Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. Weโ€™ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ac/ac 2646/remove fc mvp code #4281

Draft
wants to merge 15 commits into
base: main
Choose a base branch
from

Conversation

vincentsalucci
Copy link
Member

๐ŸŽŸ๏ธ Tracking

๐Ÿ“” Objective

๐Ÿ“ธ Screenshots

โฐ Reminders before review

  • Contributor guidelines followed
  • All formatters and local linters executed and passed
  • Written new unit and / or integration tests where applicable
  • Protected functional changes with optionality (feature flags)
  • Used internationalization (i18n) for all UI strings
  • CI builds passed
  • Communicated to DevOps any deployment requirements
  • Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

๐Ÿฆฎ Reviewer guidelines

  • ๐Ÿ‘ (:+1:) or similar for great changes
  • ๐Ÿ“ (:memo:) or โ„น๏ธ (:information_source:) for notes or general info
  • โ“ (:question:) for questions
  • ๐Ÿค” (:thinking:) or ๐Ÿ’ญ (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
  • ๐ŸŽจ (:art:) for suggestions / improvements
  • โŒ (:x:) or โš ๏ธ (:warning:) for more significant problems or concerns needing attention
  • ๐ŸŒฑ (:seedling:) or โ™ป๏ธ (:recycle:) for future improvements or indications of technical debt
  • โ› (:pick:) for minor or nitpick changes

Copy link
Contributor

github-actions bot commented Jun 25, 2024

Logo
Checkmarx One โ€“ Scan Summary & Details โ€“ a73f422a-3858-415c-b921-3b1721fe7d2b

New Issues

Severity Issue Source File / Package Checkmarx Insight
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/GroupsController.cs: 110 Attack Vector
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/GroupsController.cs: 133 Attack Vector
MEDIUM Privacy_Violation /src/Api/Auth/Controllers/WebAuthnController.cs: 178 Attack Vector
MEDIUM Privacy_Violation /src/Api/Auth/Controllers/AccountsController.cs: 828 Attack Vector
MEDIUM Privacy_Violation /src/Api/Auth/Controllers/AccountsController.cs: 846 Attack Vector
MEDIUM Privacy_Violation /src/Api/Vault/Controllers/CiphersController.cs: 961 Attack Vector
MEDIUM Privacy_Violation /src/Api/Controllers/DevicesController.cs: 129 Attack Vector
MEDIUM Privacy_Violation /src/Api/Auth/Controllers/AccountsController.cs: 411 Attack Vector
MEDIUM Privacy_Violation /src/Api/Auth/Controllers/AccountsController.cs: 548 Attack Vector
MEDIUM Privacy_Violation /src/Api/Auth/Controllers/TwoFactorController.cs: 444 Attack Vector
MEDIUM Privacy_Violation /src/Api/AdminConsole/Controllers/OrganizationsController.cs: 260 Attack Vector
MEDIUM Privacy_Violation /src/Api/Controllers/DevicesController.cs: 155 Attack Vector
MEDIUM Privacy_Violation /src/Api/AdminConsole/Controllers/OrganizationsController.cs: 429 Attack Vector
MEDIUM Privacy_Violation /src/Api/AdminConsole/Controllers/OrganizationsController.cs: 376 Attack Vector
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 117 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/WebAuthnController.cs: 153 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/WebAuthnController.cs: 85 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/WebAuthnController.cs: 68 Attack Vector
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 117 Attack Vector
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 117 Attack Vector
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 117 Attack Vector
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 117 Attack Vector
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 117 Attack Vector
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 117 Attack Vector
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 117 Attack Vector
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 117 Attack Vector
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 117 Attack Vector
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 117 Attack Vector
LOW Log_Forging /src/Api/Vault/Controllers/CiphersController.cs: 222 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/TwoFactorController.cs: 131 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/TwoFactorController.cs: 148 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/TwoFactorController.cs: 157 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/TwoFactorController.cs: 188 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/TwoFactorController.cs: 206 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/TwoFactorController.cs: 245 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/TwoFactorController.cs: 254 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/TwoFactorController.cs: 263 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/TwoFactorController.cs: 280 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/TwoFactorController.cs: 289 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/TwoFactorController.cs: 297 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/TwoFactorController.cs: 350 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/TwoFactorController.cs: 369 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/TwoFactorController.cs: 380 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/TwoFactorController.cs: 402 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/AccountsController.cs: 403 Attack Vector
LOW Log_Forging /src/Api/Controllers/DevicesController.cs: 120 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/AccountsController.cs: 540 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/AccountsController.cs: 820 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/AccountsController.cs: 838 Attack Vector
LOW Log_Forging /src/Api/Vault/Controllers/CiphersController.cs: 953 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/TwoFactorController.cs: 94 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/TwoFactorController.cs: 104 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/TwoFactorController.cs: 122 Attack Vector
LOW Log_Forging /src/Api/AdminConsole/Controllers/OrganizationsController.cs: 240 Attack Vector
LOW Log_Forging /src/Api/Controllers/DevicesController.cs: 146 Attack Vector
LOW Log_Forging /src/Api/AdminConsole/Controllers/OrganizationsController.cs: 404 Attack Vector
LOW Log_Forging /src/Api/AdminConsole/Controllers/OrganizationsController.cs: 341 Attack Vector

Fixed Issues

Severity Issue Source File / Package
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 360
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 360
MEDIUM CSRF /bitwarden_license/src/Scim/Controllers/v2/GroupsController.cs: 98
MEDIUM CSRF /bitwarden_license/src/Scim/Controllers/v2/GroupsController.cs: 88
MEDIUM CSRF /src/Identity/Controllers/AccountsController.cs: 72
MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: 265
MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: 248
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/MembersController.cs: 184
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 583
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 583
MEDIUM CSRF /bitwarden_license/src/Sso/Controllers/AccountController.cs: 100
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 117
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 117
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 117
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 117
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 117
LOW Log_Forging /src/Api/Vault/Controllers/CiphersController.cs: 583

Copy link
Member

@eliykat eliykat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A few code review comments, I have also fixed various tests here: #4467

@@ -20,9 +20,12 @@ namespace Bit.Core.Test.AdminConsole.OrganizationFeatures.Groups;
[SutProviderCustomize]
public class CreateGroupCommandTests
{
[Theory, OrganizationCustomize(UseGroups = true, FlexibleCollections = false), BitAutoData]
[Theory, OrganizationCustomize(UseGroups = true, FlexibleCollections = true), BitAutoData]
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FlexibleCollections should actually default to false, as the goal of these changes is to enable us to drop the FlexibleCollections column; the new FC code should be executed for all organizations. Best to remove it from here altogether.

Suggested change
[Theory, OrganizationCustomize(UseGroups = true, FlexibleCollections = true), BitAutoData]
[Theory, OrganizationCustomize(UseGroups = true), BitAutoData]

Same for all other uses of this customization.

await sutProvider.GetDependency<IReferenceEventService>().Received(1).RaiseEventAsync(
Arg.Is<ReferenceEvent>(e => e.Type == ReferenceEventType.VaultImported));
}

[Theory, BitAutoData]
public async Task ImportCiphersAsync_IntoOrganization_WithFlexibleCollectionsEnabled_Success(
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove references to FC being enabled/disabled:

Suggested change
public async Task ImportCiphersAsync_IntoOrganization_WithFlexibleCollectionsEnabled_Success(
public async Task ImportCiphersAsync_IntoOrganization_Success(

Please check all other tests to see if there are any other tests that need to be renamed or deleted. (e.g. if there are tests for with & without FC enabled, they'll now both be running the same code)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WithFlexibleCollectionsEnabled
WithFlexibleCollections
FlexibleCollectionsDisabled
WithoutFlexibleCollections

Copy link

codecov bot commented Jul 5, 2024

Codecov Report

Attention: Patch coverage is 62.74510% with 19 lines in your changes missing coverage. Please review.

Project coverage is 41.17%. Comparing base (9c8a9f4) to head (4942598).

Files Patch % Lines
.../OrganizationFeatures/Groups/CreateGroupCommand.cs 33.33% 2 Missing and 2 partials โš ๏ธ
.../OrganizationFeatures/Groups/UpdateGroupCommand.cs 33.33% 2 Missing and 2 partials โš ๏ธ
...le/Services/Implementations/OrganizationService.cs 77.77% 1 Missing and 3 partials โš ๏ธ
...Core/Services/Implementations/CollectionService.cs 60.00% 1 Missing and 3 partials โš ๏ธ
...OrganizationUsers/UpdateOrganizationUserCommand.cs 50.00% 1 Missing and 1 partial โš ๏ธ
...cial.Core/AdminConsole/Services/ProviderService.cs 0.00% 0 Missing and 1 partial โš ๏ธ
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4281      +/-   ##
==========================================
- Coverage   41.20%   41.17%   -0.03%     
==========================================
  Files        1265     1265              
  Lines       60333    60295      -38     
  Branches     5516     5510       -6     
==========================================
- Hits        24861    24829      -32     
+ Misses      34325    34314      -11     
- Partials     1147     1152       +5     

โ˜” View full report in Codecov by Sentry.
๐Ÿ“ข Have feedback on the report? Share it here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants