[PM-20577] Encrypt Risk Insights report and send it to server

bitwarden_license/bit-common/src/dirt/reports/risk-insights/models/password-health.ts

@@ -156,4 +156,40 @@ export enum DrawerType {
   OrgAtRiskApps = 3,
 }
 
+export interface RiskInsightsReport {
+  organizationId: OrganizationId;
+  date: string;
+  reportData: string;
+  totalMembers: number;
+  totalAtRiskMembers: number;
+  totalApplications: number;
+  totalAtRiskApplications: number;
+  totalCriticalApplications: number;
+}
+
+export interface ReportInsightsReportData {
+  data: string;
+  key: string;
+}
+
+export interface SaveRiskInsightsReportRequest {
+  data: RiskInsightsReport;
+}
+
+export interface SaveRiskInsightsReportResponse {
+  id: string;
+}
+
+export interface GetRiskInsightsReportResponse {
+  id: string;
+  organizationId: OrganizationId;
+  date: string;
+  reportData: string;
+  totalMembers: number;
+  totalAtRiskMembers: number;
+  totalApplications: number;
+  totalAtRiskApplications: number;
+  totalCriticalApplications: number;
+}
+
 export type PasswordHealthReportApplicationId = Opaque<string, "PasswordHealthReportApplicationId">;

bitwarden_license/bit-common/src/dirt/reports/risk-insights/services/critical-apps.service.ts

@@ -49,6 +49,10 @@
 
   // Get a list of critical apps for a given organization
   getAppsListForOrg(orgId: string): Observable<PasswordHealthReportApplicationsResponse[]> {
+    if (this.criticalAppsList.value.length === 0) {
+      return of([]);
+    }
+
     return this.criticalAppsList
       .asObservable()
       .pipe(map((apps) => apps.filter((app) => app.organizationId === orgId)));

bitwarden_license/bit-common/src/dirt/reports/risk-insights/services/index.ts

@@ -4,3 +4,4 @@
 export * from "./critical-apps-api.service";
 export * from "./risk-insights-report.service";
 export * from "./risk-insights-data.service";
+export * from "./risk-insights-api.service";

bitwarden_license/bit-common/src/dirt/reports/risk-insights/services/risk-insights-api.service.spec.ts

@@ -0,0 +1,54 @@
+import { mock } from "jest-mock-extended";
+
+import { ApiService } from "@bitwarden/common/abstractions/api.service";
+import { OrganizationId } from "@bitwarden/common/types/guid";
+
+import { SaveRiskInsightsReportRequest } from "../models/password-health";
+
+import { RiskInsightsApiService } from "./risk-insights-api.service";
+
+describe("RiskInsightsApiService", () => {
+  let service: RiskInsightsApiService;
+  const apiService = mock<ApiService>();
+
+  beforeEach(() => {
+    service = new RiskInsightsApiService(apiService);
+  });
+
+  it("should be created", () => {
+    expect(service).toBeTruthy();
+  });
+
+  it("should call apiService.send with correct parameters for saveRiskInsightsReport", (done) => {
+    const orgId = "org1" as OrganizationId;
+    const request: SaveRiskInsightsReportRequest = {
+      data: {
+        organizationId: orgId,
+        date: new Date().toISOString(),
+        reportData: "test",
+        totalMembers: 10,
+        totalAtRiskMembers: 5,
+        totalApplications: 100,
+        totalAtRiskApplications: 50,
+        totalCriticalApplications: 22,
+      },
+    };
+    const response = {
+      ...request.data,
+    };
+
+    apiService.send.mockReturnValue(Promise.resolve(response));
+
+    service.saveRiskInsightsReport(orgId, request).subscribe((result) => {
+      expect(result).toEqual(response);
+      expect(apiService.send).toHaveBeenCalledWith(
+        "PUT",
+        `/reports/risk-insights-report/${orgId.toString()}`,
+        request.data,
+        true,
+        true,
+      );
+      done();
+    });
+  });
+});

bitwarden_license/bit-common/src/dirt/reports/risk-insights/services/risk-insights-api.service.ts

@@ -0,0 +1,45 @@
+import { from, Observable, of } from "rxjs";
+
+import { ApiService } from "@bitwarden/common/abstractions/api.service";
+import { OrganizationId } from "@bitwarden/common/types/guid";
+
+import {
+  GetRiskInsightsReportResponse,
+  SaveRiskInsightsReportRequest,
+  SaveRiskInsightsReportResponse,
+} from "../models/password-health";
+
+export class RiskInsightsApiService {
+  constructor(private apiService: ApiService) {}
+
+  saveRiskInsightsReport(
+    orgId: OrganizationId,
+    request: SaveRiskInsightsReportRequest,
+  ): Observable<SaveRiskInsightsReportResponse> {
+    const dbResponse = this.apiService.send(
+      "PUT",
+      `/reports/risk-insights-report/${orgId.toString()}`,
+      request.data,
+      true,
+      true,
+    );
+
+    return from(dbResponse as Promise<SaveRiskInsightsReportResponse>);
+  }
+
+  getRiskInsightsReport(orgId: OrganizationId): Observable<GetRiskInsightsReportResponse | null> {
+    const dbResponse = this.apiService
+      .send("GET", `/reports/risk-insights-report/${orgId.toString()}`, null, true, true)
+      .catch((error: any): any => {
+        if (error.statusCode === 404) {
+          return null; // Handle 404 by returning null or an appropriate default value
+        }
+        throw error; // Re-throw other errors
+      });
+
+    if (dbResponse instanceof Error) {
+      return of(null);
+    }
+    return from(dbResponse as Promise<GetRiskInsightsReportResponse>);
+  }
+}

bitwarden_license/bit-common/src/dirt/reports/risk-insights/services/risk-insights-report.service.spec.ts

@@ -3,10 +3,14 @@ import { firstValueFrom } from "rxjs";
 import { ZXCVBNResult } from "zxcvbn";
 
 import { AuditService } from "@bitwarden/common/abstractions/audit.service";
+import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
+import { KeyGenerationService } from "@bitwarden/common/platform/abstractions/key-generation.service";
 import { PasswordStrengthServiceAbstraction } from "@bitwarden/common/tools/password-strength";
 import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
+import { KeyService } from "@bitwarden/key-management";
 
 import { mockCiphers } from "./ciphers.mock";
+import { CriticalAppsService } from "./critical-apps.service";
 import { MemberCipherDetailsApiService } from "./member-cipher-details-api.service";
 import { mockMemberCipherDetails } from "./member-cipher-details-api.service.spec";
 import { RiskInsightsReportService } from "./risk-insights-report.service";
@@ -17,6 +21,10 @@ describe("RiskInsightsReportService", () => {
   const auditService = mock<AuditService>();
   const cipherService = mock<CipherService>();
   const memberCipherDetailsService = mock<MemberCipherDetailsApiService>();
+  const keyService = mock<KeyService>();
+  const encryptService = mock<EncryptService>();
+  const criticalAppsService = mock<CriticalAppsService>();
+  const keyGenerationService = mock<KeyGenerationService>();
 
   beforeEach(() => {
     pwdStrengthService.getPasswordStrength.mockImplementation((password: string) => {
@@ -37,6 +45,10 @@ describe("RiskInsightsReportService", () => {
       auditService,
       cipherService,
       memberCipherDetailsService,
+      keyService,
+      encryptService,
+      criticalAppsService,
+      keyGenerationService,
     );
   });
 

bitwarden_license/bit-common/src/dirt/reports/risk-insights/services/risk-insights-report.service.ts

@@ -1,13 +1,18 @@
 // FIXME: Update this file to be type safe
 // @ts-strict-ignore
-import { concatMap, first, from, map, Observable, zip } from "rxjs";
+import { concatMap, first, firstValueFrom, from, map, Observable, takeWhile, zip } from "rxjs";
 
 import { AuditService } from "@bitwarden/common/abstractions/audit.service";
+import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
+import { KeyGenerationService } from "@bitwarden/common/platform/abstractions/key-generation.service";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
+import { EncString } from "@bitwarden/common/platform/models/domain/enc-string";
 import { PasswordStrengthServiceAbstraction } from "@bitwarden/common/tools/password-strength";
+import { OrganizationId } from "@bitwarden/common/types/guid";
 import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
 import { CipherType } from "@bitwarden/common/vault/enums";
 import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view";
+import { KeyService } from "@bitwarden/key-management";
 
 import {
   ApplicationHealthReportDetail,
@@ -20,8 +25,11 @@
   MemberDetailsFlat,
   WeakPasswordDetail,
   WeakPasswordScore,
+  RiskInsightsReport,
+  GetRiskInsightsReportResponse,
 } from "../models/password-health";
 
+import { CriticalAppsService } from "./critical-apps.service";
 import { MemberCipherDetailsApiService } from "./member-cipher-details-api.service";
 
 export class RiskInsightsReportService {
@@ -30,6 +38,10 @@
     private auditService: AuditService,
     private cipherService: CipherService,
     private memberCipherDetailsApiService: MemberCipherDetailsApiService,
+    private keyService: KeyService,
+    private encryptService: EncryptService,
+    private criticalAppsService: CriticalAppsService,
+    private keyGeneratorService: KeyGenerationService,
   ) {}
 
   /**
@@ -162,6 +174,106 @@
     };
   }
 
+  async generateEncryptedRiskInsightsReport(
+    organizationId: OrganizationId,
+    details: ApplicationHealthReportDetail[],
+    summary: ApplicationHealthReportSummary,
+  ): Promise<RiskInsightsReport> {
+    const orgKey = await this.keyService.getOrgKey(organizationId as string);
+    if (orgKey === null) {
+      throw new Error("Organization key not found");
+    }
+
+    const reportContentEncryptionKey = await this.keyGeneratorService.createKey(512);
+    const reportEncrypted = await this.encryptService.encryptString(
+      JSON.stringify(details),
+      reportContentEncryptionKey,
+    );
+
+    const wrappedReportContentEncryptionKey = await this.encryptService.wrapSymmetricKey(
+      reportContentEncryptionKey,
+      orgKey,
+    );
+
+    const reportDataWithWrappedKey = {
+      data: reportEncrypted.encryptedString,
+      key: wrappedReportContentEncryptionKey.encryptedString,
+    };
+
+    const encryptedReportDataWithWrappedKey = await this.encryptService.encryptString(
+      JSON.stringify(reportDataWithWrappedKey),
+      orgKey,
+    );
+
+    const criticalApps = await firstValueFrom(
+      this.criticalAppsService
+        .getAppsListForOrg(organizationId)
+        .pipe(takeWhile((apps) => apps !== null && apps.length > 0)),
+    );
+
+    const riskInsightReport = {
+      organizationId: organizationId,
+      date: new Date().toISOString(),
+      reportData: encryptedReportDataWithWrappedKey.encryptedString,
+      totalMembers: summary.totalMemberCount,
+      totalAtRiskMembers: summary.totalAtRiskMemberCount,
+      totalApplications: summary.totalApplicationCount,
+      totalAtRiskApplications: summary.totalAtRiskApplicationCount,
+      totalCriticalApplications: criticalApps.length,
+    };
+
+    return riskInsightReport;
+  }
+
+  async decryptRiskInsightsReport(
+    organizationId: OrganizationId,
+    riskInsightsReportResponse: GetRiskInsightsReportResponse,
+  ): Promise<[ApplicationHealthReportDetail[], ApplicationHealthReportSummary]> {
+    try {
+      const orgKey = await this.keyService.getOrgKey(organizationId as string);
+      if (orgKey === null) {
+        throw new Error("Organization key not found");
+      }
+
+      const decryptedReportDataWithWrappedKey = await this.encryptService.decryptString(
+        new EncString(riskInsightsReportResponse.reportData),
+        orgKey,
+      );
+
+      const reportDataInJson = JSON.parse(decryptedReportDataWithWrappedKey);
+      const reportEncrypted = reportDataInJson.data;
+      const wrappedReportContentEncryptionKey = reportDataInJson.key;
+
+      const freshWrappedReportContentEncryptionKey = new EncString(
+        wrappedReportContentEncryptionKey,
+      );
+
+      const unwrappedReportContentEncryptionKey = await this.encryptService.unwrapSymmetricKey(
+        freshWrappedReportContentEncryptionKey,
+        orgKey,
+      );
+
+      const reportUnencrypted = await this.encryptService.decryptString(
+        new EncString(reportEncrypted),
+        unwrappedReportContentEncryptionKey,
+      );
+
+      const reportJson: ApplicationHealthReportDetail[] = JSON.parse(reportUnencrypted);
+
+      const summary: ApplicationHealthReportSummary = {
+        totalMemberCount: riskInsightsReportResponse.totalMembers,
+        totalAtRiskMemberCount: riskInsightsReportResponse.totalAtRiskMembers,
+        totalApplicationCount: riskInsightsReportResponse.totalApplications,
+        totalAtRiskApplicationCount: riskInsightsReportResponse.totalAtRiskApplications,
+      };
+
+      return [reportJson, summary];
+    } catch {
+      // console.error("Error decrypting risk insights report :", error);
+      return [null, null];
+    }
+  }
+
   /**
    * Associates the members with the ciphers they have access to. Calculates the password health.
    * Finds the trimmed uris.

bitwarden_license/bit-web/src/app/dirt/access-intelligence/access-intelligence.module.ts

@@ -5,12 +5,14 @@
 import {
   CriticalAppsApiService,
   MemberCipherDetailsApiService,
+  RiskInsightsApiService,
   RiskInsightsDataService,
   RiskInsightsReportService,
 } from "@bitwarden/bit-common/dirt/reports/risk-insights/services";
 import { ApiService } from "@bitwarden/common/abstractions/api.service";
 import { AuditService } from "@bitwarden/common/abstractions/audit.service";
 import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
+import { KeyGenerationService } from "@bitwarden/common/platform/abstractions/key-generation.service";
 import { PasswordStrengthServiceAbstraction } from "@bitwarden/common/tools/password-strength/password-strength.service.abstraction";
 import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
 import { KeyService } from "@bitwarden/key-management";
@@ -32,6 +34,10 @@
         AuditService,
         CipherService,
         MemberCipherDetailsApiService,
+        KeyService,
+        EncryptService,
+        CriticalAppsService,
+        KeyGenerationService,
       ],
     },
     {
@@ -48,6 +54,10 @@
       useClass: CriticalAppsApiService,
       deps: [ApiService],
     }),
+    safeProvider({
+      provide: RiskInsightsApiService,
+      deps: [ApiService],
+    }),
   ],
 })
 export class AccessIntelligenceModule {}