Commit Graph

898 Commits

Author SHA1 Message Date
Rui Tomé
3dd72f6118 [PM-22450] Bump Collection.RevisionDate on edits and access changes (#7380)
* Fix UpdateCollectionCommand to set RevisionDate using TimeProvider and update corresponding tests. Adjust tests to verify correct RevisionDate assignment during collection updates.

* Enhance BulkAddCollectionAccessCommand to include revision date in access updates. Update ICollectionRepository and its implementations to accept revision date parameter. Modify stored procedure to update collection revision dates accordingly. Add tests to verify correct behavior of access creation and revision date updates.

* Update GroupRepository and stored procedures to bump RevisionDate for affected collections during group creation and updates. Enhance integration tests to verify that collection revision dates are correctly updated when groups are created or modified.

* Implement revision date updates for affected collections in OrganizationUserRepository and related stored procedures. Add integration tests to ensure revision dates are correctly bumped during organization user creation and updates.

* Update database migration script

* Update migration script summary

* Refactor OrganizationUserReplaceTests to create collection first

* Refactor stored procedures to use Common Table Expressions (CTEs) for updating RevisionDate of affected collections. This change improves readability and maintainability by consolidating the logic for identifying affected collections in Group_UpdateWithCollections and OrganizationUser_UpdateWithCollections procedures.

* Enhance OrganizationUser_CreateManyWithCollectionsAndGroups stored procedure to accept RevisionDate parameter for updating affected collections. Update OrganizationUserRepository to utilize the provided RevisionDate when available, ensuring accurate revision date management during organization user operations.

* Refactor OrganizationUser_CreateManyWithCollectionsGroups and migration script to utilize temporary table for CollectionUser data insertion. This change improves performance and maintains consistency in updating RevisionDate for affected collections.

* Refactor OrganizationUserRepository to consistently use RevisionDate from created OrganizationUsers when updating affected collections. This change enhances the accuracy of revision date management across the repository.

* Refactor tests to ensure consistent handling of RevisionDate across Group and Collection repositories. Update assertions to compare RevisionDate directly, improving accuracy in revision date management during tests.

* Restore BOM in Group_UpdateWithCollections and OrganizationUser_UpdateWithCollections

* Refactor GroupRepository and OrganizationUserRepository to improve handling of RevisionDate. Updated collection filtering logic to use HashSet for efficiency and ensured that affected collections are filtered by OrganizationId, enhancing accuracy in revision date management.

* Bump migration script date

* Remove internal set from RevisionDate on Group and OrganizationUser

The Dapper repositories use a System.Text.Json serialize/deserialize
round-trip to build *WithCollections objects. System.Text.Json silently
skips properties with non-public setters, so RevisionDate was reverting
to DateTime.UtcNow instead of preserving the value set in C#.

* Refactor OrganizationUser_CreateManyWithCollectionsGroups and migration script to improve the logic for updating RevisionDate. The update now uses INNER JOINs to ensure accurate filtering of collections based on OrganizationId and CollectionUser data, enhancing the precision of revision date management.

* Fix sprocs styling

* Added early return to OrganizationUserRepository.CreateManyAsync if the supplied parameter is empty
2026-04-10 07:27:27 +01:00
Jared
b3c8950838 [PM-26383] Remove feature flag from server-side for autoconfirm (#7402)
* Refactor organization user confirmation logic by removing direct feature flag checks. Updated related commands and tests to utilize policy requirements instead of feature service checks for automatic user confirmation. Cleaned up organization form view by simplifying checkbox rendering for automatic user confirmation.

* Refactor ProviderService to remove feature service dependency for automatic user confirmation. Updated logic to streamline policy requirement checks and cleaned up related tests by removing unnecessary feature flag assertions.

* Enhance tests for automatic user confirmation policy requirements. Updated multiple test classes to include checks for `AutomaticUserConfirmationPolicyRequirement`, ensuring no auto-confirm restrictions are applied by default. Refactored related assertions in `AcceptOrgUserCommandTests`, `ConfirmOrganizationUserCommandTests`, `RestoreOrganizationUserCommandTests`, and others to streamline compliance validation logic.

* Enhance tests for automatic user confirmation policy across multiple test classes. Added checks for `AutomaticUserConfirmationPolicyRequirement` in `ConfirmOrganizationUserCommandTests`, `RestoreOrganizationUserCommandTests`, and `SelfHostedOrganizationSignUpCommandTests`, ensuring compliance validation logic is streamlined and consistent. Updated assertions to reflect new policy requirements.

* Implement mock for AutomaticUserConfirmationPolicyRequirement in ProviderServiceTests to enhance test coverage for user confirmation policies.

* Update ProviderServiceTests to include mocks for AutomaticUserConfirmationPolicyRequirement, enhancing test coverage for user acceptance scenarios.

* Refactor test method names in EmergencyAccessServiceTests for clarity by removing feature flag references, improving readability and maintainability of the test suite.
2026-04-09 12:56:23 -04:00
Thomas Rittson
9ceab46d2d Remove missed uses of PolicyRequirements flag (#7426)
This is being used for the RequireSso policy only.
This commit removes the remaining other references.
2026-04-09 07:18:06 -07:00
Jimmy Vo
a29fe6f922 [PM-33044] Provider Ability Refactor EventService (#7411) 2026-04-09 09:48:25 -04:00
John Harrington
ebbf6dd0fa [PM-34383] Add import validation allowing providers to perform imports (#7394)
* resolve auth bypass and enable nullable (tech debt)

* fix failing test
2026-04-08 14:44:17 -07:00
Patrick-Pimentel-Bitwarden
74c4aced74 fix(refactor): [PM-34246] Rename Set Password to Finalize Onboarding (#7328)
* fix(refactor): [PM-34246] Rename Set Password to Finalize Onboarding - Initial set of renames take two.

* fix(refactor): [PM-34246] Rename Set Password to Finalize Onboarding - Updated function name.

* fix(refactor): [PM-34246] Rename Set Password to Finalize Onboarding - Fixed test.

* fix(refactor): [PM-34246] Rename Set Password to Finalize Onboarding - Unborked tests.

* fix(refactor): [PM-34246] Rename Set Password to Finalize Onboarding - Changed test names.
2026-04-08 11:00:17 -04:00
Alex Morask
a5052d8d0f fix(billing): skip ended schedule phases when updating storage (#7420) 2026-04-08 09:51:03 -05:00
Graham Walker
f6e858b296 PM-34686 initial commmit (#7398) 2026-04-08 07:43:05 -05:00
Jordan Aasen
d038dfa261 [PM-33500] - delete attachments from deleted ciphers (#7208)
* delete attachments from deleted ciphers

* add DeleteAttachmentsForOrganizationAsync to cipher service. update specs

* fix test

* only grab cipherId for attachments deletion

* add missing directive

---------

Co-authored-by: SmithThe4th <gsmith@bitwarden.com>
2026-04-07 21:12:59 +00:00
Alex Morask
aa1aa58190 fix(billing): use top-level ProrationBehavior on schedule updates for immediate storage invoicing (#7410) 2026-04-07 15:09:21 -05:00
renovate[bot]
13a9866cdb [deps] Billing: Update Kralizek.AutoFixture.Extensions.MockHttp to 2.2.1 (#6556)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-04-07 15:08:49 -05:00
Alex Morask
c04ee9c0a9 fix(billing): handle cross-product Phase 2 price overlay for Families 2019 (#7408) 2026-04-07 12:32:51 -05:00
Rui Tomé
c277637312 [PM-29152] Rename VNextSavePolicyCommand to SavePolicyCommand and remove deprecated policy interfaces (#7364)
* Remove deprecated ISavePolicyCommand interface and SavePolicyCommand implementation along with associated tests

* Refactor policy validation: remove IPolicyValidator interface and related implementations. Update PolicyServiceCollectionExtensions to eliminate deprecated methods. Adjust policy validator classes to remove IPolicyValidator dependency and streamline validation methods.

* Remove IPostSavePolicySideEffect interface and its implementation from the policy validation framework.

* Rename VNextSavePolicyCommand to SavePolicyCommand

* Continue renaming VNextSavePolicyCommand

* Refactor policy validation tests to use SavePolicyModel in ValidateAsync and side effect methods

* Refactor policy validators to directly use PolicyUpdate from SavePolicyModel in validation and side effect methods, improving code clarity and reducing method complexity.

* Rename test methods in PoliciesControllerTests and VerifyOrganizationDomainCommandTests to better reflect their functionality, enhancing clarity and consistency across the test suite.

* Refactor OrganizationUserNotificationPolicyValidator by removing unused methods and simplifying the implementation. Update corresponding tests to reflect these changes.

* Remove unnecessary nullable enable directives from policy validator files and update using statements for consistency.

* Rename policy validators to handlers

* dotnet format
2026-04-07 13:03:13 +01:00
Alex Morask
e758ca2e27 fix(billing): display Phase 2 prices and discount on org subscription page (#7393) 2026-04-06 14:15:20 -05:00
Alex Morask
c4f9ad79a9 fix(billing): prevent stale schedule discount after Stripe deletion (#7391) 2026-04-06 10:54:28 -05:00
Conner Turnbull
6eb0c3c3ef Include schedule Phase 2 discount in premium tax estimate preview (#7385)
When a subscription has an active schedule during the ~15-day window before
renewal, the invoice preview for tax estimation was built with the new price
but without the Phase 2 discount coupon. This caused the estimated tax on the
subscription page to be higher than what Stripe would actually charge.

Pass the coupon ID from the schedule's Phase 2 discount through to
EstimatePremiumTaxAsync so it is included in the InvoiceCreatePreviewOptions.
2026-04-03 10:41:33 -04:00
Stephon Brown
6ab70c1d99 [PM-34570] Expired or Cancelled Claimed User Throws Billing Exception on Subscription Cancel (#7382)
* fix(billing): broaden exception handling for subscription cancellations

* test(billing): add BillingException handling tests for user account deletion

* test(billing): add BillingException handling tests for organization deletion

* refactor(test): remove unused ILogger using statement

* refactor(billing): add specific usings for billing exceptions

* fix(billing): specify exceptions for billing cancellation failures
2026-04-02 14:21:51 -04:00
Alex Morask
69672bf912 fix(billing): scope schedule discount to seats item instead of cart (#7378) 2026-04-02 14:32:22 +00:00
Stephon Brown
da34581991 [PM-33897] Schedule Aware Cancellation and Reinstatement (#7374)
* feat(pricing): add ResolvePhase2Async to price increase scheduler interface

* feat(pricing): implement ResolvePhase2Async and add unit tests

* feat(subscriber): adjust subscription cancellation for price migration schedules

* feat(reinstate): update subscription reinstatement for price migration schedules

* fix(billing) simplify cancellation data logic

* fix(billing): Cast StartDate to DateTime in price increase tests

* fix(billing): PR feedback

* refactor(test): rename subscription cancellation test

* fix(billing): properly apply cancellation metadata to subscription schedules
2026-04-02 10:04:41 -04:00
Alex Morask
1fac799e3d fix(billing): display schedule phase 2 discount on premium subscription page (#7375) 2026-04-01 14:53:45 -05:00
John Harrington
7e02832672 [PM-31885] Consolidate all Send policies to a single policy (#7113)
* initial send controls

* update vNext methods and add test coverage for policy validators

* add comments to tests

* Apply suggestion from @mkincaid-bw

• `IX_Policy_OrganizationId_Type` is a unique index

Co-authored-by: mkincaid-bw <mkincaid@bitwarden.com>

* renamne migrations for correct sorting

* respond to csharp related review comments

* fix failing lints

* fix tests

* revise policy sync logic

* revise policy event logic and tests

* add integration tests

- fix SQL syntax error
- escape Sqlite format specifier
- update migration IDs to match sorted filename
- fix SQL syntax error

* OR legacy policy data with SendControls policy data

* remove migrations and associated integration test

* whitespacing and comment correction

* aggregate kegacy Send policies in PolicyQuery and adjust PoliciesController logic

* add comments to simplify post-migration cleanup

* consolidate legacy Send policy synthesis from PoliciesController into PolicyQuery.GetAllAsync

* respond to review comments and other minor fixes

---------

Co-authored-by: mkincaid-bw <mkincaid@bitwarden.com>
2026-04-01 08:03:46 -07:00
Brandon Treston
2465e3a4fe add repo call to check if existing collection already has access setup (#7365) 2026-04-01 10:03:08 -04:00
Rui Tomé
0a8d6d4268 [PM-32260] Fix missing device approval event logs for accepted users (#7247)
* Enhance IEventService to log user events for accepted status organizations. Updated LogUserEventAsync method to include a new parameter for including organizations where the user has accepted status. Added corresponding unit tests to verify functionality.

* Update AuthRequestService to include accepted status organizations in user event logging. Adjusted LogUserEventAsync method and corresponding unit tests to reflect the new parameter.

* Update NoopEventService to include a new parameter for accepted status organizations in LogUserEventAsync method.

* Update EventServiceTests to use Arg.Any for GetOrganizationAbilitiesAsync method
2026-04-01 14:34:26 +01:00
Nick Krantz
557eeaaa8f [PM-33405] Add OrganizationUserNotificationPolicy (#7250)
* add OrganizationUserNotification policy

* remove "policy" from policy name

* update policy text
2026-03-31 15:31:56 -05:00
sven-bitwarden
4cb60ac37d [PM-332124] Finalize PolicyRequirement + 2FA Feature Flag (#7209)
* Remove 2FA feature flag

* Remove unused using
2026-03-31 16:22:12 +00:00
sven-bitwarden
b38b31a0f3 Finalize org data ownership policy requirement (#7210) 2026-03-31 11:00:42 -05:00
Stephon Brown
f1a43078f3 [PM-33891] Migrate Cancel and Reinstate Paths (#7331)
* refactor(billing): make OffboardingSurveyResponse optional in CancelSubscription

* refactor(billing): migrate UserService.CancelPremiumAsync behind PM32645 feature flag

* refactor(billing): migrate OrganizationDeleteCommand cancel behind PM32645 feature flag

* refactor(billing): migrate AccountsController reinstate-premium behind PM32645 feature flag

* refactor(billing): migrate OrganizationsController reinstate behind PM32645 feature flag

* feat(billing): Introduce CancelSubscription overload for system cancellations

* refactor(billing): Conditionally apply Stripe cancellation metadata

* chore(tests): Remove unused using directive in OrganizationDeleteCommandTests

* refactor(billing): simplify OneOf result handling

* chore(deps): remove unused OneOf.Types imports

* chore(deps): remove unused Bit.Core.Billing.Commands imports

* chore(deps): remove unused Bit.Core imports

* refactor(billing): unify ISubscriberService.CancelSubscription overloads

* refactor(billing): update SubscriberService.CancelSubscription implementation

* fix(api): adjust CancelSubscription calls in billing controllers

* fix(user): adjust UserService.CancelSubscription call

* test(billing): adjust SubscriberServiceTests for new CancelSubscription signature

* test(user): adjust UserServiceTests for new CancelSubscription signature

* refactor(billing): feature flag subscription cancel

* refactor: decouple premium cancellation logic from user service

* test: add tests for organization cancellation with feature flag

* test: add tests for handling gateway exceptions during cancellation

* fix(billing): run dotnet format
2026-03-31 14:29:27 +00:00
Alex Morask
11605dd551 feat(billing): make storage commands schedule-aware for price migration (#7350) 2026-03-31 08:32:03 -05:00
Jimmy Vo
5a0353b320 [PM-34440] Fix cache duplicate-key error (#7360) 2026-03-30 17:54:50 -04:00
Kyle Spearrin
30f9229b22 [PM-15489] 2fa account recovery (#7139)
* implementation plan

* feedback updates

* revert updates

* implementation plan

* feedback updates

* revert updates

* implement plan

* Revert "Merge branch '2fa-account-recovery' of github.com:bitwarden/server into 2fa-account-recovery"

This reverts commit 3be2d140f1, reversing
changes made to 9fb8d3891c.

* PR feedback

* revert claude  local settings

* lint fixes

* fix test models

* move new commands to v2 namespace.

* format

* fix swagger stuff

* update feature flag name
2026-03-30 10:48:43 -04:00
Conner Turnbull
c604379f04 [PM-33901] Implement schedule-aware tax handling (#7319)
Make tax-related subscription updates schedule-aware during the ~15-day
window between invoice.upcoming and renewal. When a subscription schedule
is present and the feature flag is enabled, update default_settings.automatic_tax
on the schedule instead of the subscription directly.

Modified paths:
- UpcomingInvoiceHandler: AlignOrganizationTaxConcernsAsync,
  AlignPremiumUsersTaxConcernsAsync, new shared EnableAutomaticTaxAsync helper
- UpdateBillingAddressCommand: EnableAutomaticTaxAsync, added IFeatureService
2026-03-27 14:27:36 -04:00
Conner Turnbull
7458eba830 [PM-33901] Remove unused UpdateTaxInformation (#7320)
UpdateTaxInformation has no callers in src/. Remove from ISubscriberService,
SubscriberService, and associated tests. Also removes the now-unused
ITaxService constructor parameter from SubscriberService.
2026-03-27 14:26:41 -04:00
Stephon Brown
3c2cc45215 [PM-32216] Create Stripe Checkout Session Endpoint (#7246)
* feat(stripe): add checkout session constants and settings

* feat(billing): integrate Stripe Checkout Session adapter

* feat(billing): define premium checkout session DTOs

* feat(billing): implement CreatePremiumCheckoutSessionCommand

* feat(billing): add premium checkout session API endpoint

* test(billing): add premium checkout session tests

* fix(billing): run dotnet format

* fix(billing): run dotnet format

* refactor(billing): clarify Stripe session types in IStripeAdapter

* refactor(billing): clarify Stripe session service and types in StripeAdapter

* refactor(StripeAdapter): remove duplicate billing portal session method

* style(premium): remove trailing comma from payment method types

* refactor(billing): retrieve client version from context

* refactor(premium): remove IUserService dependency from checkout command

* refactor(premium): consolidate stripe customer creation logic

* fix(billing) run dotnet format

* feat(billing): add user ID to premium checkout session subscription

* test(billing): verify user ID is set in premium checkout session metadata

* test(billing): handle billing exception during stripe customer creation

* [PM-32218] Create Session Complete Handler (#7283)

* feat(billing): add checkout.session.completed webhook infrastructure

* feat(billing): introduce StripeAdapter for Checkout Session retrieval

* feat(billing): enable StripeEventService to retrieve Checkout Sessions

* feat(billing): implement CheckoutSessionCompletedHandler

* test(billing): add comprehensive tests for CheckoutSessionCompletedHandler and StripeEventService

* fix(billing): run dotnet format

* style: fix incorrect 'using' directive format

* fix(billing): standardize logging levels for critical checkout session states

* feat(billing): implement default payment method update on checkout session completion

* refactor(billing): preload subscription with checkout session

* refactor(billing): pass payment method ID to update method

* test(billing): update mocks for direct subscription access

* test(billing): update test names and expectations for payment method

* fix(billing): run dotnet format

* fix(billing): update order of operations

* feat(billing): Prevent re-upgrading for existing premium users

* refactor(billing): Augment UpdateDefaultPaymentMethodAsync with subscription ID

* feat(billing): Reset Stripe subscription default payment method
2026-03-27 13:53:49 -04:00
Derek Nance
e954ff5286 [PM-33499] Permissive base64 decoder (#7207) 2026-03-27 11:46:26 -05:00
Stephon Brown
c52ea40c28 fix(billing): ensure UserHasNoPreviousSubscriptionsFilter checks all subscription statuses (#7301) 2026-03-27 09:49:41 -04:00
Alex Morask
54c3e4a695 feat(billing): add IPriceIncreaseScheduler for deferred price migration scheduling (#7305) 2026-03-26 15:00:12 -05:00
Jimmy Vo
5d26a2040a [PM-33042] Refactor EventService to remove deprecated GetOrganizationAbilitiesAsync (#7240) 2026-03-26 15:32:25 -04:00
Jimmy Vo
f26e4627a3 [PM-33043] Fix the failing test. (#7316) 2026-03-26 18:40:26 +00:00
Jimmy Vo
deff00b881 [PM-33043] Refactor PolicyService, CipherService, and TwoFactorAuthenticationValidator (#7214) 2026-03-26 12:10:21 -04:00
Jared McCannon
c321080daf [PM-32067] - Add Provider Ability View (#7200)
* Added provider ability

* Correcting sproc

* fixed name
2026-03-26 08:59:21 -05:00
Rui Tomé
e09e63569c [PM-33086] Remove the feature flag RefactorOrgAcceptInit (#7287) 2026-03-26 12:36:07 +00:00
Ike
ffebc0d792 [PM- 30370] [PM-28827] Add Salt to Auth and KM DTOs (#7239)
feat: add `MasterPasswordSalt` to unlock and authentication flow

- Add optional `MasterPasswordSalt`:
    - `MasterPasswordUnlockAndAuthenticationData`
    - `RegisterFinishRequestModel`
    - `UserDecryptionOptionsBuilder`
- Add test coverage for explicit checks where appropriate in the above model updates
2026-03-25 16:02:33 -04:00
Patrick-Pimentel-Bitwarden
70daa856a1 feat(redirect): [PM-30810] Https Redirection for Cloud Users (#6852)
* feat(redirect): [PM-26578] Https Redirection for Cloud Users - Added deeplink scheme to duo redirect uri.
2026-03-24 21:05:33 +00:00
Derek Nance
5dcb8ca712 Allow SMTP TLS CRL status retrieval failures (#7271) 2026-03-23 15:20:33 -05:00
Alex Morask
c84ac1403e [PM-33980] Only verify UseMyItems when claim exists (#7278)
* fix(licensing): skip UseMyItems comparison for pre-2026.3.0 license files

* docs(licensing): add backward-compatibility guidance to ability flag README
2026-03-23 13:52:28 -05:00
Thomas Avery
005c74456c [PM-33435] Add new user key rotation endpoint with MP support (#7216)
* Add new user key rotation endpoint with MP support

* Increase test coverage

* Add note on request model
2026-03-20 11:06:27 -05:00
Thomas Avery
53907c2f14 [PM-33162] Refactor user key rotation (#7201)
* Refactor user key rotation to use base data composition

* Update tests
2026-03-20 10:31:25 -05:00
Alex Morask
212a0609c0 [PM-33415] [PM-33418] Fix add-on item proration and Families > Teams/Enterprise upgrade seat count (#7259)
* fix(billing): replace per-change IsStructural with changeset-level ChargeImmediately flag

* fix(billing): set seat quantity when upgrading from non-seat-based to seat-based plan
2026-03-20 09:29:45 -05:00
sven-bitwarden
081bbe66d0 [PM-30993] Better Error Message for Expired Invitation Tokens (#6971)
* Send better error message when token is expired

* Add comment indicating frontend usage

* Add testcase for Invalid Token scenario

* Update comment in test-case

* Fix merge issue

* Fix method name

* Consolidate token validation error calculation, apply to new area

* Move away from magic strings, fix tests

* Adjust class name

* Clean up old method name references

* Change errors to fields for singleton behavior

* Formatting
2026-03-20 08:35:39 -05:00
cyprain-okeke
fae3e95492 [PM-32480] Add endpoint for Stripe billing portal session (#7227)
* Implement the portal session url

* Remove comment

* formatting issues have been resolved

* Allow deep linking url

* remove thr return url request

* Resolve review comments around comments

* Fix the failing test after removing _globalSettings

* Fix the failing unit test
2026-03-20 09:31:43 +01:00