Auth/pm 2996/add auth request data to devices response model #5152

Patrick-Pimentel-Bitwarden · 2024-12-16T02:27:43Z

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-2996

📔 Objective

This pr adds two new fields to the get devices response endpoint. Now we respond back with the pending auth requests that match a certain criteria when retrieving devices

📸 Screenshots

old_response.mov

new_response.mov

⏰ Reminders before review

Contributor guidelines followed
All formatters and local linters executed and passed
Written new unit and / or integration tests where applicable
Protected functional changes with optionality (feature flags)
Used internationalization (i18n) for all UI strings
CI builds passed
Communicated to DevOps any deployment requirements
Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

👍 (:+1:) or similar for great changes
📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
❓ (:question:) for questions
🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
🎨 (:art:) for suggestions / improvements
❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
⛏ (:pick:) for minor or nitpick changes

…up to do and questions to answer.

…-request-data-to-devices-response-model

codecov · 2024-12-16T02:41:59Z

Codecov Report

Attention: Patch coverage is 26.21359% with 76 lines in your changes missing coverage. Please review.

Project coverage is 43.35%. Comparing base (a3da5b2) to head (c5d8b4c).
Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
...ries/Queries/DeviceWithPendingAuthByUserIdQuery.cs	0.00%	28 Missing ⚠️
...els/Api/Response/DeviceAuthRequestResponseModel.cs	44.68%	24 Missing and 2 partials ⚠️
...astructure.Dapper/Repositories/DeviceRepository.cs	0.00%	13 Missing ⚠️
...e.EntityFramework/Repositories/DeviceRepository.cs	0.00%	7 Missing ⚠️
...c/Infrastructure.Dapper/Repositories/Repository.cs	0.00%	2 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5152   +/-   ##
=======================================
  Coverage   43.35%   43.35%           
=======================================
  Files        1456     1458    +2     
  Lines       66468    66566   +98     
  Branches     6078     6081    +3     
=======================================
+ Hits        28817    28861   +44     
- Misses      36360    36412   +52     
- Partials     1291     1293    +2

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

github-actions · 2024-12-16T03:06:10Z

Checkmarx One – Scan Summary & Details – 83d71dc4-aa1c-469d-836e-44f5199de5a4

New Issues

Issue	Source File / Package	Checkmarx Insight
CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 967	Attack Vector
CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 381	Attack Vector
CSRF	/src/Api/Auth/Controllers/EmergencyAccessController.cs: 159	Attack Vector
CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 922	Attack Vector
CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 261	Attack Vector
CSRF	/src/Api/Auth/Controllers/TwoFactorController.cs: 108	Attack Vector
CSRF	/src/Api/Auth/Controllers/TwoFactorController.cs: 406	Attack Vector
CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 639	Attack Vector
CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 749	Attack Vector
CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 163	Attack Vector
CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 310	Attack Vector
CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 236	Attack Vector
CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 899	Attack Vector
CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 482	Attack Vector
CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 356	Attack Vector
CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 503	Attack Vector
CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 535	Attack Vector
CSRF	/src/Api/Controllers/SettingsController.cs: 36	Attack Vector
CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 483	Attack Vector
CSRF	/src/Api/Controllers/DevicesController.cs: 76	Attack Vector
Privacy_Violation	/src/Core/NotificationHub/NotificationHubPushNotificationService.cs: 195	Attack Vector
Log_Forging	/src/Api/Auth/Controllers/AccountsController.cs: 967	Attack Vector
Log_Forging	/src/Api/Auth/Controllers/AuthRequestsController.cs: 87	Attack Vector
Log_Forging	/src/Api/Auth/Controllers/AuthRequestsController.cs: 75	Attack Vector
Log_Forging	/src/Api/Auth/Controllers/TwoFactorController.cs: 406	Attack Vector
Missing_CSP_Header	/src/Core/MailTemplates/Handlebars/AdminConsole/DomainClaimedByOrganization.html.hbs: 5	Attack Vector

Fixed Issues

Severity	Issue	Source File / Package
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 967
	CSRF	/src/Api/AdminConsole/Controllers/PoliciesController.cs: 70
	CSRF	/src/Api/NotificationCenter/Controllers/NotificationsController.cs: 67
	CSRF	/src/Api/NotificationCenter/Controllers/NotificationsController.cs: 61
	CSRF	/src/Billing/Controllers/RecoveryController.cs: 38
	CSRF	/src/Api/Billing/Controllers/OrganizationsController.cs: 52
	CSRF	/src/Api/Auth/Controllers/TwoFactorController.cs: 108
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 922
	CSRF	/src/Billing/Controllers/StripeController.cs: 164
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 639
	CSRF	/src/Api/Controllers/DevicesController.cs: 73
	CSRF	/src/Api/AdminConsole/Controllers/PoliciesController.cs: 91
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 470
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 236
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 261
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 356
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 482
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 899
	CSRF	/src/Api/Auth/Controllers/EmergencyAccessController.cs: 159
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 310
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 483
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 503
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 535
	CSRF	/src/Api/Controllers/SettingsController.cs: 36
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 163
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 381
	CSRF	/src/Api/Auth/Controllers/TwoFactorController.cs: 406
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 749
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Api/Vault/Controllers/CiphersController.cs: 173
	Log_Forging	/src/Identity/Controllers/AccountsController.cs: 144
	Log_Forging	/src/Identity/Controllers/AccountsController.cs: 144
	Log_Forging	/src/Identity/Controllers/AccountsController.cs: 144
	Log_Forging	/src/Billing/Controllers/StripeController.cs: 164
	Log_Forging	/src/Billing/Controllers/StripeController.cs: 164
	Log_Forging	/src/Identity/Controllers/AccountsController.cs: 76
	Log_Forging	/src/Identity/Controllers/AccountsController.cs: 76
	Log_Forging	/src/Identity/Controllers/AccountsController.cs: 76

…est-data-to-devices-response-model

test/Infrastructure.EFIntegration.Test/Repositories/DeviceRepositoryTests.cs

Migrated tests to appropriate place. Fixed up some of the comments discussed with Ike.

…est-data-to-devices-response-model

Added comment to describe thought process for response model being passed through by the repository.

ike-kottlowski

Overall looks good, have some non-blocking comments.

src/Core/Auth/Models/Api/Response/DeviceAuthRequestResponseModel.cs

util/Migrator/DbScripts/2024-12-04_00_AddActiveDeviceWithPendighAuth.sql

src/Infrastructure.Dapper/Repositories/DeviceRepository.cs

ike-kottlowski · 2024-12-20T01:19:52Z

test/Infrastructure.IntegrationTest/Auth/Repositories/AuthRequestRepositoryTests.cs

        var adminApprovalExpiredAuthRequest = await authRequestRepository.CreateAsync(
            CreateAuthRequest(user.Id, AuthRequestType.AdminApproval, CreateExpiredDate(_adminRequestExpiration)));

        // An AdminApproval request that was approved before it expired but the user has been approved for too long, should be deleted.
        var adminApprovedExpiredAuthRequest = await authRequestRepository.CreateAsync(
            CreateAuthRequest(user.Id, AuthRequestType.AdminApproval, DateTime.UtcNow.AddDays(-6), true, CreateExpiredDate(_afterAdminApprovalExpiration)));

-        // An AdminApproval request that was rejected within it's allowed lifetime but has no gone past it's expiration time, should be deleted.
+        // An AdminApproval request that was rejected within it's allowed lifetime but has not gone past its expiration time, should be deleted.


⛏️ : *it's

ike-kottlowski · 2024-12-20T01:22:48Z

test/Infrastructure.IntegrationTest/Auth/Repositories/DeviceRepositoryTests.cs

🎉 : nice tests!

ike-kottlowski · 2024-12-20T01:28:29Z

src/Api/Controllers/DevicesController.cs

💭 : could we move the _globalSetting to the repository since it's already there?

Patrick-Pimentel-Bitwarden added 11 commits November 29, 2024 19:15

Have the dapper query working. Working on the ef query.

bca5eff

Stored procedure and entity framework query written. Still have clean…

e916faf

…up to do and questions to answer.

Query for sqlite is working. Testing the other backends.

406f941

Optimized implementations of sqlite and other db interactions.

23c049a

Merge remote-tracking branch 'origin/main' into auth/pm-2996/add-auth…

1cf6d08

…-request-data-to-devices-response-model

First device repo test working. Controller test working as well.

a922d8b

Repo tests working.

585a36a

Repository test is working properly.

ef2051f

Validating the endpoint is retreiving the correct auth request.

366dabf

Removed unnessesary files

52560a3

Tiny fixes.

cef7a02

Patrick-Pimentel-Bitwarden added 3 commits December 15, 2024 23:31

Merge remote-tracking branch 'origin' into auth/pm-2996/add-auth-requ…

c1f12de

…est-data-to-devices-response-model

Merge remote-tracking branch 'origin' into auth/pm-2996/add-auth-requ…

04b335e

…est-data-to-devices-response-model

All tests working

7687a16

Patrick-Pimentel-Bitwarden force-pushed the auth/pm-2996/add-auth-request-data-to-devices-response-model branch from d29e69d to 0562f76 Compare December 16, 2024 16:42

Tightened constraints for testing.

647fad8

Patrick-Pimentel-Bitwarden force-pushed the auth/pm-2996/add-auth-request-data-to-devices-response-model branch from 0562f76 to 647fad8 Compare December 16, 2024 17:09

Patrick-Pimentel-Bitwarden commented Dec 16, 2024

View reviewed changes

test/Infrastructure.EFIntegration.Test/Repositories/DeviceRepositoryTests.cs Outdated Show resolved Hide resolved

ike-kottlowski self-requested a review December 16, 2024 17:40

Rename controller test file.

77a38b7

Patrick-Pimentel-Bitwarden force-pushed the auth/pm-2996/add-auth-request-data-to-devices-response-model branch from bf3949d to 98434df Compare December 19, 2024 17:24

feat(device): Devices with Auth Request

97fa55a

Migrated tests to appropriate place. Fixed up some of the comments discussed with Ike.

Patrick-Pimentel-Bitwarden force-pushed the auth/pm-2996/add-auth-request-data-to-devices-response-model branch from 98434df to 97fa55a Compare December 19, 2024 17:26

Patrick-Pimentel-Bitwarden added 2 commits December 19, 2024 12:26

Merge remote-tracking branch 'origin' into auth/pm-2996/add-auth-requ…

092b83c

…est-data-to-devices-response-model

feat(device): Devices with Auth Request

c5d8b4c

Added comment to describe thought process for response model being passed through by the repository.

Patrick-Pimentel-Bitwarden marked this pull request as ready for review December 19, 2024 18:47

Patrick-Pimentel-Bitwarden requested review from a team as code owners December 19, 2024 18:47

ike-kottlowski approved these changes Dec 20, 2024

View reviewed changes

ike-kottlowski reviewed Dec 20, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Auth/pm 2996/add auth request data to devices response model #5152

Auth/pm 2996/add auth request data to devices response model #5152

Patrick-Pimentel-Bitwarden commented Dec 16, 2024 •

edited

Loading

codecov bot commented Dec 16, 2024 •

edited

Loading

github-actions bot commented Dec 16, 2024 •

edited

Loading

ike-kottlowski left a comment

ike-kottlowski Dec 20, 2024

ike-kottlowski Dec 20, 2024

ike-kottlowski Dec 20, 2024

Auth/pm 2996/add auth request data to devices response model #5152

Are you sure you want to change the base?

Auth/pm 2996/add auth request data to devices response model #5152

Conversation

Patrick-Pimentel-Bitwarden commented Dec 16, 2024 • edited Loading

🎟️ Tracking

📔 Objective

📸 Screenshots

⏰ Reminders before review

🦮 Reviewer guidelines

codecov bot commented Dec 16, 2024 • edited Loading

Codecov Report

github-actions bot commented Dec 16, 2024 • edited Loading

New Issues

Fixed Issues

ike-kottlowski left a comment

Choose a reason for hiding this comment

ike-kottlowski Dec 20, 2024

Choose a reason for hiding this comment

ike-kottlowski Dec 20, 2024

Choose a reason for hiding this comment

ike-kottlowski Dec 20, 2024

Choose a reason for hiding this comment

Patrick-Pimentel-Bitwarden commented Dec 16, 2024 •

edited

Loading

codecov bot commented Dec 16, 2024 •

edited

Loading

github-actions bot commented Dec 16, 2024 •

edited

Loading