Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Auth/PM-7322 - Registration with Email verification - Finish registration endpoint #4182

Conversation

JaredSnider-Bitwarden
Copy link
Contributor

@JaredSnider-Bitwarden JaredSnider-Bitwarden commented Jun 13, 2024

🎟️ Tracking

PM-7322
Associated Clients PR: bitwarden/clients#9653

📔 Objective(s)

  1. To refactor all existing registration flows out of the UserService and into the new RegisterUserCommand so we could add onto it
  2. Add a new PostRegisterFinish endpoint to the Identity AccountsController which calls the new RegisterUserCommand.RegisterUserViaEmailVerificationToken(...) method to register a user.

Important note: during the RegisterUserCommand refactoring, I discovered missing validation on for the existing org invite process. We previously only validated the org invite token if a self hosted org had disabled open user registration, but we should have been validating if it was provided in all scenarios - only the error message should have changed if open registration was disabled.

📸 Screenshots

SSO JIT User Registration still works - This tests the new RegisterUserCommand.RegisterUser(...) logic

PM-7322.-.Web.-.SSO.JIT.User.registration.still.works.mov

Org Invite User Registration still works - This tests the new RegisterUserCommand.RegisterUserWithOptionalOrgInvite(...) logic

PM-7322.-.Web.-.Org.Invite.User.Registration.still.works.mov

⏰ Reminders before review

  • Contributor guidelines followed
  • All formatters and local linters executed and passed
  • Written new unit and / or integration tests where applicable
  • Protected functional changes with optionality (feature flags)
  • Used internationalization (i18n) for all UI strings
  • CI builds passed
  • Communicated to DevOps any deployment requirements
  • Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

  • 👍 (:+1:) or similar for great changes
  • 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
  • ❓ (:question:) for questions
  • 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
  • 🎨 (:art:) for suggestions / improvements
  • ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
  • 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
  • ⛏ (:pick:) for minor or nitpick changes

@JaredSnider-Bitwarden JaredSnider-Bitwarden changed the title PM-7322 - AccountsController.cs - create empty method + empty req mod… Auth/PM-7322 - Registration with Email verification - Finish registration endpoint Jun 13, 2024
Copy link

codecov bot commented Jun 13, 2024

Codecov Report

Attention: Patch coverage is 96.96970% with 7 lines in your changes missing coverage. Please review.

Project coverage is 41.18%. Comparing base (14de173) to head (da887cf).
Report is 1 commits behind head on main.

Files Patch % Lines
...egistration/Implementations/RegisterUserCommand.cs 96.00% 2 Missing and 4 partials ⚠️
src/Core/Services/Implementations/UserService.cs 50.00% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4182      +/-   ##
==========================================
+ Coverage   40.90%   41.18%   +0.27%     
==========================================
  Files        1260     1262       +2     
  Lines       60103    60248     +145     
  Branches     5488     5499      +11     
==========================================
+ Hits        24586    24811     +225     
+ Misses      34382    34296      -86     
- Partials     1135     1141       +6     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

This comment was marked as off-topic.

Base automatically changed from auth/pm-5092/email-verification-send-email-endpoint to main June 19, 2024 17:54
@JaredSnider-Bitwarden JaredSnider-Bitwarden force-pushed the auth/pm-7322/email-verification-complete-registration-endpoint branch from 9fb606a to 67a18fd Compare June 19, 2024 18:26
JaredSnider-Bitwarden and others added 16 commits June 19, 2024 15:12
…gic to always validate the token if we have one.
… to be more clear + validate org invite token even in open registration scenarios + added tests.
…erify email as it's the only thing we need to verify + updated tests.
…timing attack delays per architecture discussion with a default of keeping them around.
@JaredSnider-Bitwarden JaredSnider-Bitwarden marked this pull request as ready for review June 28, 2024 17:12
@rr-bw rr-bw requested review from ike-kottlowski and removed request for rr-bw July 1, 2024 15:02
@JaredSnider-Bitwarden JaredSnider-Bitwarden merged commit 8471326 into main Jul 2, 2024
49 checks passed
@JaredSnider-Bitwarden JaredSnider-Bitwarden deleted the auth/pm-7322/email-verification-complete-registration-endpoint branch July 2, 2024 21:03
withinfocus pushed a commit that referenced this pull request Jul 9, 2024
…tion endpoint (#4182)

* PM-7322 - AccountsController.cs - create empty method + empty req model to be able to create draft PR.

* PM-7322 - Start on RegisterFinishRequestModel.cs

* PM-7322 - WIP on Complete Registration endpoint

* PM-7322 - UserService.cs - RegisterUserAsync - Tweak of token to be orgInviteToken as we are adding a new email verification token to the mix.

* PM-7322 - UserService - Rename MP to MPHash

* PM-7322 - More WIP progress on getting new finish registration process in place.

* PM-7322 Create IRegisterUserCommand

* PM-7322 - RegisterUserCommand.cs - first WIP draft

* PM-7322 - Implement use of new command in Identity.

* PM-7322 - Rename RegisterUserViaOrgInvite to just be RegisterUser as orgInvite is optional.

* PM07322 - Test RegisterUserCommand.RegisterUser(...) happy paths and one bad request path.

* PM-7322 - More WIP on RegisterUserCommand.cs and tests

* PM-7322 - RegisterUserCommand.cs - refactor ValidateOrgInviteToken logic to always validate the token if we have one.

* PM-7322 - RegisterUserCommand.cs - Refactor OrgInviteToken validation to be more clear + validate org invite token even in open registration scenarios + added tests.

* PM-7322 - Add more test coverage to RegisterUserWithOptionalOrgInvite

* PM-7322 - IRegisterUserCommand - DOCS

* PM-7322 - Test RegisterUser

* PM-7322 - IRegisterUserCommand - Add more docs.

* PM-7322 - Finish updating all existing user service register calls to use the new command.

* PM-7322 - RegistrationEmailVerificationTokenable.cs changes + tests

* PM-7322 - RegistrationEmailVerificationTokenable.cs changed to only verify email as it's the only thing we need to verify + updated tests.

* PM-7322 - Get RegisterUserViaEmailVerificationToken built and tested

* PM-7322 - AccountsController.cs - get bones of PostRegisterFinish in place

* PM-7322 - SendVerificationEmailForRegistrationCommand - Feature flag timing attack delays per architecture discussion with a default of keeping them around.

* PM-7322 - RegisterFinishRequestModel.cs - EmailVerificationToken must be optional for org invite scenarios.

* PM-7322 - HandlebarsMailService.cs - SendRegistrationVerificationEmailAsync - must URL encode email to avoid invalid email upon submission to server on complete registration step

* PM-7322 - RegisterUserCommandTests.cs - add API key assertions

* PM-7322 - Clean up RegisterUserCommand.cs

* PM-7322 - Refactor AccountsController.cs existing org invite method and new process to consider new feature flag for delays.

* PM-7322 - Add feature flag svc to AccountsControllerTests.cs + add TODO

* PM-7322 - AccountsController.cs - Refactor shared IdentityResult logic into private helper.

* PM-7322 - Work on getting PostRegisterFinish tests in place.

* PM-7322 - AccountsControllerTests.cs - test new method.

* PM-7322 - RegisterFinishRequestModel.cs - Update to use required keyword instead of required annotations as it is easier to catch mistakes.

* PM-7322 - Fix misspelling

* PM-7322 - Integration tests for RegistrationWithEmailVerification

* PM-7322 - Fix leaky integration tests.

* PM-7322 - Another leaky test fix.

* PM-7322 - AccountsControllerTests.cs - fix RegistrationWithEmailVerification_WithOrgInviteToken_Succeeds

* PM-7322 - AccountsControllerTests.cs - Finish out integration test suite!
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants