update jest to v.30

.github/workflows/build.yml

@@ -56,7 +56,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node
-        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           cache: 'npm'
           cache-dependency-path: '**/package-lock.json'
@@ -111,7 +111,7 @@ jobs:
           fi
 
       - name: Upload Linux Zip to GitHub
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: bwdc-linux-${{ env._PACKAGE_VERSION }}.zip
           path: ./dist-cli/bwdc-linux-${{ env._PACKAGE_VERSION }}.zip
@@ -134,7 +134,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node
-        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           cache: 'npm'
           cache-dependency-path: '**/package-lock.json'
@@ -182,7 +182,7 @@ jobs:
           fi
 
       - name: Upload Mac Zip to GitHub
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: bwdc-macos-${{ env._PACKAGE_VERSION }}.zip
           path: ./dist-cli/bwdc-macos-${{ env._PACKAGE_VERSION }}.zip
@@ -209,7 +209,7 @@ jobs:
           choco install checksum --no-progress
 
       - name: Set up Node
-        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           cache: 'npm'
           cache-dependency-path: '**/package-lock.json'
@@ -258,7 +258,7 @@ jobs:
           }
 
       - name: Upload Windows Zip to GitHub
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: bwdc-windows-${{ env._PACKAGE_VERSION }}.zip
           path: ./dist-cli/bwdc-windows-${{ env._PACKAGE_VERSION }}.zip
@@ -284,7 +284,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node
-        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           cache: 'npm'
           cache-dependency-path: '**/package-lock.json'
@@ -338,28 +338,28 @@ jobs:
           SIGNING_CERT_NAME: ${{ steps.retrieve-secrets.outputs.code-signing-cert-name }}
 
       - name: Upload Portable Executable to GitHub
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: Bitwarden-Connector-Portable-${{ env._PACKAGE_VERSION }}.exe
           path: ./dist/Bitwarden-Connector-Portable-${{ env._PACKAGE_VERSION }}.exe
           if-no-files-found: error
 
       - name: Upload Installer Executable to GitHub
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: Bitwarden-Connector-Installer-${{ env._PACKAGE_VERSION }}.exe
           path: ./dist/Bitwarden-Connector-Installer-${{ env._PACKAGE_VERSION }}.exe
           if-no-files-found: error
 
       - name: Upload Installer Executable Blockmap to GitHub
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: Bitwarden-Connector-Installer-${{ env._PACKAGE_VERSION }}.exe.blockmap
           path: ./dist/Bitwarden-Connector-Installer-${{ env._PACKAGE_VERSION }}.exe.blockmap
           if-no-files-found: error
 
       - name: Upload latest auto-update artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: latest.yml
           path: ./dist/latest.yml
@@ -384,7 +384,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node
-        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           cache: 'npm'
           cache-dependency-path: '**/package-lock.json'
@@ -411,14 +411,14 @@ jobs:
         run: npm run dist:lin
 
       - name: Upload AppImage
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: Bitwarden-Connector-${{ env._PACKAGE_VERSION }}-x86_64.AppImage
           path: ./dist/Bitwarden-Connector-${{ env._PACKAGE_VERSION }}-x86_64.AppImage
           if-no-files-found: error
 
       - name: Upload latest auto-update artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: latest-linux.yml
           path: ./dist/latest-linux.yml
@@ -444,7 +444,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node
-        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           cache: 'npm'
           cache-dependency-path: '**/package-lock.json'
@@ -542,28 +542,28 @@ jobs:
           CSC_FOR_PULL_REQUEST: true
 
       - name: Upload .zip artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: Bitwarden-Connector-${{ env._PACKAGE_VERSION }}-mac.zip
           path: ./dist/Bitwarden-Connector-${{ env._PACKAGE_VERSION }}-mac.zip
           if-no-files-found: error
 
       - name: Upload .dmg artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: Bitwarden-Connector-${{ env._PACKAGE_VERSION }}.dmg
           path: ./dist/Bitwarden-Connector-${{ env._PACKAGE_VERSION }}.dmg
           if-no-files-found: error
 
       - name: Upload .dmg Blockmap artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: Bitwarden-Connector-${{ env._PACKAGE_VERSION }}.dmg.blockmap
           path: ./dist/Bitwarden-Connector-${{ env._PACKAGE_VERSION }}.dmg.blockmap
           if-no-files-found: error
 
       - name: Upload latest auto-update artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: latest-mac.yml
           path: ./dist/latest-mac.yml

.github/workflows/integration-test.yml

@@ -52,7 +52,7 @@ jobs:
           echo "node_version=$NODE_VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Set up Node
-        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           cache: 'npm'
           cache-dependency-path: '**/package-lock.json'
@@ -129,7 +129,7 @@ jobs:
 
       - name: Report test results
         id: report
-        uses: dorny/test-reporter@fe45e9537387dac839af0d33ba56eed8e24189e8 # v2.3.0
+        uses: dorny/test-reporter@dc3a92680fcc15842eef52e8c4606ea7ce6bd3f3 # v2.1.1
         # This will skip the job if it's a pull request from a fork, because that won't have permission to upload test results.
         # PRs from the repository and all other events are OK.
         if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository) && !cancelled()
@@ -140,7 +140,7 @@ jobs:
           fail-on-error: true
 
       - name: Upload coverage to codecov.io
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@5a605bd92782ce0810fa3b8acc235c921b497052 # v5.2.0
 
       - name: Upload results to codecov.io
-        uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1.2.1
+        uses: codecov/test-results-action@4e79e65778be1cecd5df25e14af1eafb6df80ea9 # v1.0.2

.github/workflows/release.yml

@@ -75,7 +75,7 @@ jobs:
 
       - name: Create release
         if: ${{ inputs.release_type != 'Dry Run' }}
-        uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1.20.0
+        uses: ncipollo/release-action@cdcc88a9acf3ca41c16c37bb7d21b9ad48560d87 # v1.15.0
         env:
           PKG_VERSION: ${{ needs.setup.outputs.release_version }}
         with:

.github/workflows/review-code.yml

@@ -2,7 +2,7 @@ name: Code Review
 
 on:
   pull_request:
-    types: [opened, synchronize, reopened]
+    types: [opened, labeled]
 
 permissions: {}
 

.github/workflows/test.yml

@@ -34,7 +34,7 @@ jobs:
           echo "node_version=$NODE_VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Set up Node
-        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           cache: 'npm'
           cache-dependency-path: '**/package-lock.json'
@@ -53,7 +53,7 @@ jobs:
         run: npm run test --coverage
 
       - name: Report test results
-        uses: dorny/test-reporter@fe45e9537387dac839af0d33ba56eed8e24189e8 # v2.3.0
+        uses: dorny/test-reporter@dc3a92680fcc15842eef52e8c4606ea7ce6bd3f3 # v2.1.1
         # This will skip the job if it's a pull request from a fork, because that won't have permission to upload test results.
         # PRs from the repository and all other events are OK.
         if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository) && !cancelled()
@@ -64,7 +64,7 @@ jobs:
           fail-on-error: true
 
       - name: Upload coverage to codecov.io
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@5a605bd92782ce0810fa3b8acc235c921b497052 # v5.2.0
 
       - name: Upload results to codecov.io
-        uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1.2.1
+        uses: codecov/test-results-action@4e79e65778be1cecd5df25e14af1eafb6df80ea9 # v1.0.2

.github/workflows/version-bump.yml

@@ -42,7 +42,7 @@ jobs:
         uses: bitwarden/gh-actions/azure-logout@main
 
       - name: Generate GH App token
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
         id: app-token
         with:
           app-id: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-ID }}

docs/google-workspace.md

@@ -1,300 +0,0 @@
-# Google Workspace Directory Integration
-
-This document provides technical documentation for the Google Workspace (formerly G Suite) directory integration in Bitwarden Directory Connector.
-
-## Overview
-
-The Google Workspace integration synchronizes users and groups from Google Workspace to Bitwarden organizations using the Google Admin SDK Directory API. The service uses a service account with domain-wide delegation to authenticate and access directory data.
-
-## Architecture
-
-### Service Location
-
-- **Implementation**: `src/services/directory-services/gsuite-directory.service.ts`
-- **Configuration Model**: `src/models/gsuiteConfiguration.ts`
-- **Integration Tests**: `src/services/directory-services/gsuite-directory.service.integration.spec.ts`
-
-### Authentication Flow
-
-The Google Workspace integration uses **OAuth 2.0 with Service Accounts** and domain-wide delegation:
-
-1. A service account is created in Google Cloud Console
-2. The service account is granted domain-wide delegation authority
-3. The service account is authorized for specific OAuth scopes in Google Workspace Admin Console
-4. The Directory Connector uses the service account's private key to generate JWT tokens
-5. JWT tokens are exchanged for access tokens to call the Admin SDK APIs
-
-### Required OAuth Scopes
-
-The service account must be granted the following OAuth 2.0 scopes:
-
-```
-https://www.googleapis.com/auth/admin.directory.user.readonly
-https://www.googleapis.com/auth/admin.directory.group.readonly
-https://www.googleapis.com/auth/admin.directory.group.member.readonly
-```
-
-## Configuration
-
-### Required Fields
-
-| Field         | Description                                                                             |
-| ------------- | --------------------------------------------------------------------------------------- |
-| `clientEmail` | Service account email address (e.g., `service-account@project.iam.gserviceaccount.com`) |
-| `privateKey`  | Service account private key in PEM format                                               |
-| `adminUser`   | Admin user email to impersonate for domain-wide delegation                              |
-| `domain`      | Primary domain of the Google Workspace organization                                     |
-
-### Optional Fields
-
-| Field      | Description                                                |
-| ---------- | ---------------------------------------------------------- |
-| `customer` | Customer ID for multi-domain organizations (rarely needed) |
-
-### Example Configuration
-
-```typescript
-{
-  clientEmail: "directory-connector@my-project.iam.gserviceaccount.com",
-  privateKey: "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n",
-  adminUser: "admin@example.com",
-  domain: "example.com",
-  customer: "" // Usually not required
-}
-```
-
-## Setup Instructions
-
-### 1. Create a Service Account
-
-1. Go to [Google Cloud Console](https://console.cloud.google.com)
-2. Create or select a project
-3. Navigate to **IAM & Admin** > **Service Accounts**
-4. Click **Create Service Account**
-5. Enter a name and description
-6. Click **Create and Continue**
-7. Skip granting roles (not needed for this use case)
-8. Click **Done**
-
-### 2. Generate Service Account Key
-
-1. Click on the newly created service account
-2. Navigate to the **Keys** tab
-3. Click **Add Key** > **Create new key**
-4. Select **JSON** format
-5. Click **Create** and download the key file
-6. Extract `client_email` and `private_key` from the JSON file
-
-### 3. Enable Domain-Wide Delegation
-
-1. In the service account details, click **Show Advanced Settings**
-2. Under **Domain-wide delegation**, click **Enable Google Workspace Domain-wide Delegation**
-3. Note the **Client ID** (numeric ID)
-
-### 4. Authorize the Service Account in Google Workspace
-
-1. Go to [Google Workspace Admin Console](https://admin.google.com)
-2. Navigate to **Security** > **API Controls** > **Domain-wide Delegation**
-3. Click **Add new**
-4. Enter the **Client ID** from step 3
-5. Enter the following OAuth scopes (comma-separated):
-   ```
-   https://www.googleapis.com/auth/admin.directory.user.readonly,
-   https://www.googleapis.com/auth/admin.directory.group.readonly,
-   https://www.googleapis.com/auth/admin.directory.group.member.readonly
-   ```
-6. Click **Authorize**
-
-### 5. Configure Directory Connector
-
-Use the extracted values to configure the Directory Connector:
-
-- **Client Email**: From `client_email` in the JSON key file
-- **Private Key**: From `private_key` in the JSON key file (keep the `\n` line breaks)
-- **Admin User**: Email of a super admin user in your Google Workspace domain
-- **Domain**: Your primary Google Workspace domain
-
-## Sync Behavior
-
-### User Synchronization
-
-The service synchronizes the following user attributes:
-
-| Google Workspace Field    | Bitwarden Field             | Notes                                     |
-| ------------------------- | --------------------------- | ----------------------------------------- |
-| `id`                      | `referenceId`, `externalId` | User's unique Google ID                   |
-| `primaryEmail`            | `email`                     | Normalized to lowercase                   |
-| `suspended` OR `archived` | `disabled`                  | User is disabled if suspended or archived |
-| Deleted status            | `deleted`                   | Set to true for deleted users             |
-
-**Special Behavior:**
-
-- The service queries both **active users** and **deleted users** separately
-- Suspended and archived users are included but marked as disabled
-- Deleted users are included with the `deleted` flag set to true
-
-### Group Synchronization
-
-The service synchronizes the following group attributes:
-
-| Google Workspace Field  | Bitwarden Field             | Notes                    |
-| ----------------------- | --------------------------- | ------------------------ |
-| `id`                    | `referenceId`, `externalId` | Group's unique Google ID |
-| `name`                  | `name`                      | Group display name       |
-| Members (type=USER)     | `userMemberExternalIds`     | Individual user members  |
-| Members (type=GROUP)    | `groupMemberReferenceIds`   | Nested group members     |
-| Members (type=CUSTOMER) | `userMemberExternalIds`     | All domain users         |
-
-**Member Types:**
-
-- **USER**: Individual user accounts (only ACTIVE status users are synced)
-- **GROUP**: Nested groups (allows group hierarchy)
-- **CUSTOMER**: Special member type that includes all users in the domain
-
-### Filtering
-
-#### User Filter Examples
-
-```
-exclude:testuser1@bwrox.dev | testuser1@bwrox.dev                   # Exclude multiple users
-|orgUnitPath='/Integration testing'                                 # Users in Integration testing Organizational unit (OU)
-exclude:testuser1@bwrox.dev | orgUnitPath='/Integration testing'    # Combined filter: get users in OU excluding provided user
-|email:testuser*                                                    # Users with email starting with "testuser"
-```
-
-#### Group Filter Examples
-
-An important note for group filters is that it implicitly only syncs users that are in groups. For example, in the case of
-the integration test data, `admin@bwrox.dev` is not a member of any group. Therefore, the first example filter below will
-also implicitly exclude `admin@bwrox.dev`, who is not in any group. This is important because when it is paired with an
-empty user filter, this query may semantically be understood as "sync everyone not in Integration Test Group A," while in
-practice it means "Only sync members of groups not in integration Test Groups A."
-
-```
-exclude:Integration Test Group A                                    # Get all users in groups excluding the provided group.
-```
-
-### User AND Group Filter Examples
-
-```
-
-```
-
-**Filter Syntax:**
-
-- Prefix with `|` for custom filters
-- Use `:` for pattern matching (supports `*` wildcard)
-- Combine multiple conditions with spaces (AND logic)
-
-### Pagination
-
-The service automatically handles pagination for all API calls:
-
-- Users API (active and deleted)
-- Groups API
-- Group Members API
-
-Each API call processes all pages using the `nextPageToken` mechanism until no more results are available.
-
-## Error Handling
-
-### Common Errors
-
-| Error                  | Cause                                 | Resolution                                                 |
-| ---------------------- | ------------------------------------- | ---------------------------------------------------------- |
-| "dirConfigIncomplete"  | Missing required configuration fields | Verify all required fields are provided                    |
-| "authenticationFailed" | Invalid credentials or unauthorized   | Check service account key and domain-wide delegation setup |
-| API returns 401/403    | Missing OAuth scopes                  | Verify scopes are authorized in Admin Console              |
-| API returns 404        | Invalid domain or customer ID         | Check domain configuration                                 |
-
-### Security Considerations
-
-The service implements the following security measures:
-
-1. **Credential sanitization**: Error messages do not expose private keys or sensitive credentials
-2. **Secure authentication**: Uses OAuth 2.0 with JWT tokens, not API keys
-3. **Read-only access**: Only requires read-only scopes for directory data
-4. **No credential logging**: Service account credentials are not logged
-
-## Testing
-
-### Integration Tests
-
-Integration tests are located in `src/services/directory-services/gsuite-directory.service.integration.spec.ts`.
-
-**Test Coverage:**
-
-- Basic sync (users and groups)
-- Sync with filters
-- Users-only sync
-- Groups-only sync
-- User filtering scenarios
-- Group filtering scenarios
-- Disabled users handling
-- Group membership scenarios
-- Error handling
-
-**Running Integration Tests:**
-
-Integration tests require live Google Workspace credentials:
-
-1. Create a `.env` file in the `utils/` folder with:
-   ```
-   GOOGLE_ADMIN_USER=admin@example.com
-   GOOGLE_CLIENT_EMAIL=service-account@project.iam.gserviceaccount.com
-   GOOGLE_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n"
-   GOOGLE_DOMAIN=example.com
-   ```
-2. Run tests:
-
-   ```bash
-   # Run all integration tests (includes LDAP, Google Workspace, etc.)
-   npm run test:integration
-
-   # Run only Google Workspace integration tests
-   npx jest gsuite-directory.service.integration.spec.ts
-   ```
-
-**Test Data:**
-
-The integration tests expect specific test data in Google Workspace:
-
-- **Users**: 5 test users in organizational unit `/Integration testing`
-  - testuser1@bwrox.dev (in Group A)
-  - testuser2@bwrox.dev (in Groups A & B)
-  - testuser3@bwrox.dev (in Group B)
-  - testuser4@bwrox.dev (no groups)
-  - testuser5@bwrox.dev (disabled)
-
-- **Groups**: 2 test groups with name pattern `Integration*`
-  - Integration Test Group A
-  - Integration Test Group B
-
-## API Reference
-
-### Google Admin SDK APIs Used
-
-- **Users API**: `admin.users.list()`
-  - [Documentation](https://developers.google.com/admin-sdk/directory/reference/rest/v1/users/list)
-
-- **Groups API**: `admin.groups.list()`
-  - [Documentation](https://developers.google.com/admin-sdk/directory/reference/rest/v1/groups/list)
-
-- **Members API**: `admin.members.list()`
-  - [Documentation](https://developers.google.com/admin-sdk/directory/reference/rest/v1/members/list)
-
-### Rate Limits
-
-Google Workspace Directory API rate limits:
-
-- Default: 2,400 queries per minute per user, per Google Cloud Project
-
-The service does not implement rate limiting logic; it relies on API error responses.
-
-## Resources
-
-- [Google Admin SDK Directory API Guide](https://developers.google.com/admin-sdk/directory/v1/guides)
-- [Service Account Authentication](https://developers.google.com/identity/protocols/oauth2/service-account)
-- [Domain-wide Delegation](https://support.google.com/a/answer/162106)
-- [Google Workspace Admin Console](https://admin.google.com)
-- [Bitwarden Directory Connector Documentation](https://bitwarden.com/help/directory-sync/)

jslib/common/spec/domain/symmetricCryptoKey.spec.ts

@@ -9,7 +9,7 @@ describe("SymmetricCryptoKey", () => {
       new SymmetricCryptoKey(null);
     };
 
-    expect(t).toThrowError("Must provide key");
+    expect(t).toThrow("Must provide key");
   });
 
   describe("guesses encKey from key length", () => {
@@ -63,7 +63,7 @@ describe("SymmetricCryptoKey", () => {
         new SymmetricCryptoKey(makeStaticByteArray(30));
       };
 
-      expect(t).toThrowError("Unable to determine encType.");
+      expect(t).toThrow("Unable to determine encType.");
     });
   });
 });

jslib/common/spec/utils.ts

@@ -33,5 +33,5 @@ export function makeStaticByteArray(length: number, start = 0) {
   for (let i = 0; i < length; i++) {
     arr[i] = start + i;
   }
-  return arr.buffer;
+  return arr;
 }

jslib/common/src/misc/nodeUtils.ts

@@ -26,4 +26,9 @@ export class NodeUtils {
         .on("error", (err) => reject(err));
     });
   }
+
+  // https://stackoverflow.com/a/31394257
+  static bufferToArrayBuffer(buf: Buffer): ArrayBuffer {
+    return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
+  }
 }

jslib/common/src/misc/utils.ts

@@ -36,7 +36,7 @@ export class Utils {
     Utils.global = Utils.isNode && !Utils.isBrowser ? global : window;
   }
 
-  static fromB64ToArray(str: string): Uint8Array<ArrayBuffer> {
+  static fromB64ToArray(str: string): Uint8Array {
     if (Utils.isNode) {
       return new Uint8Array(Buffer.from(str, "base64"));
     } else {
@@ -49,11 +49,11 @@ export class Utils {
     }
   }
 
-  static fromUrlB64ToArray(str: string): Uint8Array<ArrayBuffer> {
+  static fromUrlB64ToArray(str: string): Uint8Array {
     return Utils.fromB64ToArray(Utils.fromUrlB64ToB64(str));
   }
 
-  static fromHexToArray(str: string): Uint8Array<ArrayBuffer> {
+  static fromHexToArray(str: string): Uint8Array {
     if (Utils.isNode) {
       return new Uint8Array(Buffer.from(str, "hex"));
     } else {
@@ -65,7 +65,7 @@ export class Utils {
     }
   }
 
-  static fromUtf8ToArray(str: string): Uint8Array<ArrayBuffer> {
+  static fromUtf8ToArray(str: string): Uint8Array {
     if (Utils.isNode) {
       return new Uint8Array(Buffer.from(str, "utf8"));
     } else {
@@ -78,7 +78,7 @@ export class Utils {
     }
   }
 
-  static fromByteStringToArray(str: string): Uint8Array<ArrayBuffer> {
+  static fromByteStringToArray(str: string): Uint8Array {
     const arr = new Uint8Array(str.length);
     for (let i = 0; i < str.length; i++) {
       arr[i] = str.charCodeAt(i);
@@ -99,8 +99,8 @@ export class Utils {
     }
   }
 
-  static fromBufferToUrlB64(buffer: Uint8Array<ArrayBuffer>): string {
-    return Utils.fromB64toUrlB64(Utils.fromBufferToB64(buffer.buffer));
+  static fromBufferToUrlB64(buffer: ArrayBuffer): string {
+    return Utils.fromB64toUrlB64(Utils.fromBufferToB64(buffer));
   }
 
   static fromB64toUrlB64(b64Str: string) {

jslib/common/src/services/crypto.service.ts

@@ -636,9 +636,9 @@ export class CryptoService implements CryptoServiceAbstraction {
 
     const encBytes = new Uint8Array(encBuf);
     const encType = encBytes[0];
-    let ctBytes: Uint8Array<ArrayBuffer> = null;
-    let ivBytes: Uint8Array<ArrayBuffer> = null;
-    let macBytes: Uint8Array<ArrayBuffer> = null;
+    let ctBytes: Uint8Array = null;
+    let ivBytes: Uint8Array = null;
+    let macBytes: Uint8Array = null;
 
     switch (encType) {
       case EncryptionType.AesCbc128_HmacSha256_B64:

jslib/node/spec/services/nodeCryptoFunction.service.spec.ts

@@ -94,7 +94,7 @@ describe("NodeCrypto Function Service", () => {
     it("should fail with prk too small", async () => {
       const cryptoFunctionService = new NodeCryptoFunctionService();
       const f = cryptoFunctionService.hkdfExpand(
-        Utils.fromB64ToArray(prk16Byte).buffer,
+        Utils.fromB64ToArray(prk16Byte),
         "info",
         32,
         "sha256",
@@ -105,7 +105,7 @@ describe("NodeCrypto Function Service", () => {
     it("should fail with outputByteSize is too large", async () => {
       const cryptoFunctionService = new NodeCryptoFunctionService();
       const f = cryptoFunctionService.hkdfExpand(
-        Utils.fromB64ToArray(prk32Byte).buffer,
+        Utils.fromB64ToArray(prk32Byte),
         "info",
         8161,
         "sha256",
@@ -341,7 +341,7 @@ function testHkdf(
   utf8Key: string,
   unicodeKey: string,
 ) {
-  const ikm = Utils.fromB64ToArray("criAmKtfzxanbgea5/kelQ==").buffer;
+  const ikm = Utils.fromB64ToArray("criAmKtfzxanbgea5/kelQ==");
 
   const regularSalt = "salt";
   const utf8Salt = "üser_salt";
@@ -393,7 +393,7 @@ function testHkdfExpand(
   it("should create valid " + algorithm + " " + outputByteSize + " byte okm", async () => {
     const cryptoFunctionService = new NodeCryptoFunctionService();
     const okm = await cryptoFunctionService.hkdfExpand(
-      Utils.fromB64ToArray(b64prk).buffer,
+      Utils.fromB64ToArray(b64prk),
       info,
       outputByteSize,
       algorithm,

package.json

@@ -117,10 +117,10 @@
     "html-loader": "5.1.0",
     "html-webpack-plugin": "5.6.3",
     "husky": "9.1.7",
-    "jest": "29.7.0",
+    "jest": "30.0.0",
     "jest-junit": "16.0.0",
     "jest-mock-extended": "4.0.0",
-    "jest-preset-angular": "14.6.0",
+    "jest-preset-angular": "16.0.0",
     "lint-staged": "16.2.6",
     "mini-css-extract-plugin": "2.9.2",
     "minimatch": "5.1.2",
@@ -129,14 +129,14 @@
     "prettier": "3.7.4",
     "rimraf": "6.1.0",
     "rxjs": "7.8.2",
-    "sass": "1.97.1",
+    "sass": "1.94.2",
     "sass-loader": "16.0.5",
     "ts-jest": "29.4.1",
     "ts-loader": "9.5.2",
     "tsconfig-paths-webpack-plugin": "4.2.0",
     "type-fest": "5.3.0",
-    "typescript": "5.9.3",
-    "webpack": "5.104.1",
+    "typescript": "5.8.3",
+    "webpack": "5.103.0",
     "webpack-cli": "6.0.1",
     "webpack-merge": "6.0.1",
     "webpack-node-externals": "3.0.0",

src/services/directory-services/gsuite-directory.service.integration.spec.ts

@@ -50,221 +50,36 @@ describe("gsuiteDirectoryService", () => {
     directoryService = new GSuiteDirectoryService(logService, i18nService, stateService);
   });
 
-  describe("basic sync fetching users and groups", () => {
-    it("syncs without using filters (includes test data)", async () => {
-      const directoryConfig = getGSuiteConfiguration();
-      stateService.getDirectory.calledWith(DirectoryType.GSuite).mockResolvedValue(directoryConfig);
+  it("syncs without using filters (includes test data)", async () => {
+    const directoryConfig = getGSuiteConfiguration();
+    stateService.getDirectory.calledWith(DirectoryType.GSuite).mockResolvedValue(directoryConfig);
 
-      const syncConfig = getSyncConfiguration({
-        groups: true,
-        users: true,
-      });
-      stateService.getSync.mockResolvedValue(syncConfig);
-
-      const result = await directoryService.getEntries(true, true);
-
-      expect(result[0]).toEqual(expect.arrayContaining(groupFixtures));
-      expect(result[1]).toEqual(expect.arrayContaining(userFixtures));
+    const syncConfig = getSyncConfiguration({
+      groups: true,
+      users: true,
     });
+    stateService.getSync.mockResolvedValue(syncConfig);
 
-    it("syncs using user and group filters (exact match for test data)", async () => {
-      const directoryConfig = getGSuiteConfiguration();
-      stateService.getDirectory.calledWith(DirectoryType.GSuite).mockResolvedValue(directoryConfig);
+    const result = await directoryService.getEntries(true, true);
 
-      const syncConfig = getSyncConfiguration({
-        groups: true,
-        users: true,
-        userFilter: INTEGRATION_USER_FILTER,
-        groupFilter: INTEGRATION_GROUP_FILTER,
-      });
-      stateService.getSync.mockResolvedValue(syncConfig);
-
-      const result = await directoryService.getEntries(true, true);
-
-      expect(result).toEqual([groupFixtures, userFixtures]);
-    });
-
-    it("syncs only users when groups sync is disabled", async () => {
-      const directoryConfig = getGSuiteConfiguration();
-      stateService.getDirectory.calledWith(DirectoryType.GSuite).mockResolvedValue(directoryConfig);
-
-      const syncConfig = getSyncConfiguration({
-        groups: false,
-        users: true,
-        userFilter: INTEGRATION_USER_FILTER,
-      });
-      stateService.getSync.mockResolvedValue(syncConfig);
-
-      const result = await directoryService.getEntries(true, true);
-
-      expect(result[0]).toBeUndefined();
-      expect(result[1]).toEqual(expect.arrayContaining(userFixtures));
-    });
-
-    it("syncs only groups when users sync is disabled", async () => {
-      const directoryConfig = getGSuiteConfiguration();
-      stateService.getDirectory.calledWith(DirectoryType.GSuite).mockResolvedValue(directoryConfig);
-
-      const syncConfig = getSyncConfiguration({
-        groups: true,
-        users: false,
-        groupFilter: INTEGRATION_GROUP_FILTER,
-      });
-      stateService.getSync.mockResolvedValue(syncConfig);
-
-      const result = await directoryService.getEntries(true, true);
-
-      expect(result[0]).toEqual(expect.arrayContaining(groupFixtures));
-      expect(result[1]).toEqual([]);
-    });
+    expect(result[0]).toEqual(expect.arrayContaining(groupFixtures));
+    expect(result[1]).toEqual(expect.arrayContaining(userFixtures));
   });
 
-  describe("users", () => {
-    it("includes disabled users in sync results", async () => {
-      const directoryConfig = getGSuiteConfiguration();
-      stateService.getDirectory.calledWith(DirectoryType.GSuite).mockResolvedValue(directoryConfig);
+  it("syncs using user and group filters (exact match for test data)", async () => {
+    const directoryConfig = getGSuiteConfiguration();
+    stateService.getDirectory.calledWith(DirectoryType.GSuite).mockResolvedValue(directoryConfig);
 
-      const syncConfig = getSyncConfiguration({
-        users: true,
-        userFilter: INTEGRATION_USER_FILTER,
-      });
-      stateService.getSync.mockResolvedValue(syncConfig);
-
-      const result = await directoryService.getEntries(true, true);
-
-      const disabledUser = userFixtures.find((u) => u.email === "testuser5@bwrox.dev");
-      expect(result[1]).toContainEqual(disabledUser);
-      expect(disabledUser.disabled).toBe(true);
+    const syncConfig = getSyncConfiguration({
+      groups: true,
+      users: true,
+      userFilter: INTEGRATION_USER_FILTER,
+      groupFilter: INTEGRATION_GROUP_FILTER,
     });
+    stateService.getSync.mockResolvedValue(syncConfig);
 
-    it("filters users by org unit path", async () => {
-      const directoryConfig = getGSuiteConfiguration();
-      stateService.getDirectory.calledWith(DirectoryType.GSuite).mockResolvedValue(directoryConfig);
+    const result = await directoryService.getEntries(true, true);
 
-      const syncConfig = getSyncConfiguration({
-        users: true,
-        userFilter: INTEGRATION_USER_FILTER,
-      });
-      stateService.getSync.mockResolvedValue(syncConfig);
-
-      const result = await directoryService.getEntries(true, true);
-
-      expect(result[1]).toEqual(userFixtures);
-      expect(result[1].length).toBe(5);
-    });
-
-    it("filters users by email pattern", async () => {
-      const directoryConfig = getGSuiteConfiguration();
-      stateService.getDirectory.calledWith(DirectoryType.GSuite).mockResolvedValue(directoryConfig);
-
-      const syncConfig = getSyncConfiguration({
-        users: true,
-        userFilter: "|email:testuser1*",
-      });
-      stateService.getSync.mockResolvedValue(syncConfig);
-
-      const result = await directoryService.getEntries(true, true);
-
-      const testuser1 = userFixtures.find((u) => u.email === "testuser1@bwrox.dev");
-      expect(result[1]).toContainEqual(testuser1);
-      expect(result[1].length).toBeGreaterThanOrEqual(1);
-    });
-  });
-
-  describe("groups", () => {
-    it("filters groups by name pattern", async () => {
-      const directoryConfig = getGSuiteConfiguration();
-      stateService.getDirectory.calledWith(DirectoryType.GSuite).mockResolvedValue(directoryConfig);
-
-      const syncConfig = getSyncConfiguration({
-        groups: true,
-        users: true,
-        userFilter: INTEGRATION_USER_FILTER,
-        groupFilter: INTEGRATION_GROUP_FILTER,
-      });
-      stateService.getSync.mockResolvedValue(syncConfig);
-
-      const result = await directoryService.getEntries(true, true);
-
-      expect(result[0]).toEqual(groupFixtures);
-      expect(result[0].length).toBe(2);
-    });
-
-    it("includes group members correctly", async () => {
-      const directoryConfig = getGSuiteConfiguration();
-      stateService.getDirectory.calledWith(DirectoryType.GSuite).mockResolvedValue(directoryConfig);
-
-      const syncConfig = getSyncConfiguration({
-        groups: true,
-        users: true,
-        userFilter: INTEGRATION_USER_FILTER,
-        groupFilter: INTEGRATION_GROUP_FILTER,
-      });
-      stateService.getSync.mockResolvedValue(syncConfig);
-
-      const result = await directoryService.getEntries(true, true);
-
-      const groupA = result[0].find((g) => g.name === "Integration Test Group A");
-      expect(groupA).toBeDefined();
-      expect(groupA.userMemberExternalIds.size).toBe(2);
-      expect(groupA.userMemberExternalIds.has("111605910541641314041")).toBe(true);
-      expect(groupA.userMemberExternalIds.has("111147009830456099026")).toBe(true);
-
-      const groupB = result[0].find((g) => g.name === "Integration Test Group B");
-      expect(groupB).toBeDefined();
-      expect(groupB.userMemberExternalIds.size).toBe(2);
-      expect(groupB.userMemberExternalIds.has("111147009830456099026")).toBe(true);
-      expect(groupB.userMemberExternalIds.has("100150970267699397306")).toBe(true);
-    });
-
-    it("handles groups with no members", async () => {
-      const directoryConfig = getGSuiteConfiguration();
-      stateService.getDirectory.calledWith(DirectoryType.GSuite).mockResolvedValue(directoryConfig);
-
-      const syncConfig = getSyncConfiguration({
-        groups: true,
-        users: true,
-        userFilter: INTEGRATION_USER_FILTER,
-        groupFilter: "|name:Integration*",
-      });
-      stateService.getSync.mockResolvedValue(syncConfig);
-
-      const result = await directoryService.getEntries(true, true);
-
-      // All test groups should have members, but ensure the code handles empty groups
-      expect(result[0]).toBeDefined();
-      expect(Array.isArray(result[0])).toBe(true);
-    });
-  });
-
-  describe("error handling", () => {
-    it("throws error when directory configuration is incomplete", async () => {
-      stateService.getDirectory.calledWith(DirectoryType.GSuite).mockResolvedValue(
-        getGSuiteConfiguration({
-          clientEmail: "",
-        }),
-      );
-
-      const syncConfig = getSyncConfiguration({
-        users: true,
-      });
-      stateService.getSync.mockResolvedValue(syncConfig);
-
-      await expect(directoryService.getEntries(true, true)).rejects.toThrow();
-    });
-
-    it("throws error when authentication fails with invalid credentials", async () => {
-      const directoryConfig = getGSuiteConfiguration({
-        privateKey: "-----BEGIN PRIVATE KEY-----\nINVALID_KEY\n-----END PRIVATE KEY-----\n",
-      });
-      stateService.getDirectory.calledWith(DirectoryType.GSuite).mockResolvedValue(directoryConfig);
-
-      const syncConfig = getSyncConfiguration({
-        users: true,
-      });
-      stateService.getSync.mockResolvedValue(syncConfig);
-
-      await expect(directoryService.getEntries(true, true)).rejects.toThrow();
-    });
+    expect(result).toEqual([groupFixtures, userFixtures]);
   });
 });

src/services/directory-services/gsuite-directory.service.ts

@@ -14,22 +14,6 @@ import { BaseDirectoryService } from "../baseDirectory.service";
 
 import { IDirectoryService } from "./directory.service";
 
-/**
- * Google Workspace (formerly G Suite) Directory Service
- *
- * This service integrates with Google Workspace to synchronize users and groups
- * to Bitwarden organizations using the Google Admin SDK Directory API.
- *
- * @remarks
- * Authentication is performed using a service account with domain-wide delegation.
- * The service account must be granted the following OAuth 2.0 scopes:
- * - https://www.googleapis.com/auth/admin.directory.user.readonly
- * - https://www.googleapis.com/auth/admin.directory.group.readonly
- * - https://www.googleapis.com/auth/admin.directory.group.member.readonly
- *
- * @see {@link https://developers.google.com/admin-sdk/directory/v1/guides | Google Admin SDK Directory API}
- * @see {@link https://support.google.com/a/answer/162106 | Domain-wide delegation of authority}
- */
 export class GSuiteDirectoryService extends BaseDirectoryService implements IDirectoryService {
   private client: JWT;
   private service: admin_directory_v1.Admin;
@@ -46,29 +30,6 @@ export class GSuiteDirectoryService extends BaseDirectoryService implements IDir
     this.service = google.admin("directory_v1");
   }
 
-  /**
-   * Retrieves users and groups from Google Workspace directory
-   * @returns A tuple containing [groups, users] arrays
-   *
-   * @remarks
-   * This function:
-   * 1. Validates the directory type matches GSuite
-   * 2. Loads directory and sync configuration
-   * 3. Authenticates with Google Workspace using service account credentials
-   * 4. Retrieves users (if enabled in sync config)
-   * 5. Retrieves groups and their members (if enabled in sync config)
-   * 6. Applies any user/group filters specified in sync configuration
-   *
-   * User and group filters follow Google Workspace Directory API query syntax:
-   * - Use `|` prefix for custom filters (e.g., "|orgUnitPath='/Engineering'")
-   * - Multiple conditions can be combined with AND/OR operators
-   *
-   * @example
-   * ```typescript
-   * const [groups, users] = await service.getEntries(true, false);
-   * console.log(`Synced ${users.length} users and ${groups.length} groups`);
-   * ```
-   */
   async getEntries(force: boolean, test: boolean): Promise<[GroupEntry[], UserEntry[]]> {
     const type = await this.stateService.getDirectoryType();
     if (type !== DirectoryType.GSuite) {
@@ -104,26 +65,6 @@ export class GSuiteDirectoryService extends BaseDirectoryService implements IDir
     return [groups, users];
   }
 
-  /**
-   * Retrieves all users from Google Workspace directory
-   *
-   * @returns Array of UserEntry objects representing users in the directory
-   *
-   * @remarks
-   * This method performs two separate queries:
-   * 1. Active users (including suspended and archived)
-   * 2. Deleted users (marked with deleted flag)
-   *
-   * The method handles pagination automatically, fetching all pages of results.
-   * Users are filtered based on the userFilter specified in sync configuration.
-   *
-   * User properties mapped:
-   * - referenceId: User's unique Google ID
-   * - externalId: User's unique Google ID (same as referenceId)
-   * - email: User's primary email address (lowercase)
-   * - disabled: True if user is suspended or archived
-   * - deleted: True if user is deleted from the directory
-   */
   private async getUsers(): Promise<UserEntry[]> {
     const entries: UserEntry[] = [];
     const query = this.createDirectoryQuery(this.syncConfig.userFilter);
@@ -191,13 +132,6 @@ export class GSuiteDirectoryService extends BaseDirectoryService implements IDir
     return entries;
   }
 
-  /**
-   * Transforms a Google Workspace user object into a UserEntry
-   *
-   * @param user - Google Workspace user object from the API
-   * @param deleted - Whether this user is from the deleted users list
-   * @returns UserEntry object or null if user data is invalid
-   */
   private buildUser(user: admin_directory_v1.Schema$User, deleted: boolean) {
     if ((user.emails == null || user.emails === "") && !deleted) {
       return null;
@@ -212,17 +146,6 @@ export class GSuiteDirectoryService extends BaseDirectoryService implements IDir
     return entry;
   }
 
-  /**
-   * Retrieves all groups from Google Workspace directory
-   *
-   * @param setFilter - Tuple of [isWhitelist, Set<string>] for filtering groups
-   * @param users - Array of UserEntry objects to reference when processing members
-   * @returns Array of GroupEntry objects representing groups in the directory
-   *
-   * @remarks
-   * For each group, the method also retrieves all group members by calling the
-   * members API. Groups are filtered based on the groupFilter in sync configuration.
-   */
   private async getGroups(
     setFilter: [boolean, Set<string>],
     users: UserEntry[],
@@ -262,19 +185,6 @@ export class GSuiteDirectoryService extends BaseDirectoryService implements IDir
     return entries;
   }
 
-  /**
-   * Transforms a Google Workspace group object into a GroupEntry with members
-   *
-   * @param group - Google Workspace group object from the API
-   * @param users - Array of UserEntry objects for reference
-   * @returns GroupEntry object with all members populated
-   *
-   * @remarks
-   * This method retrieves all members of the group, handling three member types:
-   * - USER: Individual user members (only active status users are included)
-   * - GROUP: Nested group members
-   * - CUSTOMER: Special type that includes all users in the domain
-   */
   private async buildGroup(group: admin_directory_v1.Schema$Group, users: UserEntry[]) {
     let nextPageToken: string = null;
 
@@ -320,26 +230,6 @@ export class GSuiteDirectoryService extends BaseDirectoryService implements IDir
     return entry;
   }
 
-  /**
-   * Authenticates with Google Workspace using service account credentials
-   *
-   * @throws Error if required configuration fields are missing or authentication fails
-   *
-   * @remarks
-   * Authentication uses a JWT with the following required fields:
-   * - clientEmail: Service account email address
-   * - privateKey: Service account private key (PEM format)
-   * - subject: Admin user email to impersonate (for domain-wide delegation)
-   *
-   * The service account must be configured with domain-wide delegation and granted
-   * the required OAuth scopes in the Google Workspace Admin Console.
-   *
-   * Optional configuration:
-   * - domain: Filters results to a specific domain
-   * - customer: Customer ID for multi-domain organizations
-   *
-   * @see {@link https://developers.google.com/identity/protocols/oauth2/service-account | Service account authentication}
-   */
   private async auth() {
     if (
       this.dirConfig.clientEmail == null ||

test.setup.ts

@@ -1,7 +1,5 @@
 import { webcrypto } from "crypto";
 
-import "jest-preset-angular/setup-jest";
-
 Object.defineProperty(window, "CSS", { value: null });
 Object.defineProperty(window, "getComputedStyle", {
   value: () => {