[SM-999] Add Bulk Move to Project Endpoint

bitwarden_license/src/Commercial.Core/SecretsManager/AuthorizationHandlers/Secrets/BulkSecretAuthorizationHandler.cs

@@ -0,0 +1,71 @@
+using Bit.Core.Context;
+using Bit.Core.Enums;
+using Bit.Core.SecretsManager.AuthorizationRequirements;
+using Bit.Core.SecretsManager.Entities;
+using Bit.Core.SecretsManager.Queries.Interfaces;
+using Bit.Core.SecretsManager.Repositories;
+using Microsoft.AspNetCore.Authorization;
+
+namespace Bit.Commercial.Core.SecretsManager.AuthorizationHandlers.Secrets;
+
+public class BulkSecretAuthorizationHandler : AuthorizationHandler<BulkSecretOperationRequirement, IReadOnlyList<Secret>>
+{
+    private readonly ICurrentContext _currentContext;
+    private readonly IAccessClientQuery _accessClientQuery;
+    private readonly ISecretRepository _secretRepository;
+
+    public BulkSecretAuthorizationHandler(
+        ICurrentContext currentContext,
+        IAccessClientQuery accessClientQuery,
+        ISecretRepository secretRepository)
+    {
+        _currentContext = currentContext;
+        _accessClientQuery = accessClientQuery;
+        _secretRepository = secretRepository;
+    }
+
+    protected override async Task HandleRequirementAsync(
+      AuthorizationHandlerContext context,
+      BulkSecretOperationRequirement requirement,
+      IReadOnlyList<Secret> resource)
+    {
+        var secretsByOrganizationId = resource.GroupBy(s => s.OrganizationId).ToArray();
+
+        // All the secrets should be part of a single organization
+        if (secretsByOrganizationId.Length != 1)
+        {
+            return;
+        }
+
+        var organizationId = secretsByOrganizationId[0].Key;
+
+        if (!_currentContext.AccessSecretsManager(organizationId))
+        {
+            return;
+        }
+
+        var (accessClient, userId) = await _accessClientQuery.GetAccessClientAsync(context.User, organizationId);
+
+        if (requirement == BulkSecretOperations.Update)
+        {
+            if (!await CanBulkUpdateSecretsAsync(resource, accessClient, userId))
+            {
+                return;
+            }
+
+            context.Succeed(requirement);
+        }
+    }
+
+    private async Task<bool> CanBulkUpdateSecretsAsync(
+        IReadOnlyList<Secret> secrets,
+        AccessClientType accessClientType,
+        Guid userId)
+    {
+        var secretAccesses = await _secretRepository.AccessToSecretsAsync(
+          secrets.Select(s => s.Id).ToArray(), userId, accessClientType);
+
+        // If we don't have the write permission
+        return secretAccesses.All(a => a.Value.Write);
+    }
+}

bitwarden_license/src/Commercial.Core/SecretsManager/Commands/Secrets/MoveSecretsCommand.cs

@@ -0,0 +1,20 @@
+using Bit.Core.SecretsManager.Commands.Secrets.Interfaces;
+using Bit.Core.SecretsManager.Entities;
+using Bit.Core.SecretsManager.Repositories;
+
+namespace Bit.Commercial.Core.SecretsManager.Commands.Secrets;
+
+public class MoveSecretsCommand : IMoveSecretsCommand
+{
+    private readonly ISecretRepository _secretRepository;
+
+    public MoveSecretsCommand(ISecretRepository secretRepository)
+    {
+        _secretRepository = secretRepository;
+    }
+
+    public async Task MoveSecretsAsync(IEnumerable<Secret> secrets, Guid project)
+    {
+        await _secretRepository.MoveSecretsAsync(secrets, project);
+    }
+}

bitwarden_license/src/Commercial.Core/SecretsManager/SecretsManagerCollectionExtensions.cs

@@ -35,6 +35,7 @@ public static void AddSecretsManagerServices(this IServiceCollection services)
     {
         services.AddScoped<IAuthorizationHandler, ProjectAuthorizationHandler>();
         services.AddScoped<IAuthorizationHandler, SecretAuthorizationHandler>();
+        services.AddScoped<IAuthorizationHandler, BulkSecretAuthorizationHandler>();
         services.AddScoped<IAuthorizationHandler, ServiceAccountAuthorizationHandler>();
         services.AddScoped<IAuthorizationHandler, AccessPolicyAuthorizationHandler>();
         services.AddScoped<IAuthorizationHandler, ProjectPeopleAccessPoliciesAuthorizationHandler>();
@@ -61,5 +62,6 @@ public static void AddSecretsManagerServices(this IServiceCollection services)
         services.AddScoped<IImportCommand, ImportCommand>();
         services.AddScoped<IEmptyTrashCommand, EmptyTrashCommand>();
         services.AddScoped<IRestoreTrashCommand, RestoreTrashCommand>();
+        services.AddScoped<IMoveSecretsCommand, MoveSecretsCommand>();
     }
 }

bitwarden_license/src/Commercial.Infrastructure.EntityFramework/SecretsManager/Repositories/SecretRepository.cs

@@ -274,35 +274,58 @@ await secrets.ForEachAsync(secret =>
         var secret = dbContext.Secret
             .Where(s => s.Id == id);
 
-        var query = accessType switch
+        var query = BuildSecretAccessQuery(secret, userId, accessType);
+
+        var policy = await query.FirstOrDefaultAsync();
+
+        return policy == null ? (false, false) : (policy.Read, policy.Write);
+    }
+
+    public async Task<Dictionary<Guid, (bool Read, bool Write)>> AccessToSecretsAsync(
+        IEnumerable<Guid> secretIds,
+        Guid userId,
+        AccessClientType accessType)
+    {
+        await using var scope = ServiceScopeFactory.CreateAsyncScope();
+        var dbContext = GetDatabaseContext(scope);
+
+        var secrets = dbContext.Secret
+            .Where(s => secretIds.Contains(s.Id));
+
+        var accessQuery = BuildSecretAccessQuery(secrets, userId, accessType);
+
+        return await accessQuery.ToDictionaryAsync(sa => sa.Id, sa => (sa.Read, sa.Write));
+    }
+
+    private static IQueryable<SecretAccess> BuildSecretAccessQuery(IQueryable<Secret> secrets, Guid userId, AccessClientType accessType)
+    {
+        return accessType switch
         {
-            AccessClientType.NoAccessCheck => secret.Select(_ => new { Read = true, Write = true }),
-            AccessClientType.User => secret.Select(s => new
-            {
-                Read = s.Projects.Any(p =>
+            AccessClientType.NoAccessCheck => secrets.Select(s => new SecretAccess(s.Id, true, true)),
+            AccessClientType.User => secrets.Select(s => new SecretAccess(
+                s.Id,
+                s.Projects.Any(p =>
                     p.UserAccessPolicies.Any(ap => ap.OrganizationUser.User.Id == userId && ap.Read) ||
                     p.GroupAccessPolicies.Any(ap =>
                         ap.Group.GroupUsers.Any(gu => gu.OrganizationUser.User.Id == userId && ap.Read))),
-                Write = s.Projects.Any(p =>
+                s.Projects.Any(p =>
                     p.UserAccessPolicies.Any(ap => ap.OrganizationUser.User.Id == userId && ap.Write) ||
                     p.GroupAccessPolicies.Any(ap =>
-                        ap.Group.GroupUsers.Any(gu => gu.OrganizationUser.User.Id == userId && ap.Write))),
-            }),
-            AccessClientType.ServiceAccount => secret.Select(s => new
-            {
-                Read = s.Projects.Any(p =>
+                        ap.Group.GroupUsers.Any(gu => gu.OrganizationUser.User.Id == userId && ap.Write)))
+            )),
+            AccessClientType.ServiceAccount => secrets.Select(s => new SecretAccess(
+                s.Id,
+                s.Projects.Any(p =>
                     p.ServiceAccountAccessPolicies.Any(ap => ap.ServiceAccountId == userId && ap.Read)),
-                Write = s.Projects.Any(p =>
-                    p.ServiceAccountAccessPolicies.Any(ap => ap.ServiceAccountId == userId && ap.Write)),
-            }),
-            _ => secret.Select(_ => new { Read = false, Write = false }),
+                s.Projects.Any(p =>
+                    p.ServiceAccountAccessPolicies.Any(ap => ap.ServiceAccountId == userId && ap.Write))
+            )),
+            _ => secrets.Select(s => new SecretAccess(s.Id, false, false)),
         };
-
-        var policy = await query.FirstOrDefaultAsync();
-
-        return policy == null ? (false, false) : (policy.Read, policy.Write);
     }
 
+    private record SecretAccess(Guid Id, bool Read, bool Write);
+
     public async Task EmptyTrash(DateTime currentDate, uint deleteAfterThisNumberOfDays)
     {
         using var scope = ServiceScopeFactory.CreateScope();
@@ -313,6 +336,32 @@ public async Task EmptyTrash(DateTime currentDate, uint deleteAfterThisNumberOfD
         await dbContext.SaveChangesAsync();
     }
 
+    public async Task MoveSecretsAsync(IEnumerable<Core.SecretsManager.Entities.Secret> secrets, Guid projectId)
+    {
+        using var scope = ServiceScopeFactory.CreateScope();
+        var dbContext = GetDatabaseContext(scope);
+
+        await using var transaction = await dbContext.Database.BeginTransactionAsync();
+
+        var secretIds = secrets.Select(s => s.Id).ToList();
+
+        var projectSecrets = secretIds.Select(secretId => new ProjectSecret
+        {
+            ProjectsId = projectId,
+            SecretsId = secretId
+        });
+
+        await dbContext.ProjectSecrets
+            .Where(ps => secretIds.Contains(ps.SecretsId))
+            .ExecuteDeleteAsync();
+
+        dbContext.ProjectSecrets.AddRange(projectSecrets);
+
+        await dbContext.SaveChangesAsync();
+
+        await transaction.CommitAsync();
+    }
+
     private IQueryable<SecretPermissionDetails> SecretToPermissionDetails(IQueryable<Secret> query, Guid userId, AccessClientType accessType)
     {
         var secrets = accessType switch