1473 Commits

Author SHA1 Message Date
Conner Turnbull
51455ecbf2 [PM-34866][PM-34865] Fix EnableAutomaticTaxAsync to update schedule phases (#7437)
* [PM-34866] Fix EnableAutomaticTaxAsync to update schedule phases

* Use test clock frozen time for phase filtering

* Expand test_clock on customer subscription fetches
2026-04-10 18:07:31 +00:00
Alex Morask
5e99098d08 fix(billing): skip ended schedule phases when updating storage (#7420)
(cherry picked from commit a5052d8d0f)
2026-04-08 13:32:05 -05:00
Patrick-Pimentel-Bitwarden
34b6ce926f fix(change-email): [PM-34742] Change Email Sets Salt (#7422) (#7423)
* fix(change-email): [PM-34742] Change Email Sets Salt (#7422) - Fixed email and salt being able to be separated. Added test to confirm rollback on stripe failure.

(cherry picked from commit 7c4fa752c7)
2026-04-08 14:02:11 -04:00
Alex Morask
7cba77a89f fix(billing): use top-level ProrationBehavior on schedule updates for immediate storage invoicing (#7410)
(cherry picked from commit aa1aa58190)
2026-04-08 08:09:30 -05:00
Alex Morask
26695db86d fix(billing): handle cross-product Phase 2 price overlay for Families 2019 (#7408)
(cherry picked from commit c04ee9c0a9)
2026-04-08 08:09:16 -05:00
Alex Morask
d092ce2d52 fix(billing): display Phase 2 prices and discount on org subscription page (#7393)
(cherry picked from commit e758ca2e27)
2026-04-08 08:08:51 -05:00
Alex Morask
c4f9ad79a9 fix(billing): prevent stale schedule discount after Stripe deletion (#7391) 2026-04-06 10:54:28 -05:00
Dave
93604aae8f fix(emergency-access): [PM-33788] EF Emergency Access Query Updates
* feat(emergency-access) [PM-33788] Update expired recoveries query.

* feat(emergency-access) [PM-33788] Update many to notify query.

* test(emergency-access) [PM-33788] Update integration tests for recovery time.
2026-04-05 14:43:13 -04:00
Conner Turnbull
6eb0c3c3ef Include schedule Phase 2 discount in premium tax estimate preview (#7385)
When a subscription has an active schedule during the ~15-day window before
renewal, the invoice preview for tax estimation was built with the new price
but without the Phase 2 discount coupon. This caused the estimated tax on the
subscription page to be higher than what Stripe would actually charge.

Pass the coupon ID from the schedule's Phase 2 discount through to
EstimatePremiumTaxAsync so it is included in the InvoiceCreatePreviewOptions.
2026-04-03 10:41:33 -04:00
Matt Gibson
5596ffce0d [pm-34486] require basic auth on seeder api endpoints (#7368)
* [pm-34486] require basic auth on seeder api endpoints

* Fixup tests with basic auth
2026-04-03 07:22:23 +02:00
Stephon Brown
6ab70c1d99 [PM-34570] Expired or Cancelled Claimed User Throws Billing Exception on Subscription Cancel (#7382)
* fix(billing): broaden exception handling for subscription cancellations

* test(billing): add BillingException handling tests for user account deletion

* test(billing): add BillingException handling tests for organization deletion

* refactor(test): remove unused ILogger using statement

* refactor(billing): add specific usings for billing exceptions

* fix(billing): specify exceptions for billing cancellation failures
2026-04-02 14:21:51 -04:00
John Harrington
44b818acc6 [PM-3836] Tools - Make Controllers, Services and API Models nullable (#7212)
* enable nullable on AzureSendFileStorageService

* LocalSendStorageService nullable

* revert primary constructor and begin updating some models

* SendRequestModel > nullable

* SendAccessResponseModel SendFileDownloadDataResponseModel SendFileUploadDataResponseModel > nullable

* SendResponseModel SendFileModel SendTextModel > nullable

* ImportCiphersController > nullable
2026-04-02 10:15:18 -07:00
Alex Morask
69672bf912 fix(billing): scope schedule discount to seats item instead of cart (#7378) 2026-04-02 14:32:22 +00:00
Stephon Brown
da34581991 [PM-33897] Schedule Aware Cancellation and Reinstatement (#7374)
* feat(pricing): add ResolvePhase2Async to price increase scheduler interface

* feat(pricing): implement ResolvePhase2Async and add unit tests

* feat(subscriber): adjust subscription cancellation for price migration schedules

* feat(reinstate): update subscription reinstatement for price migration schedules

* fix(billing) simplify cancellation data logic

* fix(billing): Cast StartDate to DateTime in price increase tests

* fix(billing): PR feedback

* refactor(test): rename subscription cancellation test

* fix(billing): properly apply cancellation metadata to subscription schedules
2026-04-02 10:04:41 -04:00
Thomas Rittson
0918bfdda6 Add checks and tests to provider controllers (#7372) 2026-04-02 09:05:19 +10:00
Alex Morask
1fac799e3d fix(billing): display schedule phase 2 discount on premium subscription page (#7375) 2026-04-01 14:53:45 -05:00
Conner Turnbull
aced3762fa [PM-31902] Remove m2 flagged logic (#7351)
* Remove pm-23341-milestone-2 flag from UpcomingInvoiceHandler.HandleForUserAsync

Always call AlignPremiumUsersSubscriptionConcernsAsync instead of gating
it behind the feature flag.

* Remove pm-23341-milestone-2 flag from AccountsController and SubscriptionResponseModel

Remove includeMilestone2Discount parameter from both SubscriptionResponseModel
constructors. Rename ShouldIncludeMilestone2Discount to ShouldIncludeDiscount
and always evaluate the discount (coupon ID match + active check).

* Update AccountsControllerTests after pm-23341-milestone-2 removal

Remove feature flag mock setup lines and delete test methods that
verified flag-disabled behavior. Rename tests to remove flag references.

* Update SubscriptionResponseModelTests after pm-23341-milestone-2 removal

Remove includeMilestone2Discount parameter from all constructor calls.
Delete tests that verified flag-disabled behavior.

* Update UpcomingInvoiceHandlerTests after pm-23341-milestone-2 removal

Remove all feature flag mock setup lines for PM23341_Milestone_2.

* Remove IFeatureService from AccountsController constructor and tests

The constructor parameter became unused after removing the flag check.

* Add default ListPremiumPlans mock for UpcomingInvoiceHandler tests

After removing the m2 flag guard, AlignPremiumUsersSubscriptionConcernsAsync
is always called and needs ListPremiumPlans to return a non-null value.
Add a default empty list in the test constructor setup.
2026-04-01 18:05:26 +00:00
John Harrington
7e02832672 [PM-31885] Consolidate all Send policies to a single policy (#7113)
* initial send controls

* update vNext methods and add test coverage for policy validators

* add comments to tests

* Apply suggestion from @mkincaid-bw

• `IX_Policy_OrganizationId_Type` is a unique index

Co-authored-by: mkincaid-bw <mkincaid@bitwarden.com>

* renamne migrations for correct sorting

* respond to csharp related review comments

* fix failing lints

* fix tests

* revise policy sync logic

* revise policy event logic and tests

* add integration tests

- fix SQL syntax error
- escape Sqlite format specifier
- update migration IDs to match sorted filename
- fix SQL syntax error

* OR legacy policy data with SendControls policy data

* remove migrations and associated integration test

* whitespacing and comment correction

* aggregate kegacy Send policies in PolicyQuery and adjust PoliciesController logic

* add comments to simplify post-migration cleanup

* consolidate legacy Send policy synthesis from PoliciesController into PolicyQuery.GetAllAsync

* respond to review comments and other minor fixes

---------

Co-authored-by: mkincaid-bw <mkincaid@bitwarden.com>
2026-04-01 08:03:46 -07:00
Brandon Treston
2465e3a4fe add repo call to check if existing collection already has access setup (#7365) 2026-04-01 10:03:08 -04:00
Brandon Treston
53d49e0faa add missing model.type param (#7369) 2026-04-01 09:47:37 -04:00
Rui Tomé
0a8d6d4268 [PM-32260] Fix missing device approval event logs for accepted users (#7247)
* Enhance IEventService to log user events for accepted status organizations. Updated LogUserEventAsync method to include a new parameter for including organizations where the user has accepted status. Added corresponding unit tests to verify functionality.

* Update AuthRequestService to include accepted status organizations in user event logging. Adjusted LogUserEventAsync method and corresponding unit tests to reflect the new parameter.

* Update NoopEventService to include a new parameter for accepted status organizations in LogUserEventAsync method.

* Update EventServiceTests to use Arg.Any for GetOrganizationAbilitiesAsync method
2026-04-01 14:34:26 +01:00
Nick Krantz
557eeaaa8f [PM-33405] Add OrganizationUserNotificationPolicy (#7250)
* add OrganizationUserNotification policy

* remove "policy" from policy name

* update policy text
2026-03-31 15:31:56 -05:00
sven-bitwarden
4cb60ac37d [PM-332124] Finalize PolicyRequirement + 2FA Feature Flag (#7209)
* Remove 2FA feature flag

* Remove unused using
2026-03-31 16:22:12 +00:00
sven-bitwarden
b38b31a0f3 Finalize org data ownership policy requirement (#7210) 2026-03-31 11:00:42 -05:00
Nick Krantz
b9f9071e4b [PM-32829] Cipher Key for unassigned ciphers (#7164)
* add cipher key on EF organization

* add reprompt and additional mapping
2026-03-31 09:45:32 -05:00
Stephon Brown
f1a43078f3 [PM-33891] Migrate Cancel and Reinstate Paths (#7331)
* refactor(billing): make OffboardingSurveyResponse optional in CancelSubscription

* refactor(billing): migrate UserService.CancelPremiumAsync behind PM32645 feature flag

* refactor(billing): migrate OrganizationDeleteCommand cancel behind PM32645 feature flag

* refactor(billing): migrate AccountsController reinstate-premium behind PM32645 feature flag

* refactor(billing): migrate OrganizationsController reinstate behind PM32645 feature flag

* feat(billing): Introduce CancelSubscription overload for system cancellations

* refactor(billing): Conditionally apply Stripe cancellation metadata

* chore(tests): Remove unused using directive in OrganizationDeleteCommandTests

* refactor(billing): simplify OneOf result handling

* chore(deps): remove unused OneOf.Types imports

* chore(deps): remove unused Bit.Core.Billing.Commands imports

* chore(deps): remove unused Bit.Core imports

* refactor(billing): unify ISubscriberService.CancelSubscription overloads

* refactor(billing): update SubscriberService.CancelSubscription implementation

* fix(api): adjust CancelSubscription calls in billing controllers

* fix(user): adjust UserService.CancelSubscription call

* test(billing): adjust SubscriberServiceTests for new CancelSubscription signature

* test(user): adjust UserServiceTests for new CancelSubscription signature

* refactor(billing): feature flag subscription cancel

* refactor: decouple premium cancellation logic from user service

* test: add tests for organization cancellation with feature flag

* test: add tests for handling gateway exceptions during cancellation

* fix(billing): run dotnet format
2026-03-31 14:29:27 +00:00
Alex Morask
11605dd551 feat(billing): make storage commands schedule-aware for price migration (#7350) 2026-03-31 08:32:03 -05:00
Jimmy Vo
5a0353b320 [PM-34440] Fix cache duplicate-key error (#7360) 2026-03-30 17:54:50 -04:00
Kyle Spearrin
30f9229b22 [PM-15489] 2fa account recovery (#7139)
* implementation plan

* feedback updates

* revert updates

* implementation plan

* feedback updates

* revert updates

* implement plan

* Revert "Merge branch '2fa-account-recovery' of github.com:bitwarden/server into 2fa-account-recovery"

This reverts commit 3be2d140f1, reversing
changes made to 9fb8d3891c.

* PR feedback

* revert claude  local settings

* lint fixes

* fix test models

* move new commands to v2 namespace.

* format

* fix swagger stuff

* update feature flag name
2026-03-30 10:48:43 -04:00
Mick Letofsky
6547361e31 PM-33964 - Unify CipherSeeder factories behind CipherSeed domain model. (#7330)
* Unify CipherSeeder factories behind CipherSeed domain model.
2026-03-28 08:08:59 +01:00
Conner Turnbull
c604379f04 [PM-33901] Implement schedule-aware tax handling (#7319)
Make tax-related subscription updates schedule-aware during the ~15-day
window between invoice.upcoming and renewal. When a subscription schedule
is present and the feature flag is enabled, update default_settings.automatic_tax
on the schedule instead of the subscription directly.

Modified paths:
- UpcomingInvoiceHandler: AlignOrganizationTaxConcernsAsync,
  AlignPremiumUsersTaxConcernsAsync, new shared EnableAutomaticTaxAsync helper
- UpdateBillingAddressCommand: EnableAutomaticTaxAsync, added IFeatureService
2026-03-27 14:27:36 -04:00
Conner Turnbull
7458eba830 [PM-33901] Remove unused UpdateTaxInformation (#7320)
UpdateTaxInformation has no callers in src/. Remove from ISubscriberService,
SubscriberService, and associated tests. Also removes the now-unused
ITaxService constructor parameter from SubscriberService.
2026-03-27 14:26:41 -04:00
Stephon Brown
3c2cc45215 [PM-32216] Create Stripe Checkout Session Endpoint (#7246)
* feat(stripe): add checkout session constants and settings

* feat(billing): integrate Stripe Checkout Session adapter

* feat(billing): define premium checkout session DTOs

* feat(billing): implement CreatePremiumCheckoutSessionCommand

* feat(billing): add premium checkout session API endpoint

* test(billing): add premium checkout session tests

* fix(billing): run dotnet format

* fix(billing): run dotnet format

* refactor(billing): clarify Stripe session types in IStripeAdapter

* refactor(billing): clarify Stripe session service and types in StripeAdapter

* refactor(StripeAdapter): remove duplicate billing portal session method

* style(premium): remove trailing comma from payment method types

* refactor(billing): retrieve client version from context

* refactor(premium): remove IUserService dependency from checkout command

* refactor(premium): consolidate stripe customer creation logic

* fix(billing) run dotnet format

* feat(billing): add user ID to premium checkout session subscription

* test(billing): verify user ID is set in premium checkout session metadata

* test(billing): handle billing exception during stripe customer creation

* [PM-32218] Create Session Complete Handler (#7283)

* feat(billing): add checkout.session.completed webhook infrastructure

* feat(billing): introduce StripeAdapter for Checkout Session retrieval

* feat(billing): enable StripeEventService to retrieve Checkout Sessions

* feat(billing): implement CheckoutSessionCompletedHandler

* test(billing): add comprehensive tests for CheckoutSessionCompletedHandler and StripeEventService

* fix(billing): run dotnet format

* style: fix incorrect 'using' directive format

* fix(billing): standardize logging levels for critical checkout session states

* feat(billing): implement default payment method update on checkout session completion

* refactor(billing): preload subscription with checkout session

* refactor(billing): pass payment method ID to update method

* test(billing): update mocks for direct subscription access

* test(billing): update test names and expectations for payment method

* fix(billing): run dotnet format

* fix(billing): update order of operations

* feat(billing): Prevent re-upgrading for existing premium users

* refactor(billing): Augment UpdateDefaultPaymentMethodAsync with subscription ID

* feat(billing): Reset Stripe subscription default payment method
2026-03-27 13:53:49 -04:00
Derek Nance
e954ff5286 [PM-33499] Permissive base64 decoder (#7207) 2026-03-27 11:46:26 -05:00
Justin Baur
550968bf41 Update to IHostBuilder style (#6843)
* Add some integration tests for the Server project

* Not sure why this project got removed?

* Format

* capture debug output

* Update tests to work with the now legacy WebHostBuilder

- I accidentally had the updated Program locally and that was why tests were working for me locally

* Formatting...again

* Update to `IHostBuilder` style

* Formatting
2026-03-27 11:09:05 -04:00
Stephon Brown
c52ea40c28 fix(billing): ensure UserHasNoPreviousSubscriptionsFilter checks all subscription statuses (#7301) 2026-03-27 09:49:41 -04:00
Mick Letofsky
5833e34cf6 PM-34033 - Add individual user seeding to preset pipeline (#7304) 2026-03-27 08:14:46 +01:00
Alex Morask
54c3e4a695 feat(billing): add IPriceIncreaseScheduler for deferred price migration scheduling (#7305) 2026-03-26 15:00:12 -05:00
Jimmy Vo
5d26a2040a [PM-33042] Refactor EventService to remove deprecated GetOrganizationAbilitiesAsync (#7240) 2026-03-26 15:32:25 -04:00
Jimmy Vo
f26e4627a3 [PM-33043] Fix the failing test. (#7316) 2026-03-26 18:40:26 +00:00
Jimmy Vo
deff00b881 [PM-33043] Refactor PolicyService, CipherService, and TwoFactorAuthenticationValidator (#7214) 2026-03-26 12:10:21 -04:00
Jimmy Vo
34aba63b90 [PM-33041] Organization Ability: Refactor CipherResponseModel (#7202) 2026-03-26 11:35:41 -04:00
Ike
db1fff211e [PM-21926] Add salt to Admin Console DTOs (#7231)
feat: add MasterPasswordSalt to Admin Console DTOs

  - Add MasterPasswordSalt property to Admin Console DTOs
  - Set salt via GetMasterPasswordSalt method
  - Add unit tests for affected repositories
2026-03-26 10:45:34 -04:00
Jared McCannon
c321080daf [PM-32067] - Add Provider Ability View (#7200)
* Added provider ability

* Correcting sproc

* fixed name
2026-03-26 08:59:21 -05:00
Rui Tomé
e09e63569c [PM-33086] Remove the feature flag RefactorOrgAcceptInit (#7287) 2026-03-26 12:36:07 +00:00
Ike
ffebc0d792 [PM- 30370] [PM-28827] Add Salt to Auth and KM DTOs (#7239)
feat: add `MasterPasswordSalt` to unlock and authentication flow

- Add optional `MasterPasswordSalt`:
    - `MasterPasswordUnlockAndAuthenticationData`
    - `RegisterFinishRequestModel`
    - `UserDecryptionOptionsBuilder`
- Add test coverage for explicit checks where appropriate in the above model updates
2026-03-25 16:02:33 -04:00
Conner Turnbull
89f6e432b5 [PM-33896] Update Families organization on schedule transition (#7300) 2026-03-25 15:53:07 +00:00
Thomas Rittson
cafe4ffce8 [PM-34049] Fix PoliciesController authorize attribute (#7303)
GetMasterPasswordPolicy incorrectly used the MemberRequirement
authz requirement. However, this endpoint needs to support users
who are in the invited state, and that only authorizes users who are
confirmed. Recreate previous logic inside a new attribute.
2026-03-25 19:27:38 +10:00
Matt Gibson
869ba57a2a [PM-34082] Seed passkeys (#7265)
* Seed passkeys

Generates passkey data from minimal inputs or relying party and username

* Allow totp specifying to user login cipher scene

* Fixup test

* Use default values in seed DTOs where possible

* Limit classes to one per file
2026-03-25 07:48:09 +01:00
Alex Morask
15e71aa93d [PM-33894] Schedule price increases (#7293) 2026-03-24 17:22:50 -05:00