Public Access
Share a vault with a team, without the server holding a key
M3's teams, sharing and ACLs. Teams with roles, a public-key directory, the append-only key log served for clients to check it against, team-owned vaults, and vault key grants wrapped by a client and stored opaquely by the server. VaultAccessService resolves team membership to PermissionFlags, so a viewer may pull and may not push; the desktop client reads and syncs every vault it holds a key for, and a real TEAMS screen replaces the one that said it did not exist. No migration: team, team_membership, vault.team_id and vault_key_grant have all been there since the first one, which is what carrying two unused tables bought. Membership is authorisation. A grant is access. The obvious model is one concept — "access", with a role attached, handed out by the server — and this architecture cannot implement it: a vault key is sealed to each member's X25519 key, and only a client holding the plaintext can seal it for somebody else. So "give Bob access" decomposes into a database write and a wrap, which happen on different machines. Adding a member makes the server serve them the vault; it cannot make it readable. VaultSummary.WrappedVaultKey is null in the meantime and the vault appears in their list saying it is waiting for a key, because hiding it until a grant existed would have been tidier and would have implied the server was the thing granting access. The screen says the same thing after every add, in the status line. ADR 0009 records the whole decision. Sharing verifies or refuses. A directory lookup is a claim by the server about a third party's public key, and wrapping to an unverified claim hands the vault to whoever made it — no amount of transport security helps, because the server is inside the threat model. KeyLogAudit reads the whole log, recomputes every entry's hash from its own contents, checks the chain from genesis, and refuses unless the offered key appears in it unchanged. There is no override flag: one that exists gets used on the day the log is briefly unreachable, and the resulting grant is indistinguishable from a correct one afterwards. What it still cannot promise is that the key is the right person's, so the fingerprint comes back for an out-of-band comparison and the success message says so every time. A test corrupts the fake server's log by one byte and watches the client refuse rather than warn. The roles are only the ones that are enforceable. There is no ConnectOnly, despite the design asking for one and TeamRole having room: SSH terminates on the client, so a session needs the credential's plaintext on that machine, and "may connect but may not read the key" cannot be enforced here. Shipping it as an option in a dropdown would have been a lie. Connect rides along with Read and is documented as an interface hint. Removal is named for what it does — it revokes grants and flags the vault for rekey, and claims nothing about what is already on somebody's laptop. Three things are deliberately absent, and each is a refusal rather than an omission. The rekey itself, because re-wrapping every item's data key under a new vault key needs a client holding the current one; the server records that a rotation is owed and the interface reports it, which is more honest than a button that only appears to do it. Ownership transfer, because allowing an owner to be removed without one leaves a team nobody can administer. And cross-vault host key trust: a pin in a team vault is listed but not consulted at connect time, because any member with Write could otherwise pre-approve a fingerprint another member's client then trusts silently for a host in their own vault. Scoping trust properly needs a scope on the SSH connect path, which IKnownHostStore has not got; until then the narrow direction is the safe one and the cost is in the README rather than hidden. Reading now spans vaults and writing still does not. Every list on the vault and hosts screens covers each vault the keyring opened, rows carry the vault they came from, and an edit goes back to that vault rather than to the active one — writing it to the active vault would fork the item and only show up when a colleague wondered why their change never arrived. A new item goes wherever a picker says, defaulting to the personal vault and never moving on its own, because an item filed into a team's vault is visible to that team and moving it back means deleting and retyping. The sidebar heading stops naming one vault once there are two, and each row names its own. The server checks what it can and nothing it cannot. It will not record a grant for a key its recipient no longer holds, for a superseded generation, or for somebody who is not in the team — each of those would otherwise surface days later at the far end as a tag failure indistinguishable from corruption. It does not verify the wrap or the signature, and the grant service says so: that would be a convenience and never the boundary, and would put an asymmetric implementation on a machine that is supposed to hold no keys. Two bugs the tests found. TeamsViewModel's busy gate blocked its own reload, so a team created a moment earlier was missing from the list it had just been added to. And syncing every vault turned a failure from an exception into a report, which made a background pass announce an unreachable vault once a minute — the exact behaviour AnAutomaticPassThatFails_LeavesTheStatusAlone exists to prevent. The fact is recorded and the message swallowed, as it was before; pressing Sync still names the vault and the reason. Also fixes a build break this branch started with: QuickConnectTests was never updated when M2 added ISftpSessionFactory to the shell's constructor, so nothing built at all.
This commit is contained in:
@@ -0,0 +1,745 @@
|
||||
using System.Globalization;
|
||||
using DodoSSH.Contracts;
|
||||
using DodoSSH.Domain;
|
||||
using DodoSSH.Infrastructure;
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
using Npgsql;
|
||||
|
||||
namespace DodoSSH.Api.Features.Teams;
|
||||
|
||||
/// <summary>The result of a team access check.</summary>
|
||||
/// <param name="Team">The team, when the caller is an active member.</param>
|
||||
/// <param name="Role">The caller's role.</param>
|
||||
internal readonly record struct TeamAccess(Team? Team, TeamRole Role)
|
||||
{
|
||||
/// <summary>Whether the caller is in this team at all.</summary>
|
||||
public bool Granted => Team is not null;
|
||||
|
||||
/// <summary>
|
||||
/// Whether the caller may manage members and vaults.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// The team-level counterpart of <c>PermissionFlags.Admin</c>, and deliberately not derived from
|
||||
/// it: those flags describe a vault, and adding a member is not an operation on any vault.
|
||||
/// </remarks>
|
||||
public bool CanAdminister => Role is TeamRole.Admin or TeamRole.Owner;
|
||||
|
||||
/// <summary>Denied access.</summary>
|
||||
public static TeamAccess Denied => new(null, TeamRole.Unspecified);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Teams and their membership.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// <b>Membership is authorization; a key grant is access.</b> Everything in this class moves rows
|
||||
/// that decide what the <em>server</em> will serve. None of it can make a vault readable, because
|
||||
/// making a vault readable means wrapping its key to somebody's public key and only a client holding
|
||||
/// that key can do it. Adding a member is therefore two deliberate steps, and the interface says so:
|
||||
/// add them here, then share the vault key from a machine that has one. Collapsing the two would
|
||||
/// require the server to hold a key, which is the one thing this design is built to avoid.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// The reverse direction is the honest half of the same split. Removing a member revokes their
|
||||
/// grants and flags every team vault for rekey, and that blocks <em>future</em> reads only. Anything
|
||||
/// already on their laptop is already gone; the real remediation is rotating the SSH credential. See
|
||||
/// ADR 0001, and note that this class deliberately does not offer a "revoke access" verb that would
|
||||
/// imply more than it delivers.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
internal sealed class TeamService(
|
||||
DodoDbContext database,
|
||||
TimeProvider clock,
|
||||
ILogger<TeamService> logger)
|
||||
{
|
||||
/// <summary>Longest acceptable slug. Matches the column.</summary>
|
||||
private const int MaxSlugLength = 128;
|
||||
|
||||
/// <summary>Longest acceptable display name. Matches the column.</summary>
|
||||
private const int MaxNameLength = 256;
|
||||
|
||||
/// <summary>Longest acceptable description. Matches the column.</summary>
|
||||
private const int MaxDescriptionLength = 2048;
|
||||
|
||||
/// <summary>Creates a team, with the caller as its owner.</summary>
|
||||
/// <remarks>
|
||||
/// Idempotent on the client-chosen id, exactly as enrollment is: a request whose response was
|
||||
/// lost can be re-sent verbatim and returns the same team rather than creating a second one under
|
||||
/// a name the user meant to type once. A different body under the same id is a client that has
|
||||
/// lost track of its own state and is refused rather than silently reinterpreted.
|
||||
/// </remarks>
|
||||
internal async Task<TeamSummary> CreateAsync(
|
||||
UserAccount user,
|
||||
CreateTeamRequest request,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
var name = RequireText(request.Name, nameof(request.Name), MaxNameLength);
|
||||
var slug = RequireSlug(request.Slug);
|
||||
var description = OptionalText(request.Description, MaxDescriptionLength);
|
||||
|
||||
if (request.TeamId == Guid.Empty)
|
||||
{
|
||||
throw new TeamInvalidException("A team id is required. Generate a UUIDv7 on the client.");
|
||||
}
|
||||
|
||||
var existing = await database.Teams
|
||||
.SingleOrDefaultAsync(t => t.Id == request.TeamId, cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
if (existing is not null)
|
||||
{
|
||||
return await ResolveExistingAsync(user, existing, name, slug, cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
}
|
||||
|
||||
var team = AddTeamWithOwner(user, request.TeamId, name, slug, description);
|
||||
|
||||
try
|
||||
{
|
||||
await database.SaveChangesAsync(cancellationToken).ConfigureAwait(false);
|
||||
}
|
||||
catch (DbUpdateException exception) when (IsUniqueViolation(exception))
|
||||
{
|
||||
// The partial unique index on slug. Reported as its own code because it is the one
|
||||
// failure the caller could not have foreseen from their own input.
|
||||
throw new TeamSlugTakenException(
|
||||
$"The slug '{slug}' is already in use. Choose another.");
|
||||
}
|
||||
|
||||
TeamLog.TeamCreated(logger, team.Id, user.Id);
|
||||
|
||||
return new TeamSummary(
|
||||
team.Id, team.Name, team.Slug, team.Description,
|
||||
TeamMemberRole.Owner, MemberCount: 1, VaultCount: 0, team.CreatedAtUtc);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Adds the team row and the creator's owner membership.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// The two together, never one: a team with no members has nobody who can add any, and the row
|
||||
/// would have to be found and fixed by hand.
|
||||
/// </remarks>
|
||||
private Team AddTeamWithOwner(
|
||||
UserAccount user,
|
||||
Guid teamId,
|
||||
string name,
|
||||
string slug,
|
||||
string? description)
|
||||
{
|
||||
var now = clock.GetUtcNow();
|
||||
|
||||
var team = new Team
|
||||
{
|
||||
Id = teamId,
|
||||
Name = name,
|
||||
Slug = slug,
|
||||
Description = description,
|
||||
CreatedByUserId = user.Id,
|
||||
CreatedAtUtc = now,
|
||||
};
|
||||
|
||||
database.Teams.Add(team);
|
||||
|
||||
database.TeamMemberships.Add(new TeamMembership
|
||||
{
|
||||
Id = Guid.CreateVersion7(),
|
||||
TeamId = team.Id,
|
||||
UserId = user.Id,
|
||||
Role = TeamRole.Owner,
|
||||
Status = MembershipStatus.Active,
|
||||
JoinedAtUtc = now,
|
||||
CreatedAtUtc = now,
|
||||
});
|
||||
|
||||
return team;
|
||||
}
|
||||
|
||||
/// <summary>Lists the teams the caller is an active member of.</summary>
|
||||
internal async Task<IReadOnlyList<TeamSummary>> ListAsync(
|
||||
UserAccount user,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
var memberships = await database.TeamMemberships
|
||||
.Where(m => m.UserId == user.Id
|
||||
&& m.Status == MembershipStatus.Active
|
||||
&& m.DeletedAtUtc == null)
|
||||
.ToListAsync(cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
if (memberships.Count == 0)
|
||||
{
|
||||
return [];
|
||||
}
|
||||
|
||||
var teamIds = memberships.Select(m => m.TeamId).ToArray();
|
||||
|
||||
var teams = await database.Teams
|
||||
.Where(t => teamIds.Contains(t.Id) && t.DeletedAtUtc == null)
|
||||
.OrderBy(t => t.CreatedAtUtc)
|
||||
.ToListAsync(cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
var memberCounts = await database.TeamMemberships
|
||||
.Where(m => teamIds.Contains(m.TeamId)
|
||||
&& m.Status == MembershipStatus.Active
|
||||
&& m.DeletedAtUtc == null)
|
||||
.GroupBy(m => m.TeamId)
|
||||
.Select(g => new { TeamId = g.Key, Count = g.Count() })
|
||||
.ToDictionaryAsync(x => x.TeamId, x => x.Count, cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
var vaultCounts = await database.Vaults
|
||||
.Where(v => v.OwnerKind == VaultOwnerKind.Team
|
||||
&& v.TeamId != null
|
||||
&& teamIds.Contains(v.TeamId.Value)
|
||||
&& v.DeletedAtUtc == null)
|
||||
.GroupBy(v => v.TeamId!.Value)
|
||||
.Select(g => new { TeamId = g.Key, Count = g.Count() })
|
||||
.ToDictionaryAsync(x => x.TeamId, x => x.Count, cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
return
|
||||
[
|
||||
.. teams.Select(team => new TeamSummary(
|
||||
team.Id,
|
||||
team.Name,
|
||||
team.Slug,
|
||||
team.Description,
|
||||
ToContract(memberships.Find(m => m.TeamId == team.Id)!.Role),
|
||||
memberCounts.GetValueOrDefault(team.Id),
|
||||
vaultCounts.GetValueOrDefault(team.Id),
|
||||
team.CreatedAtUtc)),
|
||||
];
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Lists a team's members.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Available to every member, not only to admins. Whoever is about to be handed a vault key needs
|
||||
/// to know who else already holds one, and a directory that only administrators can read makes
|
||||
/// the sharing graph less visible to the people it is about than it is to the operator — who can
|
||||
/// read it straight out of the database either way.
|
||||
/// </remarks>
|
||||
internal async Task<IReadOnlyList<TeamMemberSummary>> ListMembersAsync(
|
||||
Guid teamId,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
var memberships = await database.TeamMemberships
|
||||
.Where(m => m.TeamId == teamId && m.DeletedAtUtc == null)
|
||||
.Include(m => m.User)
|
||||
.ToListAsync(cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
if (memberships.Count == 0)
|
||||
{
|
||||
return [];
|
||||
}
|
||||
|
||||
var userIds = memberships.Select(m => m.UserId).ToArray();
|
||||
|
||||
var enrolled = await database.UserKeys
|
||||
.Where(k => userIds.Contains(k.UserId) && k.IsCurrent)
|
||||
.Select(k => k.UserId)
|
||||
.ToListAsync(cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
var enrolledIds = enrolled.ToHashSet();
|
||||
|
||||
return
|
||||
[
|
||||
.. memberships
|
||||
.OrderByDescending(m => m.Role)
|
||||
.ThenBy(m => m.CreatedAtUtc)
|
||||
.Select(m => new TeamMemberSummary(
|
||||
m.UserId,
|
||||
m.User?.Email,
|
||||
m.User?.DisplayName,
|
||||
ToContract(m.Role),
|
||||
ToContract(m.Status),
|
||||
enrolledIds.Contains(m.UserId),
|
||||
m.JoinedAtUtc)),
|
||||
];
|
||||
}
|
||||
|
||||
/// <summary>Adds a member, or reactivates one who was removed.</summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// The role may not be <see cref="TeamMemberRole.Owner"/>. Ownership is sole, so granting it to
|
||||
/// somebody else is a transfer rather than an addition — a different operation with a different
|
||||
/// confirmation, and not one M3 offers.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// Re-adding a removed member reactivates the original row rather than inserting a second one,
|
||||
/// which is what keeps historic audit entries resolvable to one membership. It does <em>not</em>
|
||||
/// restore their revoked key grants: those were wrapped to a generation the vault has since been
|
||||
/// flagged to leave behind, and a member holding Share has to wrap the key afresh.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
internal async Task<TeamMemberSummary> AddMemberAsync(
|
||||
UserAccount actor,
|
||||
Guid teamId,
|
||||
AddTeamMemberRequest request,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
var role = ToDomain(request.Role);
|
||||
|
||||
if (role is TeamRole.Unspecified or TeamRole.Owner)
|
||||
{
|
||||
throw new TeamInvalidException(
|
||||
"Add a member as viewer, member or admin. Ownership is sole and is not transferred "
|
||||
+ "by adding somebody.");
|
||||
}
|
||||
|
||||
var target = await database.Users
|
||||
.SingleOrDefaultAsync(
|
||||
u => u.Id == request.UserId && u.DeletedAtUtc == null,
|
||||
cancellationToken)
|
||||
.ConfigureAwait(false)
|
||||
|
||||
// Safe to be specific: the caller supplied this id from a directory lookup they just
|
||||
// made, so it confirms nothing they did not already know.
|
||||
?? throw new TeamInvalidException(
|
||||
"No such account on this server. A member has to sign in here once before they can "
|
||||
+ "be added — that is what creates the account and publishes the key a vault would "
|
||||
+ "be shared with.");
|
||||
|
||||
var now = clock.GetUtcNow();
|
||||
|
||||
var membership = await database.TeamMemberships
|
||||
.SingleOrDefaultAsync(
|
||||
m => m.TeamId == teamId && m.UserId == target.Id && m.DeletedAtUtc == null,
|
||||
cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
if (membership is null)
|
||||
{
|
||||
membership = new TeamMembership
|
||||
{
|
||||
Id = Guid.CreateVersion7(),
|
||||
TeamId = teamId,
|
||||
UserId = target.Id,
|
||||
InvitedByUserId = actor.Id,
|
||||
CreatedAtUtc = now,
|
||||
};
|
||||
|
||||
database.TeamMemberships.Add(membership);
|
||||
}
|
||||
else if (membership.Status == MembershipStatus.Active)
|
||||
{
|
||||
throw new TeamInvalidException(
|
||||
"That account is already a member of this team. Change their role instead.");
|
||||
}
|
||||
|
||||
membership.Role = role;
|
||||
membership.Status = MembershipStatus.Active;
|
||||
membership.JoinedAtUtc = now;
|
||||
|
||||
await database.SaveChangesAsync(cancellationToken).ConfigureAwait(false);
|
||||
|
||||
TeamLog.MemberAdded(logger, teamId, target.Id, role, actor.Id);
|
||||
|
||||
return await DescribeAsync(target, membership, cancellationToken).ConfigureAwait(false);
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
/// Enrollment is looked up rather than inferred, because it is the one field on a member row that
|
||||
/// is about them and not about the membership: somebody can be added on Monday and set their
|
||||
/// vault up on Tuesday, and the interface has to stop offering to share with them in between.
|
||||
/// </remarks>
|
||||
private async Task<TeamMemberSummary> DescribeAsync(
|
||||
UserAccount user,
|
||||
TeamMembership membership,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
var isEnrolled = await database.UserKeys
|
||||
.AnyAsync(k => k.UserId == user.Id && k.IsCurrent, cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
return new TeamMemberSummary(
|
||||
user.Id,
|
||||
user.Email,
|
||||
user.DisplayName,
|
||||
ToContract(membership.Role),
|
||||
ToContract(membership.Status),
|
||||
isEnrolled,
|
||||
membership.JoinedAtUtc);
|
||||
}
|
||||
|
||||
/// <summary>Changes a member's role.</summary>
|
||||
internal async Task<TeamMemberSummary> ChangeRoleAsync(
|
||||
UserAccount actor,
|
||||
Guid teamId,
|
||||
Guid memberId,
|
||||
ChangeTeamMemberRoleRequest request,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
var role = ToDomain(request.Role);
|
||||
|
||||
if (role is TeamRole.Unspecified or TeamRole.Owner)
|
||||
{
|
||||
throw new TeamInvalidException(
|
||||
"A member may be made a viewer, a member or an admin. Ownership is sole and is not "
|
||||
+ "granted this way.");
|
||||
}
|
||||
|
||||
var membership = await RequireMembershipAsync(teamId, memberId, cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
// Demoting the owner is what would leave the team ownerless, and there is no transfer to
|
||||
// do it through yet. Refused with the code a client can act on rather than a bare 400.
|
||||
if (membership.Role == TeamRole.Owner)
|
||||
{
|
||||
throw new LastTeamOwnerException(
|
||||
"This team's owner cannot be demoted, because nothing can appoint a replacement yet.");
|
||||
}
|
||||
|
||||
membership.Role = role;
|
||||
|
||||
await database.SaveChangesAsync(cancellationToken).ConfigureAwait(false);
|
||||
|
||||
TeamLog.MemberRoleChanged(logger, teamId, memberId, role, actor.Id);
|
||||
|
||||
// The account cannot be missing — a membership has a foreign key to it — but the query is
|
||||
// written to tolerate it rather than to assert, because a null here would become an
|
||||
// exception on a change that has already been committed.
|
||||
var user = await database.Users
|
||||
.SingleOrDefaultAsync(u => u.Id == memberId, cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
return user is null
|
||||
? new TeamMemberSummary(
|
||||
memberId, null, null, ToContract(role), ToContract(membership.Status), false,
|
||||
membership.JoinedAtUtc)
|
||||
: await DescribeAsync(user, membership, cancellationToken).ConfigureAwait(false);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Removes a member, revoking every vault key grant they hold from this team.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// One transaction, because the two halves are not separable: a membership revoked without its
|
||||
/// grants leaves a departed member holding a key the server will happily keep serving, and grants
|
||||
/// revoked without the membership leaves an active member whose vaults have silently stopped
|
||||
/// opening.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// Every affected vault is flagged <c>RekeyRequired</c> rather than rekeyed. A rekey re-wraps
|
||||
/// every item's data key under a new vault key and can only be performed by a client that holds
|
||||
/// the current one; the server can record that one is owed and nothing more. That is M5's key
|
||||
/// rotation, and until it lands the flag is what the interface reads to say so out loud.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
internal async Task RemoveMemberAsync(
|
||||
UserAccount actor,
|
||||
Guid teamId,
|
||||
Guid memberId,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
var membership = await RequireMembershipAsync(teamId, memberId, cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
if (membership.Role == TeamRole.Owner)
|
||||
{
|
||||
throw new LastTeamOwnerException(
|
||||
"This team's owner cannot be removed. Ownership transfer is not implemented, so "
|
||||
+ "removing them would leave the team with nobody who can manage it.");
|
||||
}
|
||||
|
||||
var now = clock.GetUtcNow();
|
||||
var strategy = database.Database.CreateExecutionStrategy();
|
||||
|
||||
var revoked = await strategy.ExecuteAsync(async () =>
|
||||
{
|
||||
var transaction = await database.Database
|
||||
.BeginTransactionAsync(cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
await using var _ = transaction.ConfigureAwait(false);
|
||||
|
||||
membership.Status = MembershipStatus.Revoked;
|
||||
membership.DeletedAtUtc = now;
|
||||
|
||||
var count = await RevokeTeamGrantsAsync(teamId, memberId, now, cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
await database.SaveChangesAsync(cancellationToken).ConfigureAwait(false);
|
||||
await transaction.CommitAsync(cancellationToken).ConfigureAwait(false);
|
||||
|
||||
return count;
|
||||
}).ConfigureAwait(false);
|
||||
|
||||
TeamLog.MemberRemoved(logger, teamId, memberId, actor.Id, revoked);
|
||||
}
|
||||
|
||||
/// <summary>Revokes one user's grants on every vault a team owns, and flags each for rekey.</summary>
|
||||
private async Task<int> RevokeTeamGrantsAsync(
|
||||
Guid teamId,
|
||||
Guid memberId,
|
||||
DateTimeOffset now,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
var vaults = await database.Vaults
|
||||
.Where(v => v.TeamId == teamId
|
||||
&& v.OwnerKind == VaultOwnerKind.Team
|
||||
&& v.DeletedAtUtc == null)
|
||||
.ToListAsync(cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
if (vaults.Count == 0)
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
|
||||
var vaultIds = vaults.Select(v => v.Id).ToArray();
|
||||
|
||||
var grants = await database.VaultKeyGrants
|
||||
.Where(g => vaultIds.Contains(g.VaultId)
|
||||
&& g.RecipientUserId == memberId
|
||||
&& g.RevokedAtUtc == null)
|
||||
.ToListAsync(cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
foreach (var grant in grants)
|
||||
{
|
||||
grant.State = GrantState.Revoked;
|
||||
grant.RevokedAtUtc = now;
|
||||
}
|
||||
|
||||
// Flagged whether or not this member held a grant. Somebody who was a member without a key
|
||||
// still saw the vault's existence, its item count and its plaintext columns, and the vault's
|
||||
// key is what a rekey would change — so "they never had a grant" is not a reason to leave the
|
||||
// flag clear.
|
||||
foreach (var vault in vaults)
|
||||
{
|
||||
vault.RekeyRequired = true;
|
||||
vault.RekeyReason = RekeyReason.MemberRemoved;
|
||||
vault.UpdatedAtUtc = now;
|
||||
}
|
||||
|
||||
return grants.Count;
|
||||
}
|
||||
|
||||
/// <summary>Reads the caller's own membership, for authorization checks.</summary>
|
||||
internal Task<TeamMembership?> FindActiveMembershipAsync(
|
||||
Guid teamId,
|
||||
Guid userId,
|
||||
CancellationToken cancellationToken) =>
|
||||
database.TeamMemberships.SingleOrDefaultAsync(
|
||||
m => m.TeamId == teamId
|
||||
&& m.UserId == userId
|
||||
&& m.Status == MembershipStatus.Active
|
||||
&& m.DeletedAtUtc == null,
|
||||
cancellationToken);
|
||||
|
||||
/// <summary>
|
||||
/// Resolves what the caller may do with a team.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Answers <see cref="TeamAccess.Denied"/> identically for a team that does not exist and one the
|
||||
/// caller is not in, for the reason <c>VaultAccessService</c> gives: a distinct "exists but
|
||||
/// forbidden" is an oracle for other tenants' team ids.
|
||||
/// </remarks>
|
||||
internal async Task<TeamAccess> ResolveAsync(
|
||||
Guid userId,
|
||||
Guid teamId,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
var team = await database.Teams
|
||||
.SingleOrDefaultAsync(t => t.Id == teamId && t.DeletedAtUtc == null, cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
if (team is null)
|
||||
{
|
||||
return TeamAccess.Denied;
|
||||
}
|
||||
|
||||
var membership = await FindActiveMembershipAsync(teamId, userId, cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
return membership is null ? TeamAccess.Denied : new TeamAccess(team, membership.Role);
|
||||
}
|
||||
|
||||
private async Task<TeamMembership> RequireMembershipAsync(
|
||||
Guid teamId,
|
||||
Guid memberId,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
var membership = await database.TeamMemberships
|
||||
.SingleOrDefaultAsync(
|
||||
m => m.TeamId == teamId
|
||||
&& m.UserId == memberId
|
||||
&& m.Status == MembershipStatus.Active
|
||||
&& m.DeletedAtUtc == null,
|
||||
cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
return membership
|
||||
?? throw new TeamInvalidException("That account is not an active member of this team.");
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
/// A retry is the same id with the same name and slug, from the account that owns it. Anything
|
||||
/// else under an id that is already taken is refused: silently returning somebody else's team
|
||||
/// would be an existence oracle, and returning a differently-named one would tell a client its
|
||||
/// rename succeeded when nothing changed.
|
||||
/// </remarks>
|
||||
private async Task<TeamSummary> ResolveExistingAsync(
|
||||
UserAccount user,
|
||||
Team existing,
|
||||
string name,
|
||||
string slug,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
var membership = await FindActiveMembershipAsync(existing.Id, user.Id, cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
var isRetry = membership?.Role == TeamRole.Owner
|
||||
&& existing.DeletedAtUtc == null
|
||||
&& string.Equals(existing.Name, name, StringComparison.Ordinal)
|
||||
&& string.Equals(existing.Slug, slug, StringComparison.Ordinal);
|
||||
|
||||
if (!isRetry)
|
||||
{
|
||||
throw new TeamInvalidException(
|
||||
"That team id is already in use. Generate a new UUIDv7 and retry.");
|
||||
}
|
||||
|
||||
var memberCount = await database.TeamMemberships
|
||||
.CountAsync(
|
||||
m => m.TeamId == existing.Id
|
||||
&& m.Status == MembershipStatus.Active
|
||||
&& m.DeletedAtUtc == null,
|
||||
cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
var vaultCount = await database.Vaults
|
||||
.CountAsync(
|
||||
v => v.TeamId == existing.Id && v.DeletedAtUtc == null,
|
||||
cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
return new TeamSummary(
|
||||
existing.Id, existing.Name, existing.Slug, existing.Description,
|
||||
TeamMemberRole.Owner, memberCount, vaultCount, existing.CreatedAtUtc);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Validates a slug.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Lowercase ASCII letters, digits and single hyphens, not starting or ending with one. Narrow on
|
||||
/// purpose: the column is <c>citext</c>, so a slug differing only in case is the same slug, and a
|
||||
/// value that renders differently from how it compares is how two teams end up looking distinct
|
||||
/// in a list and colliding on insert.
|
||||
/// </remarks>
|
||||
private static string RequireSlug(string? value)
|
||||
{
|
||||
var slug = (value ?? string.Empty).Trim();
|
||||
|
||||
if (slug.Length is 0 or > MaxSlugLength)
|
||||
{
|
||||
throw new TeamInvalidException(
|
||||
$"A slug of 1 to {MaxSlugLength} characters is required.");
|
||||
}
|
||||
|
||||
var previousWasHyphen = false;
|
||||
|
||||
for (var index = 0; index < slug.Length; index++)
|
||||
{
|
||||
var character = slug[index];
|
||||
var isHyphen = character == '-';
|
||||
|
||||
var acceptable = (character is >= 'a' and <= 'z')
|
||||
|| (character is >= '0' and <= '9')
|
||||
|| isHyphen;
|
||||
|
||||
if (!acceptable
|
||||
|| (isHyphen && (previousWasHyphen || index == 0 || index == slug.Length - 1)))
|
||||
{
|
||||
throw new TeamInvalidException(
|
||||
"A slug is lowercase letters, digits and single hyphens, and cannot start or end "
|
||||
+ "with a hyphen.");
|
||||
}
|
||||
|
||||
previousWasHyphen = isHyphen;
|
||||
}
|
||||
|
||||
return slug;
|
||||
}
|
||||
|
||||
private static string RequireText(string? value, string field, int maxLength)
|
||||
{
|
||||
var text = (value ?? string.Empty).Trim();
|
||||
|
||||
if (text.Length == 0 || text.Length > maxLength)
|
||||
{
|
||||
throw new TeamInvalidException(
|
||||
string.Create(
|
||||
CultureInfo.InvariantCulture,
|
||||
$"{field} is required, and at most {maxLength} characters."));
|
||||
}
|
||||
|
||||
return text;
|
||||
}
|
||||
|
||||
private static string? OptionalText(string? value, int maxLength)
|
||||
{
|
||||
var text = value?.Trim();
|
||||
|
||||
if (string.IsNullOrEmpty(text))
|
||||
{
|
||||
return null;
|
||||
}
|
||||
|
||||
if (text.Length > maxLength)
|
||||
{
|
||||
throw new TeamInvalidException(
|
||||
string.Create(
|
||||
CultureInfo.InvariantCulture,
|
||||
$"A description is at most {maxLength} characters."));
|
||||
}
|
||||
|
||||
return text;
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
/// A plain cast, which is why <c>TeamMemberRole</c> pins the same numeric values as
|
||||
/// <see cref="TeamRole"/> and a test asserts it. An unknown value becomes
|
||||
/// <see cref="TeamRole.Unspecified"/> rather than a silent cast to a role nobody defined, so a
|
||||
/// newer client's role is refused instead of resolving to whatever bit pattern it happens to be.
|
||||
/// </remarks>
|
||||
private static TeamRole ToDomain(TeamMemberRole role) => role switch
|
||||
{
|
||||
TeamMemberRole.Viewer => TeamRole.Viewer,
|
||||
TeamMemberRole.Member => TeamRole.Member,
|
||||
TeamMemberRole.Admin => TeamRole.Admin,
|
||||
TeamMemberRole.Owner => TeamRole.Owner,
|
||||
_ => TeamRole.Unspecified,
|
||||
};
|
||||
|
||||
private static TeamMemberRole ToContract(TeamRole role) => role switch
|
||||
{
|
||||
TeamRole.Viewer => TeamMemberRole.Viewer,
|
||||
TeamRole.Member => TeamMemberRole.Member,
|
||||
TeamRole.Admin => TeamMemberRole.Admin,
|
||||
TeamRole.Owner => TeamMemberRole.Owner,
|
||||
_ => TeamMemberRole.Unspecified,
|
||||
};
|
||||
|
||||
private static TeamMemberStatus ToContract(MembershipStatus status) => status switch
|
||||
{
|
||||
MembershipStatus.Invited => TeamMemberStatus.Invited,
|
||||
MembershipStatus.Active => TeamMemberStatus.Active,
|
||||
MembershipStatus.Revoked => TeamMemberStatus.Revoked,
|
||||
_ => TeamMemberStatus.Unspecified,
|
||||
};
|
||||
|
||||
private static bool IsUniqueViolation(DbUpdateException exception) =>
|
||||
string.Equals(
|
||||
(exception.InnerException as PostgresException)?.SqlState,
|
||||
PostgresErrorCodes.UniqueViolation,
|
||||
StringComparison.Ordinal);
|
||||
}
|
||||
Reference in New Issue
Block a user