Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[AC-2204] Finalize sprocs that added the Manage permission (1 of 3) #4204

Merged
merged 9 commits into from
Jun 26, 2024

Conversation

eliykat
Copy link
Member

@eliykat eliykat commented Jun 19, 2024

🎟️ Tracking

https://bitwarden.atlassian.net/browse/AC-2204

📔 Objective

When we added the CollectionUser.Manage and CollectionGroup.Manage columns, we updated a number of sprocs by duplicating them and adding a _V2 suffix. We later dropped the old, non-suffixed sprocs, but the V2 naming remained.

This is a chore PR that duplicates the V2 sprocs back to non-suffixed versions. After 1 release, updates the repository code to use the non-suffixed versions will be performed. After another release, the V2 sprocs will be dropped, completing the EDD cycle.

📸 Screenshots

⏰ Reminders before review

  • Contributor guidelines followed
  • All formatters and local linters executed and passed
  • Written new unit and / or integration tests where applicable
  • Protected functional changes with optionality (feature flags)
  • Used internationalization (i18n) for all UI strings
  • CI builds passed
  • Communicated to DevOps any deployment requirements
  • Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

  • 👍 (:+1:) or similar for great changes
  • 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
  • ❓ (:question:) for questions
  • 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
  • 🎨 (:art:) for suggestions / improvements
  • ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
  • 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
  • ⛏ (:pick:) for minor or nitpick changes

@eliykat eliykat requested review from a team as code owners June 19, 2024 04:53
@eliykat eliykat requested a review from addisonbeck June 19, 2024 04:53
@eliykat eliykat changed the title [AC-2204] Finalize sprocs that added the Manage permission [AC-2204] Finalize sprocs that added the Manage permission (1 of 2) Jun 19, 2024
Copy link

codecov bot commented Jun 19, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 41.02%. Comparing base (e9ecb1d) to head (fe1b59e).

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #4204   +/-   ##
=======================================
  Coverage   41.02%   41.02%           
=======================================
  Files        1246     1246           
  Lines       59888    59888           
  Branches     5482     5482           
=======================================
  Hits        24572    24572           
  Misses      34186    34186           
  Partials     1130     1130           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copy link
Contributor

github-actions bot commented Jun 19, 2024

Logo
Checkmarx One – Scan Summary & Detailsa50b8a5a-4c9a-419d-b402-619dbbd1dfac

New Issues

Severity Issue Source File / Package Checkmarx Insight
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/GroupsController.cs: 110 Attack Vector
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/GroupsController.cs: 133 Attack Vector
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 579 Attack Vector
MEDIUM Privacy_Violation /src/Api/Auth/Controllers/AccountsController.cs: 548 Attack Vector
MEDIUM Privacy_Violation /src/Api/Auth/Controllers/AccountsController.cs: 828 Attack Vector
MEDIUM Privacy_Violation /src/Api/Auth/Controllers/AccountsController.cs: 846 Attack Vector
MEDIUM Privacy_Violation /src/Api/Vault/Controllers/CiphersController.cs: 961 Attack Vector
MEDIUM Privacy_Violation /src/Api/Auth/Controllers/AccountsController.cs: 411 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/AccountsController.cs: 820 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/AccountsController.cs: 540 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/AccountsController.cs: 403 Attack Vector
LOW Log_Forging /src/Api/Vault/Controllers/CiphersController.cs: 953 Attack Vector
LOW Log_Forging /src/Api/Auth/Controllers/AccountsController.cs: 838 Attack Vector
LOW Missing_CSP_Header /src/Core/MailTemplates/Handlebars/Auth/RegistrationVerifyEmail.html.hbs: 17 Attack Vector
LOW Open_Redirect /src/Admin/Controllers/ToolsController.cs: 194 Attack Vector

Fixed Issues

Severity Issue Source File / Package
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 365
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/MembersController.cs: 83
MEDIUM CSRF /src/Api/Public/Controllers/CollectionsController.cs: 87
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 171
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 143
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 645
MEDIUM CSRF /bitwarden_license/src/Scim/Controllers/v2/GroupsController.cs: 98
MEDIUM CSRF /bitwarden_license/src/Scim/Controllers/v2/GroupsController.cs: 88
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 247
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 799
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/MembersController.cs: 184
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 209
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 261
MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: 248
MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: 265
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 984
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 125
MEDIUM CSRF /src/Identity/Controllers/AccountsController.cs: 68
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 453
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 111

@@ -329,7 +329,7 @@ public async Task<Guid> CreateAsync(OrganizationUser obj, IEnumerable<Collection
using (var connection = new SqlConnection(ConnectionString))
{
var results = await connection.ExecuteAsync(
$"[{Schema}].[OrganizationUser_CreateWithCollections_V2]",
$"[{Schema}].[OrganizationUser_CreateWithCollections]",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The BRE team is looking to leverage EDD to be able to deploy database changes independent of code changes. The general pattern is to just drop old versions, but with renaming it here we are tying the database change with the code. @withinfocus Thoughts?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Correct with your catch here. While more tedious, one change and deployment would be your proc duplication (both "V1" and "V2" now having the latter's content), then a second deployment would be the reference back to the V1 version, then finally a third being the V2 drop.

@eliykat
Copy link
Member Author

eliykat commented Jun 20, 2024

OK, thanks both. The C# changes have been reverted; now it's just duplicating the sprocs.

The next PR will make the C# changes, then a third and final PR will drop the old sprocs.

@withinfocus withinfocus requested review from a team and removed request for withinfocus and rkac-bw June 21, 2024 12:25
rkac-bw
rkac-bw previously approved these changes Jun 21, 2024
Copy link
Contributor

@rkac-bw rkac-bw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@eliykat eliykat changed the title [AC-2204] Finalize sprocs that added the Manage permission (1 of 2) [AC-2204] Finalize sprocs that added the Manage permission (1 of 3) Jun 24, 2024
@eliykat eliykat requested a review from rkac-bw June 24, 2024 01:00
@eliykat
Copy link
Member Author

eliykat commented Jun 24, 2024

Had to bump dates on the migration script.

@eliykat eliykat merged commit d9aa27d into main Jun 26, 2024
52 checks passed
@eliykat eliykat deleted the ac/ac-2204/replace-old-sprocs-with-v2-sprocs branch June 26, 2024 19:56
withinfocus pushed a commit that referenced this pull request Jul 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants