[AC-2379] Stripe webhook update provider status #4012

cturnbull-bitwarden · 2024-04-24T13:45:00Z

Type of change

- [ ] Bug fix
- [X] New feature development
- [ ] Tech debt (refactoring, code cleanup, dependency upgrades, etc)
- [ ] Build/deploy pipeline (DevOps)
- [ ] Other

Objective

Updates the Stripe webhook to enable or disable a given Provider if there are changes to the Provider's subscription status.

Code changes

ProviderService.cs: Two new methods, EnableAsync and DisableAsync, have been added. These methods change the Enabled property of a Provider and update the RevisionDate to the current UTC. They also handle updating the provider repository and application cache
Billing.csproj: Updated to include a reference to Commercial.Core.csproj so that IProviderService can be added as a dependency
Startup.cs: Added services to the DI container for IProviderService
StripeController: Disabling or enabling a provider if its subscription status is either "unpaid" or "incomplete expired," or "active" respectively
Provider.cs: Updated to allow the RevisionDate property to be set externally, enabling updates to this property from the new methods in ProviderService.cs
IProviderService.cs: Updated to include declarations for the EnableAsync and DisableAsync methods
NoopProviderService.cs: Dummy implementations of EnableAsync and DisableAsync have been added, throwing NotImplementedException when called

Before you submit

Please check for formatting errors (dotnet format --verify-no-changes) (required)
If making database changes - make sure you also update Entity Framework queries and/or migrations
Please add unit tests where it makes sense to do so (encouraged but not required)
If this change requires a documentation update - notify the documentation team
If this change has particular deployment requirements - notify the DevOps team

github-actions · 2024-04-24T14:38:48Z

Checkmarx One – Scan Summary & Details – 0e4c93c4-8a9c-4d9c-8ece-46903f411f05

New Issues

Issue	Source File / Package	Checkmarx Insight
CSRF	/src/Api/Public/Controllers/CollectionsController.cs: 87	Attack Vector
CSRF	/src/Api/Controllers/CollectionsController.cs: 270	Attack Vector
CSRF	/src/Api/Controllers/CollectionsController.cs: 270	Attack Vector
CSRF	/src/Api/Controllers/CollectionsController.cs: 212	Attack Vector
CSRF	/src/Api/Controllers/CollectionsController.cs: 212	Attack Vector
Missing_HSTS_Header	/bitwarden_license/src/Sso/Startup.cs: 57	Attack Vector
Privacy_Violation	/src/Api/Auth/Controllers/AccountsController.cs: 518	Attack Vector
Privacy_Violation	/src/Api/Auth/Controllers/AccountsController.cs: 655	Attack Vector
Privacy_Violation	/src/Api/Auth/Controllers/AccountsController.cs: 955	Attack Vector
Privacy_Violation	/src/Api/Auth/Controllers/AccountsController.cs: 937	Attack Vector
Privacy_Violation	/src/Api/Vault/Controllers/CiphersController.cs: 919	Attack Vector
Log_Forging	/src/Api/Auth/Controllers/AccountsController.cs: 947	Attack Vector
Log_Forging	/src/Api/Vault/Controllers/CiphersController.cs: 911	Attack Vector
Log_Forging	/src/Api/Auth/Controllers/AccountsController.cs: 510	Attack Vector
Log_Forging	/src/Api/Auth/Controllers/AccountsController.cs: 647	Attack Vector
Log_Forging	/src/Api/Auth/Controllers/AccountsController.cs: 929	Attack Vector

Fixed Issues

Severity	Issue	Source File / Package
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 587
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 587
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 587
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 587
	CSRF	/src/Api/AdminConsole/Controllers/GroupsController.cs: 132
	CSRF	/src/Api/AdminConsole/Controllers/ProvidersController.cs: 141
	CSRF	/src/Api/SecretsManager/Controllers/AccessPoliciesController.cs: 229
	CSRF	/src/Admin/AdminConsole/Controllers/ProvidersController.cs: 309
	CSRF	/src/Api/AdminConsole/Controllers/GroupsController.cs: 161
	CSRF	/src/Api/AdminConsole/Controllers/GroupsController.cs: 161
	CSRF	/src/Api/Billing/Controllers/ProviderClientsController.cs: 30
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 190
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 331
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 331
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 710
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 686
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 891
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 173
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 752
	CSRF	/src/Api/Vault/Controllers/FoldersController.cs: 45
	CSRF	/src/Api/Controllers/SelfHosted/SelfHostedOrganizationLicensesController.cs: 51
	CSRF	/src/Api/Controllers/UsersController.cs: 22
	CSRF	/src/Api/Controllers/DevicesController.cs: 70
	CSRF	/src/Api/Controllers/DevicesController.cs: 57
	CSRF	/src/Api/AdminConsole/Public/Controllers/PoliciesController.cs: 69
	CSRF	/src/Api/AdminConsole/Public/Controllers/PoliciesController.cs: 49
	CSRF	/src/Api/AdminConsole/Public/Controllers/OrganizationController.cs: 42
	CSRF	/src/Api/AdminConsole/Public/Controllers/GroupsController.cs: 92
	CSRF	/src/Api/AdminConsole/Public/Controllers/GroupsController.cs: 49
	CSRF	/src/Api/AdminConsole/Controllers/ProviderUsersController.cs: 142
	CSRF	/src/Api/AdminConsole/Controllers/ProviderOrganizationsController.cs: 52
	CSRF	/src/Api/AdminConsole/Controllers/PoliciesController.cs: 148
	CSRF	/src/Api/AdminConsole/Controllers/PoliciesController.cs: 78
	CSRF	/src/Api/AdminConsole/Controllers/PoliciesController.cs: 61
	CSRF	/bitwarden_license/src/Sso/Controllers/AccountController.cs: 163
	CSRF	/bitwarden_license/src/Sso/Controllers/AccountController.cs: 96
	CSRF	/bitwarden_license/src/Scim/Controllers/v2/UsersController.cs: 50
	CSRF	/src/Api/AdminConsole/Public/Controllers/GroupsController.cs: 161
	CSRF	/src/Api/Auth/Controllers/EmergencyAccessController.cs: 159
	CSRF	/bitwarden_license/src/Scim/Controllers/v2/GroupsController.cs: 98
	CSRF	/bitwarden_license/src/Scim/Controllers/v2/GroupsController.cs: 88
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 284
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 193
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 908
	CSRF	/src/Api/Controllers/CollectionsController.cs: 303
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 244
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 550
	CSRF	/src/Api/AdminConsole/Controllers/GroupsController.cs: 274
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 586
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 144
	CSRF	/src/Api/AdminConsole/Controllers/ProviderUsersController.cs: 175
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 222
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 222
	CSRF	/src/Api/Controllers/CollectionsController.cs: 375
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 222
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 791
	CSRF	/src/Api/AdminConsole/Public/Controllers/GroupsController.cs: 133
	CSRF	/src/Admin/AdminConsole/Controllers/OrganizationsController.cs: 308
	CSRF	/src/Admin/AdminConsole/Controllers/ProvidersController.cs: 232
	CSRF	/src/Api/AdminConsole/Controllers/GroupsController.cs: 81
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 230
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 331
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 590
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 86
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 216
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 298
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 316
	CSRF	/src/Identity/Controllers/AccountsController.cs: 72
	CSRF	/src/Identity/Controllers/AccountsController.cs: 50
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 942
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 125
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 111
	CSRF	/src/Api/Tools/Controllers/ImportCiphersController.cs: 66
	CSRF	/src/Api/Tools/Controllers/ImportCiphersController.cs: 50
	CSRF	/src/Api/Public/Controllers/CollectionsController.cs: 64
	CSRF	/src/Api/AdminConsole/Controllers/GroupsController.cs: 118
	CSRF	/src/Api/Controllers/CollectionsController.cs: 323
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 590
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 590
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 590
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 288
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 728
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 193
	CSRF	/src/Api/AdminConsole/Controllers/ProviderUsersController.cs: 188
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1046
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1046
	CSRF	/src/Api/Controllers/CollectionsController.cs: 411
	CSRF	/src/Api/Controllers/CollectionsController.cs: 303
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 313
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 174
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 997
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 997
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1100
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 299
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 563
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 563
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 805
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1023
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1023
	CSRF	/src/Api/AdminConsole/Public/Controllers/MembersController.cs: 150
	CSRF	/src/Api/AdminConsole/Public/Controllers/MembersController.cs: 150
	CSRF	/src/Api/AdminConsole/Controllers/GroupsController.cs: 257
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 911
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 408
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 815
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 607
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 607
	CSRF	/src/Api/Controllers/SettingsController.cs: 36
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 571
	CSRF	/src/Api/AdminConsole/Public/Controllers/OrganizationController.cs: 42
	CSRF	/src/Api/AdminConsole/Public/Controllers/OrganizationController.cs: 42
	CSRF	/src/Api/AdminConsole/Public/Controllers/OrganizationController.cs: 42
	CSRF	/src/Api/Controllers/CollectionsController.cs: 411
	CSRF	/src/Api/AdminConsole/Public/Controllers/MembersController.cs: 187
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 284
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 244
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 550
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 447
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 362
	CSRF	/src/Api/Auth/Controllers/TwoFactorController.cs: 403
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 702
	CSRF	/src/Api/Controllers/CollectionsController.cs: 375
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 433
	CSRF

More results are available on AST platform

bitwarden_license/src/Commercial.Core/AdminConsole/Services/ProviderService.cs

codecov · 2024-04-26T12:43:54Z

Codecov Report

Attention: Patch coverage is 47.61905% with 22 lines in your changes are missing coverage. Please review.

❗ No coverage uploaded for pull request base (main@ea49ff7). Click here to learn what that means.

Files	Patch %	Lines
src/Billing/Controllers/StripeController.cs	0.00%	18 Missing ⚠️
...ervices/NoopImplementations/NoopProviderService.cs	0.00%	2 Missing ⚠️
...cial.Core/AdminConsole/Services/ProviderService.cs	95.00%	0 Missing and 1 partial ⚠️
src/Billing/Startup.cs	0.00%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4012   +/-   ##
=======================================
  Coverage        ?   38.41%           
=======================================
  Files           ?     1209           
  Lines           ?    58704           
  Branches        ?     5592           
=======================================
  Hits            ?    22549           
  Misses          ?    35111           
  Partials        ?     1044

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

vincentsalucci

Non-blocking: only thing missing from this PR are a handful of tests for the new service methods added. Please follow-up at some point to get that coverage added.

cturnbull-bitwarden · 2024-05-07T19:46:53Z

Closing this PR as we learned that this Enabled flag doesn't actually do anything. In the future, we'll just use the subscription status to decide if the Provider is enabled or not.

cturnbull-bitwarden requested review from a team as code owners April 24, 2024 13:45

cturnbull-bitwarden requested a review from vincentsalucci April 24, 2024 13:45

Updating provider enabled status based on webhook events

3e3180c

cturnbull-bitwarden force-pushed the billing/AC-2379/webhook-update-provider-status branch from a7f9320 to 3e3180c Compare April 24, 2024 13:49

amorask-bitwarden previously approved these changes Apr 24, 2024

View reviewed changes

vincentsalucci requested changes Apr 25, 2024

View reviewed changes

bitwarden_license/src/Commercial.Core/AdminConsole/Services/ProviderService.cs Outdated Show resolved Hide resolved

Setting Enabled to false when disabling a provider

08e8b91

cturnbull-bitwarden dismissed amorask-bitwarden’s stale review via 08e8b91 April 26, 2024 12:43

cturnbull-bitwarden requested review from amorask-bitwarden and vincentsalucci April 26, 2024 12:43

Merge branch 'main' into billing/AC-2379/webhook-update-provider-status

224de8d

amorask-bitwarden previously approved these changes Apr 26, 2024

View reviewed changes

vincentsalucci previously approved these changes Apr 26, 2024

View reviewed changes

cturnbull-bitwarden and others added 3 commits May 3, 2024 10:55

Merge branch 'main' into billing/AC-2379/webhook-update-provider-status

f417ae8

Updated Billing startup to use correct billing service extension

dc939b1

Added provider service unit tests for new enable and disable methods

53c8936

cturnbull-bitwarden dismissed stale reviews from amorask-bitwarden and vincentsalucci via 53c8936 May 3, 2024 15:21

cturnbull-bitwarden requested review from vincentsalucci and amorask-bitwarden May 3, 2024 15:21

amorask-bitwarden approved these changes May 3, 2024

View reviewed changes

vincentsalucci approved these changes May 3, 2024

View reviewed changes

Merge branch 'main' into billing/AC-2379/webhook-update-provider-status

133030b

cturnbull-bitwarden closed this May 7, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[AC-2379] Stripe webhook update provider status #4012

[AC-2379] Stripe webhook update provider status #4012

cturnbull-bitwarden commented Apr 24, 2024 •

edited

github-actions bot commented Apr 24, 2024 •

edited

codecov bot commented Apr 26, 2024 •

edited

vincentsalucci left a comment

cturnbull-bitwarden commented May 7, 2024 •

edited

[AC-2379] Stripe webhook update provider status #4012

[AC-2379] Stripe webhook update provider status #4012

Conversation

cturnbull-bitwarden commented Apr 24, 2024 • edited

Type of change

Objective

Code changes

Before you submit

github-actions bot commented Apr 24, 2024 • edited

New Issues

Fixed Issues

codecov bot commented Apr 26, 2024 • edited

Codecov Report

vincentsalucci left a comment

Choose a reason for hiding this comment

cturnbull-bitwarden commented May 7, 2024 • edited

cturnbull-bitwarden commented Apr 24, 2024 •

edited

github-actions bot commented Apr 24, 2024 •

edited

codecov bot commented Apr 26, 2024 •

edited

cturnbull-bitwarden commented May 7, 2024 •

edited