From f82f9ba0d09ffd95218b3a1f3b39a5b477d44c78 Mon Sep 17 00:00:00 2001 From: Shane Melton Date: Mon, 27 Nov 2023 11:44:15 -0800 Subject: [PATCH] [AC-1122] Add new admin access to all collections and items settings (#6703) * [AC-1117] Add manage permission (#5910) * Add 'manage' option to collection access permissions * Add 'manage' to collection permissions * remove service accidentally committed from another branch * Update CLI commands * update message casing to be consistent * access selector model updates * [AC-1374] Limit collection create/delete (#5963) * feat: udate request/response/data/domain models for new column, refs AC-1374 * feat: create collection management ui, refs AC-1374 * fix: remove limitCollectionCdOwnerAdmin boolean from org update request, refs AC-1374 * fix: moved collection management UI, removed comments, refs AC-1374 * fix: observable chaining now properly calls API when local org updated, refs AC-1374 * fix: remove unused form template variables, refs AC-1374 * fix: clean up observable chain, refs AC-1374 * fix: remove parent.parent route, refs AC-1374 * fix: add cd explaination, refs AC-1374 * [AC-1649] Remove organizationId from collection-bulk-delete.request (#6343) * refactor: remove organizationId from collection-bulk-delete-request, refs AC-1649 * refactor: remove request model from dialog component, refs AC-1649 * [AC-1174] Bulk collection management (#6133) * [AC-1174] Add bulk edit collection access event type * [AC-1174] Add bulk edit collection access menu option * [AC-1174] Add initial bulk collections access dialog * [AC-1174] Add logic to open bulk edit collections dialog * [AC-1174] Move AccessItemView helper methods to access selector model to be shared * [AC-1174] Add access selector to bulk collections dialog * [AC-1174] Add bulk assign access method to collection-admin service * [AC-1174] Introduce strongly typed BulkCollectionAccessRequest model * [AC-1174] Update vault item event type name * Update DialogService dependency --------- Co-authored-by: Thomas Rittson * Rename LimitCollectionCdOwnerAdmin -> LimitCollectionCreationDeletion (#6409) * Add manage property to synced Collection data * Revert "Add manage property to synced Collection data" Pushed to feature branch instead of a new one This reverts commit 65cd39589cbeca154e0d469be46c006ba4fab0d7. * Add manage property to synced Collection data * Revert "Add manage property to synced Collection data" This reverts commit f7fa30b79a83a0193398e31bf353b41985b41e23. * [AC-1680] Add manage property to collection view and response models (#6417) * Add manage property to synced Collection data * Update tests * feat: add LimitCollectionCreationDeletion conditional to canCreateNewCollections logic, refs AC-1659 (#6429) * [AC-1669] Enforce Can Manage permission on Collection dialog (#6493) * [AC-1669] Cleanup unhandled promise warnings * [AC-1669] Force change detection to ensure AccessSelector has the most recent items * [AC-1669] Initially select acting member when creating a new collection * [AC-1669] Add validator to ensure manage permission is selected * [AC-1669] Update error toast logic to support access tab errors * [AC-1669] Add error icon * [AC-1713] [Flexible collections] Add feature flags to clients (#6486) * Add FlexibleCollections and BulkCollectionAccess flags * Flag Collection Management settings * Flag bulk collection access dialog * Flag collection access modal changes * [AC-1662] Add LimitCollecitonCreationDeletion conditional to CanDelete logic (#6526) * feat: implement limitCollectionCreationDeletion into canDelete logic, refs AC-1662 * feat: make canDelete functions backwards compatible with feature flag, refs AC-1662 * feat: update vault-items.component for async getter, refs AC-1662 * feat: update configService injection, refs AC-1662 * feat: add config service to canDelete reference, refs AC-1662 * fix: remove configservice dependency from views, refs AC-1757 (#6686) * Add missing provider to vault-items.stories (#6690) * [AC-1730] Add new AllowAdminAccessToAllCollectionItems setting to org response models * [AC-1730] Add new AllowAdminAccessToAllCollectionItems setting to org request model * [AC-1730] Add new collection setting to UI and include it when submitting * [AC-1122] Add V1 feature flag * [AC-1122] Hide new setting behind V1 feature flag * [AC-1122] Add support for disabled form control --------- Co-authored-by: Robyn MacCallum Co-authored-by: Vincent Salucci <26154748+vincentsalucci@users.noreply.github.com> Co-authored-by: Vincent Salucci Co-authored-by: Thomas Rittson <31796059+eliykat@users.noreply.github.com> Co-authored-by: Thomas Rittson --- .../settings/account.component.html | 6 +++++- .../organizations/settings/account.component.ts | 16 ++++++++++++++-- apps/web/src/locales/en/messages.json | 3 +++ ...ation-collection-management-update.request.ts | 1 + .../models/response/organization.response.ts | 4 ++++ .../response/profile-organization.response.ts | 4 ++++ libs/common/src/enums/feature-flag.enum.ts | 1 + 7 files changed, 32 insertions(+), 3 deletions(-) diff --git a/apps/web/src/app/admin-console/organizations/settings/account.component.html b/apps/web/src/app/admin-console/organizations/settings/account.component.html index c2462acf9d..300d8003a1 100644 --- a/apps/web/src/app/admin-console/organizations/settings/account.component.html +++ b/apps/web/src/app/admin-console/organizations/settings/account.component.html @@ -53,12 +53,16 @@

{{ "collectionManagement" | i18n }}

{{ "collectionManagementDesc" | i18n }}

+ + {{ "allowAdminAccessToAllCollectionItemsDesc" | i18n }} + + {{ "limitCollectionCreationDeletionDesc" | i18n }} diff --git a/apps/web/src/app/admin-console/organizations/settings/account.component.ts b/apps/web/src/app/admin-console/organizations/settings/account.component.ts index 798895259e..3bd76aa812 100644 --- a/apps/web/src/app/admin-console/organizations/settings/account.component.ts +++ b/apps/web/src/app/admin-console/organizations/settings/account.component.ts @@ -1,7 +1,7 @@ import { Component, ViewChild, ViewContainerRef } from "@angular/core"; import { FormBuilder, Validators } from "@angular/forms"; import { ActivatedRoute, Router } from "@angular/router"; -import { combineLatest, lastValueFrom, Subject, switchMap, takeUntil, from, of } from "rxjs"; +import { combineLatest, from, lastValueFrom, of, Subject, switchMap, takeUntil } from "rxjs"; import { ModalService } from "@bitwarden/angular/services/modal.service"; import { OrganizationApiServiceAbstraction } from "@bitwarden/common/admin-console/abstractions/organization/organization-api.service.abstraction"; @@ -41,10 +41,14 @@ export class AccountComponent { canUseApi = false; org: OrganizationResponse; taxFormPromise: Promise; - showCollectionManagementSettings$ = this.configService.getFeatureFlag$( + flexibleCollectionsEnabled$ = this.configService.getFeatureFlag$( FeatureFlag.FlexibleCollections, false ); + flexibleCollectionsV1Enabled$ = this.configService.getFeatureFlag$( + FeatureFlag.FlexibleCollectionsV1, + false + ); // FormGroup validators taken from server Organization domain object protected formGroup = this.formBuilder.group({ @@ -67,6 +71,10 @@ export class AccountComponent { protected collectionManagementFormGroup = this.formBuilder.group({ limitCollectionCreationDeletion: this.formBuilder.control({ value: false, disabled: true }), + allowAdminAccessToAllCollectionItems: this.formBuilder.control({ + value: false, + disabled: true, + }), }); protected organizationId: string; @@ -115,6 +123,7 @@ export class AccountComponent { if (!this.selfHosted) { this.formGroup.get("orgName").enable(); this.collectionManagementFormGroup.get("limitCollectionCreationDeletion").enable(); + this.collectionManagementFormGroup.get("allowAdminAccessToAllCollectionItems").enable(); } if (!this.selfHosted || this.canEditSubscription) { @@ -136,6 +145,7 @@ export class AccountComponent { }); this.collectionManagementFormGroup.patchValue({ limitCollectionCreationDeletion: this.org.limitCollectionCreationDeletion, + allowAdminAccessToAllCollectionItems: this.org.allowAdminAccessToAllCollectionItems, }); this.loading = false; @@ -180,6 +190,8 @@ export class AccountComponent { const request = new OrganizationCollectionManagementUpdateRequest(); request.limitCreateDeleteOwnerAdmin = this.collectionManagementFormGroup.value.limitCollectionCreationDeletion; + request.allowAdminAccessToAllCollectionItems = + this.collectionManagementFormGroup.value.allowAdminAccessToAllCollectionItems; await this.organizationApiService.updateCollectionManagement(this.organizationId, request); diff --git a/apps/web/src/locales/en/messages.json b/apps/web/src/locales/en/messages.json index 604aedd38f..5fd31e6cfa 100644 --- a/apps/web/src/locales/en/messages.json +++ b/apps/web/src/locales/en/messages.json @@ -7322,6 +7322,9 @@ "limitCollectionCreationDeletionDesc": { "message": "Limit collection creation and deletion to owners and admins" }, + "allowAdminAccessToAllCollectionItemsDesc": { + "message": "Owners and admins can manage all collections and items" + }, "collectionManagementUpdated": { "message": "Collection management behavior saved" }, diff --git a/libs/common/src/admin-console/models/request/organization-collection-management-update.request.ts b/libs/common/src/admin-console/models/request/organization-collection-management-update.request.ts index 1c6ed27f19..26275650b0 100644 --- a/libs/common/src/admin-console/models/request/organization-collection-management-update.request.ts +++ b/libs/common/src/admin-console/models/request/organization-collection-management-update.request.ts @@ -1,3 +1,4 @@ export class OrganizationCollectionManagementUpdateRequest { limitCreateDeleteOwnerAdmin: boolean; + allowAdminAccessToAllCollectionItems: boolean; } diff --git a/libs/common/src/admin-console/models/response/organization.response.ts b/libs/common/src/admin-console/models/response/organization.response.ts index 74b29a7948..bdcaf79707 100644 --- a/libs/common/src/admin-console/models/response/organization.response.ts +++ b/libs/common/src/admin-console/models/response/organization.response.ts @@ -33,6 +33,7 @@ export class OrganizationResponse extends BaseResponse { maxAutoscaleSmSeats?: number; maxAutoscaleSmServiceAccounts?: number; limitCollectionCreationDeletion: boolean; + allowAdminAccessToAllCollectionItems: boolean; constructor(response: any) { super(response); @@ -71,5 +72,8 @@ export class OrganizationResponse extends BaseResponse { this.limitCollectionCreationDeletion = this.getResponseProperty( "LimitCollectionCreationDeletion" ); + this.allowAdminAccessToAllCollectionItems = this.getResponseProperty( + "AllowAdminAccessToAllCollectionItems" + ); } } diff --git a/libs/common/src/admin-console/models/response/profile-organization.response.ts b/libs/common/src/admin-console/models/response/profile-organization.response.ts index a401662cd5..83187082e5 100644 --- a/libs/common/src/admin-console/models/response/profile-organization.response.ts +++ b/libs/common/src/admin-console/models/response/profile-organization.response.ts @@ -49,6 +49,7 @@ export class ProfileOrganizationResponse extends BaseResponse { familySponsorshipToDelete?: boolean; accessSecretsManager: boolean; limitCollectionCreationDeletion: boolean; + allowAdminAccessToAllCollectionItems: boolean; constructor(response: any) { super(response); @@ -109,5 +110,8 @@ export class ProfileOrganizationResponse extends BaseResponse { this.limitCollectionCreationDeletion = this.getResponseProperty( "LimitCollectionCreationDeletion" ); + this.allowAdminAccessToAllCollectionItems = this.getResponseProperty( + "AllowAdminAccessToAllCollectionItems" + ); } } diff --git a/libs/common/src/enums/feature-flag.enum.ts b/libs/common/src/enums/feature-flag.enum.ts index d51b4561fd..95dbf5d2db 100644 --- a/libs/common/src/enums/feature-flag.enum.ts +++ b/libs/common/src/enums/feature-flag.enum.ts @@ -8,6 +8,7 @@ export enum FeatureFlag { BrowserFilelessImport = "browser-fileless-import", ItemShare = "item-share", FlexibleCollections = "flexible-collections", + FlexibleCollectionsV1 = "flexible-collections-v-1", // v-1 is intentional BulkCollectionAccess = "bulk-collection-access", }