From fe1c04099355162b20a891ae73bee8f91cf4ab6a Mon Sep 17 00:00:00 2001
From: Jordan Aasen <166539328+jaasen-livefront@users.noreply.github.com>
Date: Wed, 23 Jul 2025 10:37:40 -0700
Subject: [PATCH] [PM-23789][PM-237090][PM-23791][PM-23792] -
 [Web][Desktop][Browser] - Do not import cards if policy is enabled (#15740)

* restrict item types in import

* add comment

* fix spec

* fix dep

* clean up logic
---
 apps/browser/src/background/main.background.ts      |  1 +
 apps/cli/src/service-container/service-container.ts |  1 +
 libs/importer/src/components/import.component.ts    |  1 +
 libs/importer/src/services/import.service.spec.ts   |  4 ++++
 libs/importer/src/services/import.service.ts        | 13 +++++++++++++
 5 files changed, 20 insertions(+)

diff --git a/apps/browser/src/background/main.background.ts b/apps/browser/src/background/main.background.ts
index 1dfc947b28..2565f36687 100644
--- a/apps/browser/src/background/main.background.ts
+++ b/apps/browser/src/background/main.background.ts
@@ -1070,6 +1070,7 @@ export default class MainBackground {
       this.pinService,
       this.accountService,
       this.sdkService,
+      this.restrictedItemTypesService,
     );
 
     this.individualVaultExportService = new IndividualVaultExportService(
diff --git a/apps/cli/src/service-container/service-container.ts b/apps/cli/src/service-container/service-container.ts
index aa507aec1d..78f961973d 100644
--- a/apps/cli/src/service-container/service-container.ts
+++ b/apps/cli/src/service-container/service-container.ts
@@ -821,6 +821,7 @@ export class ServiceContainer {
       this.pinService,
       this.accountService,
       this.sdkService,
+      this.restrictedItemTypesService,
     );
 
     this.individualExportService = new IndividualVaultExportService(
diff --git a/libs/importer/src/components/import.component.ts b/libs/importer/src/components/import.component.ts
index 4f2715fe9c..7bac6b0e0a 100644
--- a/libs/importer/src/components/import.component.ts
+++ b/libs/importer/src/components/import.component.ts
@@ -100,6 +100,7 @@ const safeProviders: SafeProvider[] = [
       PinServiceAbstraction,
       AccountService,
       SdkService,
+      RestrictedItemTypesService,
     ],
   }),
 ];
diff --git a/libs/importer/src/services/import.service.spec.ts b/libs/importer/src/services/import.service.spec.ts
index f71c34bf20..a27b74c7ad 100644
--- a/libs/importer/src/services/import.service.spec.ts
+++ b/libs/importer/src/services/import.service.spec.ts
@@ -13,6 +13,7 @@ import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.servi
 import { FolderService } from "@bitwarden/common/vault/abstractions/folder/folder.service.abstraction";
 import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view";
 import { FolderView } from "@bitwarden/common/vault/models/view/folder.view";
+import { RestrictedItemTypesService } from "@bitwarden/common/vault/services/restricted-item-types.service";
 import { KeyService } from "@bitwarden/key-management";
 
 import { BitwardenPasswordProtectedImporter } from "../importers/bitwarden/bitwarden-password-protected-importer";
@@ -34,6 +35,7 @@ describe("ImportService", () => {
   let pinService: MockProxy<PinServiceAbstraction>;
   let accountService: MockProxy<AccountService>;
   let sdkService: MockSdkService;
+  let restrictedItemTypesService: MockProxy<RestrictedItemTypesService>;
 
   beforeEach(() => {
     cipherService = mock<CipherService>();
@@ -45,6 +47,7 @@ describe("ImportService", () => {
     encryptService = mock<EncryptService>();
     pinService = mock<PinServiceAbstraction>();
     sdkService = new MockSdkService();
+    restrictedItemTypesService = mock<RestrictedItemTypesService>();
 
     importService = new ImportService(
       cipherService,
@@ -57,6 +60,7 @@ describe("ImportService", () => {
       pinService,
       accountService,
       sdkService,
+      restrictedItemTypesService,
     );
   });
 
diff --git a/libs/importer/src/services/import.service.ts b/libs/importer/src/services/import.service.ts
index c9cb325d10..c6bff60763 100644
--- a/libs/importer/src/services/import.service.ts
+++ b/libs/importer/src/services/import.service.ts
@@ -26,6 +26,7 @@ import { CipherRequest } from "@bitwarden/common/vault/models/request/cipher.req
 import { FolderWithIdRequest } from "@bitwarden/common/vault/models/request/folder-with-id.request";
 import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view";
 import { FolderView } from "@bitwarden/common/vault/models/view/folder.view";
+import { RestrictedItemTypesService } from "@bitwarden/common/vault/services/restricted-item-types.service";
 import { KeyService } from "@bitwarden/key-management";
 
 import {
@@ -119,6 +120,7 @@ export class ImportService implements ImportServiceAbstraction {
     private pinService: PinServiceAbstraction,
     private accountService: AccountService,
     private sdkService: SdkService,
+    private restrictedItemTypesService: RestrictedItemTypesService,
   ) {}
 
   getImportOptions(): ImportOption[] {
@@ -166,6 +168,17 @@ export class ImportService implements ImportServiceAbstraction {
       }
     }
 
+    const restrictedItemTypes = await firstValueFrom(
+      this.restrictedItemTypesService.restricted$.pipe(
+        map((restrictedItemTypes) => restrictedItemTypes.map((r) => r.cipherType)),
+      ),
+    );
+
+    // Filter out restricted item types from the import result
+    importResult.ciphers = importResult.ciphers.filter(
+      (cipher) => !restrictedItemTypes.includes(cipher.type),
+    );
+
     if (organizationId && !selectedImportTarget && !canAccessImportExport) {
       const hasUnassignedCollections =
         importResult.collectionRelationships.length < importResult.ciphers.length;