[PM-26636] - Auto Confirm Org User Command

src/Api/AdminConsole/Controllers/OrganizationUsersController.cs

@@ -10,7 +10,9 @@
 using Bit.Api.Vault.AuthorizationHandlers.Collections;
 using Bit.Core;
 using Bit.Core.AdminConsole.Enums;
+using Bit.Core.AdminConsole.Models.Data;
 using Bit.Core.AdminConsole.Models.Data.Organizations.Policies;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.AutoConfirmUser;
 using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.DeleteClaimedAccount;
 using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
 using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.InviteUsers;
@@ -66,6 +68,8 @@ public class OrganizationUsersController : Controller
     private readonly IFeatureService _featureService;
     private readonly IPricingClient _pricingClient;
     private readonly IResendOrganizationInviteCommand _resendOrganizationInviteCommand;
+    private readonly IAutomaticallyConfirmOrganizationUserCommand _automaticallyConfirmOrganizationUserCommand;
+    private readonly TimeProvider _timeProvider;
     private readonly IConfirmOrganizationUserCommand _confirmOrganizationUserCommand;
     private readonly IRestoreOrganizationUserCommand _restoreOrganizationUserCommand;
     private readonly IInitPendingOrganizationCommand _initPendingOrganizationCommand;
@@ -97,7 +101,9 @@ public OrganizationUsersController(IOrganizationRepository organizationRepositor
         IRestoreOrganizationUserCommand restoreOrganizationUserCommand,
         IInitPendingOrganizationCommand initPendingOrganizationCommand,
         IRevokeOrganizationUserCommand revokeOrganizationUserCommand,
-        IResendOrganizationInviteCommand resendOrganizationInviteCommand)
+        IResendOrganizationInviteCommand resendOrganizationInviteCommand,
+        IAutomaticallyConfirmOrganizationUserCommand automaticallyConfirmOrganizationUserCommand,
+        TimeProvider timeProvider)
     {
         _organizationRepository = organizationRepository;
         _organizationUserRepository = organizationUserRepository;
@@ -122,6 +128,8 @@ public OrganizationUsersController(IOrganizationRepository organizationRepositor
         _featureService = featureService;
         _pricingClient = pricingClient;
         _resendOrganizationInviteCommand = resendOrganizationInviteCommand;
+        _automaticallyConfirmOrganizationUserCommand = automaticallyConfirmOrganizationUserCommand;
+        _timeProvider = timeProvider;
         _confirmOrganizationUserCommand = confirmOrganizationUserCommand;
         _restoreOrganizationUserCommand = restoreOrganizationUserCommand;
         _initPendingOrganizationCommand = initPendingOrganizationCommand;
@@ -691,6 +699,56 @@ public async Task PatchBulkEnableSecretsManagerAsync(Guid orgId,
         await BulkEnableSecretsManagerAsync(orgId, model);
     }
 
+
+    [Authorize<ManageUsersRequirement>]
+    [HttpPost("{id}/auto-confirm")]
+    public async Task<IActionResult> AutomaticallyConfirmOrganizationUserAsync([FromRoute] Guid orgId,
+        [FromRoute] Guid id,
+        [FromBody] OrganizationUserConfirmRequestModel model)
+    {
+        if (!_featureService.IsEnabled(FeatureFlagKeys.AutomaticConfirmUsers))
+        {
+            return NotFound();
+        }
+
+        var userId = _userService.GetProperUserId(User);
+
+        if (userId is null || userId.Value == Guid.Empty)
+        {
+            return Unauthorized();
+        }
+
+        var result = await _automaticallyConfirmOrganizationUserCommand.AutomaticallyConfirmOrganizationUserAsync(
+            new AutomaticallyConfirmOrganizationUserRequest
+            {
+                OrganizationId = orgId,
+                OrganizationUserId = id,
+                Key = model.Key,
+                DefaultUserCollectionName = model.DefaultUserCollectionName,
+                PerformedBy = new StandardUser(userId.Value, await _currentContext.OrganizationOwner(orgId)),
+                PerformedOn = _timeProvider.GetUtcNow()
+            });
+
+        if (result is { IsError: true })
+        {
+            return result.AsError switch
+            {
+                NotFoundError notFound => NotFound(notFound.Message),
+                BadRequestError badRequest => BadRequest(badRequest.Message),
+                InternalError internalError => Problem(
+                    detail: internalError.Message,
+                    statusCode: StatusCodes.Status500InternalServerError,
+                    title: "An unexpected error occurred. Please try again or contact support."),
+                _ => Problem(
+                    detail: result.AsError.Message,
+                    statusCode: StatusCodes.Status500InternalServerError,
+                    title: "An unexpected error occurred")
+            };
+        }
+
+        return Ok();
+    }
+
     private async Task RestoreOrRevokeUserAsync(
         Guid orgId,
         Guid id,

src/Core/AdminConsole/Enums/EventType.cs

@@ -60,6 +60,7 @@ public enum EventType : int
     OrganizationUser_RejectedAuthRequest = 1514,
     OrganizationUser_Deleted = 1515, // Both user and organization user data were deleted
     OrganizationUser_Left = 1516,    // User voluntarily left the organization
+    OrganizationUser_AutomaticallyConfirmed = 1517,
 
     Organization_Updated = 1600,
     Organization_PurgedVault = 1601,

src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/AutoConfirmUser/AutomaticallyConfirmOrganizationUserCommand.cs

@@ -0,0 +1,200 @@
+using Bit.Core.AdminConsole.Entities;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.DeleteClaimedAccount;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies;
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
+using Bit.Core.Entities;
+using Bit.Core.Enums;
+using Bit.Core.Models.Data;
+using Bit.Core.Platform.Push;
+using Bit.Core.Repositories;
+using Bit.Core.Services;
+using Microsoft.Extensions.Logging;
+using OneOf.Types;
+using CommandResult = Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.DeleteClaimedAccount.CommandResult;
+
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.AutoConfirmUser;
+
+public class AutomaticallyConfirmOrganizationUserCommand(IOrganizationUserRepository organizationUserRepository,
+    IOrganizationRepository organizationRepository,
+    IAutomaticallyConfirmOrganizationUsersValidator validator,
+    IEventService eventService,
+    IMailService mailService,
+    IUserRepository userRepository,
+    IPushRegistrationService pushRegistrationService,
+    IDeviceRepository deviceRepository,
+    IPushNotificationService pushNotificationService,
+    IFeatureService featureService,
+    IPolicyRequirementQuery policyRequirementQuery,
+    ICollectionRepository collectionRepository,
+    ILogger<AutomaticallyConfirmOrganizationUserCommand> logger) : IAutomaticallyConfirmOrganizationUserCommand
+{
+    public async Task<CommandResult> AutomaticallyConfirmOrganizationUserAsync(AutomaticallyConfirmOrganizationUserRequest request)
+    {
+        var requestData = await RetrieveDataAsync(request);
+
+        if (requestData.IsError) return requestData.AsError;
+
+        var validatedData = await validator.ValidateAsync(requestData.AsSuccess);
+
+        if (validatedData.IsError) return validatedData.AsError;
+
+        var validatedRequest = validatedData.Request;
+
+        var successfulConfirmation = await organizationUserRepository.ConfirmOrganizationUserAsync(validatedRequest.OrganizationUser);
+
+        if (!successfulConfirmation) return new None();
+
+        return await validatedRequest.ToCommandResultAsync()
+            .MapAsync(CreateDefaultCollectionsAsync)
+            .MapAsync(LogOrganizationUserConfirmedEventAsync)
+            .MapAsync(SendConfirmedOrganizationUserEmailAsync)
+            .MapAsync(DeleteDeviceRegistrationAsync)
+            .MapAsync(PushSyncOrganizationKeysAsync)
+            .ToResultAsync();
+    }
+
+    private async Task<CommandResult<AutomaticallyConfirmOrganizationUserRequestData>> CreateDefaultCollectionsAsync(
+        AutomaticallyConfirmOrganizationUserRequestData request)
+    {
+        try
+        {
+            if (!featureService.IsEnabled(FeatureFlagKeys.CreateDefaultLocation)
+                || string.IsNullOrWhiteSpace(request.DefaultUserCollectionName)
+                || !(await policyRequirementQuery.GetAsync<OrganizationDataOwnershipPolicyRequirement>(request.UserId))
+                    .RequiresDefaultCollectionOnConfirm(request.Organization.Id))
+            {
+                return request;
+            }
+
+            await collectionRepository.CreateAsync(
+                new Collection
+                {
+                    OrganizationId = request.Organization.Id,
+                    Name = request.DefaultUserCollectionName,
+                    Type = CollectionType.DefaultUserCollection
+                },
+                groups: null,
+                [new CollectionAccessSelection
+                {
+                    Id = request.OrganizationUser.Id,
+                    Manage = true
+                }]);
+
+            return request;
+        }
+        catch (Exception ex)
+        {
+            logger.LogError(ex, "Failed to create default collection for user.");
+            return new FailedToCreateDefaultCollection();
+        }
+    }
+
+    private async Task<CommandResult<AutomaticallyConfirmOrganizationUserRequestData>> PushSyncOrganizationKeysAsync(AutomaticallyConfirmOrganizationUserRequestData request)
+    {
+        try
+        {
+            await pushNotificationService.PushSyncOrgKeysAsync(request.UserId);
+            return request;
+        }
+        catch (Exception ex)
+        {
+            logger.LogError(ex, "Failed to push organization keys.");
+            return new FailedToPushOrganizationSyncKeys();
+        }
+    }
+
+    private async Task<CommandResult<AutomaticallyConfirmOrganizationUserRequestData>> LogOrganizationUserConfirmedEventAsync(
+        AutomaticallyConfirmOrganizationUserRequestData request)
+    {
+        try
+        {
+            await eventService.LogOrganizationUserEventAsync(request.OrganizationUser,
+                EventType.OrganizationUser_AutomaticallyConfirmed,
+                request.PerformedOn.UtcDateTime);
+            return request;
+        }
+        catch (Exception ex)
+        {
+            logger.LogError(ex, "Failed to log OrganizationUser_AutomaticallyConfirmed event.");
+            return new FailedToWriteToEventLog();
+        }
+    }
+
+    private async Task<CommandResult<AutomaticallyConfirmOrganizationUserRequestData>> SendConfirmedOrganizationUserEmailAsync(
+        AutomaticallyConfirmOrganizationUserRequestData request)
+    {
+        try
+        {
+            var user = await userRepository.GetByIdAsync(request.UserId);
+
+            if (user is null) return new UserNotFoundError();
+
+            await mailService.SendOrganizationConfirmedEmailAsync(request.Organization.Name,
+                user.Email,
+                request.OrganizationUser.AccessSecretsManager);
+
+            return request;
+        }
+        catch (Exception ex)
+        {
+            logger.LogError(ex, "Failed to send OrganizationUserConfirmed.");
+            return new FailedToSendConfirmedUserEmail();
+        }
+    }
+
+    private async Task<CommandResult<AutomaticallyConfirmOrganizationUserRequestData>> DeleteDeviceRegistrationAsync(
+        AutomaticallyConfirmOrganizationUserRequestData request)
+    {
+        try
+        {
+            var devices = (await deviceRepository.GetManyByUserIdAsync(request.UserId))
+                    .Where(d => !string.IsNullOrWhiteSpace(d.PushToken))
+                    .Select(d => d.Id.ToString());
+
+            await pushRegistrationService.DeleteUserRegistrationOrganizationAsync(devices, request.Organization.Id.ToString());
+            return request;
+        }
+        catch (Exception ex)
+        {
+            logger.LogError(ex, "Failed to delete device registration.");
+            return new FailedToDeleteDeviceRegistration();
+        }
+    }
+
+    private async Task<CommandResult<AutomaticallyConfirmOrganizationUserRequestData>> RetrieveDataAsync(
+        AutomaticallyConfirmOrganizationUserRequest request)
+    {
+        var organizationUser = await GetOrganizationUserAsync(request.OrganizationUserId);
+
+        if (organizationUser.IsError) return organizationUser.AsError;
+
+        var organization = await GetOrganizationAsync(request.OrganizationId);
+
+        if (organization.IsError) return organization.AsError;
+
+        return new AutomaticallyConfirmOrganizationUserRequestData
+        {
+            OrganizationUser = organizationUser.AsSuccess,
+            Organization = organization.AsSuccess,
+            PerformedBy = request.PerformedBy,
+            Key = request.Key,
+            DefaultUserCollectionName = request.DefaultUserCollectionName,
+            PerformedOn = request.PerformedOn
+        };
+    }
+
+    private async Task<CommandResult<OrganizationUser>> GetOrganizationUserAsync(Guid organizationUserId)
+    {
+        var organizationUser = await organizationUserRepository.GetByIdAsync(organizationUserId);
+
+        return organizationUser is { UserId: not null } ? organizationUser : new UserNotFoundError();
+    }
+
+    private async Task<CommandResult<Organization>> GetOrganizationAsync(Guid organizationId)
+    {
+        var organization = await organizationRepository.GetByIdAsync(organizationId);
+
+        return organization is not null ? organization : new OrganizationNotFound();
+    }
+}