[PM-14439] Add PolicyRequirements for enforcement logic

src/Core/AdminConsole/Models/Data/Organizations/OrganizationUsers/OrganizationUserPolicyDetails.cs

@@ -1,5 +1,7 @@
 using Bit.Core.AdminConsole.Enums;
+using Bit.Core.AdminConsole.Models.Data.Organizations.Policies;
 using Bit.Core.Enums;
+using Bit.Core.Utilities;
 
 namespace Bit.Core.Models.Data.Organizations.OrganizationUsers;
 
@@ -22,4 +24,9 @@ public class OrganizationUserPolicyDetails
     public string OrganizationUserPermissionsData { get; set; }
 
     public bool IsProvider { get; set; }
+
+    public T GetDataModel<T>() where T : IPolicyDataModel, new()
+    {
+        return CoreHelpers.LoadClassFromJsonData<T>(PolicyData);
+    }
 }

src/Core/AdminConsole/OrganizationFeatures/Policies/IPolicyRequirementQuery.cs

@@ -0,0 +1,8 @@
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
+
+namespace Bit.Core.AdminConsole.OrganizationFeatures.Policies;
+
+public interface IPolicyRequirementQuery
+{
+    Task<T> GetAsync<T>(Guid userId) where T : IPolicyRequirement;
+}

src/Core/AdminConsole/OrganizationFeatures/Policies/Implementations/PolicyRequirementQuery.cs

@@ -0,0 +1,57 @@
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
+using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.Models.Data.Organizations.OrganizationUsers;
+using Bit.Core.Settings;
+
+namespace Bit.Core.AdminConsole.OrganizationFeatures.Policies.Implementations;
+
+public class PolicyRequirementQuery : IPolicyRequirementQuery
+{
+    private readonly IPolicyRepository _policyRepository;
+    private readonly PolicyRequirementRegistry _policyRequirements = new();
+
+    public PolicyRequirementQuery(IGlobalSettings globalSettings, IPolicyRepository policyRepository)
+    {
+        _policyRepository = policyRepository;
+
+        // Register Policy Requirement factory functions below
+        _policyRequirements.Add(SendPolicyRequirement.Create);
+        _policyRequirements.Add(up
+            => SsoPolicyRequirement.Create(up, globalSettings.Sso));
+    }
+
+    public async Task<T> GetAsync<T>(Guid userId) where T : IPolicyRequirement
+        => _policyRequirements.Get<T>()(await GetPolicyDetails(userId));
+
+    private Task<IEnumerable<OrganizationUserPolicyDetails>> GetPolicyDetails(Guid userId) =>
+        _policyRepository.GetPolicyDetailsByUserId(userId);
+
+    /// <summary>
+    /// Helper class used to register and retrieve Policy Requirement factories by type.
+    /// </summary>
+    private class PolicyRequirementRegistry
+    {
+        private readonly Dictionary<Type, CreateRequirement<IPolicyRequirement>> _registry = new();
+
+        public void Add<T>(CreateRequirement<T> factory) where T : IPolicyRequirement
+        {
+            // Explicitly convert T to an IPolicyRequirement (C# doesn't do this automatically).
+            IPolicyRequirement Converted(IEnumerable<OrganizationUserPolicyDetails> up) => factory(up);
+            _registry.Add(typeof(T), Converted);
+        }
+
+        public CreateRequirement<T> Get<T>() where T : IPolicyRequirement
+        {
+            if (!_registry.TryGetValue(typeof(T), out var factory))
+            {
+                throw new NotImplementedException("No Policy Requirement found for " + typeof(T));
+            }
+
+            // Explicitly convert IPolicyRequirement back to T (C# doesn't do this automatically).
+            // The cast here relies on the Register method correctly associating the type and factory function.
+            T Converted(IEnumerable<OrganizationUserPolicyDetails> up) => (T)factory(up);
+            return Converted;
+        }
+    }
+}
+

src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyRequirements/IPolicyRequirement.cs

@@ -0,0 +1,8 @@
+using Bit.Core.Models.Data.Organizations.OrganizationUsers;
+
+namespace Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
+
+public interface IPolicyRequirement;
+
+public delegate T CreateRequirement<T>(IEnumerable<OrganizationUserPolicyDetails> userPolicyDetails)
+    where T : IPolicyRequirement;

src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyRequirements/MasterPasswordPolicyRequirement.cs

@@ -0,0 +1,23 @@
+using Bit.Core.AdminConsole.Enums;
+using Bit.Core.AdminConsole.Models.Data.Organizations.Policies;
+using Bit.Core.Models.Data.Organizations.OrganizationUsers;
+
+namespace Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
+
+public class MasterPasswordPolicyRequirement : MasterPasswordPolicyData, IPolicyRequirement
+{
+    public static MasterPasswordPolicyRequirement Create(IEnumerable<OrganizationUserPolicyDetails> userPolicyDetails) =>
+        userPolicyDetails
+            .GetPolicyType(PolicyType.MasterPassword)
+            .ExcludeProviders()
+            .ExcludeRevokedAndInvitedUsers()
+            .Select(up => up.GetDataModel<MasterPasswordPolicyData>())
+            .Aggregate(
+                new MasterPasswordPolicyRequirement(),
+                (result, current) =>
+                {
+                    result.CombineWith(current);
+                    return result;
+                }
+            );
+}

src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyRequirements/PersonalOwnershipPolicyRequirement.cs

@@ -0,0 +1,20 @@
+using Bit.Core.AdminConsole.Enums;
+using Bit.Core.Models.Data.Organizations.OrganizationUsers;
+
+namespace Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
+
+public class PersonalOwnershipPolicyRequirement : IPolicyRequirement
+{
+    public bool DisablePersonalOwnership { get; init; }
+
+    public static PersonalOwnershipPolicyRequirement Create(IEnumerable<OrganizationUserPolicyDetails> userPolicyDetails)
+        => new()
+        {
+            DisablePersonalOwnership = userPolicyDetails
+                .GetPolicyType(PolicyType.PersonalOwnership)
+                .ExcludeOwnersAndAdmins()
+                .ExcludeProviders()
+                .ExcludeRevokedAndInvitedUsers()
+                .Any()
+        };
+}

src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyRequirements/PolicyRequirementHelpers.cs

@@ -0,0 +1,29 @@
+using Bit.Core.AdminConsole.Enums;
+using Bit.Core.Enums;
+using Bit.Core.Models.Data.Organizations.OrganizationUsers;
+
+namespace Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
+
+public static class PolicyRequirementHelpers
+{
+    public static IEnumerable<OrganizationUserPolicyDetails> GetPolicyType(
+        this IEnumerable<OrganizationUserPolicyDetails> userPolicyDetails,
+        PolicyType type) =>
+            userPolicyDetails.Where(x => x.PolicyType == type);
+
+    public static IEnumerable<OrganizationUserPolicyDetails> ExcludeOwnersAndAdmins(
+        this IEnumerable<OrganizationUserPolicyDetails> userPolicyDetails) =>
+            userPolicyDetails.Where(x => x.OrganizationUserType != OrganizationUserType.Owner);
+
+    public static IEnumerable<OrganizationUserPolicyDetails> ExcludeProviders(
+        this IEnumerable<OrganizationUserPolicyDetails> userPolicyDetails) =>
+            userPolicyDetails.Where(x => !x.IsProvider);
+
+    public static IEnumerable<OrganizationUserPolicyDetails> ExcludeRevokedAndInvitedUsers(
+        this IEnumerable<OrganizationUserPolicyDetails> userPolicyDetails) =>
+            userPolicyDetails.Where(x => x.OrganizationUserStatus >= OrganizationUserStatusType.Accepted);
+
+    public static IEnumerable<OrganizationUserPolicyDetails> ExcludeRevokedUsers(
+        this IEnumerable<OrganizationUserPolicyDetails> userPolicyDetails) =>
+            userPolicyDetails.Where(x => x.OrganizationUserStatus >= OrganizationUserStatusType.Invited);
+}

src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyRequirements/SendPolicyRequirement.cs

@@ -0,0 +1,31 @@
+using Bit.Core.AdminConsole.Enums;
+using Bit.Core.AdminConsole.Models.Data.Organizations.Policies;
+using Bit.Core.Models.Data.Organizations.OrganizationUsers;
+
+namespace Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
+
+public class SendPolicyRequirement : IPolicyRequirement
+{
+    public bool DisableSend { get; init; }
+    public bool DisableHideEmail { get; init; }
+
+    public static SendPolicyRequirement Create(IEnumerable<OrganizationUserPolicyDetails> userPolicyDetails)
+    {
+        var filteredPolicies = userPolicyDetails
+            .ExcludeOwnersAndAdmins()
+            .ExcludeRevokedAndInvitedUsers()
+            .ToList();
+
+        return new SendPolicyRequirement
+        {
+            DisableSend = filteredPolicies
+                .GetPolicyType(PolicyType.DisableSend)
+                .Any(),
+
+            DisableHideEmail = filteredPolicies
+                .GetPolicyType(PolicyType.SendOptions)
+                .Select(up => up.GetDataModel<SendOptionsPolicyData>())
+                .Any(d => d.DisableHideEmail)
+        };
+    }
+}

src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyRequirements/SingleOrganizationPolicyRequirement.cs

@@ -0,0 +1,45 @@
+using Bit.Core.AdminConsole.Enums;
+using Bit.Core.Models.Data.Organizations.OrganizationUsers;
+
+namespace Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
+
+public enum SingleOrganizationRequirementResult
+{
+    Ok = 1,
+    RequiredByThisOrganization = 2,
+    RequiredByOtherOrganization = 3
+}
+
+public class SingleOrganizationPolicyRequirement : IPolicyRequirement
+{
+    private IEnumerable<OrganizationUserPolicyDetails> PolicyDetails { get; }
+
+    public SingleOrganizationPolicyRequirement(IEnumerable<OrganizationUserPolicyDetails> userPolicyDetails)
+    {
+        PolicyDetails = userPolicyDetails
+            .GetPolicyType(PolicyType.SingleOrg)
+            .ExcludeOwnersAndAdmins()
+            .ExcludeProviders()
+            .ToList();
+    }
+
+    public SingleOrganizationRequirementResult CanJoinOrganization(Guid organizationId)
+    {
+        // Check for the org the user is trying to join
+        if (PolicyDetails.Any(x => x.OrganizationId == organizationId))
+        {
+            return SingleOrganizationRequirementResult.RequiredByThisOrganization;
+        }
+
+        // Check for other orgs the user might already be a member of (accepted or confirmed status only)
+        if (PolicyDetails.ExcludeRevokedAndInvitedUsers().Any())
+        {
+            return SingleOrganizationRequirementResult.RequiredByOtherOrganization;
+        }
+
+        return SingleOrganizationRequirementResult.Ok;
+    }
+
+    public SingleOrganizationRequirementResult CanBeRestoredToOrganization(Guid organizationId) =>
+        CanJoinOrganization(organizationId);
+}

src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyRequirements/SsoPolicyRequirement.cs

@@ -0,0 +1,26 @@
+using Bit.Core.AdminConsole.Enums;
+using Bit.Core.Enums;
+using Bit.Core.Models.Data.Organizations.OrganizationUsers;
+using Bit.Core.Settings;
+
+namespace Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
+
+public class SsoPolicyRequirement : IPolicyRequirement
+{
+    public bool RequireSso { get; init; }
+
+    public static SsoPolicyRequirement Create(
+        IEnumerable<OrganizationUserPolicyDetails> userPolicyDetails,
+        ISsoSettings ssoSettings)
+        => new()
+        {
+            RequireSso = userPolicyDetails
+                .GetPolicyType(PolicyType.RequireSso)
+                .ExcludeProviders()
+                // TODO: confirm minStatus - maybe confirmed?
+                .ExcludeRevokedAndInvitedUsers()
+                .Any(up =>
+                    up.OrganizationUserType is not OrganizationUserType.Owner and not OrganizationUserType.Admin ||
+                    ssoSettings.EnforceSsoPolicyForAllUsers)
+        };
+}

src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyRequirements/TwoFactorAuthenticationPolicyRequirement.cs

@@ -0,0 +1,26 @@
+using Bit.Core.AdminConsole.Enums;
+using Bit.Core.Models.Data.Organizations.OrganizationUsers;
+
+namespace Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
+
+public class TwoFactorAuthenticationPolicyRequirement : IPolicyRequirement
+{
+    private IEnumerable<OrganizationUserPolicyDetails> PolicyDetails { get; }
+
+    public TwoFactorAuthenticationPolicyRequirement(IEnumerable<OrganizationUserPolicyDetails> userPolicyDetails)
+    {
+        PolicyDetails = userPolicyDetails
+            .GetPolicyType(PolicyType.TwoFactorAuthentication)
+            .ExcludeOwnersAndAdmins()
+            .ExcludeProviders()
+            .ToList();
+    }
+
+    public bool RequiredToJoinOrganization(Guid organizationId)
+        => PolicyDetails.Any(x => x.OrganizationId == organizationId);
+
+    public IEnumerable<Guid> OrganizationsRequiringTwoFactor
+        => PolicyDetails
+            .ExcludeRevokedAndInvitedUsers()
+            .Select(x => x.OrganizationId);
+}

src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyServiceCollectionExtensions.cs

@@ -12,6 +12,7 @@ public static void AddPolicyServices(this IServiceCollection services)
     {
         services.AddScoped<IPolicyService, PolicyService>();
         services.AddScoped<ISavePolicyCommand, SavePolicyCommand>();
+        services.AddScoped<IPolicyRequirementQuery, PolicyRequirementQuery>();
 
         services.AddScoped<IPolicyValidator, TwoFactorAuthenticationPolicyValidator>();
         services.AddScoped<IPolicyValidator, SingleOrgPolicyValidator>();

src/Core/AdminConsole/Repositories/IPolicyRepository.cs

@@ -1,5 +1,6 @@
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.AdminConsole.Enums;
+using Bit.Core.Models.Data.Organizations.OrganizationUsers;
 using Bit.Core.Repositories;
 
 #nullable enable
@@ -11,4 +12,5 @@ public interface IPolicyRepository : IRepository<Policy, Guid>
     Task<Policy?> GetByOrganizationIdTypeAsync(Guid organizationId, PolicyType type);
     Task<ICollection<Policy>> GetManyByOrganizationIdAsync(Guid organizationId);
     Task<ICollection<Policy>> GetManyByUserIdAsync(Guid userId);
+    Task<IEnumerable<OrganizationUserPolicyDetails>> GetPolicyDetailsByUserId(Guid userId);
 }

src/Core/Tools/Services/Implementations/SendService.cs

@@ -1,6 +1,6 @@
 using System.Text.Json;
-using Bit.Core.AdminConsole.Enums;
-using Bit.Core.AdminConsole.Models.Data.Organizations.Policies;
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies;
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.AdminConsole.Services;
 using Bit.Core.Context;
@@ -36,6 +36,7 @@
     private readonly IReferenceEventService _referenceEventService;
     private readonly GlobalSettings _globalSettings;
     private readonly ICurrentContext _currentContext;
+    private readonly IPolicyRequirementQuery _policyRequirementQuery;
     private const long _fileSizeLeeway = 1024L * 1024L; // 1MB
 
     public SendService(
@@ -50,7 +51,8 @@
         GlobalSettings globalSettings,
         IPolicyRepository policyRepository,
         IPolicyService policyService,
-        ICurrentContext currentContext)
+        ICurrentContext currentContext,
+        IPolicyRequirementQuery policyRequirementQuery)
     {
         _sendRepository = sendRepository;
         _userRepository = userRepository;
@@ -64,6 +66,7 @@
         _referenceEventService = referenceEventService;
         _globalSettings = globalSettings;
         _currentContext = currentContext;
+        _policyRequirementQuery = policyRequirementQuery;
     }
 
     public async Task SaveSendAsync(Send send)
@@ -291,20 +294,15 @@
             return;
         }
 
-        var anyDisableSendPolicies = await _policyService.AnyPoliciesApplicableToUserAsync(userId.Value,
-            PolicyType.DisableSend);
-        if (anyDisableSendPolicies)
+        var sendRequirement = await _policyRequirementQuery.GetAsync<SendPolicyRequirement>(userId.Value);
+        if (sendRequirement.DisableSend)
         {
             throw new BadRequestException("Due to an Enterprise Policy, you are only able to delete an existing Send.");
         }
 
-        if (send.HideEmail.GetValueOrDefault())
+        if (send.HideEmail.GetValueOrDefault() && sendRequirement.DisableHideEmail)
         {
-            var sendOptionsPolicies = await _policyService.GetPoliciesApplicableToUserAsync(userId.Value, PolicyType.SendOptions);
-            if (sendOptionsPolicies.Any(p => CoreHelpers.LoadClassFromJsonData<SendOptionsPolicyData>(p.PolicyData)?.DisableHideEmail ?? false))
-            {
-                throw new BadRequestException("Due to an Enterprise Policy, you are not allowed to hide your email address from recipients when creating or editing a Send.");
-            }
+            throw new BadRequestException("Due to an Enterprise Policy, you are not allowed to hide your email address from recipients when creating or editing a Send.");
         }
     }