Tom
2 days ago
committed by
GitHub
GitHub
6 changed files with 324 additions and 96 deletions
@ -0,0 +1,289 @@ |
|||
//! The Send controls policy (21) absorbs the legacy `Disable Send` (6) and `Send Options` (7) policies.
|
|||
//! Like upstream, the three are kept in sync in both directions, so clients that only know the legacy
|
|||
//! policies keep enforcing the same rules, and Sends are checked against all of them.
|
|||
//!
|
|||
//! https://github.com/bitwarden/server/tree/04a4d7548b07d18ab7327ddaae81a05fd893a820/src/Core/AdminConsole/OrganizationFeatures/Policies
|
|||
|
|||
use chrono::TimeDelta; |
|||
use diesel::prelude::*; |
|||
use num_traits::FromPrimitive; |
|||
use serde::Deserialize; |
|||
use serde_json::Value; |
|||
|
|||
use super::{OrgPolicy, OrgPolicyType, SendOptionsPolicyData}; |
|||
use crate::{ |
|||
api::{ApiResult, EmptyResult}, |
|||
db::{ |
|||
DbConn, |
|||
models::{MembershipStatus, MembershipType, OrganizationId, Send, SendType, UserId}, |
|||
schema::{org_policies, users_organizations}, |
|||
}, |
|||
}; |
|||
|
|||
const SEND_POLICIES: [i32; 3] = |
|||
[OrgPolicyType::DisableSend as i32, OrgPolicyType::SendOptions as i32, OrgPolicyType::SendControls as i32]; |
|||
|
|||
// SendWhoCanAccessType. Specific people requires Sends with email verification, which are not supported.
|
|||
const ACCESS_ANY: i32 = 0; |
|||
const ACCESS_PASSWORD: i32 = 1; |
|||
const ACCESS_SPECIFIC_PEOPLE: i32 = 2; |
|||
|
|||
// https://github.com/bitwarden/server/blob/04a4d7548b07d18ab7327ddaae81a05fd893a820/src/Core/AdminConsole/Models/Data/Organizations/Policies/SendControlsPolicyData.cs
|
|||
#[derive(Default, Deserialize, Serialize)] |
|||
#[serde(default, rename_all = "camelCase")] |
|||
struct SendControlsPolicyData { |
|||
#[serde(alias = "DisableSend")] |
|||
disable_send: bool, |
|||
#[serde(alias = "DisableHideEmail")] |
|||
disable_hide_email: bool, |
|||
#[serde(alias = "WhoCanAccess")] |
|||
who_can_access: Option<i32>, |
|||
#[serde(alias = "AllowedDomains")] |
|||
allowed_domains: Option<String>, |
|||
#[serde(alias = "DeletionHours")] |
|||
deletion_hours: Option<i32>, |
|||
#[serde(alias = "AllowedSendTypes")] |
|||
allowed_send_types: Option<Vec<i32>>, |
|||
} |
|||
|
|||
impl SendControlsPolicyData { |
|||
/// Validates the data an organization saves. Requiring email verification, which allowed domains
|
|||
/// depend on, would leave members unable to create any Send, so it is refused.
|
|||
fn parse(data: Option<&Value>) -> ApiResult<Self> { |
|||
let data = match Option::<Self>::deserialize(data.unwrap_or(&Value::Null)) { |
|||
Ok(data) => data.unwrap_or_default(), |
|||
Err(e) => err!(format!("Invalid Send controls policy data: {e}")), |
|||
}; |
|||
match data.who_can_access { |
|||
None | Some(ACCESS_ANY | ACCESS_PASSWORD) => (), |
|||
Some(ACCESS_SPECIFIC_PEOPLE) => { |
|||
err!("Sends with email verification are not supported, so that access type cannot be required") |
|||
} |
|||
Some(_) => err!("Invalid Send controls access type"), |
|||
} |
|||
if data.allowed_domains.is_some() { |
|||
err!("Allowed domains require Sends with email verification, which are not supported") |
|||
} |
|||
if data.deletion_hours.is_some_and(|hours| hours < 1) { |
|||
err!("The maximum lifetime of a Send has to be at least one hour") |
|||
} |
|||
// Current clients may also list Item Sends (2), which can not be created here.
|
|||
if let Some(types) = &data.allowed_send_types |
|||
&& (types.iter().any(|t| !(0..=2).contains(t)) |
|||
|| !types.iter().any(|t| *t == SendType::Text as i32 || *t == SendType::File as i32)) |
|||
{ |
|||
err!("The allowed Send types have to include Text or File") |
|||
} |
|||
Ok(data) |
|||
} |
|||
|
|||
/// Every organization's restrictions apply, so a less strict organization never relaxes a stricter
|
|||
/// one, independent of the order the policies are loaded in.
|
|||
fn merge(&mut self, other: Self) { |
|||
self.disable_send |= other.disable_send; |
|||
self.disable_hide_email |= other.disable_hide_email; |
|||
self.who_can_access = self.who_can_access.max(other.who_can_access); |
|||
self.deletion_hours = match (self.deletion_hours, other.deletion_hours) { |
|||
(Some(a), Some(b)) => Some(a.min(b)), |
|||
(a, b) => a.or(b), |
|||
}; |
|||
self.allowed_send_types = match (self.allowed_send_types.take(), other.allowed_send_types) { |
|||
(Some(a), Some(b)) => Some(a.into_iter().filter(|t| b.contains(t)).collect()), |
|||
(a, b) => a.or(b), |
|||
}; |
|||
} |
|||
|
|||
/// Checks the Send as it would be saved, like upstream's `SendValidationService`.
|
|||
fn check_send(&self, send: &Send) -> EmptyResult { |
|||
if self.disable_send { |
|||
err!("Due to an Enterprise Policy, you are only able to delete an existing Send.") |
|||
} |
|||
if self.disable_hide_email && send.hide_email.unwrap_or(false) { |
|||
err!( |
|||
"Due to an Enterprise Policy, you are not allowed to hide your email address \ |
|||
from recipients when creating or editing a Send." |
|||
) |
|||
} |
|||
if self.who_can_access == Some(ACCESS_PASSWORD) && send.password_hash.is_none() { |
|||
err!("Due to an Enterprise policy your Sends must be protected by password") |
|||
} |
|||
if let Some(types) = &self.allowed_send_types |
|||
&& !types.contains(&send.atype) |
|||
{ |
|||
let names: Vec<&str> = types |
|||
.iter() |
|||
.map(|t| match *t { |
|||
0 => "Text", |
|||
1 => "File", |
|||
_ => "Unknown", |
|||
}) |
|||
.collect(); |
|||
err!(format!("Due to an Enterprise policy your Sends must be of the following types: {}", names.join(", "))) |
|||
} |
|||
// Upstream allows for up to a minute of skew between the deletion and the creation date.
|
|||
if let Some(hours) = self.deletion_hours |
|||
&& send.deletion_date - send.creation_date - TimeDelta::minutes(1) > TimeDelta::hours(i64::from(hours)) |
|||
{ |
|||
let (duration, unit) = if hours >= 24 { |
|||
(hours / 24, "day") |
|||
} else { |
|||
(hours, "hour") |
|||
}; |
|||
let plural = if duration > 1 { |
|||
"s" |
|||
} else { |
|||
"" |
|||
}; |
|||
err!(format!( |
|||
"Due to an Enterprise policy your Sends must have deletion dates no more than {duration} {unit}{plural} from their creation dates" |
|||
)) |
|||
} |
|||
Ok(()) |
|||
} |
|||
} |
|||
|
|||
/// Whether an enabled `Send Options` policy disables hiding the email. Unreadable data keeps the option on.
|
|||
fn hide_email_disabled(policy: &OrgPolicy) -> bool { |
|||
policy.enabled |
|||
&& serde_json::from_str::<Option<SendOptionsPolicyData>>(&policy.data).map_or_else( |
|||
|_| { |
|||
error!("Failed to deserialize SendOptionsPolicyData: {}", policy.data); |
|||
true |
|||
}, |
|||
|data| data.is_some_and(|d| d.disable_hide_email), |
|||
) |
|||
} |
|||
|
|||
/// The options of the legacy policies, as Send controls holds them. A disabled `Send Options` policy
|
|||
/// counts as off, so a later save of Send controls does not switch its stored option back on.
|
|||
fn legacy_send_options(policies: &[OrgPolicy]) -> (bool, bool) { |
|||
let disable_send = policies.iter().any(|p| p.has_type(OrgPolicyType::DisableSend) && p.enabled); |
|||
let disable_hide_email = policies.iter().any(|p| p.has_type(OrgPolicyType::SendOptions) && hide_email_disabled(p)); |
|||
(disable_send, disable_hide_email) |
|||
} |
|||
|
|||
/// Mirrors a saved Send policy into the others, like upstream's `SendControlsSyncPolicyEvent`,
|
|||
/// `DisableSendSyncPolicyEvent` and `SendOptionsSyncPolicyEvent`, and returns the policies to save.
|
|||
/// `policies` are the organization's policies, including the saved one.
|
|||
fn mirror_send_policies(saved: &OrgPolicy, policies: &[OrgPolicy]) -> ApiResult<Vec<OrgPolicy>> { |
|||
let find_or_new = |policy_type| { |
|||
policies |
|||
.iter() |
|||
.find(|p| p.has_type(policy_type)) |
|||
.cloned() |
|||
.unwrap_or_else(|| OrgPolicy::new(saved.org_uuid.clone(), policy_type, false, String::from("null"))) |
|||
}; |
|||
|
|||
if saved.has_type(OrgPolicyType::SendControls) { |
|||
let data = saved.send_controls_data(); |
|||
let mut disable_send = find_or_new(OrgPolicyType::DisableSend); |
|||
disable_send.enabled = saved.enabled && data.disable_send; |
|||
let mut send_options = find_or_new(OrgPolicyType::SendOptions); |
|||
send_options.enabled = saved.enabled && data.disable_hide_email; |
|||
send_options.data = serde_json::to_string(&SendOptionsPolicyData { |
|||
disable_hide_email: data.disable_hide_email, |
|||
})?; |
|||
return Ok(vec![disable_send, send_options]); |
|||
} |
|||
|
|||
let mut controls = find_or_new(OrgPolicyType::SendControls); |
|||
let mut data = controls.send_controls_data(); |
|||
(data.disable_send, data.disable_hide_email) = legacy_send_options(policies); |
|||
// Turning a legacy policy off must not switch off the restrictions only Send controls has.
|
|||
controls.enabled |= data.disable_send || data.disable_hide_email; |
|||
controls.data = serde_json::to_string(&data)?; |
|||
Ok(vec![controls]) |
|||
} |
|||
|
|||
impl OrgPolicy { |
|||
/// Stored data was validated when saved; data that can not be read blocks Sends instead of allowing them.
|
|||
fn send_controls_data(&self) -> SendControlsPolicyData { |
|||
let data = serde_json::from_str::<Value>(&self.data).ok(); |
|||
data.and_then(|data| SendControlsPolicyData::parse(Some(&data)).ok()).unwrap_or_else(|| { |
|||
error!("Invalid Send controls policy data, blocking Sends: {}", self.data); |
|||
SendControlsPolicyData { |
|||
disable_send: true, |
|||
..Default::default() |
|||
} |
|||
}) |
|||
} |
|||
|
|||
/// Validates the data of a Send policy before it is saved and returns the data to store.
|
|||
pub fn send_policy_data(policy_type: OrgPolicyType, data: Option<Value>) -> ApiResult<Option<Value>> { |
|||
match policy_type { |
|||
OrgPolicyType::SendControls => { |
|||
Ok(Some(serde_json::to_value(SendControlsPolicyData::parse(data.as_ref())?)?)) |
|||
} |
|||
OrgPolicyType::SendOptions => { |
|||
if let Some(value) = &data |
|||
&& let Err(e) = Option::<SendOptionsPolicyData>::deserialize(value) |
|||
{ |
|||
err!(format!("Invalid Send options policy data: {e}")) |
|||
} |
|||
Ok(data) |
|||
} |
|||
_ => Ok(data), |
|||
} |
|||
} |
|||
|
|||
/// Keeps Send controls and the legacy Send policies in sync after one of them was saved.
|
|||
pub async fn sync_send_policies(saved: &Self, conn: &DbConn) -> EmptyResult { |
|||
if !SEND_POLICIES.contains(&saved.atype) { |
|||
return Ok(()); |
|||
} |
|||
for mut policy in mirror_send_policies(saved, &Self::find_by_org(&saved.org_uuid, conn).await)? { |
|||
policy.save(conn).await?; |
|||
} |
|||
Ok(()) |
|||
} |
|||
|
|||
/// Upstream's `PolicyQuery`: until Send controls is saved, it is derived from the legacy policies, so the
|
|||
/// current policy editor shows what is enforced instead of turning it off on the next save.
|
|||
pub fn synthesize_send_controls(org_id: &OrganizationId, policies: &[Self]) -> Self { |
|||
let (disable_send, disable_hide_email) = legacy_send_options(policies); |
|||
let data = SendControlsPolicyData { |
|||
disable_send, |
|||
disable_hide_email, |
|||
..Default::default() |
|||
}; |
|||
Self::new( |
|||
org_id.clone(), |
|||
OrgPolicyType::SendControls, |
|||
disable_send || disable_hide_email, |
|||
json!(data).to_string(), |
|||
) |
|||
} |
|||
|
|||
/// Enforces the Send policies of every organization in which the user is an accepted or confirmed
|
|||
/// member below Admin on the Send as it would be saved. Deleting a Send stays possible.
|
|||
pub async fn check_send(user_id: &UserId, send: &Send, conn: &DbConn) -> EmptyResult { |
|||
let policies = conn |
|||
.run(move |conn| { |
|||
org_policies::table |
|||
.inner_join(users_organizations::table.on(users_organizations::org_uuid.eq(org_policies::org_uuid))) |
|||
.filter(users_organizations::user_uuid.eq(user_id)) |
|||
.filter( |
|||
users_organizations::status |
|||
.eq_any([MembershipStatus::Accepted as i32, MembershipStatus::Confirmed as i32]), |
|||
) |
|||
// Owners and admins are exempt. The numbers of MembershipType are not its order.
|
|||
.filter(users_organizations::atype.ne(MembershipType::Owner as i32)) |
|||
.filter(users_organizations::atype.ne(MembershipType::Admin as i32)) |
|||
.filter(org_policies::enabled.eq(true)) |
|||
.filter(org_policies::atype.eq_any(SEND_POLICIES)) |
|||
.select(org_policies::all_columns) |
|||
.load::<Self>(conn) |
|||
}) |
|||
.await?; |
|||
|
|||
let mut controls = SendControlsPolicyData::default(); |
|||
for policy in policies { |
|||
match OrgPolicyType::from_i32(policy.atype) { |
|||
Some(OrgPolicyType::DisableSend) => controls.disable_send = true, |
|||
Some(OrgPolicyType::SendOptions) => controls.disable_hide_email |= hide_email_disabled(&policy), |
|||
_ => controls.merge(policy.send_controls_data()), |
|||
} |
|||
} |
|||
controls.check_send(send) |
|||
} |
|||
} |
|||
Loading…
Reference in new issue