[PM-10319] - Revoke Non Complaint Users for 2FA and Single Org Policy Enablement #5037

jrmccannon · 2024-11-13T20:38:00Z

🎟️ Tracking

📔 Objective

This change revokes non-compliant users when 2FA or Single Org policies are enabled. This adds the a RevokeNonCompliantOrganizationUserCommand along with a bulk set status stored procedure. It also adds two new email templates to be sent when a user is revoked from an organization.

📸 Screenshots

Two FA Policy Revocation Email

Single Org Policy Email

⏰ Reminders before review

Contributor guidelines followed
All formatters and local linters executed and passed
Written new unit and / or integration tests where applicable
Protected functional changes with optionality (feature flags)
Used internationalization (i18n) for all UI strings
CI builds passed
Communicated to DevOps any deployment requirements
Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

👍 (:+1:) or similar for great changes
📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
❓ (:question:) for questions
🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
🎨 (:art:) for suggestions / improvements
❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
⛏ (:pick:) for minor or nitpick changes

…request.

# Conflicts: # src/Api/AdminConsole/Models/Response/Organizations/CommandResult.cs # src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyValidators/SingleOrgPolicyValidator.cs

github-actions · 2024-11-13T21:34:29Z

Checkmarx One – Scan Summary & Details – a1ced24f-c026-464d-9c9e-c2d1a2e0dc6d

New Issues

Issue	Source File / Package	Checkmarx Insight
Missing_HSTS_Header	/src/Admin/Views/Home/Index.cshtml: 14	Attack Vector
Log_Forging	/src/Api/Auth/Controllers/TwoFactorController.cs: 406	Attack Vector
Missing_CSP_Header	/src/Core/MailTemplates/Handlebars/FamiliesForEnterprise/FamiliesForEnterpriseRemovedFromFamilyUser.html.hbs: 5	Attack Vector
Unsafe_Use_Of_Target_blank	/src/Core/MailTemplates/Handlebars/AdminConsole/OrganizationUserRevokedForTwoFactorPolicy.html.hbs: 11	Attack Vector

Fixed Issues

Severity	Issue	Source File / Package
	CSRF	/src/Api/AdminConsole/Public/Controllers/MembersController.cs: 95
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 122
	CSRF	/src/Admin/AdminConsole/Controllers/OrganizationsController.cs: 372
	Log_Forging	/src/Api/AdminConsole/Controllers/ProvidersController.cs: 72
	Log_Forging	/src/Api/AdminConsole/Controllers/ProvidersController.cs: 72
	Log_Forging	/src/Api/AdminConsole/Controllers/ProvidersController.cs: 72

codecov · 2024-11-13T21:49:09Z

Codecov Report

Attention: Patch coverage is 67.03704% with 89 lines in your changes missing coverage. Please review.

Project coverage is 43.13%. Comparing base (92b94fd) to head (66d5831).

Files with missing lines	Patch %	Lines
.../Services/Implementations/HandlebarsMailService.cs	4.00%	24 Missing ⚠️
...icies/PolicyValidators/SingleOrgPolicyValidator.cs	68.88%	8 Missing and 6 partials ⚠️
...Users/RevokeNonCompliantOrganizationUserCommand.cs	81.35%	6 Missing and 5 partials ⚠️
...lidators/TwoFactorAuthenticationPolicyValidator.cs	82.14%	4 Missing and 6 partials ⚠️
...Console/Repositories/OrganizationUserRepository.cs	0.00%	7 Missing ⚠️
...Console/Repositories/OrganizationUserRepository.cs	0.00%	7 Missing ⚠️
...nizationDomains/VerifyOrganizationDomainCommand.cs	87.50%	3 Missing and 1 partial ⚠️
...nConsole/Services/Implementations/PolicyService.cs	42.85%	4 Missing ⚠️
src/Core/AdminConsole/Models/Data/SystemUser.cs	57.14%	3 Missing ⚠️
...re/Services/NoopImplementations/NoopMailService.cs	0.00%	2 Missing ⚠️
... and 3 more

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5037      +/-   ##
==========================================
+ Coverage   43.09%   43.13%   +0.04%     
==========================================
  Files        1414     1421       +7     
  Lines       64808    65014     +206     
  Branches     5925     5955      +30     
==========================================
+ Hits        27929    28045     +116     
- Misses      35645    35716      +71     
- Partials     1234     1253      +19

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚨 Try these New Features:

Flaky Tests Detection - Detect and resolve failed and flaky tests
JS Bundle Analysis - Avoid shipping oversized bundles

r-tome

Looks good, left some suggestions

src/Sql/dbo/Stored Procedures/OrganizationUser_SetStatusForUsersById.sql

src/Core/AdminConsole/OrganizationFeatures/Shared/CommandResult.cs

...nConsole/OrganizationFeatures/OrganizationUsers/RevokeNonCompliantOrganizationUserCommand.cs

src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/Requests/RevokeOrganizationUser.cs

…evokeNonCompliantOrganizationUserCommand.cs Co-authored-by: Rui Tomé <[email protected]>

…ation. Adding unknown type to event system user. Adding optional parameter to SaveAsync in policy service in order to pass in event system user.

...nConsole/OrganizationFeatures/OrganizationUsers/RevokeNonCompliantOrganizationUserCommand.cs

...Core/AdminConsole/OrganizationFeatures/Policies/PolicyValidators/SingleOrgPolicyValidator.cs

...ole/OrganizationFeatures/Policies/PolicyValidators/TwoFactorAuthenticationPolicyValidator.cs

src/Core/AdminConsole/Repositories/IOrganizationUserRepository.cs

src/Core/Services/Implementations/HandlebarsMailService.cs

src/Infrastructure.EntityFramework/AdminConsole/Repositories/OrganizationUserRepository.cs

...AdminConsole/OrganizationFeatures/Policies/PolicyValidators/SingleOrgPolicyValidatorTests.cs

...rganizationFeatures/Policies/PolicyValidators/TwoFactorAuthenticationPolicyValidatorTests.cs

...ole/OrganizationFeatures/Policies/PolicyValidators/TwoFactorAuthenticationPolicyValidator.cs

r-tome · 2024-11-20T10:48:31Z

...ore/AdminConsole/OrganizationFeatures/OrganizationDomains/VerifyOrganizationDomainCommand.cs



    public async Task<OrganizationDomain> UserVerifyOrganizationDomainAsync(OrganizationDomain organizationDomain)
    {
-        var domainVerificationResult = await VerifyOrganizationDomainAsync(organizationDomain);
+        var actingUser = new StandardUser(currentContext.UserId ?? Guid.Empty, await currentContext.OrganizationOwner(organizationDomain.OrganizationId));


Why pass an empty Guid and not the nullable Guid in the first parameter?

I'd rather not have null. I could throw at this point instead of using Guid.Empty. I was just defaulting to Guid.Empty in the event that a caller hasn't initialized the CurrentContext.

Do we know which applications would call this method without the CurrentContext populated with a user?

I'm not sure about this method specifically, but generally:

the Public API and SCIM - CurrentContext.UserId is null because it's the organization that's authenticated, not the user

a system call (jobs) - also not tied to a user

A regular call from a client through the private api will always have UserId populated (to my knowledge) because CurrentContext is always initialized in the middleware and the private api always requires user authentication.

What this means for you here I'm not sure. This method seems specifically designed to be called by a user, so throwing if there is no UserId available seems reasonable. And if the UserId is null for some reason, then _currentContext.OrganizationOwner is probably not going to be accurate either (as this is also user specific). Really it seems like an invalid state.

src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/Requests/RevokeOrganizationUser.cs

...AdminConsole/OrganizationFeatures/Policies/PolicyValidators/SingleOrgPolicyValidatorTests.cs

...rganizationFeatures/Policies/PolicyValidators/TwoFactorAuthenticationPolicyValidatorTests.cs

r-tome · 2024-11-20T11:26:07Z

src/Core/AdminConsole/Services/Implementations/PolicyService.cs

    {
        if (_featureService.IsEnabled(FeatureFlagKeys.Pm13322AddPolicyDefinitions))
        {
            // Transitional mapping - this will be moved to callers once the feature flag is removed
+            // TODO make sure to populate with SystemUser if not an actual user


TODO no longer needed?

This TODO will get addressed with a subsequent story.

I can do this when I remove the policy definition feature flag shortly. Callers will have to construct their own PolicyUpdate objects, so I'll need to pass in the right ActingUser at that time.

src/Core/AdminConsole/Repositories/IOrganizationUserRepository.cs

...ole/OrganizationFeatures/OrganizationUsers/RevokeNonCompliantOrganizationUserCommandTests.cs

eliykat

Looking good, just a couple of things.

Also see my feedback above re: empty guid vs. throwing.

eliykat · 2024-11-21T04:43:46Z

...Core/AdminConsole/OrganizationFeatures/Policies/PolicyValidators/SingleOrgPolicyValidator.cs

+                         performedBy is StandardUser stdUser &&
+                         stdUser.UserId != ou.UserId)


I think these last conditions need to be nested. If the ActingUser is a SystemUser, this will never evaluate to true for anyone.

eliykat · 2024-11-21T04:47:04Z

...ole/OrganizationFeatures/Policies/PolicyValidators/TwoFactorAuthenticationPolicyValidator.cs

-        var organizationUsersTwoFactorEnabled = await _twoFactorIsEnabledQuery.TwoFactorIsEnabledAsync(orgUsers);
-        var removableOrgUsers = orgUsers.Where(ou =>
-            ou.Status != OrganizationUserStatusType.Invited && ou.Status != OrganizationUserStatusType.Revoked &&
-            ou.Type != OrganizationUserType.Owner && ou.Type != OrganizationUserType.Admin &&
-            ou.UserId != savingUserId);
+
+        // this can get moved into the private method after AccountDeprovisiong flag check is removed.
+        var organizationUsersTwoFactorEnabled =
+            (await _twoFactorIsEnabledQuery.TwoFactorIsEnabledAsync(orgUsers)).ToList();
+
+        var revocableOrgUsers = orgUsers.Where(ou =>
+                ou.Status != OrganizationUserStatusType.Invited && ou.Status != OrganizationUserStatusType.Revoked &&
+                ou.Type != OrganizationUserType.Owner && ou.Type != OrganizationUserType.Admin &&
+                ou.UserId != savingUserId)
+            .ToList();


There are unreverted changes here. I think it's functionally the same but would be best to properly revert. (e.g. it still refers to revocableOrgUsers.)

eliykat · 2024-11-22T04:09:38Z

...ole/OrganizationFeatures/Policies/PolicyValidators/TwoFactorAuthenticationPolicyValidator.cs

+                         performedBy is StandardUser stdUser &&
+                         stdUser.UserId != ou.UserId)


eliykat · 2024-11-22T04:12:07Z

...ole/OrganizationFeatures/Policies/PolicyValidators/TwoFactorAuthenticationPolicyValidator.cs

+        var organizationUsersTwoFactorEnabled =
+            await _twoFactorIsEnabledQuery.TwoFactorIsEnabledAsync(currentActiveRevocableOrganizationUsers);
+
+        if (DoMembersNotHaveAPasswordWithTwoFactorAuthenticationEnabled(currentActiveRevocableOrganizationUsers, organizationUsersTwoFactorEnabled))


I'm not sure this method name is accurate; shouldn't it be "WithoutTwoFactorAuthenticationEnabled"? Or maybe the double negative is throwing me. How about if (NonCompliantMembersWillLoseAccess)?

eliykat · 2024-11-22T04:16:45Z

...AdminConsole/OrganizationFeatures/Policies/PolicyValidators/SingleOrgPolicyValidatorTests.cs

+        if (isAccountDeprovisioningEnabled)
+        {
+            await sutProvider.GetDependency<IRevokeNonCompliantOrganizationUserCommand>()
+                .Received(1)
+                .RevokeNonCompliantOrganizationUsersAsync(Arg.Any<RevokeOrganizationUsersRequest>());
+            await sutProvider.GetDependency<IMailService>()
+                .Received(1)
+                .SendOrganizationUserRevokedForPolicySingleOrgEmailAsync(organization.DisplayName(),
+                    "[email protected]");
+        }
+        else
+        {
+            await sutProvider.GetDependency<IRemoveOrganizationUserCommand>()
+                .Received(1)
+                .RemoveUserAsync(policyUpdate.OrganizationId, nonCompliantUser.Id, savingUserId);
+            await sutProvider.GetDependency<IMailService>()
+                .Received(1)
+                .SendOrganizationUserRemovedForPolicySingleOrgEmailAsync(organization.DisplayName(),
+                    "[email protected]");
+        }


Not a blocker, but I generally avoid conditional assertions in tests; this suggests to me that you should just have 2 tests. That's easier to clean up as well, because you can just delete the whole test.

jrmccannon and others added 17 commits November 7, 2024 15:50

Revoking users when enabling single org and 2fa policies. Fixing tests.

0a4c88a

Added migration.

ff61b83

Wrote tests and fixed bugs found.

49620c7

Patch build process

e7a9a4f

Fixing tests.

8b534b0

Added unit test around disabling the feature flag.

6a36767

Updated error message to be public and added test for validating the …

f2f2a62

…request.

formatting

f009db0

Added some tests for single org policy validator.

595e4b9

Merge branch 'main' into ac/jmccannon/pm-10319-revoke-nc-users

d662fff

# Conflicts: # src/Api/AdminConsole/Models/Response/Organizations/CommandResult.cs # src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyValidators/SingleOrgPolicyValidator.cs

Fix issues from merge.

d64032c

Added sending emails to revoked non-compliant users.

abbd4f5

Fixing name. Adding two factor policy email.

3917114

Send email when user has been revoked.

da02c89

Correcting migration name.

1c3e4d8

Fixing templates and logic issue in Revoke command.

35643c1

Moving interface into its own file.

d3172c0

jrmccannon requested review from a team as code owners November 13, 2024 20:38

jrmccannon requested a review from eliykat November 13, 2024 20:38

Correcting namespaces for email templates.

fe5af90

jrmccannon changed the title ~~[PM-10319]~~ [PM-10319] - Revoke Non Complaint Users for 2FA and Single Org Policy Enablement Nov 13, 2024

correcting logic that would not allow normal users to revoke non owners.

95bb1f4

jrmccannon added 3 commits November 13, 2024 16:18

Actually correcting the test and logic.

eb693a8

dotnet format. Added exec to bottom of bulk sproc

58702d2

Merge branch 'main' into ac/jmccannon/pm-10319-revoke-nc-users

47cc545

eliykat requested a review from r-tome November 15, 2024 07:22

r-tome reviewed Nov 15, 2024

View reviewed changes

jrmccannon and others added 7 commits November 15, 2024 09:45

Update src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/R…

9427b9f

…evokeNonCompliantOrganizationUserCommand.cs Co-authored-by: Rui Tomé <[email protected]>

Updated OrgIds to be a json string

99f98f2

Fixing errors.

78cd03d

Updating test

436bebd

Moving command result.

8b89ad6

Formatting and request rename

0014d5c

Realized this would throw a null error from the system domain verific…

82b65e0

…ation. Adding unknown type to event system user. Adding optional parameter to SaveAsync in policy service in order to pass in event system user.

jrmccannon requested a review from r-tome November 15, 2024 16:56

eliykat requested changes Nov 18, 2024

View reviewed changes

Code review changes

51d0b12

jrmccannon requested a review from eliykat November 19, 2024 20:22

jrmccannon added 2 commits November 19, 2024 14:24

Removing todos

d4bd369

Corrected test name.

1d77345

r-tome requested changes Nov 20, 2024

View reviewed changes

jrmccannon added 3 commits November 20, 2024 08:36

Syncing filename to record name.

37ca7ff

Fixing up the tests.

d0dd776

Added happy path test

273754a

jrmccannon requested a review from r-tome November 20, 2024 18:44

jrmccannon and others added 3 commits November 20, 2024 13:00

Naming corrections. And corrected EF query.

2f3da19

added check against event service

1e7c17f

Merge branch 'main' into ac/jmccannon/pm-10319-revoke-nc-users

66d5831

eliykat requested changes Nov 22, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[PM-10319] - Revoke Non Complaint Users for 2FA and Single Org Policy Enablement #5037

[PM-10319] - Revoke Non Complaint Users for 2FA and Single Org Policy Enablement #5037

jrmccannon commented Nov 13, 2024 •

edited by jira bot

Loading

github-actions bot commented Nov 13, 2024 •

edited

Loading

codecov bot commented Nov 13, 2024 •

edited

Loading

r-tome left a comment

r-tome Nov 20, 2024

jrmccannon Nov 20, 2024

eliykat Nov 21, 2024 •

edited

Loading

r-tome Nov 20, 2024

jrmccannon Nov 20, 2024

eliykat Nov 21, 2024 •

edited

Loading

eliykat left a comment

eliykat Nov 21, 2024

eliykat Nov 21, 2024

eliykat Nov 22, 2024

eliykat Nov 22, 2024

eliykat Nov 22, 2024

		performedBy is StandardUser stdUser &&
		stdUser.UserId != ou.UserId)

[PM-10319] - Revoke Non Complaint Users for 2FA and Single Org Policy Enablement #5037

Are you sure you want to change the base?

[PM-10319] - Revoke Non Complaint Users for 2FA and Single Org Policy Enablement #5037

Conversation

jrmccannon commented Nov 13, 2024 • edited by jira bot Loading

🎟️ Tracking

📔 Objective

📸 Screenshots

⏰ Reminders before review

🦮 Reviewer guidelines

github-actions bot commented Nov 13, 2024 • edited Loading

New Issues

Fixed Issues

codecov bot commented Nov 13, 2024 • edited Loading

Codecov Report

r-tome left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

eliykat Nov 21, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

eliykat Nov 21, 2024 • edited Loading

Choose a reason for hiding this comment

eliykat left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jrmccannon commented Nov 13, 2024 •

edited by jira bot

Loading

github-actions bot commented Nov 13, 2024 •

edited

Loading

codecov bot commented Nov 13, 2024 •

edited

Loading

eliykat Nov 21, 2024 •

edited

Loading

eliykat Nov 21, 2024 •

edited

Loading