Merge branch 'main' into vault/pm-27632/sdk-cipher-ops

libs/common/src/abstractions/api.service.ts

@@ -1,12 +1,11 @@
 // This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
 // eslint-disable-next-line no-restricted-imports
+import { CreateCollectionRequest, UpdateCollectionRequest } from "@bitwarden/admin-console/common";
 import {
   CollectionAccessDetailsResponse,
   CollectionDetailsResponse,
   CollectionResponse,
-  CreateCollectionRequest,
-  UpdateCollectionRequest,
-} from "@bitwarden/admin-console/common";
+} from "@bitwarden/common/admin-console/models/collections";
 
 import { OrganizationConnectionType } from "../admin-console/enums";
 import { OrganizationSponsorshipCreateRequest } from "../admin-console/models/request/organization/organization-sponsorship-create.request";

libs/common/src/admin-console/models/collections/collection-access-selection.view.ts

@@ -0,0 +1,30 @@
+// FIXME: Update this file to be type safe and remove this and next line
+// @ts-strict-ignore
+import { View } from "@bitwarden/common/models/view/view";
+
+interface SelectionResponseLike {
+  id: string;
+  readOnly: boolean;
+  hidePasswords: boolean;
+  manage: boolean;
+}
+
+export class CollectionAccessSelectionView extends View {
+  readonly id: string;
+  readonly readOnly: boolean;
+  readonly hidePasswords: boolean;
+  readonly manage: boolean;
+
+  constructor(response?: SelectionResponseLike) {
+    super();
+
+    if (!response) {
+      return;
+    }
+
+    this.id = response.id;
+    this.readOnly = response.readOnly;
+    this.hidePasswords = response.hidePasswords;
+    this.manage = response.manage;
+  }
+}

libs/common/src/admin-console/models/collections/collection-admin.view.ts

@@ -0,0 +1,180 @@
+import { CollectionAccessSelectionView } from "@bitwarden/common/admin-console/models/collections";
+import { Organization } from "@bitwarden/common/admin-console/models/domain/organization";
+import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
+import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-string";
+import { OrgKey } from "@bitwarden/common/types/key";
+
+import { CollectionAccessDetailsResponse, CollectionResponse } from "./collection.response";
+import { CollectionView } from "./collection.view";
+
+// TODO: this is used to represent the pseudo "Unassigned" collection as well as
+// the user's personal vault (as a pseudo organization). This should be separated out into different values.
+export const Unassigned = "unassigned";
+export type Unassigned = typeof Unassigned;
+
+export class CollectionAdminView extends CollectionView {
+  groups: CollectionAccessSelectionView[] = [];
+  users: CollectionAccessSelectionView[] = [];
+
+  /**
+   * Flag indicating the collection has no active user or group assigned to it with CanManage permissions
+   * In this case, the collection can be managed by admins/owners or custom users with appropriate permissions
+   */
+  unmanaged: boolean = false;
+
+  /**
+   * Flag indicating the user has been explicitly assigned to this Collection
+   */
+  assigned: boolean = false;
+
+  /**
+   * Returns true if the user can edit a collection (including user and group access) from the Admin Console.
+   */
+  override canEdit(org: Organization): boolean {
+    if (this.isDefaultCollection) {
+      return false;
+    }
+
+    return (
+      org?.canEditAnyCollection ||
+      (this.unmanaged && org?.canEditUnmanagedCollections) ||
+      super.canEdit(org)
+    );
+  }
+
+  /**
+   * Returns true if the user can delete a collection from the Admin Console.
+   */
+  override canDelete(org: Organization): boolean {
+    if (this.isDefaultCollection) {
+      return false;
+    }
+
+    return org?.canDeleteAnyCollection || super.canDelete(org);
+  }
+
+  /**
+   * Whether the user can modify user access to this collection
+   */
+  canEditUserAccess(org: Organization): boolean {
+    if (this.isDefaultCollection) {
+      return false;
+    }
+
+    return (
+      (org.permissions.manageUsers && org.allowAdminAccessToAllCollectionItems) || this.canEdit(org)
+    );
+  }
+
+  /**
+   * Whether the user can modify group access to this collection
+   */
+  canEditGroupAccess(org: Organization): boolean {
+    if (this.isDefaultCollection) {
+      return false;
+    }
+
+    return (
+      (org.permissions.manageGroups && org.allowAdminAccessToAllCollectionItems) ||
+      this.canEdit(org)
+    );
+  }
+
+  /**
+   * Returns true if the user can view collection info and access in a read-only state from the Admin Console
+   */
+  override canViewCollectionInfo(org: Organization | undefined): boolean {
+    if (this.isUnassignedCollection || this.isDefaultCollection) {
+      return false;
+    }
+    const isAdmin = org?.isAdmin ?? false;
+    const permissions = org?.permissions.editAnyCollection ?? false;
+
+    return this.manage || isAdmin || permissions;
+  }
+
+  /**
+   * True if this collection represents the pseudo "Unassigned" collection
+   * This is different from the "unmanaged" flag, which indicates that no users or groups have access to the collection
+   */
+  get isUnassignedCollection() {
+    return this.id === Unassigned;
+  }
+
+  /**
+   * Returns true if the collection name can be edited. Editing the collection name is restricted for collections
+   * that were DefaultUserCollections but where the relevant user has been offboarded.
+   * When this occurs, the offboarded user's email is treated as the collection name, and cannot be edited.
+   * This is important for security so that the server cannot ask the client to encrypt arbitrary data.
+   * WARNING! This is an IMPORTANT restriction that MUST be maintained for security purposes.
+   * Do not edit or remove this unless you understand why.
+   */
+  override canEditName(org: Organization): boolean {
+    return (this.canEdit(org) && !this.defaultUserCollectionEmail) || super.canEditName(org);
+  }
+  static async fromCollectionAccessDetails(
+    collection: CollectionAccessDetailsResponse,
+    encryptService: EncryptService,
+    orgKey: OrgKey,
+  ): Promise<CollectionAdminView> {
+    const view = new CollectionAdminView({ ...collection });
+    try {
+      view.name = await encryptService.decryptString(new EncString(view.name), orgKey);
+    } catch (e) {
+      view.name = "[error: cannot decrypt]";
+      // Note: This should be replaced by the owning team with appropriate, domain-specific behavior.
+      // eslint-disable-next-line no-console
+      console.error(
+        "[CollectionAdminView/fromCollectionAccessDetails] Error decrypting collection name",
+        e,
+      );
+    }
+    view.assigned = collection.assigned;
+    view.readOnly = collection.readOnly;
+    view.hidePasswords = collection.hidePasswords;
+    view.manage = collection.manage;
+    view.unmanaged = collection.unmanaged;
+    view.type = collection.type;
+    view.externalId = collection.externalId;
+    view.defaultUserCollectionEmail = collection.defaultUserCollectionEmail;
+
+    view.groups = collection.groups
+      ? collection.groups.map((g) => new CollectionAccessSelectionView(g))
+      : [];
+
+    view.users = collection.users
+      ? collection.users.map((g) => new CollectionAccessSelectionView(g))
+      : [];
+
+    return view;
+  }
+
+  static async fromCollectionResponse(
+    collection: CollectionResponse,
+    encryptService: EncryptService,
+    orgKey: OrgKey,
+  ): Promise<CollectionAdminView> {
+    let collectionName: string;
+    try {
+      collectionName = await encryptService.decryptString(new EncString(collection.name), orgKey);
+    } catch (e) {
+      // Note: This should be updated by the owning team with appropriate, domain specific behavior
+      // eslint-disable-next-line no-console
+      console.error(
+        "[CollectionAdminView/fromCollectionResponse] Failed to decrypt the collection name",
+        e,
+      );
+      throw e;
+    }
+
+    const collectionAdminView = new CollectionAdminView({
+      id: collection.id,
+      name: collectionName,
+      organizationId: collection.organizationId,
+    });
+
+    collectionAdminView.externalId = collection.externalId;
+
+    return collectionAdminView;
+  }
+}

libs/common/src/admin-console/models/collections/collection.data.ts

@@ -0,0 +1,39 @@
+import { Jsonify } from "type-fest";
+
+import {
+  CollectionDetailsResponse,
+  CollectionType,
+  CollectionTypes,
+} from "@bitwarden/common/admin-console/models/collections";
+import { CollectionId, OrganizationId } from "@bitwarden/common/types/guid";
+
+export class CollectionData {
+  id: CollectionId;
+  organizationId: OrganizationId;
+  name: string;
+  defaultUserCollectionEmail: string | undefined;
+  externalId: string | undefined;
+  readOnly: boolean = false;
+  manage: boolean = false;
+  hidePasswords: boolean = false;
+  type: CollectionType = CollectionTypes.SharedCollection;
+
+  constructor(response: CollectionDetailsResponse) {
+    this.id = response.id;
+    this.organizationId = response.organizationId;
+    this.name = response.name;
+    this.externalId = response.externalId;
+    this.readOnly = response.readOnly;
+    this.manage = response.manage;
+    this.hidePasswords = response.hidePasswords;
+    this.type = response.type;
+    this.defaultUserCollectionEmail = response.defaultUserCollectionEmail;
+  }
+
+  static fromJSON(obj: Jsonify<CollectionData | null>): CollectionData | null {
+    if (obj == null) {
+      return null;
+    }
+    return Object.assign(new CollectionData(new CollectionDetailsResponse({})), obj);
+  }
+}

libs/common/src/admin-console/models/collections/collection.response.ts

@@ -0,0 +1,70 @@
+import {
+  CollectionType,
+  CollectionTypes,
+} from "@bitwarden/common/admin-console/models/collections";
+import { SelectionReadOnlyResponse } from "@bitwarden/common/admin-console/models/response/selection-read-only.response";
+import { BaseResponse } from "@bitwarden/common/models/response/base.response";
+import { CollectionId, OrganizationId } from "@bitwarden/common/types/guid";
+
+export class CollectionResponse extends BaseResponse {
+  id: CollectionId;
+  organizationId: OrganizationId;
+  name: string;
+  defaultUserCollectionEmail: string | undefined;
+  externalId: string | undefined;
+  type: CollectionType = CollectionTypes.SharedCollection;
+
+  constructor(response: any) {
+    super(response);
+    this.id = this.getResponseProperty("Id");
+    this.organizationId = this.getResponseProperty("OrganizationId");
+    this.name = this.getResponseProperty("Name");
+    this.externalId = this.getResponseProperty("ExternalId");
+    this.defaultUserCollectionEmail = this.getResponseProperty("DefaultUserCollectionEmail");
+    this.type = this.getResponseProperty("Type") ?? CollectionTypes.SharedCollection;
+  }
+}
+
+export class CollectionDetailsResponse extends CollectionResponse {
+  readOnly: boolean;
+  manage: boolean;
+  hidePasswords: boolean;
+
+  /**
+   * Flag indicating the user has been explicitly assigned to this Collection
+   */
+  assigned: boolean;
+
+  constructor(response: any) {
+    super(response);
+    this.readOnly = this.getResponseProperty("ReadOnly") || false;
+    this.manage = this.getResponseProperty("Manage") || false;
+    this.hidePasswords = this.getResponseProperty("HidePasswords") || false;
+
+    // Temporary until the API is updated to return this property in AC-2084
+    // For now, we can assume that if the object is 'collectionDetails' then the user is assigned
+    this.assigned = this.getResponseProperty("object") == "collectionDetails";
+  }
+}
+
+export class CollectionAccessDetailsResponse extends CollectionDetailsResponse {
+  groups: SelectionReadOnlyResponse[] = [];
+  users: SelectionReadOnlyResponse[] = [];
+  unmanaged: boolean;
+
+  constructor(response: any) {
+    super(response);
+    this.assigned = this.getResponseProperty("Assigned") || false;
+    this.unmanaged = this.getResponseProperty("Unmanaged") || false;
+
+    const groups = this.getResponseProperty("Groups");
+    if (groups != null) {
+      this.groups = groups.map((g: any) => new SelectionReadOnlyResponse(g));
+    }
+
+    const users = this.getResponseProperty("Users");
+    if (users != null) {
+      this.users = users.map((g: any) => new SelectionReadOnlyResponse(g));
+    }
+  }
+}

libs/common/src/admin-console/models/collections/collection.ts

@@ -0,0 +1,84 @@
+import { CollectionView } from "@bitwarden/common/admin-console/models/collections";
+import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
+import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-string";
+import Domain from "@bitwarden/common/platform/models/domain/domain-base";
+import { CollectionId, OrganizationId } from "@bitwarden/common/types/guid";
+import { OrgKey } from "@bitwarden/common/types/key";
+
+import { CollectionData } from "./collection.data";
+
+export const CollectionTypes = {
+  SharedCollection: 0,
+  DefaultUserCollection: 1,
+} as const;
+
+export type CollectionType = (typeof CollectionTypes)[keyof typeof CollectionTypes];
+
+export class Collection extends Domain {
+  id: CollectionId;
+  organizationId: OrganizationId;
+  name: EncString;
+  externalId: string | undefined;
+  readOnly: boolean = false;
+  hidePasswords: boolean = false;
+  manage: boolean = false;
+  type: CollectionType = CollectionTypes.SharedCollection;
+  defaultUserCollectionEmail: string | undefined;
+
+  constructor(c: { id: CollectionId; name: EncString; organizationId: OrganizationId }) {
+    super();
+    this.id = c.id;
+    this.name = c.name;
+    this.organizationId = c.organizationId;
+  }
+
+  static fromCollectionData(obj: CollectionData): Collection {
+    if (obj == null || obj.name == null || obj.organizationId == null) {
+      throw new Error("CollectionData must contain name and organizationId.");
+    }
+
+    const collection = new Collection({
+      ...obj,
+      name: new EncString(obj.name),
+    });
+
+    collection.externalId = obj.externalId;
+    collection.readOnly = obj.readOnly;
+    collection.hidePasswords = obj.hidePasswords;
+    collection.manage = obj.manage;
+    collection.type = obj.type;
+    collection.defaultUserCollectionEmail = obj.defaultUserCollectionEmail;
+
+    return collection;
+  }
+
+  static async fromCollectionView(
+    view: CollectionView,
+    encryptService: EncryptService,
+    orgKey: OrgKey,
+  ): Promise<Collection> {
+    const collection = new Collection({
+      name: await encryptService.encryptString(view.name, orgKey),
+      id: view.id,
+      organizationId: view.organizationId,
+    });
+
+    collection.externalId = view.externalId;
+    collection.readOnly = view.readOnly;
+    collection.hidePasswords = view.hidePasswords;
+    collection.manage = view.manage;
+    collection.type = view.type;
+
+    return collection;
+  }
+
+  decrypt(orgKey: OrgKey, encryptService: EncryptService): Promise<CollectionView> {
+    return CollectionView.fromCollection(this, encryptService, orgKey);
+  }
+
+  // @TODO: This would be better off in Collection.Utils. Move this there when
+  // refactoring to a shared lib.
+  static isCollectionId(id: any): id is CollectionId {
+    return typeof id === "string" && id != null;
+  }
+}

libs/common/src/admin-console/models/collections/collection.view.ts

@@ -0,0 +1,177 @@
+import { Jsonify } from "type-fest";
+
+import { Organization } from "@bitwarden/common/admin-console/models/domain/organization";
+import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
+import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-string";
+import { View } from "@bitwarden/common/models/view/view";
+import { CollectionId, OrganizationId } from "@bitwarden/common/types/guid";
+import { OrgKey } from "@bitwarden/common/types/key";
+import { ITreeNodeObject } from "@bitwarden/common/vault/models/domain/tree-node";
+
+import { Collection, CollectionType, CollectionTypes } from "./collection";
+import { CollectionAccessDetailsResponse } from "./collection.response";
+
+export const NestingDelimiter = "/";
+
+export class CollectionView implements View, ITreeNodeObject {
+  id: CollectionId;
+  organizationId: OrganizationId;
+  externalId: string | undefined;
+  // readOnly applies to the items within a collection
+  readOnly: boolean = false;
+  hidePasswords: boolean = false;
+  manage: boolean = false;
+  assigned: boolean = false;
+  type: CollectionType = CollectionTypes.SharedCollection;
+  defaultUserCollectionEmail: string | undefined;
+
+  private _name: string;
+
+  constructor(c: { id: CollectionId; organizationId: OrganizationId; name: string }) {
+    this.id = c.id;
+    this.organizationId = c.organizationId;
+    this._name = c.name;
+  }
+
+  set name(name: string) {
+    this._name = name;
+  }
+
+  get name(): string {
+    return this.defaultUserCollectionEmail ?? this._name;
+  }
+
+  canEditItems(org: Organization): boolean {
+    if (org != null && org.id !== this.organizationId) {
+      throw new Error(
+        "Id of the organization provided does not match the org id of the collection.",
+      );
+    }
+
+    return org?.canEditAllCiphers || this.manage || (this.assigned && !this.readOnly);
+  }
+
+  /**
+   * Returns true if the user can edit a collection (including user and group access) from the individual vault.
+   * Does not include admin permissions - see {@link CollectionAdminView.canEdit}.
+   */
+  canEdit(org: Organization | undefined): boolean {
+    if (this.isDefaultCollection) {
+      return false;
+    }
+
+    if (org != null && org.id !== this.organizationId) {
+      throw new Error(
+        "Id of the organization provided does not match the org id of the collection.",
+      );
+    }
+
+    return this.manage;
+  }
+
+  /**
+   * Returns true if the user can delete a collection from the individual vault.
+   * Does not include admin permissions - see {@link CollectionAdminView.canDelete}.
+   */
+  canDelete(org: Organization | undefined): boolean {
+    if (org != null && org.id !== this.organizationId) {
+      throw new Error(
+        "Id of the organization provided does not match the org id of the collection.",
+      );
+    }
+
+    const canDeleteManagedCollections = !org?.limitCollectionDeletion || org.isAdmin;
+
+    // Only use individual permissions, not admin permissions
+    return canDeleteManagedCollections && this.manage && !this.isDefaultCollection;
+  }
+
+  /**
+   * Returns true if the user can view collection info and access in a read-only state from the individual vault
+   */
+  canViewCollectionInfo(org: Organization | undefined): boolean {
+    return false;
+  }
+
+  /**
+   * Returns true if the collection name can be edited. Editing the collection name is restricted for collections
+   * that were DefaultUserCollections but where the relevant user has been offboarded.
+   * When this occurs, the offboarded user's email is treated as the collection name, and cannot be edited.
+   * This is important for security so that the server cannot ask the client to encrypt arbitrary data.
+   * WARNING! This is an IMPORTANT restriction that MUST be maintained for security purposes.
+   * Do not edit or remove this unless you understand why.
+   */
+  canEditName(org: Organization): boolean {
+    return this.canEdit(org) && !this.defaultUserCollectionEmail;
+  }
+
+  get isDefaultCollection() {
+    return this.type == CollectionTypes.DefaultUserCollection;
+  }
+
+  // FIXME: we should not use a CollectionView object for the vault filter header because it is not a real
+  // CollectionView and this violates ts-strict rules.
+  static vaultFilterHead(): CollectionView {
+    return new CollectionView({
+      id: "" as CollectionId,
+      organizationId: "" as OrganizationId,
+      name: "",
+    });
+  }
+
+  static async fromCollection(
+    collection: Collection,
+    encryptService: EncryptService,
+    key: OrgKey,
+  ): Promise<CollectionView> {
+    const view = new CollectionView({ ...collection, name: "" });
+
+    try {
+      view.name = await encryptService.decryptString(collection.name, key);
+    } catch (e) {
+      view.name = "[error: cannot decrypt]";
+      // eslint-disable-next-line no-console
+      console.error("[CollectionView] Error decrypting collection name", e);
+    }
+
+    view.assigned = true;
+    view.externalId = collection.externalId;
+    view.readOnly = collection.readOnly;
+    view.hidePasswords = collection.hidePasswords;
+    view.manage = collection.manage;
+    view.type = collection.type;
+    view.defaultUserCollectionEmail = collection.defaultUserCollectionEmail;
+    return view;
+  }
+
+  static async fromCollectionAccessDetails(
+    collection: CollectionAccessDetailsResponse,
+    encryptService: EncryptService,
+    orgKey: OrgKey,
+  ): Promise<CollectionView> {
+    const view = new CollectionView({ ...collection });
+
+    try {
+      view.name = await encryptService.decryptString(new EncString(collection.name), orgKey);
+    } catch (e) {
+      // Note: This should be replaced by the owning team with appropriate, domain-specific behavior.
+      // eslint-disable-next-line no-console
+      console.error("[CollectionView] Error decrypting collection name", e);
+      throw e;
+    }
+
+    view.externalId = collection.externalId;
+    view.type = collection.type;
+    view.assigned = collection.assigned;
+    view.defaultUserCollectionEmail = collection.defaultUserCollectionEmail;
+    return view;
+  }
+
+  static fromJSON(obj: Jsonify<CollectionView>) {
+    return Object.assign(new CollectionView({ ...obj }), obj);
+  }
+
+  encrypt(orgKey: OrgKey, encryptService: EncryptService): Promise<Collection> {
+    return Collection.fromCollectionView(this, encryptService, orgKey);
+  }
+}

libs/common/src/admin-console/models/collections/index.ts

@@ -0,0 +1,6 @@
+export * from "./collection-access-selection.view";
+export * from "./collection-admin.view";
+export * from "./collection.view";
+export * from "./collection.response";
+export * from "./collection";
+export * from "./collection.data";

libs/common/src/admin-console/models/request/provider/provider-user-confirm.request.ts

@@ -1,5 +1,7 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 export class ProviderUserConfirmRequest {
-  key: string;
+  protected key: string;
+
+  constructor(key: string) {
+    this.key = key;
+  }
 }

libs/common/src/admin-console/models/response/organization-export.response.ts

@@ -1,8 +1,6 @@
 // FIXME: Update this file to be type safe and remove this and next line
 // @ts-strict-ignore
-// This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
-// eslint-disable-next-line no-restricted-imports
-import { CollectionResponse } from "@bitwarden/admin-console/common";
+import { CollectionResponse } from "@bitwarden/common/admin-console/models/collections";
 
 import { BaseResponse } from "../../../models/response/base.response";
 import { CipherResponse } from "../../../vault/models/response/cipher.response";

libs/common/src/admin-console/utils/collection-utils.spec.ts

@@ -0,0 +1,120 @@
+import { CollectionView } from "@bitwarden/common/admin-console/models/collections";
+import { CollectionId, OrganizationId } from "@bitwarden/common/types/guid";
+import { TreeNode } from "@bitwarden/common/vault/models/domain/tree-node";
+import { newGuid } from "@bitwarden/guid";
+
+import { getNestedCollectionTree, getFlatCollectionTree } from "./collection-utils";
+
+describe("CollectionUtils Service", () => {
+  describe("getNestedCollectionTree", () => {
+    it("should return collections properly sorted if provided out of order", () => {
+      // Arrange
+      const collections: CollectionView[] = [];
+
+      const parentCollection = new CollectionView({
+        name: "Parent",
+        organizationId: "orgId" as OrganizationId,
+        id: newGuid() as CollectionId,
+      });
+
+      const childCollection = new CollectionView({
+        name: "Parent/Child",
+        organizationId: "orgId" as OrganizationId,
+        id: newGuid() as CollectionId,
+      });
+
+      collections.push(childCollection);
+      collections.push(parentCollection);
+
+      // Act
+      const result = getNestedCollectionTree(collections);
+
+      // Assert
+      expect(result[0].node.name).toBe("Parent");
+      expect(result[0].children[0].node.name).toBe("Child");
+    });
+
+    it("should return an empty array if no collections are provided", () => {
+      // Arrange
+      const collections: CollectionView[] = [];
+
+      // Act
+      const result = getNestedCollectionTree(collections);
+
+      // Assert
+      expect(result).toEqual([]);
+    });
+  });
+
+  describe("getFlatCollectionTree", () => {
+    it("should flatten a tree node with no children", () => {
+      // Arrange
+      const collection = new CollectionView({
+        name: "Test Collection",
+        id: "test-id" as CollectionId,
+        organizationId: "orgId" as OrganizationId,
+      });
+
+      const treeNodes: TreeNode<CollectionView>[] = [
+        new TreeNode<CollectionView>(collection, {} as TreeNode<CollectionView>),
+      ];
+
+      // Act
+      const result = getFlatCollectionTree(treeNodes);
+
+      // Assert
+      expect(result.length).toBe(1);
+      expect(result[0]).toBe(collection);
+    });
+
+    it("should flatten a tree node with children", () => {
+      // Arrange
+      const parentCollection = new CollectionView({
+        name: "Parent",
+        id: "parent-id" as CollectionId,
+        organizationId: "orgId" as OrganizationId,
+      });
+
+      const child1Collection = new CollectionView({
+        name: "Child 1",
+        id: "child1-id" as CollectionId,
+        organizationId: "orgId" as OrganizationId,
+      });
+
+      const child2Collection = new CollectionView({
+        name: "Child 2",
+        id: "child2-id" as CollectionId,
+        organizationId: "orgId" as OrganizationId,
+      });
+
+      const grandchildCollection = new CollectionView({
+        name: "Grandchild",
+        id: "grandchild-id" as CollectionId,
+        organizationId: "orgId" as OrganizationId,
+      });
+
+      const parentNode = new TreeNode<CollectionView>(
+        parentCollection,
+        {} as TreeNode<CollectionView>,
+      );
+      const child1Node = new TreeNode<CollectionView>(child1Collection, parentNode);
+      const child2Node = new TreeNode<CollectionView>(child2Collection, parentNode);
+      const grandchildNode = new TreeNode<CollectionView>(grandchildCollection, child1Node);
+
+      parentNode.children = [child1Node, child2Node];
+      child1Node.children = [grandchildNode];
+
+      const treeNodes: TreeNode<CollectionView>[] = [parentNode];
+
+      // Act
+      const result = getFlatCollectionTree(treeNodes);
+
+      // Assert
+      expect(result.length).toBe(4);
+      expect(result[0]).toBe(parentCollection);
+      expect(result).toContain(child1Collection);
+      expect(result).toContain(child2Collection);
+      expect(result).toContain(grandchildCollection);
+    });
+  });
+});

libs/common/src/admin-console/utils/collection-utils.ts

@@ -0,0 +1,87 @@
+// FIXME: Update this file to be type safe and remove this and next line
+// @ts-strict-ignore
+import {
+  CollectionView,
+  NestingDelimiter,
+  CollectionAdminView,
+} from "@bitwarden/common/admin-console/models/collections";
+import { OrganizationId } from "@bitwarden/common/types/guid";
+import { TreeNode } from "@bitwarden/common/vault/models/domain/tree-node";
+import { ServiceUtils } from "@bitwarden/common/vault/service-utils";
+
+export function getNestedCollectionTree(
+  collections: CollectionAdminView[],
+): TreeNode<CollectionAdminView>[];
+export function getNestedCollectionTree(collections: CollectionView[]): TreeNode<CollectionView>[];
+export function getNestedCollectionTree(
+  collections: (CollectionView | CollectionAdminView)[],
+): TreeNode<CollectionView | CollectionAdminView>[] {
+  if (!collections) {
+    return [];
+  }
+
+  // Collections need to be cloned because ServiceUtils.nestedTraverse actively
+  // modifies the names of collections.
+  // These changes risk affecting collections store in StateService.
+  const clonedCollections: CollectionView[] | CollectionAdminView[] = collections
+    .sort((a, b) => a.name.localeCompare(b.name))
+    .map(cloneCollection);
+
+  const all: TreeNode<CollectionView | CollectionAdminView>[] = [];
+  const groupedByOrg = new Map<OrganizationId, (CollectionView | CollectionAdminView)[]>();
+  clonedCollections.map((c) => {
+    const key = c.organizationId;
+    (groupedByOrg.get(key) ?? groupedByOrg.set(key, []).get(key)!).push(c);
+  });
+  for (const group of groupedByOrg.values()) {
+    const nodes: TreeNode<CollectionView | CollectionAdminView>[] = [];
+    for (const c of group) {
+      const parts = c.name ? c.name.replace(/^\/+|\/+$/g, "").split(NestingDelimiter) : [];
+      ServiceUtils.nestedTraverse(nodes, 0, parts, c, undefined, NestingDelimiter);
+    }
+    all.push(...nodes);
+  }
+  return all;
+}
+
+export function cloneCollection(collection: CollectionView): CollectionView;
+export function cloneCollection(collection: CollectionAdminView): CollectionAdminView;
+export function cloneCollection(
+  collection: CollectionView | CollectionAdminView,
+): CollectionView | CollectionAdminView {
+  let cloned;
+
+  if (collection instanceof CollectionAdminView) {
+    cloned = Object.assign(
+      new CollectionAdminView({ ...collection, name: collection.name }),
+      collection,
+    );
+  } else {
+    cloned = Object.assign(
+      new CollectionView({ ...collection, name: collection.name }),
+      collection,
+    );
+  }
+  return cloned;
+}
+
+export function getFlatCollectionTree(
+  nodes: TreeNode<CollectionAdminView>[],
+): CollectionAdminView[];
+export function getFlatCollectionTree(nodes: TreeNode<CollectionView>[]): CollectionView[];
+export function getFlatCollectionTree(
+  nodes: TreeNode<CollectionView | CollectionAdminView>[],
+): (CollectionView | CollectionAdminView)[] {
+  if (!nodes || nodes.length === 0) {
+    return [];
+  }
+
+  return nodes.flatMap((node) => {
+    if (!node.children || node.children.length === 0) {
+      return [node.node];
+    }
+
+    const children = getFlatCollectionTree(node.children);
+    return [node.node, ...children];
+  });
+}

libs/common/src/admin-console/utils/index.ts

@@ -0,0 +1 @@
+export * from "./collection-utils";

libs/common/src/dirt/services/phishing-detection/phishing-detection-settings.service.spec.ts

@@ -8,6 +8,7 @@ import { BillingAccountProfileStateService } from "@bitwarden/common/billing/abs
 import { ProductTierType } from "@bitwarden/common/billing/enums";
 import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
 import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
+import { LogService } from "@bitwarden/logging";
 
 import { FakeAccountService, FakeStateProvider, mockAccountServiceWith } from "../../../../spec";
 import { UserId } from "../../../types/guid";
@@ -54,6 +55,8 @@ describe("PhishingDetectionSettingsService", () => {
     usePhishingBlocker: true,
   });
 
+  const mockLogService = mock<LogService>();
+
   const mockUserId = "mock-user-id" as UserId;
   const account = mock<Account>({ id: mockUserId });
   const accountService: FakeAccountService = mockAccountServiceWith(mockUserId);
@@ -85,6 +88,7 @@ describe("PhishingDetectionSettingsService", () => {
       mockAccountService,
       mockBillingService,
       mockConfigService,
+      mockLogService,
       mockOrganizationService,
       mockPlatformService,
       stateProvider,

libs/common/src/dirt/services/phishing-detection/phishing-detection-settings.service.ts

@@ -1,5 +1,5 @@
 import { combineLatest, Observable, of, switchMap } from "rxjs";
-import { catchError, distinctUntilChanged, map, shareReplay } from "rxjs/operators";
+import { catchError, distinctUntilChanged, map, shareReplay, tap } from "rxjs/operators";
 
 import { OrganizationService } from "@bitwarden/common/admin-console/abstractions/organization/organization.service.abstraction";
 import { Organization } from "@bitwarden/common/admin-console/models/domain/organization";
@@ -9,6 +9,7 @@ import { ProductTierType } from "@bitwarden/common/billing/enums";
 import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
 import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
 import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
+import { LogService } from "@bitwarden/logging";
 import { UserId } from "@bitwarden/user-core";
 
 import { PHISHING_DETECTION_DISK, StateProvider, UserKeyDefinition } from "../../../platform/state";
@@ -32,27 +33,47 @@ export class PhishingDetectionSettingsService implements PhishingDetectionSettin
     private accountService: AccountService,
     private billingService: BillingAccountProfileStateService,
     private configService: ConfigService,
+    private logService: LogService,
     private organizationService: OrganizationService,
     private platformService: PlatformUtilsService,
     private stateProvider: StateProvider,
   ) {
+    this.logService.debug(`[PhishingDetectionSettingsService] Initializing service...`);
     this.available$ = this.buildAvailablePipeline$().pipe(
       distinctUntilChanged(),
+      tap((available) =>
+        this.logService.debug(
+          `[PhishingDetectionSettingsService] Phishing detection available: ${available}`,
+        ),
+      ),
       shareReplay({ bufferSize: 1, refCount: true }),
     );
     this.enabled$ = this.buildEnabledPipeline$().pipe(
       distinctUntilChanged(),
+      tap((enabled) =>
+        this.logService.debug(
+          `[PhishingDetectionSettingsService] Phishing detection enabled: ${{ enabled }}`,
+        ),
+      ),
       shareReplay({ bufferSize: 1, refCount: true }),
     );
 
     this.on$ = combineLatest([this.available$, this.enabled$]).pipe(
       map(([available, enabled]) => available && enabled),
       distinctUntilChanged(),
-      shareReplay({ bufferSize: 1, refCount: true }),
+      tap((on) =>
+        this.logService.debug(
+          `[PhishingDetectionSettingsService] Phishing detection is on: ${{ on }}`,
+        ),
+      ),
+      shareReplay({ bufferSize: 1, refCount: false }),
     );
   }
 
   async setEnabled(userId: UserId, enabled: boolean): Promise<void> {
+    this.logService.debug(
+      `[PhishingDetectionSettingsService] Setting phishing detection enabled: ${{ enabled, userId }}`,
+    );
     await this.stateProvider.getUser(userId, ENABLE_PHISHING_DETECTION).update(() => enabled);
   }
 
@@ -64,6 +85,9 @@ export class PhishingDetectionSettingsService implements PhishingDetectionSettin
   private buildAvailablePipeline$(): Observable<boolean> {
     // Phishing detection is unavailable on Safari due to platform limitations.
     if (this.platformService.isSafari()) {
+      this.logService.warning(
+        `[PhishingDetectionSettingsService] Phishing detection is unavailable on Safari due to platform limitations`,
+      );
       return of(false);
     }
 
@@ -97,6 +121,9 @@ export class PhishingDetectionSettingsService implements PhishingDetectionSettin
         if (!account) {
           return of(false);
         }
+        this.logService.debug(
+          `[PhishingDetectionSettingsService] Refreshing phishing detection enabled state`,
+        );
         return this.stateProvider.getUserState$(ENABLE_PHISHING_DETECTION, account.id);
       }),
       map((enabled) => enabled ?? true),

libs/common/src/enums/feature-flag.enum.ts

@@ -14,6 +14,7 @@ export enum FeatureFlag {
   AutoConfirm = "pm-19934-auto-confirm-organization-users",
   BlockClaimedDomainAccountCreation = "pm-28297-block-uninvited-claimed-domain-registration",
   IncreaseBulkReinviteLimitForCloud = "pm-28251-increase-bulk-reinvite-limit-for-cloud",
+  MembersComponentRefactor = "pm-29503-refactor-members-inheritance",
 
   /* Auth */
   PM23801_PrefetchPasswordPrelogin = "pm-23801-prefetch-password-prelogin",
@@ -22,6 +23,7 @@ export enum FeatureFlag {
   MacOsNativeCredentialSync = "macos-native-credential-sync",
   WindowsDesktopAutotype = "windows-desktop-autotype",
   WindowsDesktopAutotypeGA = "windows-desktop-autotype-ga",
+  SSHAgentV2 = "ssh-agent-v2",
 
   /* Billing */
   TrialPaymentOptional = "PM-8163-trial-payment",
@@ -45,9 +47,9 @@ export enum FeatureFlag {
   ConsolidatedSessionTimeoutComponent = "pm-26056-consolidated-session-timeout-component",
   PM27279_V2RegistrationTdeJit = "pm-27279-v2-registration-tde-jit",
   EnableAccountEncryptionV2KeyConnectorRegistration = "enable-account-encryption-v2-key-connector-registration",
+  EnableAccountEncryptionV2JitPasswordRegistration = "enable-account-encryption-v2-jit-password-registration",
 
   /* Tools */
-  DesktopSendUIRefresh = "desktop-send-ui-refresh",
   UseSdkPasswordGenerators = "pm-19976-use-sdk-password-generators",
   ChromiumImporterWithABE = "pm-25855-chromium-importer-abe",
   SendUIRefresh = "pm-28175-send-ui-refresh",
@@ -76,6 +78,7 @@ export enum FeatureFlag {
 
   /* Desktop */
   DesktopUiMigrationMilestone1 = "desktop-ui-migration-milestone-1",
+  DesktopUiMigrationMilestone2 = "desktop-ui-migration-milestone-2",
 
   /* UIF */
   RouterFocusManagement = "router-focus-management",
@@ -102,14 +105,15 @@ export const DefaultFeatureFlagValue = {
   [FeatureFlag.AutoConfirm]: FALSE,
   [FeatureFlag.BlockClaimedDomainAccountCreation]: FALSE,
   [FeatureFlag.IncreaseBulkReinviteLimitForCloud]: FALSE,
+  [FeatureFlag.MembersComponentRefactor]: FALSE,
 
   /* Autofill */
   [FeatureFlag.MacOsNativeCredentialSync]: FALSE,
   [FeatureFlag.WindowsDesktopAutotype]: FALSE,
   [FeatureFlag.WindowsDesktopAutotypeGA]: FALSE,
+  [FeatureFlag.SSHAgentV2]: FALSE,
 
   /* Tools */
-  [FeatureFlag.DesktopSendUIRefresh]: FALSE,
   [FeatureFlag.UseSdkPasswordGenerators]: FALSE,
   [FeatureFlag.ChromiumImporterWithABE]: FALSE,
   [FeatureFlag.SendUIRefresh]: FALSE,
@@ -155,6 +159,7 @@ export const DefaultFeatureFlagValue = {
   [FeatureFlag.ConsolidatedSessionTimeoutComponent]: FALSE,
   [FeatureFlag.PM27279_V2RegistrationTdeJit]: FALSE,
   [FeatureFlag.EnableAccountEncryptionV2KeyConnectorRegistration]: FALSE,
+  [FeatureFlag.EnableAccountEncryptionV2JitPasswordRegistration]: FALSE,
 
   /* Platform */
   [FeatureFlag.IpcChannelFramework]: FALSE,
@@ -164,6 +169,7 @@ export const DefaultFeatureFlagValue = {
 
   /* Desktop */
   [FeatureFlag.DesktopUiMigrationMilestone1]: FALSE,
+  [FeatureFlag.DesktopUiMigrationMilestone2]: FALSE,
 
   /* UIF */
   [FeatureFlag.RouterFocusManagement]: FALSE,

libs/common/src/key-management/master-password/abstractions/master-password.service.abstraction.ts

@@ -113,6 +113,23 @@ export abstract class MasterPasswordServiceAbstraction {
    * @throws If the user ID is missing.
    */
   abstract userHasMasterPassword(userId: UserId): Promise<boolean>;
+
+  /**
+   * Derives a master key from the provided password and master password unlock data,
+   * then sets it to state for the specified user. This is a temporary backwards compatibility function
+   * to support existing code that relies on direct master key access.
+   * Note: This will be removed in https://bitwarden.atlassian.net/browse/PM-30676
+   *
+   * @param password The master password.
+   * @param masterPasswordUnlockData The master password unlock data containing the KDF settings and salt.
+   * @param userId The user ID.
+   * @throws If the password, master password unlock data, or user ID is missing.
+   */
+  abstract setLegacyMasterKeyFromUnlockData(
+    password: string,
+    masterPasswordUnlockData: MasterPasswordUnlockData,
+    userId: UserId,
+  ): Promise<void>;
 }
 
 export abstract class InternalMasterPasswordServiceAbstraction extends MasterPasswordServiceAbstraction {

libs/common/src/key-management/master-password/services/fake-master-password.service.ts

@@ -127,4 +127,12 @@ export class FakeMasterPasswordService implements InternalMasterPasswordServiceA
   masterPasswordUnlockData$(userId: UserId): Observable<MasterPasswordUnlockData | null> {
     return this.mock.masterPasswordUnlockData$(userId);
   }
+
+  setLegacyMasterKeyFromUnlockData(
+    password: string,
+    masterPasswordUnlockData: MasterPasswordUnlockData,
+    userId: UserId,
+  ): Promise<void> {
+    return this.mock.setLegacyMasterKeyFromUnlockData(password, masterPasswordUnlockData, userId);
+  }
 }

libs/common/src/key-management/master-password/services/master-password.service.spec.ts

@@ -3,6 +3,7 @@ import { firstValueFrom } from "rxjs";
 import { Jsonify } from "type-fest";
 
 import { SdkLoadService } from "@bitwarden/common/platform/abstractions/sdk/sdk-load.service";
+import { HashPurpose } from "@bitwarden/common/platform/enums";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
 // eslint-disable-next-line no-restricted-imports
 import { Argon2KdfConfig, KdfConfig, KdfType, PBKDF2KdfConfig } from "@bitwarden/key-management";
@@ -415,6 +416,125 @@ describe("MasterPasswordService", () => {
     );
   });
 
+  describe("setLegacyMasterKeyFromUnlockData", () => {
+    const password = "test-password";
+
+    it("derives master key from password and sets it in state", async () => {
+      const masterKey = makeSymmetricCryptoKey(32, 5) as MasterKey;
+      keyGenerationService.deriveKeyFromPassword.mockResolvedValue(masterKey);
+      cryptoFunctionService.pbkdf2.mockResolvedValue(new Uint8Array(32));
+
+      const masterPasswordUnlockData = new MasterPasswordUnlockData(
+        salt,
+        kdfPBKDF2,
+        makeEncString().toSdk() as MasterKeyWrappedUserKey,
+      );
+
+      await sut.setLegacyMasterKeyFromUnlockData(password, masterPasswordUnlockData, userId);
+
+      expect(keyGenerationService.deriveKeyFromPassword).toHaveBeenCalledWith(
+        password,
+        masterPasswordUnlockData.salt,
+        masterPasswordUnlockData.kdf,
+      );
+
+      const state = await firstValueFrom(stateProvider.getUser(userId, MASTER_KEY).state$);
+      expect(state).toEqual(masterKey);
+    });
+
+    it("works with argon2 kdf config", async () => {
+      const masterKey = makeSymmetricCryptoKey(32, 6) as MasterKey;
+      keyGenerationService.deriveKeyFromPassword.mockResolvedValue(masterKey);
+      cryptoFunctionService.pbkdf2.mockResolvedValue(new Uint8Array(32));
+
+      const masterPasswordUnlockData = new MasterPasswordUnlockData(
+        salt,
+        kdfArgon2,
+        makeEncString().toSdk() as MasterKeyWrappedUserKey,
+      );
+
+      await sut.setLegacyMasterKeyFromUnlockData(password, masterPasswordUnlockData, userId);
+
+      expect(keyGenerationService.deriveKeyFromPassword).toHaveBeenCalledWith(
+        password,
+        masterPasswordUnlockData.salt,
+        masterPasswordUnlockData.kdf,
+      );
+
+      const state = await firstValueFrom(stateProvider.getUser(userId, MASTER_KEY).state$);
+      expect(state).toEqual(masterKey);
+    });
+
+    it("computes and sets master key hash in state", async () => {
+      const masterKey = makeSymmetricCryptoKey(32, 7) as MasterKey;
+      const expectedHashBytes = new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8]);
+      const expectedHashB64 = "AQIDBAUGBwg=";
+      keyGenerationService.deriveKeyFromPassword.mockResolvedValue(masterKey);
+      cryptoFunctionService.pbkdf2.mockResolvedValue(expectedHashBytes);
+      jest.spyOn(Utils, "fromBufferToB64").mockReturnValue(expectedHashB64);
+
+      const masterPasswordUnlockData = new MasterPasswordUnlockData(
+        salt,
+        kdfPBKDF2,
+        makeEncString().toSdk() as MasterKeyWrappedUserKey,
+      );
+
+      await sut.setLegacyMasterKeyFromUnlockData(password, masterPasswordUnlockData, userId);
+
+      expect(cryptoFunctionService.pbkdf2).toHaveBeenCalledWith(
+        masterKey.inner().encryptionKey,
+        password,
+        "sha256",
+        HashPurpose.LocalAuthorization,
+      );
+
+      const hashState = await firstValueFrom(sut.masterKeyHash$(userId));
+      expect(hashState).toEqual(expectedHashB64);
+    });
+
+    it("throws if password is null", async () => {
+      const masterPasswordUnlockData = new MasterPasswordUnlockData(
+        salt,
+        kdfPBKDF2,
+        makeEncString().toSdk() as MasterKeyWrappedUserKey,
+      );
+
+      await expect(
+        sut.setLegacyMasterKeyFromUnlockData(
+          null as unknown as string,
+          masterPasswordUnlockData,
+          userId,
+        ),
+      ).rejects.toThrow("password is null or undefined.");
+    });
+
+    it("throws if masterPasswordUnlockData is null", async () => {
+      await expect(
+        sut.setLegacyMasterKeyFromUnlockData(
+          password,
+          null as unknown as MasterPasswordUnlockData,
+          userId,
+        ),
+      ).rejects.toThrow("masterPasswordUnlockData is null or undefined.");
+    });
+
+    it("throws if userId is null", async () => {
+      const masterPasswordUnlockData = new MasterPasswordUnlockData(
+        salt,
+        kdfPBKDF2,
+        makeEncString().toSdk() as MasterKeyWrappedUserKey,
+      );
+
+      await expect(
+        sut.setLegacyMasterKeyFromUnlockData(
+          password,
+          masterPasswordUnlockData,
+          null as unknown as UserId,
+        ),
+      ).rejects.toThrow("userId is null or undefined.");
+    });
+  });
+
   describe("MASTER_PASSWORD_UNLOCK_KEY", () => {
     it("has the correct configuration", () => {
       expect(MASTER_PASSWORD_UNLOCK_KEY.stateDefinition).toBeDefined();

libs/common/src/key-management/master-password/services/master-password.service.ts

@@ -5,6 +5,7 @@ import { firstValueFrom, map, Observable } from "rxjs";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
 import { assertNonNullish } from "@bitwarden/common/auth/utils";
 import { SdkLoadService } from "@bitwarden/common/platform/abstractions/sdk/sdk-load.service";
+import { HashPurpose } from "@bitwarden/common/platform/enums";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
 // eslint-disable-next-line no-restricted-imports
 import { KdfConfig } from "@bitwarden/key-management";
@@ -342,4 +343,51 @@ export class MasterPasswordService implements InternalMasterPasswordServiceAbstr
 
     return this.stateProvider.getUser(userId, MASTER_PASSWORD_UNLOCK_KEY).state$;
   }
+
+  async setLegacyMasterKeyFromUnlockData(
+    password: string,
+    masterPasswordUnlockData: MasterPasswordUnlockData,
+    userId: UserId,
+  ): Promise<void> {
+    assertNonNullish(password, "password");
+    assertNonNullish(masterPasswordUnlockData, "masterPasswordUnlockData");
+    assertNonNullish(userId, "userId");
+
+    const masterKey = (await this.keyGenerationService.deriveKeyFromPassword(
+      password,
+      masterPasswordUnlockData.salt,
+      masterPasswordUnlockData.kdf,
+    )) as MasterKey;
+    const localKeyHash = await this.hashMasterKey(
+      password,
+      masterKey,
+      HashPurpose.LocalAuthorization,
+    );
+
+    await this.setMasterKey(masterKey, userId);
+    await this.setMasterKeyHash(localKeyHash, userId);
+  }
+
+  // Copied from KeyService to avoid circular dependency. This will be dropped together with `setLegacyMatserKeyFromUnlockData`.
+  private async hashMasterKey(
+    password: string,
+    key: MasterKey,
+    hashPurpose: HashPurpose,
+  ): Promise<string> {
+    if (password == null) {
+      throw new Error("password is required.");
+    }
+    if (key == null) {
+      throw new Error("key is required.");
+    }
+
+    const iterations = hashPurpose === HashPurpose.LocalAuthorization ? 2 : 1;
+    const hash = await this.cryptoFunctionService.pbkdf2(
+      key.inner().encryptionKey,
+      password,
+      "sha256",
+      iterations,
+    );
+    return Utils.fromBufferToB64(hash);
+  }
 }

libs/common/src/models/export/collection-with-id.export.ts

@@ -1,8 +1,9 @@
 // FIXME: Update this file to be type safe and remove this and next line
 // @ts-strict-ignore
-// This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
-// eslint-disable-next-line no-restricted-imports
-import { Collection as CollectionDomain, CollectionView } from "@bitwarden/admin-console/common";
+import {
+  CollectionView,
+  Collection as CollectionDomain,
+} from "@bitwarden/common/admin-console/models/collections";
 import { CollectionId } from "@bitwarden/common/types/guid";
 
 import { CollectionExport } from "./collection.export";

libs/common/src/models/export/collection.export.ts

@@ -1,8 +1,9 @@
 // FIXME: Update this file to be type safe and remove this and next line
 // @ts-strict-ignore
-// This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
-// eslint-disable-next-line no-restricted-imports
-import { Collection as CollectionDomain, CollectionView } from "@bitwarden/admin-console/common";
+import {
+  CollectionView,
+  Collection as CollectionDomain,
+} from "@bitwarden/common/admin-console/models/collections";
 
 import { EncString } from "../../key-management/crypto/models/enc-string";
 import { CollectionId, emptyGuid, OrganizationId } from "../../types/guid";

libs/common/src/platform/abstractions/fido2/fido2-client.service.abstraction.ts

@@ -136,11 +136,11 @@ export interface CreateCredentialResult {
  */
 export interface AssertCredentialParams {
   allowedCredentialIds: string[];
-  rpId: string;
+  rpId?: string;
   origin: string;
   challenge: string;
   userVerification?: UserVerification;
-  timeout: number;
+  timeout?: number;
   sameOriginWithAncestors: boolean;
   mediation?: "silent" | "optional" | "required" | "conditional";
   fallbackSupported: boolean;

libs/common/src/platform/services/fido2/fido2-client.service.ts

@@ -30,7 +30,6 @@ import {
   Fido2ClientService as Fido2ClientServiceAbstraction,
   PublicKeyCredentialParam,
   UserRequestedFallbackAbortReason,
-  UserVerification,
 } from "../../abstractions/fido2/fido2-client.service.abstraction";
 import { LogService } from "../../abstractions/log.service";
 import { Utils } from "../../misc/utils";
@@ -195,7 +194,7 @@ export class Fido2ClientService<
     }
     const timeoutSubscription = this.setAbortTimeout(
       abortController,
-      params.authenticatorSelection?.userVerification,
+      makeCredentialParams.requireUserVerification,
       params.timeout,
     );
 
@@ -318,7 +317,7 @@ export class Fido2ClientService<
 
     const timeoutSubscription = this.setAbortTimeout(
       abortController,
-      params.userVerification,
+      getAssertionParams.requireUserVerification,
       params.timeout,
     );
 
@@ -441,13 +440,13 @@ export class Fido2ClientService<
 
   private setAbortTimeout = (
     abortController: AbortController,
-    userVerification?: UserVerification,
+    requireUserVerification: boolean,
     timeout?: number,
   ): Subscription => {
     let clampedTimeout: number;
 
     const { WITH_VERIFICATION, NO_VERIFICATION } = this.TIMEOUTS;
-    if (userVerification === "required") {
+    if (requireUserVerification) {
       timeout = timeout ?? WITH_VERIFICATION.DEFAULT;
       clampedTimeout = Math.max(WITH_VERIFICATION.MIN, Math.min(timeout, WITH_VERIFICATION.MAX));
     } else {

libs/common/src/platform/sync/default-sync.service.ts

@@ -4,11 +4,11 @@ import { firstValueFrom, map } from "rxjs";
 
 // This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
 // eslint-disable-next-line no-restricted-imports
+import { CollectionService } from "@bitwarden/admin-console/common";
 import {
-  CollectionData,
   CollectionDetailsResponse,
-  CollectionService,
-} from "@bitwarden/admin-console/common";
+  CollectionData,
+} from "@bitwarden/common/admin-console/models/collections";
 import { AccountCryptographicStateService } from "@bitwarden/common/key-management/account-cryptography/account-cryptographic-state.service";
 import { SecurityStateService } from "@bitwarden/common/key-management/security-state/abstractions/security-state.service";
 // This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.

libs/common/src/platform/sync/sync.response.ts

@@ -1,6 +1,4 @@
-// This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
-// eslint-disable-next-line no-restricted-imports
-import { CollectionDetailsResponse } from "@bitwarden/admin-console/common";
+import { CollectionDetailsResponse } from "@bitwarden/common/admin-console/models/collections";
 
 import { PolicyResponse } from "../../admin-console/models/response/policy.response";
 import { UserDecryptionResponse } from "../../key-management/models/response/user-decryption.response";

libs/common/src/services/api.service.ts

@@ -4,16 +4,15 @@ import { firstValueFrom, map } from "rxjs";
 
 // This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
 // eslint-disable-next-line no-restricted-imports
+import { CreateCollectionRequest, UpdateCollectionRequest } from "@bitwarden/admin-console/common";
+// This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
+// eslint-disable-next-line no-restricted-imports
+import { LogoutReason } from "@bitwarden/auth/common";
 import {
   CollectionAccessDetailsResponse,
   CollectionDetailsResponse,
   CollectionResponse,
-  CreateCollectionRequest,
-  UpdateCollectionRequest,
-} from "@bitwarden/admin-console/common";
-// This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
-// eslint-disable-next-line no-restricted-imports
-import { LogoutReason } from "@bitwarden/auth/common";
+} from "@bitwarden/common/admin-console/models/collections";
 
 import { ApiService as ApiServiceAbstraction } from "../abstractions/api.service";
 import { OrganizationConnectionType } from "../admin-console/enums";

libs/common/src/tools/password-strength/password-strength.service.ts

@@ -1,6 +1,6 @@
 // FIXME: Update this file to be type safe and remove this and next line
 // @ts-strict-ignore
-import * as zxcvbn from "zxcvbn";
+import zxcvbn from "zxcvbn";
 
 import { PasswordStrengthServiceAbstraction } from "./password-strength.service.abstraction";
 

libs/common/src/tools/send/models/data/send.data.ts

@@ -1,5 +1,6 @@
 // FIXME: Update this file to be type safe and remove this and next line
 // @ts-strict-ignore
+import { AuthType } from "../../types/auth-type";
 import { SendType } from "../../types/send-type";
 import { SendResponse } from "../response/send.response";
 
@@ -10,6 +11,7 @@ export class SendData {
   id: string;
   accessId: string;
   type: SendType;
+  authType: AuthType;
   name: string;
   notes: string;
   file: SendFileData;
@@ -33,6 +35,7 @@ export class SendData {
     this.id = response.id;
     this.accessId = response.accessId;
     this.type = response.type;
+    this.authType = response.authType;
     this.name = response.name;
     this.notes = response.notes;
     this.key = response.key;

libs/common/src/tools/send/models/domain/send.spec.ts

@@ -11,6 +11,7 @@ import { EncryptService } from "../../../../key-management/crypto/abstractions/e
 import { SymmetricCryptoKey } from "../../../../platform/models/domain/symmetric-crypto-key";
 import { ContainerService } from "../../../../platform/services/container.service";
 import { UserKey } from "../../../../types/key";
+import { AuthType } from "../../types/auth-type";
 import { SendType } from "../../types/send-type";
 import { SendData } from "../data/send.data";
 
@@ -25,6 +26,7 @@ describe("Send", () => {
       id: "id",
       accessId: "accessId",
       type: SendType.Text,
+      authType: AuthType.None,
       name: "encName",
       notes: "encNotes",
       text: {
@@ -55,6 +57,7 @@ describe("Send", () => {
       id: null,
       accessId: null,
       type: undefined,
+      authType: undefined,
       name: null,
       notes: null,
       text: undefined,
@@ -78,6 +81,7 @@ describe("Send", () => {
       id: "id",
       accessId: "accessId",
       type: SendType.Text,
+      authType: AuthType.None,
       name: { encryptedString: "encName", encryptionType: 0 },
       notes: { encryptedString: "encNotes", encryptionType: 0 },
       text: {
@@ -107,6 +111,7 @@ describe("Send", () => {
     send.id = "id";
     send.accessId = "accessId";
     send.type = SendType.Text;
+    send.authType = AuthType.None;
     send.name = mockEnc("name");
     send.notes = mockEnc("notes");
     send.text = text;
@@ -145,6 +150,7 @@ describe("Send", () => {
       name: "name",
       notes: "notes",
       type: 0,
+      authType: 2,
       key: expect.anything(),
       cryptoKey: "cryptoKey",
       file: expect.anything(),

libs/common/src/tools/send/models/domain/send.ts

@@ -8,6 +8,7 @@ import { UserId } from "@bitwarden/common/types/guid";
 import { EncString } from "../../../../key-management/crypto/models/enc-string";
 import { Utils } from "../../../../platform/misc/utils";
 import Domain from "../../../../platform/models/domain/domain-base";
+import { AuthType } from "../../types/auth-type";
 import { SendType } from "../../types/send-type";
 import { SendData } from "../data/send.data";
 import { SendView } from "../view/send.view";
@@ -19,6 +20,7 @@ export class Send extends Domain {
   id: string;
   accessId: string;
   type: SendType;
+  authType: AuthType;
   name: EncString;
   notes: EncString;
   file: SendFile;
@@ -54,6 +56,7 @@ export class Send extends Domain {
     );
 
     this.type = obj.type;
+    this.authType = obj.authType;
     this.maxAccessCount = obj.maxAccessCount;
     this.accessCount = obj.accessCount;
     this.password = obj.password;

libs/common/src/tools/send/models/response/send.response.ts

@@ -1,6 +1,7 @@
 // FIXME: Update this file to be type safe and remove this and next line
 // @ts-strict-ignore
 import { BaseResponse } from "../../../../models/response/base.response";
+import { AuthType } from "../../types/auth-type";
 import { SendType } from "../../types/send-type";
 import { SendFileApi } from "../api/send-file.api";
 import { SendTextApi } from "../api/send-text.api";
@@ -9,6 +10,7 @@ export class SendResponse extends BaseResponse {
   id: string;
   accessId: string;
   type: SendType;
+  authType: AuthType;
   name: string;
   notes: string;
   file: SendFileApi;
@@ -29,6 +31,7 @@ export class SendResponse extends BaseResponse {
     this.id = this.getResponseProperty("Id");
     this.accessId = this.getResponseProperty("AccessId");
     this.type = this.getResponseProperty("Type");
+    this.authType = this.getResponseProperty("AuthType");
     this.name = this.getResponseProperty("Name");
     this.notes = this.getResponseProperty("Notes");
     this.key = this.getResponseProperty("Key");

libs/common/src/tools/send/models/view/send.view.ts

@@ -4,6 +4,7 @@ import { View } from "../../../../models/view/view";
 import { Utils } from "../../../../platform/misc/utils";
 import { SymmetricCryptoKey } from "../../../../platform/models/domain/symmetric-crypto-key";
 import { DeepJsonify } from "../../../../types/deep-jsonify";
+import { AuthType } from "../../types/auth-type";
 import { SendType } from "../../types/send-type";
 import { Send } from "../domain/send";
 
@@ -18,6 +19,7 @@ export class SendView implements View {
   key: Uint8Array;
   cryptoKey: SymmetricCryptoKey;
   type: SendType = null;
+  authType: AuthType = null;
   text = new SendTextView();
   file = new SendFileView();
   maxAccessCount?: number = null;
@@ -38,6 +40,7 @@ export class SendView implements View {
     this.id = s.id;
     this.accessId = s.accessId;
     this.type = s.type;
+    this.authType = s.authType;
     this.maxAccessCount = s.maxAccessCount;
     this.accessCount = s.accessCount;
     this.revisionDate = s.revisionDate;

libs/common/src/tools/send/types/auth-type.ts

@@ -0,0 +1,12 @@
+/** An type of auth necessary to access a Send */
+export const AuthType = Object.freeze({
+  /** Send requires email OTP verification */
+  Email: 0,
+  /** Send requires a password */
+  Password: 1,
+  /** Send requires no auth */
+  None: 2,
+} as const);
+
+/** An type of auth necessary to access a Send */
+export type AuthType = (typeof AuthType)[keyof typeof AuthType];

libs/common/src/vault/services/cipher-authorization.service.spec.ts

@@ -3,8 +3,9 @@ import { Observable, firstValueFrom, of } from "rxjs";
 
 // This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
 // eslint-disable-next-line no-restricted-imports
-import { CollectionService, CollectionView } from "@bitwarden/admin-console/common";
+import { CollectionService } from "@bitwarden/admin-console/common";
 import { OrganizationService } from "@bitwarden/common/admin-console/abstractions/organization/organization.service.abstraction";
+import { CollectionView } from "@bitwarden/common/admin-console/models/collections";
 import { Organization } from "@bitwarden/common/admin-console/models/domain/organization";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { UserId } from "@bitwarden/common/types/guid";

libs/common/tsconfig.spec.json

@@ -2,7 +2,9 @@
   "extends": "./tsconfig.json",
   "compilerOptions": {
     "isolatedModules": true,
-    "emitDecoratorMetadata": false
+    "emitDecoratorMetadata": false,
+    "module": "nodenext",
+    "moduleResolution": "nodenext"
   },
   "files": ["./test.setup.ts"]
 }