[SM-713] Add database support for secret access policies

bitwarden_license/src/Commercial.Infrastructure.EntityFramework/SecretsManager/Repositories/ServiceAccountRepository.cs

@@ -84,22 +84,29 @@ public async Task<bool> UserHasWriteAccessToServiceAccount(Guid id, Guid userId)
 
     public async Task DeleteManyByIdAsync(IEnumerable<Guid> ids)
     {
+        var targetIds = ids.ToList();
         using var scope = ServiceScopeFactory.CreateScope();
         var dbContext = GetDatabaseContext(scope);
 
+        await using var transaction = await dbContext.Database.BeginTransactionAsync();
+
         // Policies can't have a cascade delete, so we need to delete them manually.
-        var policies = dbContext.AccessPolicies.Where(ap =>
-            ((ServiceAccountProjectAccessPolicy)ap).ServiceAccountId.HasValue && ids.Contains(((ServiceAccountProjectAccessPolicy)ap).ServiceAccountId!.Value) ||
-            ((GroupServiceAccountAccessPolicy)ap).GrantedServiceAccountId.HasValue && ids.Contains(((GroupServiceAccountAccessPolicy)ap).GrantedServiceAccountId!.Value) ||
-            ((UserServiceAccountAccessPolicy)ap).GrantedServiceAccountId.HasValue && ids.Contains(((UserServiceAccountAccessPolicy)ap).GrantedServiceAccountId!.Value));
-        dbContext.RemoveRange(policies);
-
-        var apiKeys = dbContext.ApiKeys.Where(a => a.ServiceAccountId.HasValue && ids.Contains(a.ServiceAccountId!.Value));
-        dbContext.RemoveRange(apiKeys);
-
-        var serviceAccounts = dbContext.ServiceAccount.Where(c => ids.Contains(c.Id));
-        dbContext.RemoveRange(serviceAccounts);
-        await dbContext.SaveChangesAsync();
+        await dbContext.AccessPolicies.Where(ap =>
+                targetIds.Contains(((ServiceAccountProjectAccessPolicy)ap).ServiceAccountId!.Value) ||
+                targetIds.Contains(((ServiceAccountSecretAccessPolicy)ap).ServiceAccountId!.Value) ||
+                targetIds.Contains(((GroupServiceAccountAccessPolicy)ap).GrantedServiceAccountId!.Value) ||
+                targetIds.Contains(((UserServiceAccountAccessPolicy)ap).GrantedServiceAccountId!.Value))
+            .ExecuteDeleteAsync();
+
+        await dbContext.ApiKeys
+            .Where(a => targetIds.Contains(a.ServiceAccountId!.Value))
+            .ExecuteDeleteAsync();
+
+        await dbContext.ServiceAccount
+            .Where(c => targetIds.Contains(c.Id))
+            .ExecuteDeleteAsync();
+
+        await transaction.CommitAsync();
     }
 
     public async Task<(bool Read, bool Write)> AccessToServiceAccountAsync(Guid id, Guid userId,

src/Core/SecretsManager/Entities/AccessPolicy.cs

@@ -38,6 +38,14 @@
     public ServiceAccount? GrantedServiceAccount { get; set; }
 }
 
+public class UserSecretAccessPolicy : BaseAccessPolicy
+{
+    public Guid? OrganizationUserId { get; set; }
+    public User? User { get; set; }
+    public Guid? GrantedSecretId { get; set; }
+    public Secret? GrantedSecret { get; set; }
+}
+
 public class GroupProjectAccessPolicy : BaseAccessPolicy
 {
     public Guid? GroupId { get; set; }
@@ -56,10 +64,27 @@
     public ServiceAccount? GrantedServiceAccount { get; set; }
 }
 
+public class GroupSecretAccessPolicy : BaseAccessPolicy
+{
+    public Guid? GroupId { get; set; }
+    public Group? Group { get; set; }
+    public bool? CurrentUserInGroup { get; set; }
+    public Guid? GrantedSecretId { get; set; }
+    public Secret? GrantedSecret { get; set; }
+}
+
 public class ServiceAccountProjectAccessPolicy : BaseAccessPolicy
 {
     public Guid? ServiceAccountId { get; set; }
     public ServiceAccount? ServiceAccount { get; set; }
     public Guid? GrantedProjectId { get; set; }
     public Project? GrantedProject { get; set; }
 }
+
+public class ServiceAccountSecretAccessPolicy : BaseAccessPolicy
+{
+    public Guid? ServiceAccountId { get; set; }
+    public ServiceAccount? ServiceAccount { get; set; }
+    public Guid? GrantedSecretId { get; set; }
+    public Secret? GrantedSecret { get; set; }
+}

src/Infrastructure.EntityFramework/AdminConsole/Repositories/OrganizationRepository.cs

@@ -180,6 +180,8 @@
                 .ExecuteDeleteAsync();
             await dbContext.UserServiceAccountAccessPolicy.Where(ap => ap.OrganizationUser.OrganizationId == organization.Id)
                 .ExecuteDeleteAsync();
+            await dbContext.UserSecretAccessPolicy.Where(ap => ap.OrganizationUser.OrganizationId == organization.Id)
+                .ExecuteDeleteAsync();
             await dbContext.OrganizationUsers.Where(ou => ou.OrganizationId == organization.Id)
                 .ExecuteDeleteAsync();
             await dbContext.ProviderOrganizations.Where(po => po.OrganizationId == organization.Id)

src/Infrastructure.EntityFramework/AdminConsole/Repositories/OrganizationUserRepository.cs

@@ -100,6 +100,8 @@
                 dbContext.UserProjectAccessPolicy.Where(ap => ap.OrganizationUserId == organizationUserId));
             dbContext.UserServiceAccountAccessPolicy.RemoveRange(
                 dbContext.UserServiceAccountAccessPolicy.Where(ap => ap.OrganizationUserId == organizationUserId));
+            dbContext.UserSecretAccessPolicy.RemoveRange(
+                dbContext.UserSecretAccessPolicy.Where(ap => ap.OrganizationUserId == organizationUserId));
 
             var orgSponsorships = await dbContext.OrganizationSponsorships
                 .Where(os => os.SponsoringOrganizationUserId == organizationUserId)
@@ -117,18 +119,36 @@
 
     public async Task DeleteManyAsync(IEnumerable<Guid> organizationUserIds)
     {
-        using (var scope = ServiceScopeFactory.CreateScope())
-        {
-            var dbContext = GetDatabaseContext(scope);
-            await dbContext.UserBumpAccountRevisionDateByOrganizationUserIdsAsync(organizationUserIds);
-            var entities = await dbContext.OrganizationUsers
-                // TODO: Does this work?
-                .Where(ou => organizationUserIds.Contains(ou.Id))
-                .ToListAsync();
+        var targetOrganizationUserIds = organizationUserIds.ToList();
+        using var scope = ServiceScopeFactory.CreateScope();
+        var dbContext = GetDatabaseContext(scope);
 
-            dbContext.OrganizationUsers.RemoveRange(entities);
-            await dbContext.SaveChangesAsync();
-        }
+        var transaction = await dbContext.Database.BeginTransactionAsync();
+        await dbContext.UserBumpAccountRevisionDateByOrganizationUserIdsAsync(targetOrganizationUserIds);
+
+        await dbContext.CollectionUsers
+            .Where(cu => targetOrganizationUserIds.Contains(cu.OrganizationUserId))
+            .ExecuteDeleteAsync();
+
+        await dbContext.GroupUsers
+            .Where(gu => targetOrganizationUserIds.Contains(gu.OrganizationUserId))
+            .ExecuteDeleteAsync();
+
+        await dbContext.UserProjectAccessPolicy
+            .Where(ap => targetOrganizationUserIds.Contains(ap.OrganizationUserId!.Value))
+            .ExecuteDeleteAsync();
+        await dbContext.UserServiceAccountAccessPolicy
+            .Where(ap => targetOrganizationUserIds.Contains(ap.OrganizationUserId!.Value))
+            .ExecuteDeleteAsync();
+        await dbContext.UserSecretAccessPolicy
+            .Where(ap => targetOrganizationUserIds.Contains(ap.OrganizationUserId!.Value))
+            .ExecuteDeleteAsync();
+
+        await dbContext.OrganizationUsers
+            .Where(ou => targetOrganizationUserIds.Contains(ou.Id)).ExecuteDeleteAsync();
+
+        await dbContext.SaveChangesAsync();
+        await transaction.CommitAsync();
     }
 
     public async Task<Tuple<Core.Entities.OrganizationUser, ICollection<CollectionAccessSelection>>> GetByIdWithCollectionsAsync(Guid id)

src/Infrastructure.EntityFramework/Repositories/DatabaseContext.cs

@@ -27,6 +27,9 @@ public DatabaseContext(DbContextOptions<DatabaseContext> options)
     public DbSet<ServiceAccountProjectAccessPolicy> ServiceAccountProjectAccessPolicy { get; set; }
     public DbSet<UserServiceAccountAccessPolicy> UserServiceAccountAccessPolicy { get; set; }
     public DbSet<GroupServiceAccountAccessPolicy> GroupServiceAccountAccessPolicy { get; set; }
+    public DbSet<UserSecretAccessPolicy> UserSecretAccessPolicy { get; set; }
+    public DbSet<GroupSecretAccessPolicy> GroupSecretAccessPolicy { get; set; }
+    public DbSet<ServiceAccountSecretAccessPolicy> ServiceAccountSecretAccessPolicy { get; set; }
     public DbSet<ApiKey> ApiKeys { get; set; }
     public DbSet<Cipher> Ciphers { get; set; }
     public DbSet<Collection> Collections { get; set; }

src/Infrastructure.EntityFramework/SecretsManager/Configurations/AccessPolicyEntityTypeConfiguration.cs

@@ -13,9 +13,12 @@ public void Configure(EntityTypeBuilder<AccessPolicy> builder)
             .HasDiscriminator<string>("Discriminator")
             .HasValue<UserProjectAccessPolicy>(AccessPolicyDiscriminator.UserProject)
             .HasValue<UserServiceAccountAccessPolicy>(AccessPolicyDiscriminator.UserServiceAccount)
+            .HasValue<UserSecretAccessPolicy>(AccessPolicyDiscriminator.UserSecret)
             .HasValue<GroupProjectAccessPolicy>(AccessPolicyDiscriminator.GroupProject)
             .HasValue<GroupServiceAccountAccessPolicy>(AccessPolicyDiscriminator.GroupServiceAccount)
-            .HasValue<ServiceAccountProjectAccessPolicy>(AccessPolicyDiscriminator.ServiceAccountProject);
+            .HasValue<GroupSecretAccessPolicy>(AccessPolicyDiscriminator.GroupSecret)
+            .HasValue<ServiceAccountProjectAccessPolicy>(AccessPolicyDiscriminator.ServiceAccountProject)
+            .HasValue<ServiceAccountSecretAccessPolicy>(AccessPolicyDiscriminator.ServiceAccountSecret);
 
         builder
             .Property(s => s.Id)
@@ -63,6 +66,26 @@ public void Configure(EntityTypeBuilder<UserServiceAccountAccessPolicy> builder)
     }
 }
 
+public class UserSecretAccessPolicyEntityTypeConfiguration : IEntityTypeConfiguration<UserSecretAccessPolicy>
+{
+    public void Configure(EntityTypeBuilder<UserSecretAccessPolicy> builder)
+    {
+        builder
+            .Property(e => e.OrganizationUserId)
+            .HasColumnName(nameof(UserSecretAccessPolicy.OrganizationUserId));
+
+        builder
+            .Property(e => e.GrantedSecretId)
+            .HasColumnName(nameof(UserSecretAccessPolicy.GrantedSecretId));
+
+        builder
+            .HasOne(e => e.GrantedSecret)
+            .WithMany(e => e.UserAccessPolicies)
+            .HasForeignKey(nameof(UserSecretAccessPolicy.GrantedSecretId))
+            .OnDelete(DeleteBehavior.Cascade);
+    }
+}
+
 public class GroupProjectAccessPolicyEntityTypeConfiguration : IEntityTypeConfiguration<GroupProjectAccessPolicy>
 {
     public void Configure(EntityTypeBuilder<GroupProjectAccessPolicy> builder)
@@ -109,6 +132,32 @@ public void Configure(EntityTypeBuilder<GroupServiceAccountAccessPolicy> builder
     }
 }
 
+public class GroupSecretAccessPolicyEntityTypeConfiguration : IEntityTypeConfiguration<GroupSecretAccessPolicy>
+{
+    public void Configure(EntityTypeBuilder<GroupSecretAccessPolicy> builder)
+    {
+        builder
+            .Property(e => e.GroupId)
+            .HasColumnName(nameof(GroupSecretAccessPolicy.GroupId));
+
+        builder
+            .Property(e => e.GrantedSecretId)
+            .HasColumnName(nameof(GroupSecretAccessPolicy.GrantedSecretId));
+
+        builder
+            .HasOne(e => e.GrantedSecret)
+            .WithMany(e => e.GroupAccessPolicies)
+            .HasForeignKey(nameof(GroupSecretAccessPolicy.GrantedSecretId))
+            .OnDelete(DeleteBehavior.Cascade);
+
+        builder
+            .HasOne(e => e.Group)
+            .WithMany()
+            .HasForeignKey(nameof(GroupSecretAccessPolicy.GroupId))
+            .OnDelete(DeleteBehavior.Cascade);
+    }
+}
+
 public class ServiceAccountProjectAccessPolicyEntityTypeConfiguration : IEntityTypeConfiguration<ServiceAccountProjectAccessPolicy>
 {
     public void Configure(EntityTypeBuilder<ServiceAccountProjectAccessPolicy> builder)
@@ -128,3 +177,23 @@ public void Configure(EntityTypeBuilder<ServiceAccountProjectAccessPolicy> build
             .OnDelete(DeleteBehavior.Cascade);
     }
 }
+
+public class ServiceAccountSecretAccessPolicyEntityTypeConfiguration : IEntityTypeConfiguration<ServiceAccountSecretAccessPolicy>
+{
+    public void Configure(EntityTypeBuilder<ServiceAccountSecretAccessPolicy> builder)
+    {
+        builder
+            .Property(e => e.ServiceAccountId)
+            .HasColumnName(nameof(ServiceAccountSecretAccessPolicy.ServiceAccountId));
+
+        builder
+            .Property(e => e.GrantedSecretId)
+            .HasColumnName(nameof(ServiceAccountSecretAccessPolicy.GrantedSecretId));
+
+        builder
+            .HasOne(e => e.GrantedSecret)
+            .WithMany(e => e.ServiceAccountAccessPolicies)
+            .HasForeignKey(nameof(ServiceAccountSecretAccessPolicy.GrantedSecretId))
+            .OnDelete(DeleteBehavior.Cascade);
+    }
+}

src/Infrastructure.EntityFramework/SecretsManager/Discriminators/AccessPolicyDiscriminator.cs

@@ -4,8 +4,10 @@ public static class AccessPolicyDiscriminator
 {
     public const string UserProject = "user_project";
     public const string UserServiceAccount = "user_service_account";
+    public const string UserSecret = "user_secret";
     public const string GroupProject = "group_project";
     public const string GroupServiceAccount = "group_service_account";
+    public const string GroupSecret = "group_secret";
     public const string ServiceAccountProject = "service_account_project";
-
+    public const string ServiceAccountSecret = "service_account_secret";
 }

src/Infrastructure.EntityFramework/SecretsManager/Models/AccessPolicy.cs

@@ -24,6 +24,12 @@
             .ReverseMap()
             .ForMember(dst => dst.User, opt => opt.MapFrom(src => src.OrganizationUser.User));
 
+        CreateMap<Core.SecretsManager.Entities.UserSecretAccessPolicy, UserSecretAccessPolicy>()
+            .ForMember(dst => dst.GrantedSecret, opt => opt.Ignore())
+            .ForMember(dst => dst.OrganizationUser, opt => opt.Ignore())
+            .ReverseMap()
+            .ForMember(dst => dst.User, opt => opt.MapFrom(src => src.OrganizationUser.User));
+
         CreateMap<Core.SecretsManager.Entities.GroupProjectAccessPolicy, GroupProjectAccessPolicy>()
             .ForMember(dst => dst.GrantedProject, opt => opt.Ignore())
             .ForMember(dst => dst.Group, opt => opt.Ignore())
@@ -34,10 +40,20 @@
             .ForMember(dst => dst.Group, opt => opt.Ignore())
             .ReverseMap();
 
+        CreateMap<Core.SecretsManager.Entities.GroupSecretAccessPolicy, GroupSecretAccessPolicy>()
+            .ForMember(dst => dst.GrantedSecret, opt => opt.Ignore())
+            .ForMember(dst => dst.Group, opt => opt.Ignore())
+            .ReverseMap();
+
         CreateMap<Core.SecretsManager.Entities.ServiceAccountProjectAccessPolicy, ServiceAccountProjectAccessPolicy>()
             .ForMember(dst => dst.GrantedProject, opt => opt.Ignore())
             .ForMember(dst => dst.ServiceAccount, opt => opt.Ignore())
             .ReverseMap();
+
+        CreateMap<Core.SecretsManager.Entities.ServiceAccountSecretAccessPolicy, ServiceAccountSecretAccessPolicy>()
+            .ForMember(dst => dst.GrantedSecret, opt => opt.Ignore())
+            .ForMember(dst => dst.ServiceAccount, opt => opt.Ignore())
+            .ReverseMap();
     }
 }
 
@@ -61,6 +77,14 @@
     public virtual ServiceAccount GrantedServiceAccount { get; set; }
 }
 
+public class UserSecretAccessPolicy : AccessPolicy
+{
+    public Guid? OrganizationUserId { get; set; }
+    public virtual OrganizationUser OrganizationUser { get; set; }
+    public Guid? GrantedSecretId { get; set; }
+    public virtual Secret GrantedSecret { get; set; }
+}
+
 public class GroupProjectAccessPolicy : AccessPolicy
 {
     public Guid? GroupId { get; set; }
@@ -77,10 +101,27 @@
     public virtual ServiceAccount GrantedServiceAccount { get; set; }
 }
 
+public class GroupSecretAccessPolicy : AccessPolicy
+{
+    public Guid? GroupId { get; set; }
+    public virtual Group Group { get; set; }
+    public Guid? GrantedSecretId { get; set; }
+    public virtual Secret GrantedSecret { get; set; }
+}
+
 public class ServiceAccountProjectAccessPolicy : AccessPolicy
 {
     public Guid? ServiceAccountId { get; set; }
     public virtual ServiceAccount ServiceAccount { get; set; }
     public Guid? GrantedProjectId { get; set; }
     public virtual Project GrantedProject { get; set; }
 }
+
+public class ServiceAccountSecretAccessPolicy : AccessPolicy
+{
+    public Guid? ServiceAccountId { get; set; }
+    public virtual ServiceAccount ServiceAccount { get; set; }
+    public Guid? GrantedSecretId { get; set; }
+    public virtual Secret GrantedSecret { get; set; }
+}
+

src/Infrastructure.EntityFramework/SecretsManager/Models/Secret.cs

@@ -5,8 +5,11 @@
 
 public class Secret : Core.SecretsManager.Entities.Secret
 {
-    public virtual new ICollection<Project> Projects { get; set; }
+    public new virtual ICollection<Project> Projects { get; set; }
     public virtual Organization Organization { get; set; }
+    public virtual ICollection<UserSecretAccessPolicy> UserAccessPolicies { get; set; }
+    public virtual ICollection<GroupSecretAccessPolicy> GroupAccessPolicies { get; set; }
+    public virtual ICollection<ServiceAccountSecretAccessPolicy> ServiceAccountAccessPolicies { get; set; }
 }
 
 public class SecretMapperProfile : Profile