[SM-863] Add endpoint for fetching multiple secrets by IDs

[Thomas-Avery]

Type of change

- [ ] Bug fix
- [X] New feature development
- [ ] Tech debt (refactoring, code cleanup, dependency upgrades, etc)
- [ ] Build/deploy pipeline (DevOps)
- [ ] Other

Objective

Code changes

• bitwarden_license/src/Commercial.Core/SecretsManager/AuthorizationHandlers/Secrets/SecretAuthorizationHandler.cs:
  Adding CanReadSecret authorization.

• src/Core/SecretsManager/AuthorizationRequirements/SecretOperationRequirement.cs:
  Adding read option.

• bitwarden_license/test/Commercial.Core.Test/SecretsManager/AuthorizationHandlers/Secrets/SecretAuthorizationHandlerTests.cs:
  Adding unit tests for the CanReadSecret option.

• bitwarden_license/src/Commercial.Infrastructure.EntityFramework/SecretsManager/Repositories/SecretRepository.cs:
  Bug fix since service accounts can have write access now.

• src/Api/SecretsManager/Controllers/SecretsController.cs:
  Adding a new endpoint to fetch secrets given a list of secret IDs.

• src/Api/SecretsManager/Models/Request/GetSecretsRequestModel.cs:
  Request model for the new endpoint.

• src/Api/SecretsManager/Models/Response/BaseSecretResponseModel.cs:
  src/Api/SecretsManager/Models/Response/SecretResponseModel.cs:
  Since we won't need to return access information (read, write) for the endpoint, separating out response models.

BaseSecretResponseModel will just have secret information and SecretResponseModel will have the extra access information.

• src/Core/Services/IEventService.cs:
  src/Core/Services/Implementations/EventService.cs:
  src/Core/Services/NoopImplementations/NoopEventService.cs:

Adding a new method to the event service that will bulk insert many service account fetching secret events at once.

• test/Api.IntegrationTest/SecretsManager/Controllers/SecretsControllerTests.cs:
  Integration tests for the new endpoint.

• test/Api.Test/SecretsManager/Controllers/SecretsControllerTests.cs:
  Unit tests for the new endpoint.

Before you submit

• Please check for formatting errors (dotnet format --verify-no-changes) (required)
• If making database changes - make sure you also update Entity Framework queries and/or migrations
• Please add unit tests where it makes sense to do so (encouraged but not required)
• If this change requires a documentation update - notify the documentation team
• If this change has particular deployment requirements - notify the DevOps team

[bitwarden-bot]

Checkmarx One – Scan Summary & Details – 618b1974-fe47-45ac-9ef1-cbba1282983e

New Issues

Severity	Issue	Source File / Package	Checkmarx Insight
	CSRF	/src/Api/SecretsManager/Controllers/SecretsController.cs: 212	Attack Vector

[cd-bitwarden]

Great job @Thomas-Avery I just had 2 easy questions about the tests, other than that it looks great.

[cd-bitwarden]

LGTM Thomas :)