[PM-32187] Add Send Type restriction to Send Controls policy#7504
[PM-32187] Add Send Type restriction to Send Controls policy#7504mcamirault wants to merge 63 commits into
Conversation
…ntrols-Policy merge main
• `IX_Policy_OrganizationId_Type` is a unique index Co-authored-by: mkincaid-bw <mkincaid@bitwarden.com>
…rden/server into tools/PM-31885-SendControls-Policy merge suggested changes to migration
…rden/server into tools/PM-31885-SendControls-Policy merge main
- fix SQL syntax error - escape Sqlite format specifier - update migration IDs to match sorted filename - fix SQL syntax error
… PolicyQuery.GetAllAsync
mcamirault
changed the base branch from
tools/pm-31884/send-access-controls-policy
to
main
mcamirault
removed request for
a team,
coroiu,
fntyler,
ike-kottlowski,
kdenney,
keithhubner,
mzieniukbw and
nikwithak
mkincaid-bw
left a comment
mkincaid-bw
left a comment
There was a problem hiding this comment.
Minor changes requested.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| if (sendControlsRequirement.AllowedSendTypes != null && !sendControlsRequirement.AllowedSendTypes.Contains(send.Type)) | ||
| { | ||
| throw new BadRequestException($"Due to an Enterprise policy your Sends must be of the following types: {string.Join(", ", sendControlsRequirement.AllowedSendTypes.Select(st => st == SendType.Text ? "Text" : st == SendType.File ? "File" : "Unknown"))}"); | ||
| } |
There was a problem hiding this comment.
♻️ DEBT: New AllowedSendTypes creation-time guard has no unit test.
Details
This branch is the bypass-resistant server-side enforcement (the CLI skips front-end checks), so it is the most important path to cover. The sync handler's equivalent logic got a test in this PR (SendControlsSyncPolicyEventTests), but SendValidationServiceTests.cs has no case asserting that a disallowed send.Type throws and an allowed one passes.
Project convention (CLAUDE.md): "ALWAYS add unit tests (with mocking) for any new feature development." Suggest adding a ValidateUserCanSaveAsync_WhenSendTypeRestrictedByPolicy test mirroring the existing domain/auth cases.
|
@mkincaid-bw The procedure most of your comments were on was introduced in a different PR (for PM-31884), so I've added an update script to fix the procedure here |
|
There was a problem hiding this comment.
I am not certain if this file should be checked in
4 participants
🎟️ Tracking
https://bitwarden.atlassian.net/browse/PM-32187
📔 Objective
This PR adds a field to the Send Controls policy that can be used to restrict which types of Sends can be created
📸 Screenshots
N/A