diff --git a/bitwarden_license/bit-web/src/app/secrets-manager/service-accounts/guards/service-account-access.guard.ts b/bitwarden_license/bit-web/src/app/secrets-manager/service-accounts/guards/service-account-access.guard.ts new file mode 100644 index 00000000000..a1c54a6bfaa --- /dev/null +++ b/bitwarden_license/bit-web/src/app/secrets-manager/service-accounts/guards/service-account-access.guard.ts @@ -0,0 +1,28 @@ +import { inject } from "@angular/core"; +import { ActivatedRouteSnapshot, CanActivateFn, createUrlTreeFromSnapshot } from "@angular/router"; + +import { ServiceAccountService } from "../service-account.service"; + +/** + * Redirects to service accounts page if the user doesn't have access to service account. + */ +export const serviceAccountAccessGuard: CanActivateFn = async (route: ActivatedRouteSnapshot) => { + const serviceAccountService = inject(ServiceAccountService); + + try { + const serviceAccount = await serviceAccountService.getByServiceAccountId( + route.params.serviceAccountId, + route.params.organizationId + ); + if (serviceAccount) { + return true; + } + } catch { + return createUrlTreeFromSnapshot(route, [ + "/sm", + route.params.organizationId, + "service-accounts", + ]); + } + return createUrlTreeFromSnapshot(route, ["/sm", route.params.organizationId, "service-accounts"]); +}; diff --git a/bitwarden_license/bit-web/src/app/secrets-manager/service-accounts/service-accounts-routing.module.ts b/bitwarden_license/bit-web/src/app/secrets-manager/service-accounts/service-accounts-routing.module.ts index 56d1c42155f..a25797cddae 100644 --- a/bitwarden_license/bit-web/src/app/secrets-manager/service-accounts/service-accounts-routing.module.ts +++ b/bitwarden_license/bit-web/src/app/secrets-manager/service-accounts/service-accounts-routing.module.ts @@ -3,6 +3,7 @@ import { RouterModule, Routes } from "@angular/router"; import { AccessTokenComponent } from "./access/access-tokens.component"; import { ServiceAccountEventsComponent } from "./event-logs/service-accounts-events.component"; +import { serviceAccountAccessGuard } from "./guards/service-account-access.guard"; import { ServiceAccountPeopleComponent } from "./people/service-account-people.component"; import { ServiceAccountProjectsComponent } from "./projects/service-account-projects.component"; import { ServiceAccountComponent } from "./service-account.component"; @@ -16,6 +17,7 @@ const routes: Routes = [ { path: ":serviceAccountId", component: ServiceAccountComponent, + canActivate: [serviceAccountAccessGuard], children: [ { path: "",