoutCallback,
);
this.eventUploadService = new EventUploadService(

1
apps/cli/src/bw.ts
View File

@ -443,6 +443,7 @@ export class Main {
this.folderApiService,
this.organizationService,
this.sendApiService,
this.configService,
async (expired: boolean) => await this.logout(),
);

109
apps/web/src/app/admin-console/organizations/members/components/member-dialog/member-dialog.component.html
View File

@ -138,6 +138,7 @@
</div>
</fieldset>
<ng-container *ngIf="customUserTypeSelected">
<ng-container *ngIf="!(flexibleCollectionsEnabled$ | async); else customPermissionsFC">
<h3 class="mt-4 d-flex tw-font-semibold">
{{ "permissions" | i18n }}
</h3>
@ -256,6 +257,114 @@
</div>
</div>
</ng-container>
<ng-template #customPermissionsFC>
<div class="row" [formGroup]="permissionsGroup">
<div class="col-4">
<div>
<input
type="checkbox"
name="accessEventLogs"
id="accessEventLogs"
formControlName="accessEventLogs"
/>
<label class="!tw-font-normal" for="accessEventLogs">
{{ "accessEventLogs" | i18n }}
</label>
</div>
<div>
<input
type="checkbox"
name="accessImportExport"
id="accessImportExport"
formControlName="accessImportExport"
/>
<label class="!tw-font-normal" for="accessImportExport">
{{ "accessImportExport" | i18n }}
</label>
</div>
<div>
<input
type="checkbox"
name="accessReports"
id="accessReports"
formControlName="accessReports"
/>
<label class="!tw-font-normal" for="accessReports">
{{ "accessReports" | i18n }}
</label>
</div>
</div>
<div class="col-4">
<app-nested-checkbox
parentId="manageAllCollections"
[checkboxes]="permissionsGroup.controls.manageAllCollectionsGroup"
>
</app-nested-checkbox>
</div>
<div class="col-4">
<div class="mb-3">
<div>
<input
type="checkbox"
name="manageGroups"
id="manageGroups"
formControlName="manageGroups"
/>
<label class="!tw-font-normal" for="manageGroups">
{{ "manageGroups" | i18n }}
</label>
</div>
<div>
<input
type="checkbox"
name="manageSso"
id="manageSso"
formControlName="manageSso"
/>
<label class="!tw-font-normal" for="manageSso">
{{ "manageSso" | i18n }}
</label>
</div>
<div>
<input
type="checkbox"
name="managePolicies"
id="managePolicies"
formControlName="managePolicies"
/>
<label class="!tw-font-normal" for="managePolicies">
{{ "managePolicies" | i18n }}
</label>
</div>
<div>
<input
type="checkbox"
name="manageUsers"
id="manageUsers"
formControlName="manageUsers"
(change)="handleDependentPermissions()"
/>
<label class="!tw-font-normal" for="manageUsers">
{{ "manageUsers" | i18n }}
</label>
</div>
<div>
<input
type="checkbox"
name="manageResetPassword"
id="manageResetPassword"
formControlName="manageResetPassword"
(change)="handleDependentPermissions()"
/>
<label class="!tw-font-normal" for="manageResetPassword">
{{ "manageAccountRecovery" | i18n }}
</label>
</div>
</div>
</div>
</div>
</ng-template>
</ng-container>
<ng-container *ngIf="canUseSecretsManager">
<h3 class="mt-4">
{{ "secretsManager" | i18n }}

9
apps/web/src/app/billing/organizations/sm-subscribe-standalone.component.ts
View File

@ -9,6 +9,8 @@ import { Organization } from "@bitwarden/common/admin-console/models/domain/orga
import { SecretsManagerSubscribeRequest } from "@bitwarden/common/billing/models/request/sm-subscribe.request";
import { BillingCustomerDiscount } from "@bitwarden/common/billing/models/response/organization-subscription.response";
import { PlanResponse } from "@bitwarden/common/billing/models/response/plan.response";
import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
import { ConfigServiceAbstraction } from "@bitwarden/common/platform/abstractions/config/config.service.abstraction";
import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
@ -33,6 +35,7 @@ export class SecretsManagerSubscribeStandaloneComponent {
private i18nService: I18nService,
private organizationApiService: OrganizationApiServiceAbstraction,
private organizationService: InternalOrganizationServiceAbstraction,
private configService: ConfigServiceAbstraction,
) {}
submit = async () => {
@ -52,7 +55,11 @@ export class SecretsManagerSubscribeStandaloneComponent {
isMember: this.organization.isMember,
isProviderUser: this.organization.isProviderUser,
});
await this.organizationService.upsert(organizationData);
const flexibleCollectionsEnabled = await this.configService.getFeatureFlag(
FeatureFlag.FlexibleCollections,
false,
);
await this.organizationService.upsert(organizationData, flexibleCollectionsEnabled);
/*
Because subscribing to Secrets Manager automatically provides access to Secrets Manager for the

2
apps/web/src/app/vault/components/collection-dialog/collection-dialog.component.html
View File

@ -109,7 +109,7 @@
{{ "cancel" | i18n }}
</button>
<button
*ngIf="editMode && organization?.canDeleteAssignedCollections"
*ngIf="canDelete$ | async"
type="button"
bitIconButton="bwi-trash"
buttonType="danger"

7
apps/web/src/app/vault/components/collection-dialog/collection-dialog.component.ts
View File

@ -313,6 +313,13 @@ export class CollectionDialogComponent implements OnInit, OnDestroy {
this.close(CollectionDialogAction.Deleted, this.collection);
};
protected canDelete$ = this.flexibleCollectionsEnabled$.pipe(
map(
(flexibleCollectionsEnabled) =>
this.editMode && this.collection.canDelete(this.organization, flexibleCollectionsEnabled),
),
);
ngOnDestroy(): void {
this.destroy$.next();
this.destroy$.complete();

2
apps/web/src/app/vault/components/vault-items/vault-items.component.ts
View File

@ -106,7 +106,7 @@ export class VaultItemsComponent {
}
const organization = this.allOrganizations.find((o) => o.id === collection.organizationId);
return collection.canEdit(organization);
return collection.canEdit(organization, this.flexibleCollectionsEnabled);
}
protected canDeleteCollection(collection: CollectionView): boolean {

14
apps/web/src/app/vault/core/views/collection-admin.view.ts
View File

@ -31,15 +31,15 @@ export class CollectionAdminView extends CollectionView {
this.assigned = response.assigned;
}
override canEdit(org: Organization): boolean {
return org?.canEditAnyCollection || (org?.canEditAssignedCollections && this.assigned);
override canEdit(org: Organization, flexibleCollectionsEnabled: boolean): boolean {
return flexibleCollectionsEnabled
? org?.canEditAnyCollection
: org?.canEditAnyCollection || (org?.canEditAssignedCollections && this.assigned);
}
override canDelete(org: Organization, flexibleCollectionsEnabled: boolean): boolean {
if (flexibleCollectionsEnabled) {
return org?.canDeleteAnyCollection;
} else {
return org?.canDeleteAnyCollection || (org?.canDeleteAssignedCollections && this.assigned);
}
return flexibleCollectionsEnabled
? org?.canDeleteAnyCollection
: org?.canDeleteAnyCollection || (org?.canDeleteAssignedCollections && this.assigned);
}
}

19
apps/web/src/app/vault/individual-vault/bulk-action-dialogs/bulk-delete-dialog/bulk-delete-dialog.component.ts
View File

@ -3,6 +3,8 @@ import { Component, Inject } from "@angular/core";
import { ApiService } from "@bitwarden/common/abstractions/api.service";
import { Organization } from "@bitwarden/common/admin-console/models/domain/organization";
import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
import { ConfigServiceAbstraction } from "@bitwarden/common/platform/abstractions/config/config.service.abstraction";
import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
@ -59,6 +61,7 @@ export class BulkDeleteDialogComponent {
private i18nService: I18nService,
private apiService: ApiService,
private collectionService: CollectionService,
private configService: ConfigServiceAbstraction,
) {
this.cipherIds = params.cipherIds ?? [];
this.collectionIds = params.collectionIds ?? [];
@ -125,11 +128,14 @@ export class BulkDeleteDialogComponent {
}
private async deleteCollections(): Promise<any> {
const flexibleCollectionsEnabled = await this.configService.getFeatureFlag(
FeatureFlag.FlexibleCollections,
false,
);
// From org vault
if (this.organization) {
if (
!this.organization.canDeleteAssignedCollections &&
!this.organization.canDeleteAnyCollection
this.collections.some((c) => !c.canDelete(this.organization, flexibleCollectionsEnabled))
) {
this.platformUtilsService.showToast(
"error",
@ -143,7 +149,8 @@ export class BulkDeleteDialogComponent {
} else if (this.organizations && this.collections) {
const deletePromises: Promise<any>[] = [];
for (const organization of this.organizations) {
if (!organization.canDeleteAssignedCollections && !organization.canDeleteAnyCollection) {
const orgCollections = this.collections.filter((o) => o.organizationId === organization.id);
if (orgCollections.some((c) => !c.canDelete(organization, flexibleCollectionsEnabled))) {
this.platformUtilsService.showToast(
"error",
this.i18nService.t("errorOccurred"),
@ -151,11 +158,9 @@ export class BulkDeleteDialogComponent {
);
return;
}
const orgCollections = this.collections
.filter((o) => o.organizationId === organization.id)
.map((c) => c.id);
const orgCollectionIds = orgCollections.map((c) => c.id);
deletePromises.push(
this.apiService.deleteManyCollections(this.organization.id, orgCollections),
this.apiService.deleteManyCollections(this.organization.id, orgCollectionIds),
);
}
return await Promise.all(deletePromises);

2
apps/web/src/app/vault/individual-vault/vault-header/vault-header.component.ts
View File

@ -146,7 +146,7 @@ export class VaultHeaderComponent {
const organization = this.organizations.find(
(o) => o.id === this.collection?.node.organizationId,
);
return this.collection.node.canEdit(organization);
return this.collection.node.canEdit(organization, this.flexibleCollectionsEnabled);
}
async editCollection(tab: CollectionDialogTabType): Promise<void> {

6
apps/web/src/app/vault/individual-vault/vault.component.ts
View File

@ -688,7 +688,11 @@ export class VaultComponent implements OnInit, OnDestroy {
async deleteCollection(collection: CollectionView): Promise<void> {
const organization = this.organizationService.get(collection.organizationId);
if (!organization.canDeleteAssignedCollections && !organization.canDeleteAnyCollection) {
const flexibleCollectionsEnabled = await this.configService.getFeatureFlag(
FeatureFlag.FlexibleCollections,
false,
);
if (!collection.canDelete(organization, flexibleCollectionsEnabled)) {
this.platformUtilsService.showToast(
"error",
this.i18nService.t("errorOccurred"),

2
apps/web/src/app/vault/org-vault/vault-header/vault-header.component.ts
View File

@ -152,7 +152,7 @@ export class VaultHeaderComponent {
}
// Otherwise, check if we can edit the specified collection
return this.collection.node.canEdit(this.organization);
return this.collection.node.canEdit(this.organization, this.flexibleCollectionsEnabled);
}
addCipher() {

10
apps/web/src/app/vault/org-vault/vault.component.ts
View File

@ -132,6 +132,7 @@ export class VaultComponent implements OnInit, OnDestroy {
FeatureFlag.BulkCollectionAccess,
false,
);
protected flexibleCollectionsEnabled: boolean;
private searchText$ = new Subject<string>();
private refresh$ = new BehaviorSubject<void>(null);
@ -750,10 +751,11 @@ export class VaultComponent implements OnInit, OnDestroy {
}
async deleteCollection(collection: CollectionView): Promise<void> {
if (
!this.organization.canDeleteAssignedCollections &&
!this.organization.canDeleteAnyCollection
) {
const flexibleCollectionsEnabled = await this.configService.getFeatureFlag(
FeatureFlag.FlexibleCollections,
false,
);
if (!collection.canDelete(this.organization, flexibleCollectionsEnabled)) {
this.platformUtilsService.showToast(
"error",
this.i18nService.t("errorOccurred"),

1
libs/angular/src/services/jslib-services.module.ts
View File

@ -459,6 +459,7 @@ import { ModalService } from "./modal.service";
FolderApiServiceAbstraction,
OrganizationServiceAbstraction,
SendApiServiceAbstraction,
ConfigServiceAbstraction,
LOGOUT_CALLBACK,
],
},

10
libs/common/src/admin-console/abstractions/organization/organization.service.abstraction.ts
View File

@ -95,6 +95,12 @@ export abstract class OrganizationService {
}
export abstract class InternalOrganizationServiceAbstraction extends OrganizationService {
replace: (organizations: { [id: string]: OrganizationData }) => Promise<void>;
upsert: (OrganizationData: OrganizationData | OrganizationData[]) => Promise<void>;
replace: (
organizations: { [id: string]: OrganizationData },
flexibleCollectionsEnabled: boolean,
) => Promise<void>;
upsert: (
OrganizationData: OrganizationData | OrganizationData[],
flexibleCollectionsEnabled: boolean,
) => Promise<void>;
}

15
libs/common/src/admin-console/models/domain/organization.ts
View File

@ -186,14 +186,29 @@ export class Organization {
return this.canEditAnyCollection || this.canDeleteAnyCollection;
}
/**
* @deprecated
* This is deprecated with the introduction of Flexible Collections.
* This will always return false if FlexibleCollections flag is on.
*/
get canEditAssignedCollections() {
return this.isManager || this.permissions.editAssignedCollections;
}
/**
* @deprecated
* This is deprecated with the introduction of Flexible Collections.
* This will always return false if FlexibleCollections flag is on.
*/
get canDeleteAssignedCollections() {
return this.isManager || this.permissions.deleteAssignedCollections;
}
/**
* @deprecated
* This is deprecated with the introduction of Flexible Collections.
* This will always return false if FlexibleCollections flag is on.
*/
get canViewAssignedCollections() {
return this.canDeleteAssignedCollections || this.canEditAssignedCollections;
}

6
libs/common/src/admin-console/services/organization/organization.service.spec.ts
View File

@ -110,7 +110,7 @@ describe("Organization Service", () => {
});
it("upsert", async () => {
await organizationService.upsert(organizationData("2", "Test 2"));
await organizationService.upsert(organizationData("2", "Test 2"), false);
expect(await firstValueFrom(organizationService.organizations$)).toEqual([
{
@ -146,7 +146,7 @@ describe("Organization Service", () => {
describe("delete", () => {
it("exists", async () => {
await organizationService.delete("1");
await organizationService.delete("1", false);
expect(stateService.getOrganizations).toHaveBeenCalledTimes(2);
@ -154,7 +154,7 @@ describe("Organization Service", () => {
});
it("does not exist", async () => {
organizationService.delete("1");
organizationService.delete("1", false);
expect(stateService.getOrganizations).toHaveBeenCalledTimes(2);
});

28
libs/common/src/admin-console/services/organization/organization.service.ts
View File

@ -5,6 +5,7 @@ import {
InternalOrganizationServiceAbstraction,
isMember,
} from "../../abstractions/organization/organization.service.abstraction";
import { OrganizationUserType } from "../../enums";
import { OrganizationData } from "../../models/data/organization.data";
import { Organization } from "../../models/domain/organization";
@ -51,7 +52,7 @@ export class OrganizationService implements InternalOrganizationServiceAbstracti
return organizations.length > 0;
}
async upsert(organization: OrganizationData): Promise<void> {
async upsert(organization: OrganizationData, flexibleCollectionsEnabled: boolean): Promise<void> {
let organizations = await this.stateService.getOrganizations();
if (organizations == null) {
organizations = {};
@ -59,10 +60,10 @@ export class OrganizationService implements InternalOrganizationServiceAbstracti
organizations[organization.id] = organization;
await this.replace(organizations);
await this.replace(organizations, flexibleCollectionsEnabled);
}
async delete(id: string): Promise<void> {
async delete(id: string, flexibleCollectionsEnabled: boolean): Promise<void> {
const organizations = await this.stateService.getOrganizations();
if (organizations == null) {
return;
@ -73,7 +74,7 @@ export class OrganizationService implements InternalOrganizationServiceAbstracti
}
delete organizations[id];
await this.replace(organizations);
await this.replace(organizations, flexibleCollectionsEnabled);
}
get(id: string): Organization {
@ -102,7 +103,24 @@ export class OrganizationService implements InternalOrganizationServiceAbstracti
return organizations.find((organization) => organization.identifier === identifier);
}
async replace(organizations: { [id: string]: OrganizationData }) {
async replace(
organizations: { [id: string]: OrganizationData },
flexibleCollectionsEnabled: boolean,
) {
// If Flexible Collections is enabled, treat Managers as Users and ignore deprecated permissions
if (flexibleCollectionsEnabled) {
Object.values(organizations).forEach((o) => {
if (o.type === OrganizationUserType.Manager) {
o.type = OrganizationUserType.User;
}
if (o.permissions != null) {
o.permissions.editAssignedCollections = false;
o.permissions.deleteAssignedCollections = false;
}
});
}
await this.stateService.setOrganizations(organizations);
this.updateObservables(organizations);
}

15
libs/common/src/vault/models/view/collection.view.ts
View File

@ -32,13 +32,16 @@ export class CollectionView implements View, ITreeNodeObject {
}
// For editing collection details, not the items within it.
canEdit(org: Organization): boolean {
canEdit(org: Organization, flexibleCollectionsEnabled: boolean): boolean {
if (org.id !== this.organizationId) {
throw new Error(
"Id of the organization provided does not match the org id of the collection.",
);
}
return org?.canEditAnyCollection || org?.canEditAssignedCollections;
return flexibleCollectionsEnabled
? org?.canEditAnyCollection || this.manage
: org?.canEditAnyCollection || org?.canEditAssignedCollections;
}
// For deleting a collection, not the items within it.
@ -49,10 +52,8 @@ export class CollectionView implements View, ITreeNodeObject {
);
}
if (flexibleCollectionsEnabled) {
return org?.canDeleteAnyCollection || (!org?.limitCollectionCreationDeletion && this.manage);
} else {
return org?.canDeleteAnyCollection || org?.canDeleteAssignedCollections;
}
return flexibleCollectionsEnabled
? org?.canDeleteAnyCollection || (!org?.limitCollectionCreationDeletion && this.manage)
: org?.canDeleteAnyCollection || org?.canDeleteAssignedCollections;
}
}

16
libs/common/src/vault/services/sync/sync.service.ts
View File

@ -10,6 +10,7 @@ import { ProviderData } from "../../../admin-console/models/data/provider.data";
import { PolicyResponse } from "../../../admin-console/models/response/policy.response";
import { KeyConnectorService } from "../../../auth/abstractions/key-connector.service";
import { ForceSetPasswordReason } from "../../../auth/models/domain/force-set-password-reason";
import { FeatureFlag } from "../../../enums/feature-flag.enum";
import { DomainsResponse } from "../../../models/response/domains.response";
import {
SyncCipherNotification,
@ -17,6 +18,7 @@ import {
SyncSendNotification,
} from "../../../models/response/notification.response";
import { ProfileResponse } from "../../../models/response/profile.response";
import { ConfigServiceAbstraction } from "../../../platform/abstractions/config/config.service.abstraction";
import { CryptoService } from "../../../platform/abstractions/crypto.service";
import { LogService } from "../../../platform/abstractions/log.service";
import { MessagingService } from "../../../platform/abstractions/messaging.service";
@ -59,6 +61,7 @@ export class SyncService implements SyncServiceAbstraction {
private folderApiService: FolderApiServiceAbstraction,
private organizationService: InternalOrganizationServiceAbstraction,
private sendApiService: SendApiService,
private configService: ConfigServiceAbstraction,
private logoutCallback: (expired: boolean) => Promise<void>,
) {}
@ -318,7 +321,11 @@ export class SyncService implements SyncServiceAbstraction {
await this.setForceSetPasswordReasonIfNeeded(response);
await this.syncProfileOrganizations(response);
const flexibleCollectionsEnabled = await this.configService.getFeatureFlag(
FeatureFlag.FlexibleCollections,
false,
);
await this.syncProfileOrganizations(response, flexibleCollectionsEnabled);
const providers: { [id: string]: ProviderData } = {};
response.providers.forEach((p) => {
@ -374,7 +381,10 @@ export class SyncService implements SyncServiceAbstraction {
}
}
private async syncProfileOrganizations(response: ProfileResponse) {
private async syncProfileOrganizations(
response: ProfileResponse,
flexibleCollectionsEnabled: boolean,
) {
const organizations: { [id: string]: OrganizationData } = {};
response.organizations.forEach((o) => {
organizations[o.id] = new OrganizationData(o, {
@ -394,7 +404,7 @@ export class SyncService implements SyncServiceAbstraction {
}
});
await this.organizationService.replace(organizations);
await this.organizationService.replace(organizations, flexibleCollectionsEnabled);
}
private async syncFolders(response: FolderResponse[]) {