* Session timeout policy
* default "custom" is 8 hours, validation fixes
* ownership update
* default max allowed timeout is not selected
* adjusting defaults, fixing backwards compatibility, skip type confirmation dialog when switching between the never and on system lock
* unit test coverage
* wording update, custom hours, minutes jumping on errors
* wording update
* wrong session timeout action dropdown label
* show dialog as valid when opened first time, use @for loop, use controls instead of get
* dialog static opener
* easier to understand type value listener
* unit tests
* explicit maximum allowed timeout required error
* eslint revert
* new drawer functions for crit apps
* logic for triggering the drawer functions in components
* cleanup unused logic and rename "navigation" to "action"
- ... since the click is now triggering the drawer instead of navigating to another tab/page
* null check for reportData in drawer methods
* use criticalReportResults$ to avoid duplicating logic
* use criticalReportResults$ to avoid dupe logic
* remove unused code
* Add runtime type guards for decrypted JSON data
- Create risk-insights-type-guards.ts with validation functions
- Replace unsafe type assertions with runtime validation in encryption service
- Validate ApplicationHealthReportDetail, OrganizationReportSummary, and OrganizationReportApplication
- Add detailed error messages for validation failures
- Remove TODO comments for type guard implementation
Improves security by preventing malformed data from bypassing type safety and ensures data integrity for decrypted report structures.
* test file fix
* date validation
* add runtime type guards and validation failure tests
Issue 1: Missing Test Coverage for Type Guard Validation Failures
- Create comprehensive test suite with 17 tests covering all validation scenarios
- Test invalid structures, missing fields, wrong types, and edge cases
- Verify proper error messages and validation logic for all data types
Issue 2: Silent Failure on Validation Errors (Security Concern)
- Re-throw validation errors instead of silently returning empty/default data
- Add descriptive error messages indicating potential data corruption or tampering
- Ensure all validation failures are surfaced as security issues, not swallowed
Additional Fix: Date Validation Vulnerability
- Validate date strings before creating Date objects to prevent Invalid Date (NaN)
- Throw explicit errors for unparseable date strings
- Update error handling to catch and properly surface date validation failures
* add empty string validation and sanitize error messages
- Validate array elements are non-empty strings (atRiskCipherIds, cipherIds, newApplications)
- Sanitize validation error messages to prevent information disclosure
- Log detailed errors for debugging, re-throw generic messages
- Add tests for empty string validation and error message sanitization
* add comprehensive validation for scalar strings and numeric ranges
- Validate all scalar string fields are non-empty (applicationName, userName, email, cipherId, userGuid)
- Add numeric range validation (finite, non-negative) for all count fields
- Export type guard functions for testability and reusability
- Add 19 new tests covering edge cases (empty strings, NaN, Infinity, negative numbers)
* prevent prototype pollution and unexpected property injection in type guards
- Validate object prototype is Object.prototype (prevents __proto__ attacks)
- Check for dangerous own properties (constructor, prototype)
- Strict property enumeration - reject objects with unexpected properties
- Add comprehensive security tests (prototype pollution, unexpected props)
- Protects against data tampering and information leakage
* security: always sanitize error messages to prevent information disclosure
- Remove fragile pattern matching in error handlers
- Always throw generic error messages by default
- Log detailed errors for debugging, never expose to callers
- Future-proof against validation error message changes
- Prevents disclosure of internal data structure details
Applies to all decryption/validation methods in encryption service
* security: comprehensive hardening of type validation system
CRITICAL FIXES:
- Add __proto__ to prototype pollution checks (loop-based)
- Remove conditional error sanitization (always sanitize)
SECURITY ENHANCEMENTS:
- Add integer overflow protection (Number.isSafeInteger)
- Add DoS prevention (array/string length limits: 50K/1K)
- Strengthen all 4 type guards with 10-layer validation
LIMITS:
- Max string length: 1,000 characters
- Max array length: 50,000 elements
- Max safe integer: 2^53 - 1
DOCUMENTATION:
- Update code-review-methodology.md with patterns
- Update .cursorrules with security best practices
- Create comprehensive security audit document
All 57 tests passing. No linting errors.
Defense-in-depth complete - production ready.
* fix: consolidate security constants and add upper bound validation
CRITICAL FIXES:
- Consolidate MAX_STRING_LENGTH and MAX_ARRAY_LENGTH to file level (DRY)
- Add MAX_COUNT constant (10M) for upper bound validation
- Apply upper bound checks to all 12 count fields
BENEFITS:
- Single source of truth for security limits
- Prevents business logic issues from extreme values
- Easier maintenance and updates
* filter at risk passwords count to only critical apps
* PM-26929 assign tasks to those apps that are marked as critical
---------
Co-authored-by: voommen-livefront <voommen@livefront.com>
* created shared card directive
* WIP
* use base card in anon layout
* use bit-card for pricing card component
* add base card to integration cards
* add base card to reports cards
* add base card to integration card
* use card content on report card
* use base card directive on base component
* update dirt card to use bit-card
* run prettier. fix whitespace
* add missing imports to report list stories
* add base card story and docs
* feat: add commercial sdk as optional dependency
* feat: add alias to CLI
* feat: add alias to browser
* feat: add alias to web
* fix: revert optional - we cant omit optional dependencies or the builds break
* feat: remove commercial package from browser build
* feat: remove commercial package from cli build
* feat: remove commercial package from web build
* chore: add commercial sdk to renovate
* fix: windows cli workflow
* fix: accidental change
* feat: add lint for version string
* undo weird merge changes
* WIP: added new services, refactor members to use billing service and member action service
* replace dialog logic and user logic with service implementations
* WIP
* wip add tests
* add tests, continue refactoring
* clean up
* move BillingConstraintService to billing ownership
* fix import
* fix seat count not updating if feature flag is disabled
* refactor billingMetadata, clean up
* Move files to folders. Delete unused component. Move model to file
* Move risk insights services to folder structure capturing domains, api, and view organization. Move mock data
* Remove legacy risk insight report code
* Move api model to file
* Separate data service and orchestration of data to make the data service a facade
* Add orchestration updates for fetching applications as well as migrating data.
* Updated migration of critical applications and merged old saved data to new critical applications on report object
* Update test cases
* Fixed test case after merge. Cleaned up per comments on review
* Fixed decryption and encryption issue when not using existing content key
* Fix type errors
* Fix test update
* Fixe remove critical applications
* Fix report generating flag not being reset
* Removed extra logs
* Remove legacy provider files
* Removing index files to make file re-org easier
* Move manage-clients.component and associated API invocation to AC
* Move add-existing-organization-dialog.component to AC
* Move manage-client-name-dialog.component and associated API call to AC
* Move misc clients files to AC
* Move create-client-dialog.component and associated API call to AC
* Move manage-client-subscription-dialog.component to AC
* Update provider-layout.component
* Cleanup
* Fix linting
* [PM-27024] Fix password change progress card to track only critical apps and detect new at-risk passwords
- Filter at-risk password count to critical applications only
- Update state logic to transition back to assign tasks when new at-risk passwords detected
- Only create security tasks for critical applications with at-risk passwords
- Show 'X new passwords at-risk' message when tasks exist and new at-risk passwords appear
* spec
The Key Connector URL was getting overwritten back to the default URL on `submit()` because `valueChanges` gets triggered during `submit()`. This fix adds a check to make sure we only set the default URL when changing TO Key Connector from a different decryption option. In other words, don't overwrite back to the default URL during `submit()`.
Also removes the trailing slash `/` from the default URL.
* removing unused properties from org metadata
* removing further properties from the response and replacing them with data already available
* [PM-25379] new org metadata service for new endpoint
* don't need strict ignore
* forgot unit tests
* added cache busting to metadata service
not used yet - waiting for a decision on moving a portion of this to AC
* [PM-25682] Remove ts-strict-ignore from Vault view models and update types to be strict
* [PM-25682] Ignore ViewEncryptableKeys error for old decrypt methods
* [PM-25682] Add null/undefined as possible types for isNull* and other helpers that include null checks internally
* [PM-25682] Use patchValue instead of setValue which does not support undefined values
* [PM-25682] Add type assertions and other misc. null checks where necessary
* [PM-25682] Fix importers specs
* [PM-25682] Cleanup card view/details
* [PM-25682] Fix cipher view hasAttachment helper
* [PM-25682] Cleanup unecessary null assignments in notification.background.spec.ts
* [PM-25682] Ensure linkedId is undefined instead of null
* [PM-25682] Cleanup misc typing errors
* [PM-25682] Make the CipherId required
* [PM-25682] Undo CipherId assertions
* [PM-25682] Undo brand initial value change
* [PM-25682] Update SshKeyView
* [PM-25682] Add constructor to Fido2CredentialView
* [PM-25682] Prettier
* [PM-25682] Fix strict type warnings after merge with main
* [PM-25682] Cleanup cipher view spec
* [PM-25682] Cleanup new type warnings after merge
* [PM-25682] Undo removed eslint-disable-next-line comment
* [PM-25682] Fix flaky test
* [PM-25682] Use satisfies instead of as for Fido2CredentialAutofillView
On the SSO Config page, when Key Connector is a valid option, setup a listener to changes to the Member Decryption Options form radio selection:
- If radio selection is Key Connector: set a default URL
- If radio selection is NOT Key Connector: clear the URL
This commit restructures the webpack configs for each project (i.e. web, browser, desktop, cli) such that each project has a base config that is shared in a way that requires less hard-coding of info, and more like simply calling a function with a few properties.
* new messages.json keys
* button changes for dirt activity card
* dummy data
* newApplicationsCount and temp toast
* Added third dirt-activity-card component after the existing two cards
* added newApplications to setAllAppsReportSummary
* make button smaller
* cleanup/nice-to-haves
* remove comment
* simplify activity card icon logic to use nullable iconClass
* use buttonText presence to determine button display in activity card
* apps needing review card
- I think accidentally deleted when resolving merge conflicts
* buttonClick.observed && buttonText
* Add password trigger logic to report service. Also updated api to use classes that properly handle encstring with placeholders for upcoming usage
* Fix merged test case conflict
* Fix type errors and test cases. Make create data functions for report and summary
* Update Risk Insights Report Data Type
* Update encryption usage and test cases. Moved mock data
* Remove unused variable
* Move all-application constructor
* Update all applications and risk insights to look at fetched logic
* Fix name of variable. Fetch last report run
* Cleanup all and critical application tabs drawer dependencies
* Rename components from tool to dirt. Hook up all applications to use reportResult summary
* Critical application cleanup. Trigger refetch of report for enriching when critical applications change
* Fix type errors
* Rename loader from tools to dirt. Cleanup
* Add activity tab updates using data service
* Use safeProviders in access intelligence
* Fix refresh button not appearing. Change "refresh" to "run report"
* Remove multiple async calls for isRunningReport
* Fix report button not showing
* Add no report ran message
* Fix password change on critical applications
Upgrade to the latest supported typescript version in Angular.
Resolved TS errors by:
- adding `: any` which is what the compiler previously implied and now warns about.
- adding `toJSON` to satisfy requirement.
* Adding enums for additional event logs for secrets
* updating messages
* Updating messages to be consistent for logs
* Displaying project logs, and fixing search query param searching in projects list, having deleted log for secrets and projects not show as a link
* Viewing secret and project event logs in event modal, adding to the context menu for secrets and projects the ability to view the logs if user has permission. Restricting logs to SM projs and Secs if the logged in user has event log access but not SM access.
* lint
* Lint Fixes
* fix to messages file
* fixing lint
* Adding machine account event logs
* lint fix
* Update event.service.ts
* removing duplicate function issue from merge
* Update service-accounts-list.component.ts
* fixing message
* Fixes to QA bugs
* lint fix
* linter for messages is annoying
* lint
Makes some tweaks to the SSO config page:
- SSO Identifier: update hint text
- Single Sign-On Service URL: make required, remove hint text
- Client Secret: make hidden by default (add view/hide toggle)
* Use payment domain
* Fixing lint and test issue
* Fix organization plans tax issue
* PM-26297: Use existing billing address for tax calculation if it exists
* PM-26344: Check existing payment method on submit
* refactor `canInteract` into a component level usage.
- The default service is going to be used in the CLI which won't make use of the UI-related aspects
* all nested entities to be imported from the vault
* initial add of archive command to the cli
* add archive to oss serve
* check for deleted cipher when attempting to archive
* add searchability/list functionality for archived ciphers
* restore an archived cipher
* unarchive a cipher when a user is editing it and has lost their premium status
* add missing feature flags
* re-export only needed services from the vault
* add needed await
* add prompt when applicable for editing an archived cipher
* move cipher archive service into `common/vault`
* fix testing code
* Add password trigger logic to report service. Also updated api to use classes that properly handle encstring with placeholders for upcoming usage
* Fix merged test case conflict
* Fix type errors and test cases. Make create data functions for report and summary
