[AC-1125] Enforce org setting for creating/deleting collections

src/Api/Controllers/CollectionsController.cs

@@ -1,5 +1,6 @@
 using Bit.Api.Models.Request;
 using Bit.Api.Models.Response;
+using Bit.Api.Vault.AuthorizationHandlers.Collections;
 using Bit.Core.Context;
 using Bit.Core.Entities;
 using Bit.Core.Exceptions;
@@ -20,19 +21,22 @@ public class CollectionsController : Controller
     private readonly IDeleteCollectionCommand _deleteCollectionCommand;
     private readonly IUserService _userService;
     private readonly ICurrentContext _currentContext;
+    private readonly IAuthorizationService _authorizationService;
 
     public CollectionsController(
         ICollectionRepository collectionRepository,
         ICollectionService collectionService,
         IDeleteCollectionCommand deleteCollectionCommand,
         IUserService userService,
-        ICurrentContext currentContext)
+        ICurrentContext currentContext,
+        IAuthorizationService authorizationService)
     {
         _collectionRepository = collectionRepository;
         _collectionService = collectionService;
         _deleteCollectionCommand = deleteCollectionCommand;
         _userService = userService;
         _currentContext = currentContext;
+        _authorizationService = authorizationService;
     }
 
     [HttpGet("{id}")]
@@ -62,6 +66,7 @@ public async Task<CollectionAccessDetailsResponseModel> GetDetails(Guid orgId, G
             {
                 throw new NotFoundException();
             }
+
             return new CollectionAccessDetailsResponseModel(collection, access.Groups, access.Users);
         }
         else
@@ -72,20 +77,23 @@ public async Task<CollectionAccessDetailsResponseModel> GetDetails(Guid orgId, G
             {
                 throw new NotFoundException();
             }
+
             return new CollectionAccessDetailsResponseModel(collection, access.Groups, access.Users);
         }
     }
 
     [HttpGet("details")]
     public async Task<ListResponseModel<CollectionAccessDetailsResponseModel>> GetManyWithDetails(Guid orgId)
     {
-        if (!await ViewAtLeastOneCollectionAsync(orgId) && !await _currentContext.ManageUsers(orgId) && !await _currentContext.ManageGroups(orgId))
+        if (!await ViewAtLeastOneCollectionAsync(orgId) && !await _currentContext.ManageUsers(orgId) &&
+            !await _currentContext.ManageGroups(orgId))
         {
             throw new NotFoundException();
         }
 
         // We always need to know which collections the current user is assigned to
-        var assignedOrgCollections = await _collectionRepository.GetManyByUserIdWithAccessAsync(_currentContext.UserId.Value, orgId);
+        var assignedOrgCollections =
+            await _collectionRepository.GetManyByUserIdWithAccessAsync(_currentContext.UserId.Value, orgId);
 
         if (await _currentContext.ViewAllCollections(orgId) || await _currentContext.ManageUsers(orgId))
         {
@@ -141,19 +149,16 @@ public async Task<CollectionResponseModel> Post(Guid orgId, [FromBody] Collectio
     {
         var collection = model.ToCollection(orgId);
 
-        if (!await CanCreateCollection(orgId, collection.Id) &&
-            !await CanEditCollectionAsync(orgId, collection.Id))
+        var result = await _authorizationService.AuthorizeAsync(User, collection, CollectionOperations.Create);
+        if (!result.Succeeded)
         {
             throw new NotFoundException();
         }
 
         var groups = model.Groups?.Select(g => g.ToSelectionReadOnly());
         var users = model.Users?.Select(g => g.ToSelectionReadOnly());
 
-        var assignUserToCollection = !(await _currentContext.EditAnyCollection(orgId)) &&
-            await _currentContext.EditAssignedCollections(orgId);
-
-        await _collectionService.SaveAsync(collection, groups, users, assignUserToCollection ? _currentContext.UserId : null);
+        await _collectionService.SaveAsync(collection, groups, users, _currentContext.UserId);
         return new CollectionResponseModel(collection);
     }
 
@@ -189,35 +194,28 @@ public async Task PutUsers(Guid orgId, Guid id, [FromBody] IEnumerable<Selection
     [HttpPost("{id}/delete")]
     public async Task Delete(Guid orgId, Guid id)
     {
-        if (!await CanDeleteCollectionAsync(orgId, id))
+        var collection = await GetCollectionAsync(id, orgId);
+        var result = await _authorizationService.AuthorizeAsync(User, collection, CollectionOperations.Delete);
+        if (!result.Succeeded)
         {
             throw new NotFoundException();
         }
 
-        var collection = await GetCollectionAsync(id, orgId);
         await _deleteCollectionCommand.DeleteAsync(collection);
     }
 
     [HttpDelete("")]
     [HttpPost("delete")]
     public async Task DeleteMany([FromBody] CollectionBulkDeleteRequestModel model)
     {
-        var orgId = new Guid(model.OrganizationId);
-        var collectionIds = model.Ids.Select(i => new Guid(i));
-        if (!await _currentContext.DeleteAssignedCollections(orgId) && !await _currentContext.DeleteAnyCollection(orgId))
+        var collections = await _collectionRepository.GetManyByManyIdsAsync(model.Ids);
+        var result = await _authorizationService.AuthorizeAsync(User, collections, CollectionOperations.Delete);
+        if (!result.Succeeded)
         {
             throw new NotFoundException();
         }
 
-        var userCollections = await _collectionService.GetOrganizationCollectionsAsync(orgId);
-        var filteredCollections = userCollections.Where(c => collectionIds.Contains(c.Id) && c.OrganizationId == orgId);
-
-        if (!filteredCollections.Any())
-        {
-            throw new BadRequestException("No collections found.");
-        }
-
-        await _deleteCollectionCommand.DeleteManyAsync(filteredCollections);
+        await _deleteCollectionCommand.DeleteManyAsync(collections);
     }
 
     [HttpDelete("{id}/user/{orgUserId}")]
@@ -248,17 +246,6 @@ private async Task<Collection> GetCollectionAsync(Guid id, Guid orgId)
         return collection;
     }
 
-
-    private async Task<bool> CanCreateCollection(Guid orgId, Guid collectionId)
-    {
-        if (collectionId != default)
-        {
-            return false;
-        }
-
-        return await _currentContext.CreateNewCollections(orgId);
-    }
-
     private async Task<bool> CanEditCollectionAsync(Guid orgId, Guid collectionId)
     {
         if (collectionId == default)
@@ -273,28 +260,8 @@ private async Task<bool> CanEditCollectionAsync(Guid orgId, Guid collectionId)
 
         if (await _currentContext.EditAssignedCollections(orgId))
         {
-            var collectionDetails = await _collectionRepository.GetByIdAsync(collectionId, _currentContext.UserId.Value);
-            return collectionDetails != null;
-        }
-
-        return false;
-    }
-
-    private async Task<bool> CanDeleteCollectionAsync(Guid orgId, Guid collectionId)
-    {
-        if (collectionId == default)
-        {
-            return false;
-        }
-
-        if (await _currentContext.DeleteAnyCollection(orgId))
-        {
-            return true;
-        }
-
-        if (await _currentContext.DeleteAssignedCollections(orgId))
-        {
-            var collectionDetails = await _collectionRepository.GetByIdAsync(collectionId, _currentContext.UserId.Value);
+            var collectionDetails =
+                await _collectionRepository.GetByIdAsync(collectionId, _currentContext.UserId.Value);
             return collectionDetails != null;
         }
 
@@ -315,7 +282,8 @@ private async Task<bool> CanViewCollectionAsync(Guid orgId, Guid collectionId)
 
         if (await _currentContext.ViewAssignedCollections(orgId))
         {
-            var collectionDetails = await _collectionRepository.GetByIdAsync(collectionId, _currentContext.UserId.Value);
+            var collectionDetails =
+                await _collectionRepository.GetByIdAsync(collectionId, _currentContext.UserId.Value);
             return collectionDetails != null;
         }
 

src/Api/Models/Request/CollectionRequestModel.cs

@@ -34,7 +34,8 @@ public virtual Collection ToCollection(Collection existingCollection)
 public class CollectionBulkDeleteRequestModel
 {
     [Required]
-    public IEnumerable<string> Ids { get; set; }
+    public IEnumerable<Guid> Ids { get; set; }
+    [Obsolete("OrganizationId is no longer required and will be removed in a future release")]
     public string OrganizationId { get; set; }
 }
 

src/Api/Utilities/ServiceCollectionExtensions.cs

@@ -1,4 +1,4 @@
-using Bit.Api.Vault.AuthorizationHandlers;
+using Bit.Api.Vault.AuthorizationHandlers.Collections;
 using Bit.Core.IdentityServer;
 using Bit.Core.Settings;
 using Bit.Core.Utilities;