[Tools] Update SendAuthenticationQuery, add new non-anonymous endpoints, and add PutRemoveAuth endpoint

src/Api/Tools/Controllers/SendsController.cs

@@ -5,9 +5,11 @@
 using Bit.Api.Tools.Models.Response;
 using Bit.Api.Utilities;
 using Bit.Core;
+using Bit.Core.Auth.Identity;
+using Bit.Core.Auth.UserFeatures.SendAccess;
 using Bit.Core.Exceptions;
+using Bit.Core.Platform.Push;
 using Bit.Core.Services;
-using Bit.Core.Settings;
 using Bit.Core.Tools.Enums;
 using Bit.Core.Tools.Models.Data;
 using Bit.Core.Tools.Repositories;
@@ -22,7 +24,6 @@
 namespace Bit.Api.Tools.Controllers;
 
 [Route("sends")]
-[Authorize("Application")]
 public class SendsController : Controller
 {
     private readonly ISendRepository _sendRepository;
@@ -31,11 +32,10 @@ public class SendsController : Controller
     private readonly ISendFileStorageService _sendFileStorageService;
     private readonly IAnonymousSendCommand _anonymousSendCommand;
     private readonly INonAnonymousSendCommand _nonAnonymousSendCommand;
-
     private readonly ISendOwnerQuery _sendOwnerQuery;
-
     private readonly ILogger<SendsController> _logger;
-    private readonly GlobalSettings _globalSettings;
+    private readonly IFeatureService _featureService;
+    private readonly IPushNotificationService _pushNotificationService;
 
     public SendsController(
         ISendRepository sendRepository,
@@ -46,7 +46,8 @@ public SendsController(
         ISendOwnerQuery sendOwnerQuery,
         ISendFileStorageService sendFileStorageService,
         ILogger<SendsController> logger,
-        GlobalSettings globalSettings)
+        IFeatureService featureService,
+        IPushNotificationService pushNotificationService)
     {
         _sendRepository = sendRepository;
         _userService = userService;
@@ -56,10 +57,12 @@ public SendsController(
         _sendOwnerQuery = sendOwnerQuery;
         _sendFileStorageService = sendFileStorageService;
         _logger = logger;
-        _globalSettings = globalSettings;
+        _featureService = featureService;
+        _pushNotificationService = pushNotificationService;
     }
 
     #region Anonymous endpoints
+
     [AllowAnonymous]
     [HttpPost("access/{id}")]
     public async Task<IActionResult> Access(string id, [FromBody] SendAccessRequestModel model)
@@ -73,21 +76,32 @@ public async Task<IActionResult> Access(string id, [FromBody] SendAccessRequestM
 
         var guid = new Guid(CoreHelpers.Base64UrlDecode(id));
         var send = await _sendRepository.GetByIdAsync(guid);
+
         if (send == null)
         {
             throw new BadRequestException("Could not locate send");
         }
+
+        /* This guard can be removed once feature flag is retired*/
+        var sendEmailOtpEnabled = _featureService.IsEnabled(FeatureFlagKeys.SendEmailOTP);
+        if (sendEmailOtpEnabled && send.AuthType == AuthType.Email && send.Emails is not null)
+        {
+            return new UnauthorizedResult();
+        }
+
         var sendAuthResult =
             await _sendAuthorizationService.AccessAsync(send, model.Password);
         if (sendAuthResult.Equals(SendAccessResult.PasswordRequired))
         {
             return new UnauthorizedResult();
         }
+
         if (sendAuthResult.Equals(SendAccessResult.PasswordInvalid))
         {
             await Task.Delay(2000);
             throw new BadRequestException("Invalid password.");
         }
+
         if (sendAuthResult.Equals(SendAccessResult.Denied))
         {
             throw new NotFoundException();
@@ -99,6 +113,7 @@ public async Task<IActionResult> Access(string id, [FromBody] SendAccessRequestM
             var creator = await _userService.GetUserByIdAsync(send.UserId.Value);
             sendResponse.CreatorIdentifier = creator.Email;
         }
+
         return new ObjectResult(sendResponse);
     }
 
@@ -122,28 +137,33 @@ public async Task<IActionResult> GetSendFileDownloadData(string encodedSendId,
             throw new BadRequestException("Could not locate send");
         }
 
+        /* This guard can be removed once feature flag is retired*/
+        var sendEmailOtpEnabled = _featureService.IsEnabled(FeatureFlagKeys.SendEmailOTP);
+        if (sendEmailOtpEnabled && send.AuthType == AuthType.Email && send.Emails is not null)
+        {
+            return new UnauthorizedResult();
+        }
+
         var (url, result) = await _anonymousSendCommand.GetSendFileDownloadUrlAsync(send, fileId,
             model.Password);
 
         if (result.Equals(SendAccessResult.PasswordRequired))
         {
             return new UnauthorizedResult();
         }
+
         if (result.Equals(SendAccessResult.PasswordInvalid))
         {
             await Task.Delay(2000);
             throw new BadRequestException("Invalid password.");
         }
+
         if (result.Equals(SendAccessResult.Denied))
         {
             throw new NotFoundException();
         }
 
-        return new ObjectResult(new SendFileDownloadDataResponseModel()
-        {
-            Id = fileId,
-            Url = url,
-        });
+        return new ObjectResult(new SendFileDownloadDataResponseModel() { Id = fileId, Url = url, });
     }
 
     [AllowAnonymous]
@@ -157,7 +177,8 @@ public async Task<ObjectResult> AzureValidateFile()
                 {
                     try
                     {
-                        var blobName = eventGridEvent.Subject.Split($"{AzureSendFileStorageService.FilesContainerName}/blobs/")[1];
+                        var blobName =
+                            eventGridEvent.Subject.Split($"{AzureSendFileStorageService.FilesContainerName}/blobs/")[1];
                         var sendId = AzureSendFileStorageService.SendIdFromBlobName(blobName);
                         var send = await _sendRepository.GetByIdAsync(new Guid(sendId));
                         if (send == null)
@@ -166,14 +187,16 @@ public async Task<ObjectResult> AzureValidateFile()
                             {
                                 await azureSendFileStorageService.DeleteBlobAsync(blobName);
                             }
+
                             return;
                         }
 
                         await _nonAnonymousSendCommand.ConfirmFileSize(send);
                     }
                     catch (Exception e)
                     {
-                        _logger.LogError(e, "Uncaught exception occurred while handling event grid event: {Event}", JsonSerializer.Serialize(eventGridEvent));
+                        _logger.LogError(e, "Uncaught exception occurred while handling event grid event: {Event}",
+                            JsonSerializer.Serialize(eventGridEvent));
                         return;
                     }
                 }
@@ -185,6 +208,7 @@ public async Task<ObjectResult> AzureValidateFile()
 
     #region Non-anonymous endpoints
 
+    [Authorize(Policies.Application)]
     [HttpGet("{id}")]
     public async Task<SendResponseModel> Get(string id)
     {
@@ -193,6 +217,7 @@ public async Task<SendResponseModel> Get(string id)
         return new SendResponseModel(send);
     }
 
+    [Authorize(Policies.Application)]
     [HttpGet("")]
     public async Task<ListResponseModel<SendResponseModel>> GetAll()
     {
@@ -203,6 +228,67 @@ public async Task<ListResponseModel<SendResponseModel>> GetAll()
         return result;
     }
 
+    [Authorize(Policy = Policies.Send)]
+    // [RequireFeature(FeatureFlagKeys.SendEmailOTP)]  /* Uncomment once client fallback re-try logic is added */
+    [HttpPost("access/")]
+    public async Task<IActionResult> AccessUsingAuth()
+    {
+        var guid = User.GetSendId();
+        var send = await _sendRepository.GetByIdAsync(guid);
+        if (send == null)
+        {
+            throw new BadRequestException("Could not locate send");
+        }
+        if (send.MaxAccessCount.GetValueOrDefault(int.MaxValue) <= send.AccessCount ||
+            send.ExpirationDate.GetValueOrDefault(DateTime.MaxValue) < DateTime.UtcNow || send.Disabled ||
+            send.DeletionDate < DateTime.UtcNow)
+        {
+            throw new NotFoundException();
+        }
+
+        var sendResponse = new SendAccessResponseModel(send);
+        if (send.UserId.HasValue && !send.HideEmail.GetValueOrDefault())
+        {
+            var creator = await _userService.GetUserByIdAsync(send.UserId.Value);
+            sendResponse.CreatorIdentifier = creator.Email;
+        }
+
+        send.AccessCount++;
+        await _sendRepository.ReplaceAsync(send);
+        await _pushNotificationService.PushSyncSendUpdateAsync(send);
+
+        return new ObjectResult(sendResponse);
+    }
+
+    [Authorize(Policy = Policies.Send)]
+    // [RequireFeature(FeatureFlagKeys.SendEmailOTP)]  /* Uncomment once client fallback re-try logic is added */
+    [HttpPost("access/file/{fileId}")]
+    public async Task<IActionResult> GetSendFileDownloadDataUsingAuth(string fileId)
+    {
+        var sendId = User.GetSendId();
+        var send = await _sendRepository.GetByIdAsync(sendId);
+
+        if (send == null)
+        {
+            throw new BadRequestException("Could not locate send");
+        }
+        if (send.MaxAccessCount.GetValueOrDefault(int.MaxValue) <= send.AccessCount ||
+            send.ExpirationDate.GetValueOrDefault(DateTime.MaxValue) < DateTime.UtcNow || send.Disabled ||
+            send.DeletionDate < DateTime.UtcNow)
+        {
+            throw new NotFoundException();
+        }
+
+        var url = await _sendFileStorageService.GetSendFileDownloadUrlAsync(send, fileId);
+
+        send.AccessCount++;
+        await _sendRepository.ReplaceAsync(send);
+        await _pushNotificationService.PushSyncSendUpdateAsync(send);
+
+        return new ObjectResult(new SendFileDownloadDataResponseModel() { Id = fileId, Url = url });
+    }
+
+    [Authorize(Policies.Application)]
     [HttpPost("")]
     public async Task<SendResponseModel> Post([FromBody] SendRequestModel model)
     {
@@ -213,6 +299,7 @@ public async Task<SendResponseModel> Post([FromBody] SendRequestModel model)
         return new SendResponseModel(send);
     }
 
+    [Authorize(Policies.Application)]
     [HttpPost("file/v2")]
     public async Task<SendFileUploadDataResponseModel> PostFile([FromBody] SendRequestModel model)
     {
@@ -243,6 +330,7 @@ public async Task<SendFileUploadDataResponseModel> PostFile([FromBody] SendReque
         };
     }
 
+    [Authorize(Policies.Application)]
     [HttpGet("{id}/file/{fileId}")]
     public async Task<SendFileUploadDataResponseModel> RenewFileUpload(string id, string fileId)
     {
@@ -267,6 +355,7 @@ public async Task<SendFileUploadDataResponseModel> RenewFileUpload(string id, st
         };
     }
 
+    [Authorize(Policies.Application)]
     [HttpPost("{id}/file/{fileId}")]
     [SelfHosted(SelfHostedOnly = true)]
     [RequestSizeLimit(Constants.FileSize501mb)]
@@ -283,12 +372,14 @@ public async Task PostFileForExistingSend(string id, string fileId)
         {
             throw new BadRequestException("Could not locate send");
         }
+
         await Request.GetFileAsync(async (stream) =>
         {
             await _nonAnonymousSendCommand.UploadFileToExistingSendAsync(stream, send);
         });
     }
 
+    [Authorize(Policies.Application)]
     [HttpPut("{id}")]
     public async Task<SendResponseModel> Put(string id, [FromBody] SendRequestModel model)
     {
@@ -304,6 +395,7 @@ public async Task<SendResponseModel> Put(string id, [FromBody] SendRequestModel
         return new SendResponseModel(send);
     }
 
+    [Authorize(Policies.Application)]
     [HttpPut("{id}/remove-password")]
     public async Task<SendResponseModel> PutRemovePassword(string id)
     {
@@ -322,6 +414,28 @@ public async Task<SendResponseModel> PutRemovePassword(string id)
         return new SendResponseModel(send);
     }
 
+    // Removes ALL authentication (email or password) if any is present
+    [Authorize(Policies.Application)]
+    [HttpPut("{id}/remove-auth")]
+    public async Task<SendResponseModel> PutRemoveAuth(string id)
+    {
+        var userId = _userService.GetProperUserId(User) ?? throw new InvalidOperationException("User ID not found");
+        var send = await _sendRepository.GetByIdAsync(new Guid(id));
+        if (send == null || send.UserId != userId)
+        {
+            throw new NotFoundException();
+        }
+
+        // This endpoint exists because PUT preserves existing Password/Emails when not provided.
+        // This allows clients to update other fields without re-submitting sensitive auth data.
+        send.Password = null;
+        send.Emails = null;
+        send.AuthType = AuthType.None;
+        await _nonAnonymousSendCommand.SaveSendAsync(send);
+        return new SendResponseModel(send);
+    }
+
+    [Authorize(Policies.Application)]
     [HttpDelete("{id}")]
     public async Task Delete(string id)
     {

src/Core/Tools/SendFeatures/Queries/SendAuthenticationQuery.cs

@@ -1,4 +1,5 @@
-using Bit.Core.Tools.Models.Data;
+using Bit.Core.Tools.Enums;
+using Bit.Core.Tools.Models.Data;
 using Bit.Core.Tools.Repositories;
 using Bit.Core.Tools.SendFeatures.Queries.Interfaces;
 
@@ -37,8 +38,8 @@ public async Task<SendAuthenticationMethod> GetAuthenticationMethod(Guid sendId)
         {
             null => NEVER_AUTHENTICATE,
             var s when s.AccessCount >= s.MaxAccessCount => NEVER_AUTHENTICATE,
-            var s when s.Emails is not null => emailOtp(s.Emails),
-            var s when s.Password is not null => new ResourcePassword(s.Password),
+            var s when s.AuthType == AuthType.Email && s.Emails is not null => emailOtp(s.Emails),
+            var s when s.AuthType == AuthType.Password && s.Password is not null => new ResourcePassword(s.Password),
             _ => NOT_AUTHENTICATED
         };
 

src/Core/Tools/SendFeatures/Queries/SendOwnerQuery.cs

@@ -12,7 +12,6 @@ namespace Bit.Core.Tools.SendFeatures.Queries;
 public class SendOwnerQuery : ISendOwnerQuery
 {
     private readonly ISendRepository _repository;
-    private readonly IFeatureService _features;
     private readonly IUserService _users;
 
     /// <summary>
@@ -24,10 +23,9 @@ public class SendOwnerQuery : ISendOwnerQuery
     /// <exception cref="ArgumentNullException">
     /// Thrown when <paramref name="sendRepository"/> is <see langword="null"/>.
     /// </exception>
-    public SendOwnerQuery(ISendRepository sendRepository, IFeatureService features, IUserService users)
+    public SendOwnerQuery(ISendRepository sendRepository, IUserService users)
     {
         _repository = sendRepository;
-        _features = features ?? throw new ArgumentNullException(nameof(features));
         _users = users ?? throw new ArgumentNullException(nameof(users));
     }
 
@@ -51,16 +49,6 @@ public async Task<ICollection<Send>> GetOwned(ClaimsPrincipal user)
         var userId = _users.GetProperUserId(user) ?? throw new BadRequestException("invalid user.");
         var sends = await _repository.GetManyByUserIdAsync(userId);
 
-        var removeEmailOtp = !_features.IsEnabled(FeatureFlagKeys.PM19051_ListEmailOtpSends);
-        if (removeEmailOtp)
-        {
-            // reify list to avoid invalidating the enumerator
-            foreach (var s in sends.Where(s => s.Emails != null).ToList())
-            {
-                sends.Remove(s);
-            }
-        }
-
         return sends;
     }
 }