Merge branch 'main' into dirt/pm-23826/crowdstrike-integration-dialog

2026-02-06 11:43:51 +00:00 · 2025-07-24 09:41:15 -05:00
parent b25a039eda df8e0ed094
commit 2755fda417
76 changed files with 1111 additions and 1179 deletions
--- a/.github/workflows/chromatic.yml
+++ b/.github/workflows/chromatic.yml
@@ -102,6 +102,9 @@ jobs:
          storybookBuildDir: ./storybook-static
          exitOnceUploaded: true
          onlyChanged: true
-          externals: "[\"libs/components/**/*.scss\", \"libs/components/**/*.css\", \"libs/components/tailwind.config*.js\"]"
+          externals: |
+            libs/components/**/*.scss
+            libs/components/**/*.css
+            libs/components/tailwind.config*.js
          # Rather than use an `if` check on the whole publish step, we need to tell Chromatic to skip so that any Chromatic-spawned actions are properly skipped
          skip: ${{ steps.get-changed-files-for-chromatic.outputs.storyFiles == 'false' }}
--- a/apps/browser/src/auth/popup/change-password/extension-change-password.service.spec.ts
+++ b/apps/browser/src/auth/popup/change-password/extension-change-password.service.spec.ts
@@ -0,0 +1,50 @@
+import { MockProxy, mock } from "jest-mock-extended";
+
+import { ChangePasswordService } from "@bitwarden/angular/auth/password-management/change-password";
+import { MasterPasswordApiService } from "@bitwarden/common/auth/abstractions/master-password-api.service.abstraction";
+import { InternalMasterPasswordServiceAbstraction } from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
+import { KeyService } from "@bitwarden/key-management";
+
+import { BrowserApi } from "../../../platform/browser/browser-api";
+import BrowserPopupUtils from "../../../platform/browser/browser-popup-utils";
+
+import { ExtensionChangePasswordService } from "./extension-change-password.service";
+
+describe("ExtensionChangePasswordService", () => {
+  let keyService: MockProxy<KeyService>;
+  let masterPasswordApiService: MockProxy<MasterPasswordApiService>;
+  let masterPasswordService: MockProxy<InternalMasterPasswordServiceAbstraction>;
+  let window: MockProxy<Window>;
+
+  let changePasswordService: ChangePasswordService;
+
+  beforeEach(() => {
+    keyService = mock<KeyService>();
+    masterPasswordApiService = mock<MasterPasswordApiService>();
+    masterPasswordService = mock<InternalMasterPasswordServiceAbstraction>();
+    window = mock<Window>();
+
+    changePasswordService = new ExtensionChangePasswordService(
+      keyService,
+      masterPasswordApiService,
+      masterPasswordService,
+      window,
+    );
+  });
+
+  it("should instantiate the service", () => {
+    expect(changePasswordService).toBeDefined();
+  });
+
+  it("should close the browser extension popout", () => {
+    const closePopupSpy = jest.spyOn(BrowserApi, "closePopup");
+    const browserPopupUtilsInPopupSpy = jest
+      .spyOn(BrowserPopupUtils, "inPopout")
+      .mockReturnValue(true);
+
+    changePasswordService.closeBrowserExtensionPopout?.();
+
+    expect(closePopupSpy).toHaveBeenCalledWith(window);
+    expect(browserPopupUtilsInPopupSpy).toHaveBeenCalledWith(window);
+  });
+});
--- a/apps/browser/src/auth/popup/change-password/extension-change-password.service.ts
+++ b/apps/browser/src/auth/popup/change-password/extension-change-password.service.ts
@@ -0,0 +1,29 @@
+import {
+  DefaultChangePasswordService,
+  ChangePasswordService,
+} from "@bitwarden/angular/auth/password-management/change-password";
+import { MasterPasswordApiService } from "@bitwarden/common/auth/abstractions/master-password-api.service.abstraction";
+import { InternalMasterPasswordServiceAbstraction } from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
+import { KeyService } from "@bitwarden/key-management";
+
+import { BrowserApi } from "../../../platform/browser/browser-api";
+import BrowserPopupUtils from "../../../platform/browser/browser-popup-utils";
+
+export class ExtensionChangePasswordService
+  extends DefaultChangePasswordService
+  implements ChangePasswordService
+{
+  constructor(
+    protected keyService: KeyService,
+    protected masterPasswordApiService: MasterPasswordApiService,
+    protected masterPasswordService: InternalMasterPasswordServiceAbstraction,
+    private win: Window,
+  ) {
+    super(keyService, masterPasswordApiService, masterPasswordService);
+  }
+  closeBrowserExtensionPopout(): void {
+    if (BrowserPopupUtils.inPopout(this.win)) {
+      BrowserApi.closePopup(this.win);
+    }
+  }
+}
--- a/apps/browser/src/autofill/background/notification.background.ts
+++ b/apps/browser/src/autofill/background/notification.background.ts
@@ -1030,18 +1030,23 @@ export default class NotificationBackground {
  private async getCollectionData(
    message: NotificationBackgroundExtensionMessage,
  ): Promise<CollectionView[]> {
-    const collections = (await this.collectionService.getAllDecrypted()).reduce<CollectionView[]>(
-      (acc, collection) => {
-        if (collection.organizationId === message?.orgId) {
-          acc.push({
-            id: collection.id,
-            name: collection.name,
-            organizationId: collection.organizationId,
-          });
-        }
-        return acc;
-      },
-      [],
+    const collections = await firstValueFrom(
+      this.accountService.activeAccount$.pipe(
+        getUserId,
+        switchMap((userId) => this.collectionService.decryptedCollections$(userId)),
+        map((collections) =>
+          collections.reduce<CollectionView[]>((acc, collection) => {
+            if (collection.organizationId === message?.orgId) {
+              acc.push({
+                id: collection.id,
+                name: collection.name,
+                organizationId: collection.organizationId,
+              });
+            }
+            return acc;
+          }, []),
+        ),
+      ),
    );
    return collections;
  }
--- a/apps/browser/src/background/main.background.ts
+++ b/apps/browser/src/background/main.background.ts
@@ -1070,6 +1070,7 @@ export default class MainBackground {
      this.pinService,
      this.accountService,
      this.sdkService,
+      this.restrictedItemTypesService,
    );

    this.individualVaultExportService = new IndividualVaultExportService(
@@ -1619,7 +1620,6 @@ export default class MainBackground {
      this.keyService.clearKeys(userBeingLoggedOut),
      this.cipherService.clear(userBeingLoggedOut),
      this.folderService.clear(userBeingLoggedOut),
-      this.collectionService.clear(userBeingLoggedOut),
      this.vaultTimeoutSettingsService.clear(userBeingLoggedOut),
      this.vaultFilterService.clear(),
      this.biometricStateService.logout(userBeingLoggedOut),
--- a/apps/browser/src/popup/services/services.module.ts
+++ b/apps/browser/src/popup/services/services.module.ts
@@ -5,6 +5,7 @@ import { merge, of, Subject } from "rxjs";

 import { CollectionService } from "@bitwarden/admin-console/common";
 import { DeviceManagementComponentServiceAbstraction } from "@bitwarden/angular/auth/device-management/device-management-component.service.abstraction";
+import { ChangePasswordService } from "@bitwarden/angular/auth/password-management/change-password";
 import { AngularThemingService } from "@bitwarden/angular/platform/services/theming/angular-theming.service";
 import { SafeProvider, safeProvider } from "@bitwarden/angular/platform/utils/safe-provider";
 import { ViewCacheService } from "@bitwarden/angular/platform/view-cache";
@@ -45,6 +46,7 @@ import {
  AccountService as AccountServiceAbstraction,
 } from "@bitwarden/common/auth/abstractions/account.service";
 import { AuthService } from "@bitwarden/common/auth/abstractions/auth.service";
+import { MasterPasswordApiService } from "@bitwarden/common/auth/abstractions/master-password-api.service.abstraction";
 import { SsoLoginServiceAbstraction } from "@bitwarden/common/auth/abstractions/sso-login.service.abstraction";
 import { UserVerificationService } from "@bitwarden/common/auth/abstractions/user-verification/user-verification.service.abstraction";
 import {
@@ -143,6 +145,7 @@ import {

 import { AccountSwitcherService } from "../../auth/popup/account-switching/services/account-switcher.service";
 import { ForegroundLockService } from "../../auth/popup/accounts/foreground-lock.service";
+import { ExtensionChangePasswordService } from "../../auth/popup/change-password/extension-change-password.service";
 import { ExtensionLoginComponentService } from "../../auth/popup/login/extension-login-component.service";
 import { ExtensionSsoComponentService } from "../../auth/popup/login/extension-sso-component.service";
 import { ExtensionLogoutService } from "../../auth/popup/logout/extension-logout.service";
@@ -664,6 +667,11 @@ const safeProviders: SafeProvider[] = [
    useClass: DefaultSshImportPromptService,
    deps: [DialogService, ToastService, PlatformUtilsService, I18nServiceAbstraction],
  }),
+  safeProvider({
+    provide: ChangePasswordService,
+    useClass: ExtensionChangePasswordService,
+    deps: [KeyService, MasterPasswordApiService, InternalMasterPasswordServiceAbstraction, WINDOW],
+  }),
  safeProvider({
    provide: NotificationsService,
    useClass: ForegroundNotificationsService,
--- a/apps/browser/src/tools/popup/settings/settings-v2.component.html
+++ b/apps/browser/src/tools/popup/settings/settings-v2.component.html
@@ -10,16 +10,7 @@
    <bit-item>
      <a bit-item-content routerLink="/account-security">
        <i slot="start" class="bwi bwi-lock" aria-hidden="true"></i>
-        <div class="tw-flex tw-items-center tw-justify-center">
-          <p class="tw-pr-2">{{ "accountSecurity" | i18n }}</p>
-          <span
-            *ngIf="showAcctSecurityNudge$ | async"
-            bitBadge
-            variant="notification"
-            [attr.aria-label]="'nudgeBadgeAria' | i18n"
-            >1</span
-          >
-        </div>
+        {{ "accountSecurity" | i18n }}
        <i slot="end" class="bwi bwi-angle-right" aria-hidden="true"></i>
      </a>
    </bit-item>
--- a/apps/browser/src/tools/popup/settings/settings-v2.component.ts
+++ b/apps/browser/src/tools/popup/settings/settings-v2.component.ts
@@ -50,12 +50,6 @@ export class SettingsV2Component implements OnInit {
    shareReplay({ bufferSize: 1, refCount: true }),
  );

-  protected showAcctSecurityNudge$: Observable<boolean> = this.authenticatedAccount$.pipe(
-    switchMap((account) =>
-      this.nudgesService.showNudgeBadge$(NudgeType.AccountSecurity, account.id),
-    ),
-  );
-
  showDownloadBitwardenNudge$: Observable<boolean> = this.authenticatedAccount$.pipe(
    switchMap((account) =>
      this.nudgesService.showNudgeBadge$(NudgeType.DownloadBitwarden, account.id),
--- a/apps/browser/src/vault/popup/components/vault-v2/assign-collections/assign-collections.component.ts
+++ b/apps/browser/src/vault/popup/components/vault-v2/assign-collections/assign-collections.component.ts
@@ -10,6 +10,7 @@ import { Observable, combineLatest, filter, first, map, switchMap } from "rxjs";
 import { CollectionService } from "@bitwarden/admin-console/common";
 import { JslibModule } from "@bitwarden/angular/jslib.module";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { getUserId } from "@bitwarden/common/auth/services/account.service";
 import { OrganizationId } from "@bitwarden/common/types/guid";
 import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
 import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view";
@@ -70,7 +71,12 @@ export class AssignCollections {
      ),
    );

-    combineLatest([cipher$, this.collectionService.decryptedCollections$])
+    const decryptedCollection$ = this.accountService.activeAccount$.pipe(
+      getUserId,
+      switchMap((userId) => this.collectionService.decryptedCollections$(userId)),
+    );
+
+    combineLatest([cipher$, decryptedCollection$])
      .pipe(takeUntilDestroyed(), first())
      .subscribe(([cipherView, collections]) => {
        let availableCollections = collections;
--- a/apps/browser/src/vault/popup/components/vault-v2/item-more-options/item-more-options.component.ts
+++ b/apps/browser/src/vault/popup/components/vault-v2/item-more-options/item-more-options.component.ts
@@ -93,7 +93,7 @@ export class ItemMoreOptionsComponent {
    switchMap((userId) => {
      return combineLatest([
        this.organizationService.hasOrganizations(userId),
-        this.collectionService.decryptedCollections$,
+        this.collectionService.decryptedCollections$(userId),
      ]).pipe(
        map(([hasOrgs, collections]) => {
          const canEditCollections = collections.some((c) => !c.readOnly);
--- a/apps/browser/src/vault/popup/services/vault-popup-items.service.spec.ts
+++ b/apps/browser/src/vault/popup/services/vault-popup-items.service.spec.ts
@@ -139,7 +139,7 @@ describe("VaultPopupItemsService", () => {
    ];

    organizationServiceMock.organizations$.mockReturnValue(new BehaviorSubject([mockOrg]));
-    collectionService.decryptedCollections$ = new BehaviorSubject(mockCollections);
+    collectionService.decryptedCollections$.mockReturnValue(new BehaviorSubject(mockCollections));

    activeUserLastSync$ = new BehaviorSubject(new Date());
    syncServiceMock.activeUserLastSync$.mockReturnValue(activeUserLastSync$);
--- a/apps/browser/src/vault/popup/services/vault-popup-items.service.ts
+++ b/apps/browser/src/vault/popup/services/vault-popup-items.service.ts
@@ -72,6 +72,11 @@ export class VaultPopupItemsService {
  private organizations$ = this.activeUserId$.pipe(
    switchMap((userId) => this.organizationService.organizations$(userId)),
  );
+
+  private decryptedCollections$ = this.activeUserId$.pipe(
+    switchMap((userId) => this.collectionService.decryptedCollections$(userId)),
+  );
+
  /**
   * Observable that contains the list of other cipher types that should be shown
   * in the autofill section of the Vault tab. Depends on vault settings.
@@ -130,7 +135,7 @@ export class VaultPopupItemsService {

  private _activeCipherList$: Observable<PopupCipherViewLike[]> = this._allDecryptedCiphers$.pipe(
    switchMap((ciphers) =>
-      combineLatest([this.organizations$, this.collectionService.decryptedCollections$]).pipe(
+      combineLatest([this.organizations$, this.decryptedCollections$]).pipe(
        map(([organizations, collections]) => {
          const orgMap = Object.fromEntries(organizations.map((org) => [org.id, org]));
          const collectionMap = Object.fromEntries(collections.map((col) => [col.id, col]));
@@ -291,7 +296,7 @@ export class VaultPopupItemsService {
   */
  deletedCiphers$: Observable<PopupCipherViewLike[]> = this._allDecryptedCiphers$.pipe(
    switchMap((ciphers) =>
-      combineLatest([this.organizations$, this.collectionService.decryptedCollections$]).pipe(
+      combineLatest([this.organizations$, this.decryptedCollections$]).pipe(
        map(([organizations, collections]) => {
          const orgMap = Object.fromEntries(organizations.map((org) => [org.id, org]));
          const collectionMap = Object.fromEntries(collections.map((col) => [col.id, col]));
--- a/apps/browser/src/vault/popup/services/vault-popup-list-filters.service.spec.ts
+++ b/apps/browser/src/vault/popup/services/vault-popup-list-filters.service.spec.ts
@@ -20,6 +20,7 @@ import { UserId } from "@bitwarden/common/types/guid";
 import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
 import { FolderService } from "@bitwarden/common/vault/abstractions/folder/folder.service.abstraction";
 import { CipherType } from "@bitwarden/common/vault/enums";
+import { TreeNode } from "@bitwarden/common/vault/models/domain/tree-node";
 import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view";
 import { FolderView } from "@bitwarden/common/vault/models/view/folder.view";
 import {
@@ -58,7 +59,7 @@ describe("VaultPopupListFiltersService", () => {
  };

  const collectionService = {
-    decryptedCollections$,
+    decryptedCollections$: () => decryptedCollections$,
    getAllNested: () => Promise.resolve([]),
  } as unknown as CollectionService;

@@ -106,7 +107,7 @@ describe("VaultPopupListFiltersService", () => {
      signal: jest.fn(() => mockCachedSignal),
    };

-    collectionService.getAllNested = () => Promise.resolve([]);
+    collectionService.getAllNested = () => [];
    TestBed.configureTestingModule({
      providers: [
        {
@@ -382,14 +383,7 @@ describe("VaultPopupListFiltersService", () => {
    beforeEach(() => {
      decryptedCollections$.next(testCollections);

-      collectionService.getAllNested = () =>
-        Promise.resolve(
-          testCollections.map((c) => ({
-            children: [],
-            node: c,
-            parent: null,
-          })),
-        );
+      collectionService.getAllNested = () => testCollections.map((c) => new TreeNode(c, null));
    });

    it("returns all collections", (done) => {
@@ -755,15 +749,13 @@ function createSeededVaultPopupListFiltersService(
  } as any;

  const collectionServiceMock = {
-    decryptedCollections$: seededCollections$,
+    decryptedCollections$: () => seededCollections$,
    getAllNested: () =>
-      Promise.resolve(
-        seededCollections$.value.map((c) => ({
-          children: [],
-          node: c,
-          parent: null,
-        })),
-      ),
+      seededCollections$.value.map((c) => ({
+        children: [],
+        node: c,
+        parent: null,
+      })),
  } as any;

  const folderServiceMock = {
--- a/apps/browser/src/vault/popup/services/vault-popup-list-filters.service.ts
+++ b/apps/browser/src/vault/popup/services/vault-popup-list-filters.service.ts
@@ -6,7 +6,6 @@ import {
  debounceTime,
  distinctUntilChanged,
  filter,
-  from,
  map,
  Observable,
  shareReplay,
@@ -446,7 +445,7 @@ export class VaultPopupListFiltersService {
          this.filters$.pipe(
            distinctUntilChanged((prev, curr) => prev.organization?.id === curr.organization?.id),
          ),
-          this.collectionService.decryptedCollections$,
+          this.collectionService.decryptedCollections$(userId),
          this.organizationService.memberOrganizations$(userId),
          this.configService.getFeatureFlag$(FeatureFlag.CreateDefaultLocation),
        ]),
@@ -463,16 +462,11 @@ export class VaultPopupListFiltersService {
        }
        return sortDefaultCollections(filtered, orgs, this.i18nService.collator);
      }),
-      switchMap((collections) => {
-        return from(this.collectionService.getAllNested(collections)).pipe(
-          map(
-            (nested) =>
-              new DynamicTreeNode<CollectionView>({
-                fullList: collections,
-                nestedList: nested,
-              }),
-          ),
-        );
+      map((fullList) => {
+        return new DynamicTreeNode<CollectionView>({
+          fullList,
+          nestedList: this.collectionService.getAllNested(fullList),
+        });
      }),
      map((tree) =>
        tree.nestedList.map((c) => this.convertToChipSelectOption(c, "bwi-collection-shared")),
--- a/apps/cli/src/commands/get.command.ts
+++ b/apps/cli/src/commands/get.command.ts
@@ -24,6 +24,7 @@ import { LoginUriExport } from "@bitwarden/common/models/export/login-uri.export
 import { LoginExport } from "@bitwarden/common/models/export/login.export";
 import { SecureNoteExport } from "@bitwarden/common/models/export/secure-note.export";
 import { ErrorResponse } from "@bitwarden/common/models/response/error.response";
+import { getById } from "@bitwarden/common/platform/misc";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { CipherId, OrganizationId, UserId } from "@bitwarden/common/types/guid";
 import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
@@ -442,8 +443,11 @@ export class GetCommand extends DownloadCommand {

  private async getCollection(id: string) {
    let decCollection: CollectionView = null;
+    const activeUserId = await firstValueFrom(this.accountService.activeAccount$.pipe(getUserId));
    if (Utils.isGuid(id)) {
-      const collection = await this.collectionService.get(id);
+      const collection = await firstValueFrom(
+        this.collectionService.encryptedCollections$(activeUserId).pipe(getById(id)),
+      );
      if (collection != null) {
        const orgKeys = await firstValueFrom(this.keyService.activeUserOrgKeys$);
        decCollection = await collection.decrypt(
@@ -451,7 +455,9 @@ export class GetCommand extends DownloadCommand {
        );
      }
    } else if (id.trim() !== "") {
-      let collections = await this.collectionService.getAllDecrypted();
+      let collections = await firstValueFrom(
+        this.collectionService.decryptedCollections$(activeUserId),
+      );
      collections = CliUtils.searchCollections(collections, id);
      if (collections.length > 1) {
        return Response.multipleResults(collections.map((c) => c.id));
--- a/apps/cli/src/commands/list.command.ts
+++ b/apps/cli/src/commands/list.command.ts
@@ -20,6 +20,7 @@ import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.servi
 import { FolderService } from "@bitwarden/common/vault/abstractions/folder/folder.service.abstraction";
 import { SearchService } from "@bitwarden/common/vault/abstractions/search.service";
 import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view";
+import { KeyService } from "@bitwarden/key-management";

 import { CollectionResponse } from "../admin-console/models/response/collection.response";
 import { OrganizationUserResponse } from "../admin-console/models/response/organization-user.response";
@@ -42,6 +43,7 @@ export class ListCommand {
    private apiService: ApiService,
    private eventCollectionService: EventCollectionService,
    private accountService: AccountService,
+    private keyService: KeyService,
    private cliRestrictedItemTypesService: CliRestrictedItemTypesService,
  ) {}

@@ -158,7 +160,10 @@ export class ListCommand {
  }

  private async listCollections(options: Options) {
-    let collections = await this.collectionService.getAllDecrypted();
+    const activeUserId = await firstValueFrom(this.accountService.activeAccount$.pipe(getUserId));
+    let collections = await firstValueFrom(
+      this.collectionService.decryptedCollections$(activeUserId),
+    );

    if (options.organizationId != null) {
      collections = collections.filter((c) => {
@@ -178,13 +183,13 @@ export class ListCommand {
  }

  private async listOrganizationCollections(options: Options) {
+    const userId = await firstValueFrom(getUserId(this.accountService.activeAccount$));
    if (options.organizationId == null || options.organizationId === "") {
      return Response.badRequest("`organizationid` option is required.");
    }
    if (!Utils.isGuid(options.organizationId)) {
      return Response.badRequest("`" + options.organizationId + "` is not a GUID.");
    }
-    const userId = await firstValueFrom(getUserId(this.accountService.activeAccount$));
    if (!userId) {
      return Response.badRequest("No user found.");
    }
@@ -207,7 +212,13 @@ export class ListCommand {
      const collections = response.data
        .filter((c) => c.organizationId === options.organizationId)
        .map((r) => new Collection(new CollectionData(r as ApiCollectionDetailsResponse)));
-      let decCollections = await this.collectionService.decryptMany(collections);
+      const orgKeys = await firstValueFrom(this.keyService.orgKeys$(userId));
+      if (orgKeys == null) {
+        throw new Error("Organization keys not found.");
+      }
+      let decCollections = await firstValueFrom(
+        this.collectionService.decryptMany$(collections, orgKeys),
+      );
      if (options.search != null && options.search.trim() !== "") {
        decCollections = CliUtils.searchCollections(decCollections, options.search);
      }
--- a/apps/cli/src/oss-serve-configurator.ts
+++ b/apps/cli/src/oss-serve-configurator.ts
@@ -79,6 +79,7 @@ export class OssServeConfigurator {
      this.serviceContainer.apiService,
      this.serviceContainer.eventCollectionService,
      this.serviceContainer.accountService,
+      this.serviceContainer.keyService,
      this.serviceContainer.cliRestrictedItemTypesService,
    );
    this.createCommand = new CreateCommand(
--- a/apps/cli/src/service-container/service-container.ts
+++ b/apps/cli/src/service-container/service-container.ts
@@ -821,6 +821,7 @@ export class ServiceContainer {
      this.pinService,
      this.accountService,
      this.sdkService,
+      this.restrictedItemTypesService,
    );

    this.individualExportService = new IndividualVaultExportService(
@@ -900,7 +901,6 @@ export class ServiceContainer {
      this.keyService.clearKeys(userId),
      this.cipherService.clear(userId),
      this.folderService.clear(userId),
-      this.collectionService.clear(userId),
    ]);

    await this.stateEventRunnerService.handleEvent("logout", userId as UserId);
--- a/apps/cli/src/vault.program.ts
+++ b/apps/cli/src/vault.program.ts
@@ -114,6 +114,7 @@ export class VaultProgram extends BaseProgram {
          this.serviceContainer.apiService,
          this.serviceContainer.eventCollectionService,
          this.serviceContainer.accountService,
+          this.serviceContainer.keyService,
          this.serviceContainer.cliRestrictedItemTypesService,
        );
        const response = await command.run(object, cmd);
--- a/apps/desktop/src/app/app.component.ts
+++ b/apps/desktop/src/app/app.component.ts
@@ -68,6 +68,7 @@ import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.servi
 import { InternalFolderService } from "@bitwarden/common/vault/abstractions/folder/folder.service.abstraction";
 import { SearchService } from "@bitwarden/common/vault/abstractions/search.service";
 import { CipherType } from "@bitwarden/common/vault/enums";
+import { RestrictedItemTypesService } from "@bitwarden/common/vault/services/restricted-item-types.service";
 import { DialogRef, DialogService, ToastOptions, ToastService } from "@bitwarden/components";
 import { CredentialGeneratorHistoryDialogComponent } from "@bitwarden/generator-components";
 import { KeyService, BiometricStateService } from "@bitwarden/key-management";
@@ -172,6 +173,7 @@ export class AppComponent implements OnInit, OnDestroy {
    private userDecryptionOptionsService: UserDecryptionOptionsServiceAbstraction,
    private readonly destroyRef: DestroyRef,
    private readonly documentLangSetter: DocumentLangSetter,
+    private restrictedItemTypesService: RestrictedItemTypesService,
  ) {
    this.deviceTrustToastService.setupListeners$.pipe(takeUntilDestroyed()).subscribe();

@@ -523,10 +525,12 @@ export class AppComponent implements OnInit, OnDestroy {
  private async updateAppMenu() {
    let updateRequest: MenuUpdateRequest;
    const stateAccounts = await firstValueFrom(this.accountService.accounts$);
+
    if (stateAccounts == null || Object.keys(stateAccounts).length < 1) {
      updateRequest = {
        accounts: null,
        activeUserId: null,
+        restrictedCipherTypes: null,
      };
    } else {
      const accounts: { [userId: string]: MenuAccount } = {};
@@ -557,6 +561,9 @@ export class AppComponent implements OnInit, OnDestroy {
        activeUserId: await firstValueFrom(
          this.accountService.activeAccount$.pipe(map((a) => a?.id)),
        ),
+        restrictedCipherTypes: (
+          await firstValueFrom(this.restrictedItemTypesService.restricted$)
+        ).map((restrictedItems) => restrictedItems.cipherType),
      };
    }

@@ -670,7 +677,6 @@ export class AppComponent implements OnInit, OnDestroy {
      await this.keyService.clearKeys(userBeingLoggedOut);
      await this.cipherService.clear(userBeingLoggedOut);
      await this.folderService.clear(userBeingLoggedOut);
-      await this.collectionService.clear(userBeingLoggedOut);
      await this.vaultTimeoutSettingsService.clear(userBeingLoggedOut);
      await this.biometricStateService.logout(userBeingLoggedOut);

--- a/apps/desktop/src/main/menu/menu.file.ts
+++ b/apps/desktop/src/main/menu/menu.file.ts
@@ -2,6 +2,7 @@ import { BrowserWindow, MenuItemConstructorOptions } from "electron";

 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
+import { CipherType } from "@bitwarden/sdk-internal";

 import { isMac, isMacAppStore } from "../../utils";
 import { UpdaterMain } from "../updater.main";
@@ -54,6 +55,7 @@ export class FileMenu extends FirstMenu implements IMenubarMenu {
    accounts: { [userId: string]: MenuAccount },
    isLocked: boolean,
    isLockable: boolean,
+    private restrictedCipherTypes: CipherType[],
  ) {
    super(i18nService, messagingService, updater, window, accounts, isLocked, isLockable);
  }
@@ -77,6 +79,23 @@ export class FileMenu extends FirstMenu implements IMenubarMenu {
    };
  }

+  private mapMenuItemToCipherType(itemId: string): CipherType {
+    switch (itemId) {
+      case "typeLogin":
+        return CipherType.Login;
+      case "typeCard":
+        return CipherType.Card;
+      case "typeIdentity":
+        return CipherType.Identity;
+      case "typeSecureNote":
+        return CipherType.SecureNote;
+      case "typeSshKey":
+        return CipherType.SshKey;
+      default:
+        throw new Error(`Unknown menu item id: ${itemId}`);
+    }
+  }
+
  private get addNewItemSubmenu(): MenuItemConstructorOptions[] {
    return [
      {
@@ -109,7 +128,11 @@ export class FileMenu extends FirstMenu implements IMenubarMenu {
        click: () => this.sendMessage("newSshKey"),
        accelerator: "CmdOrCtrl+Shift+K",
      },
-    ];
+    ].filter((item) => {
+      return !this.restrictedCipherTypes?.some(
+        (restrictedType) => restrictedType === this.mapMenuItemToCipherType(item.id),
+      );
+    });
  }

  private get addNewFolder(): MenuItemConstructorOptions {
--- a/apps/desktop/src/main/menu/menu.updater.ts
+++ b/apps/desktop/src/main/menu/menu.updater.ts
@@ -1,8 +1,10 @@
 // FIXME: Update this file to be type safe and remove this and next line
 // @ts-strict-ignore
+import { CipherType } from "@bitwarden/common/vault/enums";
 export class MenuUpdateRequest {
-  activeUserId: string;
-  accounts: { [userId: string]: MenuAccount };
+  activeUserId: string | null;
+  accounts: { [userId: string]: MenuAccount } | null;
+  restrictedCipherTypes: CipherType[] | null;
 }

 export class MenuAccount {
--- a/apps/desktop/src/main/menu/menubar.ts
+++ b/apps/desktop/src/main/menu/menubar.ts
@@ -83,6 +83,7 @@ export class Menubar {
        updateRequest?.accounts,
        isLocked,
        isLockable,
+        updateRequest?.restrictedCipherTypes,
      ),
      new EditMenu(i18nService, messagingService, isLocked),
      new ViewMenu(i18nService, messagingService, isLocked),
--- a/apps/desktop/src/vault/app/vault/vault-v2.component.ts
+++ b/apps/desktop/src/vault/app/vault/vault-v2.component.ts
@@ -30,8 +30,9 @@ import { ConfigService } from "@bitwarden/common/platform/abstractions/config/co
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
 import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
+import { getByIds } from "@bitwarden/common/platform/misc";
 import { SyncService } from "@bitwarden/common/platform/sync";
-import { CipherId, CollectionId, OrganizationId, UserId } from "@bitwarden/common/types/guid";
+import { CipherId, OrganizationId, UserId } from "@bitwarden/common/types/guid";
 import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
 import { FolderService } from "@bitwarden/common/vault/abstractions/folder/folder.service.abstraction";
 import { PremiumUpgradePromptService } from "@bitwarden/common/vault/abstractions/premium-upgrade-prompt.service";
@@ -360,7 +361,12 @@ export class VaultV2Component<C extends CipherViewLike>
      this.allOrganizations = orgs;
    });

-    this.collectionService.decryptedCollections$
+    if (!this.activeUserId) {
+      throw new Error("No user found.");
+    }
+
+    this.collectionService
+      .decryptedCollections$(this.activeUserId)
      .pipe(takeUntil(this.componentIsDestroyed$))
      .subscribe((collections) => {
        this.allCollections = collections;
@@ -701,9 +707,17 @@ export class VaultV2Component<C extends CipherViewLike>
    this.cipherId = null;
    this.action = "view";
    await this.vaultItemsComponent?.refresh().catch(() => {});
+
+    if (!this.activeUserId) {
+      throw new Error("No userId provided.");
+    }
+
    this.collections = await firstValueFrom(
-      this.collectionService.decryptedCollectionViews$(cipher.collectionIds as CollectionId[]),
+      this.collectionService
+        .decryptedCollections$(this.activeUserId)
+        .pipe(getByIds(cipher.collectionIds)),
    );
+
    this.cipherId = cipher.id;
    this.cipher = cipher;
    if (this.activeUserId) {
--- a/apps/web/src/app/admin-console/organizations/collections/vault-filter/vault-filter.component.ts
+++ b/apps/web/src/app/admin-console/organizations/collections/vault-filter/vault-filter.component.ts
@@ -10,6 +10,7 @@ import { BillingApiServiceAbstraction } from "@bitwarden/common/billing/abstract
 import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
+import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
 import { TreeNode } from "@bitwarden/common/vault/models/domain/tree-node";
 import { RestrictedItemTypesService } from "@bitwarden/common/vault/services/restricted-item-types.service";
 import { DialogService, ToastService } from "@bitwarden/components";
@@ -53,6 +54,7 @@ export class VaultFilterComponent
    protected configService: ConfigService,
    protected accountService: AccountService,
    protected restrictedItemTypesService: RestrictedItemTypesService,
+    protected cipherService: CipherService,
  ) {
    super(
      vaultFilterService,
@@ -65,6 +67,7 @@ export class VaultFilterComponent
      configService,
      accountService,
      restrictedItemTypesService,
+      cipherService,
    );
  }

@@ -131,7 +134,7 @@ export class VaultFilterComponent

  async buildAllFilters(): Promise<VaultFilterList> {
    const builderFilter = {} as VaultFilterList;
-    builderFilter.typeFilter = await this.addTypeFilter(["favorites"]);
+    builderFilter.typeFilter = await this.addTypeFilter(["favorites"], this._organization?.id);
    builderFilter.collectionFilter = await this.addCollectionFilter();
    builderFilter.trashFilter = await this.addTrashFilter();
    return builderFilter;
--- a/apps/web/src/app/admin-console/organizations/collections/vault.component.ts
+++ b/apps/web/src/app/admin-console/organizations/collections/vault.component.ts
@@ -29,6 +29,7 @@ import {
 import {
  CollectionAdminService,
  CollectionAdminView,
+  CollectionService,
  CollectionView,
  Unassigned,
 } from "@bitwarden/admin-console/common";
@@ -264,6 +265,7 @@ export class VaultComponent implements OnInit, OnDestroy {
    private accountService: AccountService,
    private billingNotificationService: BillingNotificationService,
    private organizationWarningsService: OrganizationWarningsService,
+    private collectionService: CollectionService,
  ) {}

  async ngOnInit() {
@@ -1133,6 +1135,7 @@ export class VaultComponent implements OnInit, OnDestroy {
    }
    try {
      await this.apiService.deleteCollection(this.organization?.id, collection.id);
+      await this.collectionService.delete([collection.id as CollectionId], this.userId);
      this.toastService.showToast({
        variant: "success",
        title: null,
--- a/apps/web/src/app/admin-console/organizations/manage/groups.component.ts
+++ b/apps/web/src/app/admin-console/organizations/manage/groups.component.ts
@@ -11,6 +11,7 @@ import {
  from,
  lastValueFrom,
  map,
+  Observable,
  switchMap,
  tap,
 } from "rxjs";
@@ -25,10 +26,13 @@ import {
  CollectionView,
 } from "@bitwarden/admin-console/common";
 import { ApiService } from "@bitwarden/common/abstractions/api.service";
+import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { getUserId } from "@bitwarden/common/auth/services/account.service";
 import { ListResponse } from "@bitwarden/common/models/response/list.response";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
 import { DialogService, TableDataSource, ToastService } from "@bitwarden/components";
+import { KeyService } from "@bitwarden/key-management";

 import { GroupDetailsView, InternalGroupApiService as GroupService } from "../core";

@@ -100,6 +104,8 @@ export class GroupsComponent {
    private logService: LogService,
    private collectionService: CollectionService,
    private toastService: ToastService,
+    private keyService: KeyService,
+    private accountService: AccountService,
  ) {
    this.route.params
      .pipe(
@@ -244,16 +250,22 @@ export class GroupsComponent {
    this.dataSource.data = this.dataSource.data.filter((g) => g !== groupRow);
  }

-  private async toCollectionMap(response: ListResponse<CollectionResponse>) {
+  private toCollectionMap(
+    response: ListResponse<CollectionResponse>,
+  ): Observable<Record<string, CollectionView>> {
    const collections = response.data.map(
      (r) => new Collection(new CollectionData(r as CollectionDetailsResponse)),
    );
-    const decryptedCollections = await this.collectionService.decryptMany(collections);

-    // Convert to an object using collection Ids as keys for faster name lookups
-    const collectionMap: Record<string, CollectionView> = {};
-    decryptedCollections.forEach((c) => (collectionMap[c.id] = c));
-
-    return collectionMap;
+    return this.accountService.activeAccount$.pipe(
+      getUserId,
+      switchMap((userId) => this.keyService.orgKeys$(userId)),
+      switchMap((orgKeys) => this.collectionService.decryptMany$(collections, orgKeys)),
+      map((collections) => {
+        const collectionMap: Record<string, CollectionView> = {};
+        collections.forEach((c) => (collectionMap[c.id] = c));
+        return collectionMap;
+      }),
+    );
  }
 }
--- a/apps/web/src/app/admin-console/organizations/members/members.component.ts
+++ b/apps/web/src/app/admin-console/organizations/members/members.component.ts
@@ -13,6 +13,7 @@ import {
  Observable,
  shareReplay,
  switchMap,
+  withLatestFrom,
  tap,
 } from "rxjs";

@@ -307,17 +308,27 @@ export class MembersComponent extends BaseMembersComponent<OrganizationUserView>
   * Retrieve a map of all collection IDs <-> names for the organization.
   */
  async getCollectionNameMap() {
-    const collectionMap = new Map<string, string>();
-    const response = await this.apiService.getCollections(this.organization.id);
-
-    const collections = response.data.map(
-      (r) => new Collection(new CollectionData(r as CollectionDetailsResponse)),
+    const response = from(this.apiService.getCollections(this.organization.id)).pipe(
+      map((res) =>
+        res.data.map((r) => new Collection(new CollectionData(r as CollectionDetailsResponse))),
+      ),
    );
-    const decryptedCollections = await this.collectionService.decryptMany(collections);

-    decryptedCollections.forEach((c) => collectionMap.set(c.id, c.name));
+    const decryptedCollections$ = this.accountService.activeAccount$.pipe(
+      getUserId,
+      switchMap((userId) => this.keyService.orgKeys$(userId)),
+      withLatestFrom(response),
+      switchMap(([orgKeys, collections]) =>
+        this.collectionService.decryptMany$(collections, orgKeys),
+      ),
+      map((collections) => {
+        const collectionMap = new Map<string, string>();
+        collections.forEach((c) => collectionMap.set(c.id, c.name));
+        return collectionMap;
+      }),
+    );

-    return collectionMap;
+    return await firstValueFrom(decryptedCollections$);
  }

  removeUser(id: string): Promise<void> {
--- a/apps/web/src/app/admin-console/organizations/shared/components/collection-dialog/collection-dialog.component.ts
+++ b/apps/web/src/app/admin-console/organizations/shared/components/collection-dialog/collection-dialog.component.ts
@@ -26,7 +26,6 @@ import {
  CollectionResponse,
  CollectionView,
  CollectionService,
-  Collection,
 } from "@bitwarden/admin-console/common";
 import {
  getOrganizationById,
@@ -38,6 +37,7 @@ import { getUserId } from "@bitwarden/common/auth/services/account.service";
 import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
 import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { getById } from "@bitwarden/common/platform/misc";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
 import {
  DIALOG_DATA,
@@ -141,7 +141,6 @@ export class CollectionDialogComponent implements OnInit, OnDestroy {
  protected PermissionMode = PermissionMode;
  protected showDeleteButton = false;
  protected showAddAccessWarning = false;
-  protected collections: Collection[];
  protected buttonDisplayName: ButtonType = ButtonType.Save;
  private orgExceedingCollectionLimit!: Organization;

@@ -166,14 +165,12 @@ export class CollectionDialogComponent implements OnInit, OnDestroy {

  async ngOnInit() {
    // Opened from the individual vault
+    const userId = await firstValueFrom(this.accountService.activeAccount$.pipe(map((a) => a?.id)));
    if (this.params.showOrgSelector) {
      this.showOrgSelector = true;
      this.formGroup.controls.selectedOrg.valueChanges
        .pipe(takeUntil(this.destroy$))
        .subscribe((id) => this.loadOrg(id));
-      const userId = await firstValueFrom(
-        this.accountService.activeAccount$.pipe(map((a) => a?.id)),
-      );
      this.organizations$ = this.organizationService.organizations$(userId).pipe(
        first(),
        map((orgs) =>
@@ -195,9 +192,14 @@ export class CollectionDialogComponent implements OnInit, OnDestroy {
    );

    if (isBreadcrumbEventLogsEnabled) {
-      this.collections = await this.collectionService.getAll();
      this.organizationSelected.setAsyncValidators(
-        freeOrgCollectionLimitValidator(this.organizations$, this.collections, this.i18nService),
+        freeOrgCollectionLimitValidator(
+          this.organizations$,
+          this.collectionService
+            .encryptedCollections$(userId)
+            .pipe(map((collections) => collections ?? [])),
+          this.i18nService,
+        ),
      );
      this.formGroup.updateValueAndValidity();
    }
@@ -212,7 +214,7 @@ export class CollectionDialogComponent implements OnInit, OnDestroy {
          }
        }),
        filter(() => this.organizationSelected.errors?.cannotCreateCollections),
-        switchMap((value) => this.findOrganizationById(value)),
+        switchMap((organizationId) => this.organizations$.pipe(getById(organizationId))),
        takeUntil(this.destroy$),
      )
      .subscribe((org) => {
@@ -222,11 +224,6 @@ export class CollectionDialogComponent implements OnInit, OnDestroy {
      });
  }

-  async findOrganizationById(orgId: string): Promise<Organization | undefined> {
-    const organizations = await firstValueFrom(this.organizations$);
-    return organizations.find((org) => org.id === orgId);
-  }
-
  async loadOrg(orgId: string) {
    const userId = await firstValueFrom(getUserId(this.accountService.activeAccount$));
    const organization$ = this.organizationService
@@ -413,7 +410,8 @@ export class CollectionDialogComponent implements OnInit, OnDestroy {
      collectionView.name = this.formGroup.controls.name.value;
    }

-    const savedCollection = await this.collectionAdminService.save(collectionView);
+    const userId = await firstValueFrom(this.accountService.activeAccount$.pipe(getUserId));
+    const savedCollection = await this.collectionAdminService.save(collectionView, userId);

    this.toastService.showToast({
      variant: "success",
--- a/apps/web/src/app/admin-console/organizations/shared/components/integrations/integration-card/integration-card.component.ts
+++ b/apps/web/src/app/admin-console/organizations/shared/components/integrations/integration-card/integration-card.component.ts
@@ -115,6 +115,7 @@ export class IntegrationCardComponent implements AfterViewInit, OnDestroy {
    });

    const result = await lastValueFrom(dialog.closed);
+    this.isConnected = result.success ? true : false;

    // for now we just log the result
    // eslint-disable-next-line no-console
--- a/apps/web/src/app/admin-console/organizations/shared/validators/free-org-collection-limit.validator.spec.ts
+++ b/apps/web/src/app/admin-console/organizations/shared/validators/free-org-collection-limit.validator.spec.ts
@@ -18,7 +18,7 @@ describe("freeOrgCollectionLimitValidator", () => {

  it("returns null if organization is not found", async () => {
    const orgs: Organization[] = [];
-    const validator = freeOrgCollectionLimitValidator(of(orgs), [], i18nService);
+    const validator = freeOrgCollectionLimitValidator(of(orgs), of([]), i18nService);
    const control = new FormControl("org-id");

    const result: Observable<ValidationErrors> = validator(control) as Observable<ValidationErrors>;
@@ -28,7 +28,7 @@ describe("freeOrgCollectionLimitValidator", () => {
  });

  it("returns null if control is not an instance of FormControl", async () => {
-    const validator = freeOrgCollectionLimitValidator(of([]), [], i18nService);
+    const validator = freeOrgCollectionLimitValidator(of([]), of([]), i18nService);
    const control = {} as AbstractControl;

    const result: Observable<ValidationErrors | null> = validator(
@@ -40,7 +40,7 @@ describe("freeOrgCollectionLimitValidator", () => {
  });

  it("returns null if control is not provided", async () => {
-    const validator = freeOrgCollectionLimitValidator(of([]), [], i18nService);
+    const validator = freeOrgCollectionLimitValidator(of([]), of([]), i18nService);

    const result: Observable<ValidationErrors | null> = validator(
      undefined as any,
@@ -53,7 +53,7 @@ describe("freeOrgCollectionLimitValidator", () => {
  it("returns null if organization has not reached collection limit (Observable)", async () => {
    const org = { id: "org-id", maxCollections: 2 } as Organization;
    const collections = [{ organizationId: "org-id" } as Collection];
-    const validator = freeOrgCollectionLimitValidator(of([org]), collections, i18nService);
+    const validator = freeOrgCollectionLimitValidator(of([org]), of(collections), i18nService);
    const control = new FormControl("org-id");

    const result$ = validator(control) as Observable<ValidationErrors | null>;
@@ -65,7 +65,7 @@ describe("freeOrgCollectionLimitValidator", () => {
  it("returns error if organization has reached collection limit (Observable)", async () => {
    const org = { id: "org-id", maxCollections: 1 } as Organization;
    const collections = [{ organizationId: "org-id" } as Collection];
-    const validator = freeOrgCollectionLimitValidator(of([org]), collections, i18nService);
+    const validator = freeOrgCollectionLimitValidator(of([org]), of(collections), i18nService);
    const control = new FormControl("org-id");

    const result$ = validator(control) as Observable<ValidationErrors | null>;
--- a/apps/web/src/app/admin-console/organizations/shared/validators/free-org-collection-limit.validator.ts
+++ b/apps/web/src/app/admin-console/organizations/shared/validators/free-org-collection-limit.validator.ts
@@ -1,13 +1,14 @@
 import { AbstractControl, AsyncValidatorFn, FormControl, ValidationErrors } from "@angular/forms";
-import { map, Observable, of } from "rxjs";
+import { combineLatest, map, Observable, of } from "rxjs";

 import { Collection } from "@bitwarden/admin-console/common";
 import { Organization } from "@bitwarden/common/admin-console/models/domain/organization";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { getById } from "@bitwarden/common/platform/misc";

 export function freeOrgCollectionLimitValidator(
-  orgs: Observable<Organization[]>,
-  collections: Collection[],
+  organizations$: Observable<Organization[]>,
+  collections$: Observable<Collection[]>,
  i18nService: I18nService,
 ): AsyncValidatorFn {
  return (control: AbstractControl): Observable<ValidationErrors | null> => {
@@ -21,15 +22,16 @@ export function freeOrgCollectionLimitValidator(
      return of(null);
    }

-    return orgs.pipe(
-      map((organizations) => organizations.find((org) => org.id === orgId)),
-      map((org) => {
-        if (!org) {
+    return combineLatest([organizations$.pipe(getById(orgId)), collections$]).pipe(
+      map(([organization, collections]) => {
+        if (!organization) {
          return null;
        }

-        const orgCollections = collections.filter((c) => c.organizationId === org.id);
-        const hasReachedLimit = org.maxCollections === orgCollections.length;
+        const orgCollections = collections.filter(
+          (collection: Collection) => collection.organizationId === organization.id,
+        );
+        const hasReachedLimit = organization.maxCollections === orgCollections.length;

        if (hasReachedLimit) {
          return {
--- a/apps/web/src/app/app.component.ts
+++ b/apps/web/src/app/app.component.ts
@@ -285,7 +285,6 @@ export class AppComponent implements OnDestroy, OnInit {
      this.keyService.clearKeys(userId),
      this.cipherService.clear(userId),
      this.folderService.clear(userId),
-      this.collectionService.clear(userId),
      this.biometricStateService.logout(userId),
    ]);

--- a/apps/web/src/app/vault/individual-vault/bulk-action-dialogs/bulk-delete-dialog/bulk-delete-dialog.component.ts
+++ b/apps/web/src/app/vault/individual-vault/bulk-action-dialogs/bulk-delete-dialog/bulk-delete-dialog.component.ts
@@ -9,7 +9,7 @@ import { Organization } from "@bitwarden/common/admin-console/models/domain/orga
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
 import { getUserId } from "@bitwarden/common/auth/services/account.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
-import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
+import { CollectionId } from "@bitwarden/common/types/guid";
 import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
 import { CipherBulkDeleteRequest } from "@bitwarden/common/vault/models/request/cipher-bulk-delete.request";
 import { UnionOfValues } from "@bitwarden/common/vault/types/union-of-values";
@@ -68,7 +68,6 @@ export class BulkDeleteDialogComponent {
    @Inject(DIALOG_DATA) params: BulkDeleteDialogParams,
    private dialogRef: DialogRef<BulkDeleteDialogResult>,
    private cipherService: CipherService,
-    private platformUtilsService: PlatformUtilsService,
    private i18nService: I18nService,
    private apiService: ApiService,
    private collectionService: CollectionService,
@@ -116,7 +115,11 @@ export class BulkDeleteDialogComponent {
      });
    }
    if (this.collections.length) {
-      await this.collectionService.delete(this.collections.map((c) => c.id));
+      const userId = await firstValueFrom(this.accountService.activeAccount$.pipe(getUserId));
+      await this.collectionService.delete(
+        this.collections.map((c) => c.id as CollectionId),
+        userId,
+      );
      this.toastService.showToast({
        variant: "success",
        title: null,
--- a/apps/web/src/app/vault/individual-vault/vault-filter/components/vault-filter.component.ts
+++ b/apps/web/src/app/vault/individual-vault/vault-filter/components/vault-filter.component.ts
@@ -1,6 +1,7 @@
 import { Component, EventEmitter, inject, Input, OnDestroy, OnInit, Output } from "@angular/core";
 import { Router } from "@angular/router";
 import {
+  combineLatest,
  distinctUntilChanged,
  firstValueFrom,
  map,
@@ -20,6 +21,7 @@ import { BillingApiServiceAbstraction } from "@bitwarden/common/billing/abstract
 import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
+import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
 import { CipherType } from "@bitwarden/common/vault/enums";
 import { TreeNode } from "@bitwarden/common/vault/models/domain/tree-node";
 import { RestrictedItemTypesService } from "@bitwarden/common/vault/services/restricted-item-types.service";
@@ -155,6 +157,7 @@ export class VaultFilterComponent implements OnInit, OnDestroy {
    protected configService: ConfigService,
    protected accountService: AccountService,
    protected restrictedItemTypesService: RestrictedItemTypesService,
+    protected cipherService: CipherService,
  ) {}

  async ngOnInit(): Promise<void> {
@@ -292,16 +295,47 @@ export class VaultFilterComponent implements OnInit, OnDestroy {
    return orgFilterSection;
  }

-  protected async addTypeFilter(excludeTypes: CipherStatus[] = []): Promise<VaultFilterSection> {
+  protected async addTypeFilter(
+    excludeTypes: CipherStatus[] = [],
+    organizationId?: string,
+  ): Promise<VaultFilterSection> {
    const allFilter: CipherTypeFilter = { id: "AllItems", name: "allItems", type: "all", icon: "" };

-    const data$ = this.restrictedItemTypesService.restricted$.pipe(
-      map((restricted) => {
-        // List of types restricted by all orgs
-        const restrictedByAll = restricted
-          .filter((r) => r.allowViewOrgIds.length === 0)
+    const userId = await firstValueFrom(this.activeUserId$);
+
+    const data$ = combineLatest([
+      this.restrictedItemTypesService.restricted$,
+      this.cipherService.cipherViews$(userId),
+    ]).pipe(
+      map(([restrictedTypes, ciphers]) => {
+        const restrictedForUser = restrictedTypes
+          .filter((r) => {
+            // - All orgs restrict the type
+            if (r.allowViewOrgIds.length === 0) {
+              return true;
+            }
+            // - Admin console: user has no ciphers of that type in the selected org
+            // - Individual vault view: user has no ciphers of that type in any allowed org
+            return !ciphers?.some((c) => {
+              if (c.deletedDate || c.type !== r.cipherType) {
+                return false;
+              }
+              // If the cipher doesn't belong to an org it is automatically restricted
+              if (!c.organizationId) {
+                return false;
+              }
+              if (organizationId) {
+                return (
+                  c.organizationId === organizationId &&
+                  r.allowViewOrgIds.includes(c.organizationId)
+                );
+              }
+              return r.allowViewOrgIds.includes(c.organizationId);
+            });
+          })
          .map((r) => r.cipherType);
-        const toExclude = [...excludeTypes, ...restrictedByAll];
+
+        const toExclude = [...excludeTypes, ...restrictedForUser];
        return this.allTypeFilters.filter(
          (f) => typeof f.type === "string" || !toExclude.includes(f.type),
        );
--- a/apps/web/src/app/vault/individual-vault/vault-filter/services/vault-filter.service.spec.ts
+++ b/apps/web/src/app/vault/individual-vault/vault-filter/services/vault-filter.service.spec.ts
@@ -78,7 +78,7 @@ describe("vault filter service", () => {
    configService.getFeatureFlag$.mockReturnValue(of(true));
    organizationService.memberOrganizations$.mockReturnValue(organizations);
    folderService.folderViews$.mockReturnValue(folderViews);
-    collectionService.decryptedCollections$ = collectionViews;
+    collectionService.decryptedCollections$.mockReturnValue(collectionViews);
    policyService.policyAppliesToUser$
      .calledWith(PolicyType.OrganizationDataOwnership, mockUserId)
      .mockReturnValue(organizationDataOwnershipPolicy);
--- a/apps/web/src/app/vault/individual-vault/vault-filter/services/vault-filter.service.ts
+++ b/apps/web/src/app/vault/individual-vault/vault-filter/services/vault-filter.service.ts
@@ -4,7 +4,6 @@ import { Injectable } from "@angular/core";
 import {
  BehaviorSubject,
  combineLatest,
-  combineLatestWith,
  filter,
  firstValueFrom,
  map,
@@ -100,13 +99,13 @@ export class VaultFilterService implements VaultFilterServiceAbstraction {
    map((folders) => this.buildFolderTree(folders)),
  );

-  filteredCollections$: Observable<CollectionView[]> =
-    this.collectionService.decryptedCollections$.pipe(
-      combineLatestWith(this._organizationFilter),
-      switchMap(([collections, org]) => {
-        return this.filterCollections(collections, org);
-      }),
-    );
+  filteredCollections$: Observable<CollectionView[]> = combineLatest([
+    this.accountService.activeAccount$.pipe(
+      getUserId,
+      switchMap((userId) => this.collectionService.decryptedCollections$(userId)),
+    ),
+    this._organizationFilter,
+  ]).pipe(switchMap(([collections, org]) => this.filterCollections(collections, org)));

  collectionTree$: Observable<TreeNode<CollectionFilter>> = combineLatest([
    this.filteredCollections$,
--- a/apps/web/src/app/vault/individual-vault/vault.component.ts
+++ b/apps/web/src/app/vault/individual-vault/vault.component.ts
@@ -334,7 +334,8 @@ export class VaultComponent<C extends CipherViewLike> implements OnInit, OnDestr
      });

    const filter$ = this.routedVaultFilterService.filter$;
-    const allCollections$ = this.collectionService.decryptedCollections$;
+
+    const allCollections$ = this.collectionService.decryptedCollections$(activeUserId);
    const nestedCollections$ = allCollections$.pipe(
      map((collections) => getNestedCollectionTree(collections)),
    );
@@ -861,7 +862,10 @@ export class VaultComponent<C extends CipherViewLike> implements OnInit, OnDestr
      if (result.collection) {
        // Update CollectionService with the new collection
        const c = new CollectionData(result.collection as CollectionDetailsResponse);
-        await this.collectionService.upsert(c);
+        const activeUserId = await firstValueFrom(
+          this.accountService.activeAccount$.pipe(getUserId),
+        );
+        await this.collectionService.upsert(c, activeUserId);
      }
      this.refresh();
    }
@@ -878,20 +882,23 @@ export class VaultComponent<C extends CipherViewLike> implements OnInit, OnDestr
    });

    const result = await lastValueFrom(dialog.closed);
+    const activeUserId = await firstValueFrom(this.accountService.activeAccount$.pipe(getUserId));
    if (result.action === CollectionDialogAction.Saved) {
      if (result.collection) {
        // Update CollectionService with the new collection
        const c = new CollectionData(result.collection as CollectionDetailsResponse);
-        await this.collectionService.upsert(c);
+        await this.collectionService.upsert(c, activeUserId);
      }
      this.refresh();
    } else if (result.action === CollectionDialogAction.Deleted) {
-      await this.collectionService.delete(result.collection?.id);
-      this.refresh();
+      const parent = this.selectedCollection?.parent;
      // Navigate away if we deleted the collection we were viewing
-      if (this.selectedCollection?.node.id === c?.id) {
+      const navigateAway = this.selectedCollection && this.selectedCollection.node.id === c.id;
+      await this.collectionService.delete([result.collection?.id as CollectionId], activeUserId);
+      this.refresh();
+      if (navigateAway) {
        await this.router.navigate([], {
-          queryParams: { collectionId: this.selectedCollection.parent?.node.id ?? null },
+          queryParams: { collectionId: parent?.node.id ?? null },
          queryParamsHandling: "merge",
          replaceUrl: true,
        });
@@ -916,18 +923,22 @@ export class VaultComponent<C extends CipherViewLike> implements OnInit, OnDestr
      return;
    }
    try {
+      const parent = this.selectedCollection?.parent;
+      // Navigate away if we deleted the collection we were viewing
+      const navigateAway =
+        this.selectedCollection && this.selectedCollection.node.id === collection.id;
      await this.apiService.deleteCollection(collection.organizationId, collection.id);
-      await this.collectionService.delete(collection.id);
+      const activeUserId = await firstValueFrom(this.accountService.activeAccount$.pipe(getUserId));
+      await this.collectionService.delete([collection.id as CollectionId], activeUserId);

      this.toastService.showToast({
        variant: "success",
        title: null,
        message: this.i18nService.t("deletedCollectionId", collection.name),
      });
-      // Navigate away if we deleted the collection we were viewing
-      if (this.selectedCollection?.node.id === collection.id) {
+      if (navigateAway) {
        await this.router.navigate([], {
-          queryParams: { collectionId: this.selectedCollection.parent?.node.id ?? null },
+          queryParams: { collectionId: parent?.node.id ?? null },
          queryParamsHandling: "merge",
          replaceUrl: true,
        });
--- a/libs/admin-console/src/common/collections/abstractions/collection-admin.service.ts
+++ b/libs/admin-console/src/common/collections/abstractions/collection-admin.service.ts
@@ -1,15 +1,20 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { CollectionDetailsResponse } from "@bitwarden/admin-console/common";
+import { UserId } from "@bitwarden/common/types/guid";

 import { CollectionAccessSelectionView, CollectionAdminView } from "../models";

 export abstract class CollectionAdminService {
-  getAll: (organizationId: string) => Promise<CollectionAdminView[]>;
-  get: (organizationId: string, collectionId: string) => Promise<CollectionAdminView | undefined>;
-  save: (collection: CollectionAdminView) => Promise<CollectionDetailsResponse>;
-  delete: (organizationId: string, collectionId: string) => Promise<void>;
-  bulkAssignAccess: (
+  abstract getAll: (organizationId: string) => Promise<CollectionAdminView[]>;
+  abstract get: (
+    organizationId: string,
+    collectionId: string,
+  ) => Promise<CollectionAdminView | undefined>;
+  abstract save: (
+    collection: CollectionAdminView,
+    userId: UserId,
+  ) => Promise<CollectionDetailsResponse>;
+  abstract delete: (organizationId: string, collectionId: string) => Promise<void>;
+  abstract bulkAssignAccess: (
    organizationId: string,
    collectionIds: string[],
    users: CollectionAccessSelectionView[],
--- a/libs/admin-console/src/common/collections/abstractions/collection.service.ts
+++ b/libs/admin-console/src/common/collections/abstractions/collection.service.ts
@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { Observable } from "rxjs";

 import { CollectionId, OrganizationId, UserId } from "@bitwarden/common/types/guid";
@@ -9,27 +7,25 @@ import { TreeNode } from "@bitwarden/common/vault/models/domain/tree-node";
 import { CollectionData, Collection, CollectionView } from "../models";

 export abstract class CollectionService {
-  encryptedCollections$: Observable<Collection[]>;
-  decryptedCollections$: Observable<CollectionView[]>;
-
-  clearActiveUserCache: () => Promise<void>;
-  encrypt: (model: CollectionView) => Promise<Collection>;
-  decryptedCollectionViews$: (ids: CollectionId[]) => Observable<CollectionView[]>;
+  abstract encryptedCollections$: (userId: UserId) => Observable<Collection[] | null>;
+  abstract decryptedCollections$: (userId: UserId) => Observable<CollectionView[]>;
+  abstract upsert: (collection: CollectionData, userId: UserId) => Promise<any>;
+  abstract replace: (collections: { [id: string]: CollectionData }, userId: UserId) => Promise<any>;
  /**
-   * @deprecated This method will soon be made private
-   * See PM-12375
+   * @deprecated This method will soon be made private, use `decryptedCollections$` instead.
   */
-  decryptMany: (
+  abstract decryptMany$: (
    collections: Collection[],
-    orgKeys?: Record<OrganizationId, OrgKey>,
-  ) => Promise<CollectionView[]>;
-  get: (id: string) => Promise<Collection>;
-  getAll: () => Promise<Collection[]>;
-  getAllDecrypted: () => Promise<CollectionView[]>;
-  getAllNested: (collections?: CollectionView[]) => Promise<TreeNode<CollectionView>[]>;
-  getNested: (id: string) => Promise<TreeNode<CollectionView>>;
-  upsert: (collection: CollectionData | CollectionData[]) => Promise<any>;
-  replace: (collections: { [id: string]: CollectionData }, userId: UserId) => Promise<any>;
-  clear: (userId?: string) => Promise<void>;
-  delete: (id: string | string[]) => Promise<any>;
+    orgKeys: Record<OrganizationId, OrgKey>,
+  ) => Observable<CollectionView[]>;
+  abstract delete: (ids: CollectionId[], userId: UserId) => Promise<any>;
+  abstract encrypt: (model: CollectionView, userId: UserId) => Promise<Collection>;
+  /**
+   * Transforms the input CollectionViews into TreeNodes
+   */
+  abstract getAllNested: (collections: CollectionView[]) => TreeNode<CollectionView>[];
+  /*
+   * Transforms the input CollectionViews into TreeNodes and then returns the Treenode with the specified id
+   */
+  abstract getNested: (collections: CollectionView[], id: string) => TreeNode<CollectionView>;
 }
--- a/libs/admin-console/src/common/collections/abstractions/vnext-collection.service.ts
+++ b/libs/admin-console/src/common/collections/abstractions/vnext-collection.service.ts
@@ -1,43 +0,0 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
-import { Observable } from "rxjs";
-
-import { OrganizationId, UserId } from "@bitwarden/common/types/guid";
-import { OrgKey } from "@bitwarden/common/types/key";
-import { TreeNode } from "@bitwarden/common/vault/models/domain/tree-node";
-
-import { CollectionData, Collection, CollectionView } from "../models";
-
-export abstract class vNextCollectionService {
-  encryptedCollections$: (userId: UserId) => Observable<Collection[]>;
-  decryptedCollections$: (userId: UserId) => Observable<CollectionView[]>;
-  upsert: (collection: CollectionData | CollectionData[], userId: UserId) => Promise<any>;
-  replace: (collections: { [id: string]: CollectionData }, userId: UserId) => Promise<any>;
-  /**
-   * Clear decrypted state without affecting encrypted state.
-   * Used for locking the vault.
-   */
-  clearDecryptedState: (userId: UserId) => Promise<void>;
-  /**
-   * Clear decrypted and encrypted state.
-   * Used for logging out.
-   */
-  clear: (userId: UserId) => Promise<void>;
-  delete: (id: string | string[], userId: UserId) => Promise<any>;
-  encrypt: (model: CollectionView) => Promise<Collection>;
-  /**
-   * @deprecated This method will soon be made private, use `decryptedCollections$` instead.
-   */
-  decryptMany: (
-    collections: Collection[],
-    orgKeys?: Record<OrganizationId, OrgKey> | null,
-  ) => Promise<CollectionView[]>;
-  /**
-   * Transforms the input CollectionViews into TreeNodes
-   */
-  getAllNested: (collections: CollectionView[]) => TreeNode<CollectionView>[];
-  /**
-   * Transforms the input CollectionViews into TreeNodes and then returns the Treenode with the specified id
-   */
-  getNested: (collections: CollectionView[], id: string) => TreeNode<CollectionView>;
-}
--- a/libs/admin-console/src/common/collections/models/collection.data.ts
+++ b/libs/admin-console/src/common/collections/models/collection.data.ts
@@ -26,7 +26,10 @@ export class CollectionData {
    this.type = response.type;
  }

-  static fromJSON(obj: Jsonify<CollectionData>) {
+  static fromJSON(obj: Jsonify<CollectionData | null>): CollectionData | null {
+    if (obj == null) {
+      return null;
+    }
    return Object.assign(new CollectionData(new CollectionDetailsResponse({})), obj);
  }
 }
--- a/libs/admin-console/src/common/collections/models/collection.ts
+++ b/libs/admin-console/src/common/collections/models/collection.ts
@@ -1,7 +1,5 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-string";
-import Domain from "@bitwarden/common/platform/models/domain/domain-base";
+import Domain, { EncryptableKeys } from "@bitwarden/common/platform/models/domain/domain-base";
 import { OrgKey } from "@bitwarden/common/types/key";

 import { CollectionData } from "./collection.data";
@@ -15,16 +13,16 @@ export const CollectionTypes = {
 export type CollectionType = (typeof CollectionTypes)[keyof typeof CollectionTypes];

 export class Collection extends Domain {
-  id: string;
-  organizationId: string;
-  name: EncString;
-  externalId: string;
-  readOnly: boolean;
-  hidePasswords: boolean;
-  manage: boolean;
-  type: CollectionType;
+  id: string | undefined;
+  organizationId: string | undefined;
+  name: EncString | undefined;
+  externalId: string | undefined;
+  readOnly: boolean = false;
+  hidePasswords: boolean = false;
+  manage: boolean = false;
+  type: CollectionType = CollectionTypes.SharedCollection;

-  constructor(obj?: CollectionData) {
+  constructor(obj?: CollectionData | null) {
    super();
    if (obj == null) {
      return;
@@ -51,8 +49,8 @@ export class Collection extends Domain {
    return this.decryptObj<Collection, CollectionView>(
      this,
      new CollectionView(this),
-      ["name"],
-      this.organizationId,
+      ["name"] as EncryptableKeys<Collection, CollectionView>[],
+      this.organizationId ?? null,
      orgKey,
    );
  }
--- a/libs/admin-console/src/common/collections/models/collection.view.ts
+++ b/libs/admin-console/src/common/collections/models/collection.view.ts
@@ -12,7 +12,7 @@ export const NestingDelimiter = "/";
 export class CollectionView implements View, ITreeNodeObject {
  id: string | undefined;
  organizationId: string | undefined;
-  name: string | undefined;
+  name: string = "";
  externalId: string | undefined;
  // readOnly applies to the items within a collection
  readOnly: boolean = false;
--- a/libs/admin-console/src/common/collections/services/collection.state.ts
+++ b/libs/admin-console/src/common/collections/services/collection.state.ts
@@ -0,0 +1,28 @@
+import { Jsonify } from "type-fest";
+
+import {
+  COLLECTION_DISK,
+  COLLECTION_MEMORY,
+  UserKeyDefinition,
+} from "@bitwarden/common/platform/state";
+import { CollectionId } from "@bitwarden/common/types/guid";
+
+import { CollectionData, CollectionView } from "../models";
+
+export const ENCRYPTED_COLLECTION_DATA_KEY = UserKeyDefinition.record<
+  CollectionData | null,
+  CollectionId
+>(COLLECTION_DISK, "collections", {
+  deserializer: (jsonData: Jsonify<CollectionData | null>) => CollectionData.fromJSON(jsonData),
+  clearOn: ["logout"],
+});
+
+export const DECRYPTED_COLLECTION_DATA_KEY = new UserKeyDefinition<CollectionView[] | null>(
+  COLLECTION_MEMORY,
+  "decryptedCollections",
+  {
+    deserializer: (obj: Jsonify<CollectionView[] | null>) =>
+      obj?.map((f) => CollectionView.fromJSON(f)) ?? null,
+    clearOn: ["logout", "lock"],
+  },
+);
--- a/libs/admin-console/src/common/collections/services/default-collection-admin.service.ts
+++ b/libs/admin-console/src/common/collections/services/default-collection-admin.service.ts
@@ -1,9 +1,11 @@
 // FIXME: Update this file to be type safe and remove this and next line
 // @ts-strict-ignore
+
 import { ApiService } from "@bitwarden/common/abstractions/api.service";
 import { SelectionReadOnlyRequest } from "@bitwarden/common/admin-console/models/request/selection-read-only.request";
 import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
 import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-string";
+import { CollectionId, UserId } from "@bitwarden/common/types/guid";
 import { KeyService } from "@bitwarden/key-management";

 import { CollectionAdminService, CollectionService } from "../abstractions";
@@ -55,7 +57,7 @@ export class DefaultCollectionAdminService implements CollectionAdminService {
    return view;
  }

-  async save(collection: CollectionAdminView): Promise<CollectionDetailsResponse> {
+  async save(collection: CollectionAdminView, userId: UserId): Promise<CollectionDetailsResponse> {
    const request = await this.encrypt(collection);

    let response: CollectionDetailsResponse;
@@ -71,9 +73,9 @@ export class DefaultCollectionAdminService implements CollectionAdminService {
    }

    if (response.assigned) {
-      await this.collectionService.upsert(new CollectionData(response));
+      await this.collectionService.upsert(new CollectionData(response), userId);
    } else {
-      await this.collectionService.delete(collection.id);
+      await this.collectionService.delete([collection.id as CollectionId], userId);
    }

    return response;
--- a/libs/admin-console/src/common/collections/services/default-collection.service.spec.ts
+++ b/libs/admin-console/src/common/collections/services/default-collection.service.spec.ts
@@ -1,10 +1,11 @@
-import { mock } from "jest-mock-extended";
-import { firstValueFrom, of } from "rxjs";
+import { mock, MockProxy } from "jest-mock-extended";
+import { combineLatest, first, firstValueFrom, of, ReplaySubject, takeWhile } from "rxjs";

 import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
 import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-string";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
+import { SymmetricCryptoKey } from "@bitwarden/common/platform/models/domain/symmetric-crypto-key";
 import { ContainerService } from "@bitwarden/common/platform/services/container.service";
 import {
  FakeStateProvider,
@@ -16,124 +17,382 @@ import { CollectionId, OrganizationId, UserId } from "@bitwarden/common/types/gu
 import { OrgKey } from "@bitwarden/common/types/key";
 import { KeyService } from "@bitwarden/key-management";

-import { CollectionData } from "../models";
+import { CollectionData, CollectionView } from "../models";

-import {
-  DefaultCollectionService,
-  ENCRYPTED_COLLECTION_DATA_KEY,
-} from "./default-collection.service";
+import { DECRYPTED_COLLECTION_DATA_KEY, ENCRYPTED_COLLECTION_DATA_KEY } from "./collection.state";
+import { DefaultCollectionService } from "./default-collection.service";

 describe("DefaultCollectionService", () => {
+  let keyService: MockProxy<KeyService>;
+  let encryptService: MockProxy<EncryptService>;
+  let i18nService: MockProxy<I18nService>;
+  let stateProvider: FakeStateProvider;
+
+  let userId: UserId;
+
+  let cryptoKeys: ReplaySubject<Record<OrganizationId, OrgKey> | null>;
+
+  let collectionService: DefaultCollectionService;
+
+  beforeEach(() => {
+    userId = Utils.newGuid() as UserId;
+
+    keyService = mock();
+    encryptService = mock();
+    i18nService = mock();
+    stateProvider = new FakeStateProvider(mockAccountServiceWith(userId));
+
+    cryptoKeys = new ReplaySubject(1);
+    keyService.orgKeys$.mockReturnValue(cryptoKeys);
+
+    // Set up mock decryption
+    encryptService.decryptString
+      .calledWith(expect.any(EncString), expect.any(SymmetricCryptoKey))
+      .mockImplementation((encString, key) =>
+        Promise.resolve(encString.data.replace("ENC_", "DEC_")),
+      );
+
+    (window as any).bitwardenContainerService = new ContainerService(keyService, encryptService);
+
+    // Arrange i18nService so that sorting algorithm doesn't throw
+    i18nService.collator = null;
+
+    collectionService = new DefaultCollectionService(
+      keyService,
+      encryptService,
+      i18nService,
+      stateProvider,
+    );
+  });
+
  afterEach(() => {
    delete (window as any).bitwardenContainerService;
  });

  describe("decryptedCollections$", () => {
    it("emits decrypted collections from state", async () => {
-      // Arrange test collections
+      // Arrange test data
      const org1 = Utils.newGuid() as OrganizationId;
-      const org2 = Utils.newGuid() as OrganizationId;
-
+      const orgKey1 = makeSymmetricCryptoKey<OrgKey>(64, 1);
      const collection1 = collectionDataFactory(org1);
+
+      const org2 = Utils.newGuid() as OrganizationId;
+      const orgKey2 = makeSymmetricCryptoKey<OrgKey>(64, 2);
      const collection2 = collectionDataFactory(org2);

-      // Arrange state provider
-      const fakeStateProvider = mockStateProvider();
-      await fakeStateProvider.setUserState(ENCRYPTED_COLLECTION_DATA_KEY, {
-        [collection1.id]: collection1,
-        [collection2.id]: collection2,
+      // Arrange dependencies
+      await setEncryptedState([collection1, collection2]);
+      cryptoKeys.next({
+        [org1]: orgKey1,
+        [org2]: orgKey2,
      });

-      // Arrange cryptoService - orgKeys and mock decryption
-      const cryptoService = mockCryptoService();
-      cryptoService.orgKeys$.mockReturnValue(
-        of({
-          [org1]: makeSymmetricCryptoKey<OrgKey>(),
-          [org2]: makeSymmetricCryptoKey<OrgKey>(),
-        }),
-      );
+      const result = await firstValueFrom(collectionService.decryptedCollections$(userId));

-      const collectionService = new DefaultCollectionService(
-        cryptoService,
-        mock<EncryptService>(),
-        mockI18nService(),
-        fakeStateProvider,
-      );
-
-      const result = await firstValueFrom(collectionService.decryptedCollections$);
+      // Assert emitted values
      expect(result.length).toBe(2);
-      expect(result[0]).toMatchObject({
-        id: collection1.id,
-        name: "DECRYPTED_STRING",
-      });
-      expect(result[1]).toMatchObject({
-        id: collection2.id,
-        name: "DECRYPTED_STRING",
-      });
+      expect(result).toContainPartialObjects([
+        {
+          id: collection1.id,
+          name: "DEC_NAME_" + collection1.id,
+        },
+        {
+          id: collection2.id,
+          name: "DEC_NAME_" + collection2.id,
+        },
+      ]);
+
+      // Assert that the correct org keys were used for each encrypted string
+      // This should be replaced with decryptString when the platform PR (https://github.com/bitwarden/clients/pull/14544) is merged
+      expect(encryptService.decryptString).toHaveBeenCalledWith(
+        expect.objectContaining(new EncString(collection1.name)),
+        orgKey1,
+      );
+      expect(encryptService.decryptString).toHaveBeenCalledWith(
+        expect.objectContaining(new EncString(collection2.name)),
+        orgKey2,
+      );
+    });
+
+    it("emits decrypted collections from in-memory state when available", async () => {
+      // Arrange test data
+      const org1 = Utils.newGuid() as OrganizationId;
+      const collection1 = collectionViewDataFactory(org1);
+
+      const org2 = Utils.newGuid() as OrganizationId;
+      const collection2 = collectionViewDataFactory(org2);
+
+      await setDecryptedState([collection1, collection2]);
+
+      const result = await firstValueFrom(collectionService.decryptedCollections$(userId));
+
+      // Assert emitted values
+      expect(result.length).toBe(2);
+      expect(result).toContainPartialObjects([
+        {
+          id: collection1.id,
+          name: "DEC_NAME_" + collection1.id,
+        },
+        {
+          id: collection2.id,
+          name: "DEC_NAME_" + collection2.id,
+        },
+      ]);
+
+      // Ensure that the returned data came from the in-memory state, rather than from decryption.
+      expect(encryptService.decryptString).not.toHaveBeenCalled();
    });

    it("handles null collection state", async () => {
-      // Arrange test collections
+      // Arrange dependencies
+      await setEncryptedState(null);
+      cryptoKeys.next({});
+
+      const encryptedCollections = await firstValueFrom(
+        collectionService.encryptedCollections$(userId),
+      );
+
+      expect(encryptedCollections).toBe(null);
+    });
+
+    it("handles undefined orgKeys", (done) => {
+      // Arrange test data
      const org1 = Utils.newGuid() as OrganizationId;
+      const collection1 = collectionDataFactory(org1);
+
      const org2 = Utils.newGuid() as OrganizationId;
+      const collection2 = collectionDataFactory(org2);

-      // Arrange state provider
-      const fakeStateProvider = mockStateProvider();
-      await fakeStateProvider.setUserState(ENCRYPTED_COLLECTION_DATA_KEY, null);
+      // Emit a non-null value after the first undefined value has propagated
+      // This will cause the collections to emit, calling done()
+      cryptoKeys.pipe(first()).subscribe((val) => {
+        cryptoKeys.next({});
+      });

-      // Arrange cryptoService - orgKeys and mock decryption
-      const cryptoService = mockCryptoService();
-      cryptoService.orgKeys$.mockReturnValue(
-        of({
-          [org1]: makeSymmetricCryptoKey<OrgKey>(),
-          [org2]: makeSymmetricCryptoKey<OrgKey>(),
-        }),
-      );
+      collectionService
+        .decryptedCollections$(userId)
+        .pipe(takeWhile((val) => val.length != 2))
+        .subscribe({ complete: () => done() });

-      const collectionService = new DefaultCollectionService(
-        cryptoService,
-        mock<EncryptService>(),
-        mockI18nService(),
-        fakeStateProvider,
-      );
+      // Arrange dependencies
+      void setEncryptedState([collection1, collection2]).then(() => {
+        // Act: emit undefined
+        cryptoKeys.next(undefined);
+        keyService.activeUserOrgKeys$ = of(undefined);
+      });
+    });

-      const decryptedCollections = await firstValueFrom(collectionService.decryptedCollections$);
-      expect(decryptedCollections.length).toBe(0);
+    it("Decrypts one time for multiple simultaneous callers", async () => {
+      const decryptedMock: CollectionView[] = [{ id: "col1" }] as CollectionView[];
+      const decryptManySpy = jest
+        .spyOn(collectionService, "decryptMany$")
+        .mockReturnValue(of(decryptedMock));

-      const encryptedCollections = await firstValueFrom(collectionService.encryptedCollections$);
-      expect(encryptedCollections.length).toBe(0);
+      jest
+        .spyOn(collectionService as any, "encryptedCollections$")
+        .mockReturnValue(of([{ id: "enc1" }]));
+      jest.spyOn(keyService, "orgKeys$").mockReturnValue(of({ key: "fake-key" }));
+
+      // Simulate multiple subscribers
+      const obs1 = collectionService.decryptedCollections$(userId);
+      const obs2 = collectionService.decryptedCollections$(userId);
+      const obs3 = collectionService.decryptedCollections$(userId);
+
+      await firstValueFrom(combineLatest([obs1, obs2, obs3]));
+
+      // Expect decryptMany$ to be called only once
+      expect(decryptManySpy).toHaveBeenCalledTimes(1);
    });
  });
+
+  describe("encryptedCollections$", () => {
+    it("emits encrypted collections from state", async () => {
+      // Arrange test data
+      const collection1 = collectionDataFactory();
+      const collection2 = collectionDataFactory();
+
+      // Arrange dependencies
+      await setEncryptedState([collection1, collection2]);
+
+      const result = await firstValueFrom(collectionService.encryptedCollections$(userId));
+
+      expect(result!.length).toBe(2);
+      expect(result).toContainPartialObjects([
+        {
+          id: collection1.id,
+          name: makeEncString("ENC_NAME_" + collection1.id),
+        },
+        {
+          id: collection2.id,
+          name: makeEncString("ENC_NAME_" + collection2.id),
+        },
+      ]);
+    });
+
+    it("handles null collection state", async () => {
+      await setEncryptedState(null);
+
+      const decryptedCollections = await firstValueFrom(
+        collectionService.encryptedCollections$(userId),
+      );
+      expect(decryptedCollections).toBe(null);
+    });
+  });
+
+  describe("upsert", () => {
+    it("upserts to existing collections", async () => {
+      const org1 = Utils.newGuid() as OrganizationId;
+      const orgKey1 = makeSymmetricCryptoKey<OrgKey>(64, 1);
+      const collection1 = collectionDataFactory(org1);
+
+      await setEncryptedState([collection1]);
+      cryptoKeys.next({
+        [collection1.organizationId]: orgKey1,
+      });
+
+      const updatedCollection1 = Object.assign(new CollectionData({} as any), collection1, {
+        name: makeEncString("UPDATED_ENC_NAME_" + collection1.id).encryptedString,
+      });
+
+      await collectionService.upsert(updatedCollection1, userId);
+
+      const encryptedResult = await firstValueFrom(collectionService.encryptedCollections$(userId));
+
+      expect(encryptedResult!.length).toBe(1);
+      expect(encryptedResult).toContainPartialObjects([
+        {
+          id: collection1.id,
+          name: makeEncString("UPDATED_ENC_NAME_" + collection1.id),
+        },
+      ]);
+
+      const decryptedResult = await firstValueFrom(collectionService.decryptedCollections$(userId));
+      expect(decryptedResult.length).toBe(1);
+      expect(decryptedResult).toContainPartialObjects([
+        {
+          id: collection1.id,
+          name: "UPDATED_DEC_NAME_" + collection1.id,
+        },
+      ]);
+    });
+
+    it("upserts to a null state", async () => {
+      const org1 = Utils.newGuid() as OrganizationId;
+      const orgKey1 = makeSymmetricCryptoKey<OrgKey>(64, 1);
+      const collection1 = collectionDataFactory(org1);
+
+      cryptoKeys.next({
+        [collection1.organizationId]: orgKey1,
+      });
+
+      await setEncryptedState(null);
+
+      await collectionService.upsert(collection1, userId);
+
+      const encryptedResult = await firstValueFrom(collectionService.encryptedCollections$(userId));
+      expect(encryptedResult!.length).toBe(1);
+      expect(encryptedResult).toContainPartialObjects([
+        {
+          id: collection1.id,
+          name: makeEncString("ENC_NAME_" + collection1.id),
+        },
+      ]);
+
+      const decryptedResult = await firstValueFrom(collectionService.decryptedCollections$(userId));
+      expect(decryptedResult.length).toBe(1);
+      expect(decryptedResult).toContainPartialObjects([
+        {
+          id: collection1.id,
+          name: "DEC_NAME_" + collection1.id,
+        },
+      ]);
+    });
+  });
+
+  describe("replace", () => {
+    it("replaces all collections", async () => {
+      await setEncryptedState([collectionDataFactory(), collectionDataFactory()]);
+
+      const newCollection3 = collectionDataFactory();
+      await collectionService.replace(
+        {
+          [newCollection3.id]: newCollection3,
+        },
+        userId,
+      );
+
+      const result = await firstValueFrom(collectionService.encryptedCollections$(userId));
+      expect(result!.length).toBe(1);
+      expect(result).toContainPartialObjects([
+        {
+          id: newCollection3.id,
+          name: makeEncString("ENC_NAME_" + newCollection3.id),
+        },
+      ]);
+    });
+  });
+
+  describe("delete", () => {
+    it("deletes a collection", async () => {
+      const collection1 = collectionDataFactory();
+      const collection2 = collectionDataFactory();
+      await setEncryptedState([collection1, collection2]);
+
+      await collectionService.delete([collection1.id], userId);
+
+      const result = await firstValueFrom(collectionService.encryptedCollections$(userId));
+      expect(result!.length).toEqual(1);
+      expect(result![0]).toMatchObject({ id: collection2.id });
+    });
+
+    it("deletes several collections", async () => {
+      const collection1 = collectionDataFactory();
+      const collection2 = collectionDataFactory();
+      const collection3 = collectionDataFactory();
+      await setEncryptedState([collection1, collection2, collection3]);
+
+      await collectionService.delete([collection1.id, collection3.id], userId);
+
+      const result = await firstValueFrom(collectionService.encryptedCollections$(userId));
+      expect(result!.length).toEqual(1);
+      expect(result![0]).toMatchObject({ id: collection2.id });
+    });
+
+    it("handles null collections", async () => {
+      const collection1 = collectionDataFactory();
+      await setEncryptedState(null);
+
+      await collectionService.delete([collection1.id], userId);
+
+      const result = await firstValueFrom(collectionService.encryptedCollections$(userId));
+      expect(result!.length).toEqual(0);
+    });
+  });
+
+  const setEncryptedState = (collectionData: CollectionData[] | null) =>
+    stateProvider.setUserState(
+      ENCRYPTED_COLLECTION_DATA_KEY,
+      collectionData == null ? null : Object.fromEntries(collectionData.map((c) => [c.id, c])),
+      userId,
+    );
+
+  const setDecryptedState = (collectionViews: CollectionView[] | null) =>
+    stateProvider.setUserState(DECRYPTED_COLLECTION_DATA_KEY, collectionViews, userId);
 });

-const mockI18nService = () => {
-  const i18nService = mock<I18nService>();
-  i18nService.collator = null; // this is a mock only, avoid use of this object
-  return i18nService;
-};
-
-const mockStateProvider = () => {
-  const userId = Utils.newGuid() as UserId;
-  return new FakeStateProvider(mockAccountServiceWith(userId));
-};
-
-const mockCryptoService = () => {
-  const keyService = mock<KeyService>();
-  const encryptService = mock<EncryptService>();
-  encryptService.decryptString
-    .calledWith(expect.any(EncString), expect.anything())
-    .mockResolvedValue("DECRYPTED_STRING");
-
-  (window as any).bitwardenContainerService = new ContainerService(keyService, encryptService);
-
-  return keyService;
-};
-
-const collectionDataFactory = (orgId: OrganizationId) => {
+const collectionDataFactory = (orgId?: OrganizationId) => {
  const collection = new CollectionData({} as any);
  collection.id = Utils.newGuid() as CollectionId;
-  collection.organizationId = orgId;
-  collection.name = makeEncString("ENC_STRING").encryptedString;
+  collection.organizationId = orgId ?? (Utils.newGuid() as OrganizationId);
+  collection.name = makeEncString("ENC_NAME_" + collection.id).encryptedString ?? "";

  return collection;
 };
+
+function collectionViewDataFactory(orgId?: OrganizationId): CollectionView {
+  const collectionView = new CollectionView();
+  collectionView.id = Utils.newGuid() as CollectionId;
+  collectionView.organizationId = orgId ?? (Utils.newGuid() as OrganizationId);
+  collectionView.name = "DEC_NAME_" + collectionView.id;
+  return collectionView;
+}
--- a/libs/admin-console/src/common/collections/services/default-collection.service.ts
+++ b/libs/admin-console/src/common/collections/services/default-collection.service.ts
@@ -1,113 +1,193 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
-import { combineLatest, firstValueFrom, map, Observable, of, shareReplay, switchMap } from "rxjs";
-import { Jsonify } from "type-fest";
+import {
+  combineLatest,
+  delayWhen,
+  filter,
+  firstValueFrom,
+  from,
+  map,
+  NEVER,
+  Observable,
+  of,
+  shareReplay,
+  switchMap,
+} from "rxjs";

 import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
-import {
-  ActiveUserState,
-  COLLECTION_DATA,
-  DeriveDefinition,
-  DerivedState,
-  StateProvider,
-  UserKeyDefinition,
-} from "@bitwarden/common/platform/state";
+import { SingleUserState, StateProvider } from "@bitwarden/common/platform/state";
 import { CollectionId, OrganizationId, UserId } from "@bitwarden/common/types/guid";
 import { OrgKey } from "@bitwarden/common/types/key";
 import { TreeNode } from "@bitwarden/common/vault/models/domain/tree-node";
 import { ServiceUtils } from "@bitwarden/common/vault/service-utils";
 import { KeyService } from "@bitwarden/key-management";

-import { CollectionService } from "../abstractions";
+import { CollectionService } from "../abstractions/collection.service";
 import { Collection, CollectionData, CollectionView } from "../models";

-export const ENCRYPTED_COLLECTION_DATA_KEY = UserKeyDefinition.record<CollectionData, CollectionId>(
-  COLLECTION_DATA,
-  "collections",
-  {
-    deserializer: (jsonData: Jsonify<CollectionData>) => CollectionData.fromJSON(jsonData),
-    clearOn: ["logout"],
-  },
-);
-
-const DECRYPTED_COLLECTION_DATA_KEY = new DeriveDefinition<
-  [Record<CollectionId, CollectionData>, Record<OrganizationId, OrgKey>],
-  CollectionView[],
-  { collectionService: DefaultCollectionService }
->(COLLECTION_DATA, "decryptedCollections", {
-  deserializer: (obj) => obj.map((collection) => CollectionView.fromJSON(collection)),
-  derive: async ([collections, orgKeys], { collectionService }) => {
-    if (collections == null) {
-      return [];
-    }
-
-    const data = Object.values(collections).map((c) => new Collection(c));
-    return await collectionService.decryptMany(data, orgKeys);
-  },
-});
+import { DECRYPTED_COLLECTION_DATA_KEY, ENCRYPTED_COLLECTION_DATA_KEY } from "./collection.state";

 const NestingDelimiter = "/";

 export class DefaultCollectionService implements CollectionService {
-  private encryptedCollectionDataState: ActiveUserState<Record<CollectionId, CollectionData>>;
-  encryptedCollections$: Observable<Collection[]>;
-  private decryptedCollectionDataState: DerivedState<CollectionView[]>;
-  decryptedCollections$: Observable<CollectionView[]>;
-
-  decryptedCollectionViews$(ids: CollectionId[]): Observable<CollectionView[]> {
-    return this.decryptedCollections$.pipe(
-      map((collections) => collections.filter((c) => ids.includes(c.id as CollectionId))),
-    );
-  }
-
  constructor(
    private keyService: KeyService,
    private encryptService: EncryptService,
    private i18nService: I18nService,
    protected stateProvider: StateProvider,
-  ) {
-    this.encryptedCollectionDataState = this.stateProvider.getActive(ENCRYPTED_COLLECTION_DATA_KEY);
+  ) {}

-    this.encryptedCollections$ = this.encryptedCollectionDataState.state$.pipe(
+  private collectionViewCache = new Map<UserId, Observable<CollectionView[]>>();
+
+  /**
+   * @returns a SingleUserState for encrypted collection data.
+   */
+  private encryptedState(
+    userId: UserId,
+  ): SingleUserState<Record<CollectionId, CollectionData | null>> {
+    return this.stateProvider.getUser(userId, ENCRYPTED_COLLECTION_DATA_KEY);
+  }
+
+  /**
+   * @returns a SingleUserState for decrypted collection data.
+   */
+  private decryptedState(userId: UserId): SingleUserState<CollectionView[] | null> {
+    return this.stateProvider.getUser(userId, DECRYPTED_COLLECTION_DATA_KEY);
+  }
+
+  encryptedCollections$(userId: UserId): Observable<Collection[] | null> {
+    return this.encryptedState(userId).state$.pipe(
      map((collections) => {
        if (collections == null) {
-          return [];
+          return null;
        }

        return Object.values(collections).map((c) => new Collection(c));
      }),
    );
+  }

-    const encryptedCollectionsWithKeys = this.encryptedCollectionDataState.combinedState$.pipe(
-      switchMap(([userId, collectionData]) =>
-        combineLatest([of(collectionData), this.keyService.orgKeys$(userId)]),
+  decryptedCollections$(userId: UserId): Observable<CollectionView[]> {
+    const cachedResult = this.collectionViewCache.get(userId);
+    if (cachedResult) {
+      return cachedResult;
+    }
+
+    const result$ = this.decryptedState(userId).state$.pipe(
+      switchMap((decryptedState) => {
+        // If decrypted state is already populated, return that
+        if (decryptedState !== null) {
+          return of(decryptedState ?? []);
+        }
+
+        return this.initializeDecryptedState(userId).pipe(switchMap(() => NEVER));
+      }),
+      shareReplay({ bufferSize: 1, refCount: true }),
+    );
+
+    this.collectionViewCache.set(userId, result$);
+    return result$;
+  }
+
+  private initializeDecryptedState(userId: UserId): Observable<CollectionView[]> {
+    return combineLatest([
+      this.encryptedCollections$(userId),
+      this.keyService.orgKeys$(userId).pipe(filter((orgKeys) => !!orgKeys)),
+    ]).pipe(
+      switchMap(([collections, orgKeys]) =>
+        this.decryptMany$(collections, orgKeys).pipe(
+          delayWhen((collections) => this.setDecryptedCollections(collections, userId)),
+        ),
      ),
-      shareReplay({ refCount: false, bufferSize: 1 }),
    );
-
-    this.decryptedCollectionDataState = this.stateProvider.getDerived(
-      encryptedCollectionsWithKeys,
-      DECRYPTED_COLLECTION_DATA_KEY,
-      { collectionService: this },
-    );
-
-    this.decryptedCollections$ = this.decryptedCollectionDataState.state$;
  }

-  async clearActiveUserCache(): Promise<void> {
-    await this.decryptedCollectionDataState.forceValue(null);
+  async upsert(toUpdate: CollectionData, userId: UserId): Promise<void> {
+    if (toUpdate == null) {
+      return;
+    }
+    await this.encryptedState(userId).update((collections) => {
+      if (collections == null) {
+        collections = {};
+      }
+      collections[toUpdate.id] = toUpdate;
+
+      return collections;
+    });
+
+    const decryptedCollections = await firstValueFrom(
+      this.keyService.orgKeys$(userId).pipe(
+        switchMap((orgKeys) => {
+          if (!orgKeys) {
+            throw new Error("No key for this collection's organization.");
+          }
+          return this.decryptMany$([new Collection(toUpdate)], orgKeys);
+        }),
+      ),
+    );
+
+    await this.decryptedState(userId).update((collections) => {
+      if (collections == null) {
+        collections = [];
+      }
+
+      if (!decryptedCollections?.length) {
+        return collections;
+      }
+
+      const decryptedCollection = decryptedCollections[0];
+      const existingIndex = collections.findIndex((collection) => collection.id == toUpdate.id);
+      if (existingIndex >= 0) {
+        collections[existingIndex] = decryptedCollection;
+      } else {
+        collections.push(decryptedCollection);
+      }
+
+      return collections;
+    });
  }

-  async encrypt(model: CollectionView): Promise<Collection> {
+  async replace(collections: Record<CollectionId, CollectionData>, userId: UserId): Promise<void> {
+    await this.encryptedState(userId).update(() => collections);
+    await this.decryptedState(userId).update(() => null);
+  }
+
+  async delete(ids: CollectionId[], userId: UserId): Promise<any> {
+    await this.encryptedState(userId).update((collections) => {
+      if (collections == null) {
+        collections = {};
+      }
+      ids.forEach((i) => {
+        delete collections[i];
+      });
+      return collections;
+    });
+
+    await this.decryptedState(userId).update((collections) => {
+      if (collections == null) {
+        collections = [];
+      }
+      ids.forEach((i) => {
+        if (collections?.length) {
+          collections = collections.filter((c) => c.id != i) ?? [];
+        }
+      });
+      return collections;
+    });
+  }
+
+  async encrypt(model: CollectionView, userId: UserId): Promise<Collection> {
    if (model.organizationId == null) {
      throw new Error("Collection has no organization id.");
    }
-    const key = await this.keyService.getOrgKey(model.organizationId);
-    if (key == null) {
-      throw new Error("No key for this collection's organization.");
-    }
+
+    const key = await firstValueFrom(
+      this.keyService.orgKeys$(userId).pipe(
+        filter((orgKeys) => !!orgKeys),
+        map((k) => k[model.organizationId as OrganizationId]),
+      ),
+    );
+
    const collection = new Collection();
    collection.id = model.id;
    collection.organizationId = model.organizationId;
@@ -117,58 +197,37 @@ export class DefaultCollectionService implements CollectionService {
    return collection;
  }

-  // TODO: this should be private and orgKeys should be required.
+  // TODO: this should be private.
  // See https://bitwarden.atlassian.net/browse/PM-12375
-  async decryptMany(
-    collections: Collection[],
-    orgKeys?: Record<OrganizationId, OrgKey>,
-  ): Promise<CollectionView[]> {
-    if (collections == null || collections.length === 0) {
-      return [];
+  decryptMany$(
+    collections: Collection[] | null,
+    orgKeys: Record<OrganizationId, OrgKey>,
+  ): Observable<CollectionView[]> {
+    if (collections === null || collections.length == 0 || orgKeys === null) {
+      return of([]);
    }
-    const decCollections: CollectionView[] = [];

-    orgKeys ??= await firstValueFrom(this.keyService.activeUserOrgKeys$);
+    const decCollections: Observable<CollectionView>[] = [];

-    const promises: Promise<any>[] = [];
    collections.forEach((collection) => {
-      promises.push(
-        collection
-          .decrypt(orgKeys[collection.organizationId as OrganizationId])
-          .then((c) => decCollections.push(c)),
+      decCollections.push(
+        from(collection.decrypt(orgKeys[collection.organizationId as OrganizationId])),
      );
    });
-    await Promise.all(promises);
-    return decCollections.sort(Utils.getSortFunction(this.i18nService, "name"));
-  }

-  async get(id: string): Promise<Collection> {
-    return (
-      (await firstValueFrom(
-        this.encryptedCollections$.pipe(map((cs) => cs.find((c) => c.id === id))),
-      )) ?? null
+    return combineLatest(decCollections).pipe(
+      map((collections) => collections.sort(Utils.getSortFunction(this.i18nService, "name"))),
    );
  }

-  async getAll(): Promise<Collection[]> {
-    return await firstValueFrom(this.encryptedCollections$);
-  }
-
-  async getAllDecrypted(): Promise<CollectionView[]> {
-    return await firstValueFrom(this.decryptedCollections$);
-  }
-
-  async getAllNested(collections: CollectionView[] = null): Promise<TreeNode<CollectionView>[]> {
-    if (collections == null) {
-      collections = await this.getAllDecrypted();
-    }
+  getAllNested(collections: CollectionView[]): TreeNode<CollectionView>[] {
    const nodes: TreeNode<CollectionView>[] = [];
    collections.forEach((c) => {
      const collectionCopy = new CollectionView();
      collectionCopy.id = c.id;
      collectionCopy.organizationId = c.organizationId;
      const parts = c.name != null ? c.name.replace(/^\/+|\/+$/g, "").split(NestingDelimiter) : [];
-      ServiceUtils.nestedTraverse(nodes, 0, parts, collectionCopy, null, NestingDelimiter);
+      ServiceUtils.nestedTraverse(nodes, 0, parts, collectionCopy, undefined, NestingDelimiter);
    });
    return nodes;
  }
@@ -177,58 +236,23 @@ export class DefaultCollectionService implements CollectionService {
   * @deprecated August 30 2022: Moved to new Vault Filter Service
   * Remove when Desktop and Browser are updated
   */
-  async getNested(id: string): Promise<TreeNode<CollectionView>> {
-    const collections = await this.getAllNested();
-    return ServiceUtils.getTreeNodeObjectFromList(collections, id) as TreeNode<CollectionView>;
+  getNested(collections: CollectionView[], id: string): TreeNode<CollectionView> {
+    const nestedCollections = this.getAllNested(collections);
+    return ServiceUtils.getTreeNodeObjectFromList(
+      nestedCollections,
+      id,
+    ) as TreeNode<CollectionView>;
  }

-  async upsert(toUpdate: CollectionData | CollectionData[]): Promise<void> {
-    if (toUpdate == null) {
-      return;
-    }
-    await this.encryptedCollectionDataState.update((collections) => {
-      if (collections == null) {
-        collections = {};
-      }
-      if (Array.isArray(toUpdate)) {
-        toUpdate.forEach((c) => {
-          collections[c.id] = c;
-        });
-      } else {
-        collections[toUpdate.id] = toUpdate;
-      }
-      return collections;
-    });
-  }
-
-  async replace(collections: Record<CollectionId, CollectionData>, userId: UserId): Promise<void> {
-    await this.stateProvider
-      .getUser(userId, ENCRYPTED_COLLECTION_DATA_KEY)
-      .update(() => collections);
-  }
-
-  async clear(userId?: UserId): Promise<void> {
-    if (userId == null) {
-      await this.encryptedCollectionDataState.update(() => null);
-      await this.decryptedCollectionDataState.forceValue(null);
-    } else {
-      await this.stateProvider.getUser(userId, ENCRYPTED_COLLECTION_DATA_KEY).update(() => null);
-    }
-  }
-
-  async delete(id: CollectionId | CollectionId[]): Promise<any> {
-    await this.encryptedCollectionDataState.update((collections) => {
-      if (collections == null) {
-        collections = {};
-      }
-      if (typeof id === "string") {
-        delete collections[id];
-      } else {
-        (id as CollectionId[]).forEach((i) => {
-          delete collections[i];
-        });
-      }
-      return collections;
-    });
+  /**
+   * Sets the decrypted collections state for a user.
+   * @param collections the decrypted collections
+   * @param userId the user id
+   */
+  private async setDecryptedCollections(
+    collections: CollectionView[],
+    userId: UserId,
+  ): Promise<void> {
+    await this.stateProvider.setUserState(DECRYPTED_COLLECTION_DATA_KEY, collections, userId);
  }
 }
--- a/libs/admin-console/src/common/collections/services/default-vnext-collection.service.spec.ts
+++ b/libs/admin-console/src/common/collections/services/default-vnext-collection.service.spec.ts
@@ -1,345 +0,0 @@
-import { mock, MockProxy } from "jest-mock-extended";
-import { first, firstValueFrom, of, ReplaySubject, takeWhile } from "rxjs";
-
-import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
-import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-string";
-import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
-import { Utils } from "@bitwarden/common/platform/misc/utils";
-import { SymmetricCryptoKey } from "@bitwarden/common/platform/models/domain/symmetric-crypto-key";
-import { ContainerService } from "@bitwarden/common/platform/services/container.service";
-import {
-  FakeStateProvider,
-  makeEncString,
-  makeSymmetricCryptoKey,
-  mockAccountServiceWith,
-} from "@bitwarden/common/spec";
-import { CollectionId, OrganizationId, UserId } from "@bitwarden/common/types/guid";
-import { OrgKey } from "@bitwarden/common/types/key";
-import { KeyService } from "@bitwarden/key-management";
-
-import { CollectionData } from "../models";
-
-import { DefaultvNextCollectionService } from "./default-vnext-collection.service";
-import { ENCRYPTED_COLLECTION_DATA_KEY } from "./vnext-collection.state";
-
-describe("DefaultvNextCollectionService", () => {
-  let keyService: MockProxy<KeyService>;
-  let encryptService: MockProxy<EncryptService>;
-  let i18nService: MockProxy<I18nService>;
-  let stateProvider: FakeStateProvider;
-
-  let userId: UserId;
-
-  let cryptoKeys: ReplaySubject<Record<OrganizationId, OrgKey> | null>;
-
-  let collectionService: DefaultvNextCollectionService;
-
-  beforeEach(() => {
-    userId = Utils.newGuid() as UserId;
-
-    keyService = mock();
-    encryptService = mock();
-    i18nService = mock();
-    stateProvider = new FakeStateProvider(mockAccountServiceWith(userId));
-
-    cryptoKeys = new ReplaySubject(1);
-    keyService.orgKeys$.mockReturnValue(cryptoKeys);
-
-    // Set up mock decryption
-    encryptService.decryptString
-      .calledWith(expect.any(EncString), expect.any(SymmetricCryptoKey))
-      .mockImplementation((encString, key) =>
-        Promise.resolve(encString.data.replace("ENC_", "DEC_")),
-      );
-
-    (window as any).bitwardenContainerService = new ContainerService(keyService, encryptService);
-
-    // Arrange i18nService so that sorting algorithm doesn't throw
-    i18nService.collator = null;
-
-    collectionService = new DefaultvNextCollectionService(
-      keyService,
-      encryptService,
-      i18nService,
-      stateProvider,
-    );
-  });
-
-  afterEach(() => {
-    delete (window as any).bitwardenContainerService;
-  });
-
-  describe("decryptedCollections$", () => {
-    it("emits decrypted collections from state", async () => {
-      // Arrange test data
-      const org1 = Utils.newGuid() as OrganizationId;
-      const orgKey1 = makeSymmetricCryptoKey<OrgKey>(64, 1);
-      const collection1 = collectionDataFactory(org1);
-
-      const org2 = Utils.newGuid() as OrganizationId;
-      const orgKey2 = makeSymmetricCryptoKey<OrgKey>(64, 2);
-      const collection2 = collectionDataFactory(org2);
-
-      // Arrange dependencies
-      await setEncryptedState([collection1, collection2]);
-      cryptoKeys.next({
-        [org1]: orgKey1,
-        [org2]: orgKey2,
-      });
-
-      const result = await firstValueFrom(collectionService.decryptedCollections$(userId));
-
-      // Assert emitted values
-      expect(result.length).toBe(2);
-      expect(result).toContainPartialObjects([
-        {
-          id: collection1.id,
-          name: "DEC_NAME_" + collection1.id,
-        },
-        {
-          id: collection2.id,
-          name: "DEC_NAME_" + collection2.id,
-        },
-      ]);
-
-      // Assert that the correct org keys were used for each encrypted string
-      // This should be replaced with decryptString when the platform PR (https://github.com/bitwarden/clients/pull/14544) is merged
-      expect(encryptService.decryptString).toHaveBeenCalledWith(
-        expect.objectContaining(new EncString(collection1.name)),
-        orgKey1,
-      );
-      expect(encryptService.decryptString).toHaveBeenCalledWith(
-        expect.objectContaining(new EncString(collection2.name)),
-        orgKey2,
-      );
-    });
-
-    it("handles null collection state", async () => {
-      // Arrange dependencies
-      await setEncryptedState(null);
-      cryptoKeys.next({});
-
-      const encryptedCollections = await firstValueFrom(
-        collectionService.encryptedCollections$(userId),
-      );
-
-      expect(encryptedCollections.length).toBe(0);
-    });
-
-    it("handles undefined orgKeys", (done) => {
-      // Arrange test data
-      const org1 = Utils.newGuid() as OrganizationId;
-      const collection1 = collectionDataFactory(org1);
-
-      const org2 = Utils.newGuid() as OrganizationId;
-      const collection2 = collectionDataFactory(org2);
-
-      // Emit a non-null value after the first undefined value has propagated
-      // This will cause the collections to emit, calling done()
-      cryptoKeys.pipe(first()).subscribe((val) => {
-        cryptoKeys.next({});
-      });
-
-      collectionService
-        .decryptedCollections$(userId)
-        .pipe(takeWhile((val) => val.length != 2))
-        .subscribe({ complete: () => done() });
-
-      // Arrange dependencies
-      void setEncryptedState([collection1, collection2]).then(() => {
-        // Act: emit undefined
-        cryptoKeys.next(undefined);
-        keyService.activeUserOrgKeys$ = of(undefined);
-      });
-    });
-  });
-
-  describe("encryptedCollections$", () => {
-    it("emits encrypted collections from state", async () => {
-      // Arrange test data
-      const collection1 = collectionDataFactory();
-      const collection2 = collectionDataFactory();
-
-      // Arrange dependencies
-      await setEncryptedState([collection1, collection2]);
-
-      const result = await firstValueFrom(collectionService.encryptedCollections$(userId));
-
-      expect(result.length).toBe(2);
-      expect(result).toContainPartialObjects([
-        {
-          id: collection1.id,
-          name: makeEncString("ENC_NAME_" + collection1.id),
-        },
-        {
-          id: collection2.id,
-          name: makeEncString("ENC_NAME_" + collection2.id),
-        },
-      ]);
-    });
-
-    it("handles null collection state", async () => {
-      await setEncryptedState(null);
-
-      const decryptedCollections = await firstValueFrom(
-        collectionService.encryptedCollections$(userId),
-      );
-      expect(decryptedCollections.length).toBe(0);
-    });
-  });
-
-  describe("upsert", () => {
-    it("upserts to existing collections", async () => {
-      const collection1 = collectionDataFactory();
-      const collection2 = collectionDataFactory();
-
-      await setEncryptedState([collection1, collection2]);
-
-      const updatedCollection1 = Object.assign(new CollectionData({} as any), collection1, {
-        name: makeEncString("UPDATED_ENC_NAME_" + collection1.id).encryptedString,
-      });
-      const newCollection3 = collectionDataFactory();
-
-      await collectionService.upsert([updatedCollection1, newCollection3], userId);
-
-      const result = await firstValueFrom(collectionService.encryptedCollections$(userId));
-      expect(result.length).toBe(3);
-      expect(result).toContainPartialObjects([
-        {
-          id: collection1.id,
-          name: makeEncString("UPDATED_ENC_NAME_" + collection1.id),
-        },
-        {
-          id: collection2.id,
-          name: makeEncString("ENC_NAME_" + collection2.id),
-        },
-        {
-          id: newCollection3.id,
-          name: makeEncString("ENC_NAME_" + newCollection3.id),
-        },
-      ]);
-    });
-
-    it("upserts to a null state", async () => {
-      const collection1 = collectionDataFactory();
-
-      await setEncryptedState(null);
-
-      await collectionService.upsert(collection1, userId);
-
-      const result = await firstValueFrom(collectionService.encryptedCollections$(userId));
-      expect(result.length).toBe(1);
-      expect(result).toContainPartialObjects([
-        {
-          id: collection1.id,
-          name: makeEncString("ENC_NAME_" + collection1.id),
-        },
-      ]);
-    });
-  });
-
-  describe("replace", () => {
-    it("replaces all collections", async () => {
-      await setEncryptedState([collectionDataFactory(), collectionDataFactory()]);
-
-      const newCollection3 = collectionDataFactory();
-      await collectionService.replace(
-        {
-          [newCollection3.id]: newCollection3,
-        },
-        userId,
-      );
-
-      const result = await firstValueFrom(collectionService.encryptedCollections$(userId));
-      expect(result.length).toBe(1);
-      expect(result).toContainPartialObjects([
-        {
-          id: newCollection3.id,
-          name: makeEncString("ENC_NAME_" + newCollection3.id),
-        },
-      ]);
-    });
-  });
-
-  it("clearDecryptedState", async () => {
-    await setEncryptedState([collectionDataFactory(), collectionDataFactory()]);
-
-    await collectionService.clearDecryptedState(userId);
-
-    // Encrypted state remains
-    const encryptedState = await firstValueFrom(collectionService.encryptedCollections$(userId));
-    expect(encryptedState.length).toEqual(2);
-
-    // Decrypted state is cleared
-    const decryptedState = await firstValueFrom(collectionService.decryptedCollections$(userId));
-    expect(decryptedState.length).toEqual(0);
-  });
-
-  it("clear", async () => {
-    await setEncryptedState([collectionDataFactory(), collectionDataFactory()]);
-    cryptoKeys.next({});
-
-    await collectionService.clear(userId);
-
-    // Encrypted state is cleared
-    const encryptedState = await firstValueFrom(collectionService.encryptedCollections$(userId));
-    expect(encryptedState.length).toEqual(0);
-
-    // Decrypted state is cleared
-    const decryptedState = await firstValueFrom(collectionService.decryptedCollections$(userId));
-    expect(decryptedState.length).toEqual(0);
-  });
-
-  describe("delete", () => {
-    it("deletes a collection", async () => {
-      const collection1 = collectionDataFactory();
-      const collection2 = collectionDataFactory();
-      await setEncryptedState([collection1, collection2]);
-
-      await collectionService.delete(collection1.id, userId);
-
-      const result = await firstValueFrom(collectionService.encryptedCollections$(userId));
-      expect(result.length).toEqual(1);
-      expect(result[0]).toMatchObject({ id: collection2.id });
-    });
-
-    it("deletes several collections", async () => {
-      const collection1 = collectionDataFactory();
-      const collection2 = collectionDataFactory();
-      const collection3 = collectionDataFactory();
-      await setEncryptedState([collection1, collection2, collection3]);
-
-      await collectionService.delete([collection1.id, collection3.id], userId);
-
-      const result = await firstValueFrom(collectionService.encryptedCollections$(userId));
-      expect(result.length).toEqual(1);
-      expect(result[0]).toMatchObject({ id: collection2.id });
-    });
-
-    it("handles null collections", async () => {
-      const collection1 = collectionDataFactory();
-      await setEncryptedState(null);
-
-      await collectionService.delete(collection1.id, userId);
-
-      const result = await firstValueFrom(collectionService.encryptedCollections$(userId));
-      expect(result.length).toEqual(0);
-    });
-  });
-
-  const setEncryptedState = (collectionData: CollectionData[] | null) =>
-    stateProvider.setUserState(
-      ENCRYPTED_COLLECTION_DATA_KEY,
-      collectionData == null ? null : Object.fromEntries(collectionData.map((c) => [c.id, c])),
-      userId,
-    );
-});
-
-const collectionDataFactory = (orgId?: OrganizationId) => {
-  const collection = new CollectionData({} as any);
-  collection.id = Utils.newGuid() as CollectionId;
-  collection.organizationId = orgId ?? (Utils.newGuid() as OrganizationId);
-  collection.name = makeEncString("ENC_NAME_" + collection.id).encryptedString;
-
-  return collection;
-};
--- a/libs/admin-console/src/common/collections/services/default-vnext-collection.service.ts
+++ b/libs/admin-console/src/common/collections/services/default-vnext-collection.service.ts
@@ -1,194 +0,0 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
-import { combineLatest, filter, firstValueFrom, map } from "rxjs";
-
-import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
-import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
-import { Utils } from "@bitwarden/common/platform/misc/utils";
-import { StateProvider, DerivedState } from "@bitwarden/common/platform/state";
-import { CollectionId, OrganizationId, UserId } from "@bitwarden/common/types/guid";
-import { OrgKey } from "@bitwarden/common/types/key";
-import { TreeNode } from "@bitwarden/common/vault/models/domain/tree-node";
-import { ServiceUtils } from "@bitwarden/common/vault/service-utils";
-import { KeyService } from "@bitwarden/key-management";
-
-import { vNextCollectionService } from "../abstractions/vnext-collection.service";
-import { Collection, CollectionData, CollectionView } from "../models";
-
-import {
-  DECRYPTED_COLLECTION_DATA_KEY,
-  ENCRYPTED_COLLECTION_DATA_KEY,
-} from "./vnext-collection.state";
-
-const NestingDelimiter = "/";
-
-export class DefaultvNextCollectionService implements vNextCollectionService {
-  constructor(
-    private keyService: KeyService,
-    private encryptService: EncryptService,
-    private i18nService: I18nService,
-    protected stateProvider: StateProvider,
-  ) {}
-
-  encryptedCollections$(userId: UserId) {
-    return this.encryptedState(userId).state$.pipe(
-      map((collections) => {
-        if (collections == null) {
-          return [];
-        }
-
-        return Object.values(collections).map((c) => new Collection(c));
-      }),
-    );
-  }
-
-  decryptedCollections$(userId: UserId) {
-    return this.decryptedState(userId).state$.pipe(map((collections) => collections ?? []));
-  }
-
-  async upsert(toUpdate: CollectionData | CollectionData[], userId: UserId): Promise<void> {
-    if (toUpdate == null) {
-      return;
-    }
-    await this.encryptedState(userId).update((collections) => {
-      if (collections == null) {
-        collections = {};
-      }
-      if (Array.isArray(toUpdate)) {
-        toUpdate.forEach((c) => {
-          collections[c.id] = c;
-        });
-      } else {
-        collections[toUpdate.id] = toUpdate;
-      }
-      return collections;
-    });
-  }
-
-  async replace(collections: Record<CollectionId, CollectionData>, userId: UserId): Promise<void> {
-    await this.encryptedState(userId).update(() => collections);
-  }
-
-  async clearDecryptedState(userId: UserId): Promise<void> {
-    if (userId == null) {
-      throw new Error("User ID is required.");
-    }
-
-    await this.decryptedState(userId).forceValue([]);
-  }
-
-  async clear(userId: UserId): Promise<void> {
-    await this.encryptedState(userId).update(() => null);
-    // This will propagate from the encrypted state update, but by doing it explicitly
-    // the promise doesn't resolve until the update is complete.
-    await this.decryptedState(userId).forceValue([]);
-  }
-
-  async delete(id: CollectionId | CollectionId[], userId: UserId): Promise<any> {
-    await this.encryptedState(userId).update((collections) => {
-      if (collections == null) {
-        collections = {};
-      }
-      if (typeof id === "string") {
-        delete collections[id];
-      } else {
-        (id as CollectionId[]).forEach((i) => {
-          delete collections[i];
-        });
-      }
-      return collections;
-    });
-  }
-
-  async encrypt(model: CollectionView): Promise<Collection> {
-    if (model.organizationId == null) {
-      throw new Error("Collection has no organization id.");
-    }
-    const key = await this.keyService.getOrgKey(model.organizationId);
-    if (key == null) {
-      throw new Error("No key for this collection's organization.");
-    }
-    const collection = new Collection();
-    collection.id = model.id;
-    collection.organizationId = model.organizationId;
-    collection.readOnly = model.readOnly;
-    collection.externalId = model.externalId;
-    collection.name = await this.encryptService.encryptString(model.name, key);
-    return collection;
-  }
-
-  // TODO: this should be private and orgKeys should be required.
-  // See https://bitwarden.atlassian.net/browse/PM-12375
-  async decryptMany(
-    collections: Collection[],
-    orgKeys?: Record<OrganizationId, OrgKey> | null,
-  ): Promise<CollectionView[]> {
-    if (collections == null || collections.length === 0) {
-      return [];
-    }
-    const decCollections: CollectionView[] = [];
-
-    orgKeys ??= await firstValueFrom(this.keyService.activeUserOrgKeys$);
-
-    const promises: Promise<any>[] = [];
-    collections.forEach((collection) => {
-      promises.push(
-        collection
-          .decrypt(orgKeys[collection.organizationId as OrganizationId])
-          .then((c) => decCollections.push(c)),
-      );
-    });
-    await Promise.all(promises);
-    return decCollections.sort(Utils.getSortFunction(this.i18nService, "name"));
-  }
-
-  getAllNested(collections: CollectionView[]): TreeNode<CollectionView>[] {
-    const nodes: TreeNode<CollectionView>[] = [];
-    collections.forEach((c) => {
-      const collectionCopy = new CollectionView();
-      collectionCopy.id = c.id;
-      collectionCopy.organizationId = c.organizationId;
-      const parts = c.name != null ? c.name.replace(/^\/+|\/+$/g, "").split(NestingDelimiter) : [];
-      ServiceUtils.nestedTraverse(nodes, 0, parts, collectionCopy, undefined, NestingDelimiter);
-    });
-    return nodes;
-  }
-
-  /**
-   * @deprecated August 30 2022: Moved to new Vault Filter Service
-   * Remove when Desktop and Browser are updated
-   */
-  getNested(collections: CollectionView[], id: string): TreeNode<CollectionView> {
-    const nestedCollections = this.getAllNested(collections);
-    return ServiceUtils.getTreeNodeObjectFromList(
-      nestedCollections,
-      id,
-    ) as TreeNode<CollectionView>;
-  }
-
-  /**
-   * @returns a SingleUserState for encrypted collection data.
-   */
-  private encryptedState(userId: UserId) {
-    return this.stateProvider.getUser(userId, ENCRYPTED_COLLECTION_DATA_KEY);
-  }
-
-  /**
-   * @returns a SingleUserState for decrypted collection data.
-   */
-  private decryptedState(userId: UserId): DerivedState<CollectionView[]> {
-    const encryptedCollectionsWithKeys$ = combineLatest([
-      this.encryptedCollections$(userId),
-      // orgKeys$ can emit null during brief moments on unlock and lock/logout, we want to ignore those intermediate states
-      this.keyService.orgKeys$(userId).pipe(filter((orgKeys) => orgKeys != null)),
-    ]);
-
-    return this.stateProvider.getDerived(
-      encryptedCollectionsWithKeys$,
-      DECRYPTED_COLLECTION_DATA_KEY,
-      {
-        collectionService: this,
-      },
-    );
-  }
-}
--- a/libs/admin-console/src/common/collections/services/vnext-collection.state.ts
+++ b/libs/admin-console/src/common/collections/services/vnext-collection.state.ts
@@ -1,36 +0,0 @@
-import { Jsonify } from "type-fest";
-
-import {
-  COLLECTION_DATA,
-  DeriveDefinition,
-  UserKeyDefinition,
-} from "@bitwarden/common/platform/state";
-import { CollectionId, OrganizationId } from "@bitwarden/common/types/guid";
-import { OrgKey } from "@bitwarden/common/types/key";
-
-import { vNextCollectionService } from "../abstractions/vnext-collection.service";
-import { Collection, CollectionData, CollectionView } from "../models";
-
-export const ENCRYPTED_COLLECTION_DATA_KEY = UserKeyDefinition.record<CollectionData, CollectionId>(
-  COLLECTION_DATA,
-  "collections",
-  {
-    deserializer: (jsonData: Jsonify<CollectionData>) => CollectionData.fromJSON(jsonData),
-    clearOn: ["logout"],
-  },
-);
-
-export const DECRYPTED_COLLECTION_DATA_KEY = new DeriveDefinition<
-  [Collection[], Record<OrganizationId, OrgKey> | null],
-  CollectionView[],
-  { collectionService: vNextCollectionService }
->(COLLECTION_DATA, "decryptedCollections", {
-  deserializer: (obj) => obj.map((collection) => CollectionView.fromJSON(collection)),
-  derive: async ([collections, orgKeys], { collectionService }) => {
-    if (collections == null) {
-      return [];
-    }
-
-    return await collectionService.decryptMany(collections, orgKeys);
-  },
-});
--- a/libs/angular/src/auth/guards/lock.guard.spec.ts
+++ b/libs/angular/src/auth/guards/lock.guard.spec.ts
@@ -26,7 +26,6 @@ import { lockGuard } from "./lock.guard";
 interface SetupParams {
  authStatus: AuthenticationStatus;
  canLock?: boolean;
-  isLegacyUser?: boolean;
  clientType?: ClientType;
  everHadUserKey?: boolean;
  supportsDeviceTrust?: boolean;
@@ -43,7 +42,6 @@ describe("lockGuard", () => {
    vaultTimeoutSettingsService.canLock.mockResolvedValue(setupParams.canLock);

    const keyService: MockProxy<KeyService> = mock<KeyService>();
-    keyService.isLegacyUser.mockResolvedValue(setupParams.isLegacyUser);
    keyService.everHadUserKey$.mockReturnValue(of(setupParams.everHadUserKey));

    const platformUtilService: MockProxy<PlatformUtilsService> = mock<PlatformUtilsService>();
@@ -155,37 +153,10 @@ describe("lockGuard", () => {
    expect(router.url).toBe("/");
  });

-  it("should log user out if they are a legacy user on a desktop client", async () => {
-    const { router, messagingService } = setup({
-      authStatus: AuthenticationStatus.Locked,
-      canLock: true,
-      isLegacyUser: true,
-      clientType: ClientType.Desktop,
-    });
-
-    await router.navigate(["lock"]);
-    expect(router.url).toBe("/");
-    expect(messagingService.send).toHaveBeenCalledWith("logout");
-  });
-
-  it("should log user out if they are a legacy user on a browser extension client", async () => {
-    const { router, messagingService } = setup({
-      authStatus: AuthenticationStatus.Locked,
-      canLock: true,
-      isLegacyUser: true,
-      clientType: ClientType.Browser,
-    });
-
-    await router.navigate(["lock"]);
-    expect(router.url).toBe("/");
-    expect(messagingService.send).toHaveBeenCalledWith("logout");
-  });
-
  it("should allow navigation to the lock route when device trust is supported, the user has a MP, and the user is coming from the login-initiated page", async () => {
    const { router } = setup({
      authStatus: AuthenticationStatus.Locked,
      canLock: true,
-      isLegacyUser: false,
      clientType: ClientType.Web,
      everHadUserKey: false,
      supportsDeviceTrust: true,
@@ -213,7 +184,6 @@ describe("lockGuard", () => {
    const { router } = setup({
      authStatus: AuthenticationStatus.Locked,
      canLock: true,
-      isLegacyUser: false,
      clientType: ClientType.Web,
      everHadUserKey: false,
      supportsDeviceTrust: true,
--- a/libs/angular/src/auth/guards/lock.guard.ts
+++ b/libs/angular/src/auth/guards/lock.guard.ts
@@ -13,7 +13,6 @@ import { UserVerificationService } from "@bitwarden/common/auth/abstractions/use
 import { AuthenticationStatus } from "@bitwarden/common/auth/enums/authentication-status";
 import { DeviceTrustServiceAbstraction } from "@bitwarden/common/key-management/device-trust/abstractions/device-trust.service.abstraction";
 import { VaultTimeoutSettingsService } from "@bitwarden/common/key-management/vault-timeout";
-import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
 import { KeyService } from "@bitwarden/key-management";

 /**
@@ -31,7 +30,6 @@ export function lockGuard(): CanActivateFn {
    const authService = inject(AuthService);
    const keyService = inject(KeyService);
    const deviceTrustService = inject(DeviceTrustServiceAbstraction);
-    const messagingService = inject(MessagingService);
    const router = inject(Router);
    const userVerificationService = inject(UserVerificationService);
    const vaultTimeoutSettingsService = inject(VaultTimeoutSettingsService);
@@ -56,11 +54,6 @@ export function lockGuard(): CanActivateFn {
      return false;
    }

-    if (await keyService.isLegacyUser()) {
-      messagingService.send("logout");
-      return false;
-    }
-
    // User is authN and in locked state.

    const tdeEnabled = await firstValueFrom(deviceTrustService.supportsDeviceTrust$);
--- a/libs/angular/src/auth/password-management/change-password/change-password.component.ts
+++ b/libs/angular/src/auth/password-management/change-password/change-password.component.ts
@@ -178,6 +178,9 @@ export class ChangePasswordComponent implements OnInit {

        // TODO: PM-23515 eventually use the logout service instead of messaging service once it is available without circular dependencies
        this.messagingService.send("logout");
+
+        // Close the popout if we are in a browser extension popout.
+        this.changePasswordService.closeBrowserExtensionPopout?.();
      }
    } catch (error) {
      this.logService.error(error);
--- a/libs/angular/src/auth/password-management/change-password/change-password.service.abstraction.ts
+++ b/libs/angular/src/auth/password-management/change-password/change-password.service.abstraction.ts
@@ -59,4 +59,10 @@ export abstract class ChangePasswordService {
   * - Currently only used on the web change password service.
   */
  clearDeeplinkState?: () => Promise<void>;
+
+  /**
+   * Optional method that closes the browser extension popout if in a popout
+   * If not in a popout, does nothing.
+   */
+  abstract closeBrowserExtensionPopout?(): void;
 }
--- a/libs/angular/src/vault/services/custom-nudges-services/empty-vault-nudge.service.ts
+++ b/libs/angular/src/vault/services/custom-nudges-services/empty-vault-nudge.service.ts
@@ -27,7 +27,7 @@ export class EmptyVaultNudgeService extends DefaultSingleNudgeService {
      this.getNudgeStatus$(nudgeType, userId),
      this.cipherService.cipherListViews$(userId),
      this.organizationService.organizations$(userId),
-      this.collectionService.decryptedCollections$,
+      this.collectionService.decryptedCollections$(userId),
    ]).pipe(
      switchMap(([nudgeStatus, ciphers, orgs, collections]) => {
        const vaultHasContents = !(ciphers == null || ciphers.length === 0);
--- a/libs/angular/src/vault/services/custom-nudges-services/vault-settings-import-nudge.service.ts
+++ b/libs/angular/src/vault/services/custom-nudges-services/vault-settings-import-nudge.service.ts
@@ -27,7 +27,7 @@ export class VaultSettingsImportNudgeService extends DefaultSingleNudgeService {
      this.getNudgeStatus$(nudgeType, userId),
      this.cipherService.cipherViews$(userId),
      this.organizationService.organizations$(userId),
-      this.collectionService.decryptedCollections$,
+      this.collectionService.decryptedCollections$(userId),
    ]).pipe(
      switchMap(([nudgeStatus, ciphers, orgs, collections]) => {
        const vaultHasMoreThanOneItem = (ciphers?.length ?? 0) > 1;
--- a/libs/angular/src/vault/services/nudges.service.ts
+++ b/libs/angular/src/vault/services/nudges.service.ts
@@ -160,7 +160,6 @@ export class NudgesService {
  hasActiveBadges$(userId: UserId): Observable<boolean> {
    // Add more nudge types here if they have the settings badge feature
    const nudgeTypes = [
-      NudgeType.AccountSecurity,
      NudgeType.EmptyVaultNudge,
      NudgeType.DownloadBitwarden,
      NudgeType.AutofillNudge,
--- a/libs/angular/src/vault/vault-filter/services/vault-filter.service.ts
+++ b/libs/angular/src/vault/vault-filter/services/vault-filter.service.ts
@@ -109,7 +109,12 @@ export class VaultFilterService implements DeprecatedVaultFilterServiceAbstracti
  }

  async buildCollections(organizationId?: string): Promise<DynamicTreeNode<CollectionView>> {
-    const storedCollections = await this.collectionService.getAllDecrypted();
+    const storedCollections = await firstValueFrom(
+      this.accountService.activeAccount$.pipe(
+        getUserId,
+        switchMap((userId) => this.collectionService.decryptedCollections$(userId)),
+      ),
+    );
    const orgs = await this.buildOrganizations();
    const defaulCollectionsFlagEnabled = await this.configService.getFeatureFlag(
      FeatureFlag.CreateDefaultLocation,
--- a/libs/auth/src/common/login-strategies/login.strategy.ts
+++ b/libs/auth/src/common/login-strategies/login.strategy.ts
@@ -325,7 +325,7 @@ export abstract class LoginStrategy {

  protected async createKeyPairForOldAccount(userId: UserId) {
    try {
-      const userKey = await this.keyService.getUserKeyWithLegacySupport(userId);
+      const userKey = await this.keyService.getUserKey(userId);
      const [publicKey, privateKey] = await this.keyService.makeKeyPair(userKey);
      if (!privateKey.encryptedString) {
        throw new Error("Failed to create encrypted private key");
--- a/libs/common/src/key-management/vault-timeout/services/vault-timeout.service.ts
+++ b/libs/common/src/key-management/vault-timeout/services/vault-timeout.service.ts
@@ -143,10 +143,6 @@ export class VaultTimeoutService implements VaultTimeoutServiceAbstraction {
      ),
    );

-    if (userId == null || userId === currentUserId) {
-      await this.collectionService.clearActiveUserCache();
-    }
-
    await this.searchService.clearIndex(lockingUserId);

    await this.folderService.clearDecryptedFolderState(lockingUserId);
--- a/libs/common/src/platform/misc/rxjs-operators.ts
+++ b/libs/common/src/platform/misc/rxjs-operators.ts
@@ -13,9 +13,9 @@ export const getById = <TId, T extends { id: TId }>(id: TId) =>
 * @param id The IDs of the objects to return.
 * @returns An array containing objects with matching IDs, or an empty array if there are no matching objects.
 */
-export const getByIds = <TId, T extends { id: TId }>(ids: TId[]) => {
-  const idSet = new Set(ids);
+export const getByIds = <TId, T extends { id: TId | undefined }>(ids: TId[]) => {
+  const idSet = new Set(ids.filter((id) => id != null));
  return map<T[], T[]>((objects) => {
-    return objects.filter((o) => idSet.has(o.id));
+    return objects.filter((o) => o.id && idSet.has(o.id));
  });
 };
--- a/libs/common/src/platform/models/domain/domain-base.ts
+++ b/libs/common/src/platform/models/domain/domain-base.ts
@@ -14,7 +14,7 @@ export type DecryptedObject<
 > = Record<TDecryptedKeys, string> & Omit<TEncryptedObject, TDecryptedKeys>;

 // extracts shared keys from the domain and view types
-type EncryptableKeys<D extends Domain, V extends View> = (keyof D &
+export type EncryptableKeys<D extends Domain, V extends View> = (keyof D &
  ConditionalKeys<D, EncString | null>) &
  (keyof V & ConditionalKeys<V, string | null>);

--- a/libs/common/src/platform/state/state-definitions.ts
+++ b/libs/common/src/platform/state/state-definitions.ts
@@ -164,9 +164,13 @@ export const SEND_ACCESS_AUTH_MEMORY = new StateDefinition("sendAccessAuth", "me

 // Vault

-export const COLLECTION_DATA = new StateDefinition("collection", "disk", {
+export const COLLECTION_DISK = new StateDefinition("collection", "disk", {
  web: "memory",
 });
+export const COLLECTION_MEMORY = new StateDefinition("decryptedCollections", "memory", {
+  browser: "memory-large-object",
+});
+
 export const FOLDER_DISK = new StateDefinition("folder", "disk", { web: "memory" });
 export const FOLDER_MEMORY = new StateDefinition("decryptedFolders", "memory", {
  browser: "memory-large-object",
--- a/libs/common/src/platform/sync/core-sync.service.ts
+++ b/libs/common/src/platform/sync/core-sync.service.ts
@@ -172,7 +172,11 @@ export abstract class CoreSyncService implements SyncService {
          notification.collectionIds != null &&
          notification.collectionIds.length > 0
        ) {
-          const collections = await this.collectionService.getAll();
+          const collections = await firstValueFrom(
+            this.collectionService
+              .encryptedCollections$(userId)
+              .pipe(map((collections) => collections ?? [])),
+          );
          if (collections != null) {
            for (let i = 0; i < collections.length; i++) {
              if (notification.collectionIds.indexOf(collections[i].id) > -1) {
--- a/libs/common/src/vault/services/cipher-authorization.service.spec.ts
+++ b/libs/common/src/vault/services/cipher-authorization.service.spec.ts
@@ -119,7 +119,7 @@ describe("CipherAuthorizationService", () => {

      cipherAuthorizationService.canRestoreCipher$(cipher, false).subscribe((result) => {
        expect(result).toBe(false);
-        expect(mockCollectionService.decryptedCollectionViews$).not.toHaveBeenCalled();
+        expect(mockCollectionService.decryptedCollections$).not.toHaveBeenCalled();
        done();
      });
    });
@@ -133,7 +133,7 @@ describe("CipherAuthorizationService", () => {

      cipherAuthorizationService.canRestoreCipher$(cipher, false).subscribe((result) => {
        expect(result).toBe(true);
-        expect(mockCollectionService.decryptedCollectionViews$).not.toHaveBeenCalled();
+        expect(mockCollectionService.decryptedCollections$).not.toHaveBeenCalled();
        done();
      });
    });
@@ -198,6 +198,7 @@ describe("CipherAuthorizationService", () => {

      cipherAuthorizationService.canDeleteCipher$(cipher, false).subscribe((result) => {
        expect(result).toBe(false);
+        expect(mockCollectionService.decryptedCollections$).not.toHaveBeenCalled();
        done();
      });
    });
@@ -251,7 +252,7 @@ describe("CipherAuthorizationService", () => {
          createMockCollection("col1", true),
          createMockCollection("col2", false),
        ];
-        mockCollectionService.decryptedCollectionViews$.mockReturnValue(
+        mockCollectionService.decryptedCollections$.mockReturnValue(
          of(allCollections as CollectionView[]),
        );

@@ -270,7 +271,7 @@ describe("CipherAuthorizationService", () => {
          createMockCollection("col1", false),
          createMockCollection("col2", false),
        ];
-        mockCollectionService.decryptedCollectionViews$.mockReturnValue(
+        mockCollectionService.decryptedCollections$.mockReturnValue(
          of(allCollections as CollectionView[]),
        );

--- a/libs/common/src/vault/services/cipher-authorization.service.ts
+++ b/libs/common/src/vault/services/cipher-authorization.service.ts
@@ -1,11 +1,11 @@
-import { map, Observable, of, shareReplay, switchMap } from "rxjs";
+import { combineLatest, map, Observable, of, shareReplay, switchMap } from "rxjs";

 // This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
 // eslint-disable-next-line no-restricted-imports
 import { CollectionService } from "@bitwarden/admin-console/common";
 import { OrganizationService } from "@bitwarden/common/admin-console/abstractions/organization/organization.service.abstraction";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
-import { CollectionId } from "@bitwarden/common/types/guid";
+import { getByIds } from "@bitwarden/common/platform/misc";

 import { getUserId } from "../../auth/services/account.service";
 import { CipherLike } from "../types/cipher-like";
@@ -125,8 +125,11 @@ export class DefaultCipherAuthorizationService implements CipherAuthorizationSer
      return of(true);
    }

-    return this.organization$(cipher).pipe(
-      switchMap((organization) => {
+    return combineLatest([
+      this.organization$(cipher),
+      this.accountService.activeAccount$.pipe(getUserId),
+    ]).pipe(
+      switchMap(([organization, userId]) => {
        // Admins and custom users can always clone when in the Admin Console
        if (
          isAdminConsoleAction &&
@@ -136,9 +139,10 @@ export class DefaultCipherAuthorizationService implements CipherAuthorizationSer
          return of(true);
        }

-        return this.collectionService
-          .decryptedCollectionViews$(cipher.collectionIds as CollectionId[])
-          .pipe(map((allCollections) => allCollections.some((collection) => collection.manage)));
+        return this.collectionService.decryptedCollections$(userId).pipe(
+          getByIds(cipher.collectionIds),
+          map((allCollections) => allCollections.some((collection) => collection.manage)),
+        );
      }),
      shareReplay({ bufferSize: 1, refCount: false }),
    );
--- a/libs/components/tailwind.config.base.js
+++ b/libs/components/tailwind.config.base.js
@@ -155,6 +155,7 @@ module.exports = {
        "90vw": "90vw",
      }),
      fontSize: {
+        xs: [".8125rem", "1rem"],
        "3xl": ["1.75rem", "2rem"],
      },
    },
--- a/libs/importer/src/components/import.component.ts
+++ b/libs/importer/src/components/import.component.ts
@@ -100,6 +100,7 @@ const safeProviders: SafeProvider[] = [
      PinServiceAbstraction,
      AccountService,
      SdkService,
+      RestrictedItemTypesService,
    ],
  }),
 ];
@@ -299,7 +300,7 @@ export class ImportComponent implements OnInit, OnDestroy, AfterViewInit {
    // Retrieve all organizations a user is a member of and has collections they can manage
    const userId = await firstValueFrom(getUserId(this.accountService.activeAccount$));
    this.organizations$ = this.organizationService.memberOrganizations$(userId).pipe(
-      combineLatestWith(this.collectionService.decryptedCollections$),
+      combineLatestWith(this.collectionService.decryptedCollections$(userId)),
      map(([organizations, collections]) =>
        organizations
          .filter((org) => collections.some((c) => c.organizationId === org.id && c.manage))
@@ -317,15 +318,15 @@ export class ImportComponent implements OnInit, OnDestroy, AfterViewInit {
        }

        if (value) {
-          this.collections$ = Utils.asyncToObservable(() =>
-            this.collectionService
-              .getAllDecrypted()
-              .then((decryptedCollections) =>
+          this.collections$ = this.collectionService
+            .decryptedCollections$(userId)
+            .pipe(
+              map((decryptedCollections) =>
                decryptedCollections
                  .filter((c2) => c2.organizationId === value && c2.manage)
                  .sort(Utils.getSortFunction(this.i18nService, "name")),
              ),
-          );
+            );
        }
      });
    this.formGroup.controls.vaultSelector.setValue("myVault");
--- a/libs/importer/src/services/import.service.spec.ts
+++ b/libs/importer/src/services/import.service.spec.ts
@@ -13,6 +13,7 @@ import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.servi
 import { FolderService } from "@bitwarden/common/vault/abstractions/folder/folder.service.abstraction";
 import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view";
 import { FolderView } from "@bitwarden/common/vault/models/view/folder.view";
+import { RestrictedItemTypesService } from "@bitwarden/common/vault/services/restricted-item-types.service";
 import { KeyService } from "@bitwarden/key-management";

 import { BitwardenPasswordProtectedImporter } from "../importers/bitwarden/bitwarden-password-protected-importer";
@@ -34,6 +35,7 @@ describe("ImportService", () => {
  let pinService: MockProxy<PinServiceAbstraction>;
  let accountService: MockProxy<AccountService>;
  let sdkService: MockSdkService;
+  let restrictedItemTypesService: MockProxy<RestrictedItemTypesService>;

  beforeEach(() => {
    cipherService = mock<CipherService>();
@@ -45,6 +47,7 @@ describe("ImportService", () => {
    encryptService = mock<EncryptService>();
    pinService = mock<PinServiceAbstraction>();
    sdkService = new MockSdkService();
+    restrictedItemTypesService = mock<RestrictedItemTypesService>();

    importService = new ImportService(
      cipherService,
@@ -57,6 +60,7 @@ describe("ImportService", () => {
      pinService,
      accountService,
      sdkService,
+      restrictedItemTypesService,
    );
  });

--- a/libs/importer/src/services/import.service.ts
+++ b/libs/importer/src/services/import.service.ts
@@ -26,6 +26,7 @@ import { CipherRequest } from "@bitwarden/common/vault/models/request/cipher.req
 import { FolderWithIdRequest } from "@bitwarden/common/vault/models/request/folder-with-id.request";
 import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view";
 import { FolderView } from "@bitwarden/common/vault/models/view/folder.view";
+import { RestrictedItemTypesService } from "@bitwarden/common/vault/services/restricted-item-types.service";
 import { KeyService } from "@bitwarden/key-management";

 import {
@@ -119,6 +120,7 @@ export class ImportService implements ImportServiceAbstraction {
    private pinService: PinServiceAbstraction,
    private accountService: AccountService,
    private sdkService: SdkService,
+    private restrictedItemTypesService: RestrictedItemTypesService,
  ) {}

  getImportOptions(): ImportOption[] {
@@ -166,6 +168,17 @@ export class ImportService implements ImportServiceAbstraction {
      }
    }

+    const restrictedItemTypes = await firstValueFrom(
+      this.restrictedItemTypesService.restricted$.pipe(
+        map((restrictedItemTypes) => restrictedItemTypes.map((r) => r.cipherType)),
+      ),
+    );
+
+    // Filter out restricted item types from the import result
+    importResult.ciphers = importResult.ciphers.filter(
+      (cipher) => !restrictedItemTypes.includes(cipher.type),
+    );
+
    if (organizationId && !selectedImportTarget && !canAccessImportExport) {
      const hasUnassignedCollections =
        importResult.collectionRelationships.length < importResult.ciphers.length;
@@ -393,7 +406,7 @@ export class ImportService implements ImportServiceAbstraction {
    if (importResult.collections != null) {
      for (let i = 0; i < importResult.collections.length; i++) {
        importResult.collections[i].organizationId = organizationId;
-        const c = await this.collectionService.encrypt(importResult.collections[i]);
+        const c = await this.collectionService.encrypt(importResult.collections[i], activeUserId);
        request.collections.push(new CollectionWithIdRequest(c));
      }
    }
--- a/libs/tools/export/vault-export/vault-export-core/src/services/org-vault-export.service.ts
+++ b/libs/tools/export/vault-export/vault-export-core/src/services/org-vault-export.service.ts
@@ -1,7 +1,7 @@
 // FIXME: Update this file to be type safe and remove this and next line
 // @ts-strict-ignore
 import * as papa from "papaparse";
-import { firstValueFrom } from "rxjs";
+import { firstValueFrom, map } from "rxjs";

 import {
  CollectionService,
@@ -225,15 +225,8 @@ export class OrganizationVaultExportService
  ): Promise<string> {
    let decCiphers: CipherView[] = [];
    let allDecCiphers: CipherView[] = [];
-    let decCollections: CollectionView[] = [];
    const promises = [];

-    promises.push(
-      this.collectionService.getAllDecrypted().then(async (collections) => {
-        decCollections = collections.filter((c) => c.organizationId == organizationId && c.manage);
-      }),
-    );
-
    promises.push(
      this.cipherService.getAllDecrypted(activeUserId).then((ciphers) => {
        allDecCiphers = ciphers;
@@ -241,6 +234,16 @@ export class OrganizationVaultExportService
    );
    await Promise.all(promises);

+    const decCollections: CollectionView[] = await firstValueFrom(
+      this.collectionService
+        .decryptedCollections$(activeUserId)
+        .pipe(
+          map((collections) =>
+            collections.filter((c) => c.organizationId == organizationId && c.manage),
+          ),
+        ),
+    );
+
    const restrictions = await firstValueFrom(this.restrictedItemTypesService.restricted$);

    decCiphers = allDecCiphers.filter(
@@ -263,15 +266,8 @@ export class OrganizationVaultExportService
  ): Promise<string> {
    let encCiphers: Cipher[] = [];
    let allCiphers: Cipher[] = [];
-    let encCollections: Collection[] = [];
    const promises = [];

-    promises.push(
-      this.collectionService.getAll().then((collections) => {
-        encCollections = collections.filter((c) => c.organizationId == organizationId && c.manage);
-      }),
-    );
-
    promises.push(
      this.cipherService.getAll(activeUserId).then((ciphers) => {
        allCiphers = ciphers;
@@ -280,6 +276,15 @@ export class OrganizationVaultExportService

    await Promise.all(promises);

+    const encCollections: Collection[] = await firstValueFrom(
+      this.collectionService.encryptedCollections$(activeUserId).pipe(
+        map((collections) => collections ?? []),
+        map((collections) =>
+          collections.filter((c) => c.organizationId == organizationId && c.manage),
+        ),
+      ),
+    );
+
    const restrictions = await firstValueFrom(this.restrictedItemTypesService.restricted$);

    encCiphers = allCiphers.filter(
--- a/libs/tools/export/vault-export/vault-export-ui/src/components/export.component.ts
+++ b/libs/tools/export/vault-export/vault-export-ui/src/components/export.component.ts
@@ -272,25 +272,29 @@ export class ExportComponent implements OnInit, OnDestroy, AfterViewInit {
      return;
    }

-    this.organizations$ = combineLatest({
-      collections: this.collectionService.decryptedCollections$,
-      memberOrganizations: this.accountService.activeAccount$.pipe(
+    this.organizations$ = this.accountService.activeAccount$
+      .pipe(
        getUserId,
-        switchMap((userId) => this.organizationService.memberOrganizations$(userId)),
-      ),
-    }).pipe(
-      map(({ collections, memberOrganizations }) => {
-        const managedCollectionsOrgIds = new Set(
-          collections.filter((c) => c.manage).map((c) => c.organizationId),
-        );
-        // Filter organizations that exist in managedCollectionsOrgIds
-        const filteredOrgs = memberOrganizations.filter((org) =>
-          managedCollectionsOrgIds.has(org.id),
-        );
-        // Sort the filtered organizations based on the name
-        return filteredOrgs.sort(Utils.getSortFunction(this.i18nService, "name"));
-      }),
-    );
+        switchMap((userId) =>
+          combineLatest({
+            collections: this.collectionService.decryptedCollections$(userId),
+            memberOrganizations: this.organizationService.memberOrganizations$(userId),
+          }),
+        ),
+      )
+      .pipe(
+        map(({ collections, memberOrganizations }) => {
+          const managedCollectionsOrgIds = new Set(
+            collections.filter((c) => c.manage).map((c) => c.organizationId),
+          );
+          // Filter organizations that exist in managedCollectionsOrgIds
+          const filteredOrgs = memberOrganizations.filter((org) =>
+            managedCollectionsOrgIds.has(org.id),
+          );
+          // Sort the filtered organizations based on the name
+          return filteredOrgs.sort(Utils.getSortFunction(this.i18nService, "name"));
+        }),
+      );

    combineLatest([
      this.disablePersonalVaultExportPolicy$,
--- a/libs/vault/src/cipher-form/services/default-cipher-form-config.service.ts
+++ b/libs/vault/src/cipher-form/services/default-cipher-form-config.service.ts
@@ -48,9 +48,10 @@ export class DefaultCipherFormConfigService implements CipherFormConfigService {
      await firstValueFrom(
        combineLatest([
          this.organizations$(activeUserId),
-          this.collectionService.encryptedCollections$.pipe(
+          this.collectionService.encryptedCollections$(activeUserId).pipe(
+            map((collections) => collections ?? []),
            switchMap((c) =>
-              this.collectionService.decryptedCollections$.pipe(
+              this.collectionService.decryptedCollections$(activeUserId).pipe(
                filter((d) => d.length === c.length), // Ensure all collections have been decrypted
              ),
            ),
--- a/libs/vault/src/cipher-view/cipher-view.component.ts
+++ b/libs/vault/src/cipher-view/cipher-view.component.ts
@@ -16,7 +16,8 @@ import { getUserId } from "@bitwarden/common/auth/services/account.service";
 import { isCardExpired } from "@bitwarden/common/autofill/utils";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
 import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
-import { CipherId, CollectionId, EmergencyAccessId, UserId } from "@bitwarden/common/types/guid";
+import { getByIds } from "@bitwarden/common/platform/misc";
+import { CipherId, EmergencyAccessId, UserId } from "@bitwarden/common/types/guid";
 import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
 import { FolderService } from "@bitwarden/common/vault/abstractions/folder/folder.service.abstraction";
 import { CipherType } from "@bitwarden/common/vault/enums";
@@ -143,6 +144,8 @@ export class CipherViewComponent implements OnChanges, OnDestroy {
      return;
    }

+    const userId = await firstValueFrom(this.activeUserId$);
+
    // Load collections if not provided and the cipher has collectionIds
    if (
      this.cipher.collectionIds &&
@@ -150,14 +153,12 @@ export class CipherViewComponent implements OnChanges, OnDestroy {
      (!this.collections || this.collections.length === 0)
    ) {
      this.collections = await firstValueFrom(
-        this.collectionService.decryptedCollectionViews$(
-          this.cipher.collectionIds as CollectionId[],
-        ),
+        this.collectionService
+          .decryptedCollections$(userId)
+          .pipe(getByIds(this.cipher.collectionIds)),
      );
    }

-    const userId = await firstValueFrom(this.activeUserId$);
-
    if (this.cipher.organizationId) {
      this.organization$ = this.organizationService
        .organizations$(userId)
--- a/libs/vault/src/components/assign-collections.component.ts
+++ b/libs/vault/src/components/assign-collections.component.ts
@@ -435,12 +435,14 @@ export class AssignCollectionsComponent implements OnInit, OnDestroy, AfterViewI
   * @returns An observable of the collections for the organization.
   */
  private getCollectionsForOrganization(orgId: OrganizationId): Observable<CollectionView[]> {
-    return combineLatest([
-      this.collectionService.decryptedCollections$,
-      this.accountService.activeAccount$.pipe(
-        switchMap((account) => this.organizationService.organizations$(account?.id)),
+    return this.accountService.activeAccount$.pipe(
+      getUserId,
+      switchMap((userId) =>
+        combineLatest([
+          this.collectionService.decryptedCollections$(userId),
+          this.organizationService.organizations$(userId),
+        ]),
      ),
-    ]).pipe(
      map(([collections, organizations]) => {
        const org = organizations.find((o) => o.id === orgId);
        this.orgName = org.name;