AAD account checks on packages for safety reports (#9360)

Author: drewgillies

src/AccountDeleter/EmptyFeatureFlagService.cs

@@ -276,6 +276,11 @@ public bool IsShowReportAbuseSafetyChangesEnabled()
             throw new NotImplementedException();
         }
 
+        public bool IsAllowAadContentSafetyReportsEnabled()
+        {
+            throw new NotImplementedException();
+        }
+
         public bool IsTyposquattingEnabled()
         {
             throw new NotImplementedException();

src/GitHubVulnerabilities2Db/Fakes/FakeFeatureFlagService.cs

@@ -215,6 +215,11 @@ public bool IsShowReportAbuseSafetyChangesEnabled()
             throw new NotImplementedException();
         }
 
+        public bool IsAllowAadContentSafetyReportsEnabled()
+        {
+            throw new NotImplementedException();
+        }
+
         public bool IsPackageDependentsEnabled(User user)
         {
             throw new NotImplementedException();

src/NuGetGallery.Core/CredentialTypes.cs

@@ -104,6 +104,7 @@ public static bool IsApiKey(string type)
         {
             return type?.StartsWith(ApiKey.Prefix, StringComparison.OrdinalIgnoreCase) ?? false;
         }
+
         public static bool IsMicrosoftAccount(string type)
         {
             return type?.Equals(External.MicrosoftAccount, StringComparison.OrdinalIgnoreCase) ?? false;

src/NuGetGallery.Services/Configuration/FeatureFlagService.cs

@@ -52,6 +52,7 @@ public class FeatureFlagService : IFeatureFlagService
         private const string ImageAllowlistFlightName = GalleryPrefix + "ImageAllowlist";
         private const string DisplayBannerFlightName = GalleryPrefix + "Banner";
         private const string ShowReportAbuseSafetyChanges = GalleryPrefix + "ShowReportAbuseSafetyChanges";
+        private const string AllowAadContentSafetyReports = GalleryPrefix + "AllowAadContentSafetyReports";
         private const string DisplayTargetFrameworkFeatureName = GalleryPrefix + "DisplayTargetFramework";
         private const string ComputeTargetFrameworkFeatureName = GalleryPrefix + "ComputeTargetFramework";
         private const string RecentPackagesNoIndexFeatureName = GalleryPrefix + "RecentPackagesNoIndex";
@@ -333,6 +334,11 @@ public bool IsShowReportAbuseSafetyChangesEnabled()
             return _client.IsEnabled(ShowReportAbuseSafetyChanges, defaultValue: false);
         }
 
+        public bool IsAllowAadContentSafetyReportsEnabled()
+        {
+            return _client.IsEnabled(AllowAadContentSafetyReports, defaultValue: false);
+        }
+
         public bool IsMarkdigMdRenderingEnabled()
         {
             return _client.IsEnabled(MarkdigMdRenderingFlightName, defaultValue: false);

src/NuGetGallery.Services/Configuration/IFeatureFlagService.cs

@@ -258,6 +258,11 @@ public interface IFeatureFlagService
         /// </summary>
         bool IsShowReportAbuseSafetyChangesEnabled();
 
+        /// <summary>
+        /// Whether online safety categories are available to content owned by at least one AAD-authenticated account
+        /// </summary>
+        bool IsAllowAadContentSafetyReportsEnabled();
+
         /// <summary>
         /// Whether rendering Markdown content to HTML using Markdig is enabled
         /// </summary>

src/NuGetGallery/Controllers/PackagesController.cs

@@ -1385,6 +1385,7 @@ public virtual ActionResult ReportAbuse(string id, string version)
             var model = new ReportAbuseViewModel
             {
                 ReasonChoices = _featureFlagService.IsShowReportAbuseSafetyChangesEnabled()
+                    && (_featureFlagService.IsAllowAadContentSafetyReportsEnabled() || PackageHasNoAadOwners(package))
                     ? ReportAbuseWithSafetyReasons
                     : ReportAbuseReasons,
                 PackageId = id,
@@ -2857,6 +2858,38 @@ await _auditingService.SaveAuditRecordAsync(
             }
         }
 
+        private static bool PackageHasNoAadOwners(Package package)
+        {
+            var owners = package?.PackageRegistration?.Owners;
+            if (owners == null || !owners.Any()) {
+                return true;
+            }
+
+            // First check direct owner credentials
+            if (owners.Any(o => o.Credentials.GetAzureActiveDirectoryCredential() != null))
+            {
+                return false;
+            }
+
+            // Check all members of organization owners
+            var orgOwners = owners.Where(o => o is Organization).Select(o => o as Organization);
+            foreach (var orgOwner in orgOwners)
+            {
+                if (orgOwner.Members == null)
+                {
+                    continue;
+                }
+
+                if (orgOwner.Members.Any(m => m.Member?.Credentials != null &&
+                      m.Member.Credentials.GetAzureActiveDirectoryCredential() != null))
+                {
+                    return false;
+                }
+            }
+
+            return true;
+        }
+
         private async Task DeleteUploadedFileForUser(User currentUser, Stream uploadedFileStream)
         {
             try

src/VerifyMicrosoftPackage/Fakes/FakeFeatureFlagService.cs

@@ -103,6 +103,8 @@ public class FakeFeatureFlagService : IFeatureFlagService
 
         public bool IsShowReportAbuseSafetyChangesEnabled() => throw new NotImplementedException();
 
+        public bool IsAllowAadContentSafetyReportsEnabled() => throw new NotImplementedException();
+
         public bool IsMarkdigMdRenderingEnabled() => throw new NotImplementedException();
 
         public bool IsMarkdigMdSyntaxHighlightEnabled() => throw new NotImplementedException();