Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[PM-18088] Add unit test coverage for admin methods on CiphersController and CipherService #5460

Open
wants to merge 9 commits into
base: ac/pm-18087/add-cipher-permissions-to-response-models
Choose a base branch
from

Conversation

r-tome
Copy link
Contributor

@r-tome r-tome commented Mar 4, 2025

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-18088

📔 Objective

To begin implementing the changes for PM-18088, I wanted to write unit tests first. However, since none existed, this PR focuses on adding test coverage for the current implementation.

⏰ Reminders before review

  • Contributor guidelines followed
  • All formatters and local linters executed and passed
  • Written new unit and / or integration tests where applicable
  • Protected functional changes with optionality (feature flags)
  • Used internationalization (i18n) for all UI strings
  • CI builds passed
  • Communicated to DevOps any deployment requirements
  • Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

  • 👍 (:+1:) or similar for great changes
  • 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
  • ❓ (:question:) for questions
  • 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
  • 🎨 (:art:) for suggestions / improvements
  • ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
  • 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
  • ⛏ (:pick:) for minor or nitpick changes

- Add tests for provider user scenarios in admin cipher management methods
- Implement tests for custom user with edit any collection permissions
- Add test coverage for RestrictProviderAccess feature flag
- Improve test scenarios for delete, soft delete, and restore operations
…llection permission checks

- Extend CiphersControllerTests with scenarios for custom users without EditAnyCollection permission
- Add test methods to verify NotFoundException is thrown when EditAnyCollection is false
- Cover delete, soft delete, and restore operations for single and bulk cipher admin actions
- Add test methods for admin and owner roles with specific cipher access scenarios
- Implement tests for accessing specific and unassigned ciphers
- Extend test coverage for delete, soft delete, and restore operations
- Improve test method naming for clarity and precision
…nassigned ciphers

- Implement test methods for DeleteManyAdmin and PutDeleteManyAdmin
- Cover scenarios for owner and admin roles with access to specific and unassigned ciphers
- Verify correct invocation of DeleteManyAsync and SoftDeleteManyAsync methods
- Enhance test coverage for bulk cipher admin operations
Copy link

sonarqubecloud bot commented Mar 4, 2025

Copy link
Contributor

github-actions bot commented Mar 4, 2025

Logo
Checkmarx One – Scan Summary & Details1163b9f4-9502-44f0-9647-1447e5add990

New Issues (27)

Checkmarx found the following issues in this Pull Request

Severity Issue Source File / Package Checkmarx Insight
MEDIUM CSRF /src/Api/Controllers/DevicesController.cs: 72
detailsMethod Get at line 72 of /src/Api/Controllers/DevicesController.cs gets a parameter from a user request from Get. This parameter value flows throug...
Attack Vector
MEDIUM CSRF /src/Api/Controllers/DevicesController.cs: 59
detailsMethod GetByIdentifier at line 59 of /src/Api/Controllers/DevicesController.cs gets a parameter from a user request from GetByIdentifier. This para...
Attack Vector
MEDIUM CSRF /src/Api/SecretsManager/Controllers/ServiceAccountsController.cs: 162
detailsMethod BulkDeleteAsync at line 162 of /src/Api/SecretsManager/Controllers/ServiceAccountsController.cs gets a parameter from a user request from Bu...
Attack Vector
MEDIUM Privacy_Violation /src/Core/Auth/Services/Implementations/AuthRequestService.cs: 221
detailsMethod UpdateAuthRequestAsync at line 221 of /src/Core/Auth/Services/Implementations/AuthRequestService.cs sends user information outside the appli...
Attack Vector
MEDIUM Privacy_Violation /src/Core/Auth/Services/Implementations/AuthRequestService.cs: 230
detailsMethod UpdateAuthRequestAsync at line 230 of /src/Core/Auth/Services/Implementations/AuthRequestService.cs sends user information outside the appli...
Attack Vector
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 164
detailsMethod TryParseEventFromRequestBodyAsync at line 164 of /src/Billing/Controllers/StripeController.cs gets user input from element Body. This elemen...
Attack Vector
LOW Log_Forging /src/Billing/Controllers/RecoveryController.cs: 38
detailsMethod ProcessEventsAsync at line 38 of /src/Billing/Controllers/RecoveryController.cs gets user input from element requestBody. This element’s val...
Attack Vector
LOW Log_Forging /src/Api/Controllers/DevicesController.cs: 191
detailsMethod PutWebPushAuth at line 191 of /src/Api/Controllers/DevicesController.cs gets user input from element identifier. This element’s value flows ...
Attack Vector
LOW Log_Forging /src/Api/Controllers/DevicesController.cs: 191
detailsMethod PutWebPushAuth at line 191 of /src/Api/Controllers/DevicesController.cs gets user input from element identifier. This element’s value flows ...
Attack Vector
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 164
detailsMethod TryParseEventFromRequestBodyAsync at line 164 of /src/Billing/Controllers/StripeController.cs gets user input from element Body. This elemen...
Attack Vector
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 164
detailsMethod TryParseEventFromRequestBodyAsync at line 164 of /src/Billing/Controllers/StripeController.cs gets user input from element Body. This elemen...
Attack Vector
LOW Log_Forging /src/Billing/Controllers/RecoveryController.cs: 38
detailsMethod ProcessEventsAsync at line 38 of /src/Billing/Controllers/RecoveryController.cs gets user input from element requestBody. This element’s val...
Attack Vector
LOW Log_Forging /src/Billing/Controllers/RecoveryController.cs: 38
detailsMethod ProcessEventsAsync at line 38 of /src/Billing/Controllers/RecoveryController.cs gets user input from element requestBody. This element’s val...
Attack Vector
LOW Log_Forging /src/Billing/Controllers/RecoveryController.cs: 38
detailsMethod ProcessEventsAsync at line 38 of /src/Billing/Controllers/RecoveryController.cs gets user input from element requestBody. This element’s val...
Attack Vector
LOW Log_Forging /src/Billing/Controllers/RecoveryController.cs: 38
detailsMethod ProcessEventsAsync at line 38 of /src/Billing/Controllers/RecoveryController.cs gets user input from element requestBody. This element’s val...
Attack Vector
LOW Log_Forging /src/Billing/Controllers/RecoveryController.cs: 38
detailsMethod ProcessEventsAsync at line 38 of /src/Billing/Controllers/RecoveryController.cs gets user input from element requestBody. This element’s val...
Attack Vector
LOW Log_Forging /src/Billing/Controllers/RecoveryController.cs: 38
detailsMethod ProcessEventsAsync at line 38 of /src/Billing/Controllers/RecoveryController.cs gets user input from element requestBody. This element’s val...
Attack Vector
LOW Log_Forging /src/Billing/Controllers/RecoveryController.cs: 38
detailsMethod ProcessEventsAsync at line 38 of /src/Billing/Controllers/RecoveryController.cs gets user input from element requestBody. This element’s val...
Attack Vector
LOW Log_Forging /src/Billing/Controllers/RecoveryController.cs: 38
detailsMethod ProcessEventsAsync at line 38 of /src/Billing/Controllers/RecoveryController.cs gets user input from element requestBody. This element’s val...
Attack Vector
LOW Log_Forging /src/Billing/Controllers/RecoveryController.cs: 38
detailsMethod ProcessEventsAsync at line 38 of /src/Billing/Controllers/RecoveryController.cs gets user input from element requestBody. This element’s val...
Attack Vector
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 164
detailsMethod TryParseEventFromRequestBodyAsync at line 164 of /src/Billing/Controllers/StripeController.cs gets user input from element Body. This elemen...
Attack Vector
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 164
detailsMethod TryParseEventFromRequestBodyAsync at line 164 of /src/Billing/Controllers/StripeController.cs gets user input from element Body. This elemen...
Attack Vector
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 164
detailsMethod TryParseEventFromRequestBodyAsync at line 164 of /src/Billing/Controllers/StripeController.cs gets user input from element Body. This elemen...
Attack Vector
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 164
detailsMethod TryParseEventFromRequestBodyAsync at line 164 of /src/Billing/Controllers/StripeController.cs gets user input from element Body. This elemen...
Attack Vector
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 164
detailsMethod TryParseEventFromRequestBodyAsync at line 164 of /src/Billing/Controllers/StripeController.cs gets user input from element Body. This elemen...
Attack Vector
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 164
detailsMethod TryParseEventFromRequestBodyAsync at line 164 of /src/Billing/Controllers/StripeController.cs gets user input from element Body. This elemen...
Attack Vector
LOW Log_Forging /src/Billing/Controllers/StripeController.cs: 164
detailsMethod TryParseEventFromRequestBodyAsync at line 164 of /src/Billing/Controllers/StripeController.cs gets user input from element Body. This elemen...
Attack Vector
Fixed Issues (11)

Great job! The following issues were fixed in this Pull Request

Severity Issue Source File / Package
MEDIUM CSRF /src/Api/Public/Controllers/CollectionsController.cs: 87
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 143
MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 171
LOW Log_Forging /src/Api/Controllers/DevicesController.cs: 86
LOW Log_Forging /src/Api/Controllers/DevicesController.cs: 178
LOW Log_Forging /src/Api/Controllers/DevicesController.cs: 86
LOW Log_Forging /src/Api/Controllers/DevicesController.cs: 178
LOW Log_Forging /src/Api/Controllers/DevicesController.cs: 97
LOW Log_Forging /src/Api/Controllers/DevicesController.cs: 97
LOW Log_Forging /src/Api/Billing/Controllers/OrganizationBillingController.cs: 165
LOW Missing_CSP_Header /src/Core/MailTemplates/Handlebars/Layouts/SecurityTasks.html.hbs: 11

Copy link

codecov bot commented Mar 4, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 44.60%. Comparing base (5e2d973) to head (f4d3dd2).

Additional details and impacted files
@@                                    Coverage Diff                                    @@
##           ac/pm-18087/add-cipher-permissions-to-response-models    #5460      +/-   ##
=========================================================================================
+ Coverage                                                  44.44%   44.60%   +0.16%     
=========================================================================================
  Files                                                       1531     1531              
  Lines                                                      71086    71086              
  Branches                                                    6373     6373              
=========================================================================================
+ Hits                                                       31593    31707     +114     
+ Misses                                                     38125    38009     -116     
- Partials                                                    1368     1370       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@r-tome r-tome marked this pull request as ready for review March 4, 2025 14:55
@r-tome r-tome requested a review from a team as a code owner March 4, 2025 14:55
@r-tome r-tome requested a review from nick-livefront March 4, 2025 14:55
@r-tome r-tome changed the base branch from ac/pm-18087/add-cipher-permissions-to-response-models to main March 4, 2025 16:01
@r-tome r-tome requested a review from a team as a code owner March 4, 2025 16:01
@r-tome r-tome requested a review from rr-bw March 4, 2025 16:02
@r-tome r-tome marked this pull request as draft March 4, 2025 16:02
@r-tome r-tome changed the base branch from main to ac/pm-18087/add-cipher-permissions-to-response-models March 4, 2025 16:02
@r-tome r-tome removed request for a team and rr-bw March 4, 2025 16:02
@r-tome r-tome marked this pull request as ready for review March 4, 2025 16:03
Copy link
Contributor

@nick-livefront nick-livefront left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I love the approach and thank you for expanding the test suite!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants