When "Owners and admins can manage all collections and items" is OFF, Password Manager
reports incorrectly filter out items from collections where the user has "Can view",
"Can view except passwords", or "Can edit except passwords" access.
The root cause is that all five PM report components filter ciphers using
`(!this.organization && !edit) || !viewPassword`. Since PM reports run without an
organization context (this.organization is undefined), this condition excludes any
item where edit=false or viewPassword=false. These permission checks are unnecessary
for PM reports because:
1. Personal vault items always have edit=true and viewPassword=true, so the checks
never applied to them.
2. Organization items should appear in reports regardless of permission level — the
user has collection access, and edit restrictions should only affect the item
dialog, not report visibility.
3. Admin Console reports (which work correctly) skip this filtering because
this.organization is always set, making the condition always false.
This also explains why "Can edit except passwords" items only appeared in the
Unsecured Websites report — it was the only report that didn't check !viewPassword.
Removed the edit/viewPassword filter conditions from all five PM report components:
- exposed-passwords-report
- weak-passwords-report
- reused-passwords-report
- inactive-two-factor-report
- unsecured-websites-report
* stabilize table column widths with fixed layout (PM-31163)
Add layout="fixed" and explicit width classes to report tables to prevent
column widths from shifting during virtual scroll.
Files changed:
- weak-passwords-report.component.html
- reused-passwords-report.component.html
- exposed-passwords-report.component.html
- inactive-two-factor-report.component.html
- unsecured-websites-report.component.html
* use auto width for name column to fix width calculation (PM-31163)
Remove tw-w-1/2 from name column headers. With layout="fixed", the
explicit percentages didn't sum to 100%, causing inconsistent column widths.
Before: | 48px | 50% | 25% | 25% | = 48px + 100% (overflow)
After: | 48px | auto | 25% | 25% | = columns sum correctly
Name column now uses auto to fill remaining space.
* render headers in Admin Console to fix column widths (PM-31163)
Admin Console reports had a very wide icon column because no headers were
rendered. Without headers, table-layout: fixed uses data row content to
determine column widths, causing inconsistent sizing.
Root cause:
Three reports had their entire <ng-container header> block inside
@if (!isAdminConsoleActive), so when isAdminConsoleActive=true (Admin
Console), no headers were rendered at all.
Before (broken):
@if (!isAdminConsoleActive) {
<ng-container header> <!-- Entire header skipped in Admin Console -->
<th>Icon</th>
<th>Name</th>
<th>Owner</th>
</ng-container>
}
After (fixed):
<ng-container header> <!-- Always render headers -->
<th>Icon</th>
<th>Name</th>
@if (!isAdminConsoleActive) {
<th>Owner</th> <!-- Only Owner is conditional -->
}
</ng-container>
This matches the pattern already used by weak-passwords-report and
exposed-passwords-report, which were working correctly.
Files changed:
- unsecured-websites-report.component.html
- reused-passwords-report.component.html
- inactive-two-factor-report.component.html
Result:
- Admin Console now renders headers with correct column widths
- Icon column is 48px (tw-w-12) as expected
- Owner column properly hidden in Admin Console view
* truncate long item names to prevent column overflow
- you can hover cursor for tooltip to see full name
* [PM-27782] Update Access Intelligence loading state text
Simplify the loading progress messages shown during Access Intelligence
report generation to be more user-friendly and concise.
Changes:
- Add new i18n keys with simplified text
- Update ProgressStepConfig to use new keys
Progress message updates:
- "Fetching member data..." → "Reviewing member data..."
- "Analyzing password health..." → "Analyzing passwords..."
- "Calculating risk scores..." → "Calculating risks..."
- "Generating report data..." → "Generating reports..."
- "Saving report..." → "Compiling insights..."
- "Compiling insights..." → "Done!"
* delete old messages
* remove all "this might take a few minutes"
Updates the SetInitialPasswordService TDE + Permission user flow to use the new KM data types:
- `MasterPasswordAuthenticationData`
- `MasterPasswordUnlockData`
This allows us to move away from the deprecated `makeMasterKey()` method (which takes email as salt) as we seek to eventually separate the email from the salt.
The new `setInitialPasswordTdeUserWithPermission()` method essentially takes the existing deprecated `setInitialPassword()` method and:
- Removes logic that is specific to a `JIT_PROVISIONED_MP_ORG_USER` case. This way the method only handles `TDE_ORG_USER_RESET_PASSWORD_PERMISSION_REQUIRES_MP` cases.
- Updates the logic to use `MasterPasswordAuthenticationData` and `MasterPasswordUnlockData`
Behind feature flag: `pm-27086-update-authentication-apis-for-input-password`
* add notification handler for auto confirm
* add missing state check
* fix test
* isolate angular specific code from shared lib code
* clean up
* use autoconfirm method
* fix test
* Implement the required changes
* Fix the family plan creation for expired sub
* Resolve the pr comments
* resolve the resubscribe issue
* Removed redirectOnCompletion: true from the resubscribe
* Display the Change payment method dialog on the subscription page
* adjust the page reload time
* revert payment method open in subscription page
* Enable cancel premium see the subscription page
* Revert the removal of hasPremiumPersonally
* remove extra space
* Add can view subscription
* Use the canViewSubscription
* Resolve the tab default to premium
* use the subscription Instead of hasPremium
* Revert the changes on user-subscription
* Use the flag to redirect to subscription page
* revert the canViewSubscription change
* resolve the route issue with premium
* Change the path to
* Revert the previous iteration changes
* Fix the build error
* [PM-31750] Refactor members routing and user confirmation logic
* Simplified user confirmation process by removing feature flag checks.
* Updated routing to directly use the new members component without feature flagging.
* Removed deprecated members component references from routing modules.
* Cleaned up feature flag enum by removing unused entries.
* trigger claude
* [PM-31750] Refactor members component and remove deprecated files
* Renamed vNextMembersComponent to MembersComponent for consistency.
* Removed deprecated_members.component.ts and associated HTML files.
* Updated routing and references to use the new MembersComponent.
* Cleaned up related tests to reflect the component name change.
* Refactor import statements in security-tasks.service.ts for improved readability
* Update apps/web/src/app/admin-console/organizations/manage/user-confirm.component.ts
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Remove BaseMembersComponent and related imports from the admin console, streamlining member management functionality.
* Remove unused ConfigService import from UserConfirmComponent to clean up code.
* Implement feature flag logic for user restoration in MemberDialogComponent, allowing conditional restoration based on DefaultUserCollectionRestore flag.
---------
Co-authored-by: Thomas Rittson <trittson@bitwarden.com>
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Changes on browser
* Changes on desktop
* Changes on web
* Fix chromatic story
---------
Co-authored-by: Daniel James Smith <djsmith85@users.noreply.github.com>
This PR fixes an issue where admins couldn't edit ciphers in organization reports when the "Allow Admin Access to All Collection Items" setting was enabled.
The fix adds a check for organization.allowAdminAccessToAllCollectionItems in the canManage() method across all organization report components. When this setting is enabled, admins/owners can now properly edit all ciphers regardless of collection membership.
* enforce strict types on folders
* fix folder api service
* fix tests
* fix test
* fix type issue
* fix test
* add extra checks for folders. add specs
* fix folder.id checks
* fix id logic
* remove unecessary check
* name name and id optional in folder model
* fix tests
* Update folder and folderview
* fix folder with id export
* fix tests
* fix tests
* more defensive typing
* fix tests
* no need to check for presence
* check for empty name in folder toDomain
* fixes to folder
* initialize id in folder constructor. fix failing tests
* remove optional param to folder constructor
* fix folder
* fix test
* remove remaining checks for null folder id
* fix logic
* pass null for empty folder ids
* make id more explicit
* fix failing test
* fix failing test
* fix "No Folder" filter
Fix issue where ciphers appearing in the Org 2FA report would render without the cipher name shown. This was happening for all ciphers in Collections the active User did not have access to.
* Switch phishing data source to GitHub and remove fallback mechanism
The phish.co.za mirror is down, causing every update cycle to timeout on
the primary fetch before falling back to the GitHub raw URL. This removes
phish.co.za entirely and uses GitHub as the sole data source, which was
the original source before the mirror was introduced.
- Rename `remoteUrl`/`fallbackUrl` to `ghSourceUrl` on PhishingResource type
- Remove phish.co.za URLs from both Domains and Links resources
- Remove catchError fallback block in `_updateFullDataSet()`
- Errors now propagate to `_backgroundUpdate()` which already handles
retries (3 attempts with 5-minute delays) and graceful degradation
* revert the fallback logic removal, change prop name, add use fallback flag
* Update Links primaryUrl to Bitwarden-hosted blocklist
* remove all fallback logic
* Fix virtual scroll gap in exposed-passwords-report by setting rowSize to 54px
* Fix virtual scroll gap in weak-passwords-report by setting rowSize to 54px
Changed event parameter type from MouseEvent to Event in handleFillCipherClickEvent and handleViewCipherClickEvent to match the EventListener interface expected by useEventHandlersMemo.
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
* ignore events that do not originate from the user agent
* [pm-28831] Add isTrusted checks and update tests
* [pm-28831] Add isTrusted check to click events
* [pm-28831] Replace in-code jest exceptions with new utils
* [pm-28831] Move isTrusted checks to testable util
* [pm-28831] Remove redundant check in cipher-action.ts
* [pm-28831] Add isTrusted checks to click events in autofill-inine-menu-list
---------
Signed-off-by: Ben Brooks <bbrooks@bitwarden.com>
Co-authored-by: Jonathan Prusik <jprusik@classynemesis.com>
