From 1c5095806fc12b869560698b7ae91d3c890332d7 Mon Sep 17 00:00:00 2001
From: Jordan Aasen <166539328+jaasen-livefront@users.noreply.github.com>
Date: Wed, 30 Jul 2025 12:15:59 -0700
Subject: [PATCH 1/3] [PM-24232] - [Defect][Web] Admin Console - SSH key and
 Folder should not show as options from New button (#15834)

* properly call input functions

* don't enable sshkey form

* fix logic for disabling cipher form

* prefer use of observable

* use destroyRef. change to enabled status only
---
 .../vault-header/vault-header.component.html             | 1 +
 libs/vault/src/cipher-form/cipher-form-container.ts      | 8 ++++++++
 .../src/cipher-form/components/cipher-form.component.ts  | 7 +++++++
 .../sshkey-section/sshkey-section.component.ts           | 9 ++++++++-
 .../new-cipher-menu/new-cipher-menu.component.html       | 8 ++++----
 .../new-cipher-menu/new-cipher-menu.component.ts         | 4 ++++
 6 files changed, 32 insertions(+), 5 deletions(-)

diff --git a/apps/web/src/app/vault/individual-vault/vault-header/vault-header.component.html b/apps/web/src/app/vault/individual-vault/vault-header/vault-header.component.html
index 413b4792f4e..02a7a2b12ff 100644
--- a/apps/web/src/app/vault/individual-vault/vault-header/vault-header.component.html
+++ b/apps/web/src/app/vault/individual-vault/vault-header/vault-header.component.html
@@ -78,6 +78,7 @@
     <vault-new-cipher-menu
       [canCreateCipher]="true"
       [canCreateFolder]="true"
+      [canCreateSshKey]="true"
       [canCreateCollection]="canCreateCollections"
       (cipherAdded)="addCipher($event)"
       (folderAdded)="addFolder()"
diff --git a/libs/vault/src/cipher-form/cipher-form-container.ts b/libs/vault/src/cipher-form/cipher-form-container.ts
index 628b4c07f6c..db923d9fd6b 100644
--- a/libs/vault/src/cipher-form/cipher-form-container.ts
+++ b/libs/vault/src/cipher-form/cipher-form-container.ts
@@ -1,5 +1,7 @@
 // FIXME: Update this file to be type safe and remove this and next line
 // @ts-strict-ignore
+import { Observable } from "rxjs";
+
 import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view";
 import { CipherFormConfig } from "@bitwarden/vault";
 
@@ -74,4 +76,10 @@ export abstract class CipherFormContainer {
   abstract disableFormFields(): void;
 
   abstract enableFormFields(): void;
+
+  /**
+   * An observable that emits when the form status changes to enabled.
+   * This can be used to disable child forms when the parent form is enabled.
+   */
+  formEnabled$: Observable<void>;
 }
diff --git a/libs/vault/src/cipher-form/components/cipher-form.component.ts b/libs/vault/src/cipher-form/components/cipher-form.component.ts
index 47ab9977f64..6b0f9929464 100644
--- a/libs/vault/src/cipher-form/components/cipher-form.component.ts
+++ b/libs/vault/src/cipher-form/components/cipher-form.component.ts
@@ -112,6 +112,12 @@ export class CipherFormComponent implements AfterViewInit, OnInit, OnChanges, Ci
 
   @Output() formReady = this.formReadySubject.asObservable();
 
+  /**
+   * Emitted when the form is enabled
+   */
+  private formEnabledSubject = new Subject<void>();
+  formEnabled$ = this.formEnabledSubject.asObservable();
+
   /**
    * The original cipher being edited or cloned. Null for add mode.
    */
@@ -156,6 +162,7 @@ export class CipherFormComponent implements AfterViewInit, OnInit, OnChanges, Ci
 
   enableFormFields(): void {
     this.cipherForm.enable({ emitEvent: false });
+    this.formEnabledSubject.next();
   }
 
   /**
diff --git a/libs/vault/src/cipher-form/components/sshkey-section/sshkey-section.component.ts b/libs/vault/src/cipher-form/components/sshkey-section/sshkey-section.component.ts
index 71f85e0e1b3..f83f93267c9 100644
--- a/libs/vault/src/cipher-form/components/sshkey-section/sshkey-section.component.ts
+++ b/libs/vault/src/cipher-form/components/sshkey-section/sshkey-section.component.ts
@@ -1,7 +1,7 @@
 // FIXME: Update this file to be type safe and remove this and next line
 // @ts-strict-ignore
 import { CommonModule } from "@angular/common";
-import { Component, Input, OnInit } from "@angular/core";
+import { Component, DestroyRef, inject, Input, OnInit } from "@angular/core";
 import { takeUntilDestroyed } from "@angular/core/rxjs-interop";
 import { FormBuilder, ReactiveFormsModule } from "@angular/forms";
 import { firstValueFrom } from "rxjs";
@@ -60,6 +60,7 @@ export class SshKeySectionComponent implements OnInit {
   });
 
   showImport = false;
+  private destroyRef = inject(DestroyRef);
 
   constructor(
     private cipherFormContainer: CipherFormContainer,
@@ -94,6 +95,12 @@ export class SshKeySectionComponent implements OnInit {
     if (this.platformUtilsService.getClientType() !== ClientType.Web) {
       this.showImport = true;
     }
+
+    // Disable the form if the cipher form container is enabled
+    // to prevent user interaction
+    this.cipherFormContainer.formEnabled$
+      .pipe(takeUntilDestroyed(this.destroyRef))
+      .subscribe(() => this.sshKeyForm.disable());
   }
 
   /** Set form initial form values from the current cipher */
diff --git a/libs/vault/src/components/new-cipher-menu/new-cipher-menu.component.html b/libs/vault/src/components/new-cipher-menu/new-cipher-menu.component.html
index 38b5875a605..00cfa701529 100644
--- a/libs/vault/src/components/new-cipher-menu/new-cipher-menu.component.html
+++ b/libs/vault/src/components/new-cipher-menu/new-cipher-menu.component.html
@@ -1,4 +1,4 @@
-<ng-container *ngIf="canCreateCipher || canCreateCollection || canCreateFolder">
+<ng-container *ngIf="canCreateCipher() || canCreateCollection() || canCreateFolder()">
   <div>
     <button
       bitButton
@@ -18,13 +18,13 @@
           {{ item.labelKey | i18n }}
         </button>
       }
-      <bit-menu-divider *ngIf="canCreateCipher"></bit-menu-divider>
-      <button *ngIf="canCreateFolder" type="button" bitMenuItem (click)="folderAdded.emit()">
+      <bit-menu-divider *ngIf="canCreateCipher()"></bit-menu-divider>
+      <button *ngIf="canCreateFolder()" type="button" bitMenuItem (click)="folderAdded.emit()">
         <i class="bwi bwi-fw bwi-folder" aria-hidden="true"></i>
         {{ "folder" | i18n }}
       </button>
       <button
-        *ngIf="canCreateCollection"
+        *ngIf="canCreateCollection()"
         type="button"
         bitMenuItem
         (click)="collectionAdded.emit()"
diff --git a/libs/vault/src/components/new-cipher-menu/new-cipher-menu.component.ts b/libs/vault/src/components/new-cipher-menu/new-cipher-menu.component.ts
index eb3194bc5f0..82bbc9a0749 100644
--- a/libs/vault/src/components/new-cipher-menu/new-cipher-menu.component.ts
+++ b/libs/vault/src/components/new-cipher-menu/new-cipher-menu.component.ts
@@ -18,6 +18,7 @@ export class NewCipherMenuComponent {
   canCreateCipher = input(false);
   canCreateFolder = input(false);
   canCreateCollection = input(false);
+  canCreateSshKey = input(false);
   folderAdded = output();
   collectionAdded = output();
   cipherAdded = output<CipherType>();
@@ -30,6 +31,9 @@ export class NewCipherMenuComponent {
   cipherMenuItems$ = this.restrictedItemTypesService.restricted$.pipe(
     map((restrictedTypes) => {
       return CIPHER_MENU_ITEMS.filter((item) => {
+        if (!this.canCreateSshKey() && item.type === CipherType.SshKey) {
+          return false;
+        }
         return !restrictedTypes.some((restrictedType) => restrictedType.cipherType === item.type);
       });
     }),

From 74bfc1c38bb0f54d5ac38cdcdebf30782f5ba791 Mon Sep 17 00:00:00 2001
From: Andy Pixley <3723676+pixman20@users.noreply.github.com>
Date: Wed, 30 Jul 2025 15:44:33 -0400
Subject: [PATCH 2/3] [BRE-1022] Replace SPs with Managed Identities (#15844)

---
 .github/workflows/deploy-web.yml | 61 ++++++++++----------------------
 1 file changed, 18 insertions(+), 43 deletions(-)

diff --git a/.github/workflows/deploy-web.yml b/.github/workflows/deploy-web.yml
index e21f7ae1e79..d3788dc77b9 100644
--- a/.github/workflows/deploy-web.yml
+++ b/.github/workflows/deploy-web.yml
@@ -69,7 +69,6 @@ jobs:
       azure_login_client_key_name: ${{ steps.config.outputs.azure_login_client_key_name }}
       azure_login_subscription_id_key_name: ${{ steps.config.outputs.azure_login_subscription_id_key_name }}
       retrieve_secrets_keyvault: ${{ steps.config.outputs.retrieve_secrets_keyvault }}
-      sync_utility: ${{ steps.config.outputs.sync_utility }}
       sync_delete_destination_files: ${{ steps.config.outputs.sync_delete_destination_files }}
       slack_channel_name: ${{ steps.config.outputs.slack_channel_name }}
     steps:
@@ -127,8 +126,6 @@ jobs:
               echo "slack_channel_name=alerts-deploy-dev"  >> $GITHUB_OUTPUT
               ;;
           esac
-          # Set the sync utility to use for deployment to the environment (az-sync or azcopy)
-          echo "sync_utility=azcopy" >> $GITHUB_OUTPUT
 
       - name: Environment Protection
         env:
@@ -337,32 +334,6 @@ jobs:
           description: 'Deployment from branch/tag: ${{ inputs.branch-or-tag }}'
           ref: ${{ needs.artifact-check.outputs.artifact_build_commit }}
 
-      - name: Login to Azure
-        uses: bitwarden/gh-actions/azure-login@main
-        with:
-          subscription_id: ${{ secrets[needs.setup.outputs.azure_login_subscription_id_key_name] }}
-          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
-          client_id: ${{ secrets[needs.setup.outputs.azure_login_client_key_name] }}
-
-      - name: Retrieve Storage Account connection string for az sync
-        if: ${{ needs.setup.outputs.sync_utility == 'az-sync' }}
-        id: retrieve-secrets-az-sync
-        uses: bitwarden/gh-actions/get-keyvault-secrets@main
-        with:
-          keyvault: ${{ needs.setup.outputs.retrieve_secrets_keyvault }}
-          secrets: "sa-bitwarden-web-vault-dev-key-temp"
-
-      - name: Retrieve Storage Account name and SPN credentials for azcopy
-        if: ${{ needs.setup.outputs.sync_utility == 'azcopy' }}
-        id: retrieve-secrets-azcopy
-        uses: bitwarden/gh-actions/get-keyvault-secrets@main
-        with:
-          keyvault: ${{ needs.setup.outputs.retrieve_secrets_keyvault }}
-          secrets: "sa-bitwarden-web-vault-name,sp-bitwarden-web-vault-password,sp-bitwarden-web-vault-appid,sp-bitwarden-web-vault-tenant"
-
-      - name: Log out from Azure
-        uses: bitwarden/gh-actions/azure-logout@main
-
       - name: 'Download latest cloud asset using GitHub Run ID: ${{ inputs.build-web-run-id }}'
         if: ${{ inputs.build-web-run-id }}
         uses: bitwarden/gh-actions/download-artifacts@main
@@ -389,28 +360,32 @@ jobs:
         working-directory: apps/web
         run: unzip ${{ env._ENVIRONMENT_ARTIFACT }}
 
-      - name: Sync to Azure Storage Account using az storage blob sync
-        if: ${{ needs.setup.outputs.sync_utility == 'az-sync' }}
-        working-directory: apps/web
-        run: |
-          az storage blob sync \
-            --source "./build" \
-            --container '$web' \
-            --connection-string "${{ steps.retrieve-secrets-az-sync.outputs.sa-bitwarden-web-vault-dev-key-temp }}" \
-            --delete-destination=${{ inputs.force-delete-destination }}
+      - name: Login to Azure
+        uses: bitwarden/gh-actions/azure-login@main
+        with:
+          subscription_id: ${{ secrets[needs.setup.outputs.azure_login_subscription_id_key_name] }}
+          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
+          client_id: ${{ secrets[needs.setup.outputs.azure_login_client_key_name] }}
+
+      - name: Retrieve Storage Account name
+        id: retrieve-secrets-azcopy
+        uses: bitwarden/gh-actions/get-keyvault-secrets@main
+        with:
+          keyvault: ${{ needs.setup.outputs.retrieve_secrets_keyvault }}
+          secrets: "sa-bitwarden-web-vault-name"
 
       - name: Sync to Azure Storage Account using azcopy
-        if: ${{ needs.setup.outputs.sync_utility == 'azcopy' }}
         working-directory: apps/web
         env:
-          AZCOPY_AUTO_LOGIN_TYPE: SPN
-          AZCOPY_SPA_APPLICATION_ID: ${{ steps.retrieve-secrets-azcopy.outputs.sp-bitwarden-web-vault-appid }}
-          AZCOPY_SPA_CLIENT_SECRET: ${{ steps.retrieve-secrets-azcopy.outputs.sp-bitwarden-web-vault-password }}
-          AZCOPY_TENANT_ID: ${{ steps.retrieve-secrets-azcopy.outputs.sp-bitwarden-web-vault-tenant }}
+          AZCOPY_AUTO_LOGIN_TYPE: AZCLI
+          AZCOPY_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
         run: |
           azcopy sync ./build 'https://${{ steps.retrieve-secrets-azcopy.outputs.sa-bitwarden-web-vault-name }}.blob.core.windows.net/$web/' \
             --delete-destination=${{ inputs.force-delete-destination }} --compare-hash="MD5"
 
+      - name: Log out from Azure
+        uses: bitwarden/gh-actions/azure-logout@main
+
       - name: Debug sync logs
         if: ${{ inputs.debug }}
         run: cat /home/runner/.azcopy/*.log

From 0ebd4a841bc7dd3fdfc9b93af2f65115be361593 Mon Sep 17 00:00:00 2001
From: Andy Pixley <3723676+pixman20@users.noreply.github.com>
Date: Wed, 30 Jul 2025 16:46:45 -0400
Subject: [PATCH 3/3] Revert "[BRE-1022] Replace SPs with Managed Identities
 (#15844)" (#15851)

This reverts commit 74bfc1c38bb0f54d5ac38cdcdebf30782f5ba791.
---
 .github/workflows/deploy-web.yml | 61 ++++++++++++++++++++++----------
 1 file changed, 43 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/deploy-web.yml b/.github/workflows/deploy-web.yml
index d3788dc77b9..e21f7ae1e79 100644
--- a/.github/workflows/deploy-web.yml
+++ b/.github/workflows/deploy-web.yml
@@ -69,6 +69,7 @@ jobs:
       azure_login_client_key_name: ${{ steps.config.outputs.azure_login_client_key_name }}
       azure_login_subscription_id_key_name: ${{ steps.config.outputs.azure_login_subscription_id_key_name }}
       retrieve_secrets_keyvault: ${{ steps.config.outputs.retrieve_secrets_keyvault }}
+      sync_utility: ${{ steps.config.outputs.sync_utility }}
       sync_delete_destination_files: ${{ steps.config.outputs.sync_delete_destination_files }}
       slack_channel_name: ${{ steps.config.outputs.slack_channel_name }}
     steps:
@@ -126,6 +127,8 @@ jobs:
               echo "slack_channel_name=alerts-deploy-dev"  >> $GITHUB_OUTPUT
               ;;
           esac
+          # Set the sync utility to use for deployment to the environment (az-sync or azcopy)
+          echo "sync_utility=azcopy" >> $GITHUB_OUTPUT
 
       - name: Environment Protection
         env:
@@ -334,6 +337,32 @@ jobs:
           description: 'Deployment from branch/tag: ${{ inputs.branch-or-tag }}'
           ref: ${{ needs.artifact-check.outputs.artifact_build_commit }}
 
+      - name: Login to Azure
+        uses: bitwarden/gh-actions/azure-login@main
+        with:
+          subscription_id: ${{ secrets[needs.setup.outputs.azure_login_subscription_id_key_name] }}
+          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
+          client_id: ${{ secrets[needs.setup.outputs.azure_login_client_key_name] }}
+
+      - name: Retrieve Storage Account connection string for az sync
+        if: ${{ needs.setup.outputs.sync_utility == 'az-sync' }}
+        id: retrieve-secrets-az-sync
+        uses: bitwarden/gh-actions/get-keyvault-secrets@main
+        with:
+          keyvault: ${{ needs.setup.outputs.retrieve_secrets_keyvault }}
+          secrets: "sa-bitwarden-web-vault-dev-key-temp"
+
+      - name: Retrieve Storage Account name and SPN credentials for azcopy
+        if: ${{ needs.setup.outputs.sync_utility == 'azcopy' }}
+        id: retrieve-secrets-azcopy
+        uses: bitwarden/gh-actions/get-keyvault-secrets@main
+        with:
+          keyvault: ${{ needs.setup.outputs.retrieve_secrets_keyvault }}
+          secrets: "sa-bitwarden-web-vault-name,sp-bitwarden-web-vault-password,sp-bitwarden-web-vault-appid,sp-bitwarden-web-vault-tenant"
+
+      - name: Log out from Azure
+        uses: bitwarden/gh-actions/azure-logout@main
+
       - name: 'Download latest cloud asset using GitHub Run ID: ${{ inputs.build-web-run-id }}'
         if: ${{ inputs.build-web-run-id }}
         uses: bitwarden/gh-actions/download-artifacts@main
@@ -360,32 +389,28 @@ jobs:
         working-directory: apps/web
         run: unzip ${{ env._ENVIRONMENT_ARTIFACT }}
 
-      - name: Login to Azure
-        uses: bitwarden/gh-actions/azure-login@main
-        with:
-          subscription_id: ${{ secrets[needs.setup.outputs.azure_login_subscription_id_key_name] }}
-          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
-          client_id: ${{ secrets[needs.setup.outputs.azure_login_client_key_name] }}
-
-      - name: Retrieve Storage Account name
-        id: retrieve-secrets-azcopy
-        uses: bitwarden/gh-actions/get-keyvault-secrets@main
-        with:
-          keyvault: ${{ needs.setup.outputs.retrieve_secrets_keyvault }}
-          secrets: "sa-bitwarden-web-vault-name"
+      - name: Sync to Azure Storage Account using az storage blob sync
+        if: ${{ needs.setup.outputs.sync_utility == 'az-sync' }}
+        working-directory: apps/web
+        run: |
+          az storage blob sync \
+            --source "./build" \
+            --container '$web' \
+            --connection-string "${{ steps.retrieve-secrets-az-sync.outputs.sa-bitwarden-web-vault-dev-key-temp }}" \
+            --delete-destination=${{ inputs.force-delete-destination }}
 
       - name: Sync to Azure Storage Account using azcopy
+        if: ${{ needs.setup.outputs.sync_utility == 'azcopy' }}
         working-directory: apps/web
         env:
-          AZCOPY_AUTO_LOGIN_TYPE: AZCLI
-          AZCOPY_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+          AZCOPY_AUTO_LOGIN_TYPE: SPN
+          AZCOPY_SPA_APPLICATION_ID: ${{ steps.retrieve-secrets-azcopy.outputs.sp-bitwarden-web-vault-appid }}
+          AZCOPY_SPA_CLIENT_SECRET: ${{ steps.retrieve-secrets-azcopy.outputs.sp-bitwarden-web-vault-password }}
+          AZCOPY_TENANT_ID: ${{ steps.retrieve-secrets-azcopy.outputs.sp-bitwarden-web-vault-tenant }}
         run: |
           azcopy sync ./build 'https://${{ steps.retrieve-secrets-azcopy.outputs.sa-bitwarden-web-vault-name }}.blob.core.windows.net/$web/' \
             --delete-destination=${{ inputs.force-delete-destination }} --compare-hash="MD5"
 
-      - name: Log out from Azure
-        uses: bitwarden/gh-actions/azure-logout@main
-
       - name: Debug sync logs
         if: ${{ inputs.debug }}
         run: cat /home/runner/.azcopy/*.log