Skip to content

Commit

Permalink
Addressed PR feedback, corrected yaml files and unit tests
Browse files Browse the repository at this point in the history 
Address PR feedback and optimization changes

Refactored control flow logic, added TONS of unit tests, added some integration tests, and altered some database functions

Refactored logic, added unit/integration tests, handled merge conflicts

Addressed previous PR feedback and adjusted unit tests

Corrected openapi stuff

Changed the endpoint url

More openapi corrections and file name change
  • Loading branch information
@mistahj67
mistahj67 committed Aug 21, 2024
1 parent 35ac3d1 commit cd67c46
Show file tree
Hide file tree
Showing 13 changed files with 4,405 additions and 568 deletions.
2 changes: 1 addition & 1 deletion cmd/api/src/api/registration/v2.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -165,7 +165,7 @@ func NewV2API(cfg config.Configuration, resources v2.Resources, routerInst *rout
routerInst.POST("/api/v2/saved-queries", resources.CreateSavedQuery).RequirePermissions(permissions.SavedQueriesWrite),
routerInst.PUT(fmt.Sprintf("/api/v2/saved-queries/{%s}", api.URIPathVariableSavedQueryID), resources.UpdateSavedQuery).RequirePermissions(permissions.SavedQueriesWrite),
routerInst.DELETE(fmt.Sprintf("/api/v2/saved-queries/{%s}", api.URIPathVariableSavedQueryID), resources.DeleteSavedQuery).RequirePermissions(permissions.SavedQueriesWrite),
routerInst.PUT(fmt.Sprintf("/api/v2/saved-queries/{%s}/share", api.URIPathVariableSavedQueryID), resources.ShareSavedQueries).RequirePermissions(permissions.SavedQueriesWrite),
routerInst.PUT(fmt.Sprintf("/api/v2/saved-queries/{%s}/permissions", api.URIPathVariableSavedQueryID), resources.ShareSavedQueries).RequirePermissions(permissions.SavedQueriesWrite),

// Azure Entity API
routerInst.GET("/api/v2/azure/{entity_type}", resources.GetAZEntity).RequirePermissions(permissions.GraphDBRead),
Expand Down
242 changes: 198 additions & 44 deletions cmd/api/src/api/v2/saved_queries.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,6 @@ import (
"strconv"
"strings"

"github.com/gofrs/uuid"
"github.com/gorilla/mux"
"github.com/specterops/bloodhound/src/api"
"github.com/specterops/bloodhound/src/auth"
Expand Down Expand Up @@ -276,62 +275,217 @@ func (s Resources) ShareSavedQueries(response http.ResponseWriter, request *http
api.WriteErrorResponse(request.Context(), api.BuildErrorResponse(http.StatusBadRequest, "No associated user found", request), response)
} else if savedQueryID, err := strconv.Atoi(rawSavedQueryID); err != nil {
api.WriteErrorResponse(request.Context(), api.BuildErrorResponse(http.StatusBadRequest, api.ErrorResponseDetailsIDMalformed, request), response)
} else if err := api.ReadJSONRequestPayloadLimited(&createRequest, request); err != nil {
api.WriteErrorResponse(request.Context(), api.BuildErrorResponse(http.StatusBadRequest, err.Error(), request), response)
} else if createRequest.Public && len(createRequest.UserIDs) > 0 {
api.WriteErrorResponse(request.Context(), api.BuildErrorResponse(http.StatusBadRequest, "Public cannot be true while user_ids is populated", request), response)
} else if savedQueryBelongsToUser, err := s.DB.SavedQueryBelongsToUser(request.Context(), user.ID, savedQueryID); errors.Is(err, database.ErrNotFound) {
api.WriteErrorResponse(request.Context(), api.BuildErrorResponse(http.StatusNotFound, "Query does not exist", request), response)
} else if err := api.ReadJSONRequestPayloadLimited(&createRequest, request); errors.Is(err, database.ErrNotFound) {
api.WriteErrorResponse(request.Context(), api.BuildErrorResponse(http.StatusBadRequest, err.Error(), request), response)
} else if err != nil {
api.WriteErrorResponse(request.Context(), api.BuildErrorResponse(http.StatusInternalServerError, api.ErrorResponseDetailsInternalServerError, request), response)
} else if !savedQueryBelongsToUser {
api.WriteErrorResponse(request.Context(), api.BuildErrorResponse(http.StatusBadRequest, "Invalid saved_query_id supplied", request), response)
} else if scopeForSavedQuery, err := s.DB.GetScopeForSavedQuery(request.Context(), int64(savedQueryID), user.ID); err != nil {
api.HandleDatabaseError(request, response, err)
} else if dbSavedQueryScope, err := s.DB.GetScopeForSavedQuery(request.Context(), int64(savedQueryID), user.ID); err != nil {
api.HandleDatabaseError(request, response, err)
} else if isSavedQueryShared, err := s.DB.IsSavedQueryShared(request.Context(), int64(savedQueryID)); err != nil {
api.HandleDatabaseError(request, response, err)
} else {
// Sharing a query as public
if createRequest.Public {
if len(createRequest.UserIDs) > 0 {
api.WriteErrorResponse(request.Context(), api.BuildErrorResponse(http.StatusBadRequest, "SavedQueryScopePublic cannot be true while user_ids is populated", request), response)
} else if scopeForSavedQuery[database.SavedQueryScopePublic] == true {
api.WriteErrorResponse(request.Context(), api.BuildErrorResponse(http.StatusBadRequest, "User cannot make a query public that's already public", request), response)
} else if savedPermission, err := s.DB.CreateSavedQueryPermissionToPublic(request.Context(), int64(savedQueryID)); err != nil {
api.HandleDatabaseError(request, response, err)
} else {
api.WriteBasicResponse(request.Context(), ShareSavedQueriesResponse{savedPermission}, http.StatusCreated, response)
isAdmin := user.Roles.Has(model.Role{Name: auth.RoleAdministrator})

if isAdmin {
// Query set to public
if createRequest.Public {
if savedQueryBelongsToUser {
if dbSavedQueryScope[database.SavedQueryScopePublic] {
response.WriteHeader(http.StatusNoContent)
} else {
if isSavedQueryShared {
if savedPermission, err := s.DB.CreateSavedQueryPermissionToPublic(request.Context(), int64(savedQueryID)); err != nil {
api.HandleDatabaseError(request, response, err)
} else if savedQueryPermissions, err := s.DB.GetPermissionsForSavedQuery(request.Context(), int64(savedQueryID)); err != nil {
api.HandleDatabaseError(request, response, err)
} else {
for _, permission := range savedQueryPermissions {
sharedToUserID := permission.SharedToUserID

if err := s.DB.DeleteSavedQueryPermissionsForUser(request.Context(), int64(savedQueryID), sharedToUserID.UUID); err != nil {
api.HandleDatabaseError(request, response, err)
}
}
api.WriteBasicResponse(request.Context(), ShareSavedQueriesResponse{savedPermission}, http.StatusCreated, response)
}
} else {
if savedPermission, err := s.DB.CreateSavedQueryPermissionToPublic(request.Context(), int64(savedQueryID)); err != nil {
api.HandleDatabaseError(request, response, err)
} else {
api.WriteBasicResponse(request.Context(), ShareSavedQueriesResponse{savedPermission}, http.StatusCreated, response)
}
}
}
} else {
if dbSavedQueryScope[database.SavedQueryScopePublic] {
response.WriteHeader(http.StatusNoContent)
} else {
api.WriteErrorResponse(request.Context(), api.BuildErrorResponse(http.StatusForbidden, api.ErrorResponseDetailsForbidden, request), response)
return
}
}
// Query set to private
} else if len(createRequest.UserIDs) == 0 {
if savedQueryBelongsToUser {
if dbSavedQueryScope[database.SavedQueryScopePublic] {
if err := s.DB.DeleteSavedQueryPermissionPublic(request.Context(), int64(savedQueryID)); err != nil {
api.HandleDatabaseError(request, response, err)
} else {
response.WriteHeader(http.StatusNoContent)
}
} else {
if isSavedQueryShared {
if savedQueryPermissions, err := s.DB.GetPermissionsForSavedQuery(request.Context(), int64(savedQueryID)); err != nil {
api.HandleDatabaseError(request, response, err)
} else {
for _, permission := range savedQueryPermissions {
sharedToUserID := permission.SharedToUserID

if err := s.DB.DeleteSavedQueryPermissionsForUser(request.Context(), int64(savedQueryID), sharedToUserID.UUID); err != nil {
api.HandleDatabaseError(request, response, err)
}
}
response.WriteHeader(http.StatusNoContent)
}
} else {
response.WriteHeader(http.StatusNoContent)
}
}
} else {
if dbSavedQueryScope[database.SavedQueryScopePublic] {
if err := s.DB.DeleteSavedQueryPermissionPublic(request.Context(), int64(savedQueryID)); err != nil {
api.HandleDatabaseError(request, response, err)
} else {
response.WriteHeader(http.StatusNoContent)
}
} else {
api.WriteErrorResponse(request.Context(), api.BuildErrorResponse(http.StatusForbidden, api.ErrorResponseDetailsForbidden, request), response)
return
}
}
// Sharing a query
} else if len(createRequest.UserIDs) > 0 && !createRequest.Public {
if savedQueryBelongsToUser {
if dbSavedQueryScope[database.SavedQueryScopePublic] {
api.WriteErrorResponse(request.Context(), api.BuildErrorResponse(http.StatusBadRequest, "Public query cannot be shared to users. You must set your query to private first", request), response)
} else {
var newPermissions []model.SavedQueriesPermissions
for _, sharedUserID := range createRequest.UserIDs {
if sharedUserID != user.ID {
newPermissions = append(newPermissions, model.SavedQueriesPermissions{
QueryID: int64(savedQueryID),
Public: false,
SharedToUserID: database.NullUUID(sharedUserID),
})
} else {
api.WriteErrorResponse(request.Context(), api.BuildErrorResponse(http.StatusBadRequest, "Cannot share query to self", request), response)
return
}
}
// Save the permissions to the database
if savedPermissions, err := s.DB.CreateSavedQueryPermissionsBatch(request.Context(), newPermissions); err != nil {
api.HandleDatabaseError(request, response, err)
} else {
api.WriteBasicResponse(request.Context(), savedPermissions, http.StatusCreated, response)
}
}
} else {
if dbSavedQueryScope[database.SavedQueryScopePublic] {
api.WriteErrorResponse(request.Context(), api.BuildErrorResponse(http.StatusBadRequest, "Public query cannot be shared to users. You must set your query to private first", request), response)
} else {
api.WriteErrorResponse(request.Context(), api.BuildErrorResponse(http.StatusForbidden, api.ErrorResponseDetailsForbidden, request), response)
return
}
}
}
// Sharing a query with one or more users
} else if len(createRequest.UserIDs) > 0 {
var newlySharedUserIDs []uuid.UUID
for _, sharedUserID := range createRequest.UserIDs {
if sharedUserID == user.ID {
api.WriteErrorResponse(request.Context(), api.BuildErrorResponse(http.StatusBadRequest, "Cannot Share query to self", request), response)
return
} else if hasAccess, err := s.DB.CheckUserHasPermissionToSavedQuery(request.Context(), int64(savedQueryID), sharedUserID); err != nil {
api.WriteErrorResponse(request.Context(), api.BuildErrorResponse(http.StatusInternalServerError, "Error checking user's query permissions", request), response)
} else if hasAccess {
api.WriteErrorResponse(request.Context(), api.BuildErrorResponse(http.StatusBadRequest, fmt.Sprintf("User %s already has shared permission", sharedUserID), request), response)
} else if !isAdmin {
if !savedQueryBelongsToUser {
api.WriteErrorResponse(request.Context(), api.BuildErrorResponse(http.StatusForbidden, api.ErrorResponseDetailsForbidden, request), response)
return
// Query set to public
} else if createRequest.Public {
if dbSavedQueryScope[database.SavedQueryScopePublic] {
response.WriteHeader(http.StatusNoContent)
} else {
if isSavedQueryShared {
if savedPermission, err := s.DB.CreateSavedQueryPermissionToPublic(request.Context(), int64(savedQueryID)); err != nil {
api.HandleDatabaseError(request, response, err)
} else if savedQueryPermissions, err := s.DB.GetPermissionsForSavedQuery(request.Context(), int64(savedQueryID)); err != nil {
api.HandleDatabaseError(request, response, err)
} else {
for _, permission := range savedQueryPermissions {
sharedToUserID := permission.SharedToUserID

if err := s.DB.DeleteSavedQueryPermissionsForUser(request.Context(), int64(savedQueryID), sharedToUserID.UUID); err != nil {
api.HandleDatabaseError(request, response, err)
}
}
api.WriteBasicResponse(request.Context(), ShareSavedQueriesResponse{savedPermission}, http.StatusCreated, response)
}
} else {
if savedPermission, err := s.DB.CreateSavedQueryPermissionToPublic(request.Context(), int64(savedQueryID)); err != nil {
api.HandleDatabaseError(request, response, err)
} else {
api.WriteBasicResponse(request.Context(), ShareSavedQueriesResponse{savedPermission}, http.StatusCreated, response)
}
}
}
// Query set to private
} else if len(createRequest.UserIDs) == 0 {
if dbSavedQueryScope[database.SavedQueryScopePublic] {
api.WriteErrorResponse(request.Context(), api.BuildErrorResponse(http.StatusForbidden, api.ErrorResponseDetailsForbidden, request), response)
return
} else {
newlySharedUserIDs = append(newlySharedUserIDs, sharedUserID)
if isSavedQueryShared {
if savedQueryPermissions, err := s.DB.GetPermissionsForSavedQuery(request.Context(), int64(savedQueryID)); err != nil {
api.HandleDatabaseError(request, response, err)
} else {
for _, permission := range savedQueryPermissions {
sharedToUserID := permission.SharedToUserID

if err := s.DB.DeleteSavedQueryPermissionsForUser(request.Context(), int64(savedQueryID), sharedToUserID.UUID); err != nil {
api.HandleDatabaseError(request, response, err)
}
}
response.WriteHeader(http.StatusNoContent)
}
} else {
response.WriteHeader(http.StatusNoContent)
}
}
}

// Create permission objects for each user that we're attempting to share to
newPermissions := make([]model.SavedQueriesPermissions, len(newlySharedUserIDs))
for i, id := range newlySharedUserIDs {
newPermissions[i] = model.SavedQueriesPermissions{
QueryID: int64(savedQueryID),
Public: false,
SharedToUserID: database.NullUUID(id),
// Sharing a query
} else if len(createRequest.UserIDs) > 0 && !createRequest.Public {
if dbSavedQueryScope[database.SavedQueryScopePublic] {
api.WriteErrorResponse(request.Context(), api.BuildErrorResponse(http.StatusForbidden, api.ErrorResponseDetailsForbidden, request), response)
return
} else {
var newPermissions []model.SavedQueriesPermissions
for _, sharedUserID := range createRequest.UserIDs {
if sharedUserID != user.ID {
newPermissions = append(newPermissions, model.SavedQueriesPermissions{
QueryID: int64(savedQueryID),
Public: false,
SharedToUserID: database.NullUUID(sharedUserID),
})
} else {
api.WriteErrorResponse(request.Context(), api.BuildErrorResponse(http.StatusBadRequest, "Cannot share query to self", request), response)
return
}
}
// Save the permissions to the database
if savedPermissions, err := s.DB.CreateSavedQueryPermissionsBatch(request.Context(), newPermissions); err != nil {
api.HandleDatabaseError(request, response, err)
} else {
api.WriteBasicResponse(request.Context(), savedPermissions, http.StatusCreated, response)
}
}
}

// Save the permissions to the database
if savedPermissions, err := s.DB.CreateSavedQueryPermissionsBatch(request.Context(), newPermissions); err != nil {
api.HandleDatabaseError(request, response, err)
} else {
api.WriteBasicResponse(request.Context(), savedPermissions, http.StatusCreated, response)
}

}
}
}
Loading

0 comments on commit cd67c46

Please sign in to comment.