[PM-38923] feat: Add v2 UpdateOrganizationUser command with role-escalation validation #7919

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

jrmccannon wants to merge 49 commits into main from jmccannon/ac/pm-38923-update-orguser-v2

+1,920 −482

src/Api/AdminConsole/Controllers/OrganizationUsersController.cs

-Original file line number
+Diff line change
@@ Expand Up / @@ -10,7 +10,6 @@ @@
     using Bit.Api.AdminConsole.Models.Response.Organizations;
     using Bit.Api.Models.Response;
     using Bit.Core;
-    using Bit.Core.AdminConsole.AbilitiesCache;
     using Bit.Core.AdminConsole.Entities;
     using Bit.Core.AdminConsole.Models.Data;
     using Bit.Core.AdminConsole.OrganizationFeatures.AccountRecovery;
@@ Expand All / @@ -37,6 +36,7 @@ @@
     using Bit.Core.Exceptions;
     using Bit.Core.Models.Api;
     using Bit.Core.Models.Business;
+    using Bit.Core.Models.Data;
     using Bit.Core.Models.Data.Organizations.OrganizationUsers;
     using Bit.Core.OrganizationFeatures.OrganizationSubscriptions.Interface;
     using Bit.Core.OrganizationFeatures.OrganizationUsers.Interfaces;
@@ Expand All / @@ -49,6 +49,7 @@ @@
     using Microsoft.AspNetCore.Mvc;
     using V1_RevokeOrganizationUserCommand = Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.RevokeUser.v1.IRevokeOrganizationUserCommand;
     using V2_RevokeOrganizationUserCommand = Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.RevokeUser.v2;
+    using V2_UpdateUserCommand = Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.UpdateUser.v2;
     namespace Bit.Api.AdminConsole.Controllers;
@@ Expand All @@
         private readonly IUpdateOrganizationUserCommand _updateOrganizationUserCommand;
         private readonly IAcceptOrgUserCommand _acceptOrgUserCommand;
         private readonly IAuthorizationService _authorizationService;
-        private readonly IOrganizationAbilityCacheService _organizationAbilityCacheService;
         private readonly ISsoConfigRepository _ssoConfigRepository;
         private readonly IOrganizationUserUserDetailsQuery _organizationUserUserDetailsQuery;
         private readonly IRemoveOrganizationUserCommand _removeOrganizationUserCommand;
@@ Expand All @@
         private readonly IUpdateUserResetPasswordEnrollmentCommand _updateUserResetPasswordEnrollmentCommand;
         private readonly IAcceptOrganizationInviteLinkCommand _acceptOrganizationInviteLinkCommand;
         private readonly IConfirmOrganizationInviteLinkCommand _confirmOrganizationInviteLinkCommand;
+        private readonly Bitwarden.Server.Sdk.Features.IFeatureService _featureService;
+        private readonly V2_UpdateUserCommand.IUpdateOrganizationUserCommand _updateOrganizationUserCommandVNext;
         public OrganizationUsersController(IOrganizationRepository organizationRepository,
             IOrganizationUserRepository organizationUserRepository,
@@ Expand All @@
             IUpdateOrganizationUserCommand updateOrganizationUserCommand,
             IAcceptOrgUserCommand acceptOrgUserCommand,
             IAuthorizationService authorizationService,
-            IOrganizationAbilityCacheService organizationAbilityCacheService,
             ISsoConfigRepository ssoConfigRepository,
             IOrganizationUserUserDetailsQuery organizationUserUserDetailsQuery,
             IRemoveOrganizationUserCommand removeOrganizationUserCommand,
@@ Expand All @@
             IUpdateUserResetPasswordEnrollmentCommand updateUserResetPasswordEnrollmentCommand,
             IGetPendingAutoConfirmUsersQuery getPendingAutoConfirmUsersQuery,
             IAcceptOrganizationInviteLinkCommand acceptOrganizationInviteLinkCommand,
-            IConfirmOrganizationInviteLinkCommand confirmOrganizationInviteLinkCommand)
+            IConfirmOrganizationInviteLinkCommand confirmOrganizationInviteLinkCommand,
+            Bitwarden.Server.Sdk.Features.IFeatureService featureService,
+            V2_UpdateUserCommand.IUpdateOrganizationUserCommand updateOrganizationUserCommandVNext)
         {
             _organizationRepository = organizationRepository;
             _organizationUserRepository = organizationUserRepository;
@@ Expand All @@
             _updateOrganizationUserCommand = updateOrganizationUserCommand;
             _acceptOrgUserCommand = acceptOrgUserCommand;
             _authorizationService = authorizationService;
-            _organizationAbilityCacheService = organizationAbilityCacheService;
             _ssoConfigRepository = ssoConfigRepository;
             _organizationUserUserDetailsQuery = organizationUserUserDetailsQuery;
             _removeOrganizationUserCommand = removeOrganizationUserCommand;
@@ Expand All @@
             _updateUserResetPasswordEnrollmentCommand = updateUserResetPasswordEnrollmentCommand;
             _acceptOrganizationInviteLinkCommand = acceptOrganizationInviteLinkCommand;
             _confirmOrganizationInviteLinkCommand = confirmOrganizationInviteLinkCommand;
+            _featureService = featureService;
+            _updateOrganizationUserCommandVNext = updateOrganizationUserCommandVNext;
         }
         [HttpGet("{id}")]
@@ Expand Down Expand Up @@
         [HttpPut("{id}")]
         [Authorize<ManageUsersRequirement>]
-        public async Task Put(Guid orgId, Guid id, [FromBody] OrganizationUserUpdateRequestModel model)
+        public async Task<IResult> Put([BindOrganization] Organization organization, Guid id, [FromBody] OrganizationUserUpdateRequestModel model)
         {
             var (organizationUser, currentAccess) = await _organizationUserRepository.GetByIdWithCollectionsAsync(id);
-            if (organizationUser == null || organizationUser.OrganizationId != orgId)
+            if (organizationUser == null || organizationUser.OrganizationId != organization.Id)
             {
                 throw new NotFoundException();
             }
@@ Expand All @@
             // Authorization check:
             // If admins are not allowed access to all collections, you cannot add yourself to a group.
             // No error is thrown for this, we just don't update groups.
-            var organizationAbility = await _organizationAbilityCacheService.GetOrganizationAbilityAsync(orgId);
-            var groupsToSave = editingSelf && !organizationAbility.AllowAdminAccessToAllCollectionItems
+            var groupsToSave = editingSelf && !organization.AllowAdminAccessToAllCollectionItems
                 ? null
                 : model.Groups;
+            var currentAccessIds = currentAccess.Select(c => c.Id).ToHashSet();
+            var existingUserType = organizationUser.Type;
+            if (_featureService.IsEnabled(FeatureFlagKeys.ChangeMemberEmailNoMp))
+            {
+                var (collectionsToSave, postedCollections) = await GetAuthorizedCollectionsToSaveAsync(model, currentAccess);
+                var actingContext = _currentContext.GetOrganization(organization.Id);
+                var request = new V2_UpdateUserCommand.UpdateOrganizationUserRequest(
+                    organizationUser,
+                    organization,
+                    currentAccessIds,
+                    postedCollections,
+                    model.Type.Value,
+                    model.Permissions,
+                    model.AccessSecretsManager,
+                    collectionsToSave,
+                    groupsToSave,
+                    new StandardUser(
+                        userId,
+                        await _currentContext.OrganizationOwner(organization.Id),
+                        actingContext?.Type,
+                        actingContext?.Permissions),
+                    model.DefaultUserCollectionName);
+                var result = await _updateOrganizationUserCommandVNext.UpdateUserAsync(request);
+                return Handle(result);
+            }
             // Authorization check:
             // If admins are not allowed access to all collections, you cannot add yourself to collections.
             // This is not caught by the requirement below that you can ModifyUserAccess and must be checked separately
-            var currentAccessIds = currentAccess.Select(c => c.Id).ToHashSet();
             if (editingSelf &&
-                !organizationAbility.AllowAdminAccessToAllCollectionItems &&
+                !organization.AllowAdminAccessToAllCollectionItems &&
                 model.Collections.Any(c => !currentAccessIds.Contains(c.Id)))
             {
                 throw new BadRequestException("You cannot add yourself to a collection.");
             }
+            var (collectionsToSaveV1, _) = await GetAuthorizedCollectionsToSaveAsync(model, currentAccess);
+            await _updateOrganizationUserCommand.UpdateUserAsync(model.ToOrganizationUser(organizationUser), existingUserType, userId,
+                collectionsToSaveV1, groupsToSave, model.DefaultUserCollectionName);
+            return TypedResults.Ok();
+        }
+        /// <summary>
+        /// Resolves the collection access to persist for an organization user update. Collections the saving user
+        /// cannot <see cref="BulkCollectionOperations.ModifyUserAccess"/> are validated and the user's current
+        /// access to them is preserved so it is not accidentally overwritten.
+        /// </summary>
+        private async Task<(List<CollectionAccessSelection> CollectionsToSave, ICollection<Collection> Collections)> GetAuthorizedCollectionsToSaveAsync(OrganizationUserUpdateRequestModel model, ICollection<CollectionAccessSelection> currentAccess)
+        {
             // Authorization check:
-            // You must have authorization to ModifyUserAccess for all collections being saved
-            var postedCollections = await _collectionRepository
-                .GetManyByManyIdsAsync(model.Collections.Select(c => c.Id));
-            foreach (var collection in postedCollections)
-            {
-                if (!(await _authorizationService.AuthorizeAsync(User, collection,
-                        BulkCollectionOperations.ModifyUserAccess))
-                    .Succeeded)
-                {
-                    throw new NotFoundException();
-                }
+            // You must have authorization to ModifyUserAccess for all collections being saved.
+            var postedCollections = await _collectionRepository.GetManyByManyIdsAsync(model.Collections.Select(c => c.Id));
+            if (postedCollections.Count != 0 &&
+                !(await _authorizationService.AuthorizeAsync(User, postedCollections, BulkCollectionOperations.ModifyUserAccess)).Succeeded)
+            {
+                throw new NotFoundException();
             }
             // The client only sends collections that the saving user has permissions to edit.
             // We need to combine these with collections that the user doesn't have permissions for, so that we don't
             // accidentally overwrite those
-            var currentCollections = await _collectionRepository
-                .GetManyByManyIdsAsync(currentAccess.Select(cas => cas.Id));
+            var currentCollections = await _collectionRepository.GetManyByManyIdsAsync(currentAccess.Select(cas => cas.Id));
             var readonlyCollectionIds = new HashSet<Guid>();
             foreach (var collection in currentCollections)
             {
-                if (!(await _authorizationService.AuthorizeAsync(User, collection, BulkCollectionOperations.ModifyUserAccess))
-                    .Succeeded)
+                if (!(await _authorizationService.AuthorizeAsync(User, collection, BulkCollectionOperations.ModifyUserAccess)).Succeeded)
                 {
                     readonlyCollectionIds.Add(collection.Id);
                 }
             }
-            var editedCollectionAccess = model.Collections
-                .Select(c => c.ToSelectionReadOnly());
+            // Default user collections ("My Items") are never managed through this flow. Exclude any current-access
+            // defaults from the preserved set so they are not re-saved; posted defaults are rejected downstream.
+            var defaultCollectionIds = postedCollections
+                .Concat(currentCollections)
+                .Where(c => c.Type == CollectionType.DefaultUserCollection)
+                .Select(c => c.Id)
+                .ToHashSet();
+            var editedCollectionAccess = model.Collections.Select(c => c.ToSelectionReadOnly());
             var readonlyCollectionAccess = currentAccess
-                .Where(ca => readonlyCollectionIds.Contains(ca.Id));
+                .Where(ca => readonlyCollectionIds.Contains(ca.Id) && !defaultCollectionIds.Contains(ca.Id));
             var collectionsToSave = editedCollectionAccess
                 .Concat(readonlyCollectionAccess)
                 .ToList();
-            var existingUserType = organizationUser.Type;
-            await _updateOrganizationUserCommand.UpdateUserAsync(model.ToOrganizationUser(organizationUser), existingUserType, userId,
-                collectionsToSave, groupsToSave, model.DefaultUserCollectionName);
-        }
+            var collections = postedCollections
+                .Concat(currentCollections)
+                .DistinctBy(c => c.Id)
+                .ToList();
-        [HttpPost("{id}")]
-        [Obsolete("This endpoint is deprecated. Use PUT method instead")]
-        [Authorize<ManageUsersRequirement>]
-        public async Task PostPut(Guid orgId, Guid id, [FromBody] OrganizationUserUpdateRequestModel model)
-        {
-            await Put(orgId, id, model);
+            return (collectionsToSave, collections);
         }
         [HttpPut("{userId}/reset-password-enrollment")]
@@ Expand Down @@

src/Core/AdminConsole/Entities/OrganizationUser.cs

-Original file line number
+Diff line change
@@ Expand Up / @@ -2,20 +2,19 @@ @@
     using Bit.Core.AdminConsole.Entities;
     using Bit.Core.AdminConsole.Enums;
     using Bit.Core.AdminConsole.Interfaces;
+    using Bit.Core.AdminConsole.Models.Data;
     using Bit.Core.Enums;
     using Bit.Core.Models;
     using Bit.Core.Models.Data;
     using Bit.Core.Utilities;
-    #nullable enable
     namespace Bit.Core.Entities;
     /// <summary>
     /// An association table between one <see cref="User"/> and one <see cref="Organization"/>, representing that user's
     /// membership in the organization. "Member" refers to the OrganizationUser object.
     /// </summary>
-    public class OrganizationUser : ITableObject<Guid>, IExternal, IOrganizationUser
+    public class OrganizationUser : ITableObject<Guid>, IExternal, IOrganizationUser, IOrganizationUserRole
     {
         /// <summary>
         /// A unique random identifier.
@@ Expand Down Expand Up / @@ -153,4 +152,19 @@ public void SetPermissions(Permissions permissions) @@
         {
             Permissions = CoreHelpers.ClassToJsonData(permissions);
         }
+        public OrganizationUser UpdateOrganizationUser(OrganizationUserType organizationUserType,
+            Permissions? permissions,
+            bool accessSecretsManager,
+            TimeProvider timeProvider)
+        {
+            if (permissions is not null)
+            {
+                SetPermissions(permissions);
+            }
+            Type = organizationUserType;
+            AccessSecretsManager = accessSecretsManager;
+            RevisionDate = timeProvider.GetUtcNow().UtcDateTime;
+            return this;
+        }
     }

src/Core/AdminConsole/Models/Data/CollectionAccessSelection.cs

-Original file line number
+Diff line change
@@ Expand Up / @@ -24,4 +24,9 @@ public class CollectionAccessSelection @@
         /// deleting it, and assigning access for other users and groups.
         /// </summary>
         public bool Manage { get; set; }
+        /// <summary>
+        /// Manage is mutually exclusive with ReadOnly and HidePasswords.
+        /// </summary>
+        public bool Valid() => !(Manage && (ReadOnly || HidePasswords));
     }

src/Core/AdminConsole/Models/Data/IOrganizationUserRole.cs

-Original file line number
+Diff line change
@@ -0,0 +1,14 @@
+    using Bit.Core.Enums;
+    using Bit.Core.Models.Data;
+    namespace Bit.Core.AdminConsole.Models.Data;
+    /// <summary>
+    /// The minimal role information needed to authorize whether one member can manage another.
+    /// </summary>
+    public interface IOrganizationUserRole
+    {
+        OrganizationUserType Type { get; }
+        Guid OrganizationId { get; }
+        Permissions? GetPermissions();
+    }

src/Core/AdminConsole/Models/Data/OrganizationUserRole.cs

-Original file line number
+Diff line change
@@ -0,0 +1,15 @@
+    using Bit.Core.Enums;
+    using Bit.Core.Models.Data;
+    namespace Bit.Core.AdminConsole.Models.Data;
+    /// <summary>
+    /// A lightweight <see cref="IOrganizationUserRole"/> for when a full OrganizationUser isn't available.
+    /// </summary>
+    public sealed record OrganizationUserRole(
+        OrganizationUserType Type,
+        Guid OrganizationId,
+        Permissions? Permissions = null) : IOrganizationUserRole
+    {
+        public Permissions? GetPermissions() => Permissions;
+    }

src/Core/AdminConsole/Models/Data/StandardUser.cs

-Original file line number
+Diff line change
@@ -1,16 +1,15 @@
     using Bit.Core.Enums;
+    using Bit.Core.Models.Data;
     namespace Bit.Core.AdminConsole.Models.Data;
-    public class StandardUser : IActingUser
+    public class StandardUser(Guid userId, bool isOrganizationOwner, OrganizationUserType? orgUserType = null,
+        Permissions? permissions = null) : IActingUser
     {
-        public StandardUser(Guid userId, bool isOrganizationOwner)
-        {
-            UserId = userId;
-            IsOrganizationOwnerOrProvider = isOrganizationOwner;
-        }
-        public Guid? UserId { get; }
-        public bool IsOrganizationOwnerOrProvider { get; }
+        public Guid? UserId { get; } = userId;
+        public bool IsOrganizationOwnerOrProvider { get; } = isOrganizationOwner;
+        public OrganizationUserType? OrganizationUserType { get; } = orgUserType;
+        public Permissions? Permissions { get; } = permissions;
         public EventSystemUser? SystemUserType => throw new Exception($"{nameof(StandardUser)} does not have a {nameof(SystemUserType)}");
     }

src/Core/AdminConsole/Models/Data/SystemUser.cs

-Original file line number
+Diff line change
@@ Expand Up / @@ -2,15 +2,10 @@ @@
     namespace Bit.Core.AdminConsole.Models.Data;
-    public class SystemUser : IActingUser
+    public class SystemUser(EventSystemUser systemUser) : IActingUser
     {
-        public SystemUser(EventSystemUser systemUser)
-        {
-            SystemUserType = systemUser;
-        }
         public Guid? UserId => throw new Exception($"{nameof(SystemUserType)} does not have a {nameof(UserId)}.");
         public bool IsOrganizationOwnerOrProvider => false;
-        public EventSystemUser? SystemUserType { get; }
+        public EventSystemUser? SystemUserType { get; } = systemUser;
     }

...Core/AdminConsole/OrganizationFeatures/OrganizationUsers/OrganizationUserAction/Errors.cs

-Original file line number
+Diff line change
@@ Expand Up / @@ -2,8 +2,12 @@ @@
     namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.OrganizationUserAction;
-    /// <summary>
-    /// Returned when the acting user lacks the authority to act on the target member's role.
-    /// </summary>
-    public record CannotManageTargetUser()
-        : BadRequestError("You do not have permission to manage this user.");
+    public record CannotManageTargetUser() : BadRequestError("You do not have permission to manage this user.");
+    public record OnlyOwnersCanManageOwners() : BadRequestError("Only an Owner can manage another Owner's account.");
+    public record CustomUsersCannotManageAdminsOrOwners() : BadRequestError("Custom users can not manage Admins or Owners.");
+    public record CustomUsersCanOnlyGrantOwnPermissions() : BadRequestError("Custom users can only grant the same custom permissions that they have.");
+    public record CannotBeAdminOfMultipleFreeOrganizations() : BadRequestError("User can only be an admin of one free organization.");

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[PM-38923] feat: Add v2 UpdateOrganizationUser command with role-escalation validation #7919

Diff view

Diff view

There are no files selected for viewing

Uh oh!

Uh oh!

Uh oh!

eliykat Jul 18, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

[PM-38923] feat: Add v2 UpdateOrganizationUser command with role-escalation validation #7919

[PM-38923] feat: Add v2 UpdateOrganizationUser command with role-escalation validation #7919

Uh oh!

Uh oh!

Diff view

Diff view

There are no files selected for viewing

Uh oh!

Uh oh!

Uh oh!

eliykat Jul 18, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!