Merge branch 'main' into ac/pm-21742/update-confirmed-to-org-email-templates

src/Api/AdminConsole/Controllers/OrganizationUsersController.cs

@@ -41,6 +41,8 @@ using Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
 using Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Requests;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using V1_RevokeOrganizationUserCommand = Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.RevokeUser.v1.IRevokeOrganizationUserCommand;
+using V2_RevokeOrganizationUserCommand = Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.RevokeUser.v2;
 
 namespace Bit.Api.AdminConsole.Controllers;
 
@@ -71,11 +73,13 @@ public class OrganizationUsersController : BaseAdminConsoleController
     private readonly IFeatureService _featureService;
     private readonly IPricingClient _pricingClient;
     private readonly IResendOrganizationInviteCommand _resendOrganizationInviteCommand;
+    private readonly IBulkResendOrganizationInvitesCommand _bulkResendOrganizationInvitesCommand;
     private readonly IAutomaticallyConfirmOrganizationUserCommand _automaticallyConfirmOrganizationUserCommand;
+    private readonly V2_RevokeOrganizationUserCommand.IRevokeOrganizationUserCommand _revokeOrganizationUserCommandVNext;
     private readonly IConfirmOrganizationUserCommand _confirmOrganizationUserCommand;
     private readonly IRestoreOrganizationUserCommand _restoreOrganizationUserCommand;
     private readonly IInitPendingOrganizationCommand _initPendingOrganizationCommand;
-    private readonly IRevokeOrganizationUserCommand _revokeOrganizationUserCommand;
+    private readonly V1_RevokeOrganizationUserCommand _revokeOrganizationUserCommand;
     private readonly IAdminRecoverAccountCommand _adminRecoverAccountCommand;
 
     public OrganizationUsersController(IOrganizationRepository organizationRepository,
@@ -103,10 +107,12 @@ public class OrganizationUsersController : BaseAdminConsoleController
         IConfirmOrganizationUserCommand confirmOrganizationUserCommand,
         IRestoreOrganizationUserCommand restoreOrganizationUserCommand,
         IInitPendingOrganizationCommand initPendingOrganizationCommand,
-        IRevokeOrganizationUserCommand revokeOrganizationUserCommand,
+        V1_RevokeOrganizationUserCommand revokeOrganizationUserCommand,
         IResendOrganizationInviteCommand resendOrganizationInviteCommand,
+        IBulkResendOrganizationInvitesCommand bulkResendOrganizationInvitesCommand,
         IAdminRecoverAccountCommand adminRecoverAccountCommand,
-        IAutomaticallyConfirmOrganizationUserCommand automaticallyConfirmOrganizationUserCommand)
+        IAutomaticallyConfirmOrganizationUserCommand automaticallyConfirmOrganizationUserCommand,
+        V2_RevokeOrganizationUserCommand.IRevokeOrganizationUserCommand revokeOrganizationUserCommandVNext)
     {
         _organizationRepository = organizationRepository;
         _organizationUserRepository = organizationUserRepository;
@@ -131,7 +137,9 @@ public class OrganizationUsersController : BaseAdminConsoleController
         _featureService = featureService;
         _pricingClient = pricingClient;
         _resendOrganizationInviteCommand = resendOrganizationInviteCommand;
+        _bulkResendOrganizationInvitesCommand = bulkResendOrganizationInvitesCommand;
         _automaticallyConfirmOrganizationUserCommand = automaticallyConfirmOrganizationUserCommand;
+        _revokeOrganizationUserCommandVNext = revokeOrganizationUserCommandVNext;
         _confirmOrganizationUserCommand = confirmOrganizationUserCommand;
         _restoreOrganizationUserCommand = restoreOrganizationUserCommand;
         _initPendingOrganizationCommand = initPendingOrganizationCommand;
@@ -273,7 +281,17 @@ public class OrganizationUsersController : BaseAdminConsoleController
     public async Task<ListResponseModel<OrganizationUserBulkResponseModel>> BulkReinvite(Guid orgId, [FromBody] OrganizationUserBulkRequestModel model)
     {
         var userId = _userService.GetProperUserId(User);
-        var result = await _organizationService.ResendInvitesAsync(orgId, userId.Value, model.Ids);
+
+        IEnumerable<Tuple<Core.Entities.OrganizationUser, string>> result;
+        if (_featureService.IsEnabled(FeatureFlagKeys.IncreaseBulkReinviteLimitForCloud))
+        {
+            result = await _bulkResendOrganizationInvitesCommand.BulkResendInvitesAsync(orgId, userId.Value, model.Ids);
+        }
+        else
+        {
+            result = await _organizationService.ResendInvitesAsync(orgId, userId.Value, model.Ids);
+        }
+
         return new ListResponseModel<OrganizationUserBulkResponseModel>(
             result.Select(t => new OrganizationUserBulkResponseModel(t.Item1.Id, t.Item2)));
     }
@@ -629,7 +647,29 @@ public class OrganizationUsersController : BaseAdminConsoleController
     [Authorize<ManageUsersRequirement>]
     public async Task<ListResponseModel<OrganizationUserBulkResponseModel>> BulkRevokeAsync(Guid orgId, [FromBody] OrganizationUserBulkRequestModel model)
     {
-        return await RestoreOrRevokeUsersAsync(orgId, model, _revokeOrganizationUserCommand.RevokeUsersAsync);
+        if (!_featureService.IsEnabled(FeatureFlagKeys.BulkRevokeUsersV2))
+        {
+            return await RestoreOrRevokeUsersAsync(orgId, model, _revokeOrganizationUserCommand.RevokeUsersAsync);
+        }
+
+        var currentUserId = _userService.GetProperUserId(User);
+        if (currentUserId == null)
+        {
+            throw new UnauthorizedAccessException();
+        }
+
+        var results = await _revokeOrganizationUserCommandVNext.RevokeUsersAsync(
+            new V2_RevokeOrganizationUserCommand.RevokeOrganizationUsersRequest(
+                orgId,
+                model.Ids.ToArray(),
+                new StandardUser(currentUserId.Value, await _currentContext.OrganizationOwner(orgId))));
+
+        return new ListResponseModel<OrganizationUserBulkResponseModel>(results
+            .Select(result => new OrganizationUserBulkResponseModel(result.Id,
+                result.Result.Match(
+                    error => error.Message,
+                    _ => string.Empty
+                ))));
     }
 
     [HttpPatch("revoke")]

src/Api/AdminConsole/Models/Request/Organizations/OrganizationUserRequestModels.cs

@@ -119,7 +119,7 @@ public class OrganizationUserResetPasswordEnrollmentRequestModel
 
 public class OrganizationUserBulkRequestModel
 {
-    [Required]
+    [Required, MinLength(1)]
     public IEnumerable<Guid> Ids { get; set; }
 }
 

src/Api/AdminConsole/Models/Response/Organizations/OrganizationResponseModel.cs

@@ -1,10 +1,13 @@
 // FIXME: Update this file to be null safe and then delete the line below
 #nullable disable
 
+using System.Security.Claims;
 using System.Text.Json.Serialization;
 using Bit.Api.Models.Response;
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.Billing.Enums;
+using Bit.Core.Billing.Licenses;
+using Bit.Core.Billing.Licenses.Extensions;
 using Bit.Core.Billing.Organizations.Models;
 using Bit.Core.Models.Api;
 using Bit.Core.Models.Business;
@@ -177,6 +180,30 @@ public class OrganizationSubscriptionResponseModel : OrganizationResponseModel
         }
     }
 
+    public OrganizationSubscriptionResponseModel(Organization organization, OrganizationLicense license, ClaimsPrincipal claimsPrincipal) :
+        this(organization, (Plan)null)
+    {
+        if (license != null)
+        {
+            // CRITICAL: When a license has a Token (JWT), ALWAYS use the expiration from the token claim
+            // The token's expiration is cryptographically secured and cannot be tampered with
+            // The file's Expires property can be manually edited and should NOT be trusted for display
+            if (claimsPrincipal != null)
+            {
+                Expiration = claimsPrincipal.GetValue<DateTime>(OrganizationLicenseConstants.Expires);
+                ExpirationWithoutGracePeriod = claimsPrincipal.GetValue<DateTime?>(OrganizationLicenseConstants.ExpirationWithoutGracePeriod);
+            }
+            else
+            {
+                // No token - use the license file expiration (for older licenses without tokens)
+                Expiration = license.Expires;
+                ExpirationWithoutGracePeriod = license.ExpirationWithoutGracePeriod ?? (license.Trial
+                    ? license.Expires
+                    : license.Expires?.AddDays(-Constants.OrganizationSelfHostSubscriptionGracePeriodDays));
+            }
+        }
+    }
+
     public string StorageName { get; set; }
     public double? StorageGb { get; set; }
     public BillingCustomerDiscount CustomerDiscount { get; set; }

src/Api/Billing/Controllers/AccountsController.cs

@@ -26,7 +26,8 @@ public class AccountsController(
     IUserService userService,
     ITwoFactorIsEnabledQuery twoFactorIsEnabledQuery,
     IUserAccountKeysQuery userAccountKeysQuery,
-    IFeatureService featureService) : Controller
+    IFeatureService featureService,
+    ILicensingService licensingService) : Controller
 {
     [HttpPost("premium")]
     public async Task<PaymentResponseModel> PostPremiumAsync(
@@ -97,12 +98,14 @@ public class AccountsController(
                 var includeMilestone2Discount = featureService.IsEnabled(FeatureFlagKeys.PM23341_Milestone_2);
                 var subscriptionInfo = await paymentService.GetSubscriptionAsync(user);
                 var license = await userService.GenerateLicenseAsync(user, subscriptionInfo);
-                return new SubscriptionResponseModel(user, subscriptionInfo, license, includeMilestone2Discount);
+                var claimsPrincipal = licensingService.GetClaimsPrincipalFromLicense(license);
+                return new SubscriptionResponseModel(user, subscriptionInfo, license, claimsPrincipal, includeMilestone2Discount);
             }
             else
             {
                 var license = await userService.GenerateLicenseAsync(user);
-                return new SubscriptionResponseModel(user, license);
+                var claimsPrincipal = licensingService.GetClaimsPrincipalFromLicense(license);
+                return new SubscriptionResponseModel(user, null, license, claimsPrincipal);
             }
         }
         else

src/Api/Billing/Controllers/OrganizationsController.cs

@@ -67,7 +67,8 @@ public class OrganizationsController(
         if (globalSettings.SelfHosted)
         {
             var orgLicense = await licensingService.ReadOrganizationLicenseAsync(organization);
-            return new OrganizationSubscriptionResponseModel(organization, orgLicense);
+            var claimsPrincipal = licensingService.GetClaimsPrincipalFromLicense(orgLicense);
+            return new OrganizationSubscriptionResponseModel(organization, orgLicense, claimsPrincipal);
         }
 
         var plan = await pricingClient.GetPlanOrThrow(organization.PlanType);

src/Api/Models/Response/SubscriptionResponseModel.cs

@@ -1,4 +1,7 @@
-using Bit.Core.Billing.Constants;
+using System.Security.Claims;
+using Bit.Core.Billing.Constants;
+using Bit.Core.Billing.Licenses;
+using Bit.Core.Billing.Licenses.Extensions;
 using Bit.Core.Billing.Models.Business;
 using Bit.Core.Entities;
 using Bit.Core.Models.Api;
@@ -37,6 +40,46 @@ public class SubscriptionResponseModel : ResponseModel
             : null;
     }
 
+    /// <param name="user">The user entity containing storage and premium subscription information</param>
+    /// <param name="subscription">Subscription information retrieved from the payment provider (Stripe/Braintree)</param>
+    /// <param name="license">The user's license containing expiration and feature entitlements</param>
+    /// <param name="claimsPrincipal">The claims principal containing cryptographically secure token claims</param>
+    /// <param name="includeMilestone2Discount">
+    /// Whether to include discount information in the response.
+    /// Set to true when the PM23341_Milestone_2 feature flag is enabled AND
+    /// you want to expose Milestone 2 discount information to the client.
+    /// The discount will only be included if it matches the specific Milestone 2 coupon ID.
+    /// </param>
+    public SubscriptionResponseModel(User user, SubscriptionInfo? subscription, UserLicense license, ClaimsPrincipal? claimsPrincipal, bool includeMilestone2Discount = false)
+        : base("subscription")
+    {
+        Subscription = subscription?.Subscription != null ? new BillingSubscription(subscription.Subscription) : null;
+        UpcomingInvoice = subscription?.UpcomingInvoice != null ?
+            new BillingSubscriptionUpcomingInvoice(subscription.UpcomingInvoice) : null;
+        StorageName = user.Storage.HasValue ? CoreHelpers.ReadableBytesSize(user.Storage.Value) : null;
+        StorageGb = user.Storage.HasValue ? Math.Round(user.Storage.Value / 1073741824D, 2) : 0; // 1 GB
+        MaxStorageGb = user.MaxStorageGb;
+        License = license;
+
+        // CRITICAL: When a license has a Token (JWT), ALWAYS use the expiration from the token claim
+        // The token's expiration is cryptographically secured and cannot be tampered with
+        // The file's Expires property can be manually edited and should NOT be trusted for display
+        if (claimsPrincipal != null)
+        {
+            Expiration = claimsPrincipal.GetValue<DateTime?>(UserLicenseConstants.Expires);
+        }
+        else
+        {
+            // No token - use the license file expiration (for older licenses without tokens)
+            Expiration = License.Expires;
+        }
+
+        // Only display the Milestone 2 subscription discount on the subscription page.
+        CustomerDiscount = ShouldIncludeMilestone2Discount(includeMilestone2Discount, subscription?.CustomerDiscount)
+            ? new BillingCustomerDiscount(subscription!.CustomerDiscount!)
+            : null;
+    }
+
     public SubscriptionResponseModel(User user, UserLicense? license = null)
         : base("subscription")
     {

src/Billing/Jobs/SubscriptionCancellationJob.cs

@@ -1,16 +1,17 @@
-// FIXME: Update this file to be null safe and then delete the line below
-#nullable disable
-
-using Bit.Billing.Services;
+using Bit.Billing.Services;
+using Bit.Core.Billing.Constants;
 using Bit.Core.Repositories;
 using Quartz;
 using Stripe;
 
 namespace Bit.Billing.Jobs;
 
+using static StripeConstants;
+
 public class SubscriptionCancellationJob(
     IStripeFacade stripeFacade,
-    IOrganizationRepository organizationRepository)
+    IOrganizationRepository organizationRepository,
+    ILogger<SubscriptionCancellationJob> logger)
     : IJob
 {
     public async Task Execute(IJobExecutionContext context)
@@ -21,20 +22,31 @@ public class SubscriptionCancellationJob(
         var organization = await organizationRepository.GetByIdAsync(organizationId);
         if (organization == null || organization.Enabled)
         {
+            logger.LogWarning("{Job} skipped for subscription ({SubscriptionID}) because organization is either null or enabled", nameof(SubscriptionCancellationJob), subscriptionId);
             // Organization was deleted or re-enabled by CS, skip cancellation
             return;
         }
 
-        var subscription = await stripeFacade.GetSubscription(subscriptionId);
-        if (subscription?.Status != "unpaid" ||
-            subscription.LatestInvoice?.BillingReason is not ("subscription_cycle" or "subscription_create"))
+        var subscription = await stripeFacade.GetSubscription(subscriptionId, new SubscriptionGetOptions
         {
+            Expand = ["latest_invoice"]
+        });
+
+        if (subscription is not
+            {
+                Status: SubscriptionStatus.Unpaid,
+                LatestInvoice: { BillingReason: BillingReasons.SubscriptionCreate or BillingReasons.SubscriptionCycle }
+            })
+        {
+            logger.LogWarning("{Job} skipped for subscription ({SubscriptionID}) because subscription is not unpaid or does not have a cancellable billing reason", nameof(SubscriptionCancellationJob), subscriptionId);
             return;
         }
 
         // Cancel the subscription
         await stripeFacade.CancelSubscription(subscriptionId, new SubscriptionCancelOptions());
 
+        logger.LogInformation("{Job} cancelled subscription ({SubscriptionID})", nameof(SubscriptionCancellationJob), subscriptionId);
+
         // Void any open invoices
         var options = new InvoiceListOptions
         {
@@ -46,6 +58,7 @@ public class SubscriptionCancellationJob(
         foreach (var invoice in invoices)
         {
             await stripeFacade.VoidInvoice(invoice.Id);
+            logger.LogInformation("{Job} voided invoice ({InvoiceID}) for subscription ({SubscriptionID})", nameof(SubscriptionCancellationJob), invoice.Id, subscriptionId);
         }
 
         while (invoices.HasMore)
@@ -55,6 +68,7 @@ public class SubscriptionCancellationJob(
             foreach (var invoice in invoices)
             {
                 await stripeFacade.VoidInvoice(invoice.Id);
+                logger.LogInformation("{Job} voided invoice ({InvoiceID}) for subscription ({SubscriptionID})", nameof(SubscriptionCancellationJob), invoice.Id, subscriptionId);
             }
         }
     }

src/Core/AdminConsole/Entities/OrganizationIntegration.cs

@@ -2,8 +2,6 @@
 using Bit.Core.Enums;
 using Bit.Core.Utilities;
 
-#nullable enable
-
 namespace Bit.Core.AdminConsole.Entities;
 
 public class OrganizationIntegration : ITableObject<Guid>

src/Core/AdminConsole/Entities/OrganizationIntegrationConfiguration.cs

@@ -2,8 +2,6 @@
 using Bit.Core.Enums;
 using Bit.Core.Utilities;
 
-#nullable enable
-
 namespace Bit.Core.AdminConsole.Entities;
 
 public class OrganizationIntegrationConfiguration : ITableObject<Guid>

src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/InviteUsers/BulkResendOrganizationInvitesCommand.cs

@@ -0,0 +1,69 @@
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.InviteUsers.Models;
+using Bit.Core.AdminConsole.Utilities.DebuggingInstruments;
+using Bit.Core.Entities;
+using Bit.Core.Enums;
+using Bit.Core.Exceptions;
+using Bit.Core.Repositories;
+using Microsoft.Extensions.Logging;
+
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.InviteUsers;
+
+public class BulkResendOrganizationInvitesCommand : IBulkResendOrganizationInvitesCommand
+{
+    private readonly IOrganizationUserRepository _organizationUserRepository;
+    private readonly IOrganizationRepository _organizationRepository;
+    private readonly ISendOrganizationInvitesCommand _sendOrganizationInvitesCommand;
+    private readonly ILogger<BulkResendOrganizationInvitesCommand> _logger;
+
+    public BulkResendOrganizationInvitesCommand(
+        IOrganizationUserRepository organizationUserRepository,
+        IOrganizationRepository organizationRepository,
+        ISendOrganizationInvitesCommand sendOrganizationInvitesCommand,
+        ILogger<BulkResendOrganizationInvitesCommand> logger)
+    {
+        _organizationUserRepository = organizationUserRepository;
+        _organizationRepository = organizationRepository;
+        _sendOrganizationInvitesCommand = sendOrganizationInvitesCommand;
+        _logger = logger;
+    }
+
+    public async Task<IEnumerable<Tuple<OrganizationUser, string>>> BulkResendInvitesAsync(
+        Guid organizationId,
+        Guid? invitingUserId,
+        IEnumerable<Guid> organizationUsersId)
+    {
+        var orgUsers = await _organizationUserRepository.GetManyAsync(organizationUsersId);
+        _logger.LogUserInviteStateDiagnostics(orgUsers);
+
+        var org = await _organizationRepository.GetByIdAsync(organizationId);
+        if (org == null)
+        {
+            throw new NotFoundException();
+        }
+
+        var validUsers = new List<OrganizationUser>();
+        var result = new List<Tuple<OrganizationUser, string>>();
+
+        foreach (var orgUser in orgUsers)
+        {
+            if (orgUser.Status != OrganizationUserStatusType.Invited || orgUser.OrganizationId != organizationId)
+            {
+                result.Add(Tuple.Create(orgUser, "User invalid."));
+            }
+            else
+            {
+                validUsers.Add(orgUser);
+            }
+        }
+
+        if (validUsers.Any())
+        {
+            await _sendOrganizationInvitesCommand.SendInvitesAsync(
+                new SendInvitesRequest(validUsers, org));
+
+            result.AddRange(validUsers.Select(u => Tuple.Create(u, "")));
+        }
+
+        return result;
+    }
+}

src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/InviteUsers/IBulkResendOrganizationInvitesCommand.cs

@@ -0,0 +1,20 @@
+using Bit.Core.Entities;
+
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.InviteUsers;
+
+public interface IBulkResendOrganizationInvitesCommand
+{
+    /// <summary>
+    /// Resend invites to multiple organization users in bulk.
+    /// </summary>
+    /// <param name="organizationId">The ID of the organization.</param>
+    /// <param name="invitingUserId">The ID of the user who is resending the invites.</param>
+    /// <param name="organizationUsersId">The IDs of the organization users to resend invites to.</param>
+    /// <returns>A tuple containing the OrganizationUser and an error message (empty string if successful)</returns>
+    Task<IEnumerable<Tuple<OrganizationUser, string>>> BulkResendInvitesAsync(
+        Guid organizationId,
+        Guid? invitingUserId,
+        IEnumerable<Guid> organizationUsersId);
+}
+
+

src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeUser/v1/IRevokeOrganizationUserCommand.cs

@@ -1,7 +1,7 @@
 using Bit.Core.Entities;
 using Bit.Core.Enums;
 
-namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.RevokeUser.v1;
 
 public interface IRevokeOrganizationUserCommand
 {

src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeUser/v1/RevokeOrganizationUserCommand.cs

@@ -7,7 +7,7 @@ using Bit.Core.Platform.Push;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 
-namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.RevokeUser.v1;
 
 public class RevokeOrganizationUserCommand(
     IEventService eventService,

src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeUser/v2/Errors.cs

@@ -0,0 +1,8 @@
+using Bit.Core.AdminConsole.Utilities.v2;
+
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.RevokeUser.v2;
+
+public record UserAlreadyRevoked() : BadRequestError("Already revoked.");
+public record CannotRevokeYourself() : BadRequestError("You cannot revoke yourself.");
+public record OnlyOwnersCanRevokeOwners() : BadRequestError("Only owners can revoke other owners.");
+public record MustHaveConfirmedOwner() : BadRequestError("Organization must have at least one confirmed owner.");

src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeUser/v2/IRevokeOrganizationUserCommand.cs

@@ -0,0 +1,8 @@
+using Bit.Core.AdminConsole.Utilities.v2.Results;
+
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.RevokeUser.v2;
+
+public interface IRevokeOrganizationUserCommand
+{
+    Task<IEnumerable<BulkCommandResult>> RevokeUsersAsync(RevokeOrganizationUsersRequest request);
+}

src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeUser/v2/IRevokeOrganizationUserValidator.cs

@@ -0,0 +1,9 @@
+using Bit.Core.AdminConsole.Utilities.v2.Validation;
+using Bit.Core.Entities;
+
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.RevokeUser.v2;
+
+public interface IRevokeOrganizationUserValidator
+{
+    Task<ICollection<ValidationResult<OrganizationUser>>> ValidateAsync(RevokeOrganizationUsersValidationRequest request);
+}

src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeUser/v2/RevokeOrganizationUserCommand.cs

@@ -0,0 +1,114 @@
+using Bit.Core.AdminConsole.Models.Data;
+using Bit.Core.AdminConsole.Utilities.v2.Results;
+using Bit.Core.Entities;
+using Bit.Core.Enums;
+using Bit.Core.Platform.Push;
+using Bit.Core.Repositories;
+using Bit.Core.Services;
+using Microsoft.Extensions.Logging;
+using OneOf.Types;
+
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.RevokeUser.v2;
+
+public class RevokeOrganizationUserCommand(
+    IOrganizationUserRepository organizationUserRepository,
+    IEventService eventService,
+    IPushNotificationService pushNotificationService,
+    IRevokeOrganizationUserValidator validator,
+    TimeProvider timeProvider,
+    ILogger<RevokeOrganizationUserCommand> logger)
+    : IRevokeOrganizationUserCommand
+{
+    public async Task<IEnumerable<BulkCommandResult>> RevokeUsersAsync(RevokeOrganizationUsersRequest request)
+    {
+        var validationRequest = await CreateValidationRequestsAsync(request);
+
+        var results = await validator.ValidateAsync(validationRequest);
+
+        var validUsers = results.Where(r => r.IsValid).Select(r => r.Request).ToList();
+
+        await RevokeValidUsersAsync(validUsers);
+
+        await Task.WhenAll(
+            LogRevokedOrganizationUsersAsync(validUsers, request.PerformedBy),
+            SendPushNotificationsAsync(validUsers)
+        );
+
+        return results.Select(r => r.Match(
+            error => new BulkCommandResult(r.Request.Id, error),
+            _ => new BulkCommandResult(r.Request.Id, new None())
+        ));
+    }
+
+    private async Task<RevokeOrganizationUsersValidationRequest> CreateValidationRequestsAsync(
+        RevokeOrganizationUsersRequest request)
+    {
+        var organizationUserToRevoke = await organizationUserRepository
+            .GetManyAsync(request.OrganizationUserIdsToRevoke);
+
+        return new RevokeOrganizationUsersValidationRequest(
+            request.OrganizationId,
+            request.OrganizationUserIdsToRevoke,
+            request.PerformedBy,
+            organizationUserToRevoke);
+    }
+
+    private async Task RevokeValidUsersAsync(ICollection<OrganizationUser> validUsers)
+    {
+        if (validUsers.Count == 0)
+        {
+            return;
+        }
+
+        await organizationUserRepository.RevokeManyByIdAsync(validUsers.Select(u => u.Id));
+    }
+
+    private async Task LogRevokedOrganizationUsersAsync(
+        ICollection<OrganizationUser> revokedUsers,
+        IActingUser actingUser)
+    {
+        if (revokedUsers.Count == 0)
+        {
+            return;
+        }
+
+        var eventDate = timeProvider.GetUtcNow().UtcDateTime;
+
+        if (actingUser is SystemUser { SystemUserType: not null })
+        {
+            var revokeEventsWithSystem = revokedUsers
+                .Select(user => (user, EventType.OrganizationUser_Revoked, actingUser.SystemUserType!.Value,
+                    (DateTime?)eventDate))
+                .ToList();
+            await eventService.LogOrganizationUserEventsAsync(revokeEventsWithSystem);
+        }
+        else
+        {
+            var revokeEvents = revokedUsers
+                .Select(user => (user, EventType.OrganizationUser_Revoked, (DateTime?)eventDate))
+                .ToList();
+            await eventService.LogOrganizationUserEventsAsync(revokeEvents);
+        }
+    }
+
+    private async Task SendPushNotificationsAsync(ICollection<OrganizationUser> revokedUsers)
+    {
+        var userIdsToNotify = revokedUsers
+            .Where(user => user.UserId.HasValue)
+            .Select(user => user.UserId!.Value)
+            .Distinct()
+            .ToList();
+
+        foreach (var userId in userIdsToNotify)
+        {
+            try
+            {
+                await pushNotificationService.PushSyncOrgKeysAsync(userId);
+            }
+            catch (Exception ex)
+            {
+                logger.LogWarning(ex, "Failed to send push notification for user {UserId}.", userId);
+            }
+        }
+    }
+}

src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeUser/v2/RevokeOrganizationUsersRequest.cs

@@ -0,0 +1,17 @@
+using Bit.Core.AdminConsole.Models.Data;
+using Bit.Core.Entities;
+
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.RevokeUser.v2;
+
+public record RevokeOrganizationUsersRequest(
+    Guid OrganizationId,
+    ICollection<Guid> OrganizationUserIdsToRevoke,
+    IActingUser PerformedBy
+);
+
+public record RevokeOrganizationUsersValidationRequest(
+    Guid OrganizationId,
+    ICollection<Guid> OrganizationUserIdsToRevoke,
+    IActingUser PerformedBy,
+    ICollection<OrganizationUser> OrganizationUsersToRevoke
+) : RevokeOrganizationUsersRequest(OrganizationId, OrganizationUserIdsToRevoke, PerformedBy);

src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/RevokeUser/v2/RevokeOrganizationUsersValidator.cs

@@ -0,0 +1,39 @@
+using Bit.Core.AdminConsole.Models.Data;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
+using Bit.Core.AdminConsole.Utilities.v2.Validation;
+using Bit.Core.Entities;
+using Bit.Core.Enums;
+using static Bit.Core.AdminConsole.Utilities.v2.Validation.ValidationResultHelpers;
+
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.RevokeUser.v2;
+
+public class RevokeOrganizationUsersValidator(IHasConfirmedOwnersExceptQuery hasConfirmedOwnersExceptQuery)
+    : IRevokeOrganizationUserValidator
+{
+    public async Task<ICollection<ValidationResult<OrganizationUser>>> ValidateAsync(
+        RevokeOrganizationUsersValidationRequest request)
+    {
+        var hasRemainingOwner = await hasConfirmedOwnersExceptQuery.HasConfirmedOwnersExceptAsync(request.OrganizationId,
+            request.OrganizationUsersToRevoke.Select(x => x.Id) // users excluded because they are going to be revoked
+            );
+
+        return request.OrganizationUsersToRevoke.Select(x =>
+        {
+            return x switch
+            {
+                _ when request.PerformedBy is not SystemUser
+                       && x.UserId is not null
+                       && x.UserId == request.PerformedBy.UserId =>
+                    Invalid(x, new CannotRevokeYourself()),
+                { Status: OrganizationUserStatusType.Revoked } =>
+                    Invalid(x, new UserAlreadyRevoked()),
+                { Type: OrganizationUserType.Owner } when !hasRemainingOwner =>
+                    Invalid(x, new MustHaveConfirmedOwner()),
+                { Type: OrganizationUserType.Owner } when !request.PerformedBy.IsOrganizationOwnerOrProvider =>
+                    Invalid(x, new OnlyOwnersCanRevokeOwners()),
+
+                _ => Valid(x)
+            };
+        }).ToList();
+    }
+}

src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyValidators/AutomaticUserConfirmationPolicyEventHandler.cs

@@ -4,6 +4,7 @@ using Bit.Core.AdminConsole.OrganizationFeatures.Policies.Models;
 using Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyUpdateEvents.Interfaces;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Enums;
+using Bit.Core.Models.Data.Organizations.OrganizationUsers;
 using Bit.Core.Repositories;
 
 namespace Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyValidators;
@@ -17,26 +18,13 @@ namespace Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyValidators;
 ///     <li>All organization users are compliant with the Single organization policy</li>
 ///     <li>No provider users exist</li>
 /// </ul>
-///
-/// This class also performs side effects when the policy is being enabled or disabled. They are:
-/// <ul>
-///     <li>Sets the UseAutomaticUserConfirmation organization feature to match the policy update</li>
-/// </ul>
 /// </summary>
 public class AutomaticUserConfirmationPolicyEventHandler(
     IOrganizationUserRepository organizationUserRepository,
-    IProviderUserRepository providerUserRepository,
-    IPolicyRepository policyRepository,
-    IOrganizationRepository organizationRepository,
-    TimeProvider timeProvider)
-    : IPolicyValidator, IPolicyValidationEvent, IOnPolicyPreUpdateEvent, IEnforceDependentPoliciesEvent
+    IProviderUserRepository providerUserRepository)
+    : IPolicyValidator, IPolicyValidationEvent, IEnforceDependentPoliciesEvent
 {
     public PolicyType Type => PolicyType.AutomaticUserConfirmation;
-    public async Task ExecutePreUpsertSideEffectAsync(SavePolicyModel policyRequest, Policy? currentPolicy) =>
-        await OnSaveSideEffectsAsync(policyRequest.PolicyUpdate, currentPolicy);
-
-    private const string _singleOrgPolicyNotEnabledErrorMessage =
-        "The Single organization policy must be enabled before enabling the Automatically confirm invited users policy.";
 
     private const string _usersNotCompliantWithSingleOrgErrorMessage =
         "All organization users must be compliant with the Single organization policy before enabling the Automatically confirm invited users policy. Please remove users who are members of multiple organizations.";
@@ -61,27 +49,20 @@ public class AutomaticUserConfirmationPolicyEventHandler(
     public async Task<string> ValidateAsync(SavePolicyModel savePolicyModel, Policy? currentPolicy) =>
         await ValidateAsync(savePolicyModel.PolicyUpdate, currentPolicy);
 
-    public async Task OnSaveSideEffectsAsync(PolicyUpdate policyUpdate, Policy? currentPolicy)
-    {
-        var organization = await organizationRepository.GetByIdAsync(policyUpdate.OrganizationId);
-
-        if (organization is not null)
-        {
-            organization.UseAutomaticUserConfirmation = policyUpdate.Enabled;
-            organization.RevisionDate = timeProvider.GetUtcNow().UtcDateTime;
-            await organizationRepository.UpsertAsync(organization);
-        }
-    }
+    public Task OnSaveSideEffectsAsync(PolicyUpdate policyUpdate, Policy? currentPolicy) =>
+        Task.CompletedTask;
 
     private async Task<string> ValidateEnablingPolicyAsync(Guid organizationId)
     {
-        var singleOrgValidationError = await ValidateSingleOrgPolicyComplianceAsync(organizationId);
+        var organizationUsers = await organizationUserRepository.GetManyDetailsByOrganizationAsync(organizationId);
+
+        var singleOrgValidationError = await ValidateUserComplianceWithSingleOrgAsync(organizationId, organizationUsers);
         if (!string.IsNullOrWhiteSpace(singleOrgValidationError))
         {
             return singleOrgValidationError;
         }
 
-        var providerValidationError = await ValidateNoProviderUsersAsync(organizationId);
+        var providerValidationError = await ValidateNoProviderUsersAsync(organizationUsers);
         if (!string.IsNullOrWhiteSpace(providerValidationError))
         {
             return providerValidationError;
@@ -90,42 +71,24 @@ public class AutomaticUserConfirmationPolicyEventHandler(
         return string.Empty;
     }
 
-    private async Task<string> ValidateSingleOrgPolicyComplianceAsync(Guid organizationId)
+    private async Task<string> ValidateUserComplianceWithSingleOrgAsync(Guid organizationId,
+        ICollection<OrganizationUserUserDetails> organizationUsers)
     {
-        var singleOrgPolicy = await policyRepository.GetByOrganizationIdTypeAsync(organizationId, PolicyType.SingleOrg);
-        if (singleOrgPolicy is not { Enabled: true })
-        {
-            return _singleOrgPolicyNotEnabledErrorMessage;
-        }
-
-        return await ValidateUserComplianceWithSingleOrgAsync(organizationId);
-    }
-
-    private async Task<string> ValidateUserComplianceWithSingleOrgAsync(Guid organizationId)
-    {
-        var organizationUsers = (await organizationUserRepository.GetManyDetailsByOrganizationAsync(organizationId))
-            .Where(ou => ou.Status != OrganizationUserStatusType.Invited &&
-                         ou.Status != OrganizationUserStatusType.Revoked &&
-                         ou.UserId.HasValue)
-            .ToList();
-
-        if (organizationUsers.Count == 0)
-        {
-            return string.Empty;
-        }
-
         var hasNonCompliantUser = (await organizationUserRepository.GetManyByManyUsersAsync(
                 organizationUsers.Select(ou => ou.UserId!.Value)))
-            .Any(uo => uo.OrganizationId != organizationId &&
-                       uo.Status != OrganizationUserStatusType.Invited);
+            .Any(uo => uo.OrganizationId != organizationId
+                       && uo.Status != OrganizationUserStatusType.Invited);
 
         return hasNonCompliantUser ? _usersNotCompliantWithSingleOrgErrorMessage : string.Empty;
     }
 
-    private async Task<string> ValidateNoProviderUsersAsync(Guid organizationId)
+    private async Task<string> ValidateNoProviderUsersAsync(ICollection<OrganizationUserUserDetails> organizationUsers)
     {
-        var providerUsers = await providerUserRepository.GetManyByOrganizationAsync(organizationId);
+        var userIds = organizationUsers.Where(x => x.UserId is not null)
+            .Select(x => x.UserId!.Value);
 
-        return providerUsers.Count > 0 ? _providerUsersExistErrorMessage : string.Empty;
+        return (await providerUserRepository.GetManyByManyUsersAsync(userIds)).Count != 0
+            ? _providerUsersExistErrorMessage
+            : string.Empty;
     }
 }

src/Core/AdminConsole/Repositories/IOrganizationIntegrationConfigurationRepository.cs

@@ -6,10 +6,23 @@ namespace Bit.Core.Repositories;
 
 public interface IOrganizationIntegrationConfigurationRepository : IRepository<OrganizationIntegrationConfiguration, Guid>
 {
-    Task<List<OrganizationIntegrationConfigurationDetails>> GetConfigurationDetailsAsync(
+    /// <summary>
+    /// Retrieve the list of available configuration details for a specific event for the organization and
+    /// integration type.<br/>
+    /// <br/>
+    /// <b>Note:</b> This returns all configurations that match the event type explicitly <b>and</b>
+    /// all the configurations that have a null event type - null event type is considered a
+    /// wildcard that matches all events.
+    ///
+    /// </summary>
+    /// <param name="eventType">The specific event type</param>
+    /// <param name="organizationId">The id of the organization</param>
+    /// <param name="integrationType">The integration type</param>
+    /// <returns>A List of <see cref="OrganizationIntegrationConfigurationDetails"/> that match</returns>
+    Task<List<OrganizationIntegrationConfigurationDetails>> GetManyByEventTypeOrganizationIdIntegrationType(
+        EventType eventType,
         Guid organizationId,
-        IntegrationType integrationType,
-        EventType eventType);
+        IntegrationType integrationType);
 
     Task<List<OrganizationIntegrationConfigurationDetails>> GetAllConfigurationDetailsAsync();
 

src/Core/AdminConsole/Repositories/IProviderUserRepository.cs

@@ -12,6 +12,7 @@ public interface IProviderUserRepository : IRepository<ProviderUser, Guid>
     Task<int> GetCountByProviderAsync(Guid providerId, string email, bool onlyRegisteredUsers);
     Task<ICollection<ProviderUser>> GetManyAsync(IEnumerable<Guid> ids);
     Task<ICollection<ProviderUser>> GetManyByUserAsync(Guid userId);
+    Task<ICollection<ProviderUser>> GetManyByManyUsersAsync(IEnumerable<Guid> userIds);
     Task<ProviderUser?> GetByProviderUserAsync(Guid providerId, Guid userId);
     Task<ICollection<ProviderUser>> GetManyByProviderAsync(Guid providerId, ProviderUserType? type = null);
     Task<ICollection<ProviderUserUserDetails>> GetManyDetailsByProviderAsync(Guid providerId, ProviderUserStatusType? status = null);

src/Core/AdminConsole/Services/Implementations/EventIntegrations/EventIntegrationHandler.cs

@@ -5,6 +5,7 @@ using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.AdminConsole.Utilities;
 using Bit.Core.Enums;
 using Bit.Core.Models.Data;
+using Bit.Core.Models.Data.Organizations;
 using Bit.Core.Models.Data.Organizations.OrganizationUsers;
 using Bit.Core.Repositories;
 using Bit.Core.Utilities;
@@ -17,8 +18,8 @@ public class EventIntegrationHandler<T>(
     IntegrationType integrationType,
     IEventIntegrationPublisher eventIntegrationPublisher,
     IIntegrationFilterService integrationFilterService,
-    IIntegrationConfigurationDetailsCache configurationCache,
     IFusionCache cache,
+    IOrganizationIntegrationConfigurationRepository configurationRepository,
     IGroupRepository groupRepository,
     IOrganizationRepository organizationRepository,
     IOrganizationUserRepository organizationUserRepository,
@@ -27,17 +28,7 @@ public class EventIntegrationHandler<T>(
 {
     public async Task HandleEventAsync(EventMessage eventMessage)
     {
-        if (eventMessage.OrganizationId is not Guid organizationId)
-        {
-            return;
-        }
-
-        var configurations = configurationCache.GetConfigurationDetails(
-            organizationId,
-            integrationType,
-            eventMessage.Type);
-
-        foreach (var configuration in configurations)
+        foreach (var configuration in await GetConfigurationDetailsListAsync(eventMessage))
         {
             try
             {
@@ -64,7 +55,7 @@ public class EventIntegrationHandler<T>(
                 {
                     IntegrationType = integrationType,
                     MessageId = messageId.ToString(),
-                    OrganizationId = organizationId.ToString(),
+                    OrganizationId = eventMessage.OrganizationId?.ToString(),
                     Configuration = config,
                     RenderedTemplate = renderedTemplate,
                     RetryCount = 0,
@@ -132,6 +123,37 @@ public class EventIntegrationHandler<T>(
         return context;
     }
 
+    private async Task<List<OrganizationIntegrationConfigurationDetails>> GetConfigurationDetailsListAsync(EventMessage eventMessage)
+    {
+        if (eventMessage.OrganizationId is not Guid organizationId)
+        {
+            return [];
+        }
+
+        List<OrganizationIntegrationConfigurationDetails> configurations = [];
+
+        var integrationTag = EventIntegrationsCacheConstants.BuildCacheTagForOrganizationIntegration(
+            organizationId,
+            integrationType
+        );
+
+        configurations.AddRange(await cache.GetOrSetAsync<List<OrganizationIntegrationConfigurationDetails>>(
+            key: EventIntegrationsCacheConstants.BuildCacheKeyForOrganizationIntegrationConfigurationDetails(
+                organizationId: organizationId,
+                integrationType: integrationType,
+                eventType: eventMessage.Type),
+            factory: async _ => await configurationRepository.GetManyByEventTypeOrganizationIdIntegrationType(
+                eventType: eventMessage.Type,
+                organizationId: organizationId,
+                integrationType: integrationType),
+            options: new FusionCacheEntryOptions(
+                duration: EventIntegrationsCacheConstants.DurationForOrganizationIntegrationConfigurationDetails),
+            tags: [integrationTag]
+        ));
+
+        return configurations;
+    }
+
     private async Task<OrganizationUserUserDetails?> GetUserFromCacheAsync(Guid organizationId, Guid userId) =>
         await cache.GetOrSetAsync<OrganizationUserUserDetails?>(
             key: EventIntegrationsCacheConstants.BuildCacheKeyForOrganizationUser(organizationId, userId),

src/Core/AdminConsole/Services/Implementations/EventIntegrations/IntegrationConfigurationDetailsCacheService.cs

@@ -1,83 +0,0 @@
-using System.Diagnostics;
-using Bit.Core.Enums;
-using Bit.Core.Models.Data.Organizations;
-using Bit.Core.Repositories;
-using Bit.Core.Settings;
-using Microsoft.Extensions.Hosting;
-using Microsoft.Extensions.Logging;
-
-namespace Bit.Core.Services;
-
-public class IntegrationConfigurationDetailsCacheService : BackgroundService, IIntegrationConfigurationDetailsCache
-{
-    private readonly record struct IntegrationCacheKey(Guid OrganizationId, IntegrationType IntegrationType, EventType? EventType);
-    private readonly IOrganizationIntegrationConfigurationRepository _repository;
-    private readonly ILogger<IntegrationConfigurationDetailsCacheService> _logger;
-    private readonly TimeSpan _refreshInterval;
-    private Dictionary<IntegrationCacheKey, List<OrganizationIntegrationConfigurationDetails>> _cache = new();
-
-    public IntegrationConfigurationDetailsCacheService(
-        IOrganizationIntegrationConfigurationRepository repository,
-        GlobalSettings globalSettings,
-        ILogger<IntegrationConfigurationDetailsCacheService> logger)
-    {
-        _repository = repository;
-        _logger = logger;
-        _refreshInterval = TimeSpan.FromMinutes(globalSettings.EventLogging.IntegrationCacheRefreshIntervalMinutes);
-    }
-
-    public List<OrganizationIntegrationConfigurationDetails> GetConfigurationDetails(
-        Guid organizationId,
-        IntegrationType integrationType,
-        EventType eventType)
-    {
-        var specificKey = new IntegrationCacheKey(organizationId, integrationType, eventType);
-        var allEventsKey = new IntegrationCacheKey(organizationId, integrationType, null);
-
-        var results = new List<OrganizationIntegrationConfigurationDetails>();
-
-        if (_cache.TryGetValue(specificKey, out var specificConfigs))
-        {
-            results.AddRange(specificConfigs);
-        }
-        if (_cache.TryGetValue(allEventsKey, out var fallbackConfigs))
-        {
-            results.AddRange(fallbackConfigs);
-        }
-
-        return results;
-    }
-
-    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
-    {
-        await RefreshAsync();
-
-        var timer = new PeriodicTimer(_refreshInterval);
-        while (await timer.WaitForNextTickAsync(stoppingToken))
-        {
-            await RefreshAsync();
-        }
-    }
-
-    internal async Task RefreshAsync()
-    {
-        var stopwatch = Stopwatch.StartNew();
-        try
-        {
-            var newCache = (await _repository.GetAllConfigurationDetailsAsync())
-                .GroupBy(x => new IntegrationCacheKey(x.OrganizationId, x.IntegrationType, x.EventType))
-                .ToDictionary(g => g.Key, g => g.ToList());
-            _cache = newCache;
-
-            stopwatch.Stop();
-            _logger.LogInformation(
-                "[IntegrationConfigurationDetailsCacheService] Refreshed successfully: {Count} entries in {Duration}ms",
-                newCache.Count,
-                stopwatch.Elapsed.TotalMilliseconds);
-        }
-        catch (Exception ex)
-        {
-            _logger.LogError("[IntegrationConfigurationDetailsCacheService] Refresh failed: {ex}", ex);
-        }
-    }
-}

src/Core/AdminConsole/Services/Implementations/EventIntegrations/README.md

@@ -295,33 +295,59 @@ graph TD
 ```
 ## Caching
 
-To reduce database load and improve performance, integration configurations are cached in-memory as a Dictionary
-with a periodic load of all configurations. Without caching, each incoming `EventMessage` would trigger a database
+To reduce database load and improve performance, event integrations uses its own named extended cache (see
+the [README in Utilities](https://github.com/bitwarden/server/blob/main/src/Core/Utilities/README.md#extended-cache)
+for more information). Without caching, for instance, each incoming `EventMessage` would trigger a database
 query to retrieve the relevant `OrganizationIntegrationConfigurationDetails`.
 
-By loading all configurations into memory on a fixed interval, we ensure:
+### `EventIntegrationsCacheConstants`
 
-- Consistent performance for reads.
-- Reduced database pressure.
-- Predictable refresh timing, independent of event activity.
+`EventIntegrationsCacheConstants` allows the code to have strongly typed references to a number of cache-related
+details when working with the extended cache. The cache name and all cache keys and tags are programmatically accessed
+from `EventIntegrationsCacheConstants` rather than simple strings. For instance,
+`EventIntegrationsCacheConstants.CacheName` is used in the cache setup, keyed services, dependency injection, etc.,
+rather than using a string literal (i.e. "EventIntegrations") in code.
 
-### Architecture / Design
+### `OrganizationIntegrationConfigurationDetails`
 
-- The cache is read-only for consumers. It is only updated in bulk by a background refresh process.
-- The cache is fully replaced on each refresh to avoid locking or partial state.
+- This is one of the most actively used portions of the architecture because any event that has an associated
+  organization requires a check of the configurations to determine if we need to fire off an integration.
+- By using the extended cache, all reads are hitting the L1 or L2 cache before needing to access the database.
 - Reads return a `List<OrganizationIntegrationConfigurationDetails>` for a given key or an empty list if no
   match exists.
-- Failures or delays in the loading process do not affect the existing cache state. The cache will continue serving
-  the last known good state until the update replaces the whole cache.
+- The TTL is set very high on these records (1 day). This is because when the admin API makes any changes, it
+  tells the cache to remove that key. This propagates to the event listening code via the extended cache backplane,
+  which means that the cache is then expired and the next read will fetch the new values. This allows us to have
+  a high TTL and avoid needing to refresh values except when necessary.
 
-### Background Refresh
+#### Tagging per integration
 
-A hosted service (`IntegrationConfigurationDetailsCacheService`) runs in the background and:
+- Each entry in the cache (which again, returns `List<OrganizationIntegrationConfigurationDetails>`) is tagged with
+  the organization id and the integration type.
+- This allows us to remove all of a given organization's configuration details for an integration when the admin
+  makes changes at the integration level.
+    - For instance, if there were 5 events configured for a given organization's webhook and the admin changed the URL
+      at the integration level, the updates would need to be propagated or else the cache will continue returning the
+      stale URL.
+    - By tagging each of the entries, the API can ask the extended cache to remove all the entries for a given
+      organization integration in one call. The cache will handle dropping / refreshing these entries in a
+      performant way.
+- There are two places in the code that are both aware of the tagging functionality
+    - The `EventIntegrationHandler` must use the tag when fetching relevant configuration details. This tells the cache
+      to store the entry with the tag when it successfully loads from the repository.
+    - The `OrganizationIntegrationController` needs to use the tag to remove all the tagged entries when and admin
+      creates, updates, or deletes an integration.
+    - To ensure both places are synchronized on how to tag entries, they both use
+      `EventIntegrationsCacheConstants.BuildCacheTagForOrganizationIntegration` to build the tag.
 
-- Loads all configuration records at application startup.
-- Refreshes the cache on a configurable interval.
-- Logs timing and entry count on success.
-- Logs exceptions on failure without disrupting application flow.
+### Template Properties
+
+- The `IntegrationTemplateProcessor` supports some properties that require an additional lookup. For instance,
+  the `UserId` is provided as part of the `EventMessage`, but `UserName` means an additional lookup to map the user
+  id to the actual name.
+- The properties for a `User` (which includes `ActingUser`), `Group`, and `Organization` are cached via the
+  extended cache with a default TTL of 30 minutes.
+- This is cached in both the L1 (Memory) and L2 (Redis) and will be automatically refreshed as needed.
 
 # Building a new integration
 

src/Core/Auth/UserFeatures/Registration/Implementations/RegisterUserCommand.cs

@@ -5,6 +5,7 @@ using Bit.Core.Auth.Enums;
 using Bit.Core.Auth.Models;
 using Bit.Core.Auth.Models.Business.Tokenables;
 using Bit.Core.Billing.Enums;
+using Bit.Core.Billing.Extensions;
 using Bit.Core.Entities;
 using Bit.Core.Exceptions;
 using Bit.Core.OrganizationFeatures.OrganizationSponsorships.FamiliesForEnterprise.Interfaces;
@@ -455,9 +456,7 @@ public class RegisterUserCommand : IRegisterUserCommand
         else if (!string.IsNullOrEmpty(organization.DisplayName()))
         {
             // If the organization is Free or Families plan, send families welcome email
-            if (organization.PlanType is PlanType.FamiliesAnnually
-                or PlanType.FamiliesAnnually2019
-                or PlanType.Free)
+            if (organization.PlanType.GetProductTier() is ProductTierType.Free or ProductTierType.Families)
             {
                 await _mailService.SendFreeOrgOrFamilyOrgUserWelcomeEmailAsync(user, organization.DisplayName());
             }

src/Core/Billing/Constants/StripeConstants.cs

@@ -12,6 +12,12 @@ public static class StripeConstants
         public const string UnrecognizedLocation = "unrecognized_location";
     }
 
+    public static class BillingReasons
+    {
+        public const string SubscriptionCreate = "subscription_create";
+        public const string SubscriptionCycle = "subscription_cycle";
+    }
+
     public static class CollectionMethod
     {
         public const string ChargeAutomatically = "charge_automatically";

src/Core/Constants.cs

@@ -142,6 +142,7 @@ public static class FeatureFlagKeys
     public const string PM23845_VNextApplicationCache = "pm-24957-refactor-memory-application-cache";
     public const string BlockClaimedDomainAccountCreation = "pm-28297-block-uninvited-claimed-domain-registration";
     public const string IncreaseBulkReinviteLimitForCloud = "pm-28251-increase-bulk-reinvite-limit-for-cloud";
+    public const string BulkRevokeUsersV2 = "pm-28456-bulk-revoke-users-v2";
 
     /* Architecture */
     public const string DesktopMigrationMilestone1 = "desktop-ui-migration-milestone-1";
@@ -251,6 +252,7 @@ public static class FeatureFlagKeys
     public const string PM23904_RiskInsightsForPremium = "pm-23904-risk-insights-for-premium";
     public const string PM25083_AutofillConfirmFromSearch = "pm-25083-autofill-confirm-from-search";
     public const string VaultLoadingSkeletons = "pm-25081-vault-skeleton-loaders";
+    public const string BrowserPremiumSpotlight = "pm-23384-browser-premium-spotlight";
 
     /* Innovation Team */
     public const string ArchiveVaultItems = "pm-19148-innovation-archive";

src/Core/MailTemplates/Handlebars/MJML/Auth/Onboarding/welcome-family-user.html.hbs

@@ -53,11 +53,37 @@
     
     <style type="text/css">
 
+      @media only screen and (max-width:480px) {
+        .mj-bw-hero-responsive-img {
+          display: none !important;
+        }
+      }
+    
+
+      @media only screen and (max-width:480px) {
+        .mj-bw-learn-more-footer-responsive-img {
+          display: none !important;
+        }
+      }
+    
+
     @media only screen and (max-width:479px) {
       table.mj-full-width-mobile { width: 100% !important; }
       td.mj-full-width-mobile { width: auto !important; }
     }
   
+
+      @media only screen and (max-width:480px) {
+        .mj-bw-icon-row-text {
+          padding-left: 5px !important;
+          line-height: 20px;
+        }
+        .mj-bw-icon-row {
+          padding: 10px 15px;
+          width: fit-content !important;
+        }
+      }
+    
     </style>
      
     <style type="text/css">
@@ -67,29 +93,8 @@
   .border-fix > table > tbody > tr > td {
     border-radius: 3px;
   }
-@media only screen and (max-width: 480px) {
-    .hide-small-img {
-      display: none !important;
-    }
-    .send-bubble {
-      padding-left: 20px;
-      padding-right: 20px;
-      width: 90% !important;
-    }
-  }
-@media only screen and (max-width: 480px) {
-    .mj-bw-icon-row-text {
-      padding-left: 5px !important;
-      line-height: 20px;
-    }
-    .mj-bw-icon-row {
-      padding: 10px 15px;
-      width: fit-content !important;
-    }
-  }
     </style>
-    <!-- Responsive icon visibility -->
-<!-- Responsive styling for mj-bw-icon-row -->
+    
   </head>
   <body style="word-spacing:normal;background-color:#e6e9ef;">
     
@@ -156,7 +161,7 @@
             </h1>
             <mj-text color="#fff" padding-top="0" padding-bottom="0">
             <h2 style="font-weight: normal; font-size: 16px; line-height: 0px">
-              Let's get set up to autofill.
+              Let’s get you set up to autofill.
             </h2>
           </mj-text></div>
     
@@ -176,7 +181,7 @@
         <tbody>
           
               <tr>
-                <td align="center" class="hide-small-img" style="font-size:0px;padding:0px;word-break:break-word;">
+                <td align="center" class="mj-bw-hero-responsive-img" style="font-size:0px;padding:0px;word-break:break-word;">
                   
       <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:collapse;border-spacing:0px;">
         <tbody>
@@ -256,7 +261,7 @@
               <tr>
                 <td align="left" style="font-size:0px;padding:10px 15px;word-break:break-word;">
                   
-      <div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:16px;line-height:24px;text-align:left;color:#1B2029;">A <b>{{OrganizationName}}</b> administrator will approve you
+      <div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:16px;line-height:24px;text-align:left;color:#1B2029;">An administrator from <b>{{OrganizationName}}</b> will approve you
             before you can share passwords. While you wait for approval, get
             started with Bitwarden Password Manager:</div>
     
@@ -622,10 +627,10 @@
                 <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
                   
       <div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:16px;line-height:24px;text-align:left;color:#1B2029;"><p style="font-size: 18px; line-height: 28px; font-weight: bold;">
-        Learn more about Bitwarden
-      </p>
-      Find user guides, product documentation, and videos on the
-      <a href="https://bitwarden.com/help/" class="link" style="text-decoration: none; color: #175ddc; font-weight: 600;"> Bitwarden Help Center</a>.</div>
+              Learn more about Bitwarden
+            </p>
+            Find user guides, product documentation, and videos on the
+            <a href="https://bitwarden.com/help/" class="link" style="text-decoration: none; color: #175ddc; font-weight: 600;"> Bitwarden Help Center</a>.</div>
     
                 </td>
               </tr>
@@ -643,7 +648,7 @@
         <tbody>
           
               <tr>
-                <td align="center" class="hide-small-img" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                <td align="center" class="mj-bw-learn-more-footer-responsive-img" style="font-size:0px;padding:10px 25px;word-break:break-word;">
                   
       <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:collapse;border-spacing:0px;">
         <tbody>

src/Core/MailTemplates/Handlebars/MJML/Auth/Onboarding/welcome-individual-user.html.hbs

@@ -53,11 +53,37 @@
     
     <style type="text/css">
 
+      @media only screen and (max-width:480px) {
+        .mj-bw-hero-responsive-img {
+          display: none !important;
+        }
+      }
+    
+
+      @media only screen and (max-width:480px) {
+        .mj-bw-learn-more-footer-responsive-img {
+          display: none !important;
+        }
+      }
+    
+
     @media only screen and (max-width:479px) {
       table.mj-full-width-mobile { width: 100% !important; }
       td.mj-full-width-mobile { width: auto !important; }
     }
   
+
+      @media only screen and (max-width:480px) {
+        .mj-bw-icon-row-text {
+          padding-left: 5px !important;
+          line-height: 20px;
+        }
+        .mj-bw-icon-row {
+          padding: 10px 15px;
+          width: fit-content !important;
+        }
+      }
+    
     </style>
      
     <style type="text/css">
@@ -67,29 +93,8 @@
   .border-fix > table > tbody > tr > td {
     border-radius: 3px;
   }
-@media only screen and (max-width: 480px) {
-    .hide-small-img {
-      display: none !important;
-    }
-    .send-bubble {
-      padding-left: 20px;
-      padding-right: 20px;
-      width: 90% !important;
-    }
-  }
-@media only screen and (max-width: 480px) {
-    .mj-bw-icon-row-text {
-      padding-left: 5px !important;
-      line-height: 20px;
-    }
-    .mj-bw-icon-row {
-      padding: 10px 15px;
-      width: fit-content !important;
-    }
-  }
     </style>
-    <!-- Responsive icon visibility -->
-<!-- Responsive styling for mj-bw-icon-row -->
+    
   </head>
   <body style="word-spacing:normal;background-color:#e6e9ef;">
     
@@ -156,7 +161,7 @@
             </h1>
             <mj-text color="#fff" padding-top="0" padding-bottom="0">
             <h2 style="font-weight: normal; font-size: 16px; line-height: 0px">
-              Let's get set up to autofill.
+              Let’s get you set up to autofill.
             </h2>
           </mj-text></div>
     
@@ -176,7 +181,7 @@
         <tbody>
           
               <tr>
-                <td align="center" class="hide-small-img" style="font-size:0px;padding:0px;word-break:break-word;">
+                <td align="center" class="mj-bw-hero-responsive-img" style="font-size:0px;padding:0px;word-break:break-word;">
                   
       <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:collapse;border-spacing:0px;">
         <tbody>
@@ -621,10 +626,10 @@
                 <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
                   
       <div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:16px;line-height:24px;text-align:left;color:#1B2029;"><p style="font-size: 18px; line-height: 28px; font-weight: bold;">
-        Learn more about Bitwarden
-      </p>
-      Find user guides, product documentation, and videos on the
-      <a href="https://bitwarden.com/help/" class="link" style="text-decoration: none; color: #175ddc; font-weight: 600;"> Bitwarden Help Center</a>.</div>
+              Learn more about Bitwarden
+            </p>
+            Find user guides, product documentation, and videos on the
+            <a href="https://bitwarden.com/help/" class="link" style="text-decoration: none; color: #175ddc; font-weight: 600;"> Bitwarden Help Center</a>.</div>
     
                 </td>
               </tr>
@@ -642,7 +647,7 @@
         <tbody>
           
               <tr>
-                <td align="center" class="hide-small-img" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                <td align="center" class="mj-bw-learn-more-footer-responsive-img" style="font-size:0px;padding:10px 25px;word-break:break-word;">
                   
       <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:collapse;border-spacing:0px;">
         <tbody>

src/Core/MailTemplates/Handlebars/MJML/Auth/Onboarding/welcome-org-user.html.hbs

@@ -53,11 +53,37 @@
     
     <style type="text/css">
 
+      @media only screen and (max-width:480px) {
+        .mj-bw-hero-responsive-img {
+          display: none !important;
+        }
+      }
+    
+
+      @media only screen and (max-width:480px) {
+        .mj-bw-learn-more-footer-responsive-img {
+          display: none !important;
+        }
+      }
+    
+
     @media only screen and (max-width:479px) {
       table.mj-full-width-mobile { width: 100% !important; }
       td.mj-full-width-mobile { width: auto !important; }
     }
   
+
+      @media only screen and (max-width:480px) {
+        .mj-bw-icon-row-text {
+          padding-left: 5px !important;
+          line-height: 20px;
+        }
+        .mj-bw-icon-row {
+          padding: 10px 15px;
+          width: fit-content !important;
+        }
+      }
+    
     </style>
      
     <style type="text/css">
@@ -67,29 +93,8 @@
   .border-fix > table > tbody > tr > td {
     border-radius: 3px;
   }
-@media only screen and (max-width: 480px) {
-    .hide-small-img {
-      display: none !important;
-    }
-    .send-bubble {
-      padding-left: 20px;
-      padding-right: 20px;
-      width: 90% !important;
-    }
-  }
-@media only screen and (max-width: 480px) {
-    .mj-bw-icon-row-text {
-      padding-left: 5px !important;
-      line-height: 20px;
-    }
-    .mj-bw-icon-row {
-      padding: 10px 15px;
-      width: fit-content !important;
-    }
-  }
     </style>
-    <!-- Responsive icon visibility -->
-<!-- Responsive styling for mj-bw-icon-row -->
+    
   </head>
   <body style="word-spacing:normal;background-color:#e6e9ef;">
     
@@ -156,7 +161,7 @@
             </h1>
             <mj-text color="#fff" padding-top="0" padding-bottom="0">
             <h2 style="font-weight: normal; font-size: 16px; line-height: 0px">
-              Let's get set up to autofill.
+              Let’s get you set up to autofill.
             </h2>
           </mj-text></div>
     
@@ -176,7 +181,7 @@
         <tbody>
           
               <tr>
-                <td align="center" class="hide-small-img" style="font-size:0px;padding:0px;word-break:break-word;">
+                <td align="center" class="mj-bw-hero-responsive-img" style="font-size:0px;padding:0px;word-break:break-word;">
                   
       <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:collapse;border-spacing:0px;">
         <tbody>
@@ -256,7 +261,7 @@
               <tr>
                 <td align="left" style="font-size:0px;padding:10px 15px;word-break:break-word;">
                   
-      <div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:16px;line-height:24px;text-align:left;color:#1B2029;">A <b>{{OrganizationName}}</b> administrator will need to confirm
+      <div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:16px;line-height:24px;text-align:left;color:#1B2029;">An administrator from <b>{{OrganizationName}}</b> will need to confirm
             you before you can share passwords. Get started with Bitwarden
             Password Manager:</div>
     
@@ -622,10 +627,10 @@
                 <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
                   
       <div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:16px;line-height:24px;text-align:left;color:#1B2029;"><p style="font-size: 18px; line-height: 28px; font-weight: bold;">
-        Learn more about Bitwarden
-      </p>
-      Find user guides, product documentation, and videos on the
-      <a href="https://bitwarden.com/help/" class="link" style="text-decoration: none; color: #175ddc; font-weight: 600;"> Bitwarden Help Center</a>.</div>
+              Learn more about Bitwarden
+            </p>
+            Find user guides, product documentation, and videos on the
+            <a href="https://bitwarden.com/help/" class="link" style="text-decoration: none; color: #175ddc; font-weight: 600;"> Bitwarden Help Center</a>.</div>
     
                 </td>
               </tr>
@@ -643,7 +648,7 @@
         <tbody>
           
               <tr>
-                <td align="center" class="hide-small-img" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                <td align="center" class="mj-bw-learn-more-footer-responsive-img" style="font-size:0px;padding:10px 25px;word-break:break-word;">
                   
       <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:collapse;border-spacing:0px;">
         <tbody>

src/Core/MailTemplates/Mjml/build.js

@@ -41,8 +41,10 @@ if (!fs.existsSync(config.outputDir)) {
   }
 }
 
-// Find all MJML files with absolute path
-const mjmlFiles = glob.sync(`${config.inputDir}/**/*.mjml`);
+// Find all MJML files with absolute paths, excluding components directories
+const mjmlFiles = glob.sync(`${config.inputDir}/**/*.mjml`, {
+  ignore: ['**/components/**']
+});
 
 console.log(`\n[INFO] Found ${mjmlFiles.length} MJML file(s) to compile...`);
 

src/Core/MailTemplates/Mjml/components/mj-bw-icon-row.js

@@ -18,7 +18,7 @@ class MjBwIconRow extends BodyComponent {
 
   static defaultAttributes = {};
 
-  componentHeadStyle = (breakpoint) => {
+  headStyle = (breakpoint) => {
     return `
       @media only screen and (max-width:${breakpoint}) {
         .mj-bw-icon-row-text {

src/Core/MailTemplates/Mjml/emails/Auth/Onboarding/welcome-family-user.mjml

@@ -9,7 +9,7 @@
       <mj-bw-hero
         img-src="https://assets.bitwarden.com/email/v1/account-fill.png"
         title="Welcome to Bitwarden!"
-        sub-title="Let's get set up to autofill."
+        sub-title="Let’s get you set up to autofill."
       />
     </mj-wrapper>
 

src/Core/MailTemplates/Mjml/emails/Auth/Onboarding/welcome-individual-user.mjml

@@ -9,7 +9,7 @@
       <mj-bw-hero
         img-src="https://assets.bitwarden.com/email/v1/account-fill.png"
         title="Welcome to Bitwarden!"
-        sub-title="Let's get set up to autofill."
+        sub-title="Let’s get you set up to autofill."
       />
     </mj-wrapper>
 

src/Core/MailTemplates/Mjml/emails/Auth/Onboarding/welcome-org-user.mjml

@@ -9,7 +9,7 @@
       <mj-bw-hero
         img-src="https://assets.bitwarden.com/email/v1/account-fill.png"
         title="Welcome to Bitwarden!"
-        sub-title="Let's get set up to autofill."
+        sub-title="Let’s get you set up to autofill."
       />
     </mj-wrapper>
 

src/Core/OrganizationFeatures/OrganizationServiceCollectionExtensions.cs

@@ -45,6 +45,9 @@ using Microsoft.AspNetCore.DataProtection;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
 
+using V1_RevokeUsersCommand = Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.RevokeUser.v1;
+using V2_RevokeUsersCommand = Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.RevokeUser.v2;
+
 namespace Bit.Core.OrganizationFeatures;
 
 public static class OrganizationServiceCollectionExtensions
@@ -133,7 +136,6 @@ public static class OrganizationServiceCollectionExtensions
     {
         services.AddScoped<IRemoveOrganizationUserCommand, RemoveOrganizationUserCommand>();
         services.AddScoped<IRevokeNonCompliantOrganizationUserCommand, RevokeNonCompliantOrganizationUserCommand>();
-        services.AddScoped<IRevokeOrganizationUserCommand, RevokeOrganizationUserCommand>();
         services.AddScoped<IUpdateOrganizationUserCommand, UpdateOrganizationUserCommand>();
         services.AddScoped<IUpdateOrganizationUserGroupsCommand, UpdateOrganizationUserGroupsCommand>();
         services.AddScoped<IConfirmOrganizationUserCommand, ConfirmOrganizationUserCommand>();
@@ -143,6 +145,11 @@ public static class OrganizationServiceCollectionExtensions
 
         services.AddScoped<IDeleteClaimedOrganizationUserAccountCommand, DeleteClaimedOrganizationUserAccountCommand>();
         services.AddScoped<IDeleteClaimedOrganizationUserAccountValidator, DeleteClaimedOrganizationUserAccountValidator>();
+
+        services.AddScoped<V1_RevokeUsersCommand.IRevokeOrganizationUserCommand, V1_RevokeUsersCommand.RevokeOrganizationUserCommand>();
+
+        services.AddScoped<V2_RevokeUsersCommand.IRevokeOrganizationUserCommand, V2_RevokeUsersCommand.RevokeOrganizationUserCommand>();
+        services.AddScoped<V2_RevokeUsersCommand.IRevokeOrganizationUserValidator, V2_RevokeUsersCommand.RevokeOrganizationUsersValidator>();
     }
 
     private static void AddOrganizationApiKeyCommandsQueries(this IServiceCollection services)
@@ -197,6 +204,7 @@ public static class OrganizationServiceCollectionExtensions
         services.AddScoped<IInviteOrganizationUsersCommand, InviteOrganizationUsersCommand>();
         services.AddScoped<ISendOrganizationInvitesCommand, SendOrganizationInvitesCommand>();
         services.AddScoped<IResendOrganizationInviteCommand, ResendOrganizationInviteCommand>();
+        services.AddScoped<IBulkResendOrganizationInvitesCommand, BulkResendOrganizationInvitesCommand>();
 
         services.AddScoped<IInviteUsersValidator, InviteOrganizationUsersValidator>();
         services.AddScoped<IInviteUsersOrganizationValidator, InviteUsersOrganizationValidator>();

src/Core/Settings/GlobalSettings.cs

@@ -732,7 +732,7 @@ public class GlobalSettings : IGlobalSettings
     public class ExtendedCacheSettings
     {
         public bool EnableDistributedCache { get; set; } = true;
-        public bool UseSharedRedisCache { get; set; } = true;
+        public bool UseSharedDistributedCache { get; set; } = true;
         public IConnectionStringSettings Redis { get; set; } = new ConnectionStringSettings();
         public TimeSpan Duration { get; set; } = TimeSpan.FromMinutes(30);
         public bool IsFailSafeEnabled { get; set; } = true;

src/Core/Utilities/CACHING.md

@@ -140,7 +140,7 @@ services.AddExtendedCache("MyFeatureCache", globalSettings, new GlobalSettings.E
 // Option 4: Isolated Redis for specialized features
 services.AddExtendedCache("SpecializedCache", globalSettings, new GlobalSettings.ExtendedCacheSettings
 {
-    UseSharedRedisCache = false,
+    UseSharedDistributedCache = false,
     Redis = new GlobalSettings.ConnectionStringSettings
     {
         ConnectionString = "localhost:6379,ssl=false"

src/Core/Utilities/EventIntegrationsCacheConstants.cs

@@ -1,4 +1,6 @@
 using Bit.Core.AdminConsole.Entities;
+using Bit.Core.Enums;
+using Bit.Core.Models.Data.Organizations;
 using Bit.Core.Models.Data.Organizations.OrganizationUsers;
 
 namespace Bit.Core.Utilities;
@@ -11,7 +13,12 @@ public static class EventIntegrationsCacheConstants
     /// <summary>
     /// The base cache name used for storing event integration data.
     /// </summary>
-    public static readonly string CacheName = "EventIntegrations";
+    public const string CacheName = "EventIntegrations";
+
+    /// <summary>
+    /// Duration TimeSpan for adding OrganizationIntegrationConfigurationDetails to the cache.
+    /// </summary>
+    public static readonly TimeSpan DurationForOrganizationIntegrationConfigurationDetails = TimeSpan.FromDays(1);
 
     /// <summary>
     /// Builds a deterministic cache key for a <see cref="Group"/>.
@@ -20,10 +27,8 @@ public static class EventIntegrationsCacheConstants
     /// <returns>
     /// A cache key for this Group.
     /// </returns>
-    public static string BuildCacheKeyForGroup(Guid groupId)
-    {
-        return $"Group:{groupId:N}";
-    }
+    public static string BuildCacheKeyForGroup(Guid groupId) =>
+        $"Group:{groupId:N}";
 
     /// <summary>
     /// Builds a deterministic cache key for an <see cref="Organization"/>.
@@ -32,10 +37,8 @@ public static class EventIntegrationsCacheConstants
     /// <returns>
     /// A cache key for the Organization.
     /// </returns>
-    public static string BuildCacheKeyForOrganization(Guid organizationId)
-    {
-        return $"Organization:{organizationId:N}";
-    }
+    public static string BuildCacheKeyForOrganization(Guid organizationId) =>
+        $"Organization:{organizationId:N}";
 
     /// <summary>
     /// Builds a deterministic cache key for an organization user <see cref="OrganizationUserUserDetails"/>.
@@ -45,8 +48,37 @@ public static class EventIntegrationsCacheConstants
     /// <returns>
     /// A cache key for the user.
     /// </returns>
-    public static string BuildCacheKeyForOrganizationUser(Guid organizationId, Guid userId)
-    {
-        return $"OrganizationUserUserDetails:{organizationId:N}:{userId:N}";
-    }
+    public static string BuildCacheKeyForOrganizationUser(Guid organizationId, Guid userId) =>
+        $"OrganizationUserUserDetails:{organizationId:N}:{userId:N}";
+
+    /// <summary>
+    /// Builds a deterministic cache key for an organization's integration configuration details
+    /// <see cref="OrganizationIntegrationConfigurationDetails"/>.
+    /// </summary>
+    /// <param name="organizationId">The unique identifier of the organization to which the user belongs.</param>
+    /// <param name="integrationType">The <see cref="IntegrationType"/> of the integration.</param>
+    /// <param name="eventType">The <see cref="EventType"/> of the event configured. Can be null to apply to all events.</param>
+    /// <returns>
+    /// A cache key for the configuration details.
+    /// </returns>
+    public static string BuildCacheKeyForOrganizationIntegrationConfigurationDetails(
+        Guid organizationId,
+        IntegrationType integrationType,
+        EventType? eventType
+    ) => $"OrganizationIntegrationConfigurationDetails:{organizationId:N}:{integrationType}:{eventType}";
+
+    /// <summary>
+    /// Builds a deterministic tag for tagging an organization's integration configuration details. This tag is then
+    /// used to tag all of the <see cref="OrganizationIntegrationConfigurationDetails"/> that result from this
+    /// integration, which allows us to remove all relevant entries when an integration is changed or removed.
+    /// </summary>
+    /// <param name="organizationId">The unique identifier of the organization to which the user belongs.</param>
+    /// <param name="integrationType">The <see cref="IntegrationType"/> of the integration.</param>
+    /// <returns>
+    /// A cache tag to use for the configuration details.
+    /// </returns>
+    public static string BuildCacheTagForOrganizationIntegration(
+        Guid organizationId,
+        IntegrationType integrationType
+    ) => $"OrganizationIntegration:{organizationId:N}:{integrationType}";
 }

src/Core/Utilities/ExtendedCacheServiceCollectionExtensions.cs

@@ -18,9 +18,12 @@ public static class ExtendedCacheServiceCollectionExtensions
     /// Adds a new, named Fusion Cache <see href="https://github.com/ZiggyCreatures/FusionCache"/> to the service
     /// collection. If an existing cache of the same name is found, it will do nothing.<br/>
     /// <br/>
-    /// <b>Note</b>: When re-using the existing Redis cache, it is expected to call this method <b>after</b> calling
-    /// <code>services.AddDistributedCache(globalSettings)</code><br />This ensures that DI correctly finds,
-    /// configures, and re-uses all the shared Redis architecture.
+    /// <b>Note</b>: When re-using an existing distributed cache, it is expected to call this method <b>after</b> calling
+    /// <code>services.AddDistributedCache(globalSettings)</code><br />This ensures that DI correctly finds
+    /// and re-uses the shared distributed cache infrastructure.<br />
+    /// <br />
+    /// <b>Backplane</b>: Cross-instance cache invalidation is only available when using Redis.
+    /// Non-Redis distributed caches operate with eventual consistency across multiple instances.
     /// </summary>
     public static IServiceCollection AddExtendedCache(
         this IServiceCollection services,
@@ -72,12 +75,21 @@ public static class ExtendedCacheServiceCollectionExtensions
         if (!settings.EnableDistributedCache)
             return services;
 
-        if (settings.UseSharedRedisCache)
+        if (settings.UseSharedDistributedCache)
         {
-            // Using Shared Redis, TryAdd and reuse all pieces (multiplexer, distributed cache and backplane)
-
             if (!CoreHelpers.SettingHasValue(globalSettings.DistributedCache.Redis.ConnectionString))
+            {
+                // Using Shared Non-Redis Distributed Cache:
+                //   1. Assume IDistributedCache is already registered (e.g., Cosmos, SQL Server)
+                //   2. Backplane not supported (Redis-only feature, requires pub/sub)
+
+                fusionCacheBuilder
+                    .TryWithRegisteredDistributedCache();
+
                 return services;
+            }
+
+            // Using Shared Redis, TryAdd and reuse all pieces (multiplexer, distributed cache and backplane)
 
             services.TryAddSingleton<IConnectionMultiplexer>(sp =>
                 CreateConnectionMultiplexer(sp, cacheName, globalSettings.DistributedCache.Redis.ConnectionString));
@@ -92,13 +104,13 @@ public static class ExtendedCacheServiceCollectionExtensions
             });
 
             services.TryAddSingleton<IFusionCacheBackplane>(sp =>
+            {
+                var mux = sp.GetRequiredService<IConnectionMultiplexer>();
+                return new RedisBackplane(new RedisBackplaneOptions
                 {
-                    var mux = sp.GetRequiredService<IConnectionMultiplexer>();
-                    return new RedisBackplane(new RedisBackplaneOptions
-                    {
-                        ConnectionMultiplexerFactory = () => Task.FromResult(mux)
-                    });
+                    ConnectionMultiplexerFactory = () => Task.FromResult(mux)
                 });
+            });
 
             fusionCacheBuilder
                 .WithRegisteredDistributedCache()
@@ -107,10 +119,21 @@ public static class ExtendedCacheServiceCollectionExtensions
             return services;
         }
 
-        // Using keyed Redis / Distributed Cache. Create all pieces as keyed services.
+        // Using keyed Distributed Cache. Create/Reuse all pieces as keyed services.
 
         if (!CoreHelpers.SettingHasValue(settings.Redis.ConnectionString))
+        {
+            // Using Keyed Non-Redis Distributed Cache:
+            //   1. Assume IDistributedCache (e.g., Cosmos, SQL Server) is already registered with cacheName as key
+            //   2. Backplane not supported (Redis-only feature, requires pub/sub)
+
+            fusionCacheBuilder
+                .TryWithRegisteredKeyedDistributedCache(serviceKey: cacheName);
+
             return services;
+        }
+
+        // Using Keyed Redis: TryAdd and reuse all pieces (multiplexer, distributed cache and backplane)
 
         services.TryAddKeyedSingleton<IConnectionMultiplexer>(
             cacheName,

src/Infrastructure.Dapper/AdminConsole/Repositories/OrganizationIntegrationConfigurationRepository.cs

@@ -20,10 +20,9 @@ public class OrganizationIntegrationConfigurationRepository : Repository<Organiz
         : base(connectionString, readOnlyConnectionString)
     { }
 
-    public async Task<List<OrganizationIntegrationConfigurationDetails>> GetConfigurationDetailsAsync(
-        Guid organizationId,
-        IntegrationType integrationType,
-        EventType eventType)
+    public async Task<List<OrganizationIntegrationConfigurationDetails>>
+        GetManyByEventTypeOrganizationIdIntegrationType(EventType eventType, Guid organizationId,
+            IntegrationType integrationType)
     {
         using (var connection = new SqlConnection(ConnectionString))
         {

src/Infrastructure.Dapper/AdminConsole/Repositories/OrganizationUserRepository.cs

@@ -625,7 +625,11 @@ public class OrganizationUserRepository : Repository<OrganizationUser, Guid>, IO
 
         await connection.ExecuteAsync(
             "[dbo].[OrganizationUser_SetStatusForUsersByGuidIdArray]",
-            new { OrganizationUserIds = organizationUserIds.ToGuidIdArrayTVP(), Status = OrganizationUserStatusType.Revoked },
+            new
+            {
+                OrganizationUserIds = organizationUserIds.ToGuidIdArrayTVP(),
+                Status = OrganizationUserStatusType.Revoked
+            },
             commandType: CommandType.StoredProcedure);
     }
 

src/Infrastructure.Dapper/AdminConsole/Repositories/ProviderUserRepository.cs

@@ -61,6 +61,18 @@ public class ProviderUserRepository : Repository<ProviderUser, Guid>, IProviderU
         }
     }
 
+    public async Task<ICollection<ProviderUser>> GetManyByManyUsersAsync(IEnumerable<Guid> userIds)
+    {
+        await using var connection = new SqlConnection(ConnectionString);
+
+        var results = await connection.QueryAsync<ProviderUser>(
+            "[dbo].[ProviderUser_ReadManyByManyUserIds]",
+            new { UserIds = userIds.ToGuidIdArrayTVP() },
+            commandType: CommandType.StoredProcedure);
+
+        return results.ToList();
+    }
+
     public async Task<ProviderUser?> GetByProviderUserAsync(Guid providerId, Guid userId)
     {
         using (var connection = new SqlConnection(ConnectionString))

src/Infrastructure.EntityFramework/AdminConsole/Repositories/OrganizationIntegrationConfigurationRepository.cs

@@ -17,16 +17,17 @@ public class OrganizationIntegrationConfigurationRepository : Repository<Core.Ad
         : base(serviceScopeFactory, mapper, context => context.OrganizationIntegrationConfigurations)
     { }
 
-    public async Task<List<OrganizationIntegrationConfigurationDetails>> GetConfigurationDetailsAsync(
-        Guid organizationId,
-        IntegrationType integrationType,
-        EventType eventType)
+    public async Task<List<OrganizationIntegrationConfigurationDetails>>
+        GetManyByEventTypeOrganizationIdIntegrationType(EventType eventType, Guid organizationId,
+            IntegrationType integrationType)
     {
         using (var scope = ServiceScopeFactory.CreateScope())
         {
             var dbContext = GetDatabaseContext(scope);
             var query = new OrganizationIntegrationConfigurationDetailsReadManyByEventTypeOrganizationIdIntegrationTypeQuery(
-                organizationId, eventType, integrationType
+                organizationId,
+                eventType,
+                integrationType
                 );
             return await query.Run(dbContext).ToListAsync();
         }

src/Infrastructure.EntityFramework/AdminConsole/Repositories/ProviderUserRepository.cs

@@ -96,6 +96,20 @@ public class ProviderUserRepository :
             return await query.ToArrayAsync();
         }
     }
+
+    public async Task<ICollection<ProviderUser>> GetManyByManyUsersAsync(IEnumerable<Guid> userIds)
+    {
+        await using var scope = ServiceScopeFactory.CreateAsyncScope();
+
+        var dbContext = GetDatabaseContext(scope);
+
+        var query = from pu in dbContext.ProviderUsers
+                    where pu.UserId != null && userIds.Contains(pu.UserId.Value)
+                    select pu;
+
+        return await query.ToArrayAsync();
+    }
+
     public async Task<ProviderUser> GetByProviderUserAsync(Guid providerId, Guid userId)
     {
         using (var scope = ServiceScopeFactory.CreateScope())

src/Infrastructure.EntityFramework/AdminConsole/Repositories/Queries/OrganizationIntegrationConfigurationDetailsReadManyByEventTypeOrganizationIdIntegrationTypeQuery.cs

@@ -1,31 +1,21 @@
-#nullable enable
-
-using Bit.Core.Enums;
+using Bit.Core.Enums;
 using Bit.Core.Models.Data.Organizations;
 
 namespace Bit.Infrastructure.EntityFramework.Repositories.Queries;
 
-public class OrganizationIntegrationConfigurationDetailsReadManyByEventTypeOrganizationIdIntegrationTypeQuery : IQuery<OrganizationIntegrationConfigurationDetails>
+public class OrganizationIntegrationConfigurationDetailsReadManyByEventTypeOrganizationIdIntegrationTypeQuery(
+    Guid organizationId,
+    EventType eventType,
+    IntegrationType integrationType)
+    : IQuery<OrganizationIntegrationConfigurationDetails>
 {
-    private readonly Guid _organizationId;
-    private readonly EventType _eventType;
-    private readonly IntegrationType _integrationType;
-
-    public OrganizationIntegrationConfigurationDetailsReadManyByEventTypeOrganizationIdIntegrationTypeQuery(Guid organizationId, EventType eventType, IntegrationType integrationType)
-    {
-        _organizationId = organizationId;
-        _eventType = eventType;
-        _integrationType = integrationType;
-    }
-
     public IQueryable<OrganizationIntegrationConfigurationDetails> Run(DatabaseContext dbContext)
     {
         var query = from oic in dbContext.OrganizationIntegrationConfigurations
-                    join oi in dbContext.OrganizationIntegrations on oic.OrganizationIntegrationId equals oi.Id into oioic
-                    from oi in dbContext.OrganizationIntegrations
-                    where oi.OrganizationId == _organizationId &&
-                          oi.Type == _integrationType &&
-                          oic.EventType == _eventType
+                    join oi in dbContext.OrganizationIntegrations on oic.OrganizationIntegrationId equals oi.Id
+                    where oi.OrganizationId == organizationId &&
+                          oi.Type == integrationType &&
+                          (oic.EventType == eventType || oic.EventType == null)
                     select new OrganizationIntegrationConfigurationDetails()
                     {
                         Id = oic.Id,

src/SharedWeb/Utilities/ServiceCollectionExtensions.cs

@@ -893,13 +893,11 @@ public static class ServiceCollectionExtensions
                 integrationType: listenerConfiguration.IntegrationType,
                 eventIntegrationPublisher: provider.GetRequiredService<IEventIntegrationPublisher>(),
                 integrationFilterService: provider.GetRequiredService<IIntegrationFilterService>(),
-                configurationCache: provider.GetRequiredService<IIntegrationConfigurationDetailsCache>(),
                 cache: provider.GetRequiredKeyedService<IFusionCache>(EventIntegrationsCacheConstants.CacheName),
+                configurationRepository: provider.GetRequiredService<IOrganizationIntegrationConfigurationRepository>(),
                 groupRepository: provider.GetRequiredService<IGroupRepository>(),
                 organizationRepository: provider.GetRequiredService<IOrganizationRepository>(),
-                organizationUserRepository: provider.GetRequiredService<IOrganizationUserRepository>(),
-                logger: provider.GetRequiredService<ILogger<EventIntegrationHandler<TConfig>>>()
-            )
+                organizationUserRepository: provider.GetRequiredService<IOrganizationUserRepository>(), logger: provider.GetRequiredService<ILogger<EventIntegrationHandler<TConfig>>>())
         );
         services.TryAddEnumerable(ServiceDescriptor.Singleton<IHostedService,
             AzureServiceBusEventListenerService<TListenerConfig>>(provider =>
@@ -941,10 +939,6 @@ public static class ServiceCollectionExtensions
         // Add common services
         services.AddDistributedCache(globalSettings);
         services.AddExtendedCache(EventIntegrationsCacheConstants.CacheName, globalSettings);
-        services.TryAddSingleton<IntegrationConfigurationDetailsCacheService>();
-        services.TryAddSingleton<IIntegrationConfigurationDetailsCache>(provider =>
-            provider.GetRequiredService<IntegrationConfigurationDetailsCacheService>());
-        services.AddHostedService(provider => provider.GetRequiredService<IntegrationConfigurationDetailsCacheService>());
         services.TryAddSingleton<IIntegrationFilterService, IntegrationFilterService>();
         services.TryAddKeyedSingleton<IEventWriteService, RepositoryEventWriteService>("persistent");
 
@@ -1024,13 +1018,11 @@ public static class ServiceCollectionExtensions
                 integrationType: listenerConfiguration.IntegrationType,
                 eventIntegrationPublisher: provider.GetRequiredService<IEventIntegrationPublisher>(),
                 integrationFilterService: provider.GetRequiredService<IIntegrationFilterService>(),
-                configurationCache: provider.GetRequiredService<IIntegrationConfigurationDetailsCache>(),
                 cache: provider.GetRequiredKeyedService<IFusionCache>(EventIntegrationsCacheConstants.CacheName),
+                configurationRepository: provider.GetRequiredService<IOrganizationIntegrationConfigurationRepository>(),
                 groupRepository: provider.GetRequiredService<IGroupRepository>(),
                 organizationRepository: provider.GetRequiredService<IOrganizationRepository>(),
-                organizationUserRepository: provider.GetRequiredService<IOrganizationUserRepository>(),
-                logger: provider.GetRequiredService<ILogger<EventIntegrationHandler<TConfig>>>()
-            )
+                organizationUserRepository: provider.GetRequiredService<IOrganizationUserRepository>(), logger: provider.GetRequiredService<ILogger<EventIntegrationHandler<TConfig>>>())
         );
         services.TryAddEnumerable(ServiceDescriptor.Singleton<IHostedService,
             RabbitMqEventListenerService<TListenerConfig>>(provider =>

src/Sql/dbo/Stored Procedures/OrganizationIntegrationConfigurationDetails_ReadManyByEventTypeOrganizationIdIntegrationType.sql

@@ -11,7 +11,7 @@ BEGIN
     FROM
         [dbo].[OrganizationIntegrationConfigurationDetailsView] oic
     WHERE
-        oic.[EventType] = @EventType
+        (oic.[EventType] = @EventType OR oic.[EventType] IS NULL)
         AND
         oic.[OrganizationId] = @OrganizationId
         AND

src/Sql/dbo/Stored Procedures/ProviderUser_ReadManyByManyUserIds.sql

@@ -0,0 +1,13 @@
+CREATE PROCEDURE [dbo].[ProviderUser_ReadManyByManyUserIds]
+    @UserIds AS [dbo].[GuidIdArray] READONLY
+AS
+BEGIN
+    SET NOCOUNT ON
+
+    SELECT
+        [pu].*
+    FROM
+        [dbo].[ProviderUserView] AS [pu]
+    INNER JOIN
+        @UserIds [u] ON [u].[Id] = [pu].[UserId]
+END