Merge branch 'main' into SM-1571-DisableSMAdsForUsers

test/Api.IntegrationTest/AdminConsole/Controllers/OrganizationUserControllerAutoConfirmTests.cs

@@ -0,0 +1,225 @@
+using System.Net;
+using Bit.Api.AdminConsole.Models.Request.Organizations;
+using Bit.Api.IntegrationTest.Factories;
+using Bit.Api.IntegrationTest.Helpers;
+using Bit.Core;
+using Bit.Core.AdminConsole.Entities;
+using Bit.Core.AdminConsole.Enums;
+using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.Billing.Enums;
+using Bit.Core.Enums;
+using Bit.Core.Models.Data;
+using Bit.Core.Repositories;
+using Bit.Core.Services;
+using NSubstitute;
+using Xunit;
+
+namespace Bit.Api.IntegrationTest.AdminConsole.Controllers;
+
+public class OrganizationUserControllerAutoConfirmTests : IClassFixture<ApiApplicationFactory>, IAsyncLifetime
+{
+    private const string _mockEncryptedString = "2.AOs41Hd8OQiCPXjyJKCiDA==|O6OHgt2U2hJGBSNGnimJmg==|iD33s8B69C8JhYYhSa4V1tArjvLr8eEaGqOV7BRo5Jk=";
+
+    private readonly HttpClient _client;
+    private readonly ApiApplicationFactory _factory;
+    private readonly LoginHelper _loginHelper;
+
+    private string _ownerEmail = null!;
+
+    public OrganizationUserControllerAutoConfirmTests(ApiApplicationFactory apiFactory)
+    {
+        _factory = apiFactory;
+        _factory.SubstituteService<IFeatureService>(featureService =>
+        {
+            featureService
+                .IsEnabled(FeatureFlagKeys.AutomaticConfirmUsers)
+                .Returns(true);
+        });
+        _client = _factory.CreateClient();
+        _loginHelper = new LoginHelper(_factory, _client);
+    }
+
+    public async Task InitializeAsync()
+    {
+        _ownerEmail = $"org-owner-{Guid.NewGuid()}@example.com";
+        await _factory.LoginWithNewAccount(_ownerEmail);
+    }
+
+    [Fact]
+    public async Task AutoConfirm_WhenUserCannotManageOtherUsers_ThenShouldReturnForbidden()
+    {
+        var (organization, _) = await OrganizationTestHelpers.SignUpAsync(_factory, plan: PlanType.EnterpriseAnnually,
+            ownerEmail: _ownerEmail, passwordManagerSeats: 5, paymentMethod: PaymentMethodType.Card);
+
+        organization.UseAutomaticUserConfirmation = true;
+
+        await _factory.GetService<IOrganizationRepository>()
+            .UpsertAsync(organization);
+
+        var testKey = $"test-key-{Guid.NewGuid()}";
+
+        var userToConfirmEmail = $"org-user-to-confirm-{Guid.NewGuid()}@example.com";
+        await _factory.LoginWithNewAccount(userToConfirmEmail);
+
+        var (confirmingUserEmail, _) = await OrganizationTestHelpers.CreateNewUserWithAccountAsync(_factory, organization.Id, OrganizationUserType.User);
+        await _loginHelper.LoginAsync(confirmingUserEmail);
+
+        var organizationUser = await OrganizationTestHelpers.CreateUserAsync(
+            _factory,
+            organization.Id,
+            userToConfirmEmail,
+            OrganizationUserType.User,
+            false,
+            new Permissions { ManageUsers = false },
+            OrganizationUserStatusType.Accepted);
+
+        var result = await _client.PostAsJsonAsync($"organizations/{organization.Id}/users/{organizationUser.Id}/auto-confirm",
+            new OrganizationUserConfirmRequestModel
+            {
+                Key = testKey,
+                DefaultUserCollectionName = _mockEncryptedString
+            });
+
+        Assert.Equal(HttpStatusCode.Forbidden, result.StatusCode);
+
+        await _factory.GetService<IOrganizationRepository>().DeleteAsync(organization);
+    }
+
+    [Fact]
+    public async Task AutoConfirm_WhenOwnerConfirmsValidUser_ThenShouldReturnNoContent()
+    {
+        var (organization, _) = await OrganizationTestHelpers.SignUpAsync(_factory, plan: PlanType.EnterpriseAnnually,
+            ownerEmail: _ownerEmail, passwordManagerSeats: 5, paymentMethod: PaymentMethodType.Card);
+
+        organization.UseAutomaticUserConfirmation = true;
+
+        await _factory.GetService<IOrganizationRepository>()
+            .UpsertAsync(organization);
+
+        var testKey = $"test-key-{Guid.NewGuid()}";
+
+        await _factory.GetService<IPolicyRepository>().CreateAsync(new Policy
+        {
+            OrganizationId = organization.Id,
+            Type = PolicyType.AutomaticUserConfirmation,
+            Enabled = true
+        });
+
+        await _factory.GetService<IPolicyRepository>().CreateAsync(new Policy
+        {
+            OrganizationId = organization.Id,
+            Type = PolicyType.OrganizationDataOwnership,
+            Enabled = true
+        });
+
+        var userToConfirmEmail = $"org-user-to-confirm-{Guid.NewGuid()}@example.com";
+        await _factory.LoginWithNewAccount(userToConfirmEmail);
+
+        await _loginHelper.LoginAsync(_ownerEmail);
+        var organizationUser = await OrganizationTestHelpers.CreateUserAsync(
+            _factory,
+            organization.Id,
+            userToConfirmEmail,
+            OrganizationUserType.User,
+            false,
+            new Permissions(),
+            OrganizationUserStatusType.Accepted);
+
+        var result = await _client.PostAsJsonAsync($"organizations/{organization.Id}/users/{organizationUser.Id}/auto-confirm",
+            new OrganizationUserConfirmRequestModel
+            {
+                Key = testKey,
+                DefaultUserCollectionName = _mockEncryptedString
+            });
+
+        Assert.Equal(HttpStatusCode.NoContent, result.StatusCode);
+
+        var orgUserRepository = _factory.GetService<IOrganizationUserRepository>();
+        var confirmedUser = await orgUserRepository.GetByIdAsync(organizationUser.Id);
+        Assert.NotNull(confirmedUser);
+        Assert.Equal(OrganizationUserStatusType.Confirmed, confirmedUser.Status);
+        Assert.Equal(testKey, confirmedUser.Key);
+
+        var collectionRepository = _factory.GetService<ICollectionRepository>();
+        var collections = await collectionRepository.GetManyByUserIdAsync(organizationUser.UserId!.Value);
+
+        Assert.NotEmpty(collections);
+        Assert.Single(collections.Where(c => c.Type == CollectionType.DefaultUserCollection));
+
+        await _factory.GetService<IOrganizationRepository>().DeleteAsync(organization);
+    }
+
+    [Fact]
+    public async Task AutoConfirm_WhenUserIsConfirmedMultipleTimes_ThenShouldSuccessAndOnlyConfirmOneUser()
+    {
+        var (organization, _) = await OrganizationTestHelpers.SignUpAsync(_factory, plan: PlanType.EnterpriseAnnually,
+            ownerEmail: _ownerEmail, passwordManagerSeats: 5, paymentMethod: PaymentMethodType.Card);
+
+        organization.UseAutomaticUserConfirmation = true;
+
+        await _factory.GetService<IOrganizationRepository>()
+            .UpsertAsync(organization);
+
+        var testKey = $"test-key-{Guid.NewGuid()}";
+
+        var userToConfirmEmail = $"org-user-to-confirm-{Guid.NewGuid()}@example.com";
+        await _factory.LoginWithNewAccount(userToConfirmEmail);
+
+        await _factory.GetService<IPolicyRepository>().CreateAsync(new Policy
+        {
+            OrganizationId = organization.Id,
+            Type = PolicyType.AutomaticUserConfirmation,
+            Enabled = true
+        });
+
+        await _factory.GetService<IPolicyRepository>().CreateAsync(new Policy
+        {
+            OrganizationId = organization.Id,
+            Type = PolicyType.OrganizationDataOwnership,
+            Enabled = true
+        });
+
+        await _loginHelper.LoginAsync(_ownerEmail);
+
+        var organizationUser = await OrganizationTestHelpers.CreateUserAsync(
+            _factory,
+            organization.Id,
+            userToConfirmEmail,
+            OrganizationUserType.User,
+            false,
+            new Permissions(),
+            OrganizationUserStatusType.Accepted);
+
+        var tenRequests = Enumerable.Range(0, 10)
+            .Select(_ => _client.PostAsJsonAsync($"organizations/{organization.Id}/users/{organizationUser.Id}/auto-confirm",
+                new OrganizationUserConfirmRequestModel
+                {
+                    Key = testKey,
+                    DefaultUserCollectionName = _mockEncryptedString
+                })).ToList();
+
+        var results = await Task.WhenAll(tenRequests);
+
+        Assert.Contains(results, r => r.StatusCode == HttpStatusCode.NoContent);
+
+        var orgUserRepository = _factory.GetService<IOrganizationUserRepository>();
+        var confirmedUser = await orgUserRepository.GetByIdAsync(organizationUser.Id);
+        Assert.NotNull(confirmedUser);
+        Assert.Equal(OrganizationUserStatusType.Confirmed, confirmedUser.Status);
+        Assert.Equal(testKey, confirmedUser.Key);
+
+        var collections = await _factory.GetService<ICollectionRepository>()
+            .GetManyByUserIdAsync(organizationUser.UserId!.Value);
+        Assert.NotEmpty(collections);
+        // validates user only received one default collection
+        Assert.Single(collections.Where(c => c.Type == CollectionType.DefaultUserCollection));
+
+        await _factory.GetService<IOrganizationRepository>().DeleteAsync(organization);
+    }
+
+    public Task DisposeAsync()
+    {
+        _client.Dispose();
+        return Task.CompletedTask;
+    }
+}

test/Api.IntegrationTest/AdminConsole/Controllers/OrganizationUserControllerTests.cs

@@ -218,7 +218,7 @@ public class OrganizationUserControllerTests : IClassFixture<ApiApplicationFacto
         _ownerEmail = $"org-user-integration-test-{Guid.NewGuid()}@bitwarden.com";
         await _factory.LoginWithNewAccount(_ownerEmail);
 
-        (_organization, _) = await OrganizationTestHelpers.SignUpAsync(_factory, plan: PlanType.EnterpriseAnnually2023,
+        (_organization, _) = await OrganizationTestHelpers.SignUpAsync(_factory, plan: PlanType.EnterpriseAnnually,
             ownerEmail: _ownerEmail, passwordManagerSeats: 5, paymentMethod: PaymentMethodType.Card);
     }
 

test/Api.IntegrationTest/AdminConsole/Controllers/OrganizationUsersControllerPutResetPasswordTests.cs

@@ -3,7 +3,6 @@ using Bit.Api.AdminConsole.Authorization;
 using Bit.Api.IntegrationTest.Factories;
 using Bit.Api.IntegrationTest.Helpers;
 using Bit.Api.Models.Request.Organizations;
-using Bit.Core;
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.AdminConsole.Entities.Provider;
 using Bit.Core.AdminConsole.Enums;
@@ -14,8 +13,6 @@ using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Models.Api;
 using Bit.Core.Repositories;
-using Bit.Core.Services;
-using NSubstitute;
 using Xunit;
 
 namespace Bit.Api.IntegrationTest.AdminConsole.Controllers;
@@ -32,12 +29,6 @@ public class OrganizationUsersControllerPutResetPasswordTests : IClassFixture<Ap
     public OrganizationUsersControllerPutResetPasswordTests(ApiApplicationFactory apiFactory)
     {
         _factory = apiFactory;
-        _factory.SubstituteService<IFeatureService>(featureService =>
-        {
-            featureService
-                .IsEnabled(FeatureFlagKeys.AccountRecoveryCommand)
-                .Returns(true);
-        });
         _client = _factory.CreateClient();
         _loginHelper = new LoginHelper(_factory, _client);
     }
@@ -47,7 +38,7 @@ public class OrganizationUsersControllerPutResetPasswordTests : IClassFixture<Ap
         _ownerEmail = $"reset-password-test-{Guid.NewGuid()}@example.com";
         await _factory.LoginWithNewAccount(_ownerEmail);
 
-        (_organization, _) = await OrganizationTestHelpers.SignUpAsync(_factory, plan: PlanType.EnterpriseAnnually2023,
+        (_organization, _) = await OrganizationTestHelpers.SignUpAsync(_factory, plan: PlanType.EnterpriseAnnually,
             ownerEmail: _ownerEmail, passwordManagerSeats: 5, paymentMethod: PaymentMethodType.Card);
 
         // Enable reset password and policies for the organization

test/Api.IntegrationTest/AdminConsole/Controllers/OrganizationsControllerTests.cs

@@ -0,0 +1,196 @@
+using System.Net;
+using Bit.Api.AdminConsole.Models.Request.Organizations;
+using Bit.Api.IntegrationTest.Factories;
+using Bit.Api.IntegrationTest.Helpers;
+using Bit.Core.AdminConsole.Entities;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.Billing.Enums;
+using Bit.Core.Enums;
+using Bit.Core.Repositories;
+using Xunit;
+
+namespace Bit.Api.IntegrationTest.AdminConsole.Controllers;
+
+public class OrganizationsControllerTests : IClassFixture<ApiApplicationFactory>, IAsyncLifetime
+{
+    private readonly HttpClient _client;
+    private readonly ApiApplicationFactory _factory;
+    private readonly LoginHelper _loginHelper;
+
+    private Organization _organization = null!;
+    private string _ownerEmail = null!;
+    private readonly string _billingEmail = "billing@example.com";
+    private readonly string _organizationName = "Organizations Controller Test Org";
+
+    public OrganizationsControllerTests(ApiApplicationFactory apiFactory)
+    {
+        _factory = apiFactory;
+        _client = _factory.CreateClient();
+        _loginHelper = new LoginHelper(_factory, _client);
+    }
+
+    public async Task InitializeAsync()
+    {
+        _ownerEmail = $"org-integration-test-{Guid.NewGuid()}@example.com";
+        await _factory.LoginWithNewAccount(_ownerEmail);
+
+        (_organization, _) = await OrganizationTestHelpers.SignUpAsync(_factory,
+            name: _organizationName,
+            billingEmail: _billingEmail,
+            plan: PlanType.EnterpriseAnnually,
+            ownerEmail: _ownerEmail,
+            passwordManagerSeats: 5,
+            paymentMethod: PaymentMethodType.Card);
+    }
+
+    public Task DisposeAsync()
+    {
+        _client.Dispose();
+        return Task.CompletedTask;
+    }
+
+    [Fact]
+    public async Task Put_AsOwner_WithoutProvider_CanUpdateOrganization()
+    {
+        // Arrange - Regular organization owner (no provider)
+        await _loginHelper.LoginAsync(_ownerEmail);
+
+        var updateRequest = new OrganizationUpdateRequestModel
+        {
+            Name = "Updated Organization Name",
+            BillingEmail = "newbillingemail@example.com"
+        };
+
+        // Act
+        var response = await _client.PutAsJsonAsync($"/organizations/{_organization.Id}", updateRequest);
+
+        // Assert
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+
+        // Verify the organization name was updated
+        var organizationRepository = _factory.GetService<IOrganizationRepository>();
+        var updatedOrg = await organizationRepository.GetByIdAsync(_organization.Id);
+        Assert.NotNull(updatedOrg);
+        Assert.Equal("Updated Organization Name", updatedOrg.Name);
+        Assert.Equal("newbillingemail@example.com", updatedOrg.BillingEmail);
+    }
+
+    [Fact]
+    public async Task Put_AsProvider_CanUpdateOrganization()
+    {
+        // Create and login as a new account to be the provider user (not the owner)
+        var providerUserEmail = $"provider-{Guid.NewGuid()}@example.com";
+        var (token, _) = await _factory.LoginWithNewAccount(providerUserEmail);
+
+        // Set up provider linked to org and ProviderUser entry
+        var provider = await ProviderTestHelpers.CreateProviderAndLinkToOrganizationAsync(_factory, _organization.Id,
+            ProviderType.Msp);
+        await ProviderTestHelpers.CreateProviderUserAsync(_factory, provider.Id, providerUserEmail,
+            ProviderUserType.ProviderAdmin);
+
+        await _loginHelper.LoginAsync(providerUserEmail);
+
+        var updateRequest = new OrganizationUpdateRequestModel
+        {
+            Name = "Updated Organization Name",
+            BillingEmail = "newbillingemail@example.com"
+        };
+
+        // Act
+        var response = await _client.PutAsJsonAsync($"/organizations/{_organization.Id}", updateRequest);
+
+        // Assert
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+
+        // Verify the organization name was updated
+        var organizationRepository = _factory.GetService<IOrganizationRepository>();
+        var updatedOrg = await organizationRepository.GetByIdAsync(_organization.Id);
+        Assert.NotNull(updatedOrg);
+        Assert.Equal("Updated Organization Name", updatedOrg.Name);
+        Assert.Equal("newbillingemail@example.com", updatedOrg.BillingEmail);
+    }
+
+    [Fact]
+    public async Task Put_NotMemberOrProvider_CannotUpdateOrganization()
+    {
+        // Create and login as a new account to be unrelated to the org
+        var userEmail = "stranger@example.com";
+        await _factory.LoginWithNewAccount(userEmail);
+        await _loginHelper.LoginAsync(userEmail);
+
+        var updateRequest = new OrganizationUpdateRequestModel
+        {
+            Name = "Updated Organization Name",
+            BillingEmail = "newbillingemail@example.com"
+        };
+
+        // Act
+        var response = await _client.PutAsJsonAsync($"/organizations/{_organization.Id}", updateRequest);
+
+        // Assert
+        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+
+        // Verify the organization name was not updated
+        var organizationRepository = _factory.GetService<IOrganizationRepository>();
+        var updatedOrg = await organizationRepository.GetByIdAsync(_organization.Id);
+        Assert.NotNull(updatedOrg);
+        Assert.Equal(_organizationName, updatedOrg.Name);
+        Assert.Equal(_billingEmail, updatedOrg.BillingEmail);
+    }
+
+    [Fact]
+    public async Task Put_AsOwner_WithProvider_CanRenameOrganization()
+    {
+        // Arrange - Create provider and link to organization
+        // The active user is ONLY an org owner, NOT a provider user
+        await ProviderTestHelpers.CreateProviderAndLinkToOrganizationAsync(_factory, _organization.Id, ProviderType.Msp);
+        await _loginHelper.LoginAsync(_ownerEmail);
+
+        var updateRequest = new OrganizationUpdateRequestModel
+        {
+            Name = "Updated Organization Name",
+            BillingEmail = null
+        };
+
+        // Act
+        var response = await _client.PutAsJsonAsync($"/organizations/{_organization.Id}", updateRequest);
+
+        // Assert
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+
+        // Verify the organization name was actually updated
+        var organizationRepository = _factory.GetService<IOrganizationRepository>();
+        var updatedOrg = await organizationRepository.GetByIdAsync(_organization.Id);
+        Assert.NotNull(updatedOrg);
+        Assert.Equal("Updated Organization Name", updatedOrg.Name);
+        Assert.Equal(_billingEmail, updatedOrg.BillingEmail);
+    }
+
+    [Fact]
+    public async Task Put_AsOwner_WithProvider_CannotChangeBillingEmail()
+    {
+        // Arrange - Create provider and link to organization
+        // The active user is ONLY an org owner, NOT a provider user
+        await ProviderTestHelpers.CreateProviderAndLinkToOrganizationAsync(_factory, _organization.Id, ProviderType.Msp);
+        await _loginHelper.LoginAsync(_ownerEmail);
+
+        var updateRequest = new OrganizationUpdateRequestModel
+        {
+            Name = "Updated Organization Name",
+            BillingEmail = "updatedbilling@example.com"
+        };
+
+        // Act
+        var response = await _client.PutAsJsonAsync($"/organizations/{_organization.Id}", updateRequest);
+
+        // Assert
+        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+
+        // Verify the organization was not updated
+        var organizationRepository = _factory.GetService<IOrganizationRepository>();
+        var updatedOrg = await organizationRepository.GetByIdAsync(_organization.Id);
+        Assert.NotNull(updatedOrg);
+        Assert.Equal(_organizationName, updatedOrg.Name);
+        Assert.Equal(_billingEmail, updatedOrg.BillingEmail);
+    }
+}

test/Api.IntegrationTest/AdminConsole/Controllers/PoliciesControllerTests.cs

@@ -67,7 +67,6 @@ public class PoliciesControllerTests : IClassFixture<ApiApplicationFactory>, IAs
         {
             Policy = new PolicyRequestModel
             {
-                Type = policyType,
                 Enabled = true,
             },
             Metadata = new Dictionary<string, object>
@@ -148,7 +147,6 @@ public class PoliciesControllerTests : IClassFixture<ApiApplicationFactory>, IAs
         {
             Policy = new PolicyRequestModel
             {
-                Type = policyType,
                 Enabled = true,
                 Data = new Dictionary<string, object>
                 {
@@ -218,7 +216,6 @@ public class PoliciesControllerTests : IClassFixture<ApiApplicationFactory>, IAs
         var policyType = PolicyType.MasterPassword;
         var request = new PolicyRequestModel
         {
-            Type = policyType,
             Enabled = true,
             Data = new Dictionary<string, object>
             {
@@ -244,7 +241,6 @@ public class PoliciesControllerTests : IClassFixture<ApiApplicationFactory>, IAs
         var policyType = PolicyType.SendOptions;
         var request = new PolicyRequestModel
         {
-            Type = policyType,
             Enabled = true,
             Data = new Dictionary<string, object>
             {
@@ -267,7 +263,6 @@ public class PoliciesControllerTests : IClassFixture<ApiApplicationFactory>, IAs
         var policyType = PolicyType.ResetPassword;
         var request = new PolicyRequestModel
         {
-            Type = policyType,
             Enabled = true,
             Data = new Dictionary<string, object>
             {
@@ -292,7 +287,6 @@ public class PoliciesControllerTests : IClassFixture<ApiApplicationFactory>, IAs
         {
             Policy = new PolicyRequestModel
             {
-                Type = policyType,
                 Enabled = true,
                 Data = new Dictionary<string, object>
                 {
@@ -321,7 +315,6 @@ public class PoliciesControllerTests : IClassFixture<ApiApplicationFactory>, IAs
         {
             Policy = new PolicyRequestModel
             {
-                Type = policyType,
                 Enabled = true,
                 Data = new Dictionary<string, object>
                 {
@@ -347,7 +340,6 @@ public class PoliciesControllerTests : IClassFixture<ApiApplicationFactory>, IAs
         {
             Policy = new PolicyRequestModel
             {
-                Type = policyType,
                 Enabled = true,
                 Data = new Dictionary<string, object>
                 {
@@ -371,7 +363,6 @@ public class PoliciesControllerTests : IClassFixture<ApiApplicationFactory>, IAs
         var policyType = PolicyType.SingleOrg;
         var request = new PolicyRequestModel
         {
-            Type = policyType,
             Enabled = true,
             Data = null
         };
@@ -393,7 +384,6 @@ public class PoliciesControllerTests : IClassFixture<ApiApplicationFactory>, IAs
         {
             Policy = new PolicyRequestModel
             {
-                Type = policyType,
                 Enabled = true,
                 Data = null
             },

test/Api.IntegrationTest/AdminConsole/Import/ImportOrganizationUsersAndGroupsCommandTests.cs

@@ -33,7 +33,7 @@ public class ImportOrganizationUsersAndGroupsCommandTests : IClassFixture<ApiApp
         await _factory.LoginWithNewAccount(_ownerEmail);
 
         // Create the organization
-        (_organization, _) = await OrganizationTestHelpers.SignUpAsync(_factory, plan: PlanType.EnterpriseAnnually2023,
+        (_organization, _) = await OrganizationTestHelpers.SignUpAsync(_factory, plan: PlanType.EnterpriseAnnually,
             ownerEmail: _ownerEmail, passwordManagerSeats: 10, paymentMethod: PaymentMethodType.Card);
 
         // Authorize with the organization api key

test/Api.IntegrationTest/AdminConsole/Public/Controllers/MembersControllerTests.cs

@@ -39,7 +39,7 @@ public class MembersControllerTests : IClassFixture<ApiApplicationFactory>, IAsy
         await _factory.LoginWithNewAccount(_ownerEmail);
 
         // Create the organization
-        (_organization, _) = await OrganizationTestHelpers.SignUpAsync(_factory, plan: PlanType.EnterpriseAnnually2023,
+        (_organization, _) = await OrganizationTestHelpers.SignUpAsync(_factory, plan: PlanType.EnterpriseAnnually,
             ownerEmail: _ownerEmail, passwordManagerSeats: 10, paymentMethod: PaymentMethodType.Card);
 
         // Authorize with the organization api key

test/Api.IntegrationTest/AdminConsole/Public/Controllers/PoliciesControllerTests.cs

@@ -39,7 +39,7 @@ public class PoliciesControllerTests : IClassFixture<ApiApplicationFactory>, IAs
         await _factory.LoginWithNewAccount(_ownerEmail);
 
         // Create the organization
-        (_organization, _) = await OrganizationTestHelpers.SignUpAsync(_factory, plan: PlanType.EnterpriseAnnually2023,
+        (_organization, _) = await OrganizationTestHelpers.SignUpAsync(_factory, plan: PlanType.EnterpriseAnnually,
             ownerEmail: _ownerEmail, passwordManagerSeats: 10, paymentMethod: PaymentMethodType.Card);
 
         // Authorize with the organization api key

test/Api.IntegrationTest/Helpers/ProviderTestHelpers.cs

@@ -0,0 +1,77 @@
+using Bit.Api.IntegrationTest.Factories;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.Repositories;
+
+namespace Bit.Api.IntegrationTest.Helpers;
+
+public static class ProviderTestHelpers
+{
+    /// <summary>
+    /// Creates a provider and links it to an organization.
+    /// This does NOT create any provider users.
+    /// </summary>
+    /// <param name="factory">The API application factory</param>
+    /// <param name="organizationId">The organization ID to link to the provider</param>
+    /// <param name="providerType">The type of provider to create</param>
+    /// <param name="providerStatus">The provider status (defaults to Created)</param>
+    /// <returns>The created provider</returns>
+    public static async Task<Provider> CreateProviderAndLinkToOrganizationAsync(
+        ApiApplicationFactory factory,
+        Guid organizationId,
+        ProviderType providerType,
+        ProviderStatusType providerStatus = ProviderStatusType.Created)
+    {
+        var providerRepository = factory.GetService<IProviderRepository>();
+        var providerOrganizationRepository = factory.GetService<IProviderOrganizationRepository>();
+
+        // Create the provider
+        var provider = await providerRepository.CreateAsync(new Provider
+        {
+            Name = $"Test {providerType} Provider",
+            BusinessName = $"Test {providerType} Provider Business",
+            BillingEmail = $"provider-{providerType.ToString().ToLower()}@example.com",
+            Type = providerType,
+            Status = providerStatus,
+            Enabled = true
+        });
+
+        // Link the provider to the organization
+        await providerOrganizationRepository.CreateAsync(new ProviderOrganization
+        {
+            ProviderId = provider.Id,
+            OrganizationId = organizationId,
+            Key = "test-provider-key"
+        });
+
+        return provider;
+    }
+
+    /// <summary>
+    /// Creates a providerUser for a provider.
+    /// </summary>
+    public static async Task<ProviderUser> CreateProviderUserAsync(
+        ApiApplicationFactory factory,
+        Guid providerId,
+        string userEmail,
+        ProviderUserType providerUserType)
+    {
+        var userRepository = factory.GetService<IUserRepository>();
+        var user = await userRepository.GetByEmailAsync(userEmail);
+        if (user is null)
+        {
+            throw new Exception("No user found in test setup.");
+        }
+
+        var providerUserRepository = factory.GetService<IProviderUserRepository>();
+        return await providerUserRepository.CreateAsync(new ProviderUser
+        {
+            ProviderId = providerId,
+            Status = ProviderUserStatusType.Confirmed,
+            UserId = user.Id,
+            Key = Guid.NewGuid().ToString(),
+            Type = providerUserType
+        });
+    }
+}

test/Api.Test/AdminConsole/Controllers/OrganizationIntegrationControllerTests.cs

@@ -133,6 +133,29 @@ public class OrganizationIntegrationControllerTests
             .DeleteAsync(organizationIntegration);
     }
 
+    [Theory, BitAutoData]
+    public async Task PostDeleteAsync_AllParamsProvided_Succeeds(
+        SutProvider<OrganizationIntegrationController> sutProvider,
+        Guid organizationId,
+        OrganizationIntegration organizationIntegration)
+    {
+        organizationIntegration.OrganizationId = organizationId;
+        sutProvider.Sut.Url = Substitute.For<IUrlHelper>();
+        sutProvider.GetDependency<ICurrentContext>()
+            .OrganizationOwner(organizationId)
+            .Returns(true);
+        sutProvider.GetDependency<IOrganizationIntegrationRepository>()
+            .GetByIdAsync(Arg.Any<Guid>())
+            .Returns(organizationIntegration);
+
+        await sutProvider.Sut.PostDeleteAsync(organizationId, organizationIntegration.Id);
+
+        await sutProvider.GetDependency<IOrganizationIntegrationRepository>().Received(1)
+            .GetByIdAsync(organizationIntegration.Id);
+        await sutProvider.GetDependency<IOrganizationIntegrationRepository>().Received(1)
+            .DeleteAsync(organizationIntegration);
+    }
+
     [Theory, BitAutoData]
     public async Task DeleteAsync_IntegrationDoesNotBelongToOrganization_ThrowsNotFound(
         SutProvider<OrganizationIntegrationController> sutProvider,

test/Api.Test/AdminConsole/Controllers/OrganizationIntegrationsConfigurationControllerTests.cs

@@ -51,6 +51,36 @@ public class OrganizationIntegrationsConfigurationControllerTests
             .DeleteAsync(organizationIntegrationConfiguration);
     }
 
+    [Theory, BitAutoData]
+    public async Task PostDeleteAsync_AllParamsProvided_Succeeds(
+        SutProvider<OrganizationIntegrationConfigurationController> sutProvider,
+        Guid organizationId,
+        OrganizationIntegration organizationIntegration,
+        OrganizationIntegrationConfiguration organizationIntegrationConfiguration)
+    {
+        organizationIntegration.OrganizationId = organizationId;
+        organizationIntegrationConfiguration.OrganizationIntegrationId = organizationIntegration.Id;
+        sutProvider.Sut.Url = Substitute.For<IUrlHelper>();
+        sutProvider.GetDependency<ICurrentContext>()
+            .OrganizationOwner(organizationId)
+            .Returns(true);
+        sutProvider.GetDependency<IOrganizationIntegrationRepository>()
+            .GetByIdAsync(Arg.Any<Guid>())
+            .Returns(organizationIntegration);
+        sutProvider.GetDependency<IOrganizationIntegrationConfigurationRepository>()
+            .GetByIdAsync(Arg.Any<Guid>())
+            .Returns(organizationIntegrationConfiguration);
+
+        await sutProvider.Sut.PostDeleteAsync(organizationId, organizationIntegration.Id, organizationIntegrationConfiguration.Id);
+
+        await sutProvider.GetDependency<IOrganizationIntegrationRepository>().Received(1)
+            .GetByIdAsync(organizationIntegration.Id);
+        await sutProvider.GetDependency<IOrganizationIntegrationConfigurationRepository>().Received(1)
+            .GetByIdAsync(organizationIntegrationConfiguration.Id);
+        await sutProvider.GetDependency<IOrganizationIntegrationConfigurationRepository>().Received(1)
+            .DeleteAsync(organizationIntegrationConfiguration);
+    }
+
     [Theory, BitAutoData]
     public async Task DeleteAsync_IntegrationConfigurationDoesNotExist_ThrowsNotFound(
         SutProvider<OrganizationIntegrationConfigurationController> sutProvider,
@@ -199,27 +229,6 @@ public class OrganizationIntegrationsConfigurationControllerTests
             .GetManyByIntegrationAsync(organizationIntegration.Id);
     }
 
-    // [Theory, BitAutoData]
-    // public async Task GetAsync_IntegrationConfigurationDoesNotExist_ThrowsNotFound(
-    //     SutProvider<OrganizationIntegrationConfigurationController> sutProvider,
-    //     Guid organizationId,
-    //     OrganizationIntegration organizationIntegration)
-    // {
-    //     organizationIntegration.OrganizationId = organizationId;
-    //     sutProvider.Sut.Url = Substitute.For<IUrlHelper>();
-    //     sutProvider.GetDependency<ICurrentContext>()
-    //         .OrganizationOwner(organizationId)
-    //         .Returns(true);
-    //     sutProvider.GetDependency<IOrganizationIntegrationRepository>()
-    //         .GetByIdAsync(Arg.Any<Guid>())
-    //         .Returns(organizationIntegration);
-    //     sutProvider.GetDependency<IOrganizationIntegrationConfigurationRepository>()
-    //         .GetByIdAsync(Arg.Any<Guid>())
-    //         .ReturnsNull();
-    //
-    //     await Assert.ThrowsAsync<NotFoundException>(async () => await sutProvider.Sut.GetAsync(organizationId, Guid.Empty, Guid.Empty));
-    // }
-    //
     [Theory, BitAutoData]
     public async Task GetAsync_IntegrationDoesNotExist_ThrowsNotFound(
         SutProvider<OrganizationIntegrationConfigurationController> sutProvider,
@@ -293,15 +302,16 @@ public class OrganizationIntegrationsConfigurationControllerTests
         sutProvider.GetDependency<IOrganizationIntegrationConfigurationRepository>()
             .CreateAsync(Arg.Any<OrganizationIntegrationConfiguration>())
             .Returns(organizationIntegrationConfiguration);
-        var requestAction = await sutProvider.Sut.CreateAsync(organizationId, organizationIntegration.Id, model);
+        var createResponse = await sutProvider.Sut.CreateAsync(organizationId, organizationIntegration.Id, model);
 
         await sutProvider.GetDependency<IOrganizationIntegrationConfigurationRepository>().Received(1)
             .CreateAsync(Arg.Any<OrganizationIntegrationConfiguration>());
-        Assert.IsType<OrganizationIntegrationConfigurationResponseModel>(requestAction);
-        Assert.Equal(expected.Id, requestAction.Id);
-        Assert.Equal(expected.Configuration, requestAction.Configuration);
-        Assert.Equal(expected.EventType, requestAction.EventType);
-        Assert.Equal(expected.Template, requestAction.Template);
+        Assert.IsType<OrganizationIntegrationConfigurationResponseModel>(createResponse);
+        Assert.Equal(expected.Id, createResponse.Id);
+        Assert.Equal(expected.Configuration, createResponse.Configuration);
+        Assert.Equal(expected.EventType, createResponse.EventType);
+        Assert.Equal(expected.Filters, createResponse.Filters);
+        Assert.Equal(expected.Template, createResponse.Template);
     }
 
     [Theory, BitAutoData]
@@ -331,15 +341,16 @@ public class OrganizationIntegrationsConfigurationControllerTests
         sutProvider.GetDependency<IOrganizationIntegrationConfigurationRepository>()
             .CreateAsync(Arg.Any<OrganizationIntegrationConfiguration>())
             .Returns(organizationIntegrationConfiguration);
-        var requestAction = await sutProvider.Sut.CreateAsync(organizationId, organizationIntegration.Id, model);
+        var createResponse = await sutProvider.Sut.CreateAsync(organizationId, organizationIntegration.Id, model);
 
         await sutProvider.GetDependency<IOrganizationIntegrationConfigurationRepository>().Received(1)
             .CreateAsync(Arg.Any<OrganizationIntegrationConfiguration>());
-        Assert.IsType<OrganizationIntegrationConfigurationResponseModel>(requestAction);
-        Assert.Equal(expected.Id, requestAction.Id);
-        Assert.Equal(expected.Configuration, requestAction.Configuration);
-        Assert.Equal(expected.EventType, requestAction.EventType);
-        Assert.Equal(expected.Template, requestAction.Template);
+        Assert.IsType<OrganizationIntegrationConfigurationResponseModel>(createResponse);
+        Assert.Equal(expected.Id, createResponse.Id);
+        Assert.Equal(expected.Configuration, createResponse.Configuration);
+        Assert.Equal(expected.EventType, createResponse.EventType);
+        Assert.Equal(expected.Filters, createResponse.Filters);
+        Assert.Equal(expected.Template, createResponse.Template);
     }
 
     [Theory, BitAutoData]
@@ -369,15 +380,16 @@ public class OrganizationIntegrationsConfigurationControllerTests
         sutProvider.GetDependency<IOrganizationIntegrationConfigurationRepository>()
             .CreateAsync(Arg.Any<OrganizationIntegrationConfiguration>())
             .Returns(organizationIntegrationConfiguration);
-        var requestAction = await sutProvider.Sut.CreateAsync(organizationId, organizationIntegration.Id, model);
+        var createResponse = await sutProvider.Sut.CreateAsync(organizationId, organizationIntegration.Id, model);
 
         await sutProvider.GetDependency<IOrganizationIntegrationConfigurationRepository>().Received(1)
             .CreateAsync(Arg.Any<OrganizationIntegrationConfiguration>());
-        Assert.IsType<OrganizationIntegrationConfigurationResponseModel>(requestAction);
-        Assert.Equal(expected.Id, requestAction.Id);
-        Assert.Equal(expected.Configuration, requestAction.Configuration);
-        Assert.Equal(expected.EventType, requestAction.EventType);
-        Assert.Equal(expected.Template, requestAction.Template);
+        Assert.IsType<OrganizationIntegrationConfigurationResponseModel>(createResponse);
+        Assert.Equal(expected.Id, createResponse.Id);
+        Assert.Equal(expected.Configuration, createResponse.Configuration);
+        Assert.Equal(expected.EventType, createResponse.EventType);
+        Assert.Equal(expected.Filters, createResponse.Filters);
+        Assert.Equal(expected.Template, createResponse.Template);
     }
 
     [Theory, BitAutoData]
@@ -575,7 +587,7 @@ public class OrganizationIntegrationsConfigurationControllerTests
         sutProvider.GetDependency<IOrganizationIntegrationConfigurationRepository>()
             .GetByIdAsync(Arg.Any<Guid>())
             .Returns(organizationIntegrationConfiguration);
-        var requestAction = await sutProvider.Sut.UpdateAsync(
+        var updateResponse = await sutProvider.Sut.UpdateAsync(
             organizationId,
             organizationIntegration.Id,
             organizationIntegrationConfiguration.Id,
@@ -583,11 +595,12 @@ public class OrganizationIntegrationsConfigurationControllerTests
 
         await sutProvider.GetDependency<IOrganizationIntegrationConfigurationRepository>().Received(1)
             .ReplaceAsync(Arg.Any<OrganizationIntegrationConfiguration>());
-        Assert.IsType<OrganizationIntegrationConfigurationResponseModel>(requestAction);
-        Assert.Equal(expected.Id, requestAction.Id);
-        Assert.Equal(expected.Configuration, requestAction.Configuration);
-        Assert.Equal(expected.EventType, requestAction.EventType);
-        Assert.Equal(expected.Template, requestAction.Template);
+        Assert.IsType<OrganizationIntegrationConfigurationResponseModel>(updateResponse);
+        Assert.Equal(expected.Id, updateResponse.Id);
+        Assert.Equal(expected.Configuration, updateResponse.Configuration);
+        Assert.Equal(expected.EventType, updateResponse.EventType);
+        Assert.Equal(expected.Filters, updateResponse.Filters);
+        Assert.Equal(expected.Template, updateResponse.Template);
     }
 
 
@@ -619,7 +632,7 @@ public class OrganizationIntegrationsConfigurationControllerTests
         sutProvider.GetDependency<IOrganizationIntegrationConfigurationRepository>()
             .GetByIdAsync(Arg.Any<Guid>())
             .Returns(organizationIntegrationConfiguration);
-        var requestAction = await sutProvider.Sut.UpdateAsync(
+        var updateResponse = await sutProvider.Sut.UpdateAsync(
             organizationId,
             organizationIntegration.Id,
             organizationIntegrationConfiguration.Id,
@@ -627,11 +640,12 @@ public class OrganizationIntegrationsConfigurationControllerTests
 
         await sutProvider.GetDependency<IOrganizationIntegrationConfigurationRepository>().Received(1)
             .ReplaceAsync(Arg.Any<OrganizationIntegrationConfiguration>());
-        Assert.IsType<OrganizationIntegrationConfigurationResponseModel>(requestAction);
-        Assert.Equal(expected.Id, requestAction.Id);
-        Assert.Equal(expected.Configuration, requestAction.Configuration);
-        Assert.Equal(expected.EventType, requestAction.EventType);
-        Assert.Equal(expected.Template, requestAction.Template);
+        Assert.IsType<OrganizationIntegrationConfigurationResponseModel>(updateResponse);
+        Assert.Equal(expected.Id, updateResponse.Id);
+        Assert.Equal(expected.Configuration, updateResponse.Configuration);
+        Assert.Equal(expected.EventType, updateResponse.EventType);
+        Assert.Equal(expected.Filters, updateResponse.Filters);
+        Assert.Equal(expected.Template, updateResponse.Template);
     }
 
     [Theory, BitAutoData]
@@ -662,7 +676,7 @@ public class OrganizationIntegrationsConfigurationControllerTests
         sutProvider.GetDependency<IOrganizationIntegrationConfigurationRepository>()
             .GetByIdAsync(Arg.Any<Guid>())
             .Returns(organizationIntegrationConfiguration);
-        var requestAction = await sutProvider.Sut.UpdateAsync(
+        var updateResponse = await sutProvider.Sut.UpdateAsync(
             organizationId,
             organizationIntegration.Id,
             organizationIntegrationConfiguration.Id,
@@ -670,11 +684,12 @@ public class OrganizationIntegrationsConfigurationControllerTests
 
         await sutProvider.GetDependency<IOrganizationIntegrationConfigurationRepository>().Received(1)
             .ReplaceAsync(Arg.Any<OrganizationIntegrationConfiguration>());
-        Assert.IsType<OrganizationIntegrationConfigurationResponseModel>(requestAction);
-        Assert.Equal(expected.Id, requestAction.Id);
-        Assert.Equal(expected.Configuration, requestAction.Configuration);
-        Assert.Equal(expected.EventType, requestAction.EventType);
-        Assert.Equal(expected.Template, requestAction.Template);
+        Assert.IsType<OrganizationIntegrationConfigurationResponseModel>(updateResponse);
+        Assert.Equal(expected.Id, updateResponse.Id);
+        Assert.Equal(expected.Configuration, updateResponse.Configuration);
+        Assert.Equal(expected.EventType, updateResponse.EventType);
+        Assert.Equal(expected.Filters, updateResponse.Filters);
+        Assert.Equal(expected.Template, updateResponse.Template);
     }
 
     [Theory, BitAutoData]

test/Api.Test/AdminConsole/Controllers/OrganizationUsersControllerTests.cs

@@ -9,10 +9,12 @@ using Bit.Core.AdminConsole.Entities;
 using Bit.Core.AdminConsole.Enums;
 using Bit.Core.AdminConsole.Models.Data.Organizations.Policies;
 using Bit.Core.AdminConsole.OrganizationFeatures.AccountRecovery;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.AutoConfirmUser;
 using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
 using Bit.Core.AdminConsole.OrganizationFeatures.Policies;
 using Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
 using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.AdminConsole.Utilities.v2.Results;
 using Bit.Core.Auth.Entities;
 using Bit.Core.Auth.Repositories;
 using Bit.Core.Context;
@@ -33,9 +35,11 @@ using Bit.Test.Common.AutoFixture.Attributes;
 using Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
 using Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Requests;
 using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Http.HttpResults;
 using Microsoft.AspNetCore.Mvc.ModelBinding;
 using NSubstitute;
+using OneOf.Types;
 using Xunit;
 
 namespace Bit.Api.Test.AdminConsole.Controllers;
@@ -448,90 +452,38 @@ public class OrganizationUsersControllerTests
 
     [Theory]
     [BitAutoData]
-    public async Task PutResetPassword_WithFeatureFlagDisabled_CallsLegacyPath(
+    public async Task PutResetPassword_WhenOrganizationUserNotFound_ReturnsNotFound(
         Guid orgId, Guid orgUserId, OrganizationUserResetPasswordRequestModel model,
         SutProvider<OrganizationUsersController> sutProvider)
     {
-        sutProvider.GetDependency<IFeatureService>().IsEnabled(FeatureFlagKeys.AccountRecoveryCommand).Returns(false);
-        sutProvider.GetDependency<ICurrentContext>().OrganizationOwner(orgId).Returns(true);
-        sutProvider.GetDependency<IUserService>().AdminResetPasswordAsync(Arg.Any<OrganizationUserType>(), orgId, orgUserId, model.NewMasterPasswordHash, model.Key)
-            .Returns(Microsoft.AspNetCore.Identity.IdentityResult.Success);
-
-        var result = await sutProvider.Sut.PutResetPassword(orgId, orgUserId, model);
-
-        Assert.IsType<Ok>(result);
-        await sutProvider.GetDependency<IUserService>().Received(1)
-            .AdminResetPasswordAsync(OrganizationUserType.Owner, orgId, orgUserId, model.NewMasterPasswordHash, model.Key);
-    }
-
-    [Theory]
-    [BitAutoData]
-    public async Task PutResetPassword_WithFeatureFlagDisabled_WhenOrgUserTypeIsNull_ReturnsNotFound(
-        Guid orgId, Guid orgUserId, OrganizationUserResetPasswordRequestModel model,
-        SutProvider<OrganizationUsersController> sutProvider)
-    {
-        sutProvider.GetDependency<IFeatureService>().IsEnabled(FeatureFlagKeys.AccountRecoveryCommand).Returns(false);
-        sutProvider.GetDependency<ICurrentContext>().OrganizationOwner(orgId).Returns(false);
-        sutProvider.GetDependency<ICurrentContext>().Organizations.Returns(new List<CurrentContextOrganization>());
-
-        var result = await sutProvider.Sut.PutResetPassword(orgId, orgUserId, model);
-
-        Assert.IsType<NotFound>(result);
-    }
-
-    [Theory]
-    [BitAutoData]
-    public async Task PutResetPassword_WithFeatureFlagDisabled_WhenAdminResetPasswordFails_ReturnsBadRequest(
-        Guid orgId, Guid orgUserId, OrganizationUserResetPasswordRequestModel model,
-        SutProvider<OrganizationUsersController> sutProvider)
-    {
-        sutProvider.GetDependency<IFeatureService>().IsEnabled(FeatureFlagKeys.AccountRecoveryCommand).Returns(false);
-        sutProvider.GetDependency<ICurrentContext>().OrganizationOwner(orgId).Returns(true);
-        sutProvider.GetDependency<IUserService>().AdminResetPasswordAsync(Arg.Any<OrganizationUserType>(), orgId, orgUserId, model.NewMasterPasswordHash, model.Key)
-            .Returns(Microsoft.AspNetCore.Identity.IdentityResult.Failed(new Microsoft.AspNetCore.Identity.IdentityError { Description = "Error 1" }));
-
-        var result = await sutProvider.Sut.PutResetPassword(orgId, orgUserId, model);
-
-        Assert.IsType<BadRequest<ModelStateDictionary>>(result);
-    }
-
-    [Theory]
-    [BitAutoData]
-    public async Task PutResetPassword_WithFeatureFlagEnabled_WhenOrganizationUserNotFound_ReturnsNotFound(
-        Guid orgId, Guid orgUserId, OrganizationUserResetPasswordRequestModel model,
-        SutProvider<OrganizationUsersController> sutProvider)
-    {
-        sutProvider.GetDependency<IFeatureService>().IsEnabled(FeatureFlagKeys.AccountRecoveryCommand).Returns(true);
         sutProvider.GetDependency<IOrganizationUserRepository>().GetByIdAsync(orgUserId).Returns((OrganizationUser)null);
 
         var result = await sutProvider.Sut.PutResetPassword(orgId, orgUserId, model);
 
-        Assert.IsType<NotFound>(result);
+        Assert.IsType<Microsoft.AspNetCore.Http.HttpResults.NotFound>(result);
     }
 
     [Theory]
     [BitAutoData]
-    public async Task PutResetPassword_WithFeatureFlagEnabled_WhenOrganizationIdMismatch_ReturnsNotFound(
+    public async Task PutResetPassword_WhenOrganizationIdMismatch_ReturnsNotFound(
         Guid orgId, Guid orgUserId, OrganizationUserResetPasswordRequestModel model, OrganizationUser organizationUser,
         SutProvider<OrganizationUsersController> sutProvider)
     {
         organizationUser.OrganizationId = Guid.NewGuid();
-        sutProvider.GetDependency<IFeatureService>().IsEnabled(FeatureFlagKeys.AccountRecoveryCommand).Returns(true);
         sutProvider.GetDependency<IOrganizationUserRepository>().GetByIdAsync(orgUserId).Returns(organizationUser);
 
         var result = await sutProvider.Sut.PutResetPassword(orgId, orgUserId, model);
 
-        Assert.IsType<NotFound>(result);
+        Assert.IsType<Microsoft.AspNetCore.Http.HttpResults.NotFound>(result);
     }
 
     [Theory]
     [BitAutoData]
-    public async Task PutResetPassword_WithFeatureFlagEnabled_WhenAuthorizationFails_ReturnsBadRequest(
+    public async Task PutResetPassword_WhenAuthorizationFails_ReturnsBadRequest(
         Guid orgId, Guid orgUserId, OrganizationUserResetPasswordRequestModel model, OrganizationUser organizationUser,
         SutProvider<OrganizationUsersController> sutProvider)
     {
         organizationUser.OrganizationId = orgId;
-        sutProvider.GetDependency<IFeatureService>().IsEnabled(FeatureFlagKeys.AccountRecoveryCommand).Returns(true);
         sutProvider.GetDependency<IOrganizationUserRepository>().GetByIdAsync(orgUserId).Returns(organizationUser);
         sutProvider.GetDependency<IAuthorizationService>()
             .AuthorizeAsync(
@@ -547,12 +499,11 @@ public class OrganizationUsersControllerTests
 
     [Theory]
     [BitAutoData]
-    public async Task PutResetPassword_WithFeatureFlagEnabled_WhenRecoverAccountSucceeds_ReturnsOk(
+    public async Task PutResetPassword_WhenRecoverAccountSucceeds_ReturnsOk(
         Guid orgId, Guid orgUserId, OrganizationUserResetPasswordRequestModel model, OrganizationUser organizationUser,
         SutProvider<OrganizationUsersController> sutProvider)
     {
         organizationUser.OrganizationId = orgId;
-        sutProvider.GetDependency<IFeatureService>().IsEnabled(FeatureFlagKeys.AccountRecoveryCommand).Returns(true);
         sutProvider.GetDependency<IOrganizationUserRepository>().GetByIdAsync(orgUserId).Returns(organizationUser);
         sutProvider.GetDependency<IAuthorizationService>()
             .AuthorizeAsync(
@@ -573,12 +524,11 @@ public class OrganizationUsersControllerTests
 
     [Theory]
     [BitAutoData]
-    public async Task PutResetPassword_WithFeatureFlagEnabled_WhenRecoverAccountFails_ReturnsBadRequest(
+    public async Task PutResetPassword_WhenRecoverAccountFails_ReturnsBadRequest(
         Guid orgId, Guid orgUserId, OrganizationUserResetPasswordRequestModel model, OrganizationUser organizationUser,
         SutProvider<OrganizationUsersController> sutProvider)
     {
         organizationUser.OrganizationId = orgId;
-        sutProvider.GetDependency<IFeatureService>().IsEnabled(FeatureFlagKeys.AccountRecoveryCommand).Returns(true);
         sutProvider.GetDependency<IOrganizationUserRepository>().GetByIdAsync(orgUserId).Returns(organizationUser);
         sutProvider.GetDependency<IAuthorizationService>()
             .AuthorizeAsync(
@@ -594,4 +544,190 @@ public class OrganizationUsersControllerTests
 
         Assert.IsType<BadRequest<ModelStateDictionary>>(result);
     }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AutomaticallyConfirmOrganizationUserAsync_UserIdNull_ReturnsUnauthorized(
+        Guid orgId,
+        Guid orgUserId,
+        OrganizationUserConfirmRequestModel model,
+        SutProvider<OrganizationUsersController> sutProvider)
+    {
+        // Arrange
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.AutomaticConfirmUsers)
+            .Returns(true);
+
+        sutProvider.GetDependency<IUserService>()
+            .GetProperUserId(Arg.Any<ClaimsPrincipal>())
+            .Returns((Guid?)null);
+
+        // Act
+        var result = await sutProvider.Sut.AutomaticallyConfirmOrganizationUserAsync(orgId, orgUserId, model);
+
+        // Assert
+        Assert.IsType<UnauthorizedHttpResult>(result);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AutomaticallyConfirmOrganizationUserAsync_UserIdEmpty_ReturnsUnauthorized(
+        Guid orgId,
+        Guid orgUserId,
+        OrganizationUserConfirmRequestModel model,
+        SutProvider<OrganizationUsersController> sutProvider)
+    {
+        // Arrange
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.AutomaticConfirmUsers)
+            .Returns(true);
+
+        sutProvider.GetDependency<IUserService>()
+            .GetProperUserId(Arg.Any<ClaimsPrincipal>())
+            .Returns(Guid.Empty);
+
+        // Act
+        var result = await sutProvider.Sut.AutomaticallyConfirmOrganizationUserAsync(orgId, orgUserId, model);
+
+        // Assert
+        Assert.IsType<UnauthorizedHttpResult>(result);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AutomaticallyConfirmOrganizationUserAsync_Success_ReturnsOk(
+        Guid orgId,
+        Guid orgUserId,
+        Guid userId,
+        OrganizationUserConfirmRequestModel model,
+        SutProvider<OrganizationUsersController> sutProvider)
+    {
+        // Arrange
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.AutomaticConfirmUsers)
+            .Returns(true);
+
+        sutProvider.GetDependency<IUserService>()
+            .GetProperUserId(Arg.Any<ClaimsPrincipal>())
+            .Returns(userId);
+
+        sutProvider.GetDependency<ICurrentContext>()
+            .OrganizationOwner(orgId)
+            .Returns(true);
+
+        sutProvider.GetDependency<IAutomaticallyConfirmOrganizationUserCommand>()
+            .AutomaticallyConfirmOrganizationUserAsync(Arg.Any<AutomaticallyConfirmOrganizationUserRequest>())
+            .Returns(new CommandResult(new None()));
+
+        // Act
+        var result = await sutProvider.Sut.AutomaticallyConfirmOrganizationUserAsync(orgId, orgUserId, model);
+
+        // Assert
+        Assert.IsType<NoContent>(result);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AutomaticallyConfirmOrganizationUserAsync_NotFoundError_ReturnsNotFound(
+        Guid orgId,
+        Guid orgUserId,
+        Guid userId,
+        OrganizationUserConfirmRequestModel model,
+        SutProvider<OrganizationUsersController> sutProvider)
+    {
+        // Arrange
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.AutomaticConfirmUsers)
+            .Returns(true);
+
+        sutProvider.GetDependency<IUserService>()
+            .GetProperUserId(Arg.Any<ClaimsPrincipal>())
+            .Returns(userId);
+
+        sutProvider.GetDependency<ICurrentContext>()
+            .OrganizationOwner(orgId)
+            .Returns(false);
+
+        var notFoundError = new OrganizationNotFound();
+        sutProvider.GetDependency<IAutomaticallyConfirmOrganizationUserCommand>()
+            .AutomaticallyConfirmOrganizationUserAsync(Arg.Any<AutomaticallyConfirmOrganizationUserRequest>())
+            .Returns(new CommandResult(notFoundError));
+
+        // Act
+        var result = await sutProvider.Sut.AutomaticallyConfirmOrganizationUserAsync(orgId, orgUserId, model);
+
+        // Assert
+        var notFoundResult = Assert.IsType<NotFound<ErrorResponseModel>>(result);
+        Assert.Equal(notFoundError.Message, notFoundResult.Value.Message);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AutomaticallyConfirmOrganizationUserAsync_BadRequestError_ReturnsBadRequest(
+        Guid orgId,
+        Guid orgUserId,
+        Guid userId,
+        OrganizationUserConfirmRequestModel model,
+        SutProvider<OrganizationUsersController> sutProvider)
+    {
+        // Arrange
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.AutomaticConfirmUsers)
+            .Returns(true);
+
+        sutProvider.GetDependency<IUserService>()
+            .GetProperUserId(Arg.Any<ClaimsPrincipal>())
+            .Returns(userId);
+
+        sutProvider.GetDependency<ICurrentContext>()
+            .OrganizationOwner(orgId)
+            .Returns(true);
+
+        var badRequestError = new UserIsNotAccepted();
+        sutProvider.GetDependency<IAutomaticallyConfirmOrganizationUserCommand>()
+            .AutomaticallyConfirmOrganizationUserAsync(Arg.Any<AutomaticallyConfirmOrganizationUserRequest>())
+            .Returns(new CommandResult(badRequestError));
+
+        // Act
+        var result = await sutProvider.Sut.AutomaticallyConfirmOrganizationUserAsync(orgId, orgUserId, model);
+
+        // Assert
+        var badRequestResult = Assert.IsType<BadRequest<ErrorResponseModel>>(result);
+        Assert.Equal(badRequestError.Message, badRequestResult.Value.Message);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AutomaticallyConfirmOrganizationUserAsync_InternalError_ReturnsProblem(
+        Guid orgId,
+        Guid orgUserId,
+        Guid userId,
+        OrganizationUserConfirmRequestModel model,
+        SutProvider<OrganizationUsersController> sutProvider)
+    {
+        // Arrange
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.AutomaticConfirmUsers)
+            .Returns(true);
+
+        sutProvider.GetDependency<IUserService>()
+            .GetProperUserId(Arg.Any<ClaimsPrincipal>())
+            .Returns(userId);
+
+        sutProvider.GetDependency<ICurrentContext>()
+            .OrganizationOwner(orgId)
+            .Returns(true);
+
+        var internalError = new FailedToWriteToEventLog();
+        sutProvider.GetDependency<IAutomaticallyConfirmOrganizationUserCommand>()
+            .AutomaticallyConfirmOrganizationUserAsync(Arg.Any<AutomaticallyConfirmOrganizationUserRequest>())
+            .Returns(new CommandResult(internalError));
+
+        // Act
+        var result = await sutProvider.Sut.AutomaticallyConfirmOrganizationUserAsync(orgId, orgUserId, model);
+
+        // Assert
+        var problemResult = Assert.IsType<JsonHttpResult<ErrorResponseModel>>(result);
+        Assert.Equal(StatusCodes.Status500InternalServerError, problemResult.StatusCode);
+    }
 }

test/Api.Test/AdminConsole/Controllers/OrganizationsControllerTests.cs

@@ -1,5 +1,4 @@
 using System.Security.Claims;
-using AutoFixture.Xunit2;
 using Bit.Api.AdminConsole.Controllers;
 using Bit.Api.Auth.Models.Request.Accounts;
 using Bit.Api.Models.Request.Organizations;
@@ -8,9 +7,6 @@ using Bit.Core.AdminConsole.Entities;
 using Bit.Core.AdminConsole.Enums;
 using Bit.Core.AdminConsole.Enums.Provider;
 using Bit.Core.AdminConsole.Models.Business;
-using Bit.Core.AdminConsole.Models.Business.Tokenables;
-using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationApiKeys.Interfaces;
-using Bit.Core.AdminConsole.OrganizationFeatures.Organizations;
 using Bit.Core.AdminConsole.OrganizationFeatures.Organizations.Interfaces;
 using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
 using Bit.Core.AdminConsole.OrganizationFeatures.Policies;
@@ -20,7 +16,6 @@ using Bit.Core.Auth.Entities;
 using Bit.Core.Auth.Enums;
 using Bit.Core.Auth.Models.Data;
 using Bit.Core.Auth.Repositories;
-using Bit.Core.Auth.Services;
 using Bit.Core.Billing.Enums;
 using Bit.Core.Billing.Pricing;
 using Bit.Core.Billing.Providers.Services;
@@ -30,102 +25,24 @@ using Bit.Core.Enums;
 using Bit.Core.Exceptions;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
-using Bit.Core.Tokens;
-using Bit.Core.Utilities;
+using Bit.Core.Test.Billing.Mocks;
 using Bit.Infrastructure.EntityFramework.AdminConsole.Models.Provider;
+using Bit.Test.Common.AutoFixture;
+using Bit.Test.Common.AutoFixture.Attributes;
 using NSubstitute;
 using Xunit;
-using GlobalSettings = Bit.Core.Settings.GlobalSettings;
 
 namespace Bit.Api.Test.AdminConsole.Controllers;
 
-public class OrganizationsControllerTests : IDisposable
+[ControllerCustomize(typeof(OrganizationsController))]
+[SutProviderCustomize]
+public class OrganizationsControllerTests
 {
-    private readonly GlobalSettings _globalSettings;
-    private readonly ICurrentContext _currentContext;
-    private readonly IOrganizationRepository _organizationRepository;
-    private readonly IOrganizationService _organizationService;
-    private readonly IOrganizationUserRepository _organizationUserRepository;
-    private readonly IPolicyRepository _policyRepository;
-    private readonly ISsoConfigRepository _ssoConfigRepository;
-    private readonly ISsoConfigService _ssoConfigService;
-    private readonly IUserService _userService;
-    private readonly IGetOrganizationApiKeyQuery _getOrganizationApiKeyQuery;
-    private readonly IRotateOrganizationApiKeyCommand _rotateOrganizationApiKeyCommand;
-    private readonly IOrganizationApiKeyRepository _organizationApiKeyRepository;
-    private readonly ICreateOrganizationApiKeyCommand _createOrganizationApiKeyCommand;
-    private readonly IFeatureService _featureService;
-    private readonly IProviderRepository _providerRepository;
-    private readonly IProviderBillingService _providerBillingService;
-    private readonly IDataProtectorTokenFactory<OrgDeleteTokenable> _orgDeleteTokenDataFactory;
-    private readonly IRemoveOrganizationUserCommand _removeOrganizationUserCommand;
-    private readonly ICloudOrganizationSignUpCommand _cloudOrganizationSignUpCommand;
-    private readonly IOrganizationDeleteCommand _organizationDeleteCommand;
-    private readonly IPolicyRequirementQuery _policyRequirementQuery;
-    private readonly IPricingClient _pricingClient;
-    private readonly IOrganizationUpdateKeysCommand _organizationUpdateKeysCommand;
-    private readonly OrganizationsController _sut;
-
-    public OrganizationsControllerTests()
-    {
-        _currentContext = Substitute.For<ICurrentContext>();
-        _globalSettings = Substitute.For<GlobalSettings>();
-        _organizationRepository = Substitute.For<IOrganizationRepository>();
-        _organizationService = Substitute.For<IOrganizationService>();
-        _organizationUserRepository = Substitute.For<IOrganizationUserRepository>();
-        _policyRepository = Substitute.For<IPolicyRepository>();
-        _ssoConfigRepository = Substitute.For<ISsoConfigRepository>();
-        _ssoConfigService = Substitute.For<ISsoConfigService>();
-        _getOrganizationApiKeyQuery = Substitute.For<IGetOrganizationApiKeyQuery>();
-        _rotateOrganizationApiKeyCommand = Substitute.For<IRotateOrganizationApiKeyCommand>();
-        _organizationApiKeyRepository = Substitute.For<IOrganizationApiKeyRepository>();
-        _userService = Substitute.For<IUserService>();
-        _createOrganizationApiKeyCommand = Substitute.For<ICreateOrganizationApiKeyCommand>();
-        _featureService = Substitute.For<IFeatureService>();
-        _providerRepository = Substitute.For<IProviderRepository>();
-        _providerBillingService = Substitute.For<IProviderBillingService>();
-        _orgDeleteTokenDataFactory = Substitute.For<IDataProtectorTokenFactory<OrgDeleteTokenable>>();
-        _removeOrganizationUserCommand = Substitute.For<IRemoveOrganizationUserCommand>();
-        _cloudOrganizationSignUpCommand = Substitute.For<ICloudOrganizationSignUpCommand>();
-        _organizationDeleteCommand = Substitute.For<IOrganizationDeleteCommand>();
-        _policyRequirementQuery = Substitute.For<IPolicyRequirementQuery>();
-        _pricingClient = Substitute.For<IPricingClient>();
-        _organizationUpdateKeysCommand = Substitute.For<IOrganizationUpdateKeysCommand>();
-
-        _sut = new OrganizationsController(
-            _organizationRepository,
-            _organizationUserRepository,
-            _policyRepository,
-            _organizationService,
-            _userService,
-            _currentContext,
-            _ssoConfigRepository,
-            _ssoConfigService,
-            _getOrganizationApiKeyQuery,
-            _rotateOrganizationApiKeyCommand,
-            _createOrganizationApiKeyCommand,
-            _organizationApiKeyRepository,
-            _featureService,
-            _globalSettings,
-            _providerRepository,
-            _providerBillingService,
-            _orgDeleteTokenDataFactory,
-            _removeOrganizationUserCommand,
-            _cloudOrganizationSignUpCommand,
-            _organizationDeleteCommand,
-            _policyRequirementQuery,
-            _pricingClient,
-            _organizationUpdateKeysCommand);
-    }
-
-    public void Dispose()
-    {
-        _sut?.Dispose();
-    }
-
-    [Theory, AutoData]
+    [Theory, BitAutoData]
     public async Task OrganizationsController_UserCannotLeaveOrganizationThatProvidesKeyConnector(
-        Guid orgId, User user)
+        SutProvider<OrganizationsController> sutProvider,
+        Guid orgId,
+        User user)
     {
         var ssoConfig = new SsoConfig
         {
@@ -140,21 +57,24 @@ public class OrganizationsControllerTests : IDisposable
 
         user.UsesKeyConnector = true;
 
-        _currentContext.OrganizationUser(orgId).Returns(true);
-        _ssoConfigRepository.GetByOrganizationIdAsync(orgId).Returns(ssoConfig);
-        _userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
-        _userService.GetOrganizationsClaimingUserAsync(user.Id).Returns(new List<Organization> { null });
-        var exception = await Assert.ThrowsAsync<BadRequestException>(() => _sut.Leave(orgId));
+        sutProvider.GetDependency<ICurrentContext>().OrganizationUser(orgId).Returns(true);
+        sutProvider.GetDependency<ISsoConfigRepository>().GetByOrganizationIdAsync(orgId).Returns(ssoConfig);
+        sutProvider.GetDependency<IUserService>().GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
+        sutProvider.GetDependency<IUserService>().GetOrganizationsClaimingUserAsync(user.Id).Returns(new List<Organization> { null });
+
+        var exception = await Assert.ThrowsAsync<BadRequestException>(() => sutProvider.Sut.Leave(orgId));
 
         Assert.Contains("Your organization's Single Sign-On settings prevent you from leaving.",
             exception.Message);
 
-        await _removeOrganizationUserCommand.DidNotReceiveWithAnyArgs().UserLeaveAsync(default, default);
+        await sutProvider.GetDependency<IRemoveOrganizationUserCommand>().DidNotReceiveWithAnyArgs().UserLeaveAsync(default, default);
     }
 
-    [Theory, AutoData]
+    [Theory, BitAutoData]
     public async Task OrganizationsController_UserCannotLeaveOrganizationThatManagesUser(
-        Guid orgId, User user)
+        SutProvider<OrganizationsController> sutProvider,
+        Guid orgId,
+        User user)
     {
         var ssoConfig = new SsoConfig
         {
@@ -166,27 +86,34 @@ public class OrganizationsControllerTests : IDisposable
             Enabled = true,
             OrganizationId = orgId,
         };
-        var foundOrg = new Organization();
-        foundOrg.Id = orgId;
+        var foundOrg = new Organization
+        {
+            Id = orgId
+        };
 
-        _currentContext.OrganizationUser(orgId).Returns(true);
-        _ssoConfigRepository.GetByOrganizationIdAsync(orgId).Returns(ssoConfig);
-        _userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
-        _userService.GetOrganizationsClaimingUserAsync(user.Id).Returns(new List<Organization> { { foundOrg } });
-        var exception = await Assert.ThrowsAsync<BadRequestException>(() => _sut.Leave(orgId));
+        sutProvider.GetDependency<ICurrentContext>().OrganizationUser(orgId).Returns(true);
+        sutProvider.GetDependency<ISsoConfigRepository>().GetByOrganizationIdAsync(orgId).Returns(ssoConfig);
+        sutProvider.GetDependency<IUserService>().GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
+        sutProvider.GetDependency<IUserService>().GetOrganizationsClaimingUserAsync(user.Id).Returns(new List<Organization> { foundOrg });
+
+        var exception = await Assert.ThrowsAsync<BadRequestException>(() => sutProvider.Sut.Leave(orgId));
 
         Assert.Contains("Claimed user account cannot leave claiming organization. Contact your organization administrator for additional details.",
             exception.Message);
 
-        await _removeOrganizationUserCommand.DidNotReceiveWithAnyArgs().RemoveUserAsync(default, default);
+        await sutProvider.GetDependency<IRemoveOrganizationUserCommand>().DidNotReceiveWithAnyArgs().RemoveUserAsync(default, default);
     }
 
     [Theory]
-    [InlineAutoData(true, false)]
-    [InlineAutoData(false, true)]
-    [InlineAutoData(false, false)]
+    [BitAutoData(true, false)]
+    [BitAutoData(false, true)]
+    [BitAutoData(false, false)]
     public async Task OrganizationsController_UserCanLeaveOrganizationThatDoesntProvideKeyConnector(
-        bool keyConnectorEnabled, bool userUsesKeyConnector, Guid orgId, User user)
+        bool keyConnectorEnabled,
+        bool userUsesKeyConnector,
+        SutProvider<OrganizationsController> sutProvider,
+        Guid orgId,
+        User user)
     {
         var ssoConfig = new SsoConfig
         {
@@ -203,18 +130,19 @@ public class OrganizationsControllerTests : IDisposable
 
         user.UsesKeyConnector = userUsesKeyConnector;
 
-        _currentContext.OrganizationUser(orgId).Returns(true);
-        _ssoConfigRepository.GetByOrganizationIdAsync(orgId).Returns(ssoConfig);
-        _userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
-        _userService.GetOrganizationsClaimingUserAsync(user.Id).Returns(new List<Organization>());
+        sutProvider.GetDependency<ICurrentContext>().OrganizationUser(orgId).Returns(true);
+        sutProvider.GetDependency<ISsoConfigRepository>().GetByOrganizationIdAsync(orgId).Returns(ssoConfig);
+        sutProvider.GetDependency<IUserService>().GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
+        sutProvider.GetDependency<IUserService>().GetOrganizationsClaimingUserAsync(user.Id).Returns(new List<Organization>());
 
-        await _sut.Leave(orgId);
+        await sutProvider.Sut.Leave(orgId);
 
-        await _removeOrganizationUserCommand.Received(1).UserLeaveAsync(orgId, user.Id);
+        await sutProvider.GetDependency<IRemoveOrganizationUserCommand>().Received(1).UserLeaveAsync(orgId, user.Id);
     }
 
-    [Theory, AutoData]
+    [Theory, BitAutoData]
     public async Task Delete_OrganizationIsConsolidatedBillingClient_ScalesProvidersSeats(
+        SutProvider<OrganizationsController> sutProvider,
         Provider provider,
         Organization organization,
         User user,
@@ -228,87 +156,89 @@ public class OrganizationsControllerTests : IDisposable
         provider.Type = ProviderType.Msp;
         provider.Status = ProviderStatusType.Billable;
 
-        _currentContext.OrganizationOwner(organizationId).Returns(true);
+        sutProvider.GetDependency<ICurrentContext>().OrganizationOwner(organizationId).Returns(true);
+        sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(organizationId).Returns(organization);
+        sutProvider.GetDependency<IUserService>().GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
+        sutProvider.GetDependency<IUserService>().VerifySecretAsync(user, requestModel.Secret).Returns(true);
+        sutProvider.GetDependency<IProviderRepository>().GetByOrganizationIdAsync(organization.Id).Returns(provider);
 
-        _organizationRepository.GetByIdAsync(organizationId).Returns(organization);
+        await sutProvider.Sut.Delete(organizationId.ToString(), requestModel);
 
-        _userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
-
-        _userService.VerifySecretAsync(user, requestModel.Secret).Returns(true);
-
-        _providerRepository.GetByOrganizationIdAsync(organization.Id).Returns(provider);
-
-        await _sut.Delete(organizationId.ToString(), requestModel);
-
-        await _providerBillingService.Received(1)
+        await sutProvider.GetDependency<IProviderBillingService>().Received(1)
             .ScaleSeats(provider, organization.PlanType, -organization.Seats.Value);
 
-        await _organizationDeleteCommand.Received(1).DeleteAsync(organization);
+        await sutProvider.GetDependency<IOrganizationDeleteCommand>().Received(1).DeleteAsync(organization);
     }
 
-    [Theory, AutoData]
+    [Theory, BitAutoData]
     public async Task GetAutoEnrollStatus_WithPolicyRequirementsEnabled_ReturnsOrganizationAutoEnrollStatus_WithResetPasswordEnabledTrue(
+        SutProvider<OrganizationsController> sutProvider,
         User user,
         Organization organization,
-        OrganizationUser organizationUser
-    )
+        OrganizationUser organizationUser)
     {
-        var policyRequirement = new ResetPasswordPolicyRequirement() { AutoEnrollOrganizations = [organization.Id] };
+        var policyRequirement = new ResetPasswordPolicyRequirement { AutoEnrollOrganizations = [organization.Id] };
 
-        _userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
-        _organizationRepository.GetByIdentifierAsync(organization.Id.ToString()).Returns(organization);
-        _featureService.IsEnabled(FeatureFlagKeys.PolicyRequirements).Returns(true);
-        _organizationUserRepository.GetByOrganizationAsync(organization.Id, user.Id).Returns(organizationUser);
-        _policyRequirementQuery.GetAsync<ResetPasswordPolicyRequirement>(user.Id).Returns(policyRequirement);
+        sutProvider.GetDependency<IUserService>().GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
+        sutProvider.GetDependency<IOrganizationRepository>().GetByIdentifierAsync(organization.Id.ToString()).Returns(organization);
+        sutProvider.GetDependency<IFeatureService>().IsEnabled(FeatureFlagKeys.PolicyRequirements).Returns(true);
+        sutProvider.GetDependency<IOrganizationUserRepository>().GetByOrganizationAsync(organization.Id, user.Id).Returns(organizationUser);
+        sutProvider.GetDependency<IPolicyRequirementQuery>().GetAsync<ResetPasswordPolicyRequirement>(user.Id).Returns(policyRequirement);
 
-        var result = await _sut.GetAutoEnrollStatus(organization.Id.ToString());
+        var result = await sutProvider.Sut.GetAutoEnrollStatus(organization.Id.ToString());
 
-        await _userService.Received(1).GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>());
-        await _organizationRepository.Received(1).GetByIdentifierAsync(organization.Id.ToString());
-        await _policyRequirementQuery.Received(1).GetAsync<ResetPasswordPolicyRequirement>(user.Id);
+        await sutProvider.GetDependency<IUserService>().Received(1).GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>());
+        await sutProvider.GetDependency<IOrganizationRepository>().Received(1).GetByIdentifierAsync(organization.Id.ToString());
+        await sutProvider.GetDependency<IPolicyRequirementQuery>().Received(1).GetAsync<ResetPasswordPolicyRequirement>(user.Id);
 
         Assert.True(result.ResetPasswordEnabled);
         Assert.Equal(result.Id, organization.Id);
     }
 
-    [Theory, AutoData]
+    [Theory, BitAutoData]
     public async Task GetAutoEnrollStatus_WithPolicyRequirementsDisabled_ReturnsOrganizationAutoEnrollStatus_WithResetPasswordEnabledTrue(
-    User user,
-    Organization organization,
-    OrganizationUser organizationUser
-)
+        SutProvider<OrganizationsController> sutProvider,
+        User user,
+        Organization organization,
+        OrganizationUser organizationUser)
     {
+        var policy = new Policy
+        {
+            Type = PolicyType.ResetPassword,
+            Enabled = true,
+            Data = "{\"AutoEnrollEnabled\": true}",
+            OrganizationId = organization.Id
+        };
 
-        var policy = new Policy() { Type = PolicyType.ResetPassword, Enabled = true, Data = "{\"AutoEnrollEnabled\": true}", OrganizationId = organization.Id };
+        sutProvider.GetDependency<IUserService>().GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
+        sutProvider.GetDependency<IOrganizationRepository>().GetByIdentifierAsync(organization.Id.ToString()).Returns(organization);
+        sutProvider.GetDependency<IFeatureService>().IsEnabled(FeatureFlagKeys.PolicyRequirements).Returns(false);
+        sutProvider.GetDependency<IOrganizationUserRepository>().GetByOrganizationAsync(organization.Id, user.Id).Returns(organizationUser);
+        sutProvider.GetDependency<IPolicyRepository>().GetByOrganizationIdTypeAsync(organization.Id, PolicyType.ResetPassword).Returns(policy);
 
-        _userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
-        _organizationRepository.GetByIdentifierAsync(organization.Id.ToString()).Returns(organization);
-        _featureService.IsEnabled(FeatureFlagKeys.PolicyRequirements).Returns(false);
-        _organizationUserRepository.GetByOrganizationAsync(organization.Id, user.Id).Returns(organizationUser);
-        _policyRepository.GetByOrganizationIdTypeAsync(organization.Id, PolicyType.ResetPassword).Returns(policy);
+        var result = await sutProvider.Sut.GetAutoEnrollStatus(organization.Id.ToString());
 
-        var result = await _sut.GetAutoEnrollStatus(organization.Id.ToString());
-
-        await _userService.Received(1).GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>());
-        await _organizationRepository.Received(1).GetByIdentifierAsync(organization.Id.ToString());
-        await _policyRequirementQuery.Received(0).GetAsync<ResetPasswordPolicyRequirement>(user.Id);
-        await _policyRepository.Received(1).GetByOrganizationIdTypeAsync(organization.Id, PolicyType.ResetPassword);
+        await sutProvider.GetDependency<IUserService>().Received(1).GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>());
+        await sutProvider.GetDependency<IOrganizationRepository>().Received(1).GetByIdentifierAsync(organization.Id.ToString());
+        await sutProvider.GetDependency<IPolicyRequirementQuery>().Received(0).GetAsync<ResetPasswordPolicyRequirement>(user.Id);
+        await sutProvider.GetDependency<IPolicyRepository>().Received(1).GetByOrganizationIdTypeAsync(organization.Id, PolicyType.ResetPassword);
 
         Assert.True(result.ResetPasswordEnabled);
     }
 
-    [Theory, AutoData]
+    [Theory, BitAutoData]
     public async Task PutCollectionManagement_ValidRequest_Success(
+        SutProvider<OrganizationsController> sutProvider,
         Organization organization,
         OrganizationCollectionManagementUpdateRequestModel model)
     {
         // Arrange
-        _currentContext.OrganizationOwner(organization.Id).Returns(true);
+        sutProvider.GetDependency<ICurrentContext>().OrganizationOwner(organization.Id).Returns(true);
 
-        var plan = StaticStore.GetPlan(PlanType.EnterpriseAnnually);
-        _pricingClient.GetPlan(Arg.Any<PlanType>()).Returns(plan);
+        var plan = MockPlans.Get(PlanType.EnterpriseAnnually);
+        sutProvider.GetDependency<IPricingClient>().GetPlan(Arg.Any<PlanType>()).Returns(plan);
 
-        _organizationService
+        sutProvider.GetDependency<IOrganizationService>()
             .UpdateCollectionManagementSettingsAsync(
                 organization.Id,
                 Arg.Is<OrganizationCollectionManagementSettings>(s =>
@@ -319,10 +249,10 @@ public class OrganizationsControllerTests : IDisposable
             .Returns(organization);
 
         // Act
-        await _sut.PutCollectionManagement(organization.Id, model);
+        await sutProvider.Sut.PutCollectionManagement(organization.Id, model);
 
         // Assert
-        await _organizationService
+        await sutProvider.GetDependency<IOrganizationService>()
             .Received(1)
             .UpdateCollectionManagementSettingsAsync(
                 organization.Id,

test/Api.Test/AdminConsole/Controllers/SlackIntegrationControllerTests.cs

@@ -71,6 +71,26 @@ public class SlackIntegrationControllerTests
             await sutProvider.Sut.CreateAsync(string.Empty, state.ToString()));
     }
 
+    [Theory, BitAutoData]
+    public async Task CreateAsync_CallbackUrlIsEmpty_ThrowsBadRequest(
+        SutProvider<SlackIntegrationController> sutProvider,
+        OrganizationIntegration integration)
+    {
+        integration.Type = IntegrationType.Slack;
+        integration.Configuration = null;
+        sutProvider.Sut.Url = Substitute.For<IUrlHelper>();
+        sutProvider.Sut.Url
+            .RouteUrl(Arg.Is<UrlRouteContext>(c => c.RouteName == "SlackIntegration_Create"))
+            .Returns((string?)null);
+        sutProvider.GetDependency<IOrganizationIntegrationRepository>()
+            .GetByIdAsync(integration.Id)
+            .Returns(integration);
+        var state = IntegrationOAuthState.FromIntegration(integration, sutProvider.GetDependency<TimeProvider>());
+
+        await Assert.ThrowsAsync<BadRequestException>(async () =>
+            await sutProvider.Sut.CreateAsync(_validSlackCode, state.ToString()));
+    }
+
     [Theory, BitAutoData]
     public async Task CreateAsync_SlackServiceReturnsEmpty_ThrowsBadRequest(
         SutProvider<SlackIntegrationController> sutProvider,
@@ -153,6 +173,8 @@ public class SlackIntegrationControllerTests
         OrganizationIntegration wrongOrgIntegration)
     {
         wrongOrgIntegration.Id = integration.Id;
+        wrongOrgIntegration.Type = IntegrationType.Slack;
+        wrongOrgIntegration.Configuration = null;
 
         sutProvider.Sut.Url = Substitute.For<IUrlHelper>();
         sutProvider.Sut.Url
@@ -304,6 +326,22 @@ public class SlackIntegrationControllerTests
         await Assert.ThrowsAsync<BadRequestException>(async () => await sutProvider.Sut.RedirectAsync(organizationId));
     }
 
+    [Theory, BitAutoData]
+    public async Task RedirectAsync_CallbackUrlReturnsEmpty_ThrowsBadRequest(
+        SutProvider<SlackIntegrationController> sutProvider,
+        Guid organizationId)
+    {
+        sutProvider.Sut.Url = Substitute.For<IUrlHelper>();
+        sutProvider.Sut.Url
+            .RouteUrl(Arg.Is<UrlRouteContext>(c => c.RouteName == "SlackIntegration_Create"))
+            .Returns((string?)null);
+        sutProvider.GetDependency<ICurrentContext>()
+            .OrganizationOwner(organizationId)
+            .Returns(true);
+
+        await Assert.ThrowsAsync<BadRequestException>(async () => await sutProvider.Sut.RedirectAsync(organizationId));
+    }
+
     [Theory, BitAutoData]
     public async Task RedirectAsync_SlackServiceReturnsEmpty_ThrowsNotFound(
         SutProvider<SlackIntegrationController> sutProvider,

test/Api.Test/AdminConsole/Controllers/TeamsIntegrationControllerTests.cs

@@ -60,6 +60,26 @@ public class TeamsIntegrationControllerTests
         Assert.IsType<CreatedResult>(requestAction);
     }
 
+    [Theory, BitAutoData]
+    public async Task CreateAsync_CallbackUrlIsEmpty_ThrowsBadRequest(
+        SutProvider<TeamsIntegrationController> sutProvider,
+        OrganizationIntegration integration)
+    {
+        integration.Type = IntegrationType.Teams;
+        integration.Configuration = null;
+        sutProvider.Sut.Url = Substitute.For<IUrlHelper>();
+        sutProvider.Sut.Url
+            .RouteUrl(Arg.Is<UrlRouteContext>(c => c.RouteName == "TeamsIntegration_Create"))
+            .Returns((string?)null);
+        sutProvider.GetDependency<IOrganizationIntegrationRepository>()
+            .GetByIdAsync(integration.Id)
+            .Returns(integration);
+        var state = IntegrationOAuthState.FromIntegration(integration, sutProvider.GetDependency<TimeProvider>());
+
+        await Assert.ThrowsAsync<BadRequestException>(async () =>
+            await sutProvider.Sut.CreateAsync(_validTeamsCode, state.ToString()));
+    }
+
     [Theory, BitAutoData]
     public async Task CreateAsync_CodeIsEmpty_ThrowsBadRequest(
         SutProvider<TeamsIntegrationController> sutProvider,
@@ -315,6 +335,30 @@ public class TeamsIntegrationControllerTests
         sutProvider.GetDependency<ITeamsService>().Received(1).GetRedirectUrl(Arg.Any<string>(), expectedState.ToString());
     }
 
+    [Theory, BitAutoData]
+    public async Task RedirectAsync_CallbackUrlIsEmpty_ThrowsBadRequest(
+        SutProvider<TeamsIntegrationController> sutProvider,
+        Guid organizationId,
+        OrganizationIntegration integration)
+    {
+        integration.OrganizationId = organizationId;
+        integration.Configuration = null;
+        integration.Type = IntegrationType.Teams;
+
+        sutProvider.Sut.Url = Substitute.For<IUrlHelper>();
+        sutProvider.Sut.Url
+            .RouteUrl(Arg.Is<UrlRouteContext>(c => c.RouteName == "TeamsIntegration_Create"))
+            .Returns((string?)null);
+        sutProvider.GetDependency<ICurrentContext>()
+            .OrganizationOwner(organizationId)
+            .Returns(true);
+        sutProvider.GetDependency<IOrganizationIntegrationRepository>()
+            .GetManyByOrganizationAsync(organizationId)
+            .Returns([integration]);
+
+        await Assert.ThrowsAsync<BadRequestException>(async () => await sutProvider.Sut.RedirectAsync(organizationId));
+    }
+
     [Theory, BitAutoData]
     public async Task RedirectAsync_IntegrationAlreadyExistsWithConfig_ThrowsBadRequest(
         SutProvider<TeamsIntegrationController> sutProvider,

test/Api.Test/AdminConsole/Models/Request/Organizations/OrganizationIntegrationRequestModelTests.cs

@@ -1,14 +1,47 @@
 using System.ComponentModel.DataAnnotations;
 using System.Text.Json;
 using Bit.Api.AdminConsole.Models.Request.Organizations;
+using Bit.Core.AdminConsole.Entities;
 using Bit.Core.AdminConsole.Models.Data.EventIntegrations;
 using Bit.Core.Enums;
+using Bit.Test.Common.AutoFixture.Attributes;
 using Xunit;
 
 namespace Bit.Api.Test.AdminConsole.Models.Request.Organizations;
 
 public class OrganizationIntegrationRequestModelTests
 {
+    [Fact]
+    public void ToOrganizationIntegration_CreatesNewOrganizationIntegration()
+    {
+        var model = new OrganizationIntegrationRequestModel
+        {
+            Type = IntegrationType.Hec,
+            Configuration = JsonSerializer.Serialize(new HecIntegration(Uri: new Uri("http://localhost"), Scheme: "Bearer", Token: "Token"))
+        };
+
+        var organizationId = Guid.NewGuid();
+        var organizationIntegration = model.ToOrganizationIntegration(organizationId);
+
+        Assert.Equal(organizationIntegration.Type, model.Type);
+        Assert.Equal(organizationIntegration.Configuration, model.Configuration);
+        Assert.Equal(organizationIntegration.OrganizationId, organizationId);
+    }
+
+    [Theory, BitAutoData]
+    public void ToOrganizationIntegration_UpdatesExistingOrganizationIntegration(OrganizationIntegration integration)
+    {
+        var model = new OrganizationIntegrationRequestModel
+        {
+            Type = IntegrationType.Hec,
+            Configuration = JsonSerializer.Serialize(new HecIntegration(Uri: new Uri("http://localhost"), Scheme: "Bearer", Token: "Token"))
+        };
+
+        var organizationIntegration = model.ToOrganizationIntegration(integration);
+
+        Assert.Equal(organizationIntegration.Configuration, model.Configuration);
+    }
+
     [Fact]
     public void Validate_CloudBillingSync_ReturnsNotYetSupportedError()
     {

test/Api.Test/AdminConsole/Models/Request/SavePolicyRequestTests.cs

@@ -24,11 +24,11 @@ public class SavePolicyRequestTests
         currentContext.OrganizationOwner(organizationId).Returns(true);
 
         var testData = new Dictionary<string, object> { { "test", "value" } };
+        var policyType = PolicyType.TwoFactorAuthentication;
         var model = new SavePolicyRequest
         {
             Policy = new PolicyRequestModel
             {
-                Type = PolicyType.TwoFactorAuthentication,
                 Enabled = true,
                 Data = testData
             },
@@ -36,7 +36,7 @@ public class SavePolicyRequestTests
         };
 
         // Act
-        var result = await model.ToSavePolicyModelAsync(organizationId, currentContext);
+        var result = await model.ToSavePolicyModelAsync(organizationId, policyType, currentContext);
 
         // Assert
         Assert.Equal(PolicyType.TwoFactorAuthentication, result.PolicyUpdate.Type);
@@ -63,17 +63,17 @@ public class SavePolicyRequestTests
         currentContext.UserId.Returns(userId);
         currentContext.OrganizationOwner(organizationId).Returns(false);
 
+        var policyType = PolicyType.SingleOrg;
         var model = new SavePolicyRequest
         {
             Policy = new PolicyRequestModel
             {
-                Type = PolicyType.SingleOrg,
                 Enabled = false
             }
         };
 
         // Act
-        var result = await model.ToSavePolicyModelAsync(organizationId, currentContext);
+        var result = await model.ToSavePolicyModelAsync(organizationId, policyType, currentContext);
 
         // Assert
         Assert.Null(result.PolicyUpdate.Data);
@@ -93,17 +93,17 @@ public class SavePolicyRequestTests
         currentContext.UserId.Returns(userId);
         currentContext.OrganizationOwner(organizationId).Returns(true);
 
+        var policyType = PolicyType.SingleOrg;
         var model = new SavePolicyRequest
         {
             Policy = new PolicyRequestModel
             {
-                Type = PolicyType.SingleOrg,
                 Enabled = false
             }
         };
 
         // Act
-        var result = await model.ToSavePolicyModelAsync(organizationId, currentContext);
+        var result = await model.ToSavePolicyModelAsync(organizationId, policyType, currentContext);
 
         // Assert
         Assert.Null(result.PolicyUpdate.Data);
@@ -124,11 +124,11 @@ public class SavePolicyRequestTests
         currentContext.UserId.Returns(userId);
         currentContext.OrganizationOwner(organizationId).Returns(true);
 
+        var policyType = PolicyType.OrganizationDataOwnership;
         var model = new SavePolicyRequest
         {
             Policy = new PolicyRequestModel
             {
-                Type = PolicyType.OrganizationDataOwnership,
                 Enabled = true
             },
             Metadata = new Dictionary<string, object>
@@ -138,7 +138,7 @@ public class SavePolicyRequestTests
         };
 
         // Act
-        var result = await model.ToSavePolicyModelAsync(organizationId, currentContext);
+        var result = await model.ToSavePolicyModelAsync(organizationId, policyType, currentContext);
 
         // Assert
         Assert.IsType<OrganizationModelOwnershipPolicyModel>(result.Metadata);
@@ -156,17 +156,17 @@ public class SavePolicyRequestTests
         currentContext.UserId.Returns(userId);
         currentContext.OrganizationOwner(organizationId).Returns(true);
 
+        var policyType = PolicyType.OrganizationDataOwnership;
         var model = new SavePolicyRequest
         {
             Policy = new PolicyRequestModel
             {
-                Type = PolicyType.OrganizationDataOwnership,
                 Enabled = true
             }
         };
 
         // Act
-        var result = await model.ToSavePolicyModelAsync(organizationId, currentContext);
+        var result = await model.ToSavePolicyModelAsync(organizationId, policyType, currentContext);
 
         // Assert
         Assert.NotNull(result);
@@ -193,12 +193,11 @@ public class SavePolicyRequestTests
         currentContext.UserId.Returns(userId);
         currentContext.OrganizationOwner(organizationId).Returns(true);
 
-
+        var policyType = PolicyType.ResetPassword;
         var model = new SavePolicyRequest
         {
             Policy = new PolicyRequestModel
             {
-                Type = PolicyType.ResetPassword,
                 Enabled = true,
                 Data = _complexData
             },
@@ -206,7 +205,7 @@ public class SavePolicyRequestTests
         };
 
         // Act
-        var result = await model.ToSavePolicyModelAsync(organizationId, currentContext);
+        var result = await model.ToSavePolicyModelAsync(organizationId, policyType, currentContext);
 
         // Assert
         var deserializedData = JsonSerializer.Deserialize<Dictionary<string, JsonElement>>(result.PolicyUpdate.Data);
@@ -234,11 +233,11 @@ public class SavePolicyRequestTests
         currentContext.UserId.Returns(userId);
         currentContext.OrganizationOwner(organizationId).Returns(true);
 
+        var policyType = PolicyType.MaximumVaultTimeout;
         var model = new SavePolicyRequest
         {
             Policy = new PolicyRequestModel
             {
-                Type = PolicyType.MaximumVaultTimeout,
                 Enabled = true
             },
             Metadata = new Dictionary<string, object>
@@ -248,7 +247,7 @@ public class SavePolicyRequestTests
         };
 
         // Act
-        var result = await model.ToSavePolicyModelAsync(organizationId, currentContext);
+        var result = await model.ToSavePolicyModelAsync(organizationId, policyType, currentContext);
 
         // Assert
         Assert.NotNull(result);
@@ -266,19 +265,18 @@ public class SavePolicyRequestTests
         currentContext.OrganizationOwner(organizationId).Returns(true);
 
         var errorDictionary = BuildErrorDictionary();
-
+        var policyType = PolicyType.OrganizationDataOwnership;
         var model = new SavePolicyRequest
         {
             Policy = new PolicyRequestModel
             {
-                Type = PolicyType.OrganizationDataOwnership,
                 Enabled = true
             },
             Metadata = errorDictionary
         };
 
         // Act
-        var result = await model.ToSavePolicyModelAsync(organizationId, currentContext);
+        var result = await model.ToSavePolicyModelAsync(organizationId, policyType, currentContext);
 
         // Assert
         Assert.NotNull(result);

test/Api.Test/AdminConsole/Models/Response/ProfileOrganizationResponseModelTests.cs

@@ -48,6 +48,7 @@ public class ProfileOrganizationResponseModelTests
             UsersGetPremium = organization.UsersGetPremium,
             UseCustomPermissions = organization.UseCustomPermissions,
             UseRiskInsights = organization.UseRiskInsights,
+            UsePhishingBlocker = organization.UsePhishingBlocker,
             UseOrganizationDomains = organization.UseOrganizationDomains,
             UseAdminSponsoredFamilies = organization.UseAdminSponsoredFamilies,
             UseAutomaticUserConfirmation = organization.UseAutomaticUserConfirmation,

test/Api.Test/AdminConsole/Models/Response/ProfileProviderOrganizationResponseModelTests.cs

@@ -45,6 +45,7 @@ public class ProfileProviderOrganizationResponseModelTests
             UsersGetPremium = organization.UsersGetPremium,
             UseCustomPermissions = organization.UseCustomPermissions,
             UseRiskInsights = organization.UseRiskInsights,
+            UsePhishingBlocker = organization.UsePhishingBlocker,
             UseOrganizationDomains = organization.UseOrganizationDomains,
             UseAdminSponsoredFamilies = organization.UseAdminSponsoredFamilies,
             UseAutomaticUserConfirmation = organization.UseAutomaticUserConfirmation,

test/Api.Test/Billing/Controllers/AccountsControllerTests.cs

@@ -0,0 +1,800 @@
+using System.Security.Claims;
+using Bit.Api.Billing.Controllers;
+using Bit.Core;
+using Bit.Core.Auth.UserFeatures.TwoFactorAuth.Interfaces;
+using Bit.Core.Billing.Constants;
+using Bit.Core.Billing.Models.Business;
+using Bit.Core.Entities;
+using Bit.Core.Enums;
+using Bit.Core.KeyManagement.Queries.Interfaces;
+using Bit.Core.Models.Business;
+using Bit.Core.Services;
+using Bit.Core.Settings;
+using Bit.Core.Test.AutoFixture;
+using Bit.Test.Common.AutoFixture.Attributes;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using NSubstitute;
+using Stripe;
+using Xunit;
+
+namespace Bit.Api.Test.Billing.Controllers;
+
+[SubscriptionInfoCustomize]
+public class AccountsControllerTests : IDisposable
+{
+    private const string TestMilestone2CouponId = StripeConstants.CouponIDs.Milestone2SubscriptionDiscount;
+
+    private readonly IUserService _userService;
+    private readonly IFeatureService _featureService;
+    private readonly IPaymentService _paymentService;
+    private readonly ITwoFactorIsEnabledQuery _twoFactorIsEnabledQuery;
+    private readonly IUserAccountKeysQuery _userAccountKeysQuery;
+    private readonly GlobalSettings _globalSettings;
+    private readonly AccountsController _sut;
+
+    public AccountsControllerTests()
+    {
+        _userService = Substitute.For<IUserService>();
+        _featureService = Substitute.For<IFeatureService>();
+        _paymentService = Substitute.For<IPaymentService>();
+        _twoFactorIsEnabledQuery = Substitute.For<ITwoFactorIsEnabledQuery>();
+        _userAccountKeysQuery = Substitute.For<IUserAccountKeysQuery>();
+        _globalSettings = new GlobalSettings { SelfHosted = false };
+
+        _sut = new AccountsController(
+            _userService,
+            _twoFactorIsEnabledQuery,
+            _userAccountKeysQuery,
+            _featureService
+        );
+    }
+
+    public void Dispose()
+    {
+        _sut?.Dispose();
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task GetSubscriptionAsync_WhenFeatureFlagEnabled_IncludesDiscount(
+        User user,
+        SubscriptionInfo subscriptionInfo,
+        UserLicense license)
+    {
+        // Arrange
+        subscriptionInfo.CustomerDiscount = new SubscriptionInfo.BillingCustomerDiscount
+        {
+            Id = TestMilestone2CouponId,
+            Active = true,
+            PercentOff = 20m,
+            AmountOff = null,
+            AppliesTo = new List<string> { "product1" }
+        };
+
+        var claimsPrincipal = new ClaimsPrincipal(new ClaimsIdentity());
+        _sut.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext { User = claimsPrincipal }
+        };
+        _userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
+        _featureService.IsEnabled(FeatureFlagKeys.PM23341_Milestone_2).Returns(true);
+        _paymentService.GetSubscriptionAsync(user).Returns(subscriptionInfo);
+        _userService.GenerateLicenseAsync(user, subscriptionInfo).Returns(license);
+
+        user.Gateway = GatewayType.Stripe; // User has payment gateway
+
+        // Act
+        var result = await _sut.GetSubscriptionAsync(_globalSettings, _paymentService);
+
+        // Assert
+        Assert.NotNull(result);
+        Assert.NotNull(result.CustomerDiscount);
+        Assert.Equal(StripeConstants.CouponIDs.Milestone2SubscriptionDiscount, result.CustomerDiscount.Id);
+        Assert.Equal(20m, result.CustomerDiscount.PercentOff);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task GetSubscriptionAsync_WhenFeatureFlagDisabled_ExcludesDiscount(
+        User user,
+        SubscriptionInfo subscriptionInfo,
+        UserLicense license)
+    {
+        // Arrange
+        subscriptionInfo.CustomerDiscount = new SubscriptionInfo.BillingCustomerDiscount
+        {
+            Id = TestMilestone2CouponId,
+            Active = true,
+            PercentOff = 20m,
+            AmountOff = null,
+            AppliesTo = new List<string> { "product1" }
+        };
+
+        var claimsPrincipal = new ClaimsPrincipal(new ClaimsIdentity());
+        _sut.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext { User = claimsPrincipal }
+        };
+        _userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
+        _featureService.IsEnabled(FeatureFlagKeys.PM23341_Milestone_2).Returns(false);
+        _paymentService.GetSubscriptionAsync(user).Returns(subscriptionInfo);
+        _userService.GenerateLicenseAsync(user, subscriptionInfo).Returns(license);
+
+        user.Gateway = GatewayType.Stripe; // User has payment gateway
+
+        // Act
+        var result = await _sut.GetSubscriptionAsync(_globalSettings, _paymentService);
+
+        // Assert
+        Assert.NotNull(result);
+        Assert.Null(result.CustomerDiscount); // Should be null when feature flag is disabled
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task GetSubscriptionAsync_WithNonMatchingCouponId_ExcludesDiscount(
+        User user,
+        SubscriptionInfo subscriptionInfo,
+        UserLicense license)
+    {
+        // Arrange
+        subscriptionInfo.CustomerDiscount = new SubscriptionInfo.BillingCustomerDiscount
+        {
+            Id = "different-coupon-id", // Non-matching coupon ID
+            Active = true,
+            PercentOff = 20m,
+            AmountOff = null,
+            AppliesTo = new List<string> { "product1" }
+        };
+
+        var claimsPrincipal = new ClaimsPrincipal(new ClaimsIdentity());
+        _sut.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext { User = claimsPrincipal }
+        };
+        _userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
+        _featureService.IsEnabled(FeatureFlagKeys.PM23341_Milestone_2).Returns(true);
+        _paymentService.GetSubscriptionAsync(user).Returns(subscriptionInfo);
+        _userService.GenerateLicenseAsync(user, subscriptionInfo).Returns(license);
+
+        user.Gateway = GatewayType.Stripe; // User has payment gateway
+
+        // Act
+        var result = await _sut.GetSubscriptionAsync(_globalSettings, _paymentService);
+
+        // Assert
+        Assert.NotNull(result);
+        Assert.Null(result.CustomerDiscount); // Should be null when coupon ID doesn't match
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task GetSubscriptionAsync_WhenSelfHosted_ReturnsBasicResponse(User user)
+    {
+        // Arrange
+        var selfHostedSettings = new GlobalSettings { SelfHosted = true };
+        var claimsPrincipal = new ClaimsPrincipal(new ClaimsIdentity());
+        _sut.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext { User = claimsPrincipal }
+        };
+        _userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
+
+        // Act
+        var result = await _sut.GetSubscriptionAsync(selfHostedSettings, _paymentService);
+
+        // Assert
+        Assert.NotNull(result);
+        Assert.Null(result.CustomerDiscount);
+        await _paymentService.DidNotReceive().GetSubscriptionAsync(Arg.Any<User>());
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task GetSubscriptionAsync_WhenNoGateway_ExcludesDiscount(User user, UserLicense license)
+    {
+        // Arrange
+        user.Gateway = null; // No gateway configured
+        var claimsPrincipal = new ClaimsPrincipal(new ClaimsIdentity());
+        _sut.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext { User = claimsPrincipal }
+        };
+        _userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
+        _userService.GenerateLicenseAsync(user).Returns(license);
+
+        // Act
+        var result = await _sut.GetSubscriptionAsync(_globalSettings, _paymentService);
+
+        // Assert
+        Assert.NotNull(result);
+        Assert.Null(result.CustomerDiscount); // Should be null when no gateway
+        await _paymentService.DidNotReceive().GetSubscriptionAsync(Arg.Any<User>());
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task GetSubscriptionAsync_WithInactiveDiscount_ExcludesDiscount(
+        User user,
+        SubscriptionInfo subscriptionInfo,
+        UserLicense license)
+    {
+        // Arrange
+        subscriptionInfo.CustomerDiscount = new SubscriptionInfo.BillingCustomerDiscount
+        {
+            Id = TestMilestone2CouponId,
+            Active = false, // Inactive discount
+            PercentOff = 20m,
+            AmountOff = null,
+            AppliesTo = new List<string> { "product1" }
+        };
+
+        var claimsPrincipal = new ClaimsPrincipal(new ClaimsIdentity());
+        _sut.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext { User = claimsPrincipal }
+        };
+        _userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
+        _featureService.IsEnabled(FeatureFlagKeys.PM23341_Milestone_2).Returns(true);
+        _paymentService.GetSubscriptionAsync(user).Returns(subscriptionInfo);
+        _userService.GenerateLicenseAsync(user, subscriptionInfo).Returns(license);
+
+        user.Gateway = GatewayType.Stripe; // User has payment gateway
+
+        // Act
+        var result = await _sut.GetSubscriptionAsync(_globalSettings, _paymentService);
+
+        // Assert
+        Assert.NotNull(result);
+        Assert.Null(result.CustomerDiscount); // Should be null when discount is inactive
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task GetSubscriptionAsync_FullPipeline_ConvertsStripeDiscountToApiResponse(
+        User user,
+        UserLicense license)
+    {
+        // Arrange - Create a Stripe Discount object with real structure
+        var stripeDiscount = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = TestMilestone2CouponId,
+                PercentOff = 25m,
+                AmountOff = 1400, // 1400 cents = $14.00
+                AppliesTo = new CouponAppliesTo
+                {
+                    Products = new List<string> { "prod_premium", "prod_families" }
+                }
+            },
+            End = null // Active discount
+        };
+
+        // Convert Stripe Discount to BillingCustomerDiscount (simulating what StripePaymentService does)
+        var billingDiscount = new SubscriptionInfo.BillingCustomerDiscount(stripeDiscount);
+
+        var subscriptionInfo = new SubscriptionInfo
+        {
+            CustomerDiscount = billingDiscount
+        };
+
+        var claimsPrincipal = new ClaimsPrincipal(new ClaimsIdentity());
+        _sut.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext { User = claimsPrincipal }
+        };
+        _userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
+        _featureService.IsEnabled(FeatureFlagKeys.PM23341_Milestone_2).Returns(true);
+        _paymentService.GetSubscriptionAsync(user).Returns(subscriptionInfo);
+        _userService.GenerateLicenseAsync(user, subscriptionInfo).Returns(license);
+
+        user.Gateway = GatewayType.Stripe;
+
+        // Act
+        var result = await _sut.GetSubscriptionAsync(_globalSettings, _paymentService);
+
+        // Assert - Verify full pipeline conversion
+        Assert.NotNull(result);
+        Assert.NotNull(result.CustomerDiscount);
+
+        // Verify Stripe data correctly converted to API response
+        Assert.Equal(StripeConstants.CouponIDs.Milestone2SubscriptionDiscount, result.CustomerDiscount.Id);
+        Assert.True(result.CustomerDiscount.Active);
+        Assert.Equal(25m, result.CustomerDiscount.PercentOff);
+
+        // Verify cents-to-dollars conversion (1400 cents -> $14.00)
+        Assert.Equal(14.00m, result.CustomerDiscount.AmountOff);
+
+        // Verify AppliesTo products are preserved
+        Assert.NotNull(result.CustomerDiscount.AppliesTo);
+        Assert.Equal(2, result.CustomerDiscount.AppliesTo.Count());
+        Assert.Contains("prod_premium", result.CustomerDiscount.AppliesTo);
+        Assert.Contains("prod_families", result.CustomerDiscount.AppliesTo);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task GetSubscriptionAsync_FullPipeline_WithFeatureFlagToggle_ControlsVisibility(
+        User user,
+        UserLicense license)
+    {
+        // Arrange - Create Stripe Discount
+        var stripeDiscount = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = TestMilestone2CouponId,
+                PercentOff = 20m
+            },
+            End = null
+        };
+
+        var billingDiscount = new SubscriptionInfo.BillingCustomerDiscount(stripeDiscount);
+        var subscriptionInfo = new SubscriptionInfo
+        {
+            CustomerDiscount = billingDiscount
+        };
+
+        var claimsPrincipal = new ClaimsPrincipal(new ClaimsIdentity());
+        _sut.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext { User = claimsPrincipal }
+        };
+        _userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
+        _paymentService.GetSubscriptionAsync(user).Returns(subscriptionInfo);
+        _userService.GenerateLicenseAsync(user, subscriptionInfo).Returns(license);
+        user.Gateway = GatewayType.Stripe;
+
+        // Act & Assert - Feature flag ENABLED
+        _featureService.IsEnabled(FeatureFlagKeys.PM23341_Milestone_2).Returns(true);
+        var resultWithFlag = await _sut.GetSubscriptionAsync(_globalSettings, _paymentService);
+        Assert.NotNull(resultWithFlag.CustomerDiscount);
+
+        // Act & Assert - Feature flag DISABLED
+        _featureService.IsEnabled(FeatureFlagKeys.PM23341_Milestone_2).Returns(false);
+        var resultWithoutFlag = await _sut.GetSubscriptionAsync(_globalSettings, _paymentService);
+        Assert.Null(resultWithoutFlag.CustomerDiscount);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task GetSubscriptionAsync_IntegrationTest_CompletePipelineFromStripeToApiResponse(
+        User user,
+        UserLicense license)
+    {
+        // Arrange - Create a real Stripe Discount object as it would come from Stripe API
+        var stripeDiscount = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = TestMilestone2CouponId,
+                PercentOff = 30m,
+                AmountOff = 2000, // 2000 cents = $20.00
+                AppliesTo = new CouponAppliesTo
+                {
+                    Products = new List<string> { "prod_premium", "prod_families", "prod_teams" }
+                }
+            },
+            End = null // Active discount (no end date)
+        };
+
+        // Step 1: Map Stripe Discount through SubscriptionInfo.BillingCustomerDiscount
+        // This simulates what StripePaymentService.GetSubscriptionAsync does
+        var billingCustomerDiscount = new SubscriptionInfo.BillingCustomerDiscount(stripeDiscount);
+
+        // Verify the mapping worked correctly
+        Assert.Equal(TestMilestone2CouponId, billingCustomerDiscount.Id);
+        Assert.True(billingCustomerDiscount.Active);
+        Assert.Equal(30m, billingCustomerDiscount.PercentOff);
+        Assert.Equal(20.00m, billingCustomerDiscount.AmountOff); // Converted from cents
+        Assert.NotNull(billingCustomerDiscount.AppliesTo);
+        Assert.Equal(3, billingCustomerDiscount.AppliesTo.Count);
+
+        // Step 2: Create SubscriptionInfo with the mapped discount
+        // This simulates what StripePaymentService returns
+        var subscriptionInfo = new SubscriptionInfo
+        {
+            CustomerDiscount = billingCustomerDiscount
+        };
+
+        // Step 3: Set up controller dependencies
+        var claimsPrincipal = new ClaimsPrincipal(new ClaimsIdentity());
+        _sut.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext { User = claimsPrincipal }
+        };
+        _userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
+        _featureService.IsEnabled(FeatureFlagKeys.PM23341_Milestone_2).Returns(true);
+        _paymentService.GetSubscriptionAsync(user).Returns(subscriptionInfo);
+        _userService.GenerateLicenseAsync(user, subscriptionInfo).Returns(license);
+        user.Gateway = GatewayType.Stripe;
+
+        // Act - Step 4: Call AccountsController.GetSubscriptionAsync
+        // This exercises the complete pipeline:
+        // - Retrieves subscriptionInfo from paymentService (with discount from Stripe)
+        // - Maps through SubscriptionInfo.BillingCustomerDiscount (already done above)
+        // - Filters in SubscriptionResponseModel constructor (based on feature flag, coupon ID, active status)
+        // - Returns via AccountsController
+        var result = await _sut.GetSubscriptionAsync(_globalSettings, _paymentService);
+
+        // Assert - Verify the complete pipeline worked end-to-end
+        Assert.NotNull(result);
+        Assert.NotNull(result.CustomerDiscount);
+
+        // Verify Stripe Discount → SubscriptionInfo.BillingCustomerDiscount mapping
+        // (verified above, but confirming it made it through)
+
+        // Verify SubscriptionInfo.BillingCustomerDiscount → SubscriptionResponseModel.BillingCustomerDiscount filtering
+        // The filter should pass because:
+        // - includeMilestone2Discount = true (feature flag enabled)
+        // - subscription.CustomerDiscount != null
+        // - subscription.CustomerDiscount.Id == Milestone2SubscriptionDiscount
+        // - subscription.CustomerDiscount.Active = true
+        Assert.Equal(TestMilestone2CouponId, result.CustomerDiscount.Id);
+        Assert.True(result.CustomerDiscount.Active);
+        Assert.Equal(30m, result.CustomerDiscount.PercentOff);
+        Assert.Equal(20.00m, result.CustomerDiscount.AmountOff); // Verify cents-to-dollars conversion
+
+        // Verify AppliesTo products are preserved through the entire pipeline
+        Assert.NotNull(result.CustomerDiscount.AppliesTo);
+        Assert.Equal(3, result.CustomerDiscount.AppliesTo.Count());
+        Assert.Contains("prod_premium", result.CustomerDiscount.AppliesTo);
+        Assert.Contains("prod_families", result.CustomerDiscount.AppliesTo);
+        Assert.Contains("prod_teams", result.CustomerDiscount.AppliesTo);
+
+        // Verify the payment service was called correctly
+        await _paymentService.Received(1).GetSubscriptionAsync(user);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task GetSubscriptionAsync_IntegrationTest_MultipleDiscountsInSubscription_PrefersCustomerDiscount(
+        User user,
+        UserLicense license)
+    {
+        // Arrange - Create Stripe subscription with multiple discounts
+        // Customer discount should be preferred over subscription discounts
+        var customerDiscount = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = TestMilestone2CouponId,
+                PercentOff = 30m,
+                AmountOff = null
+            },
+            End = null
+        };
+
+        var subscriptionDiscount1 = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = "other-coupon-1",
+                PercentOff = 10m
+            },
+            End = null
+        };
+
+        var subscriptionDiscount2 = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = "other-coupon-2",
+                PercentOff = 15m
+            },
+            End = null
+        };
+
+        // Map through SubscriptionInfo.BillingCustomerDiscount
+        var billingCustomerDiscount = new SubscriptionInfo.BillingCustomerDiscount(customerDiscount);
+        var subscriptionInfo = new SubscriptionInfo
+        {
+            CustomerDiscount = billingCustomerDiscount
+        };
+
+        var claimsPrincipal = new ClaimsPrincipal(new ClaimsIdentity());
+        _sut.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext { User = claimsPrincipal }
+        };
+        _userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
+        _featureService.IsEnabled(FeatureFlagKeys.PM23341_Milestone_2).Returns(true);
+        _paymentService.GetSubscriptionAsync(user).Returns(subscriptionInfo);
+        _userService.GenerateLicenseAsync(user, subscriptionInfo).Returns(license);
+        user.Gateway = GatewayType.Stripe;
+
+        // Act
+        var result = await _sut.GetSubscriptionAsync(_globalSettings, _paymentService);
+
+        // Assert - Should use customer discount, not subscription discounts
+        Assert.NotNull(result);
+        Assert.NotNull(result.CustomerDiscount);
+        Assert.Equal(TestMilestone2CouponId, result.CustomerDiscount.Id);
+        Assert.Equal(30m, result.CustomerDiscount.PercentOff);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task GetSubscriptionAsync_IntegrationTest_BothPercentOffAndAmountOffPresent_HandlesEdgeCase(
+        User user,
+        UserLicense license)
+    {
+        // Arrange - Edge case: Stripe coupon with both PercentOff and AmountOff
+        // This tests the scenario mentioned in BillingCustomerDiscountTests.cs line 212-232
+        var stripeDiscount = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = TestMilestone2CouponId,
+                PercentOff = 25m,
+                AmountOff = 2000, // 2000 cents = $20.00
+                AppliesTo = new CouponAppliesTo
+                {
+                    Products = new List<string> { "prod_premium" }
+                }
+            },
+            End = null
+        };
+
+        // Map through SubscriptionInfo.BillingCustomerDiscount
+        var billingCustomerDiscount = new SubscriptionInfo.BillingCustomerDiscount(stripeDiscount);
+        var subscriptionInfo = new SubscriptionInfo
+        {
+            CustomerDiscount = billingCustomerDiscount
+        };
+
+        var claimsPrincipal = new ClaimsPrincipal(new ClaimsIdentity());
+        _sut.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext { User = claimsPrincipal }
+        };
+        _userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
+        _featureService.IsEnabled(FeatureFlagKeys.PM23341_Milestone_2).Returns(true);
+        _paymentService.GetSubscriptionAsync(user).Returns(subscriptionInfo);
+        _userService.GenerateLicenseAsync(user, subscriptionInfo).Returns(license);
+        user.Gateway = GatewayType.Stripe;
+
+        // Act
+        var result = await _sut.GetSubscriptionAsync(_globalSettings, _paymentService);
+
+        // Assert - Both values should be preserved through the pipeline
+        Assert.NotNull(result);
+        Assert.NotNull(result.CustomerDiscount);
+        Assert.Equal(TestMilestone2CouponId, result.CustomerDiscount.Id);
+        Assert.Equal(25m, result.CustomerDiscount.PercentOff);
+        Assert.Equal(20.00m, result.CustomerDiscount.AmountOff); // Converted from cents
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task GetSubscriptionAsync_IntegrationTest_BillingSubscriptionMapsThroughPipeline(
+        User user,
+        UserLicense license)
+    {
+        // Arrange - Create Stripe subscription with subscription details
+        var stripeSubscription = new Subscription
+        {
+            Id = "sub_test123",
+            Status = "active",
+            TrialStart = DateTime.UtcNow.AddDays(-30),
+            TrialEnd = DateTime.UtcNow.AddDays(-20),
+            CanceledAt = null,
+            CancelAtPeriodEnd = false,
+            CollectionMethod = "charge_automatically"
+        };
+
+        // Map through SubscriptionInfo.BillingSubscription
+        var billingSubscription = new SubscriptionInfo.BillingSubscription(stripeSubscription);
+        var subscriptionInfo = new SubscriptionInfo
+        {
+            Subscription = billingSubscription,
+            CustomerDiscount = new SubscriptionInfo.BillingCustomerDiscount
+            {
+                Id = TestMilestone2CouponId,
+                Active = true,
+                PercentOff = 20m
+            }
+        };
+
+        var claimsPrincipal = new ClaimsPrincipal(new ClaimsIdentity());
+        _sut.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext { User = claimsPrincipal }
+        };
+        _userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
+        _featureService.IsEnabled(FeatureFlagKeys.PM23341_Milestone_2).Returns(true);
+        _paymentService.GetSubscriptionAsync(user).Returns(subscriptionInfo);
+        _userService.GenerateLicenseAsync(user, subscriptionInfo).Returns(license);
+        user.Gateway = GatewayType.Stripe;
+
+        // Act
+        var result = await _sut.GetSubscriptionAsync(_globalSettings, _paymentService);
+
+        // Assert - Verify BillingSubscription mapped through pipeline
+        Assert.NotNull(result);
+        Assert.NotNull(result.Subscription);
+        Assert.Equal("active", result.Subscription.Status);
+        Assert.Equal(14, result.Subscription.GracePeriod); // charge_automatically = 14 days
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task GetSubscriptionAsync_IntegrationTest_BillingUpcomingInvoiceMapsThroughPipeline(
+        User user,
+        UserLicense license)
+    {
+        // Arrange - Create Stripe invoice for upcoming invoice
+        var stripeInvoice = new Invoice
+        {
+            AmountDue = 2000, // 2000 cents = $20.00
+            Created = DateTime.UtcNow.AddDays(1)
+        };
+
+        // Map through SubscriptionInfo.BillingUpcomingInvoice
+        var billingUpcomingInvoice = new SubscriptionInfo.BillingUpcomingInvoice(stripeInvoice);
+        var subscriptionInfo = new SubscriptionInfo
+        {
+            UpcomingInvoice = billingUpcomingInvoice,
+            CustomerDiscount = new SubscriptionInfo.BillingCustomerDiscount
+            {
+                Id = TestMilestone2CouponId,
+                Active = true,
+                PercentOff = 20m
+            }
+        };
+
+        var claimsPrincipal = new ClaimsPrincipal(new ClaimsIdentity());
+        _sut.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext { User = claimsPrincipal }
+        };
+        _userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
+        _featureService.IsEnabled(FeatureFlagKeys.PM23341_Milestone_2).Returns(true);
+        _paymentService.GetSubscriptionAsync(user).Returns(subscriptionInfo);
+        _userService.GenerateLicenseAsync(user, subscriptionInfo).Returns(license);
+        user.Gateway = GatewayType.Stripe;
+
+        // Act
+        var result = await _sut.GetSubscriptionAsync(_globalSettings, _paymentService);
+
+        // Assert - Verify BillingUpcomingInvoice mapped through pipeline
+        Assert.NotNull(result);
+        Assert.NotNull(result.UpcomingInvoice);
+        Assert.Equal(20.00m, result.UpcomingInvoice.Amount); // Converted from cents
+        Assert.NotNull(result.UpcomingInvoice.Date);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task GetSubscriptionAsync_IntegrationTest_CompletePipelineWithAllComponents(
+        User user,
+        UserLicense license)
+    {
+        // Arrange - Complete Stripe objects for full pipeline test
+        var stripeDiscount = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = TestMilestone2CouponId,
+                PercentOff = 20m,
+                AmountOff = 1000, // $10.00
+                AppliesTo = new CouponAppliesTo
+                {
+                    Products = new List<string> { "prod_premium", "prod_families" }
+                }
+            },
+            End = null
+        };
+
+        var stripeSubscription = new Subscription
+        {
+            Id = "sub_test123",
+            Status = "active",
+            CollectionMethod = "charge_automatically"
+        };
+
+        var stripeInvoice = new Invoice
+        {
+            AmountDue = 1500, // $15.00
+            Created = DateTime.UtcNow.AddDays(7)
+        };
+
+        // Map through SubscriptionInfo (simulating StripePaymentService)
+        var billingCustomerDiscount = new SubscriptionInfo.BillingCustomerDiscount(stripeDiscount);
+        var billingSubscription = new SubscriptionInfo.BillingSubscription(stripeSubscription);
+        var billingUpcomingInvoice = new SubscriptionInfo.BillingUpcomingInvoice(stripeInvoice);
+
+        var subscriptionInfo = new SubscriptionInfo
+        {
+            CustomerDiscount = billingCustomerDiscount,
+            Subscription = billingSubscription,
+            UpcomingInvoice = billingUpcomingInvoice
+        };
+
+        var claimsPrincipal = new ClaimsPrincipal(new ClaimsIdentity());
+        _sut.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext { User = claimsPrincipal }
+        };
+        _userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
+        _featureService.IsEnabled(FeatureFlagKeys.PM23341_Milestone_2).Returns(true);
+        _paymentService.GetSubscriptionAsync(user).Returns(subscriptionInfo);
+        _userService.GenerateLicenseAsync(user, subscriptionInfo).Returns(license);
+        user.Gateway = GatewayType.Stripe;
+
+        // Act - Full pipeline: Stripe → SubscriptionInfo → SubscriptionResponseModel → API response
+        var result = await _sut.GetSubscriptionAsync(_globalSettings, _paymentService);
+
+        // Assert - Verify all components mapped correctly through the pipeline
+        Assert.NotNull(result);
+
+        // Verify discount
+        Assert.NotNull(result.CustomerDiscount);
+        Assert.Equal(TestMilestone2CouponId, result.CustomerDiscount.Id);
+        Assert.Equal(20m, result.CustomerDiscount.PercentOff);
+        Assert.Equal(10.00m, result.CustomerDiscount.AmountOff);
+        Assert.NotNull(result.CustomerDiscount.AppliesTo);
+        Assert.Equal(2, result.CustomerDiscount.AppliesTo.Count());
+
+        // Verify subscription
+        Assert.NotNull(result.Subscription);
+        Assert.Equal("active", result.Subscription.Status);
+        Assert.Equal(14, result.Subscription.GracePeriod);
+
+        // Verify upcoming invoice
+        Assert.NotNull(result.UpcomingInvoice);
+        Assert.Equal(15.00m, result.UpcomingInvoice.Amount);
+        Assert.NotNull(result.UpcomingInvoice.Date);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task GetSubscriptionAsync_SelfHosted_WithDiscountFlagEnabled_NeverIncludesDiscount(User user)
+    {
+        // Arrange - Self-hosted user with discount flag enabled (should still return null)
+        var selfHostedSettings = new GlobalSettings { SelfHosted = true };
+        var claimsPrincipal = new ClaimsPrincipal(new ClaimsIdentity());
+        _sut.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext { User = claimsPrincipal }
+        };
+        _userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
+        _featureService.IsEnabled(FeatureFlagKeys.PM23341_Milestone_2).Returns(true); // Flag enabled
+
+        // Act
+        var result = await _sut.GetSubscriptionAsync(selfHostedSettings, _paymentService);
+
+        // Assert - Should never include discount for self-hosted, even with flag enabled
+        Assert.NotNull(result);
+        Assert.Null(result.CustomerDiscount);
+        await _paymentService.DidNotReceive().GetSubscriptionAsync(Arg.Any<User>());
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task GetSubscriptionAsync_NullGateway_WithDiscountFlagEnabled_NeverIncludesDiscount(
+        User user,
+        UserLicense license)
+    {
+        // Arrange - User with null gateway and discount flag enabled (should still return null)
+        user.Gateway = null; // No gateway configured
+        var claimsPrincipal = new ClaimsPrincipal(new ClaimsIdentity());
+        _sut.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext { User = claimsPrincipal }
+        };
+        _userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(user);
+        _userService.GenerateLicenseAsync(user).Returns(license);
+        _featureService.IsEnabled(FeatureFlagKeys.PM23341_Milestone_2).Returns(true); // Flag enabled
+
+        // Act
+        var result = await _sut.GetSubscriptionAsync(_globalSettings, _paymentService);
+
+        // Assert - Should never include discount when no gateway, even with flag enabled
+        Assert.NotNull(result);
+        Assert.Null(result.CustomerDiscount);
+        await _paymentService.DidNotReceive().GetSubscriptionAsync(Arg.Any<User>());
+    }
+}

test/Api.Test/Billing/Controllers/OrganizationSponsorshipsControllerTests.cs

@@ -10,7 +10,7 @@ using Bit.Core.Models.Data;
 using Bit.Core.OrganizationFeatures.OrganizationSponsorships.FamiliesForEnterprise.Interfaces;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
-using Bit.Core.Utilities;
+using Bit.Core.Test.Billing.Mocks;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using NSubstitute;
@@ -24,11 +24,11 @@ namespace Bit.Api.Test.Billing.Controllers;
 public class OrganizationSponsorshipsControllerTests
 {
     public static IEnumerable<object[]> EnterprisePlanTypes =>
-        Enum.GetValues<PlanType>().Where(p => StaticStore.GetPlan(p).ProductTier == ProductTierType.Enterprise).Select(p => new object[] { p });
+        Enum.GetValues<PlanType>().Where(p => MockPlans.Get(p).ProductTier == ProductTierType.Enterprise).Select(p => new object[] { p });
     public static IEnumerable<object[]> NonEnterprisePlanTypes =>
-        Enum.GetValues<PlanType>().Where(p => StaticStore.GetPlan(p).ProductTier != ProductTierType.Enterprise).Select(p => new object[] { p });
+        Enum.GetValues<PlanType>().Where(p => MockPlans.Get(p).ProductTier != ProductTierType.Enterprise).Select(p => new object[] { p });
     public static IEnumerable<object[]> NonFamiliesPlanTypes =>
-        Enum.GetValues<PlanType>().Where(p => StaticStore.GetPlan(p).ProductTier != ProductTierType.Families).Select(p => new object[] { p });
+        Enum.GetValues<PlanType>().Where(p => MockPlans.Get(p).ProductTier != ProductTierType.Families).Select(p => new object[] { p });
 
     public static IEnumerable<object[]> NonConfirmedOrganizationUsersStatuses =>
         Enum.GetValues<OrganizationUserStatusType>()

test/Api.Test/Billing/Controllers/ProviderBillingControllerTests.cs

@@ -17,7 +17,7 @@ using Bit.Core.Context;
 using Bit.Core.Models.Api;
 using Bit.Core.Models.BitStripe;
 using Bit.Core.Services;
-using Bit.Core.Utilities;
+using Bit.Core.Test.Billing.Mocks;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using Microsoft.AspNetCore.Http;
@@ -351,7 +351,7 @@ public class ProviderBillingControllerTests
 
         foreach (var providerPlan in providerPlans)
         {
-            var plan = StaticStore.GetPlan(providerPlan.PlanType);
+            var plan = MockPlans.Get(providerPlan.PlanType);
             sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(providerPlan.PlanType).Returns(plan);
             var priceId = ProviderPriceAdapter.GetPriceId(provider, subscription, providerPlan.PlanType);
             sutProvider.GetDependency<IStripeAdapter>().PriceGetAsync(priceId)
@@ -372,7 +372,7 @@ public class ProviderBillingControllerTests
         Assert.Equal(subscription.Customer!.Discount!.Coupon!.PercentOff, response.DiscountPercentage);
         Assert.Equal(subscription.CollectionMethod, response.CollectionMethod);
 
-        var teamsPlan = StaticStore.GetPlan(PlanType.TeamsMonthly);
+        var teamsPlan = MockPlans.Get(PlanType.TeamsMonthly);
         var providerTeamsPlan = response.Plans.FirstOrDefault(plan => plan.PlanName == teamsPlan.Name);
         Assert.NotNull(providerTeamsPlan);
         Assert.Equal(50, providerTeamsPlan.SeatMinimum);
@@ -381,7 +381,7 @@ public class ProviderBillingControllerTests
         Assert.Equal(60 * teamsPlan.PasswordManager.ProviderPortalSeatPrice, providerTeamsPlan.Cost);
         Assert.Equal("Monthly", providerTeamsPlan.Cadence);
 
-        var enterprisePlan = StaticStore.GetPlan(PlanType.EnterpriseMonthly);
+        var enterprisePlan = MockPlans.Get(PlanType.EnterpriseMonthly);
         var providerEnterprisePlan = response.Plans.FirstOrDefault(plan => plan.PlanName == enterprisePlan.Name);
         Assert.NotNull(providerEnterprisePlan);
         Assert.Equal(100, providerEnterprisePlan.SeatMinimum);
@@ -498,7 +498,7 @@ public class ProviderBillingControllerTests
 
         foreach (var providerPlan in providerPlans)
         {
-            var plan = StaticStore.GetPlan(providerPlan.PlanType);
+            var plan = MockPlans.Get(providerPlan.PlanType);
             sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(providerPlan.PlanType).Returns(plan);
             var priceId = ProviderPriceAdapter.GetPriceId(provider, subscription, providerPlan.PlanType);
             sutProvider.GetDependency<IStripeAdapter>().PriceGetAsync(priceId)

test/Api.Test/Controllers/PoliciesControllerTests.cs

@@ -487,14 +487,14 @@ public class PoliciesControllerTests
             .Returns(policy);
 
         // Act
-        var result = await sutProvider.Sut.PutVNext(orgId, model);
+        var result = await sutProvider.Sut.PutVNext(orgId, policy.Type, model);
 
         // Assert
         await sutProvider.GetDependency<IVNextSavePolicyCommand>()
             .Received(1)
             .SaveAsync(Arg.Is<SavePolicyModel>(
                 m => m.PolicyUpdate.OrganizationId == orgId &&
-                     m.PolicyUpdate.Type == model.Policy.Type &&
+                     m.PolicyUpdate.Type == policy.Type &&
                      m.PolicyUpdate.Enabled == model.Policy.Enabled &&
                      m.PerformedBy.UserId == userId &&
                      m.PerformedBy.IsOrganizationOwnerOrProvider == true));
@@ -534,14 +534,14 @@ public class PoliciesControllerTests
             .Returns(policy);
 
         // Act
-        var result = await sutProvider.Sut.PutVNext(orgId, model);
+        var result = await sutProvider.Sut.PutVNext(orgId, policy.Type, model);
 
         // Assert
         await sutProvider.GetDependency<ISavePolicyCommand>()
             .Received(1)
             .VNextSaveAsync(Arg.Is<SavePolicyModel>(
                 m => m.PolicyUpdate.OrganizationId == orgId &&
-                     m.PolicyUpdate.Type == model.Policy.Type &&
+                     m.PolicyUpdate.Type == policy.Type &&
                      m.PolicyUpdate.Enabled == model.Policy.Enabled &&
                      m.PerformedBy.UserId == userId &&
                      m.PerformedBy.IsOrganizationOwnerOrProvider == true));

test/Api.Test/Dirt/HibpControllerTests.cs

@@ -0,0 +1,292 @@
+using System.Net;
+using System.Reflection;
+using Bit.Api.Dirt.Controllers;
+using Bit.Core.Entities;
+using Bit.Core.Exceptions;
+using Bit.Core.Services;
+using Bit.Test.Common.AutoFixture;
+using Bit.Test.Common.AutoFixture.Attributes;
+using Microsoft.AspNetCore.Mvc;
+using NSubstitute;
+using Xunit;
+using GlobalSettings = Bit.Core.Settings.GlobalSettings;
+
+namespace Bit.Api.Test.Dirt;
+
+[ControllerCustomize(typeof(HibpController))]
+[SutProviderCustomize]
+public class HibpControllerTests : IDisposable
+{
+    private readonly HttpClient _originalHttpClient;
+    private readonly FieldInfo _httpClientField;
+
+    public HibpControllerTests()
+    {
+        // Store original HttpClient for restoration
+        _httpClientField = typeof(HibpController).GetField("_httpClient", BindingFlags.Static | BindingFlags.NonPublic);
+        _originalHttpClient = (HttpClient)_httpClientField?.GetValue(null);
+    }
+
+    public void Dispose()
+    {
+        // Restore original HttpClient after tests
+        _httpClientField?.SetValue(null, _originalHttpClient);
+    }
+
+    [Theory, BitAutoData]
+    public async Task Get_WithMissingApiKey_ThrowsBadRequestException(
+        SutProvider<HibpController> sutProvider,
+        string username)
+    {
+        // Arrange
+        sutProvider.GetDependency<GlobalSettings>().HibpApiKey = null;
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(
+            async () => await sutProvider.Sut.Get(username));
+        Assert.Equal("HaveIBeenPwned API key not set.", exception.Message);
+    }
+
+    [Theory, BitAutoData]
+    public async Task Get_WithValidApiKeyAndNoBreaches_Returns200WithEmptyArray(
+        SutProvider<HibpController> sutProvider,
+        string username,
+        Guid userId)
+    {
+        // Arrange
+        sutProvider.GetDependency<GlobalSettings>().HibpApiKey = "test-api-key";
+        var user = new User { Id = userId };
+        sutProvider.GetDependency<IUserService>()
+            .GetProperUserId(Arg.Any<System.Security.Claims.ClaimsPrincipal>())
+            .Returns(userId);
+
+        // Mock HttpClient to return 404 (no breaches found)
+        var mockHttpClient = CreateMockHttpClient(HttpStatusCode.NotFound, "");
+        _httpClientField.SetValue(null, mockHttpClient);
+
+        // Act
+        var result = await sutProvider.Sut.Get(username);
+
+        // Assert
+        var contentResult = Assert.IsType<ContentResult>(result);
+        Assert.Equal("[]", contentResult.Content);
+        Assert.Equal("application/json", contentResult.ContentType);
+    }
+
+    [Theory, BitAutoData]
+    public async Task Get_WithValidApiKeyAndBreachesFound_Returns200WithBreachData(
+        SutProvider<HibpController> sutProvider,
+        string username,
+        Guid userId)
+    {
+        // Arrange
+        sutProvider.GetDependency<GlobalSettings>().HibpApiKey = "test-api-key";
+        sutProvider.GetDependency<IUserService>()
+            .GetProperUserId(Arg.Any<System.Security.Claims.ClaimsPrincipal>())
+            .Returns(userId);
+
+        var breachData = "[{\"Name\":\"Adobe\",\"Title\":\"Adobe\",\"Domain\":\"adobe.com\"}]";
+        var mockHttpClient = CreateMockHttpClient(HttpStatusCode.OK, breachData);
+        _httpClientField.SetValue(null, mockHttpClient);
+
+        // Act
+        var result = await sutProvider.Sut.Get(username);
+
+        // Assert
+        var contentResult = Assert.IsType<ContentResult>(result);
+        Assert.Equal(breachData, contentResult.Content);
+        Assert.Equal("application/json", contentResult.ContentType);
+    }
+
+    [Theory, BitAutoData]
+    public async Task Get_WithRateLimiting_RetriesWithDelay(
+        SutProvider<HibpController> sutProvider,
+        string username,
+        Guid userId)
+    {
+        // Arrange
+        sutProvider.GetDependency<GlobalSettings>().HibpApiKey = "test-api-key";
+        sutProvider.GetDependency<IUserService>()
+            .GetProperUserId(Arg.Any<System.Security.Claims.ClaimsPrincipal>())
+            .Returns(userId);
+
+        // First response is rate limited, second is success
+        var requestCount = 0;
+        var mockHandler = new MockHttpMessageHandler((request, cancellationToken) =>
+        {
+            requestCount++;
+            if (requestCount == 1)
+            {
+                var response = new HttpResponseMessage(HttpStatusCode.TooManyRequests);
+                response.Headers.Add("retry-after", "1");
+                return Task.FromResult(response);
+            }
+            else
+            {
+                return Task.FromResult(new HttpResponseMessage(HttpStatusCode.NotFound)
+                {
+                    Content = new StringContent("")
+                });
+            }
+        });
+
+        var mockHttpClient = new HttpClient(mockHandler);
+        _httpClientField.SetValue(null, mockHttpClient);
+
+        // Act
+        var result = await sutProvider.Sut.Get(username);
+
+        // Assert
+        Assert.Equal(2, requestCount); // Verify retry happened
+        var contentResult = Assert.IsType<ContentResult>(result);
+        Assert.Equal("[]", contentResult.Content);
+    }
+
+    [Theory, BitAutoData]
+    public async Task Get_WithServerError_ThrowsBadRequestException(
+        SutProvider<HibpController> sutProvider,
+        string username,
+        Guid userId)
+    {
+        // Arrange
+        sutProvider.GetDependency<GlobalSettings>().HibpApiKey = "test-api-key";
+        sutProvider.GetDependency<IUserService>()
+            .GetProperUserId(Arg.Any<System.Security.Claims.ClaimsPrincipal>())
+            .Returns(userId);
+
+        var mockHttpClient = CreateMockHttpClient(HttpStatusCode.InternalServerError, "");
+        _httpClientField.SetValue(null, mockHttpClient);
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(
+            async () => await sutProvider.Sut.Get(username));
+        Assert.Contains("Request failed. Status code:", exception.Message);
+    }
+
+    [Theory, BitAutoData]
+    public async Task Get_WithBadRequest_ThrowsBadRequestException(
+        SutProvider<HibpController> sutProvider,
+        string username,
+        Guid userId)
+    {
+        // Arrange
+        sutProvider.GetDependency<GlobalSettings>().HibpApiKey = "test-api-key";
+        sutProvider.GetDependency<IUserService>()
+            .GetProperUserId(Arg.Any<System.Security.Claims.ClaimsPrincipal>())
+            .Returns(userId);
+
+        var mockHttpClient = CreateMockHttpClient(HttpStatusCode.BadRequest, "");
+        _httpClientField.SetValue(null, mockHttpClient);
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(
+            async () => await sutProvider.Sut.Get(username));
+        Assert.Contains("Request failed. Status code:", exception.Message);
+    }
+
+    [Theory, BitAutoData]
+    public async Task Get_EncodesUsernameCorrectly(
+        SutProvider<HibpController> sutProvider,
+        Guid userId)
+    {
+        // Arrange
+        var usernameWithSpecialChars = "test+user@example.com";
+        sutProvider.GetDependency<GlobalSettings>().HibpApiKey = "test-api-key";
+        sutProvider.GetDependency<IUserService>()
+            .GetProperUserId(Arg.Any<System.Security.Claims.ClaimsPrincipal>())
+            .Returns(userId);
+
+        string capturedUrl = null;
+        var mockHandler = new MockHttpMessageHandler((request, cancellationToken) =>
+        {
+            capturedUrl = request.RequestUri.ToString();
+            return Task.FromResult(new HttpResponseMessage(HttpStatusCode.NotFound)
+            {
+                Content = new StringContent("")
+            });
+        });
+
+        var mockHttpClient = new HttpClient(mockHandler);
+        _httpClientField.SetValue(null, mockHttpClient);
+
+        // Act
+        await sutProvider.Sut.Get(usernameWithSpecialChars);
+
+        // Assert
+        Assert.NotNull(capturedUrl);
+        // Username should be URL encoded (+ becomes %2B, @ becomes %40)
+        Assert.Contains("test%2Buser%40example.com", capturedUrl);
+    }
+
+    [Theory, BitAutoData]
+    public async Task SendAsync_IncludesRequiredHeaders(
+        SutProvider<HibpController> sutProvider,
+        string username,
+        Guid userId)
+    {
+        // Arrange
+        sutProvider.GetDependency<GlobalSettings>().HibpApiKey = "test-api-key";
+        sutProvider.GetDependency<GlobalSettings>().SelfHosted = false;
+        sutProvider.GetDependency<IUserService>()
+            .GetProperUserId(Arg.Any<System.Security.Claims.ClaimsPrincipal>())
+            .Returns(userId);
+
+        HttpRequestMessage capturedRequest = null;
+        var mockHandler = new MockHttpMessageHandler((request, cancellationToken) =>
+        {
+            capturedRequest = request;
+            return Task.FromResult(new HttpResponseMessage(HttpStatusCode.NotFound)
+            {
+                Content = new StringContent("")
+            });
+        });
+
+        var mockHttpClient = new HttpClient(mockHandler);
+        _httpClientField.SetValue(null, mockHttpClient);
+
+        // Act
+        await sutProvider.Sut.Get(username);
+
+        // Assert
+        Assert.NotNull(capturedRequest);
+        Assert.True(capturedRequest.Headers.Contains("hibp-api-key"));
+        Assert.True(capturedRequest.Headers.Contains("hibp-client-id"));
+        Assert.True(capturedRequest.Headers.Contains("User-Agent"));
+        Assert.Equal("Bitwarden", capturedRequest.Headers.GetValues("User-Agent").First());
+    }
+
+    /// <summary>
+    /// Helper to create a mock HttpClient that returns a specific status code and content
+    /// </summary>
+    private HttpClient CreateMockHttpClient(HttpStatusCode statusCode, string content)
+    {
+        var mockHandler = new MockHttpMessageHandler((request, cancellationToken) =>
+        {
+            return Task.FromResult(new HttpResponseMessage(statusCode)
+            {
+                Content = new StringContent(content)
+            });
+        });
+
+        return new HttpClient(mockHandler);
+    }
+}
+
+/// <summary>
+/// Mock HttpMessageHandler for testing HttpClient behavior
+/// </summary>
+public class MockHttpMessageHandler : HttpMessageHandler
+{
+    private readonly Func<HttpRequestMessage, CancellationToken, Task<HttpResponseMessage>> _sendAsync;
+
+    public MockHttpMessageHandler(Func<HttpRequestMessage, CancellationToken, Task<HttpResponseMessage>> sendAsync)
+    {
+        _sendAsync = sendAsync;
+    }
+
+    protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
+    {
+        return _sendAsync(request, cancellationToken);
+    }
+}
+

test/Api.Test/KeyManagement/Controllers/AccountsKeyManagementControllerTests.cs

@@ -14,6 +14,7 @@ using Bit.Core.Auth.Models.Data;
 using Bit.Core.Entities;
 using Bit.Core.Exceptions;
 using Bit.Core.KeyManagement.Commands.Interfaces;
+using Bit.Core.KeyManagement.Models.Api.Request;
 using Bit.Core.KeyManagement.Models.Data;
 using Bit.Core.KeyManagement.UserKey;
 using Bit.Core.Repositories;

test/Api.Test/KeyManagement/Models/Request/SignatureKeyPairRequestModel.cs

@@ -1,6 +1,6 @@
 #nullable enable
 
-using Bit.Api.KeyManagement.Models.Requests;
+using Bit.Core.KeyManagement.Models.Api.Request;
 using Xunit;
 
 namespace Bit.Api.Test.KeyManagement.Models.Request;

test/Api.Test/Models/Response/SubscriptionResponseModelTests.cs

@@ -0,0 +1,400 @@
+using Bit.Api.Models.Response;
+using Bit.Core.Billing.Constants;
+using Bit.Core.Billing.Models.Business;
+using Bit.Core.Entities;
+using Bit.Core.Models.Business;
+using Bit.Test.Common.AutoFixture.Attributes;
+using Stripe;
+using Xunit;
+
+namespace Bit.Api.Test.Models.Response;
+
+public class SubscriptionResponseModelTests
+{
+    [Theory]
+    [BitAutoData]
+    public void Constructor_IncludeMilestone2DiscountTrueMatchingCouponId_ReturnsDiscount(
+        User user,
+        UserLicense license)
+    {
+        // Arrange
+        var subscriptionInfo = new SubscriptionInfo
+        {
+            CustomerDiscount = new SubscriptionInfo.BillingCustomerDiscount
+            {
+                Id = StripeConstants.CouponIDs.Milestone2SubscriptionDiscount, // Matching coupon ID
+                Active = true,
+                PercentOff = 20m,
+                AmountOff = null,
+                AppliesTo = new List<string> { "product1" }
+            }
+        };
+
+        // Act
+        var result = new SubscriptionResponseModel(user, subscriptionInfo, license, includeMilestone2Discount: true);
+
+        // Assert
+        Assert.NotNull(result.CustomerDiscount);
+        Assert.Equal(StripeConstants.CouponIDs.Milestone2SubscriptionDiscount, result.CustomerDiscount.Id);
+        Assert.True(result.CustomerDiscount.Active);
+        Assert.Equal(20m, result.CustomerDiscount.PercentOff);
+        Assert.Null(result.CustomerDiscount.AmountOff);
+        Assert.NotNull(result.CustomerDiscount.AppliesTo);
+        Assert.Single(result.CustomerDiscount.AppliesTo);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_IncludeMilestone2DiscountTrueNonMatchingCouponId_ReturnsNull(
+        User user,
+        UserLicense license)
+    {
+        // Arrange
+        var subscriptionInfo = new SubscriptionInfo
+        {
+            CustomerDiscount = new SubscriptionInfo.BillingCustomerDiscount
+            {
+                Id = "different-coupon-id", // Non-matching coupon ID
+                Active = true,
+                PercentOff = 20m,
+                AmountOff = null,
+                AppliesTo = new List<string> { "product1" }
+            }
+        };
+
+        // Act
+        var result = new SubscriptionResponseModel(user, subscriptionInfo, license, includeMilestone2Discount: true);
+
+        // Assert
+        Assert.Null(result.CustomerDiscount);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_IncludeMilestone2DiscountFalseMatchingCouponId_ReturnsNull(
+        User user,
+        UserLicense license)
+    {
+        // Arrange
+        var subscriptionInfo = new SubscriptionInfo
+        {
+            CustomerDiscount = new SubscriptionInfo.BillingCustomerDiscount
+            {
+                Id = StripeConstants.CouponIDs.Milestone2SubscriptionDiscount, // Matching coupon ID
+                Active = true,
+                PercentOff = 20m,
+                AmountOff = null,
+                AppliesTo = new List<string> { "product1" }
+            }
+        };
+
+        // Act
+        var result = new SubscriptionResponseModel(user, subscriptionInfo, license, includeMilestone2Discount: false);
+
+        // Assert - Should be null because includeMilestone2Discount is false
+        Assert.Null(result.CustomerDiscount);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_NullCustomerDiscount_ReturnsNull(
+        User user,
+        UserLicense license)
+    {
+        // Arrange
+        var subscriptionInfo = new SubscriptionInfo
+        {
+            CustomerDiscount = null
+        };
+
+        // Act
+        var result = new SubscriptionResponseModel(user, subscriptionInfo, license, includeMilestone2Discount: true);
+
+        // Assert
+        Assert.Null(result.CustomerDiscount);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_AmountOffDiscountMatchingCouponId_ReturnsDiscount(
+        User user,
+        UserLicense license)
+    {
+        // Arrange
+        var subscriptionInfo = new SubscriptionInfo
+        {
+            CustomerDiscount = new SubscriptionInfo.BillingCustomerDiscount
+            {
+                Id = StripeConstants.CouponIDs.Milestone2SubscriptionDiscount,
+                Active = true,
+                PercentOff = null,
+                AmountOff = 14.00m, // Already converted from cents in BillingCustomerDiscount
+                AppliesTo = new List<string>()
+            }
+        };
+
+        // Act
+        var result = new SubscriptionResponseModel(user, subscriptionInfo, license, includeMilestone2Discount: true);
+
+        // Assert
+        Assert.NotNull(result.CustomerDiscount);
+        Assert.Equal(StripeConstants.CouponIDs.Milestone2SubscriptionDiscount, result.CustomerDiscount.Id);
+        Assert.Null(result.CustomerDiscount.PercentOff);
+        Assert.Equal(14.00m, result.CustomerDiscount.AmountOff);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_DefaultIncludeMilestone2DiscountParameter_ReturnsNull(
+        User user,
+        UserLicense license)
+    {
+        // Arrange
+        var subscriptionInfo = new SubscriptionInfo
+        {
+            CustomerDiscount = new SubscriptionInfo.BillingCustomerDiscount
+            {
+                Id = StripeConstants.CouponIDs.Milestone2SubscriptionDiscount,
+                Active = true,
+                PercentOff = 20m
+            }
+        };
+
+        // Act - Using default parameter (includeMilestone2Discount defaults to false)
+        var result = new SubscriptionResponseModel(user, subscriptionInfo, license);
+
+        // Assert
+        Assert.Null(result.CustomerDiscount);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_NullDiscountIdIncludeMilestone2DiscountTrue_ReturnsNull(
+        User user,
+        UserLicense license)
+    {
+        // Arrange
+        var subscriptionInfo = new SubscriptionInfo
+        {
+            CustomerDiscount = new SubscriptionInfo.BillingCustomerDiscount
+            {
+                Id = null, // Null discount ID
+                Active = true,
+                PercentOff = 20m,
+                AmountOff = null,
+                AppliesTo = new List<string> { "product1" }
+            }
+        };
+
+        // Act
+        var result = new SubscriptionResponseModel(user, subscriptionInfo, license, includeMilestone2Discount: true);
+
+        // Assert
+        Assert.Null(result.CustomerDiscount);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_MatchingCouponIdInactiveDiscount_ReturnsNull(
+        User user,
+        UserLicense license)
+    {
+        // Arrange
+        var subscriptionInfo = new SubscriptionInfo
+        {
+            CustomerDiscount = new SubscriptionInfo.BillingCustomerDiscount
+            {
+                Id = StripeConstants.CouponIDs.Milestone2SubscriptionDiscount, // Matching coupon ID
+                Active = false, // Inactive discount
+                PercentOff = 20m,
+                AmountOff = null,
+                AppliesTo = new List<string> { "product1" }
+            }
+        };
+
+        // Act
+        var result = new SubscriptionResponseModel(user, subscriptionInfo, license, includeMilestone2Discount: true);
+
+        // Assert
+        Assert.Null(result.CustomerDiscount);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_UserOnly_SetsBasicProperties(User user)
+    {
+        // Arrange
+        user.Storage = 5368709120; // 5 GB in bytes
+        user.MaxStorageGb = (short)10;
+        user.PremiumExpirationDate = DateTime.UtcNow.AddMonths(12);
+
+        // Act
+        var result = new SubscriptionResponseModel(user);
+
+        // Assert
+        Assert.NotNull(result.StorageName);
+        Assert.Equal(5.0, result.StorageGb);
+        Assert.Equal((short)10, result.MaxStorageGb);
+        Assert.Equal(user.PremiumExpirationDate, result.Expiration);
+        Assert.Null(result.License);
+        Assert.Null(result.CustomerDiscount);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_UserAndLicense_IncludesLicense(User user, UserLicense license)
+    {
+        // Arrange
+        user.Storage = 1073741824; // 1 GB in bytes
+        user.MaxStorageGb = (short)5;
+
+        // Act
+        var result = new SubscriptionResponseModel(user, license);
+
+        // Assert
+        Assert.NotNull(result.License);
+        Assert.Equal(license, result.License);
+        Assert.Equal(1.0, result.StorageGb);
+        Assert.Null(result.CustomerDiscount);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_NullStorage_SetsStorageToZero(User user)
+    {
+        // Arrange
+        user.Storage = null;
+
+        // Act
+        var result = new SubscriptionResponseModel(user);
+
+        // Assert
+        Assert.Null(result.StorageName);
+        Assert.Equal(0, result.StorageGb);
+        Assert.Null(result.CustomerDiscount);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_NullLicense_ExcludesLicense(User user)
+    {
+        // Act
+        var result = new SubscriptionResponseModel(user, null);
+
+        // Assert
+        Assert.Null(result.License);
+        Assert.Null(result.CustomerDiscount);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_BothPercentOffAndAmountOffPresent_HandlesEdgeCase(
+        User user,
+        UserLicense license)
+    {
+        // Arrange - Edge case: Both PercentOff and AmountOff present
+        // This tests the scenario where Stripe coupon has both discount types
+        var subscriptionInfo = new SubscriptionInfo
+        {
+            CustomerDiscount = new SubscriptionInfo.BillingCustomerDiscount
+            {
+                Id = StripeConstants.CouponIDs.Milestone2SubscriptionDiscount,
+                Active = true,
+                PercentOff = 25m,
+                AmountOff = 20.00m, // Already converted from cents
+                AppliesTo = new List<string> { "prod_premium" }
+            }
+        };
+
+        // Act
+        var result = new SubscriptionResponseModel(user, subscriptionInfo, license, includeMilestone2Discount: true);
+
+        // Assert - Both values should be preserved
+        Assert.NotNull(result.CustomerDiscount);
+        Assert.Equal(StripeConstants.CouponIDs.Milestone2SubscriptionDiscount, result.CustomerDiscount.Id);
+        Assert.Equal(25m, result.CustomerDiscount.PercentOff);
+        Assert.Equal(20.00m, result.CustomerDiscount.AmountOff);
+        Assert.NotNull(result.CustomerDiscount.AppliesTo);
+        Assert.Single(result.CustomerDiscount.AppliesTo);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_WithSubscriptionAndInvoice_MapsAllProperties(
+        User user,
+        UserLicense license)
+    {
+        // Arrange - Test with Subscription, UpcomingInvoice, and CustomerDiscount
+        var stripeSubscription = new Subscription
+        {
+            Id = "sub_test123",
+            Status = "active",
+            CollectionMethod = "charge_automatically"
+        };
+
+        var stripeInvoice = new Invoice
+        {
+            AmountDue = 1500, // 1500 cents = $15.00
+            Created = DateTime.UtcNow.AddDays(7)
+        };
+
+        var subscriptionInfo = new SubscriptionInfo
+        {
+            Subscription = new SubscriptionInfo.BillingSubscription(stripeSubscription),
+            UpcomingInvoice = new SubscriptionInfo.BillingUpcomingInvoice(stripeInvoice),
+            CustomerDiscount = new SubscriptionInfo.BillingCustomerDiscount
+            {
+                Id = StripeConstants.CouponIDs.Milestone2SubscriptionDiscount,
+                Active = true,
+                PercentOff = 20m,
+                AmountOff = null,
+                AppliesTo = new List<string> { "prod_premium" }
+            }
+        };
+
+        // Act
+        var result = new SubscriptionResponseModel(user, subscriptionInfo, license, includeMilestone2Discount: true);
+
+        // Assert - Verify all properties are mapped correctly
+        Assert.NotNull(result.Subscription);
+        Assert.Equal("active", result.Subscription.Status);
+        Assert.Equal(14, result.Subscription.GracePeriod); // charge_automatically = 14 days
+
+        Assert.NotNull(result.UpcomingInvoice);
+        Assert.Equal(15.00m, result.UpcomingInvoice.Amount);
+        Assert.NotNull(result.UpcomingInvoice.Date);
+
+        Assert.NotNull(result.CustomerDiscount);
+        Assert.Equal(StripeConstants.CouponIDs.Milestone2SubscriptionDiscount, result.CustomerDiscount.Id);
+        Assert.True(result.CustomerDiscount.Active);
+        Assert.Equal(20m, result.CustomerDiscount.PercentOff);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_WithNullSubscriptionAndInvoice_HandlesNullsGracefully(
+        User user,
+        UserLicense license)
+    {
+        // Arrange - Test with null Subscription and UpcomingInvoice
+        var subscriptionInfo = new SubscriptionInfo
+        {
+            Subscription = null,
+            UpcomingInvoice = null,
+            CustomerDiscount = new SubscriptionInfo.BillingCustomerDiscount
+            {
+                Id = StripeConstants.CouponIDs.Milestone2SubscriptionDiscount,
+                Active = true,
+                PercentOff = 20m
+            }
+        };
+
+        // Act
+        var result = new SubscriptionResponseModel(user, subscriptionInfo, license, includeMilestone2Discount: true);
+
+        // Assert - Null Subscription and UpcomingInvoice should be handled gracefully
+        Assert.Null(result.Subscription);
+        Assert.Null(result.UpcomingInvoice);
+        Assert.NotNull(result.CustomerDiscount);
+    }
+}

test/Api.Test/SecretsManager/Controllers/ServiceAccountsControllerTests.cs

@@ -16,7 +16,7 @@ using Bit.Core.SecretsManager.Models.Data;
 using Bit.Core.SecretsManager.Queries.ServiceAccounts.Interfaces;
 using Bit.Core.SecretsManager.Repositories;
 using Bit.Core.Services;
-using Bit.Core.Utilities;
+using Bit.Core.Test.Billing.Mocks;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using Bit.Test.Common.Helpers;
@@ -121,7 +121,7 @@ public class ServiceAccountsControllerTests
     {
         ArrangeCreateServiceAccountAutoScalingTest(newSlotsRequired, sutProvider, data, organization);
 
-        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(organization.PlanType).Returns(StaticStore.GetPlan(organization.PlanType));
+        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(organization.PlanType).Returns(MockPlans.Get(organization.PlanType));
 
         await sutProvider.Sut.CreateAsync(organization.Id, data);
 

test/Api.Test/Vault/Controllers/CiphersControllerTests.cs

@@ -1790,118 +1790,6 @@ public class CiphersControllerTests
         );
     }
 
-    [Theory, BitAutoData]
-    public async Task PutShareMany_ArchivedCipher_ThrowsBadRequestException(
-        Guid organizationId,
-        Guid userId,
-        CipherWithIdRequestModel request,
-        SutProvider<CiphersController> sutProvider)
-    {
-        request.EncryptedFor = userId;
-        request.OrganizationId = organizationId.ToString();
-        request.ArchivedDate = DateTime.UtcNow;
-        var model = new CipherBulkShareRequestModel
-        {
-            Ciphers = [request],
-            CollectionIds = [Guid.NewGuid().ToString()]
-        };
-
-        sutProvider.GetDependency<ICurrentContext>()
-            .OrganizationUser(organizationId)
-            .Returns(Task.FromResult(true));
-        sutProvider.GetDependency<IUserService>()
-            .GetProperUserId(default)
-            .ReturnsForAnyArgs(userId);
-
-        var exception = await Assert.ThrowsAsync<BadRequestException>(
-            () => sutProvider.Sut.PutShareMany(model)
-        );
-
-        Assert.Equal("Cannot move archived items to an organization.", exception.Message);
-    }
-
-    [Theory, BitAutoData]
-    public async Task PutShareMany_ExistingCipherArchived_ThrowsBadRequestException(
-        Guid organizationId,
-        Guid userId,
-        CipherWithIdRequestModel request,
-        SutProvider<CiphersController> sutProvider)
-    {
-        // Request model does not have ArchivedDate (only the existing cipher does)
-        request.EncryptedFor = userId;
-        request.OrganizationId = organizationId.ToString();
-        request.ArchivedDate = null;
-
-        var model = new CipherBulkShareRequestModel
-        {
-            Ciphers = [request],
-            CollectionIds = [Guid.NewGuid().ToString()]
-        };
-
-        // The existing cipher from the repository IS archived
-        var existingCipher = new CipherDetails
-        {
-            Id = request.Id!.Value,
-            UserId = userId,
-            Type = CipherType.Login,
-            Data = JsonSerializer.Serialize(new CipherLoginData()),
-            ArchivedDate = DateTime.UtcNow
-        };
-
-        sutProvider.GetDependency<ICurrentContext>()
-            .OrganizationUser(organizationId)
-            .Returns(Task.FromResult(true));
-        sutProvider.GetDependency<IUserService>()
-            .GetProperUserId(default)
-            .ReturnsForAnyArgs(userId);
-        sutProvider.GetDependency<ICipherRepository>()
-            .GetManyByUserIdAsync(userId, withOrganizations: false)
-            .Returns(Task.FromResult((ICollection<CipherDetails>)[existingCipher]));
-
-        var exception = await Assert.ThrowsAsync<BadRequestException>(
-            () => sutProvider.Sut.PutShareMany(model)
-        );
-
-        Assert.Equal("Cannot move archived items to an organization.", exception.Message);
-    }
-
-    [Theory, BitAutoData]
-    public async Task PutShare_ArchivedCipher_ThrowsBadRequestException(
-        Guid cipherId,
-        Guid organizationId,
-        User user,
-        CipherShareRequestModel model,
-        SutProvider<CiphersController> sutProvider)
-    {
-        model.Cipher.OrganizationId = organizationId.ToString();
-        model.Cipher.EncryptedFor = user.Id;
-
-        var cipher = new Cipher
-        {
-            Id = cipherId,
-            UserId = user.Id,
-            ArchivedDate = DateTime.UtcNow.AddDays(-1),
-            Type = CipherType.Login,
-            Data = JsonSerializer.Serialize(new CipherLoginData())
-        };
-
-        sutProvider.GetDependency<IUserService>()
-            .GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>())
-            .Returns(user);
-        sutProvider.GetDependency<ICipherRepository>()
-            .GetByIdAsync(cipherId)
-            .Returns(cipher);
-        sutProvider.GetDependency<ICurrentContext>()
-            .OrganizationUser(organizationId)
-            .Returns(Task.FromResult(true));
-
-        var exception = await Assert.ThrowsAsync<BadRequestException>(
-            () => sutProvider.Sut.PutShare(cipherId, model)
-        );
-
-        Assert.Equal("Cannot move an archived item to an organization.", exception.Message);
-    }
-
     [Theory, BitAutoData]
     public async Task PostPurge_WhenUserNotFound_ThrowsUnauthorizedAccessException(
         SecretVerificationRequestModel model,

test/Api.Test/Vault/Controllers/SyncControllerTests.cs

@@ -18,9 +18,9 @@ using Bit.Core.Models.Data;
 using Bit.Core.Models.Data.Organizations.OrganizationUsers;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
+using Bit.Core.Test.Billing.Mocks;
 using Bit.Core.Tools.Entities;
 using Bit.Core.Tools.Repositories;
-using Bit.Core.Utilities;
 using Bit.Core.Vault.Entities;
 using Bit.Core.Vault.Models.Data;
 using Bit.Core.Vault.Repositories;
@@ -335,7 +335,7 @@ public class SyncControllerTests
 
             if (matchedProviderUserOrgDetails != null)
             {
-                var providerOrgProductType = StaticStore.GetPlan(matchedProviderUserOrgDetails.PlanType).ProductTier;
+                var providerOrgProductType = MockPlans.Get(matchedProviderUserOrgDetails.PlanType).ProductTier;
                 Assert.Equal(providerOrgProductType, profProviderOrg.ProductTierType);
             }
         }

test/Billing.Test/Billing.Test.csproj

@@ -24,6 +24,7 @@
   <ItemGroup>
     <ProjectReference Include="..\..\src\Billing\Billing.csproj" />
     <ProjectReference Include="..\Common\Common.csproj" />
+    <ProjectReference Include="..\Core.Test\Core.Test.csproj" />
   </ItemGroup>
 
   <ItemGroup>

test/Billing.Test/Jobs/ReconcileAdditionalStorageJobTests.cs

@@ -0,0 +1,641 @@
+using Bit.Billing.Jobs;
+using Bit.Billing.Services;
+using Bit.Core;
+using Bit.Core.Billing.Constants;
+using Bit.Core.Services;
+using Microsoft.Extensions.Logging;
+using NSubstitute;
+using NSubstitute.ExceptionExtensions;
+using Quartz;
+using Stripe;
+using Xunit;
+
+namespace Bit.Billing.Test.Jobs;
+
+public class ReconcileAdditionalStorageJobTests
+{
+    private readonly IStripeFacade _stripeFacade;
+    private readonly ILogger<ReconcileAdditionalStorageJob> _logger;
+    private readonly IFeatureService _featureService;
+    private readonly ReconcileAdditionalStorageJob _sut;
+
+    public ReconcileAdditionalStorageJobTests()
+    {
+        _stripeFacade = Substitute.For<IStripeFacade>();
+        _logger = Substitute.For<ILogger<ReconcileAdditionalStorageJob>>();
+        _featureService = Substitute.For<IFeatureService>();
+        _sut = new ReconcileAdditionalStorageJob(_stripeFacade, _logger, _featureService);
+    }
+
+    #region Feature Flag Tests
+
+    [Fact]
+    public async Task Execute_FeatureFlagDisabled_SkipsProcessing()
+    {
+        // Arrange
+        var context = CreateJobExecutionContext();
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_EnableReconcileAdditionalStorageJob)
+            .Returns(false);
+
+        // Act
+        await _sut.Execute(context);
+
+        // Assert
+        _stripeFacade.DidNotReceiveWithAnyArgs().ListSubscriptionsAutoPagingAsync();
+    }
+
+    [Fact]
+    public async Task Execute_FeatureFlagEnabled_ProcessesSubscriptions()
+    {
+        // Arrange
+        var context = CreateJobExecutionContext();
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_EnableReconcileAdditionalStorageJob)
+            .Returns(true);
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_ReconcileAdditionalStorageJobEnableLiveMode)
+            .Returns(false);
+
+        _stripeFacade.ListSubscriptionsAutoPagingAsync(Arg.Any<SubscriptionListOptions>())
+            .Returns(AsyncEnumerable.Empty<Subscription>());
+
+        // Act
+        await _sut.Execute(context);
+
+        // Assert
+        _stripeFacade.Received(3).ListSubscriptionsAutoPagingAsync(
+            Arg.Is<SubscriptionListOptions>(o => o.Status == "active"));
+    }
+
+    #endregion
+
+    #region Dry Run Mode Tests
+
+    [Fact]
+    public async Task Execute_DryRunMode_DoesNotUpdateSubscriptions()
+    {
+        // Arrange
+        var context = CreateJobExecutionContext();
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_EnableReconcileAdditionalStorageJob).Returns(true);
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_ReconcileAdditionalStorageJobEnableLiveMode).Returns(false); // Dry run ON
+
+        var subscription = CreateSubscription("sub_123", "storage-gb-monthly", quantity: 10);
+        _stripeFacade.ListSubscriptionsAutoPagingAsync(Arg.Any<SubscriptionListOptions>())
+            .Returns(AsyncEnumerable.Create(subscription));
+
+        // Act
+        await _sut.Execute(context);
+
+        // Assert
+        await _stripeFacade.DidNotReceiveWithAnyArgs().UpdateSubscription(null!);
+    }
+
+    [Fact]
+    public async Task Execute_DryRunModeDisabled_UpdatesSubscriptions()
+    {
+        // Arrange
+        var context = CreateJobExecutionContext();
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_EnableReconcileAdditionalStorageJob).Returns(true);
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_ReconcileAdditionalStorageJobEnableLiveMode).Returns(true); // Dry run OFF
+
+        var subscription = CreateSubscription("sub_123", "storage-gb-monthly", quantity: 10);
+        _stripeFacade.ListSubscriptionsAutoPagingAsync(Arg.Any<SubscriptionListOptions>())
+            .Returns(AsyncEnumerable.Create(subscription));
+        _stripeFacade.UpdateSubscription(Arg.Any<string>(), Arg.Any<SubscriptionUpdateOptions>())
+            .Returns(subscription);
+
+        // Act
+        await _sut.Execute(context);
+
+        // Assert
+        await _stripeFacade.Received(1).UpdateSubscription(
+            "sub_123",
+            Arg.Is<SubscriptionUpdateOptions>(o => o.Items.Count == 1));
+    }
+
+    #endregion
+
+    #region Price ID Processing Tests
+
+    [Fact]
+    public async Task Execute_ProcessesAllThreePriceIds()
+    {
+        // Arrange
+        var context = CreateJobExecutionContext();
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_EnableReconcileAdditionalStorageJob).Returns(true);
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_ReconcileAdditionalStorageJobEnableLiveMode).Returns(false);
+
+        _stripeFacade.ListSubscriptionsAutoPagingAsync(Arg.Any<SubscriptionListOptions>())
+            .Returns(AsyncEnumerable.Empty<Subscription>());
+
+        // Act
+        await _sut.Execute(context);
+
+        // Assert
+        _stripeFacade.Received(1).ListSubscriptionsAutoPagingAsync(
+            Arg.Is<SubscriptionListOptions>(o => o.Price == "storage-gb-monthly"));
+        _stripeFacade.Received(1).ListSubscriptionsAutoPagingAsync(
+            Arg.Is<SubscriptionListOptions>(o => o.Price == "storage-gb-annually"));
+        _stripeFacade.Received(1).ListSubscriptionsAutoPagingAsync(
+            Arg.Is<SubscriptionListOptions>(o => o.Price == "personal-storage-gb-annually"));
+    }
+
+    #endregion
+
+    #region Already Processed Tests
+
+    [Fact]
+    public async Task Execute_SubscriptionAlreadyProcessed_SkipsUpdate()
+    {
+        // Arrange
+        var context = CreateJobExecutionContext();
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_EnableReconcileAdditionalStorageJob).Returns(true);
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_ReconcileAdditionalStorageJobEnableLiveMode).Returns(true);
+
+        var metadata = new Dictionary<string, string>
+        {
+            [StripeConstants.MetadataKeys.StorageReconciled2025] = DateTime.UtcNow.ToString("o")
+        };
+        var subscription = CreateSubscription("sub_123", "storage-gb-monthly", quantity: 10, metadata: metadata);
+
+        _stripeFacade.ListSubscriptionsAutoPagingAsync(Arg.Any<SubscriptionListOptions>())
+            .Returns(AsyncEnumerable.Create(subscription));
+
+        // Act
+        await _sut.Execute(context);
+
+        // Assert
+        await _stripeFacade.DidNotReceiveWithAnyArgs().UpdateSubscription(null!);
+    }
+
+    [Fact]
+    public async Task Execute_SubscriptionWithInvalidProcessedDate_ProcessesSubscription()
+    {
+        // Arrange
+        var context = CreateJobExecutionContext();
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_EnableReconcileAdditionalStorageJob).Returns(true);
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_ReconcileAdditionalStorageJobEnableLiveMode).Returns(true);
+
+        var metadata = new Dictionary<string, string>
+        {
+            [StripeConstants.MetadataKeys.StorageReconciled2025] = "invalid-date"
+        };
+        var subscription = CreateSubscription("sub_123", "storage-gb-monthly", quantity: 10, metadata: metadata);
+
+        _stripeFacade.ListSubscriptionsAutoPagingAsync(Arg.Any<SubscriptionListOptions>())
+            .Returns(AsyncEnumerable.Create(subscription));
+        _stripeFacade.UpdateSubscription(Arg.Any<string>(), Arg.Any<SubscriptionUpdateOptions>())
+            .Returns(subscription);
+
+        // Act
+        await _sut.Execute(context);
+
+        // Assert
+        await _stripeFacade.Received(1).UpdateSubscription("sub_123", Arg.Any<SubscriptionUpdateOptions>());
+    }
+
+    [Fact]
+    public async Task Execute_SubscriptionWithoutMetadata_ProcessesSubscription()
+    {
+        // Arrange
+        var context = CreateJobExecutionContext();
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_EnableReconcileAdditionalStorageJob).Returns(true);
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_ReconcileAdditionalStorageJobEnableLiveMode).Returns(true);
+
+        var subscription = CreateSubscription("sub_123", "storage-gb-monthly", quantity: 10, metadata: null);
+
+        _stripeFacade.ListSubscriptionsAutoPagingAsync(Arg.Any<SubscriptionListOptions>())
+            .Returns(AsyncEnumerable.Create(subscription));
+        _stripeFacade.UpdateSubscription(Arg.Any<string>(), Arg.Any<SubscriptionUpdateOptions>())
+            .Returns(subscription);
+
+        // Act
+        await _sut.Execute(context);
+
+        // Assert
+        await _stripeFacade.Received(1).UpdateSubscription("sub_123", Arg.Any<SubscriptionUpdateOptions>());
+    }
+
+    #endregion
+
+    #region Quantity Reduction Logic Tests
+
+    [Fact]
+    public async Task Execute_QuantityGreaterThan4_ReducesBy4()
+    {
+        // Arrange
+        var context = CreateJobExecutionContext();
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_EnableReconcileAdditionalStorageJob).Returns(true);
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_ReconcileAdditionalStorageJobEnableLiveMode).Returns(true);
+
+        var subscription = CreateSubscription("sub_123", "storage-gb-monthly", quantity: 10);
+
+        _stripeFacade.ListSubscriptionsAutoPagingAsync(Arg.Any<SubscriptionListOptions>())
+            .Returns(AsyncEnumerable.Create(subscription));
+        _stripeFacade.UpdateSubscription(Arg.Any<string>(), Arg.Any<SubscriptionUpdateOptions>())
+            .Returns(subscription);
+
+        // Act
+        await _sut.Execute(context);
+
+        // Assert
+        await _stripeFacade.Received(1).UpdateSubscription(
+            "sub_123",
+            Arg.Is<SubscriptionUpdateOptions>(o =>
+                o.Items.Count == 1 &&
+                o.Items[0].Quantity == 6 &&
+                o.Items[0].Deleted != true));
+    }
+
+    [Fact]
+    public async Task Execute_QuantityEquals4_DeletesItem()
+    {
+        // Arrange
+        var context = CreateJobExecutionContext();
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_EnableReconcileAdditionalStorageJob).Returns(true);
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_ReconcileAdditionalStorageJobEnableLiveMode).Returns(true);
+
+        var subscription = CreateSubscription("sub_123", "storage-gb-monthly", quantity: 4);
+
+        _stripeFacade.ListSubscriptionsAutoPagingAsync(Arg.Any<SubscriptionListOptions>())
+            .Returns(AsyncEnumerable.Create(subscription));
+        _stripeFacade.UpdateSubscription(Arg.Any<string>(), Arg.Any<SubscriptionUpdateOptions>())
+            .Returns(subscription);
+
+        // Act
+        await _sut.Execute(context);
+
+        // Assert
+        await _stripeFacade.Received(1).UpdateSubscription(
+            "sub_123",
+            Arg.Is<SubscriptionUpdateOptions>(o =>
+                o.Items.Count == 1 &&
+                o.Items[0].Deleted == true));
+    }
+
+    [Fact]
+    public async Task Execute_QuantityLessThan4_DeletesItem()
+    {
+        // Arrange
+        var context = CreateJobExecutionContext();
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_EnableReconcileAdditionalStorageJob).Returns(true);
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_ReconcileAdditionalStorageJobEnableLiveMode).Returns(true);
+
+        var subscription = CreateSubscription("sub_123", "storage-gb-monthly", quantity: 2);
+
+        _stripeFacade.ListSubscriptionsAutoPagingAsync(Arg.Any<SubscriptionListOptions>())
+            .Returns(AsyncEnumerable.Create(subscription));
+        _stripeFacade.UpdateSubscription(Arg.Any<string>(), Arg.Any<SubscriptionUpdateOptions>())
+            .Returns(subscription);
+
+        // Act
+        await _sut.Execute(context);
+
+        // Assert
+        await _stripeFacade.Received(1).UpdateSubscription(
+            "sub_123",
+            Arg.Is<SubscriptionUpdateOptions>(o =>
+                o.Items.Count == 1 &&
+                o.Items[0].Deleted == true));
+    }
+
+    #endregion
+
+    #region Update Options Tests
+
+    [Fact]
+    public async Task Execute_UpdateOptions_SetsProrationBehaviorToCreateProrations()
+    {
+        // Arrange
+        var context = CreateJobExecutionContext();
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_EnableReconcileAdditionalStorageJob).Returns(true);
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_ReconcileAdditionalStorageJobEnableLiveMode).Returns(true);
+
+        var subscription = CreateSubscription("sub_123", "storage-gb-monthly", quantity: 10);
+
+        _stripeFacade.ListSubscriptionsAutoPagingAsync(Arg.Any<SubscriptionListOptions>())
+            .Returns(AsyncEnumerable.Create(subscription));
+        _stripeFacade.UpdateSubscription(Arg.Any<string>(), Arg.Any<SubscriptionUpdateOptions>())
+            .Returns(subscription);
+
+        // Act
+        await _sut.Execute(context);
+
+        // Assert
+        await _stripeFacade.Received(1).UpdateSubscription(
+            "sub_123",
+            Arg.Is<SubscriptionUpdateOptions>(o => o.ProrationBehavior == StripeConstants.ProrationBehavior.CreateProrations));
+    }
+
+    [Fact]
+    public async Task Execute_UpdateOptions_SetsReconciledMetadata()
+    {
+        // Arrange
+        var context = CreateJobExecutionContext();
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_EnableReconcileAdditionalStorageJob).Returns(true);
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_ReconcileAdditionalStorageJobEnableLiveMode).Returns(true);
+
+        var subscription = CreateSubscription("sub_123", "storage-gb-monthly", quantity: 10);
+
+        _stripeFacade.ListSubscriptionsAutoPagingAsync(Arg.Any<SubscriptionListOptions>())
+            .Returns(AsyncEnumerable.Create(subscription));
+        _stripeFacade.UpdateSubscription(Arg.Any<string>(), Arg.Any<SubscriptionUpdateOptions>())
+            .Returns(subscription);
+
+        // Act
+        await _sut.Execute(context);
+
+        // Assert
+        await _stripeFacade.Received(1).UpdateSubscription(
+            "sub_123",
+            Arg.Is<SubscriptionUpdateOptions>(o =>
+                o.Metadata.ContainsKey(StripeConstants.MetadataKeys.StorageReconciled2025) &&
+                !string.IsNullOrEmpty(o.Metadata[StripeConstants.MetadataKeys.StorageReconciled2025])));
+    }
+
+    #endregion
+
+    #region Subscription Filtering Tests
+
+    [Fact]
+    public async Task Execute_SubscriptionWithNoItems_SkipsUpdate()
+    {
+        // Arrange
+        var context = CreateJobExecutionContext();
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_EnableReconcileAdditionalStorageJob).Returns(true);
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_ReconcileAdditionalStorageJobEnableLiveMode).Returns(true);
+
+        var subscription = new Subscription
+        {
+            Id = "sub_123",
+            Items = null
+        };
+
+        _stripeFacade.ListSubscriptionsAutoPagingAsync(Arg.Any<SubscriptionListOptions>())
+            .Returns(AsyncEnumerable.Create(subscription));
+
+        // Act
+        await _sut.Execute(context);
+
+        // Assert
+        await _stripeFacade.DidNotReceiveWithAnyArgs().UpdateSubscription(null!);
+    }
+
+    [Fact]
+    public async Task Execute_SubscriptionWithDifferentPriceId_SkipsUpdate()
+    {
+        // Arrange
+        var context = CreateJobExecutionContext();
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_EnableReconcileAdditionalStorageJob).Returns(true);
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_ReconcileAdditionalStorageJobEnableLiveMode).Returns(true);
+
+        var subscription = CreateSubscription("sub_123", "different-price-id", quantity: 10);
+
+        _stripeFacade.ListSubscriptionsAutoPagingAsync(Arg.Any<SubscriptionListOptions>())
+            .Returns(AsyncEnumerable.Create(subscription));
+
+        // Act
+        await _sut.Execute(context);
+
+        // Assert
+        await _stripeFacade.DidNotReceiveWithAnyArgs().UpdateSubscription(null!);
+    }
+
+    [Fact]
+    public async Task Execute_NullSubscription_SkipsProcessing()
+    {
+        // Arrange
+        var context = CreateJobExecutionContext();
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_EnableReconcileAdditionalStorageJob).Returns(true);
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_ReconcileAdditionalStorageJobEnableLiveMode).Returns(true);
+
+        _stripeFacade.ListSubscriptionsAutoPagingAsync(Arg.Any<SubscriptionListOptions>())
+            .Returns(AsyncEnumerable.Create<Subscription>(null!));
+
+        // Act
+        await _sut.Execute(context);
+
+        // Assert
+        await _stripeFacade.DidNotReceiveWithAnyArgs().UpdateSubscription(null!);
+    }
+
+    #endregion
+
+    #region Multiple Subscriptions Tests
+
+    [Fact]
+    public async Task Execute_MultipleSubscriptions_ProcessesAll()
+    {
+        // Arrange
+        var context = CreateJobExecutionContext();
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_EnableReconcileAdditionalStorageJob).Returns(true);
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_ReconcileAdditionalStorageJobEnableLiveMode).Returns(true);
+
+        var subscription1 = CreateSubscription("sub_1", "storage-gb-monthly", quantity: 10);
+        var subscription2 = CreateSubscription("sub_2", "storage-gb-monthly", quantity: 5);
+        var subscription3 = CreateSubscription("sub_3", "storage-gb-monthly", quantity: 3);
+
+        _stripeFacade.ListSubscriptionsAutoPagingAsync(Arg.Any<SubscriptionListOptions>())
+            .Returns(AsyncEnumerable.Create(subscription1, subscription2, subscription3));
+        _stripeFacade.UpdateSubscription(Arg.Any<string>(), Arg.Any<SubscriptionUpdateOptions>())
+            .Returns(callInfo => callInfo.Arg<string>() switch
+            {
+                "sub_1" => subscription1,
+                "sub_2" => subscription2,
+                "sub_3" => subscription3,
+                _ => null
+            });
+
+        // Act
+        await _sut.Execute(context);
+
+        // Assert
+        await _stripeFacade.Received(1).UpdateSubscription("sub_1", Arg.Any<SubscriptionUpdateOptions>());
+        await _stripeFacade.Received(1).UpdateSubscription("sub_2", Arg.Any<SubscriptionUpdateOptions>());
+        await _stripeFacade.Received(1).UpdateSubscription("sub_3", Arg.Any<SubscriptionUpdateOptions>());
+    }
+
+    [Fact]
+    public async Task Execute_MixedSubscriptionsWithProcessed_OnlyProcessesUnprocessed()
+    {
+        // Arrange
+        var context = CreateJobExecutionContext();
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_EnableReconcileAdditionalStorageJob).Returns(true);
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_ReconcileAdditionalStorageJobEnableLiveMode).Returns(true);
+
+        var processedMetadata = new Dictionary<string, string>
+        {
+            [StripeConstants.MetadataKeys.StorageReconciled2025] = DateTime.UtcNow.ToString("o")
+        };
+
+        var subscription1 = CreateSubscription("sub_1", "storage-gb-monthly", quantity: 10);
+        var subscription2 = CreateSubscription("sub_2", "storage-gb-monthly", quantity: 5, metadata: processedMetadata);
+        var subscription3 = CreateSubscription("sub_3", "storage-gb-monthly", quantity: 3);
+
+        _stripeFacade.ListSubscriptionsAutoPagingAsync(Arg.Any<SubscriptionListOptions>())
+            .Returns(AsyncEnumerable.Create(subscription1, subscription2, subscription3));
+        _stripeFacade.UpdateSubscription(Arg.Any<string>(), Arg.Any<SubscriptionUpdateOptions>())
+            .Returns(callInfo => callInfo.Arg<string>() switch
+            {
+                "sub_1" => subscription1,
+                "sub_3" => subscription3,
+                _ => null
+            });
+
+        // Act
+        await _sut.Execute(context);
+
+        // Assert
+        await _stripeFacade.Received(1).UpdateSubscription("sub_1", Arg.Any<SubscriptionUpdateOptions>());
+        await _stripeFacade.DidNotReceive().UpdateSubscription("sub_2", Arg.Any<SubscriptionUpdateOptions>());
+        await _stripeFacade.Received(1).UpdateSubscription("sub_3", Arg.Any<SubscriptionUpdateOptions>());
+    }
+
+    #endregion
+
+    #region Error Handling Tests
+
+    [Fact]
+    public async Task Execute_UpdateFails_ContinuesProcessingOthers()
+    {
+        // Arrange
+        var context = CreateJobExecutionContext();
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_EnableReconcileAdditionalStorageJob).Returns(true);
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_ReconcileAdditionalStorageJobEnableLiveMode).Returns(true);
+
+        var subscription1 = CreateSubscription("sub_1", "storage-gb-monthly", quantity: 10);
+        var subscription2 = CreateSubscription("sub_2", "storage-gb-monthly", quantity: 5);
+        var subscription3 = CreateSubscription("sub_3", "storage-gb-monthly", quantity: 3);
+
+        _stripeFacade.ListSubscriptionsAutoPagingAsync(Arg.Any<SubscriptionListOptions>())
+            .Returns(AsyncEnumerable.Create(subscription1, subscription2, subscription3));
+
+        _stripeFacade.UpdateSubscription("sub_1", Arg.Any<SubscriptionUpdateOptions>())
+            .Returns(subscription1);
+        _stripeFacade.UpdateSubscription("sub_2", Arg.Any<SubscriptionUpdateOptions>())
+            .Throws(new Exception("Stripe API error"));
+        _stripeFacade.UpdateSubscription("sub_3", Arg.Any<SubscriptionUpdateOptions>())
+            .Returns(subscription3);
+
+        // Act
+        await _sut.Execute(context);
+
+        // Assert
+        await _stripeFacade.Received(1).UpdateSubscription("sub_1", Arg.Any<SubscriptionUpdateOptions>());
+        await _stripeFacade.Received(1).UpdateSubscription("sub_2", Arg.Any<SubscriptionUpdateOptions>());
+        await _stripeFacade.Received(1).UpdateSubscription("sub_3", Arg.Any<SubscriptionUpdateOptions>());
+    }
+
+    [Fact]
+    public async Task Execute_UpdateFails_LogsError()
+    {
+        // Arrange
+        var context = CreateJobExecutionContext();
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_EnableReconcileAdditionalStorageJob).Returns(true);
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_ReconcileAdditionalStorageJobEnableLiveMode).Returns(true);
+
+        var subscription = CreateSubscription("sub_123", "storage-gb-monthly", quantity: 10);
+
+        _stripeFacade.ListSubscriptionsAutoPagingAsync(Arg.Any<SubscriptionListOptions>())
+            .Returns(AsyncEnumerable.Create(subscription));
+        _stripeFacade.UpdateSubscription(Arg.Any<string>(), Arg.Any<SubscriptionUpdateOptions>())
+            .Throws(new Exception("Stripe API error"));
+
+        // Act
+        await _sut.Execute(context);
+
+        // Assert
+        _logger.Received().Log(
+            LogLevel.Error,
+            Arg.Any<EventId>(),
+            Arg.Any<object>(),
+            Arg.Any<Exception>(),
+            Arg.Any<Func<object, Exception, string>>());
+    }
+
+    #endregion
+
+    #region Cancellation Tests
+
+    [Fact]
+    public async Task Execute_CancellationRequested_LogsWarningAndExits()
+    {
+        // Arrange
+        var cts = new CancellationTokenSource();
+        cts.Cancel(); // Cancel immediately
+        var context = CreateJobExecutionContext(cts.Token);
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_EnableReconcileAdditionalStorageJob).Returns(true);
+        _featureService.IsEnabled(FeatureFlagKeys.PM28265_ReconcileAdditionalStorageJobEnableLiveMode).Returns(true);
+
+        var subscription1 = CreateSubscription("sub_1", "storage-gb-monthly", quantity: 10);
+
+        _stripeFacade.ListSubscriptionsAutoPagingAsync(Arg.Any<SubscriptionListOptions>())
+            .Returns(AsyncEnumerable.Create(subscription1));
+
+        // Act
+        await _sut.Execute(context);
+
+        // Assert - Should not process any subscriptions due to immediate cancellation
+        await _stripeFacade.DidNotReceiveWithAnyArgs().UpdateSubscription(null);
+        _logger.Received().Log(
+            LogLevel.Warning,
+            Arg.Any<EventId>(),
+            Arg.Any<object>(),
+            Arg.Any<Exception>(),
+            Arg.Any<Func<object, Exception, string>>());
+    }
+
+    #endregion
+
+    #region Helper Methods
+
+    private static IJobExecutionContext CreateJobExecutionContext(CancellationToken cancellationToken = default)
+    {
+        var context = Substitute.For<IJobExecutionContext>();
+        context.CancellationToken.Returns(cancellationToken);
+        return context;
+    }
+
+    private static Subscription CreateSubscription(
+        string id,
+        string priceId,
+        long? quantity = null,
+        Dictionary<string, string>? metadata = null)
+    {
+        var price = new Price { Id = priceId };
+        var item = new SubscriptionItem
+        {
+            Id = $"si_{id}",
+            Price = price,
+            Quantity = quantity ?? 0
+        };
+
+        return new Subscription
+        {
+            Id = id,
+            Metadata = metadata,
+            Items = new StripeList<SubscriptionItem>
+            {
+                Data = new List<SubscriptionItem> { item }
+            }
+        };
+    }
+
+    #endregion
+}
+
+internal static class AsyncEnumerable
+{
+    public static async IAsyncEnumerable<T> Create<T>(params T[] items)
+    {
+        foreach (var item in items)
+        {
+            yield return item;
+        }
+        await Task.CompletedTask;
+    }
+
+    public static async IAsyncEnumerable<T> Empty<T>()
+    {
+        await Task.CompletedTask;
+        yield break;
+    }
+}

test/Billing.Test/Services/ProviderEventServiceTests.cs

@@ -9,7 +9,7 @@ using Bit.Core.Billing.Providers.Entities;
 using Bit.Core.Billing.Providers.Repositories;
 using Bit.Core.Enums;
 using Bit.Core.Repositories;
-using Bit.Core.Utilities;
+using Bit.Core.Test.Billing.Mocks;
 using NSubstitute;
 using Stripe;
 using Xunit;
@@ -237,7 +237,7 @@ public class ProviderEventServiceTests
 
         foreach (var providerPlan in providerPlans)
         {
-            _pricingClient.GetPlanOrThrow(providerPlan.PlanType).Returns(StaticStore.GetPlan(providerPlan.PlanType));
+            _pricingClient.GetPlanOrThrow(providerPlan.PlanType).Returns(MockPlans.Get(providerPlan.PlanType));
         }
 
         _providerPlanRepository.GetByProviderId(providerId).Returns(providerPlans);
@@ -246,8 +246,8 @@ public class ProviderEventServiceTests
         await _providerEventService.TryRecordInvoiceLineItems(stripeEvent);
 
         // Assert
-        var teamsPlan = StaticStore.GetPlan(PlanType.TeamsMonthly);
-        var enterprisePlan = StaticStore.GetPlan(PlanType.EnterpriseMonthly);
+        var teamsPlan = MockPlans.Get(PlanType.TeamsMonthly);
+        var enterprisePlan = MockPlans.Get(PlanType.EnterpriseMonthly);
 
         await _providerInvoiceItemRepository.Received(1).CreateAsync(Arg.Is<ProviderInvoiceItem>(
             options =>

test/Billing.Test/Services/SubscriptionUpdatedHandlerTests.cs

@@ -1,18 +1,17 @@
 using Bit.Billing.Constants;
 using Bit.Billing.Services;
 using Bit.Billing.Services.Implementations;
-using Bit.Core;
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.AdminConsole.Entities.Provider;
 using Bit.Core.AdminConsole.OrganizationFeatures.Organizations.Interfaces;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.AdminConsole.Services;
 using Bit.Core.Billing.Enums;
-using Bit.Core.Billing.Models.StaticStore.Plans;
 using Bit.Core.Billing.Pricing;
 using Bit.Core.OrganizationFeatures.OrganizationSponsorships.FamiliesForEnterprise.Interfaces;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
+using Bit.Core.Test.Billing.Mocks.Plans;
 using Microsoft.Extensions.Logging;
 using Newtonsoft.Json.Linq;
 using NSubstitute;
@@ -126,79 +125,6 @@ public class SubscriptionUpdatedHandlerTests
             Arg.Is<ITrigger>(t => t.Key.Name == $"cancel-trigger-{subscriptionId}"));
     }
 
-    [Fact]
-    public async Task
-        HandleAsync_UnpaidProviderSubscription_WithManualSuspensionViaMetadata_DisablesProviderAndSchedulesCancellation()
-    {
-        // Arrange
-        var providerId = Guid.NewGuid();
-        var subscriptionId = "sub_test123";
-
-        var previousSubscription = new Subscription
-        {
-            Id = subscriptionId,
-            Status = StripeSubscriptionStatus.Active,
-            Metadata = new Dictionary<string, string>
-            {
-                ["suspend_provider"] = null // This is the key part - metadata exists, but value is null
-            }
-        };
-
-        var currentSubscription = new Subscription
-        {
-            Id = subscriptionId,
-            Status = StripeSubscriptionStatus.Unpaid,
-            Items = new StripeList<SubscriptionItem>
-            {
-                Data =
-                [
-                    new SubscriptionItem { CurrentPeriodEnd = DateTime.UtcNow.AddDays(30) }
-                ]
-            },
-            Metadata = new Dictionary<string, string>
-            {
-                ["providerId"] = providerId.ToString(),
-                ["suspend_provider"] = "true" // Now has a value, indicating manual suspension
-            },
-            TestClock = null
-        };
-
-        var parsedEvent = new Event
-        {
-            Id = "evt_test123",
-            Type = HandledStripeWebhook.SubscriptionUpdated,
-            Data = new EventData
-            {
-                Object = currentSubscription,
-                PreviousAttributes = JObject.FromObject(previousSubscription)
-            }
-        };
-
-        var provider = new Provider { Id = providerId, Enabled = true };
-
-        _featureService.IsEnabled(FeatureFlagKeys.PM21821_ProviderPortalTakeover).Returns(true);
-        _stripeEventService.GetSubscription(parsedEvent, true, Arg.Any<List<string>>()).Returns(currentSubscription);
-        _stripeEventUtilityService.GetIdsFromMetadata(currentSubscription.Metadata)
-            .Returns(Tuple.Create<Guid?, Guid?, Guid?>(null, null, providerId));
-        _providerRepository.GetByIdAsync(providerId).Returns(provider);
-
-        // Act
-        await _sut.HandleAsync(parsedEvent);
-
-        // Assert
-        Assert.False(provider.Enabled);
-        await _providerService.Received(1).UpdateAsync(provider);
-
-        // Verify that UpdateSubscription was called with both CancelAt and the new metadata
-        await _stripeFacade.Received(1).UpdateSubscription(
-            subscriptionId,
-            Arg.Is<SubscriptionUpdateOptions>(options =>
-                options.CancelAt.HasValue &&
-                options.CancelAt.Value <= DateTime.UtcNow.AddDays(7).AddMinutes(1) &&
-                options.Metadata != null &&
-                options.Metadata.ContainsKey("suspended_provider_via_webhook_at")));
-    }
-
     [Fact]
     public async Task
         HandleAsync_UnpaidProviderSubscription_WithValidTransition_DisablesProviderAndSchedulesCancellation()
@@ -243,7 +169,6 @@ public class SubscriptionUpdatedHandlerTests
 
         var provider = new Provider { Id = providerId, Enabled = true };
 
-        _featureService.IsEnabled(FeatureFlagKeys.PM21821_ProviderPortalTakeover).Returns(true);
         _stripeEventService.GetSubscription(parsedEvent, true, Arg.Any<List<string>>()).Returns(currentSubscription);
         _stripeEventUtilityService.GetIdsFromMetadata(currentSubscription.Metadata)
             .Returns(Tuple.Create<Guid?, Guid?, Guid?>(null, null, providerId));
@@ -256,13 +181,12 @@ public class SubscriptionUpdatedHandlerTests
         Assert.False(provider.Enabled);
         await _providerService.Received(1).UpdateAsync(provider);
 
-        // Verify that UpdateSubscription was called with CancelAt but WITHOUT suspension metadata
+        // Verify that UpdateSubscription was called with CancelAt
         await _stripeFacade.Received(1).UpdateSubscription(
             subscriptionId,
             Arg.Is<SubscriptionUpdateOptions>(options =>
                 options.CancelAt.HasValue &&
-                options.CancelAt.Value <= DateTime.UtcNow.AddDays(7).AddMinutes(1) &&
-                (options.Metadata == null || !options.Metadata.ContainsKey("suspended_provider_via_webhook_at"))));
+                options.CancelAt.Value <= DateTime.UtcNow.AddDays(7).AddMinutes(1)));
     }
 
     [Fact]
@@ -306,9 +230,6 @@ public class SubscriptionUpdatedHandlerTests
         _stripeEventUtilityService.GetIdsFromMetadata(Arg.Any<Dictionary<string, string>>())
             .Returns(Tuple.Create<Guid?, Guid?, Guid?>(null, null, providerId));
 
-        _featureService.IsEnabled(FeatureFlagKeys.PM21821_ProviderPortalTakeover)
-            .Returns(true);
-
         _providerRepository.GetByIdAsync(providerId)
             .Returns(provider);
 
@@ -353,9 +274,6 @@ public class SubscriptionUpdatedHandlerTests
         _stripeEventUtilityService.GetIdsFromMetadata(Arg.Any<Dictionary<string, string>>())
             .Returns(Tuple.Create<Guid?, Guid?, Guid?>(null, null, providerId));
 
-        _featureService.IsEnabled(FeatureFlagKeys.PM21821_ProviderPortalTakeover)
-            .Returns(true);
-
         _providerRepository.GetByIdAsync(providerId)
             .Returns(provider);
 
@@ -401,9 +319,6 @@ public class SubscriptionUpdatedHandlerTests
         _stripeEventUtilityService.GetIdsFromMetadata(Arg.Any<Dictionary<string, string>>())
             .Returns(Tuple.Create<Guid?, Guid?, Guid?>(null, null, providerId));
 
-        _featureService.IsEnabled(FeatureFlagKeys.PM21821_ProviderPortalTakeover)
-            .Returns(true);
-
         _providerRepository.GetByIdAsync(providerId)
             .Returns(provider);
 
@@ -416,48 +331,6 @@ public class SubscriptionUpdatedHandlerTests
         await _stripeFacade.DidNotReceive().UpdateSubscription(Arg.Any<string>(), Arg.Any<SubscriptionUpdateOptions>());
     }
 
-    [Fact]
-    public async Task HandleAsync_UnpaidProviderSubscription_WhenFeatureFlagDisabled_DoesNothing()
-    {
-        // Arrange
-        var providerId = Guid.NewGuid();
-        var subscriptionId = "sub_123";
-        var currentPeriodEnd = DateTime.UtcNow.AddDays(30);
-
-        var subscription = new Subscription
-        {
-            Id = subscriptionId,
-            Status = StripeSubscriptionStatus.Unpaid,
-            Items = new StripeList<SubscriptionItem>
-            {
-                Data =
-                [
-                    new SubscriptionItem { CurrentPeriodEnd = currentPeriodEnd }
-                ]
-            },
-            Metadata = new Dictionary<string, string> { { "providerId", providerId.ToString() } },
-            LatestInvoice = new Invoice { BillingReason = "subscription_cycle" }
-        };
-
-        var parsedEvent = new Event { Data = new EventData() };
-
-        _stripeEventService.GetSubscription(Arg.Any<Event>(), Arg.Any<bool>(), Arg.Any<List<string>>())
-            .Returns(subscription);
-
-        _stripeEventUtilityService.GetIdsFromMetadata(Arg.Any<Dictionary<string, string>>())
-            .Returns(Tuple.Create<Guid?, Guid?, Guid?>(null, null, providerId));
-
-        _featureService.IsEnabled(FeatureFlagKeys.PM21821_ProviderPortalTakeover)
-            .Returns(false);
-
-        // Act
-        await _sut.HandleAsync(parsedEvent);
-
-        // Assert
-        await _providerRepository.DidNotReceive().GetByIdAsync(Arg.Any<Guid>());
-        await _providerService.DidNotReceive().UpdateAsync(Arg.Any<Provider>());
-    }
-
     [Fact]
     public async Task HandleAsync_UnpaidProviderSubscription_WhenProviderNotFound_DoesNothing()
     {
@@ -489,9 +362,6 @@ public class SubscriptionUpdatedHandlerTests
         _stripeEventUtilityService.GetIdsFromMetadata(Arg.Any<Dictionary<string, string>>())
             .Returns(Tuple.Create<Guid?, Guid?, Guid?>(null, null, providerId));
 
-        _featureService.IsEnabled(FeatureFlagKeys.PM21821_ProviderPortalTakeover)
-            .Returns(true);
-
         _providerRepository.GetByIdAsync(providerId)
             .Returns((Provider)null);
 
@@ -777,8 +647,6 @@ public class SubscriptionUpdatedHandlerTests
         _stripeFacade
             .UpdateSubscription(Arg.Any<string>(), Arg.Any<SubscriptionUpdateOptions>())
             .Returns(newSubscription);
-        _featureService.IsEnabled(FeatureFlagKeys.PM21821_ProviderPortalTakeover)
-            .Returns(true);
 
         // Act
         await _sut.HandleAsync(parsedEvent);
@@ -800,9 +668,6 @@ public class SubscriptionUpdatedHandlerTests
             .Received(1)
             .UpdateSubscription(newSubscription.Id,
                 Arg.Is<SubscriptionUpdateOptions>(options => options.CancelAtPeriodEnd == false));
-        _featureService
-            .Received(1)
-            .IsEnabled(FeatureFlagKeys.PM21821_ProviderPortalTakeover);
     }
 
     [Fact]
@@ -823,8 +688,6 @@ public class SubscriptionUpdatedHandlerTests
         _providerRepository
             .GetByIdAsync(Arg.Any<Guid>())
             .Returns(provider);
-        _featureService.IsEnabled(FeatureFlagKeys.PM21821_ProviderPortalTakeover)
-            .Returns(true);
 
         // Act
         await _sut.HandleAsync(parsedEvent);
@@ -843,9 +706,6 @@ public class SubscriptionUpdatedHandlerTests
         await _stripeFacade
             .DidNotReceiveWithAnyArgs()
             .UpdateSubscription(Arg.Any<string>());
-        _featureService
-            .Received(1)
-            .IsEnabled(FeatureFlagKeys.PM21821_ProviderPortalTakeover);
     }
 
     [Fact]
@@ -866,8 +726,6 @@ public class SubscriptionUpdatedHandlerTests
         _providerRepository
             .GetByIdAsync(Arg.Any<Guid>())
             .Returns(provider);
-        _featureService.IsEnabled(FeatureFlagKeys.PM21821_ProviderPortalTakeover)
-            .Returns(true);
 
         // Act
         await _sut.HandleAsync(parsedEvent);
@@ -886,9 +744,6 @@ public class SubscriptionUpdatedHandlerTests
         await _stripeFacade
             .DidNotReceiveWithAnyArgs()
             .UpdateSubscription(Arg.Any<string>());
-        _featureService
-            .Received(1)
-            .IsEnabled(FeatureFlagKeys.PM21821_ProviderPortalTakeover);
     }
 
     [Fact]
@@ -909,8 +764,6 @@ public class SubscriptionUpdatedHandlerTests
         _providerRepository
             .GetByIdAsync(Arg.Any<Guid>())
             .Returns(provider);
-        _featureService.IsEnabled(FeatureFlagKeys.PM21821_ProviderPortalTakeover)
-            .Returns(true);
 
         // Act
         await _sut.HandleAsync(parsedEvent);
@@ -929,9 +782,6 @@ public class SubscriptionUpdatedHandlerTests
         await _stripeFacade
             .DidNotReceiveWithAnyArgs()
             .UpdateSubscription(Arg.Any<string>());
-        _featureService
-            .Received(1)
-            .IsEnabled(FeatureFlagKeys.PM21821_ProviderPortalTakeover);
     }
 
     [Fact]
@@ -953,8 +803,6 @@ public class SubscriptionUpdatedHandlerTests
         _providerRepository
             .GetByIdAsync(Arg.Any<Guid>())
             .Returns(provider);
-        _featureService.IsEnabled(FeatureFlagKeys.PM21821_ProviderPortalTakeover)
-            .Returns(true);
 
         // Act
         await _sut.HandleAsync(parsedEvent);
@@ -975,9 +823,6 @@ public class SubscriptionUpdatedHandlerTests
         await _stripeFacade
             .DidNotReceiveWithAnyArgs()
             .UpdateSubscription(Arg.Any<string>());
-        _featureService
-            .Received(1)
-            .IsEnabled(FeatureFlagKeys.PM21821_ProviderPortalTakeover);
     }
 
     [Fact]
@@ -997,8 +842,6 @@ public class SubscriptionUpdatedHandlerTests
         _providerRepository
             .GetByIdAsync(Arg.Any<Guid>())
             .ReturnsNull();
-        _featureService.IsEnabled(FeatureFlagKeys.PM21821_ProviderPortalTakeover)
-            .Returns(true);
 
         // Act
         await _sut.HandleAsync(parsedEvent);
@@ -1019,9 +862,6 @@ public class SubscriptionUpdatedHandlerTests
         await _stripeFacade
             .DidNotReceive()
             .UpdateSubscription(Arg.Any<string>());
-        _featureService
-            .Received(1)
-            .IsEnabled(FeatureFlagKeys.PM21821_ProviderPortalTakeover);
     }
 
     [Fact]
@@ -1040,8 +880,6 @@ public class SubscriptionUpdatedHandlerTests
         _providerRepository
             .GetByIdAsync(Arg.Any<Guid>())
             .Returns(provider);
-        _featureService.IsEnabled(FeatureFlagKeys.PM21821_ProviderPortalTakeover)
-            .Returns(true);
 
         // Act
         await _sut.HandleAsync(parsedEvent);
@@ -1062,9 +900,6 @@ public class SubscriptionUpdatedHandlerTests
         await _stripeFacade
             .DidNotReceive()
             .UpdateSubscription(Arg.Any<string>());
-        _featureService
-            .Received(1)
-            .IsEnabled(FeatureFlagKeys.PM21821_ProviderPortalTakeover);
     }
 
     private static (Guid providerId, Subscription newSubscription, Provider provider, Event parsedEvent)

test/Core.IntegrationTest/Core.IntegrationTest.csproj

@@ -11,11 +11,11 @@
 
   <ItemGroup>
     <PackageReference Include="coverlet.collector" Version="6.0.4" />
-    <PackageReference Include="MartinCostello.Logging.XUnit" Version="0.5.1" />
+    <PackageReference Include="MartinCostello.Logging.XUnit" Version="0.7.0" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.8.0" />
     <PackageReference Include="Rnwood.SmtpServer" Version="3.1.0-ci0868" />
-    <PackageReference Include="xunit" Version="2.5.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="2.5.3" />
+    <PackageReference Include="xunit" Version="2.9.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
   </ItemGroup>
 
   <ItemGroup>

test/Core.Test/AdminConsole/AutoFixture/OrganizationFixtures.cs

@@ -1,6 +1,8 @@
-using System.Text.Json;
+using System.Reflection;
+using System.Text.Json;
 using AutoFixture;
 using AutoFixture.Kernel;
+using AutoFixture.Xunit2;
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.Auth.Enums;
 using Bit.Core.Auth.Models;
@@ -9,7 +11,7 @@ using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Models.Business;
 using Bit.Core.Models.Data;
-using Bit.Core.Utilities;
+using Bit.Core.Test.Billing.Mocks;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using Microsoft.AspNetCore.DataProtection;
@@ -20,12 +22,24 @@ public class OrganizationCustomization : ICustomization
 {
     public bool UseGroups { get; set; }
     public PlanType PlanType { get; set; }
+    public bool UseAutomaticUserConfirmation { get; set; }
+
+    public OrganizationCustomization()
+    {
+
+    }
+
+    public OrganizationCustomization(bool useAutomaticUserConfirmation, PlanType planType)
+    {
+        UseAutomaticUserConfirmation = useAutomaticUserConfirmation;
+        PlanType = planType;
+    }
 
     public void Customize(IFixture fixture)
     {
         var organizationId = Guid.NewGuid();
         var maxCollections = (short)new Random().Next(10, short.MaxValue);
-        var plan = StaticStore.Plans.FirstOrDefault(p => p.Type == PlanType);
+        var plan = MockPlans.Plans.FirstOrDefault(p => p.Type == PlanType);
         var seats = (short)new Random().Next(plan.PasswordManager.BaseSeats, plan.PasswordManager.MaxSeats ?? short.MaxValue);
         var smSeats = plan.SupportsSecretsManager
             ? (short?)new Random().Next(plan.SecretsManager.BaseSeats, plan.SecretsManager.MaxSeats ?? short.MaxValue)
@@ -37,7 +51,8 @@ public class OrganizationCustomization : ICustomization
             .With(o => o.UseGroups, UseGroups)
             .With(o => o.PlanType, PlanType)
             .With(o => o.Seats, seats)
-            .With(o => o.SmSeats, smSeats));
+            .With(o => o.SmSeats, smSeats)
+            .With(o => o.UseAutomaticUserConfirmation, UseAutomaticUserConfirmation));
 
         fixture.Customize<Collection>(composer =>
             composer
@@ -77,7 +92,7 @@ internal class PaidOrganization : ICustomization
     public PlanType CheckedPlanType { get; set; }
     public void Customize(IFixture fixture)
     {
-        var validUpgradePlans = StaticStore.Plans.Where(p => p.Type != PlanType.Free && p.LegacyYear == null).OrderBy(p => p.UpgradeSortOrder).Select(p => p.Type).ToList();
+        var validUpgradePlans = MockPlans.Plans.Where(p => p.Type != PlanType.Free && p.LegacyYear == null).OrderBy(p => p.UpgradeSortOrder).Select(p => p.Type).ToList();
         var lowestActivePaidPlan = validUpgradePlans.First();
         CheckedPlanType = CheckedPlanType.Equals(PlanType.Free) ? lowestActivePaidPlan : CheckedPlanType;
         validUpgradePlans.Remove(lowestActivePaidPlan);
@@ -105,7 +120,7 @@ internal class FreeOrganizationUpgrade : ICustomization
             .With(o => o.PlanType, PlanType.Free));
 
         var plansToIgnore = new List<PlanType> { PlanType.Free, PlanType.Custom };
-        var selectedPlan = StaticStore.Plans.Last(p => !plansToIgnore.Contains(p.Type) && !p.Disabled);
+        var selectedPlan = MockPlans.Plans.Last(p => !plansToIgnore.Contains(p.Type) && !p.Disabled);
 
         fixture.Customize<OrganizationUpgrade>(composer => composer
             .With(ou => ou.Plan, selectedPlan.Type)
@@ -153,7 +168,7 @@ public class SecretsManagerOrganizationCustomization : ICustomization
             .With(o => o.Id, organizationId)
             .With(o => o.UseSecretsManager, true)
             .With(o => o.PlanType, planType)
-            .With(o => o.Plan, StaticStore.GetPlan(planType).Name)
+            .With(o => o.Plan, MockPlans.Get(planType).Name)
             .With(o => o.MaxAutoscaleSmSeats, (int?)null)
             .With(o => o.MaxAutoscaleSmServiceAccounts, (int?)null));
     }
@@ -277,3 +292,9 @@ internal class EphemeralDataProtectionAutoDataAttribute : CustomAutoDataAttribut
     public EphemeralDataProtectionAutoDataAttribute() : base(new SutProviderCustomization(), new EphemeralDataProtectionCustomization())
     { }
 }
+
+internal class OrganizationAttribute(bool useAutomaticUserConfirmation = false, PlanType planType = PlanType.Free) : CustomizeAttribute
+{
+    public override ICustomization GetCustomization(ParameterInfo parameter) =>
+        new OrganizationCustomization(useAutomaticUserConfirmation, planType);
+}

test/Core.Test/AdminConsole/Models/Data/EventIntegrations/IntegrationTemplateContextTests.cs

@@ -2,8 +2,8 @@
 using System.Text.Json;
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.AdminConsole.Models.Data.EventIntegrations;
-using Bit.Core.Entities;
 using Bit.Core.Models.Data;
+using Bit.Core.Models.Data.Organizations.OrganizationUsers;
 using Bit.Test.Common.AutoFixture.Attributes;
 using Xunit;
 
@@ -21,7 +21,21 @@ public class IntegrationTemplateContextTests
     }
 
     [Theory, BitAutoData]
-    public void UserName_WhenUserIsSet_ReturnsName(EventMessage eventMessage, User user)
+    public void DateIso8601_ReturnsIso8601FormattedDate(EventMessage eventMessage)
+    {
+        var testDate = new DateTime(2025, 10, 27, 13, 30, 0, DateTimeKind.Utc);
+        eventMessage.Date = testDate;
+        var sut = new IntegrationTemplateContext(eventMessage);
+
+        var result = sut.DateIso8601;
+
+        Assert.Equal("2025-10-27T13:30:00.0000000Z", result);
+        // Verify it's valid ISO 8601
+        Assert.True(DateTime.TryParse(result, out _));
+    }
+
+    [Theory, BitAutoData]
+    public void UserName_WhenUserIsSet_ReturnsName(EventMessage eventMessage, OrganizationUserUserDetails user)
     {
         var sut = new IntegrationTemplateContext(eventMessage) { User = user };
 
@@ -37,7 +51,7 @@ public class IntegrationTemplateContextTests
     }
 
     [Theory, BitAutoData]
-    public void UserEmail_WhenUserIsSet_ReturnsEmail(EventMessage eventMessage, User user)
+    public void UserEmail_WhenUserIsSet_ReturnsEmail(EventMessage eventMessage, OrganizationUserUserDetails user)
     {
         var sut = new IntegrationTemplateContext(eventMessage) { User = user };
 
@@ -53,7 +67,23 @@ public class IntegrationTemplateContextTests
     }
 
     [Theory, BitAutoData]
-    public void ActingUserName_WhenActingUserIsSet_ReturnsName(EventMessage eventMessage, User actingUser)
+    public void UserType_WhenUserIsSet_ReturnsType(EventMessage eventMessage, OrganizationUserUserDetails user)
+    {
+        var sut = new IntegrationTemplateContext(eventMessage) { User = user };
+
+        Assert.Equal(user.Type, sut.UserType);
+    }
+
+    [Theory, BitAutoData]
+    public void UserType_WhenUserIsNull_ReturnsNull(EventMessage eventMessage)
+    {
+        var sut = new IntegrationTemplateContext(eventMessage) { User = null };
+
+        Assert.Null(sut.UserType);
+    }
+
+    [Theory, BitAutoData]
+    public void ActingUserName_WhenActingUserIsSet_ReturnsName(EventMessage eventMessage, OrganizationUserUserDetails actingUser)
     {
         var sut = new IntegrationTemplateContext(eventMessage) { ActingUser = actingUser };
 
@@ -69,7 +99,7 @@ public class IntegrationTemplateContextTests
     }
 
     [Theory, BitAutoData]
-    public void ActingUserEmail_WhenActingUserIsSet_ReturnsEmail(EventMessage eventMessage, User actingUser)
+    public void ActingUserEmail_WhenActingUserIsSet_ReturnsEmail(EventMessage eventMessage, OrganizationUserUserDetails actingUser)
     {
         var sut = new IntegrationTemplateContext(eventMessage) { ActingUser = actingUser };
 
@@ -84,6 +114,22 @@ public class IntegrationTemplateContextTests
         Assert.Null(sut.ActingUserEmail);
     }
 
+    [Theory, BitAutoData]
+    public void ActingUserType_WhenActingUserIsSet_ReturnsType(EventMessage eventMessage, OrganizationUserUserDetails actingUser)
+    {
+        var sut = new IntegrationTemplateContext(eventMessage) { ActingUser = actingUser };
+
+        Assert.Equal(actingUser.Type, sut.ActingUserType);
+    }
+
+    [Theory, BitAutoData]
+    public void ActingUserType_WhenActingUserIsNull_ReturnsNull(EventMessage eventMessage)
+    {
+        var sut = new IntegrationTemplateContext(eventMessage) { ActingUser = null };
+
+        Assert.Null(sut.ActingUserType);
+    }
+
     [Theory, BitAutoData]
     public void OrganizationName_WhenOrganizationIsSet_ReturnsDisplayName(EventMessage eventMessage, Organization organization)
     {
@@ -99,4 +145,20 @@ public class IntegrationTemplateContextTests
 
         Assert.Null(sut.OrganizationName);
     }
+
+    [Theory, BitAutoData]
+    public void GroupName_WhenGroupIsSet_ReturnsName(EventMessage eventMessage, Group group)
+    {
+        var sut = new IntegrationTemplateContext(eventMessage) { Group = group };
+
+        Assert.Equal(group.Name, sut.GroupName);
+    }
+
+    [Theory, BitAutoData]
+    public void GroupName_WhenGroupIsNull_ReturnsNull(EventMessage eventMessage)
+    {
+        var sut = new IntegrationTemplateContext(eventMessage) { Group = null };
+
+        Assert.Null(sut.GroupName);
+    }
 }

test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/AutoConfirmUsers/AutomaticallyConfirmOrganizationUsersValidatorTests.cs

@@ -0,0 +1,696 @@
+using Bit.Core.AdminConsole.Entities;
+using Bit.Core.AdminConsole.Enums;
+using Bit.Core.AdminConsole.Models.Data;
+using Bit.Core.AdminConsole.Models.Data.Organizations.Policies;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.AutoConfirmUser;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.DeleteClaimedAccount;
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies;
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
+using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.Auth.UserFeatures.TwoFactorAuth.Interfaces;
+using Bit.Core.Billing.Enums;
+using Bit.Core.Entities;
+using Bit.Core.Enums;
+using Bit.Core.Repositories;
+using Bit.Core.Test.AdminConsole.AutoFixture;
+using Bit.Core.Test.AutoFixture.OrganizationFixtures;
+using Bit.Core.Test.AutoFixture.OrganizationUserFixtures;
+using Bit.Test.Common.AutoFixture;
+using Bit.Test.Common.AutoFixture.Attributes;
+using NSubstitute;
+using Xunit;
+
+namespace Bit.Core.Test.AdminConsole.OrganizationFeatures.OrganizationUsers.AutoConfirmUsers;
+
+[SutProviderCustomize]
+public class AutomaticallyConfirmOrganizationUsersValidatorTests
+{
+    [Theory]
+    [BitAutoData]
+    public async Task ValidateAsync_WithNullOrganizationUser_ReturnsUserNotFoundError(
+        SutProvider<AutomaticallyConfirmOrganizationUsersValidator> sutProvider,
+        Organization organization)
+    {
+        // Arrange
+        var request = new AutomaticallyConfirmOrganizationUserValidationRequest
+        {
+            PerformedBy = Substitute.For<IActingUser>(),
+            DefaultUserCollectionName = "test-collection",
+            OrganizationUser = null,
+            OrganizationUserId = Guid.NewGuid(),
+            Organization = organization,
+            OrganizationId = organization.Id,
+            Key = "test-key"
+        };
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(request);
+
+        // Assert
+        Assert.True(result.IsError);
+        Assert.IsType<UserNotFoundError>(result.AsError);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task ValidateAsync_WithNullUserId_ReturnsUserNotFoundError(
+        SutProvider<AutomaticallyConfirmOrganizationUsersValidator> sutProvider,
+        Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser)
+    {
+        // Arrange
+        organizationUser.UserId = null;
+        organizationUser.OrganizationId = organization.Id;
+
+        var request = new AutomaticallyConfirmOrganizationUserValidationRequest
+        {
+            PerformedBy = Substitute.For<IActingUser>(),
+            DefaultUserCollectionName = "test-collection",
+            OrganizationUser = organizationUser,
+            OrganizationUserId = organizationUser.Id,
+            Organization = organization,
+            OrganizationId = organization.Id,
+            Key = "test-key"
+        };
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(request);
+
+        // Assert
+        Assert.True(result.IsError);
+        Assert.IsType<UserNotFoundError>(result.AsError);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task ValidateAsync_WithNullOrganization_ReturnsOrganizationNotFoundError(
+        SutProvider<AutomaticallyConfirmOrganizationUsersValidator> sutProvider,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser,
+        Guid userId)
+    {
+        // Arrange
+        organizationUser.UserId = userId;
+
+        var request = new AutomaticallyConfirmOrganizationUserValidationRequest
+        {
+            PerformedBy = Substitute.For<IActingUser>(),
+            DefaultUserCollectionName = "test-collection",
+            OrganizationUser = organizationUser,
+            OrganizationUserId = organizationUser.Id,
+            Organization = null,
+            OrganizationId = organizationUser.OrganizationId,
+            Key = "test-key"
+        };
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(request);
+
+        // Assert
+        Assert.True(result.IsError);
+        Assert.IsType<OrganizationNotFound>(result.AsError);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task ValidateAsync_WithValidAcceptedUser_ReturnsValidResult(
+        SutProvider<AutomaticallyConfirmOrganizationUsersValidator> sutProvider,
+        [Organization(useAutomaticUserConfirmation: true, planType: PlanType.EnterpriseAnnually)] Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser,
+        Guid userId,
+        [Policy(PolicyType.AutomaticUserConfirmation)] Policy autoConfirmPolicy)
+    {
+        // Arrange
+        organizationUser.UserId = userId;
+        organizationUser.OrganizationId = organization.Id;
+
+        var request = new AutomaticallyConfirmOrganizationUserValidationRequest
+        {
+            PerformedBy = Substitute.For<IActingUser>(),
+            DefaultUserCollectionName = "test-collection",
+            OrganizationUser = organizationUser,
+            OrganizationUserId = organizationUser.Id,
+            Organization = organization,
+            OrganizationId = organization.Id,
+            Key = "test-key"
+        };
+
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(organization.Id, PolicyType.AutomaticUserConfirmation)
+            .Returns(autoConfirmPolicy);
+
+        sutProvider.GetDependency<ITwoFactorIsEnabledQuery>()
+            .TwoFactorIsEnabledAsync(Arg.Any<IEnumerable<Guid>>())
+            .Returns([(userId, true)]);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByUserAsync(userId)
+            .Returns([organizationUser]);
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(request);
+
+        // Assert
+        Assert.True(result.IsValid);
+        Assert.Equal(request, result.Request);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task ValidateAsync_WithMismatchedOrganizationId_ReturnsOrganizationUserIdIsInvalidError(
+        SutProvider<AutomaticallyConfirmOrganizationUsersValidator> sutProvider,
+        Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser,
+        Guid userId)
+    {
+        // Arrange
+        organizationUser.UserId = userId;
+        organizationUser.OrganizationId = Guid.NewGuid(); // Different from organization.Id
+
+        var request = new AutomaticallyConfirmOrganizationUserValidationRequest
+        {
+            PerformedBy = Substitute.For<IActingUser>(),
+            DefaultUserCollectionName = "test-collection",
+            OrganizationUser = organizationUser,
+            OrganizationUserId = organizationUser.Id,
+            Organization = organization,
+            OrganizationId = organization.Id,
+            Key = "test-key"
+        };
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByUserAsync(userId)
+            .Returns([organizationUser]);
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(request);
+
+        // Assert
+        Assert.True(result.IsError);
+        Assert.IsType<OrganizationUserIdIsInvalid>(result.AsError);
+    }
+
+    [Theory]
+    [BitAutoData(OrganizationUserStatusType.Invited)]
+    [BitAutoData(OrganizationUserStatusType.Revoked)]
+    [BitAutoData(OrganizationUserStatusType.Confirmed)]
+    public async Task ValidateAsync_WithNotAcceptedStatus_ReturnsUserIsNotAcceptedError(
+        OrganizationUserStatusType statusType,
+        SutProvider<AutomaticallyConfirmOrganizationUsersValidator> sutProvider,
+        Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Revoked)] OrganizationUser organizationUser,
+        Guid userId)
+    {
+        // Arrange
+        organizationUser.UserId = userId;
+        organizationUser.OrganizationId = organization.Id;
+        organizationUser.Status = statusType;
+
+        var request = new AutomaticallyConfirmOrganizationUserValidationRequest
+        {
+            PerformedBy = Substitute.For<IActingUser>(),
+            DefaultUserCollectionName = "test-collection",
+            OrganizationUser = organizationUser,
+            OrganizationUserId = organizationUser.Id,
+            Organization = organization,
+            OrganizationId = organization.Id,
+            Key = "test-key"
+        };
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(request);
+
+        // Assert
+        Assert.True(result.IsError);
+        Assert.IsType<UserIsNotAccepted>(result.AsError);
+    }
+
+    [Theory]
+    [BitAutoData(OrganizationUserType.Owner)]
+    [BitAutoData(OrganizationUserType.Custom)]
+    [BitAutoData(OrganizationUserType.Admin)]
+    public async Task ValidateAsync_WithNonUserType_ReturnsUserIsNotUserTypeError(
+        OrganizationUserType userType,
+        SutProvider<AutomaticallyConfirmOrganizationUsersValidator> sutProvider,
+        Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser,
+        Guid userId)
+    {
+        // Arrange
+        organizationUser.UserId = userId;
+        organizationUser.OrganizationId = organization.Id;
+        organizationUser.Type = userType;
+
+        var request = new AutomaticallyConfirmOrganizationUserValidationRequest
+        {
+            PerformedBy = Substitute.For<IActingUser>(),
+            DefaultUserCollectionName = "test-collection",
+            OrganizationUser = organizationUser,
+            OrganizationUserId = organizationUser.Id,
+            Organization = organization,
+            OrganizationId = organization.Id,
+            Key = "test-key"
+        };
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(request);
+
+        // Assert
+        Assert.True(result.IsError);
+        Assert.IsType<UserIsNotUserType>(result.AsError);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task ValidateAsync_UserWithout2FA_And2FARequired_ReturnsError(
+        SutProvider<AutomaticallyConfirmOrganizationUsersValidator> sutProvider,
+        [Organization(useAutomaticUserConfirmation: true)] Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser,
+        Guid userId,
+        [Policy(PolicyType.AutomaticUserConfirmation)] Policy autoConfirmPolicy)
+    {
+        // Arrange
+        organizationUser.UserId = userId;
+        organizationUser.OrganizationId = organization.Id;
+
+        var request = new AutomaticallyConfirmOrganizationUserValidationRequest
+        {
+            PerformedBy = Substitute.For<IActingUser>(),
+            DefaultUserCollectionName = "test-collection",
+            OrganizationUser = organizationUser,
+            OrganizationUserId = organizationUser.Id,
+            Organization = organization,
+            OrganizationId = organization.Id,
+            Key = "test-key"
+        };
+
+        var twoFactorPolicyDetails = new PolicyDetails
+        {
+            OrganizationId = organization.Id,
+            PolicyType = PolicyType.TwoFactorAuthentication
+        };
+
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(organization.Id, PolicyType.AutomaticUserConfirmation)
+            .Returns(autoConfirmPolicy);
+
+        sutProvider.GetDependency<ITwoFactorIsEnabledQuery>()
+            .TwoFactorIsEnabledAsync(Arg.Any<IEnumerable<Guid>>())
+            .Returns([(userId, false)]);
+
+        sutProvider.GetDependency<IPolicyRequirementQuery>()
+            .GetAsync<RequireTwoFactorPolicyRequirement>(userId)
+            .Returns(new RequireTwoFactorPolicyRequirement([twoFactorPolicyDetails]));
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByUserAsync(userId)
+            .Returns([organizationUser]);
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(request);
+
+        // Assert
+        Assert.True(result.IsError);
+        Assert.IsType<UserDoesNotHaveTwoFactorEnabled>(result.AsError);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task ValidateAsync_UserWith2FA_ReturnsValidResult(
+        SutProvider<AutomaticallyConfirmOrganizationUsersValidator> sutProvider,
+        [Organization(useAutomaticUserConfirmation: true)] Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser,
+        Guid userId,
+        [Policy(PolicyType.AutomaticUserConfirmation)] Policy autoConfirmPolicy)
+    {
+        // Arrange
+        organizationUser.UserId = userId;
+        organizationUser.OrganizationId = organization.Id;
+
+        var request = new AutomaticallyConfirmOrganizationUserValidationRequest
+        {
+            PerformedBy = Substitute.For<IActingUser>(),
+            DefaultUserCollectionName = "test-collection",
+            OrganizationUser = organizationUser,
+            OrganizationUserId = organizationUser.Id,
+            Organization = organization,
+            OrganizationId = organization.Id,
+            Key = "test-key"
+        };
+
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(organization.Id, PolicyType.AutomaticUserConfirmation)
+            .Returns(autoConfirmPolicy);
+
+        sutProvider.GetDependency<ITwoFactorIsEnabledQuery>()
+            .TwoFactorIsEnabledAsync(Arg.Any<IEnumerable<Guid>>())
+            .Returns([(userId, true)]);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByUserAsync(userId)
+            .Returns([organizationUser]);
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(request);
+
+        // Assert
+        Assert.True(result.IsValid);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task ValidateAsync_UserWithout2FA_And2FANotRequired_ReturnsValidResult(
+        SutProvider<AutomaticallyConfirmOrganizationUsersValidator> sutProvider,
+        [Organization(useAutomaticUserConfirmation: true)] Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser,
+        Guid userId,
+        [Policy(PolicyType.AutomaticUserConfirmation)] Policy autoConfirmPolicy)
+    {
+        // Arrange
+        organizationUser.UserId = userId;
+        organizationUser.OrganizationId = organization.Id;
+
+        var request = new AutomaticallyConfirmOrganizationUserValidationRequest
+        {
+            PerformedBy = Substitute.For<IActingUser>(),
+            DefaultUserCollectionName = "test-collection",
+            OrganizationUser = organizationUser,
+            OrganizationUserId = organizationUser.Id,
+            Organization = organization,
+            OrganizationId = organization.Id,
+            Key = "test-key"
+        };
+
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(organization.Id, PolicyType.AutomaticUserConfirmation)
+            .Returns(autoConfirmPolicy);
+
+        sutProvider.GetDependency<ITwoFactorIsEnabledQuery>()
+            .TwoFactorIsEnabledAsync(Arg.Any<IEnumerable<Guid>>())
+            .Returns([(userId, false)]);
+
+        sutProvider.GetDependency<IPolicyRequirementQuery>()
+            .GetAsync<RequireTwoFactorPolicyRequirement>(userId)
+            .Returns(new RequireTwoFactorPolicyRequirement([])); // No 2FA policy
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByUserAsync(userId)
+            .Returns([organizationUser]);
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(request);
+
+        // Assert
+        Assert.True(result.IsValid);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task ValidateAsync_UserInMultipleOrgs_WithSingleOrgPolicyOnThisOrg_ReturnsError(
+        SutProvider<AutomaticallyConfirmOrganizationUsersValidator> sutProvider,
+        [Organization(useAutomaticUserConfirmation: true)] Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser,
+        OrganizationUser otherOrgUser,
+        Guid userId,
+        [Policy(PolicyType.AutomaticUserConfirmation)] Policy autoConfirmPolicy)
+    {
+        // Arrange
+        organizationUser.UserId = userId;
+        organizationUser.OrganizationId = organization.Id;
+
+        var request = new AutomaticallyConfirmOrganizationUserValidationRequest
+        {
+            PerformedBy = Substitute.For<IActingUser>(),
+            DefaultUserCollectionName = "test-collection",
+            OrganizationUser = organizationUser,
+            OrganizationUserId = organizationUser.Id,
+            Organization = organization,
+            OrganizationId = organization.Id,
+            Key = "test-key"
+        };
+
+        var singleOrgPolicyDetails = new PolicyDetails
+        {
+            OrganizationId = organization.Id,
+            PolicyType = PolicyType.SingleOrg
+        };
+
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(organization.Id, PolicyType.AutomaticUserConfirmation)
+            .Returns(autoConfirmPolicy);
+
+        sutProvider.GetDependency<ITwoFactorIsEnabledQuery>()
+            .TwoFactorIsEnabledAsync(Arg.Any<IEnumerable<Guid>>())
+            .Returns([(userId, true)]);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByUserAsync(userId)
+            .Returns([organizationUser, otherOrgUser]);
+
+        sutProvider.GetDependency<IPolicyRequirementQuery>()
+            .GetAsync<SingleOrganizationPolicyRequirement>(userId)
+            .Returns(new SingleOrganizationPolicyRequirement([singleOrgPolicyDetails]));
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(request);
+
+        // Assert
+        Assert.True(result.IsError);
+        Assert.IsType<OrganizationEnforcesSingleOrgPolicy>(result.AsError);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task ValidateAsync_UserInMultipleOrgs_WithSingleOrgPolicyOnOtherOrg_ReturnsError(
+        SutProvider<AutomaticallyConfirmOrganizationUsersValidator> sutProvider,
+        [Organization(useAutomaticUserConfirmation: true)] Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser,
+        OrganizationUser otherOrgUser,
+        Guid userId,
+        [Policy(PolicyType.AutomaticUserConfirmation)] Policy autoConfirmPolicy)
+    {
+        // Arrange
+        organizationUser.UserId = userId;
+        organizationUser.OrganizationId = organization.Id;
+
+        var request = new AutomaticallyConfirmOrganizationUserValidationRequest
+        {
+            PerformedBy = Substitute.For<IActingUser>(),
+            DefaultUserCollectionName = "test-collection",
+            OrganizationUser = organizationUser,
+            OrganizationUserId = organizationUser.Id,
+            Organization = organization,
+            OrganizationId = organization.Id,
+            Key = "test-key"
+        };
+
+        var otherOrgId = Guid.NewGuid(); // Different org
+        var singleOrgPolicyDetails = new PolicyDetails
+        {
+            OrganizationId = otherOrgId,
+            PolicyType = PolicyType.SingleOrg,
+        };
+
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(organization.Id, PolicyType.AutomaticUserConfirmation)
+            .Returns(autoConfirmPolicy);
+
+        sutProvider.GetDependency<ITwoFactorIsEnabledQuery>()
+            .TwoFactorIsEnabledAsync(Arg.Any<IEnumerable<Guid>>())
+            .Returns([(userId, true)]);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByUserAsync(userId)
+            .Returns([organizationUser, otherOrgUser]);
+
+        sutProvider.GetDependency<IPolicyRequirementQuery>()
+            .GetAsync<SingleOrganizationPolicyRequirement>(userId)
+            .Returns(new SingleOrganizationPolicyRequirement([singleOrgPolicyDetails]));
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(request);
+
+        // Assert
+        Assert.True(result.IsError);
+        Assert.IsType<OtherOrganizationEnforcesSingleOrgPolicy>(result.AsError);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task ValidateAsync_UserInSingleOrg_ReturnsValidResult(
+        SutProvider<AutomaticallyConfirmOrganizationUsersValidator> sutProvider,
+        [Organization(useAutomaticUserConfirmation: true)] Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser,
+        Guid userId,
+        [Policy(PolicyType.AutomaticUserConfirmation)] Policy autoConfirmPolicy)
+    {
+        // Arrange
+        organizationUser.UserId = userId;
+        organizationUser.OrganizationId = organization.Id;
+
+        var request = new AutomaticallyConfirmOrganizationUserValidationRequest
+        {
+            PerformedBy = Substitute.For<IActingUser>(),
+            DefaultUserCollectionName = "test-collection",
+            OrganizationUser = organizationUser,
+            OrganizationUserId = organizationUser.Id,
+            Organization = organization,
+            OrganizationId = organization.Id,
+            Key = "test-key"
+        };
+
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(organization.Id, PolicyType.AutomaticUserConfirmation)
+            .Returns(autoConfirmPolicy);
+
+        sutProvider.GetDependency<ITwoFactorIsEnabledQuery>()
+            .TwoFactorIsEnabledAsync(Arg.Any<IEnumerable<Guid>>())
+            .Returns([(userId, true)]);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByUserAsync(userId)
+            .Returns([organizationUser]); // Single org
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(request);
+
+        // Assert
+        Assert.True(result.IsValid);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task ValidateAsync_UserInMultipleOrgs_WithNoSingleOrgPolicy_ReturnsValidResult(
+        SutProvider<AutomaticallyConfirmOrganizationUsersValidator> sutProvider,
+        [Organization(useAutomaticUserConfirmation: true)] Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser,
+        OrganizationUser otherOrgUser,
+        Guid userId,
+        Policy autoConfirmPolicy)
+    {
+        // Arrange
+        organizationUser.UserId = userId;
+        organizationUser.OrganizationId = organization.Id;
+        autoConfirmPolicy.Type = PolicyType.AutomaticUserConfirmation;
+        autoConfirmPolicy.Enabled = true;
+
+        var request = new AutomaticallyConfirmOrganizationUserValidationRequest
+        {
+            PerformedBy = Substitute.For<IActingUser>(),
+            DefaultUserCollectionName = "test-collection",
+            OrganizationUser = organizationUser,
+            OrganizationUserId = organizationUser.Id,
+            Organization = organization,
+            OrganizationId = organization.Id,
+            Key = "test-key"
+        };
+
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(organization.Id, PolicyType.AutomaticUserConfirmation)
+            .Returns(autoConfirmPolicy);
+
+        sutProvider.GetDependency<ITwoFactorIsEnabledQuery>()
+            .TwoFactorIsEnabledAsync(Arg.Any<IEnumerable<Guid>>())
+            .Returns([(userId, true)]);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByUserAsync(userId)
+            .Returns([organizationUser, otherOrgUser]);
+
+        sutProvider.GetDependency<IPolicyRequirementQuery>()
+            .GetAsync<SingleOrganizationPolicyRequirement>(userId)
+            .Returns(new SingleOrganizationPolicyRequirement([]));
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(request);
+
+        // Assert
+        Assert.True(result.IsValid);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task ValidateAsync_WithAutoConfirmPolicyDisabled_ReturnsAutoConfirmPolicyNotEnabledError(
+        SutProvider<AutomaticallyConfirmOrganizationUsersValidator> sutProvider,
+        Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser,
+        Guid userId)
+    {
+        // Arrange
+        organizationUser.UserId = userId;
+        organizationUser.OrganizationId = organization.Id;
+
+        var request = new AutomaticallyConfirmOrganizationUserValidationRequest
+        {
+            PerformedBy = Substitute.For<IActingUser>(),
+            DefaultUserCollectionName = "test-collection",
+            OrganizationUser = organizationUser,
+            OrganizationUserId = organizationUser.Id,
+            Organization = organization,
+            OrganizationId = organization.Id,
+            Key = "test-key"
+        };
+
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(organization.Id, PolicyType.AutomaticUserConfirmation)
+            .Returns((Policy)null);
+
+        sutProvider.GetDependency<ITwoFactorIsEnabledQuery>()
+            .TwoFactorIsEnabledAsync(Arg.Any<IEnumerable<Guid>>())
+            .Returns([(userId, true)]);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByUserAsync(userId)
+            .Returns([organizationUser]);
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(request);
+
+        // Assert
+        Assert.True(result.IsError);
+        Assert.IsType<AutomaticallyConfirmUsersPolicyIsNotEnabled>(result.AsError);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task ValidateAsync_WithOrganizationUseAutomaticUserConfirmationDisabled_ReturnsAutoConfirmPolicyNotEnabledError(
+        SutProvider<AutomaticallyConfirmOrganizationUsersValidator> sutProvider,
+        [Organization(useAutomaticUserConfirmation: false)] Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser,
+        Guid userId,
+        [Policy(PolicyType.AutomaticUserConfirmation)] Policy autoConfirmPolicy)
+    {
+        // Arrange
+        organizationUser.UserId = userId;
+        organizationUser.OrganizationId = organization.Id;
+
+        var request = new AutomaticallyConfirmOrganizationUserValidationRequest
+        {
+            PerformedBy = Substitute.For<IActingUser>(),
+            DefaultUserCollectionName = "test-collection",
+            OrganizationUser = organizationUser,
+            OrganizationUserId = organizationUser.Id,
+            Organization = organization,
+            OrganizationId = organization.Id,
+            Key = "test-key"
+        };
+
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(organization.Id, PolicyType.AutomaticUserConfirmation)
+            .Returns(autoConfirmPolicy);
+
+        sutProvider.GetDependency<ITwoFactorIsEnabledQuery>()
+            .TwoFactorIsEnabledAsync(Arg.Any<IEnumerable<Guid>>())
+            .Returns([(userId, true)]);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByUserAsync(userId)
+            .Returns([organizationUser]);
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(request);
+
+        // Assert
+        Assert.True(result.IsError);
+        Assert.IsType<AutomaticallyConfirmUsersPolicyIsNotEnabled>(result.AsError);
+    }
+}

test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/AutoConfirmUsers/AutomaticallyConfirmUsersCommandTests.cs

@@ -0,0 +1,730 @@
+using Bit.Core.AdminConsole.Entities;
+using Bit.Core.AdminConsole.Models.Data;
+using Bit.Core.AdminConsole.Models.Data.Organizations.Policies;
+using Bit.Core.AdminConsole.Models.Data.OrganizationUsers;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.AutoConfirmUser;
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies;
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
+using Bit.Core.AdminConsole.Utilities.v2;
+using Bit.Core.AdminConsole.Utilities.v2.Validation;
+using Bit.Core.Entities;
+using Bit.Core.Enums;
+using Bit.Core.Models.Data;
+using Bit.Core.Platform.Push;
+using Bit.Core.Repositories;
+using Bit.Core.Services;
+using Bit.Core.Test.AutoFixture.OrganizationUserFixtures;
+using Bit.Test.Common.AutoFixture;
+using Bit.Test.Common.AutoFixture.Attributes;
+using Microsoft.Extensions.Logging;
+using NSubstitute;
+using NSubstitute.ExceptionExtensions;
+using Xunit;
+
+namespace Bit.Core.Test.AdminConsole.OrganizationFeatures.OrganizationUsers.AutoConfirmUsers;
+
+[SutProviderCustomize]
+public class AutomaticallyConfirmUsersCommandTests
+{
+    [Theory]
+    [BitAutoData]
+    public async Task AutomaticallyConfirmOrganizationUserAsync_WithValidRequest_ConfirmsUserSuccessfully(
+        SutProvider<AutomaticallyConfirmOrganizationUserCommand> sutProvider,
+        Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser,
+        User user,
+        Guid performingUserId,
+        string key,
+        string defaultCollectionName)
+    {
+        // Arrange
+        organizationUser.UserId = user.Id;
+        organizationUser.OrganizationId = organization.Id;
+
+        var request = new AutomaticallyConfirmOrganizationUserRequest
+        {
+            OrganizationUserId = organizationUser.Id,
+            OrganizationId = organization.Id,
+            Key = key,
+            DefaultUserCollectionName = defaultCollectionName,
+            PerformedBy = new StandardUser(performingUserId, true)
+        };
+
+        SetupRepositoryMocks(sutProvider, organizationUser, organization, user);
+        SetupValidatorMock(sutProvider, request, organizationUser, organization, true);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .ConfirmOrganizationUserAsync(Arg.Is<AcceptedOrganizationUserToConfirm>(o =>
+                o.OrganizationUserId == organizationUser.Id && o.Key == request.Key))
+            .Returns(true);
+
+        // Act
+        var result = await sutProvider.Sut.AutomaticallyConfirmOrganizationUserAsync(request);
+
+        // Assert
+        Assert.True(result.IsSuccess);
+
+        await sutProvider.GetDependency<IOrganizationUserRepository>()
+            .Received(1)
+            .ConfirmOrganizationUserAsync(Arg.Is<AcceptedOrganizationUserToConfirm>(o =>
+                o.OrganizationUserId == organizationUser.Id && o.Key == request.Key));
+
+        await AssertSuccessfulOperationsAsync(sutProvider, organizationUser, organization, user, key);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AutomaticallyConfirmOrganizationUserAsync_WithInvalidUserOrgId_ReturnsOrganizationUserIdIsInvalidError(
+        SutProvider<AutomaticallyConfirmOrganizationUserCommand> sutProvider,
+        Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser,
+        User user,
+        Guid performingUserId,
+        string key,
+        string defaultCollectionName)
+    {
+        // Arrange
+        organizationUser.UserId = user.Id;
+        organizationUser.OrganizationId = Guid.NewGuid(); // User belongs to another organization
+        var request = new AutomaticallyConfirmOrganizationUserRequest
+        {
+            OrganizationUserId = organizationUser.Id,
+            OrganizationId = organization.Id,
+            Key = key,
+            DefaultUserCollectionName = defaultCollectionName,
+            PerformedBy = new StandardUser(performingUserId, true)
+        };
+
+        SetupRepositoryMocks(sutProvider, organizationUser, organization, user);
+        SetupValidatorMock(sutProvider, request, organizationUser, organization, false, new OrganizationUserIdIsInvalid());
+
+        // Act
+        var result = await sutProvider.Sut.AutomaticallyConfirmOrganizationUserAsync(request);
+
+        // Assert
+        Assert.True(result.IsError);
+        Assert.IsType<OrganizationUserIdIsInvalid>(result.AsError);
+
+        await sutProvider.GetDependency<IOrganizationUserRepository>()
+            .DidNotReceive()
+            .ConfirmOrganizationUserAsync(Arg.Any<AcceptedOrganizationUserToConfirm>());
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AutomaticallyConfirmOrganizationUserAsync_WhenAlreadyConfirmed_ReturnsNoneSuccess(
+        SutProvider<AutomaticallyConfirmOrganizationUserCommand> sutProvider,
+        Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser,
+        User user,
+        Guid performingUserId,
+        string key,
+        string defaultCollectionName)
+    {
+        // Arrange
+        organizationUser.UserId = user.Id;
+        organizationUser.OrganizationId = organization.Id;
+        var request = new AutomaticallyConfirmOrganizationUserRequest
+        {
+            OrganizationUserId = organizationUser.Id,
+            OrganizationId = organization.Id,
+            Key = key,
+            DefaultUserCollectionName = defaultCollectionName,
+            PerformedBy = new StandardUser(performingUserId, true)
+        };
+
+        SetupRepositoryMocks(sutProvider, organizationUser, organization, user);
+        SetupValidatorMock(sutProvider, request, organizationUser, organization, true);
+
+        // Return false to indicate the user is already confirmed
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .ConfirmOrganizationUserAsync(Arg.Is<AcceptedOrganizationUserToConfirm>(x =>
+                x.OrganizationUserId == organizationUser.Id && x.Key == request.Key))
+            .Returns(false);
+
+        // Act
+        var result = await sutProvider.Sut.AutomaticallyConfirmOrganizationUserAsync(request);
+
+        // Assert
+        Assert.True(result.IsSuccess);
+
+        await sutProvider.GetDependency<IOrganizationUserRepository>()
+            .Received(1)
+            .ConfirmOrganizationUserAsync(Arg.Is<AcceptedOrganizationUserToConfirm>(x =>
+                x.OrganizationUserId == organizationUser.Id && x.Key == request.Key));
+
+        // Verify no side effects occurred
+        await sutProvider.GetDependency<IEventService>()
+            .DidNotReceive()
+            .LogOrganizationUserEventAsync(Arg.Any<OrganizationUser>(), Arg.Any<EventType>(), Arg.Any<DateTime?>());
+
+        await sutProvider.GetDependency<IPushNotificationService>()
+            .DidNotReceive()
+            .PushSyncOrgKeysAsync(Arg.Any<Guid>());
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AutomaticallyConfirmOrganizationUserAsync_WithDefaultCollectionEnabled_CreatesDefaultCollection(
+        SutProvider<AutomaticallyConfirmOrganizationUserCommand> sutProvider,
+        Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser,
+        User user,
+        Guid performingUserId,
+        string key,
+        string defaultCollectionName)
+    {
+        // Arrange
+        organizationUser.UserId = user.Id;
+        organizationUser.OrganizationId = organization.Id;
+        var request = new AutomaticallyConfirmOrganizationUserRequest
+        {
+            OrganizationUserId = organizationUser.Id,
+            OrganizationId = organization.Id,
+            Key = key,
+            DefaultUserCollectionName = defaultCollectionName, // Non-empty to trigger creation
+            PerformedBy = new StandardUser(performingUserId, true)
+        };
+
+        SetupRepositoryMocks(sutProvider, organizationUser, organization, user);
+        SetupValidatorMock(sutProvider, request, organizationUser, organization, true);
+        SetupPolicyRequirementMock(sutProvider, user.Id, organization.Id, true); // Policy requires collection
+
+        sutProvider.GetDependency<IOrganizationUserRepository>().ConfirmOrganizationUserAsync(
+                Arg.Is<AcceptedOrganizationUserToConfirm>(o =>
+                    o.OrganizationUserId == organizationUser.Id && o.Key == request.Key))
+            .Returns(true);
+
+        // Act
+        var result = await sutProvider.Sut.AutomaticallyConfirmOrganizationUserAsync(request);
+
+        // Assert
+        Assert.True(result.IsSuccess);
+
+        await sutProvider.GetDependency<ICollectionRepository>()
+            .Received(1)
+            .CreateAsync(
+                Arg.Is<Collection>(c =>
+                    c.OrganizationId == organization.Id &&
+                    c.Name == defaultCollectionName &&
+                    c.Type == CollectionType.DefaultUserCollection),
+                Arg.Is<IEnumerable<CollectionAccessSelection>>(groups => groups == null),
+                Arg.Is<IEnumerable<CollectionAccessSelection>>(access =>
+                    access.FirstOrDefault(x => x.Id == organizationUser.Id && x.Manage) != null));
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AutomaticallyConfirmOrganizationUserAsync_WithDefaultCollectionDisabled_DoesNotCreateCollection(
+        SutProvider<AutomaticallyConfirmOrganizationUserCommand> sutProvider,
+        Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser,
+        User user,
+        Guid performingUserId,
+        string key)
+    {
+        // Arrange
+        organizationUser.UserId = user.Id;
+        organizationUser.OrganizationId = organization.Id;
+        var request = new AutomaticallyConfirmOrganizationUserRequest
+        {
+            OrganizationUserId = organizationUser.Id,
+            OrganizationId = organization.Id,
+            Key = key,
+            DefaultUserCollectionName = string.Empty, // Empty, so the collection won't be created
+            PerformedBy = new StandardUser(performingUserId, true)
+        };
+
+        SetupRepositoryMocks(sutProvider, organizationUser, organization, user);
+        SetupValidatorMock(sutProvider, request, organizationUser, organization, true);
+        SetupPolicyRequirementMock(sutProvider, user.Id, organization.Id, false); // Policy doesn't require
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .ConfirmOrganizationUserAsync(Arg.Is<AcceptedOrganizationUserToConfirm>(o =>
+                o.OrganizationUserId == organizationUser.Id && o.Key == request.Key))
+            .Returns(true);
+
+        // Act
+        var result = await sutProvider.Sut.AutomaticallyConfirmOrganizationUserAsync(request);
+
+        // Assert
+        Assert.True(result.IsSuccess);
+
+        await sutProvider.GetDependency<ICollectionRepository>()
+            .DidNotReceive()
+            .CreateAsync(Arg.Any<Collection>(),
+                Arg.Any<IEnumerable<CollectionAccessSelection>>(),
+                Arg.Any<IEnumerable<CollectionAccessSelection>>());
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AutomaticallyConfirmOrganizationUserAsync_WhenCreateDefaultCollectionFails_LogsErrorButReturnsSuccess(
+        SutProvider<AutomaticallyConfirmOrganizationUserCommand> sutProvider,
+        Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser,
+        User user,
+        Guid performingUserId,
+        string key,
+        string defaultCollectionName)
+    {
+        // Arrange
+        organizationUser.UserId = user.Id;
+        organizationUser.OrganizationId = organization.Id;
+        var request = new AutomaticallyConfirmOrganizationUserRequest
+        {
+            OrganizationUserId = organizationUser.Id,
+            OrganizationId = organization.Id,
+            Key = key,
+            DefaultUserCollectionName = defaultCollectionName, // Non-empty to trigger creation
+            PerformedBy = new StandardUser(performingUserId, true)
+        };
+
+        SetupRepositoryMocks(sutProvider, organizationUser, organization, user);
+        SetupValidatorMock(sutProvider, request, organizationUser, organization, true);
+        SetupPolicyRequirementMock(sutProvider, user.Id, organization.Id, true);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .ConfirmOrganizationUserAsync(Arg.Is<AcceptedOrganizationUserToConfirm>(o =>
+                o.OrganizationUserId == organizationUser.Id && o.Key == request.Key)).Returns(true);
+
+        var collectionException = new Exception("Collection creation failed");
+        sutProvider.GetDependency<ICollectionRepository>()
+            .CreateAsync(Arg.Any<Collection>(),
+                Arg.Any<IEnumerable<CollectionAccessSelection>>(),
+                Arg.Any<IEnumerable<CollectionAccessSelection>>())
+            .ThrowsAsync(collectionException);
+
+        // Act
+        var result = await sutProvider.Sut.AutomaticallyConfirmOrganizationUserAsync(request);
+
+        // Assert - side effects are fire-and-forget, so command returns success even if collection creation fails
+        Assert.True(result.IsSuccess);
+
+        sutProvider.GetDependency<ILogger<AutomaticallyConfirmOrganizationUserCommand>>()
+            .Received(1)
+            .Log(
+                LogLevel.Error,
+                Arg.Any<EventId>(),
+                Arg.Is<object>(o => o.ToString()!.Contains("Failed to create default collection for user")),
+                collectionException,
+                Arg.Any<Func<object, Exception?, string>>());
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AutomaticallyConfirmOrganizationUserAsync_WhenEventLogFails_LogsErrorButReturnsSuccess(
+        SutProvider<AutomaticallyConfirmOrganizationUserCommand> sutProvider,
+        Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser,
+        User user,
+        Guid performingUserId,
+        string key,
+        string defaultCollectionName)
+    {
+        // Arrange
+        organizationUser.UserId = user.Id;
+        organizationUser.OrganizationId = organization.Id;
+        var request = new AutomaticallyConfirmOrganizationUserRequest
+        {
+            OrganizationUserId = organizationUser.Id,
+            OrganizationId = organization.Id,
+            Key = key,
+            DefaultUserCollectionName = defaultCollectionName,
+            PerformedBy = new StandardUser(performingUserId, true)
+        };
+
+        SetupRepositoryMocks(sutProvider, organizationUser, organization, user);
+        SetupValidatorMock(sutProvider, request, organizationUser, organization, true);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .ConfirmOrganizationUserAsync(Arg.Is<AcceptedOrganizationUserToConfirm>(o =>
+                o.OrganizationUserId == organizationUser.Id && o.Key == request.Key))
+            .Returns(true);
+
+        var eventException = new Exception("Event logging failed");
+        sutProvider.GetDependency<IEventService>()
+            .LogOrganizationUserEventAsync(Arg.Any<OrganizationUser>(),
+                EventType.OrganizationUser_AutomaticallyConfirmed,
+                Arg.Any<DateTime?>())
+            .ThrowsAsync(eventException);
+
+        // Act
+        var result = await sutProvider.Sut.AutomaticallyConfirmOrganizationUserAsync(request);
+
+        // Assert - side effects are fire-and-forget, so command returns success even if event log fails
+        Assert.True(result.IsSuccess);
+
+        sutProvider.GetDependency<ILogger<AutomaticallyConfirmOrganizationUserCommand>>()
+            .Received(1)
+            .Log(
+                LogLevel.Error,
+                Arg.Any<EventId>(),
+                Arg.Is<object>(o => o.ToString()!.Contains("Failed to log OrganizationUser_AutomaticallyConfirmed event")),
+                eventException,
+                Arg.Any<Func<object, Exception?, string>>());
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AutomaticallyConfirmOrganizationUserAsync_WhenSendEmailFails_LogsErrorButReturnsSuccess(
+        SutProvider<AutomaticallyConfirmOrganizationUserCommand> sutProvider,
+        Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser,
+        User user,
+        Guid performingUserId,
+        string key,
+        string defaultCollectionName)
+    {
+        // Arrange
+        organizationUser.UserId = user.Id;
+        organizationUser.OrganizationId = organization.Id;
+        var request = new AutomaticallyConfirmOrganizationUserRequest
+        {
+            OrganizationUserId = organizationUser.Id,
+            OrganizationId = organization.Id,
+            Key = key,
+            DefaultUserCollectionName = defaultCollectionName,
+            PerformedBy = new StandardUser(performingUserId, true)
+        };
+
+        SetupRepositoryMocks(sutProvider, organizationUser, organization, user);
+        SetupValidatorMock(sutProvider, request, organizationUser, organization, true);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .ConfirmOrganizationUserAsync(Arg.Is<AcceptedOrganizationUserToConfirm>(o =>
+                o.OrganizationUserId == organizationUser.Id && o.Key == request.Key))
+            .Returns(true);
+
+        var emailException = new Exception("Email sending failed");
+        sutProvider.GetDependency<IMailService>()
+            .SendOrganizationConfirmedEmailAsync(organization.Name, user.Email, organizationUser.AccessSecretsManager)
+            .ThrowsAsync(emailException);
+
+        // Act
+        var result = await sutProvider.Sut.AutomaticallyConfirmOrganizationUserAsync(request);
+
+        // Assert - side effects are fire-and-forget, so command returns success even if email fails
+        Assert.True(result.IsSuccess);
+
+        sutProvider.GetDependency<ILogger<AutomaticallyConfirmOrganizationUserCommand>>()
+            .Received(1)
+            .Log(
+                LogLevel.Error,
+                Arg.Any<EventId>(),
+                Arg.Is<object>(o => o.ToString()!.Contains("Failed to send OrganizationUserConfirmed")),
+                emailException,
+                Arg.Any<Func<object, Exception?, string>>());
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AutomaticallyConfirmOrganizationUserAsync_WhenUserNotFoundForEmail_LogsErrorButReturnsSuccess(
+        SutProvider<AutomaticallyConfirmOrganizationUserCommand> sutProvider,
+        Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser,
+        User user,
+        Guid performingUserId,
+        string key,
+        string defaultCollectionName)
+    {
+        // Arrange
+        organizationUser.UserId = user.Id;
+        organizationUser.OrganizationId = organization.Id;
+        var request = new AutomaticallyConfirmOrganizationUserRequest
+        {
+            OrganizationUserId = organizationUser.Id,
+            OrganizationId = organization.Id,
+            Key = key,
+            DefaultUserCollectionName = defaultCollectionName,
+            PerformedBy = new StandardUser(performingUserId, true)
+        };
+
+        SetupRepositoryMocks(sutProvider, organizationUser, organization, user);
+        SetupValidatorMock(sutProvider, request, organizationUser, organization, true);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .ConfirmOrganizationUserAsync(Arg.Is<AcceptedOrganizationUserToConfirm>(o =>
+                o.OrganizationUserId == organizationUser.Id && o.Key == request.Key))
+            .Returns(true);
+
+        // Return null when retrieving user for email
+        sutProvider.GetDependency<IUserRepository>()
+            .GetByIdAsync(user.Id)
+            .Returns((User)null!);
+
+        // Act
+        var result = await sutProvider.Sut.AutomaticallyConfirmOrganizationUserAsync(request);
+
+        // Assert - side effects are fire-and-forget, so command returns success even if user not found for email
+        Assert.True(result.IsSuccess);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AutomaticallyConfirmOrganizationUserAsync_WhenDeleteDeviceRegistrationFails_LogsErrorButReturnsSuccess(
+        SutProvider<AutomaticallyConfirmOrganizationUserCommand> sutProvider,
+        Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser,
+        User user,
+        Guid performingUserId,
+        string key,
+        string defaultCollectionName,
+        Device device)
+    {
+        // Arrange
+        organizationUser.UserId = user.Id;
+        organizationUser.OrganizationId = organization.Id;
+        device.UserId = user.Id;
+        device.PushToken = "test-push-token";
+        var request = new AutomaticallyConfirmOrganizationUserRequest
+        {
+            OrganizationUserId = organizationUser.Id,
+            OrganizationId = organization.Id,
+            Key = key,
+            DefaultUserCollectionName = defaultCollectionName,
+            PerformedBy = new StandardUser(performingUserId, true)
+        };
+
+        SetupRepositoryMocks(sutProvider, organizationUser, organization, user);
+        SetupValidatorMock(sutProvider, request, organizationUser, organization, true);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .ConfirmOrganizationUserAsync(Arg.Is<AcceptedOrganizationUserToConfirm>(o =>
+                o.OrganizationUserId == organizationUser.Id && o.Key == request.Key))
+            .Returns(true);
+
+        sutProvider.GetDependency<IDeviceRepository>()
+            .GetManyByUserIdAsync(user.Id)
+            .Returns(new List<Device> { device });
+
+        var deviceException = new Exception("Device registration deletion failed");
+        sutProvider.GetDependency<IPushRegistrationService>()
+            .DeleteUserRegistrationOrganizationAsync(Arg.Any<IEnumerable<string>>(), organization.Id.ToString())
+            .ThrowsAsync(deviceException);
+
+        // Act
+        var result = await sutProvider.Sut.AutomaticallyConfirmOrganizationUserAsync(request);
+
+        // Assert - side effects are fire-and-forget, so command returns success even if device registration deletion fails
+        Assert.True(result.IsSuccess);
+
+        sutProvider.GetDependency<ILogger<AutomaticallyConfirmOrganizationUserCommand>>()
+            .Received(1)
+            .Log(
+                LogLevel.Error,
+                Arg.Any<EventId>(),
+                Arg.Is<object>(o => o.ToString()!.Contains("Failed to delete device registration")),
+                deviceException,
+                Arg.Any<Func<object, Exception?, string>>());
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AutomaticallyConfirmOrganizationUserAsync_WhenPushSyncOrgKeysFails_LogsErrorButReturnsSuccess(
+        SutProvider<AutomaticallyConfirmOrganizationUserCommand> sutProvider,
+        Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser,
+        User user,
+        Guid performingUserId,
+        string key,
+        string defaultCollectionName)
+    {
+        // Arrange
+        organizationUser.UserId = user.Id;
+        organizationUser.OrganizationId = organization.Id;
+        var request = new AutomaticallyConfirmOrganizationUserRequest
+        {
+            OrganizationUserId = organizationUser.Id,
+            OrganizationId = organization.Id,
+            Key = key,
+            DefaultUserCollectionName = defaultCollectionName,
+            PerformedBy = new StandardUser(performingUserId, true)
+        };
+
+        SetupRepositoryMocks(sutProvider, organizationUser, organization, user);
+        SetupValidatorMock(sutProvider, request, organizationUser, organization, true);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .ConfirmOrganizationUserAsync(Arg.Is<AcceptedOrganizationUserToConfirm>(o =>
+                o.OrganizationUserId == organizationUser.Id && o.Key == request.Key))
+            .Returns(true);
+
+        var pushException = new Exception("Push sync failed");
+        sutProvider.GetDependency<IPushNotificationService>()
+            .PushSyncOrgKeysAsync(user.Id)
+            .ThrowsAsync(pushException);
+
+        // Act
+        var result = await sutProvider.Sut.AutomaticallyConfirmOrganizationUserAsync(request);
+
+        // Assert - side effects are fire-and-forget, so command returns success even if push sync fails
+        Assert.True(result.IsSuccess);
+
+        sutProvider.GetDependency<ILogger<AutomaticallyConfirmOrganizationUserCommand>>()
+            .Received(1)
+            .Log(
+                LogLevel.Error,
+                Arg.Any<EventId>(),
+                Arg.Is<object>(o => o.ToString()!.Contains("Failed to push organization keys")),
+                pushException,
+                Arg.Any<Func<object, Exception?, string>>());
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AutomaticallyConfirmOrganizationUserAsync_WithDevicesWithoutPushToken_FiltersCorrectly(
+        SutProvider<AutomaticallyConfirmOrganizationUserCommand> sutProvider,
+        Organization organization,
+        [OrganizationUser(OrganizationUserStatusType.Accepted)] OrganizationUser organizationUser,
+        User user,
+        Guid performingUserId,
+        string key,
+        string defaultCollectionName,
+        Device deviceWithToken,
+        Device deviceWithoutToken)
+    {
+        // Arrange
+        organizationUser.UserId = user.Id;
+        organizationUser.OrganizationId = organization.Id;
+        deviceWithToken.UserId = user.Id;
+        deviceWithToken.PushToken = "test-token";
+        deviceWithoutToken.UserId = user.Id;
+        deviceWithoutToken.PushToken = null;
+        var request = new AutomaticallyConfirmOrganizationUserRequest
+        {
+            OrganizationUserId = organizationUser.Id,
+            OrganizationId = organization.Id,
+            Key = key,
+            DefaultUserCollectionName = defaultCollectionName,
+            PerformedBy = new StandardUser(performingUserId, true)
+        };
+
+        SetupRepositoryMocks(sutProvider, organizationUser, organization, user);
+        SetupValidatorMock(sutProvider, request, organizationUser, organization, true);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .ConfirmOrganizationUserAsync(Arg.Is<AcceptedOrganizationUserToConfirm>(o =>
+                o.OrganizationUserId == organizationUser.Id && o.Key == request.Key))
+            .Returns(true);
+
+        sutProvider.GetDependency<IDeviceRepository>()
+            .GetManyByUserIdAsync(user.Id)
+            .Returns(new List<Device> { deviceWithToken, deviceWithoutToken });
+
+        // Act
+        var result = await sutProvider.Sut.AutomaticallyConfirmOrganizationUserAsync(request);
+
+        // Assert
+        Assert.True(result.IsSuccess);
+
+        await sutProvider.GetDependency<IPushRegistrationService>()
+            .Received(1)
+            .DeleteUserRegistrationOrganizationAsync(
+                Arg.Is<IEnumerable<string>>(devices =>
+                    devices.Count(d => deviceWithToken.Id.ToString() == d) == 1),
+                organization.Id.ToString());
+    }
+
+    private static void SetupRepositoryMocks(
+        SutProvider<AutomaticallyConfirmOrganizationUserCommand> sutProvider,
+        OrganizationUser organizationUser,
+        Organization organization,
+        User user)
+    {
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByIdAsync(organizationUser.Id)
+            .Returns(organizationUser);
+
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdAsync(organization.Id)
+            .Returns(organization);
+
+        sutProvider.GetDependency<IUserRepository>()
+            .GetByIdAsync(user.Id)
+            .Returns(user);
+
+        sutProvider.GetDependency<IDeviceRepository>()
+            .GetManyByUserIdAsync(user.Id)
+            .Returns(new List<Device>());
+    }
+
+    private static void SetupValidatorMock(
+        SutProvider<AutomaticallyConfirmOrganizationUserCommand> sutProvider,
+        AutomaticallyConfirmOrganizationUserRequest originalRequest,
+        OrganizationUser organizationUser,
+        Organization organization,
+        bool isValid,
+        Error? error = null)
+    {
+        var validationRequest = new AutomaticallyConfirmOrganizationUserValidationRequest
+        {
+            PerformedBy = originalRequest.PerformedBy,
+            DefaultUserCollectionName = originalRequest.DefaultUserCollectionName,
+            OrganizationUserId = originalRequest.OrganizationUserId,
+            OrganizationUser = organizationUser,
+            OrganizationId = originalRequest.OrganizationId,
+            Organization = organization,
+            Key = originalRequest.Key
+        };
+
+        var validationResult = isValid
+            ? ValidationResultHelpers.Valid(validationRequest)
+            : ValidationResultHelpers.Invalid(validationRequest, error ?? new UserIsNotAccepted());
+
+        sutProvider.GetDependency<IAutomaticallyConfirmOrganizationUsersValidator>()
+            .ValidateAsync(Arg.Any<AutomaticallyConfirmOrganizationUserValidationRequest>())
+            .Returns(validationResult);
+    }
+
+    private static void SetupPolicyRequirementMock(
+        SutProvider<AutomaticallyConfirmOrganizationUserCommand> sutProvider,
+        Guid userId,
+        Guid organizationId,
+        bool requiresDefaultCollection)
+    {
+        var policyDetails = requiresDefaultCollection
+            ? new List<PolicyDetails> { new() { OrganizationId = organizationId } }
+            : new List<PolicyDetails>();
+
+        var policyRequirement = new OrganizationDataOwnershipPolicyRequirement(
+            requiresDefaultCollection ? OrganizationDataOwnershipState.Enabled : OrganizationDataOwnershipState.Disabled,
+            policyDetails);
+
+        sutProvider.GetDependency<IPolicyRequirementQuery>()
+            .GetAsync<OrganizationDataOwnershipPolicyRequirement>(userId)
+            .Returns(policyRequirement);
+    }
+
+    private static async Task AssertSuccessfulOperationsAsync(
+        SutProvider<AutomaticallyConfirmOrganizationUserCommand> sutProvider,
+        OrganizationUser organizationUser,
+        Organization organization,
+        User user,
+        string key)
+    {
+        await sutProvider.GetDependency<IEventService>()
+            .Received(1)
+            .LogOrganizationUserEventAsync(
+                Arg.Is<OrganizationUser>(x => x.Id == organizationUser.Id),
+                EventType.OrganizationUser_AutomaticallyConfirmed,
+                Arg.Any<DateTime?>());
+
+        await sutProvider.GetDependency<IMailService>()
+            .Received(1)
+            .SendOrganizationConfirmedEmailAsync(
+                organization.Name,
+                user.Email,
+                organizationUser.AccessSecretsManager);
+
+        await sutProvider.GetDependency<IPushNotificationService>()
+            .Received(1)
+            .PushSyncOrgKeysAsync(user.Id);
+
+        await sutProvider.GetDependency<IPushRegistrationService>()
+            .Received(1)
+            .DeleteUserRegistrationOrganizationAsync(
+                Arg.Any<IEnumerable<string>>(),
+                organization.Id.ToString());
+    }
+}

test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/ConfirmOrganizationUserCommandTests.cs

@@ -97,6 +97,8 @@ public class ConfirmOrganizationUserCommandTests
     [BitAutoData(PlanType.EnterpriseMonthly2019, OrganizationUserType.Owner)]
     [BitAutoData(PlanType.FamiliesAnnually, OrganizationUserType.Admin)]
     [BitAutoData(PlanType.FamiliesAnnually, OrganizationUserType.Owner)]
+    [BitAutoData(PlanType.FamiliesAnnually2025, OrganizationUserType.Admin)]
+    [BitAutoData(PlanType.FamiliesAnnually2025, OrganizationUserType.Owner)]
     [BitAutoData(PlanType.FamiliesAnnually2019, OrganizationUserType.Admin)]
     [BitAutoData(PlanType.FamiliesAnnually2019, OrganizationUserType.Owner)]
     [BitAutoData(PlanType.TeamsAnnually, OrganizationUserType.Admin)]

test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/DeleteClaimedAccountvNext/DeleteClaimedOrganizationUserAccountCommandTests.cs

@@ -1,5 +1,7 @@
 using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.DeleteClaimedAccount;
 using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
+using Bit.Core.AdminConsole.Utilities.v2;
+using Bit.Core.AdminConsole.Utilities.v2.Validation;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;

test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/InviteUsers/InviteOrganizationUserCommandTests.cs

@@ -13,7 +13,6 @@ using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.AdminConsole.Utilities.Commands;
 using Bit.Core.AdminConsole.Utilities.Errors;
 using Bit.Core.AdminConsole.Utilities.Validation;
-using Bit.Core.Billing.Models.StaticStore.Plans;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Models.Business;
@@ -22,6 +21,7 @@ using Bit.Core.Models.Data.Organizations.OrganizationUsers;
 using Bit.Core.OrganizationFeatures.OrganizationSubscriptions.Interface;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
+using Bit.Core.Test.Billing.Mocks.Plans;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using Microsoft.Extensions.Time.Testing;
@@ -29,6 +29,7 @@ using NSubstitute;
 using NSubstitute.ExceptionExtensions;
 using Xunit;
 using static Bit.Core.Test.AdminConsole.OrganizationFeatures.OrganizationUsers.InviteUsers.Helpers.InviteUserOrganizationValidationRequestHelpers;
+using Enterprise2019Plan = Bit.Core.Test.Billing.Mocks.Plans.Enterprise2019Plan;
 
 namespace Bit.Core.Test.AdminConsole.OrganizationFeatures.OrganizationUsers.InviteUsers;
 

test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/InviteUsers/Validation/InviteOrganizationUsersValidatorTests.cs

@@ -3,12 +3,12 @@ using Bit.Core.AdminConsole.Models.Business;
 using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.InviteUsers.Models;
 using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.InviteUsers.Validation;
 using Bit.Core.AdminConsole.Utilities.Validation;
-using Bit.Core.Billing.Models.StaticStore.Plans;
 using Bit.Core.Exceptions;
 using Bit.Core.Models.Business;
 using Bit.Core.OrganizationFeatures.OrganizationSubscriptions.Interface;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
+using Bit.Core.Test.Billing.Mocks.Plans;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using NSubstitute;

test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/InviteUsers/Validation/InviteUserOrganizationValidationTests.cs

@@ -2,7 +2,7 @@
 using Bit.Core.AdminConsole.Models.Business;
 using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.InviteUsers.Validation.Organization;
 using Bit.Core.AdminConsole.Utilities.Validation;
-using Bit.Core.Billing.Models.StaticStore.Plans;
+using Bit.Core.Test.Billing.Mocks.Plans;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using Xunit;

test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/InviteUsers/Validation/InviteUserPaymentValidationTests.cs

@@ -5,7 +5,7 @@ using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.InviteUsers.V
 using Bit.Core.AdminConsole.Utilities.Validation;
 using Bit.Core.Billing.Constants;
 using Bit.Core.Billing.Enums;
-using Bit.Core.Billing.Models.StaticStore.Plans;
+using Bit.Core.Test.Billing.Mocks.Plans;
 using Bit.Test.Common.AutoFixture.Attributes;
 using Xunit;
 

test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/InviteUsers/Validation/PasswordManagerInviteUserValidatorTests.cs

@@ -3,7 +3,7 @@ using Bit.Core.AdminConsole.Models.Business;
 using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.InviteUsers.Validation.PasswordManager;
 using Bit.Core.AdminConsole.Utilities.Validation;
 using Bit.Core.Billing.Enums;
-using Bit.Core.Billing.Models.StaticStore.Plans;
+using Bit.Core.Test.Billing.Mocks.Plans;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using Xunit;

test/Core.Test/AdminConsole/OrganizationFeatures/Organizations/GetOrganizationSubscriptionsToUpdateQueryTests.cs

@@ -1,9 +1,9 @@
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.AdminConsole.OrganizationFeatures.Organizations;
 using Bit.Core.Billing.Enums;
-using Bit.Core.Billing.Models.StaticStore.Plans;
 using Bit.Core.Billing.Pricing;
 using Bit.Core.Repositories;
+using Bit.Core.Test.Billing.Mocks.Plans;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using NSubstitute;

test/Core.Test/AdminConsole/OrganizationFeatures/Organizations/OrganizationSignUp/CloudOrganizationSignUpCommandTests.cs

@@ -10,7 +10,7 @@ using Bit.Core.Exceptions;
 using Bit.Core.Models.Business;
 using Bit.Core.Models.Data;
 using Bit.Core.Repositories;
-using Bit.Core.Utilities;
+using Bit.Core.Test.Billing.Mocks;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using NSubstitute;
@@ -23,11 +23,12 @@ public class CloudICloudOrganizationSignUpCommandTests
 {
     [Theory]
     [BitAutoData(PlanType.FamiliesAnnually)]
+    [BitAutoData(PlanType.FamiliesAnnually2025)]
     public async Task SignUp_PM_Family_Passes(PlanType planType, OrganizationSignup signup, SutProvider<CloudOrganizationSignUpCommand> sutProvider)
     {
         signup.Plan = planType;
 
-        var plan = StaticStore.GetPlan(signup.Plan);
+        var plan = MockPlans.Get(signup.Plan);
 
         signup.AdditionalSeats = 0;
         signup.PaymentMethodType = PaymentMethodType.Card;
@@ -36,7 +37,7 @@ public class CloudICloudOrganizationSignUpCommandTests
         signup.IsFromSecretsManagerTrial = false;
         signup.IsFromProvider = false;
 
-        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(signup.Plan).Returns(StaticStore.GetPlan(signup.Plan));
+        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(signup.Plan).Returns(MockPlans.Get(signup.Plan));
 
         var result = await sutProvider.Sut.SignUpOrganizationAsync(signup);
 
@@ -65,6 +66,7 @@ public class CloudICloudOrganizationSignUpCommandTests
 
     [Theory]
     [BitAutoData(PlanType.FamiliesAnnually)]
+    [BitAutoData(PlanType.FamiliesAnnually2025)]
     public async Task SignUp_AssignsOwnerToDefaultCollection
         (PlanType planType, OrganizationSignup signup, SutProvider<CloudOrganizationSignUpCommand> sutProvider)
     {
@@ -75,7 +77,7 @@ public class CloudICloudOrganizationSignUpCommandTests
         signup.UseSecretsManager = false;
         signup.IsFromProvider = false;
 
-        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(signup.Plan).Returns(StaticStore.GetPlan(signup.Plan));
+        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(signup.Plan).Returns(MockPlans.Get(signup.Plan));
 
         // Extract orgUserId when created
         Guid? orgUserId = null;
@@ -110,7 +112,7 @@ public class CloudICloudOrganizationSignUpCommandTests
     {
         signup.Plan = planType;
 
-        var plan = StaticStore.GetPlan(signup.Plan);
+        var plan = MockPlans.Get(signup.Plan);
 
         signup.UseSecretsManager = true;
         signup.AdditionalSeats = 15;
@@ -121,7 +123,7 @@ public class CloudICloudOrganizationSignUpCommandTests
         signup.IsFromSecretsManagerTrial = false;
         signup.IsFromProvider = false;
 
-        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(signup.Plan).Returns(StaticStore.GetPlan(signup.Plan));
+        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(signup.Plan).Returns(MockPlans.Get(signup.Plan));
 
         var result = await sutProvider.Sut.SignUpOrganizationAsync(signup);
 
@@ -162,7 +164,7 @@ public class CloudICloudOrganizationSignUpCommandTests
         signup.PremiumAccessAddon = false;
         signup.IsFromProvider = true;
 
-        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(signup.Plan).Returns(StaticStore.GetPlan(signup.Plan));
+        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(signup.Plan).Returns(MockPlans.Get(signup.Plan));
 
         var exception = await Assert.ThrowsAsync<BadRequestException>(() => sutProvider.Sut.SignUpOrganizationAsync(signup));
         Assert.Contains("Organizations with a Managed Service Provider do not support Secrets Manager.", exception.Message);
@@ -182,7 +184,7 @@ public class CloudICloudOrganizationSignUpCommandTests
         signup.AdditionalStorageGb = 0;
         signup.IsFromProvider = false;
 
-        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(signup.Plan).Returns(StaticStore.GetPlan(signup.Plan));
+        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(signup.Plan).Returns(MockPlans.Get(signup.Plan));
 
         var exception = await Assert.ThrowsAsync<BadRequestException>(
             () => sutProvider.Sut.SignUpOrganizationAsync(signup));
@@ -202,7 +204,7 @@ public class CloudICloudOrganizationSignUpCommandTests
         signup.AdditionalServiceAccounts = 10;
         signup.IsFromProvider = false;
 
-        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(signup.Plan).Returns(StaticStore.GetPlan(signup.Plan));
+        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(signup.Plan).Returns(MockPlans.Get(signup.Plan));
 
         var exception = await Assert.ThrowsAsync<BadRequestException>(
            () => sutProvider.Sut.SignUpOrganizationAsync(signup));
@@ -222,7 +224,7 @@ public class CloudICloudOrganizationSignUpCommandTests
         signup.AdditionalServiceAccounts = -10;
         signup.IsFromProvider = false;
 
-        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(signup.Plan).Returns(StaticStore.GetPlan(signup.Plan));
+        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(signup.Plan).Returns(MockPlans.Get(signup.Plan));
 
         var exception = await Assert.ThrowsAsync<BadRequestException>(
             () => sutProvider.Sut.SignUpOrganizationAsync(signup));
@@ -242,7 +244,7 @@ public class CloudICloudOrganizationSignUpCommandTests
             Owner = new User { Id = Guid.NewGuid() }
         };
 
-        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(signup.Plan).Returns(StaticStore.GetPlan(signup.Plan));
+        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(signup.Plan).Returns(MockPlans.Get(signup.Plan));
 
         sutProvider.GetDependency<IOrganizationUserRepository>()
             .GetCountByFreeOrganizationAdminUserAsync(signup.Owner.Id)

test/Core.Test/AdminConsole/OrganizationFeatures/Organizations/OrganizationSignUp/ProviderClientOrganizationSignUpCommandTests.cs

@@ -10,7 +10,7 @@ using Bit.Core.Models.Data;
 using Bit.Core.Models.StaticStore;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
-using Bit.Core.Utilities;
+using Bit.Core.Test.Billing.Mocks;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using NSubstitute;
@@ -36,7 +36,7 @@ public class ProviderClientOrganizationSignUpCommandTests
         signup.AdditionalSeats = 15;
         signup.CollectionName = collectionName;
 
-        var plan = StaticStore.GetPlan(signup.Plan);
+        var plan = MockPlans.Get(signup.Plan);
         sutProvider.GetDependency<IPricingClient>()
             .GetPlanOrThrow(signup.Plan)
             .Returns(plan);
@@ -112,7 +112,7 @@ public class ProviderClientOrganizationSignUpCommandTests
         signup.Plan = PlanType.TeamsMonthly;
         signup.AdditionalSeats = -5;
 
-        var plan = StaticStore.GetPlan(signup.Plan);
+        var plan = MockPlans.Get(signup.Plan);
         sutProvider.GetDependency<IPricingClient>()
             .GetPlanOrThrow(signup.Plan)
             .Returns(plan);
@@ -132,7 +132,7 @@ public class ProviderClientOrganizationSignUpCommandTests
     {
         signup.Plan = planType;
 
-        var plan = StaticStore.GetPlan(signup.Plan);
+        var plan = MockPlans.Get(signup.Plan);
         sutProvider.GetDependency<IPricingClient>()
             .GetPlanOrThrow(signup.Plan)
             .Returns(plan);

test/Core.Test/AdminConsole/OrganizationFeatures/Organizations/OrganizationUpdateCommandTests.cs

@@ -0,0 +1,414 @@
+using Bit.Core.AdminConsole.Entities;
+using Bit.Core.AdminConsole.OrganizationFeatures.Organizations.Update;
+using Bit.Core.Billing.Organizations.Services;
+using Bit.Core.Enums;
+using Bit.Core.Exceptions;
+using Bit.Core.Repositories;
+using Bit.Core.Services;
+using Bit.Core.Settings;
+using Bit.Test.Common.AutoFixture;
+using Bit.Test.Common.AutoFixture.Attributes;
+using NSubstitute;
+using Xunit;
+
+namespace Bit.Core.Test.AdminConsole.OrganizationFeatures.Organizations;
+
+[SutProviderCustomize]
+public class OrganizationUpdateCommandTests
+{
+    [Theory, BitAutoData]
+    public async Task UpdateAsync_WhenValidOrganization_UpdatesOrganization(
+        Guid organizationId,
+        string name,
+        string billingEmail,
+        Organization organization,
+        SutProvider<OrganizationUpdateCommand> sutProvider)
+    {
+        // Arrange
+        var organizationRepository = sutProvider.GetDependency<IOrganizationRepository>();
+        var organizationService = sutProvider.GetDependency<IOrganizationService>();
+        var organizationBillingService = sutProvider.GetDependency<IOrganizationBillingService>();
+
+        organization.Id = organizationId;
+        organization.GatewayCustomerId = null; // No Stripe customer, so no billing update
+
+        organizationRepository
+            .GetByIdAsync(organizationId)
+            .Returns(organization);
+
+        var request = new OrganizationUpdateRequest
+        {
+            OrganizationId = organizationId,
+            Name = name,
+            BillingEmail = billingEmail
+        };
+
+        // Act
+        var result = await sutProvider.Sut.UpdateAsync(request);
+
+        // Assert
+        Assert.NotNull(result);
+        Assert.Equal(organizationId, result.Id);
+        Assert.Equal(name, result.Name);
+        Assert.Equal(billingEmail.ToLowerInvariant().Trim(), result.BillingEmail);
+
+        await organizationRepository
+            .Received(1)
+            .GetByIdAsync(Arg.Is<Guid>(id => id == organizationId));
+        await organizationService
+            .Received(1)
+            .ReplaceAndUpdateCacheAsync(
+                result,
+                EventType.Organization_Updated);
+        await organizationBillingService
+            .DidNotReceiveWithAnyArgs()
+            .UpdateOrganizationNameAndEmail(Arg.Any<Organization>());
+    }
+
+    [Theory, BitAutoData]
+    public async Task UpdateAsync_WhenOrganizationNotFound_ThrowsNotFoundException(
+        Guid organizationId,
+        string name,
+        string billingEmail,
+        SutProvider<OrganizationUpdateCommand> sutProvider)
+    {
+        // Arrange
+        var organizationRepository = sutProvider.GetDependency<IOrganizationRepository>();
+
+        organizationRepository
+            .GetByIdAsync(organizationId)
+            .Returns((Organization)null);
+
+        var request = new OrganizationUpdateRequest
+        {
+            OrganizationId = organizationId,
+            Name = name,
+            BillingEmail = billingEmail
+        };
+
+        // Act/Assert
+        await Assert.ThrowsAsync<NotFoundException>(() => sutProvider.Sut.UpdateAsync(request));
+    }
+
+    [Theory]
+    [BitAutoData("")]
+    [BitAutoData((string)null)]
+    public async Task UpdateAsync_WhenGatewayCustomerIdIsNullOrEmpty_SkipsBillingUpdate(
+        string gatewayCustomerId,
+        Guid organizationId,
+        Organization organization,
+        SutProvider<OrganizationUpdateCommand> sutProvider)
+    {
+        // Arrange
+        var organizationRepository = sutProvider.GetDependency<IOrganizationRepository>();
+        var organizationService = sutProvider.GetDependency<IOrganizationService>();
+        var organizationBillingService = sutProvider.GetDependency<IOrganizationBillingService>();
+
+        organization.Id = organizationId;
+        organization.Name = "Old Name";
+        organization.GatewayCustomerId = gatewayCustomerId;
+
+        organizationRepository
+            .GetByIdAsync(organizationId)
+            .Returns(organization);
+
+        var request = new OrganizationUpdateRequest
+        {
+            OrganizationId = organizationId,
+            Name = "New Name",
+            BillingEmail = organization.BillingEmail
+        };
+
+        // Act
+        var result = await sutProvider.Sut.UpdateAsync(request);
+
+        // Assert
+        Assert.NotNull(result);
+        Assert.Equal(organizationId, result.Id);
+        Assert.Equal("New Name", result.Name);
+
+        await organizationService
+            .Received(1)
+            .ReplaceAndUpdateCacheAsync(
+                result,
+                EventType.Organization_Updated);
+        await organizationBillingService
+            .DidNotReceiveWithAnyArgs()
+            .UpdateOrganizationNameAndEmail(Arg.Any<Organization>());
+    }
+
+    [Theory, BitAutoData]
+    public async Task UpdateAsync_WhenKeysProvided_AndNotAlreadySet_SetsKeys(
+        Guid organizationId,
+        string publicKey,
+        string encryptedPrivateKey,
+        Organization organization,
+        SutProvider<OrganizationUpdateCommand> sutProvider)
+    {
+        // Arrange
+        var organizationRepository = sutProvider.GetDependency<IOrganizationRepository>();
+        var organizationService = sutProvider.GetDependency<IOrganizationService>();
+
+        organization.Id = organizationId;
+        organization.PublicKey = null;
+        organization.PrivateKey = null;
+
+        organizationRepository
+            .GetByIdAsync(organizationId)
+            .Returns(organization);
+
+        var request = new OrganizationUpdateRequest
+        {
+            OrganizationId = organizationId,
+            Name = organization.Name,
+            BillingEmail = organization.BillingEmail,
+            PublicKey = publicKey,
+            EncryptedPrivateKey = encryptedPrivateKey
+        };
+
+        // Act
+        var result = await sutProvider.Sut.UpdateAsync(request);
+
+        // Assert
+        Assert.NotNull(result);
+        Assert.Equal(organizationId, result.Id);
+        Assert.Equal(publicKey, result.PublicKey);
+        Assert.Equal(encryptedPrivateKey, result.PrivateKey);
+
+        await organizationService
+            .Received(1)
+            .ReplaceAndUpdateCacheAsync(
+                result,
+                EventType.Organization_Updated);
+    }
+
+    [Theory, BitAutoData]
+    public async Task UpdateAsync_WhenKeysProvided_AndAlreadySet_DoesNotOverwriteKeys(
+        Guid organizationId,
+        string newPublicKey,
+        string newEncryptedPrivateKey,
+        Organization organization,
+        SutProvider<OrganizationUpdateCommand> sutProvider)
+    {
+        // Arrange
+        var organizationRepository = sutProvider.GetDependency<IOrganizationRepository>();
+        var organizationService = sutProvider.GetDependency<IOrganizationService>();
+
+        organization.Id = organizationId;
+        var existingPublicKey = organization.PublicKey;
+        var existingPrivateKey = organization.PrivateKey;
+
+        organizationRepository
+            .GetByIdAsync(organizationId)
+            .Returns(organization);
+
+        var request = new OrganizationUpdateRequest
+        {
+            OrganizationId = organizationId,
+            Name = organization.Name,
+            BillingEmail = organization.BillingEmail,
+            PublicKey = newPublicKey,
+            EncryptedPrivateKey = newEncryptedPrivateKey
+        };
+
+        // Act
+        var result = await sutProvider.Sut.UpdateAsync(request);
+
+        // Assert
+        Assert.NotNull(result);
+        Assert.Equal(organizationId, result.Id);
+        Assert.Equal(existingPublicKey, result.PublicKey);
+        Assert.Equal(existingPrivateKey, result.PrivateKey);
+
+        await organizationService
+            .Received(1)
+            .ReplaceAndUpdateCacheAsync(
+                result,
+                EventType.Organization_Updated);
+    }
+
+    [Theory, BitAutoData]
+    public async Task UpdateAsync_UpdatingNameOnly_UpdatesNameAndNotBillingEmail(
+        Guid organizationId,
+        string newName,
+        Organization organization,
+        SutProvider<OrganizationUpdateCommand> sutProvider)
+    {
+        // Arrange
+        var organizationRepository = sutProvider.GetDependency<IOrganizationRepository>();
+        var organizationService = sutProvider.GetDependency<IOrganizationService>();
+        var organizationBillingService = sutProvider.GetDependency<IOrganizationBillingService>();
+
+        organization.Id = organizationId;
+        organization.Name = "Old Name";
+        var originalBillingEmail = organization.BillingEmail;
+
+        organizationRepository
+            .GetByIdAsync(organizationId)
+            .Returns(organization);
+
+        var request = new OrganizationUpdateRequest
+        {
+            OrganizationId = organizationId,
+            Name = newName,
+            BillingEmail = null
+        };
+
+        // Act
+        var result = await sutProvider.Sut.UpdateAsync(request);
+
+        // Assert
+        Assert.NotNull(result);
+        Assert.Equal(organizationId, result.Id);
+        Assert.Equal(newName, result.Name);
+        Assert.Equal(originalBillingEmail, result.BillingEmail);
+
+        await organizationService
+            .Received(1)
+            .ReplaceAndUpdateCacheAsync(
+                result,
+                EventType.Organization_Updated);
+        await organizationBillingService
+            .Received(1)
+            .UpdateOrganizationNameAndEmail(result);
+    }
+
+    [Theory, BitAutoData]
+    public async Task UpdateAsync_UpdatingBillingEmailOnly_UpdatesBillingEmailAndNotName(
+        Guid organizationId,
+        string newBillingEmail,
+        Organization organization,
+        SutProvider<OrganizationUpdateCommand> sutProvider)
+    {
+        // Arrange
+        var organizationRepository = sutProvider.GetDependency<IOrganizationRepository>();
+        var organizationService = sutProvider.GetDependency<IOrganizationService>();
+        var organizationBillingService = sutProvider.GetDependency<IOrganizationBillingService>();
+
+        organization.Id = organizationId;
+        organization.BillingEmail = "old@example.com";
+        var originalName = organization.Name;
+
+        organizationRepository
+            .GetByIdAsync(organizationId)
+            .Returns(organization);
+
+        var request = new OrganizationUpdateRequest
+        {
+            OrganizationId = organizationId,
+            Name = null,
+            BillingEmail = newBillingEmail
+        };
+
+        // Act
+        var result = await sutProvider.Sut.UpdateAsync(request);
+
+        // Assert
+        Assert.NotNull(result);
+        Assert.Equal(organizationId, result.Id);
+        Assert.Equal(originalName, result.Name);
+        Assert.Equal(newBillingEmail.ToLowerInvariant().Trim(), result.BillingEmail);
+
+        await organizationService
+            .Received(1)
+            .ReplaceAndUpdateCacheAsync(
+                result,
+                EventType.Organization_Updated);
+        await organizationBillingService
+            .Received(1)
+            .UpdateOrganizationNameAndEmail(result);
+    }
+
+    [Theory, BitAutoData]
+    public async Task UpdateAsync_WhenNoChanges_PreservesBothFields(
+        Guid organizationId,
+        Organization organization,
+        SutProvider<OrganizationUpdateCommand> sutProvider)
+    {
+        // Arrange
+        var organizationRepository = sutProvider.GetDependency<IOrganizationRepository>();
+        var organizationService = sutProvider.GetDependency<IOrganizationService>();
+        var organizationBillingService = sutProvider.GetDependency<IOrganizationBillingService>();
+
+        organization.Id = organizationId;
+        var originalName = organization.Name;
+        var originalBillingEmail = organization.BillingEmail;
+
+        organizationRepository
+            .GetByIdAsync(organizationId)
+            .Returns(organization);
+
+        var request = new OrganizationUpdateRequest
+        {
+            OrganizationId = organizationId,
+            Name = null,
+            BillingEmail = null
+        };
+
+        // Act
+        var result = await sutProvider.Sut.UpdateAsync(request);
+
+        // Assert
+        Assert.NotNull(result);
+        Assert.Equal(organizationId, result.Id);
+        Assert.Equal(originalName, result.Name);
+        Assert.Equal(originalBillingEmail, result.BillingEmail);
+
+        await organizationService
+            .Received(1)
+            .ReplaceAndUpdateCacheAsync(
+                result,
+                EventType.Organization_Updated);
+        await organizationBillingService
+            .DidNotReceiveWithAnyArgs()
+            .UpdateOrganizationNameAndEmail(Arg.Any<Organization>());
+    }
+
+    [Theory, BitAutoData]
+    public async Task UpdateAsync_SelfHosted_OnlyUpdatesKeysNotOrganizationDetails(
+        Guid organizationId,
+        string newName,
+        string newBillingEmail,
+        string publicKey,
+        string encryptedPrivateKey,
+        Organization organization,
+        SutProvider<OrganizationUpdateCommand> sutProvider)
+    {
+        // Arrange
+        var organizationBillingService = sutProvider.GetDependency<IOrganizationBillingService>();
+        var globalSettings = sutProvider.GetDependency<IGlobalSettings>();
+        var organizationRepository = sutProvider.GetDependency<IOrganizationRepository>();
+
+        globalSettings.SelfHosted.Returns(true);
+
+        organization.Id = organizationId;
+        organization.Name = "Original Name";
+        organization.BillingEmail = "original@example.com";
+        organization.PublicKey = null;
+        organization.PrivateKey = null;
+
+        organizationRepository.GetByIdAsync(organizationId).Returns(organization);
+
+        var request = new OrganizationUpdateRequest
+        {
+            OrganizationId = organizationId,
+            Name = newName, // Should be ignored
+            BillingEmail = newBillingEmail, // Should be ignored
+            PublicKey = publicKey,
+            EncryptedPrivateKey = encryptedPrivateKey
+        };
+
+        // Act
+        var result = await sutProvider.Sut.UpdateAsync(request);
+
+        // Assert
+        Assert.Equal("Original Name", result.Name); // Not changed
+        Assert.Equal("original@example.com", result.BillingEmail); // Not changed
+        Assert.Equal(publicKey, result.PublicKey); // Changed
+        Assert.Equal(encryptedPrivateKey, result.PrivateKey); // Changed
+
+        await organizationBillingService
+            .DidNotReceiveWithAnyArgs()
+            .UpdateOrganizationNameAndEmail(Arg.Any<Organization>());
+    }
+}

test/Core.Test/AdminConsole/OrganizationFeatures/Organizations/UpdateOrganizationSubscriptionCommandTests.cs

@@ -2,10 +2,10 @@
 using Bit.Core.AdminConsole.Models.Data.Organizations;
 using Bit.Core.AdminConsole.OrganizationFeatures.Organizations;
 using Bit.Core.Billing.Enums;
-using Bit.Core.Billing.Models.StaticStore.Plans;
 using Bit.Core.Models.StaticStore;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
+using Bit.Core.Test.Billing.Mocks.Plans;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using NSubstitute;

test/Core.Test/AdminConsole/OrganizationFeatures/Policies/PolicyValidators/AutomaticUserConfirmationPolicyEventHandlerTests.cs

@@ -0,0 +1,628 @@
+using Bit.Core.AdminConsole.Entities;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Enums;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies.Models;
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyValidators;
+using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.Entities;
+using Bit.Core.Enums;
+using Bit.Core.Models.Data.Organizations.OrganizationUsers;
+using Bit.Core.Repositories;
+using Bit.Core.Test.AdminConsole.AutoFixture;
+using Bit.Test.Common.AutoFixture;
+using Bit.Test.Common.AutoFixture.Attributes;
+using NSubstitute;
+using Xunit;
+
+namespace Bit.Core.Test.AdminConsole.OrganizationFeatures.Policies.PolicyValidators;
+
+[SutProviderCustomize]
+public class AutomaticUserConfirmationPolicyEventHandlerTests
+{
+    [Theory, BitAutoData]
+    public async Task ValidateAsync_EnablingPolicy_SingleOrgNotEnabled_ReturnsError(
+        [PolicyUpdate(PolicyType.AutomaticUserConfirmation)] PolicyUpdate policyUpdate,
+        SutProvider<AutomaticUserConfirmationPolicyEventHandler> sutProvider)
+    {
+        // Arrange
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(policyUpdate.OrganizationId, PolicyType.SingleOrg)
+            .Returns((Policy?)null);
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(policyUpdate, null);
+
+        // Assert
+        Assert.Contains("Single organization policy must be enabled", result, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Theory, BitAutoData]
+    public async Task ValidateAsync_EnablingPolicy_SingleOrgPolicyDisabled_ReturnsError(
+        [PolicyUpdate(PolicyType.AutomaticUserConfirmation)] PolicyUpdate policyUpdate,
+        [Policy(PolicyType.SingleOrg, false)] Policy singleOrgPolicy,
+        SutProvider<AutomaticUserConfirmationPolicyEventHandler> sutProvider)
+    {
+        // Arrange
+        singleOrgPolicy.OrganizationId = policyUpdate.OrganizationId;
+
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(policyUpdate.OrganizationId, PolicyType.SingleOrg)
+            .Returns(singleOrgPolicy);
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(policyUpdate, null);
+
+        // Assert
+        Assert.Contains("Single organization policy must be enabled", result, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Theory, BitAutoData]
+    public async Task ValidateAsync_EnablingPolicy_UsersNotCompliantWithSingleOrg_ReturnsError(
+        [PolicyUpdate(PolicyType.AutomaticUserConfirmation)] PolicyUpdate policyUpdate,
+        [Policy(PolicyType.SingleOrg)] Policy singleOrgPolicy,
+        Guid nonCompliantUserId,
+        SutProvider<AutomaticUserConfirmationPolicyEventHandler> sutProvider)
+    {
+        // Arrange
+        singleOrgPolicy.OrganizationId = policyUpdate.OrganizationId;
+
+        var orgUser = new OrganizationUserUserDetails
+        {
+            Id = Guid.NewGuid(),
+            OrganizationId = policyUpdate.OrganizationId,
+            Type = OrganizationUserType.User,
+            Status = OrganizationUserStatusType.Confirmed,
+            UserId = nonCompliantUserId,
+            Email = "user@example.com"
+        };
+
+        var otherOrgUser = new OrganizationUser
+        {
+            Id = Guid.NewGuid(),
+            OrganizationId = Guid.NewGuid(),
+            UserId = nonCompliantUserId,
+            Status = OrganizationUserStatusType.Confirmed
+        };
+
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(policyUpdate.OrganizationId, PolicyType.SingleOrg)
+            .Returns(singleOrgPolicy);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyDetailsByOrganizationAsync(policyUpdate.OrganizationId)
+            .Returns([orgUser]);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByManyUsersAsync(Arg.Any<IEnumerable<Guid>>())
+            .Returns([otherOrgUser]);
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(policyUpdate, null);
+
+        // Assert
+        Assert.Contains("compliant with the Single organization policy", result, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Theory, BitAutoData]
+    public async Task ValidateAsync_EnablingPolicy_UserWithInvitedStatusInOtherOrg_ValidationPasses(
+        [PolicyUpdate(PolicyType.AutomaticUserConfirmation)] PolicyUpdate policyUpdate,
+        [Policy(PolicyType.SingleOrg)] Policy singleOrgPolicy,
+        Guid userId,
+        SutProvider<AutomaticUserConfirmationPolicyEventHandler> sutProvider)
+    {
+        // Arrange
+        singleOrgPolicy.OrganizationId = policyUpdate.OrganizationId;
+
+        var orgUser = new OrganizationUserUserDetails
+        {
+            Id = Guid.NewGuid(),
+            OrganizationId = policyUpdate.OrganizationId,
+            Type = OrganizationUserType.User,
+            Status = OrganizationUserStatusType.Confirmed,
+            UserId = userId,
+            Email = "test@email.com"
+        };
+
+        var otherOrgUser = new OrganizationUser
+        {
+            Id = Guid.NewGuid(),
+            OrganizationId = Guid.NewGuid(),
+            UserId = null, // invited users do not have a user id
+            Status = OrganizationUserStatusType.Invited,
+            Email = orgUser.Email
+        };
+
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(policyUpdate.OrganizationId, PolicyType.SingleOrg)
+            .Returns(singleOrgPolicy);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyDetailsByOrganizationAsync(policyUpdate.OrganizationId)
+            .Returns([orgUser]);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByManyUsersAsync(Arg.Any<IEnumerable<Guid>>())
+            .Returns([otherOrgUser]);
+
+        sutProvider.GetDependency<IProviderUserRepository>()
+            .GetManyByOrganizationAsync(policyUpdate.OrganizationId)
+            .Returns([]);
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(policyUpdate, null);
+
+        // Assert
+        Assert.True(string.IsNullOrEmpty(result));
+    }
+
+    [Theory, BitAutoData]
+    public async Task ValidateAsync_EnablingPolicy_ProviderUsersExist_ReturnsError(
+        [PolicyUpdate(PolicyType.AutomaticUserConfirmation)] PolicyUpdate policyUpdate,
+        [Policy(PolicyType.SingleOrg)] Policy singleOrgPolicy,
+        SutProvider<AutomaticUserConfirmationPolicyEventHandler> sutProvider)
+    {
+        // Arrange
+        singleOrgPolicy.OrganizationId = policyUpdate.OrganizationId;
+
+        var providerUser = new ProviderUser
+        {
+            Id = Guid.NewGuid(),
+            ProviderId = Guid.NewGuid(),
+            UserId = Guid.NewGuid(),
+            Status = ProviderUserStatusType.Confirmed
+        };
+
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(policyUpdate.OrganizationId, PolicyType.SingleOrg)
+            .Returns(singleOrgPolicy);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyDetailsByOrganizationAsync(policyUpdate.OrganizationId)
+            .Returns([]);
+
+        sutProvider.GetDependency<IProviderUserRepository>()
+            .GetManyByOrganizationAsync(policyUpdate.OrganizationId)
+            .Returns([providerUser]);
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(policyUpdate, null);
+
+        // Assert
+        Assert.Contains("Provider user type", result, StringComparison.OrdinalIgnoreCase);
+    }
+
+
+    [Theory, BitAutoData]
+    public async Task ValidateAsync_EnablingPolicy_AllValidationsPassed_ReturnsEmptyString(
+        [PolicyUpdate(PolicyType.AutomaticUserConfirmation)] PolicyUpdate policyUpdate,
+        [Policy(PolicyType.SingleOrg)] Policy singleOrgPolicy,
+        SutProvider<AutomaticUserConfirmationPolicyEventHandler> sutProvider)
+    {
+        // Arrange
+        singleOrgPolicy.OrganizationId = policyUpdate.OrganizationId;
+
+        var orgUser = new OrganizationUserUserDetails
+        {
+            Id = Guid.NewGuid(),
+            OrganizationId = policyUpdate.OrganizationId,
+            Type = OrganizationUserType.User,
+            Status = OrganizationUserStatusType.Confirmed,
+            UserId = Guid.NewGuid(),
+            Email = "user@example.com"
+        };
+
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(policyUpdate.OrganizationId, PolicyType.SingleOrg)
+            .Returns(singleOrgPolicy);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyDetailsByOrganizationAsync(policyUpdate.OrganizationId)
+            .Returns([orgUser]);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByManyUsersAsync(Arg.Any<IEnumerable<Guid>>())
+            .Returns([]);
+
+        sutProvider.GetDependency<IProviderUserRepository>()
+            .GetManyByOrganizationAsync(policyUpdate.OrganizationId)
+            .Returns([]);
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(policyUpdate, null);
+
+        // Assert
+        Assert.True(string.IsNullOrEmpty(result));
+    }
+
+    [Theory, BitAutoData]
+    public async Task ValidateAsync_PolicyAlreadyEnabled_ReturnsEmptyString(
+        [PolicyUpdate(PolicyType.AutomaticUserConfirmation)] PolicyUpdate policyUpdate,
+        [Policy(PolicyType.AutomaticUserConfirmation)] Policy currentPolicy,
+        SutProvider<AutomaticUserConfirmationPolicyEventHandler> sutProvider)
+    {
+        // Arrange
+        currentPolicy.OrganizationId = policyUpdate.OrganizationId;
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(policyUpdate, currentPolicy);
+
+        // Assert
+        Assert.True(string.IsNullOrEmpty(result));
+        await sutProvider.GetDependency<IPolicyRepository>()
+            .DidNotReceive()
+            .GetByOrganizationIdTypeAsync(Arg.Any<Guid>(), Arg.Any<PolicyType>());
+    }
+
+    [Theory, BitAutoData]
+    public async Task ValidateAsync_DisablingPolicy_ReturnsEmptyString(
+        [PolicyUpdate(PolicyType.AutomaticUserConfirmation, false)] PolicyUpdate policyUpdate,
+        [Policy(PolicyType.AutomaticUserConfirmation)] Policy currentPolicy,
+        SutProvider<AutomaticUserConfirmationPolicyEventHandler> sutProvider)
+    {
+        // Arrange
+        currentPolicy.OrganizationId = policyUpdate.OrganizationId;
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(policyUpdate, currentPolicy);
+
+        // Assert
+        Assert.True(string.IsNullOrEmpty(result));
+        await sutProvider.GetDependency<IPolicyRepository>()
+            .DidNotReceive()
+            .GetByOrganizationIdTypeAsync(Arg.Any<Guid>(), Arg.Any<PolicyType>());
+    }
+
+    [Theory, BitAutoData]
+    public async Task ValidateAsync_EnablingPolicy_IncludesOwnersAndAdmins_InComplianceCheck(
+        [PolicyUpdate(PolicyType.AutomaticUserConfirmation)] PolicyUpdate policyUpdate,
+        [Policy(PolicyType.SingleOrg)] Policy singleOrgPolicy,
+        Guid nonCompliantOwnerId,
+        SutProvider<AutomaticUserConfirmationPolicyEventHandler> sutProvider)
+    {
+        // Arrange
+        singleOrgPolicy.OrganizationId = policyUpdate.OrganizationId;
+
+        var ownerUser = new OrganizationUserUserDetails
+        {
+            Id = Guid.NewGuid(),
+            OrganizationId = policyUpdate.OrganizationId,
+            Type = OrganizationUserType.Owner,
+            Status = OrganizationUserStatusType.Confirmed,
+            UserId = nonCompliantOwnerId,
+            Email = "owner@example.com"
+        };
+
+        var otherOrgUser = new OrganizationUser
+        {
+            Id = Guid.NewGuid(),
+            OrganizationId = Guid.NewGuid(),
+            UserId = nonCompliantOwnerId,
+            Status = OrganizationUserStatusType.Confirmed
+        };
+
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(policyUpdate.OrganizationId, PolicyType.SingleOrg)
+            .Returns(singleOrgPolicy);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyDetailsByOrganizationAsync(policyUpdate.OrganizationId)
+            .Returns([ownerUser]);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByManyUsersAsync(Arg.Any<IEnumerable<Guid>>())
+            .Returns([otherOrgUser]);
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(policyUpdate, null);
+
+        // Assert
+        Assert.Contains("compliant with the Single organization policy", result, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Theory, BitAutoData]
+    public async Task ValidateAsync_EnablingPolicy_InvitedUsersExcluded_FromComplianceCheck(
+        [PolicyUpdate(PolicyType.AutomaticUserConfirmation)] PolicyUpdate policyUpdate,
+        [Policy(PolicyType.SingleOrg)] Policy singleOrgPolicy,
+        SutProvider<AutomaticUserConfirmationPolicyEventHandler> sutProvider)
+    {
+        // Arrange
+        singleOrgPolicy.OrganizationId = policyUpdate.OrganizationId;
+
+        var invitedUser = new OrganizationUserUserDetails
+        {
+            Id = Guid.NewGuid(),
+            OrganizationId = policyUpdate.OrganizationId,
+            Type = OrganizationUserType.User,
+            Status = OrganizationUserStatusType.Invited,
+            UserId = Guid.NewGuid(),
+            Email = "invited@example.com"
+        };
+
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(policyUpdate.OrganizationId, PolicyType.SingleOrg)
+            .Returns(singleOrgPolicy);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyDetailsByOrganizationAsync(policyUpdate.OrganizationId)
+            .Returns([invitedUser]);
+
+        sutProvider.GetDependency<IProviderUserRepository>()
+            .GetManyByOrganizationAsync(policyUpdate.OrganizationId)
+            .Returns([]);
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(policyUpdate, null);
+
+        // Assert
+        Assert.True(string.IsNullOrEmpty(result));
+    }
+
+    [Theory, BitAutoData]
+    public async Task ValidateAsync_EnablingPolicy_RevokedUsersExcluded_FromComplianceCheck(
+        [PolicyUpdate(PolicyType.AutomaticUserConfirmation)] PolicyUpdate policyUpdate,
+        [Policy(PolicyType.SingleOrg)] Policy singleOrgPolicy,
+        SutProvider<AutomaticUserConfirmationPolicyEventHandler> sutProvider)
+    {
+        // Arrange
+        singleOrgPolicy.OrganizationId = policyUpdate.OrganizationId;
+
+        var revokedUser = new OrganizationUserUserDetails
+        {
+            Id = Guid.NewGuid(),
+            OrganizationId = policyUpdate.OrganizationId,
+            Type = OrganizationUserType.User,
+            Status = OrganizationUserStatusType.Revoked,
+            UserId = Guid.NewGuid(),
+            Email = "revoked@example.com"
+        };
+
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(policyUpdate.OrganizationId, PolicyType.SingleOrg)
+            .Returns(singleOrgPolicy);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyDetailsByOrganizationAsync(policyUpdate.OrganizationId)
+            .Returns([revokedUser]);
+
+        sutProvider.GetDependency<IProviderUserRepository>()
+            .GetManyByOrganizationAsync(policyUpdate.OrganizationId)
+            .Returns([]);
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(policyUpdate, null);
+
+        // Assert
+        Assert.True(string.IsNullOrEmpty(result));
+    }
+
+    [Theory, BitAutoData]
+    public async Task ValidateAsync_EnablingPolicy_AcceptedUsersIncluded_InComplianceCheck(
+        [PolicyUpdate(PolicyType.AutomaticUserConfirmation)] PolicyUpdate policyUpdate,
+        [Policy(PolicyType.SingleOrg)] Policy singleOrgPolicy,
+        Guid nonCompliantUserId,
+        SutProvider<AutomaticUserConfirmationPolicyEventHandler> sutProvider)
+    {
+        // Arrange
+        singleOrgPolicy.OrganizationId = policyUpdate.OrganizationId;
+
+        var acceptedUser = new OrganizationUserUserDetails
+        {
+            Id = Guid.NewGuid(),
+            OrganizationId = policyUpdate.OrganizationId,
+            Type = OrganizationUserType.User,
+            Status = OrganizationUserStatusType.Accepted,
+            UserId = nonCompliantUserId,
+            Email = "accepted@example.com"
+        };
+
+        var otherOrgUser = new OrganizationUser
+        {
+            Id = Guid.NewGuid(),
+            OrganizationId = Guid.NewGuid(),
+            UserId = nonCompliantUserId,
+            Status = OrganizationUserStatusType.Confirmed
+        };
+
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(policyUpdate.OrganizationId, PolicyType.SingleOrg)
+            .Returns(singleOrgPolicy);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyDetailsByOrganizationAsync(policyUpdate.OrganizationId)
+            .Returns([acceptedUser]);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByManyUsersAsync(Arg.Any<IEnumerable<Guid>>())
+            .Returns([otherOrgUser]);
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(policyUpdate, null);
+
+        // Assert
+        Assert.Contains("compliant with the Single organization policy", result, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Theory, BitAutoData]
+    public async Task ValidateAsync_EnablingPolicy_EmptyOrganization_ReturnsEmptyString(
+        [PolicyUpdate(PolicyType.AutomaticUserConfirmation)] PolicyUpdate policyUpdate,
+        [Policy(PolicyType.SingleOrg)] Policy singleOrgPolicy,
+        SutProvider<AutomaticUserConfirmationPolicyEventHandler> sutProvider)
+    {
+        // Arrange
+        singleOrgPolicy.OrganizationId = policyUpdate.OrganizationId;
+
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(policyUpdate.OrganizationId, PolicyType.SingleOrg)
+            .Returns(singleOrgPolicy);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyDetailsByOrganizationAsync(policyUpdate.OrganizationId)
+            .Returns([]);
+
+        sutProvider.GetDependency<IProviderUserRepository>()
+            .GetManyByOrganizationAsync(policyUpdate.OrganizationId)
+            .Returns([]);
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(policyUpdate, null);
+
+        // Assert
+        Assert.True(string.IsNullOrEmpty(result));
+    }
+
+    [Theory, BitAutoData]
+    public async Task ValidateAsync_WithSavePolicyModel_CallsValidateWithPolicyUpdate(
+        [PolicyUpdate(PolicyType.AutomaticUserConfirmation)] PolicyUpdate policyUpdate,
+        [Policy(PolicyType.SingleOrg)] Policy singleOrgPolicy,
+        SutProvider<AutomaticUserConfirmationPolicyEventHandler> sutProvider)
+    {
+        // Arrange
+        singleOrgPolicy.OrganizationId = policyUpdate.OrganizationId;
+
+        var savePolicyModel = new SavePolicyModel(policyUpdate);
+
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(policyUpdate.OrganizationId, PolicyType.SingleOrg)
+            .Returns(singleOrgPolicy);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyDetailsByOrganizationAsync(policyUpdate.OrganizationId)
+            .Returns([]);
+
+        sutProvider.GetDependency<IProviderUserRepository>()
+            .GetManyByOrganizationAsync(policyUpdate.OrganizationId)
+            .Returns([]);
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(savePolicyModel, null);
+
+        // Assert
+        Assert.True(string.IsNullOrEmpty(result));
+    }
+
+    [Theory, BitAutoData]
+    public async Task OnSaveSideEffectsAsync_EnablingPolicy_SetsUseAutomaticUserConfirmationToTrue(
+        [PolicyUpdate(PolicyType.AutomaticUserConfirmation)] PolicyUpdate policyUpdate,
+        Organization organization,
+        SutProvider<AutomaticUserConfirmationPolicyEventHandler> sutProvider)
+    {
+        // Arrange
+        organization.Id = policyUpdate.OrganizationId;
+        organization.UseAutomaticUserConfirmation = false;
+
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdAsync(policyUpdate.OrganizationId)
+            .Returns(organization);
+
+        // Act
+        await sutProvider.Sut.OnSaveSideEffectsAsync(policyUpdate, null);
+
+        // Assert
+        await sutProvider.GetDependency<IOrganizationRepository>()
+            .Received(1)
+            .UpsertAsync(Arg.Is<Organization>(o =>
+                o.Id == organization.Id &&
+                o.UseAutomaticUserConfirmation == true &&
+                o.RevisionDate > DateTime.MinValue));
+    }
+
+    [Theory, BitAutoData]
+    public async Task OnSaveSideEffectsAsync_DisablingPolicy_SetsUseAutomaticUserConfirmationToFalse(
+        [PolicyUpdate(PolicyType.AutomaticUserConfirmation, false)] PolicyUpdate policyUpdate,
+        Organization organization,
+        SutProvider<AutomaticUserConfirmationPolicyEventHandler> sutProvider)
+    {
+        // Arrange
+        organization.Id = policyUpdate.OrganizationId;
+        organization.UseAutomaticUserConfirmation = true;
+
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdAsync(policyUpdate.OrganizationId)
+            .Returns(organization);
+
+        // Act
+        await sutProvider.Sut.OnSaveSideEffectsAsync(policyUpdate, null);
+
+        // Assert
+        await sutProvider.GetDependency<IOrganizationRepository>()
+            .Received(1)
+            .UpsertAsync(Arg.Is<Organization>(o =>
+                o.Id == organization.Id &&
+                o.UseAutomaticUserConfirmation == false &&
+                o.RevisionDate > DateTime.MinValue));
+    }
+
+    [Theory, BitAutoData]
+    public async Task OnSaveSideEffectsAsync_OrganizationNotFound_DoesNotThrowException(
+        [PolicyUpdate(PolicyType.AutomaticUserConfirmation)] PolicyUpdate policyUpdate,
+        SutProvider<AutomaticUserConfirmationPolicyEventHandler> sutProvider)
+    {
+        // Arrange
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdAsync(policyUpdate.OrganizationId)
+            .Returns((Organization?)null);
+
+        // Act
+        await sutProvider.Sut.OnSaveSideEffectsAsync(policyUpdate, null);
+
+        // Assert
+        await sutProvider.GetDependency<IOrganizationRepository>()
+            .DidNotReceive()
+            .UpsertAsync(Arg.Any<Organization>());
+    }
+
+    [Theory, BitAutoData]
+    public async Task ExecutePreUpsertSideEffectAsync_CallsOnSaveSideEffectsAsync(
+        [PolicyUpdate(PolicyType.AutomaticUserConfirmation)] PolicyUpdate policyUpdate,
+        [Policy(PolicyType.AutomaticUserConfirmation)] Policy currentPolicy,
+        Organization organization,
+        SutProvider<AutomaticUserConfirmationPolicyEventHandler> sutProvider)
+    {
+        // Arrange
+        organization.Id = policyUpdate.OrganizationId;
+        currentPolicy.OrganizationId = policyUpdate.OrganizationId;
+
+        var savePolicyModel = new SavePolicyModel(policyUpdate);
+
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdAsync(policyUpdate.OrganizationId)
+            .Returns(organization);
+
+        // Act
+        await sutProvider.Sut.ExecutePreUpsertSideEffectAsync(savePolicyModel, currentPolicy);
+
+        // Assert
+        await sutProvider.GetDependency<IOrganizationRepository>()
+            .Received(1)
+            .UpsertAsync(Arg.Is<Organization>(o =>
+                o.Id == organization.Id &&
+                o.UseAutomaticUserConfirmation == policyUpdate.Enabled));
+    }
+
+    [Theory, BitAutoData]
+    public async Task OnSaveSideEffectsAsync_UpdatesRevisionDate(
+        [PolicyUpdate(PolicyType.AutomaticUserConfirmation)] PolicyUpdate policyUpdate,
+        Organization organization,
+        SutProvider<AutomaticUserConfirmationPolicyEventHandler> sutProvider)
+    {
+        // Arrange
+        organization.Id = policyUpdate.OrganizationId;
+        var originalRevisionDate = DateTime.UtcNow.AddDays(-1);
+        organization.RevisionDate = originalRevisionDate;
+
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdAsync(policyUpdate.OrganizationId)
+            .Returns(organization);
+
+        // Act
+        await sutProvider.Sut.OnSaveSideEffectsAsync(policyUpdate, null);
+
+        // Assert
+        await sutProvider.GetDependency<IOrganizationRepository>()
+            .Received(1)
+            .UpsertAsync(Arg.Is<Organization>(o =>
+                o.Id == organization.Id &&
+                o.RevisionDate > originalRevisionDate));
+    }
+}

test/Core.Test/AdminConsole/OrganizationFeatures/Policies/PolicyValidators/BlockClaimedDomainAccountCreationPolicyValidatorTests.cs

@@ -0,0 +1,189 @@
+namespace Bit.Core.Test.AdminConsole.OrganizationFeatures.Policies.PolicyValidators;
+
+using Bit.Core.AdminConsole.Enums;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationDomains.Interfaces;
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies.Models;
+using Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyValidators;
+using Bit.Core.Services;
+using Bit.Core.Test.AdminConsole.AutoFixture;
+using Bit.Test.Common.AutoFixture;
+using Bit.Test.Common.AutoFixture.Attributes;
+using NSubstitute;
+using Xunit;
+
+[SutProviderCustomize]
+public class BlockClaimedDomainAccountCreationPolicyValidatorTests
+{
+    [Theory, BitAutoData]
+    public async Task ValidateAsync_EnablingPolicy_NoVerifiedDomains_ValidationError(
+        [PolicyUpdate(PolicyType.BlockClaimedDomainAccountCreation, true)] PolicyUpdate policyUpdate,
+        SutProvider<BlockClaimedDomainAccountCreationPolicyValidator> sutProvider)
+    {
+        // Arrange
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.BlockClaimedDomainAccountCreation)
+            .Returns(true);
+
+        sutProvider.GetDependency<IOrganizationHasVerifiedDomainsQuery>()
+            .HasVerifiedDomainsAsync(policyUpdate.OrganizationId)
+            .Returns(false);
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(policyUpdate, null);
+
+        // Assert
+        Assert.Equal("You must claim at least one domain to turn on this policy", result);
+    }
+
+    [Theory, BitAutoData]
+    public async Task ValidateAsync_EnablingPolicy_HasVerifiedDomains_Success(
+        [PolicyUpdate(PolicyType.BlockClaimedDomainAccountCreation, true)] PolicyUpdate policyUpdate,
+        SutProvider<BlockClaimedDomainAccountCreationPolicyValidator> sutProvider)
+    {
+        // Arrange
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.BlockClaimedDomainAccountCreation)
+            .Returns(true);
+
+        sutProvider.GetDependency<IOrganizationHasVerifiedDomainsQuery>()
+            .HasVerifiedDomainsAsync(policyUpdate.OrganizationId)
+            .Returns(true);
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(policyUpdate, null);
+
+        // Assert
+        Assert.True(string.IsNullOrEmpty(result));
+    }
+
+    [Theory, BitAutoData]
+    public async Task ValidateAsync_DisablingPolicy_NoValidation(
+        [PolicyUpdate(PolicyType.BlockClaimedDomainAccountCreation, false)] PolicyUpdate policyUpdate,
+        SutProvider<BlockClaimedDomainAccountCreationPolicyValidator> sutProvider)
+    {
+        // Arrange
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.BlockClaimedDomainAccountCreation)
+            .Returns(true);
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(policyUpdate, null);
+
+        // Assert
+        Assert.True(string.IsNullOrEmpty(result));
+        await sutProvider.GetDependency<IOrganizationHasVerifiedDomainsQuery>()
+            .DidNotReceive()
+            .HasVerifiedDomainsAsync(Arg.Any<Guid>());
+    }
+
+    [Theory, BitAutoData]
+    public async Task ValidateAsync_WithSavePolicyModel_EnablingPolicy_NoVerifiedDomains_ValidationError(
+        [PolicyUpdate(PolicyType.BlockClaimedDomainAccountCreation, true)] PolicyUpdate policyUpdate,
+        SutProvider<BlockClaimedDomainAccountCreationPolicyValidator> sutProvider)
+    {
+        // Arrange
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.BlockClaimedDomainAccountCreation)
+            .Returns(true);
+
+        sutProvider.GetDependency<IOrganizationHasVerifiedDomainsQuery>()
+            .HasVerifiedDomainsAsync(policyUpdate.OrganizationId)
+            .Returns(false);
+
+        var savePolicyModel = new SavePolicyModel(policyUpdate, null, new EmptyMetadataModel());
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(savePolicyModel, null);
+
+        // Assert
+        Assert.Equal("You must claim at least one domain to turn on this policy", result);
+    }
+
+    [Theory, BitAutoData]
+    public async Task ValidateAsync_WithSavePolicyModel_EnablingPolicy_HasVerifiedDomains_Success(
+        [PolicyUpdate(PolicyType.BlockClaimedDomainAccountCreation, true)] PolicyUpdate policyUpdate,
+        SutProvider<BlockClaimedDomainAccountCreationPolicyValidator> sutProvider)
+    {
+        // Arrange
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.BlockClaimedDomainAccountCreation)
+            .Returns(true);
+
+        sutProvider.GetDependency<IOrganizationHasVerifiedDomainsQuery>()
+            .HasVerifiedDomainsAsync(policyUpdate.OrganizationId)
+            .Returns(true);
+
+        var savePolicyModel = new SavePolicyModel(policyUpdate, null, new EmptyMetadataModel());
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(savePolicyModel, null);
+
+        // Assert
+        Assert.True(string.IsNullOrEmpty(result));
+    }
+
+    [Theory, BitAutoData]
+    public async Task ValidateAsync_WithSavePolicyModel_DisablingPolicy_NoValidation(
+        [PolicyUpdate(PolicyType.BlockClaimedDomainAccountCreation, false)] PolicyUpdate policyUpdate,
+        SutProvider<BlockClaimedDomainAccountCreationPolicyValidator> sutProvider)
+    {
+        // Arrange
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.BlockClaimedDomainAccountCreation)
+            .Returns(true);
+
+        var savePolicyModel = new SavePolicyModel(policyUpdate, null, new EmptyMetadataModel());
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(savePolicyModel, null);
+
+        // Assert
+        Assert.True(string.IsNullOrEmpty(result));
+        await sutProvider.GetDependency<IOrganizationHasVerifiedDomainsQuery>()
+            .DidNotReceive()
+            .HasVerifiedDomainsAsync(Arg.Any<Guid>());
+    }
+
+    [Theory, BitAutoData]
+    public async Task ValidateAsync_FeatureFlagDisabled_ReturnsError(
+        [PolicyUpdate(PolicyType.BlockClaimedDomainAccountCreation, true)] PolicyUpdate policyUpdate,
+        SutProvider<BlockClaimedDomainAccountCreationPolicyValidator> sutProvider)
+    {
+        // Arrange
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.BlockClaimedDomainAccountCreation)
+            .Returns(false);
+
+        // Act
+        var result = await sutProvider.Sut.ValidateAsync(policyUpdate, null);
+
+        // Assert
+        Assert.Equal("This feature is not enabled", result);
+        await sutProvider.GetDependency<IOrganizationHasVerifiedDomainsQuery>()
+            .DidNotReceive()
+            .HasVerifiedDomainsAsync(Arg.Any<Guid>());
+    }
+
+    [Fact]
+    public void Type_ReturnsBlockClaimedDomainAccountCreation()
+    {
+        // Arrange
+        var validator = new BlockClaimedDomainAccountCreationPolicyValidator(null, null);
+
+        // Act & Assert
+        Assert.Equal(PolicyType.BlockClaimedDomainAccountCreation, validator.Type);
+    }
+
+    [Fact]
+    public void RequiredPolicies_ReturnsEmpty()
+    {
+        // Arrange
+        var validator = new BlockClaimedDomainAccountCreationPolicyValidator(null, null);
+
+        // Act
+        var requiredPolicies = validator.RequiredPolicies.ToList();
+
+        // Assert
+        Assert.Empty(requiredPolicies);
+    }
+}

test/Core.Test/AdminConsole/OrganizationFeatures/Policies/SavePolicyCommandTests.cs

@@ -6,8 +6,11 @@ using Bit.Core.AdminConsole.OrganizationFeatures.Policies;
 using Bit.Core.AdminConsole.OrganizationFeatures.Policies.Implementations;
 using Bit.Core.AdminConsole.OrganizationFeatures.Policies.Models;
 using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.Enums;
 using Bit.Core.Exceptions;
+using Bit.Core.Models;
 using Bit.Core.Models.Data.Organizations;
+using Bit.Core.Platform.Push;
 using Bit.Core.Services;
 using Bit.Core.Test.AdminConsole.AutoFixture;
 using Bit.Test.Common.AutoFixture;
@@ -95,7 +98,8 @@ public class SavePolicyCommandTests
                 Substitute.For<IPolicyRepository>(),
                 [new FakeSingleOrgPolicyValidator(), new FakeSingleOrgPolicyValidator()],
                 Substitute.For<TimeProvider>(),
-                Substitute.For<IPostSavePolicySideEffect>()));
+                Substitute.For<IPostSavePolicySideEffect>(),
+                Substitute.For<IPushNotificationService>()));
         Assert.Contains("Duplicate PolicyValidator for SingleOrg policy", exception.Message);
     }
 
@@ -360,6 +364,103 @@ public class SavePolicyCommandTests
             .ExecuteSideEffectsAsync(default!, default!, default!);
     }
 
+    [Theory, BitAutoData]
+    public async Task VNextSaveAsync_SendsPushNotification(
+        [PolicyUpdate(PolicyType.SingleOrg)] PolicyUpdate policyUpdate,
+        [Policy(PolicyType.SingleOrg, false)] Policy currentPolicy)
+    {
+        // Arrange
+        var fakePolicyValidator = new FakeSingleOrgPolicyValidator();
+        fakePolicyValidator.ValidateAsyncMock(policyUpdate, null).Returns("");
+        var sutProvider = SutProviderFactory([fakePolicyValidator]);
+        var savePolicyModel = new SavePolicyModel(policyUpdate);
+
+        currentPolicy.OrganizationId = policyUpdate.OrganizationId;
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(policyUpdate.OrganizationId, policyUpdate.Type)
+            .Returns(currentPolicy);
+
+        ArrangeOrganization(sutProvider, policyUpdate);
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetManyByOrganizationIdAsync(policyUpdate.OrganizationId)
+            .Returns([currentPolicy]);
+
+        // Act
+        var result = await sutProvider.Sut.VNextSaveAsync(savePolicyModel);
+
+        // Assert
+        await sutProvider.GetDependency<IPushNotificationService>().Received(1)
+            .PushAsync(Arg.Is<PushNotification<SyncPolicyPushNotification>>(p =>
+                p.Type == PushType.PolicyChanged &&
+                p.Target == NotificationTarget.Organization &&
+                p.TargetId == policyUpdate.OrganizationId &&
+                p.ExcludeCurrentContext == false &&
+                p.Payload.OrganizationId == policyUpdate.OrganizationId &&
+                p.Payload.Policy.Id == result.Id &&
+                p.Payload.Policy.Type == policyUpdate.Type &&
+                p.Payload.Policy.Enabled == policyUpdate.Enabled &&
+                p.Payload.Policy.Data == policyUpdate.Data));
+    }
+
+    [Theory, BitAutoData]
+    public async Task SaveAsync_SendsPushNotification([PolicyUpdate(PolicyType.SingleOrg)] PolicyUpdate policyUpdate)
+    {
+        var fakePolicyValidator = new FakeSingleOrgPolicyValidator();
+        fakePolicyValidator.ValidateAsyncMock(policyUpdate, null).Returns("");
+        var sutProvider = SutProviderFactory([fakePolicyValidator]);
+
+        ArrangeOrganization(sutProvider, policyUpdate);
+        sutProvider.GetDependency<IPolicyRepository>().GetManyByOrganizationIdAsync(policyUpdate.OrganizationId).Returns([]);
+
+        var result = await sutProvider.Sut.SaveAsync(policyUpdate);
+
+        await sutProvider.GetDependency<IPushNotificationService>().Received(1)
+            .PushAsync(Arg.Is<PushNotification<SyncPolicyPushNotification>>(p =>
+                p.Type == PushType.PolicyChanged &&
+                p.Target == NotificationTarget.Organization &&
+                p.TargetId == policyUpdate.OrganizationId &&
+                p.ExcludeCurrentContext == false &&
+                p.Payload.OrganizationId == policyUpdate.OrganizationId &&
+                p.Payload.Policy.Id == result.Id &&
+                p.Payload.Policy.Type == policyUpdate.Type &&
+                p.Payload.Policy.Enabled == policyUpdate.Enabled &&
+                p.Payload.Policy.Data == policyUpdate.Data));
+    }
+
+    [Theory, BitAutoData]
+    public async Task SaveAsync_ExistingPolicy_SendsPushNotificationWithUpdatedPolicy(
+        [PolicyUpdate(PolicyType.SingleOrg)] PolicyUpdate policyUpdate,
+        [Policy(PolicyType.SingleOrg, false)] Policy currentPolicy)
+    {
+        var fakePolicyValidator = new FakeSingleOrgPolicyValidator();
+        fakePolicyValidator.ValidateAsyncMock(policyUpdate, null).Returns("");
+        var sutProvider = SutProviderFactory([fakePolicyValidator]);
+
+        currentPolicy.OrganizationId = policyUpdate.OrganizationId;
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(policyUpdate.OrganizationId, policyUpdate.Type)
+            .Returns(currentPolicy);
+
+        ArrangeOrganization(sutProvider, policyUpdate);
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetManyByOrganizationIdAsync(policyUpdate.OrganizationId)
+            .Returns([currentPolicy]);
+
+        var result = await sutProvider.Sut.SaveAsync(policyUpdate);
+
+        await sutProvider.GetDependency<IPushNotificationService>().Received(1)
+            .PushAsync(Arg.Is<PushNotification<SyncPolicyPushNotification>>(p =>
+                p.Type == PushType.PolicyChanged &&
+                p.Target == NotificationTarget.Organization &&
+                p.TargetId == policyUpdate.OrganizationId &&
+                p.ExcludeCurrentContext == false &&
+                p.Payload.OrganizationId == policyUpdate.OrganizationId &&
+                p.Payload.Policy.Id == result.Id &&
+                p.Payload.Policy.Type == policyUpdate.Type &&
+                p.Payload.Policy.Enabled == policyUpdate.Enabled &&
+                p.Payload.Policy.Data == policyUpdate.Data));
+    }
+
     /// <summary>
     /// Returns a new SutProvider with the PolicyValidators registered in the Sut.
     /// </summary>

test/Core.Test/AdminConsole/Services/EventIntegrationEventWriteServiceTests.cs

@@ -38,6 +38,20 @@ public class EventIntegrationEventWriteServiceTests
             organizationId: Arg.Is<string>(orgId => eventMessage.OrganizationId.ToString().Equals(orgId)));
     }
 
+    [Fact]
+    public async Task CreateManyAsync_EmptyList_DoesNothing()
+    {
+        await Subject.CreateManyAsync([]);
+        await _eventIntegrationPublisher.DidNotReceiveWithAnyArgs().PublishEventAsync(Arg.Any<string>(), Arg.Any<string>());
+    }
+
+    [Fact]
+    public async Task DisposeAsync_DisposesEventIntegrationPublisher()
+    {
+        await Subject.DisposeAsync();
+        await _eventIntegrationPublisher.Received(1).DisposeAsync();
+    }
+
     private static bool AssertJsonStringsMatch(EventMessage expected, string body)
     {
         var actual = JsonSerializer.Deserialize<EventMessage>(body);

test/Core.Test/AdminConsole/Services/EventIntegrationHandlerTests.cs

@@ -1,10 +1,11 @@
 using System.Text.Json;
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.AdminConsole.Models.Data.EventIntegrations;
-using Bit.Core.Entities;
+using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Enums;
 using Bit.Core.Models.Data;
 using Bit.Core.Models.Data.Organizations;
+using Bit.Core.Models.Data.Organizations.OrganizationUsers;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Test.Common.AutoFixture;
@@ -13,6 +14,7 @@ using Bit.Test.Common.Helpers;
 using Microsoft.Extensions.Logging;
 using NSubstitute;
 using Xunit;
+using ZiggyCreatures.Caching.Fusion;
 
 namespace Bit.Core.Test.Services;
 
@@ -20,9 +22,10 @@ namespace Bit.Core.Test.Services;
 public class EventIntegrationHandlerTests
 {
     private const string _templateBase = "Date: #Date#, Type: #Type#, UserId: #UserId#";
+    private const string _templateWithGroup = "Group: #GroupName#";
     private const string _templateWithOrganization = "Org: #OrganizationName#";
-    private const string _templateWithUser = "#UserName#, #UserEmail#";
-    private const string _templateWithActingUser = "#ActingUserName#, #ActingUserEmail#";
+    private const string _templateWithUser = "#UserName#, #UserEmail#, #UserType#";
+    private const string _templateWithActingUser = "#ActingUserName#, #ActingUserEmail#, #ActingUserType#";
     private static readonly Guid _organizationId = Guid.NewGuid();
     private static readonly Uri _uri = new Uri("https://localhost");
     private static readonly Uri _uri2 = new Uri("https://example.com");
@@ -45,7 +48,7 @@ public class EventIntegrationHandlerTests
             .Create();
     }
 
-    private static IntegrationMessage<WebhookIntegrationConfigurationDetails> expectedMessage(string template)
+    private static IntegrationMessage<WebhookIntegrationConfigurationDetails> ExpectedMessage(string template)
     {
         return new IntegrationMessage<WebhookIntegrationConfigurationDetails>()
         {
@@ -105,11 +108,237 @@ public class EventIntegrationHandlerTests
         config.Configuration = null;
         config.IntegrationConfiguration = JsonSerializer.Serialize(new { Uri = _uri });
         config.Template = _templateBase;
-        config.Filters = JsonSerializer.Serialize(new IntegrationFilterGroup() { });
+        config.Filters = JsonSerializer.Serialize(new IntegrationFilterGroup());
 
         return [config];
     }
 
+    [Theory, BitAutoData]
+    public async Task BuildContextAsync_ActingUserIdPresent_UsesCache(EventMessage eventMessage, OrganizationUserUserDetails actingUser)
+    {
+        var sutProvider = GetSutProvider(OneConfiguration(_templateWithActingUser));
+        var cache = sutProvider.GetDependency<IFusionCache>();
+
+        eventMessage.OrganizationId ??= Guid.NewGuid();
+        eventMessage.ActingUserId ??= Guid.NewGuid();
+
+        cache.GetOrSetAsync(
+            key: Arg.Any<string>(),
+            factory: Arg.Any<Func<FusionCacheFactoryExecutionContext<OrganizationUserUserDetails?>, CancellationToken, Task<OrganizationUserUserDetails?>>>()
+        ).Returns(actingUser);
+
+        var context = await sutProvider.Sut.BuildContextAsync(eventMessage, _templateWithActingUser);
+
+        await cache.Received(1).GetOrSetAsync(
+            key: Arg.Any<string>(),
+            factory: Arg.Any<Func<FusionCacheFactoryExecutionContext<OrganizationUserUserDetails?>, CancellationToken, Task<OrganizationUserUserDetails?>>>()
+        );
+
+        Assert.Equal(actingUser, context.ActingUser);
+    }
+
+    [Theory, BitAutoData]
+    public async Task BuildContextAsync_ActingUserIdNull_SkipsCache(EventMessage eventMessage)
+    {
+        var sutProvider = GetSutProvider(OneConfiguration(_templateWithActingUser));
+        var cache = sutProvider.GetDependency<IFusionCache>();
+
+        eventMessage.OrganizationId ??= Guid.NewGuid();
+        eventMessage.ActingUserId = null;
+
+        var context = await sutProvider.Sut.BuildContextAsync(eventMessage, _templateWithActingUser);
+
+        await cache.DidNotReceive().GetOrSetAsync(
+            key: Arg.Any<string>(),
+            factory: Arg.Any<Func<FusionCacheFactoryExecutionContext<OrganizationUserUserDetails?>, CancellationToken, Task<OrganizationUserUserDetails?>>>()
+        );
+        Assert.Null(context.ActingUser);
+    }
+
+    [Theory, BitAutoData]
+    public async Task BuildContextAsync_ActingUserOrganizationIdNull_SkipsCache(EventMessage eventMessage)
+    {
+        var sutProvider = GetSutProvider(OneConfiguration(_templateWithActingUser));
+        var cache = sutProvider.GetDependency<IFusionCache>();
+
+        eventMessage.OrganizationId = null;
+        eventMessage.ActingUserId ??= Guid.NewGuid();
+
+        var context = await sutProvider.Sut.BuildContextAsync(eventMessage, _templateWithActingUser);
+
+        await cache.DidNotReceive().GetOrSetAsync(
+            key: Arg.Any<string>(),
+            factory: Arg.Any<Func<FusionCacheFactoryExecutionContext<OrganizationUserUserDetails?>, CancellationToken, Task<OrganizationUserUserDetails?>>>()
+        );
+        Assert.Null(context.ActingUser);
+    }
+
+    [Theory, BitAutoData]
+    public async Task BuildContextAsync_GroupIdPresent_UsesCache(EventMessage eventMessage, Group group)
+    {
+        var sutProvider = GetSutProvider(OneConfiguration(_templateWithGroup));
+        var cache = sutProvider.GetDependency<IFusionCache>();
+
+        eventMessage.GroupId ??= Guid.NewGuid();
+
+        cache.GetOrSetAsync(
+            key: Arg.Any<string>(),
+            factory: Arg.Any<Func<FusionCacheFactoryExecutionContext<Group?>, CancellationToken, Task<Group?>>>()
+        ).Returns(group);
+
+        var context = await sutProvider.Sut.BuildContextAsync(eventMessage, _templateWithGroup);
+
+        await cache.Received(1).GetOrSetAsync(
+            key: Arg.Any<string>(),
+            factory: Arg.Any<Func<FusionCacheFactoryExecutionContext<Group?>, CancellationToken, Task<Group?>>>()
+        );
+        Assert.Equal(group, context.Group);
+    }
+
+    [Theory, BitAutoData]
+    public async Task BuildContextAsync_GroupIdNull_SkipsCache(EventMessage eventMessage)
+    {
+        var sutProvider = GetSutProvider(OneConfiguration(_templateWithGroup));
+        var cache = sutProvider.GetDependency<IFusionCache>();
+        eventMessage.GroupId = null;
+
+        var context = await sutProvider.Sut.BuildContextAsync(eventMessage, _templateWithGroup);
+
+        await cache.DidNotReceive().GetOrSetAsync(
+            key: Arg.Any<string>(),
+            factory: Arg.Any<Func<FusionCacheFactoryExecutionContext<Group?>, CancellationToken, Task<Group?>>>()
+        );
+        Assert.Null(context.Group);
+    }
+
+    [Theory, BitAutoData]
+    public async Task BuildContextAsync_OrganizationIdPresent_UsesCache(EventMessage eventMessage, Organization organization)
+    {
+        var sutProvider = GetSutProvider(OneConfiguration(_templateWithOrganization));
+        var cache = sutProvider.GetDependency<IFusionCache>();
+
+        eventMessage.OrganizationId ??= Guid.NewGuid();
+
+        cache.GetOrSetAsync(
+            key: Arg.Any<string>(),
+            factory: Arg.Any<Func<FusionCacheFactoryExecutionContext<Organization?>, CancellationToken, Task<Organization?>>>()
+        ).Returns(organization);
+
+        var context = await sutProvider.Sut.BuildContextAsync(eventMessage, _templateWithOrganization);
+
+        await cache.Received(1).GetOrSetAsync(
+            key: Arg.Any<string>(),
+            factory: Arg.Any<Func<FusionCacheFactoryExecutionContext<Organization?>, CancellationToken, Task<Organization?>>>()
+        );
+        Assert.Equal(organization, context.Organization);
+    }
+
+    [Theory, BitAutoData]
+    public async Task BuildContextAsync_OrganizationIdNull_SkipsCache(EventMessage eventMessage)
+    {
+        var sutProvider = GetSutProvider(OneConfiguration(_templateWithOrganization));
+        var cache = sutProvider.GetDependency<IFusionCache>();
+
+        eventMessage.OrganizationId = null;
+
+        var context = await sutProvider.Sut.BuildContextAsync(eventMessage, _templateWithOrganization);
+
+        await cache.DidNotReceive().GetOrSetAsync(
+            key: Arg.Any<string>(),
+            factory: Arg.Any<Func<FusionCacheFactoryExecutionContext<Organization?>, CancellationToken, Task<Organization?>>>()
+        );
+        Assert.Null(context.Organization);
+    }
+
+    [Theory, BitAutoData]
+    public async Task BuildContextAsync_UserIdPresent_UsesCache(EventMessage eventMessage, OrganizationUserUserDetails userDetails)
+    {
+        var sutProvider = GetSutProvider(OneConfiguration(_templateWithUser));
+        var cache = sutProvider.GetDependency<IFusionCache>();
+
+        eventMessage.OrganizationId ??= Guid.NewGuid();
+        eventMessage.UserId ??= Guid.NewGuid();
+
+        cache.GetOrSetAsync(
+            key: Arg.Any<string>(),
+            factory: Arg.Any<Func<FusionCacheFactoryExecutionContext<OrganizationUserUserDetails?>, CancellationToken, Task<OrganizationUserUserDetails?>>>()
+        ).Returns(userDetails);
+
+        var context = await sutProvider.Sut.BuildContextAsync(eventMessage, _templateWithUser);
+
+        await cache.Received(1).GetOrSetAsync(
+            key: Arg.Any<string>(),
+            factory: Arg.Any<Func<FusionCacheFactoryExecutionContext<OrganizationUserUserDetails?>, CancellationToken, Task<OrganizationUserUserDetails?>>>()
+        );
+
+        Assert.Equal(userDetails, context.User);
+    }
+
+
+    [Theory, BitAutoData]
+    public async Task BuildContextAsync_UserIdNull_SkipsCache(EventMessage eventMessage)
+    {
+        var sutProvider = GetSutProvider(OneConfiguration(_templateWithUser));
+        var cache = sutProvider.GetDependency<IFusionCache>();
+
+        eventMessage.OrganizationId = null;
+        eventMessage.UserId ??= Guid.NewGuid();
+
+        var context = await sutProvider.Sut.BuildContextAsync(eventMessage, _templateWithUser);
+
+        await cache.DidNotReceive().GetOrSetAsync(
+            key: Arg.Any<string>(),
+            factory: Arg.Any<Func<FusionCacheFactoryExecutionContext<OrganizationUserUserDetails?>, CancellationToken, Task<OrganizationUserUserDetails?>>>()
+        );
+
+        Assert.Null(context.User);
+    }
+
+    [Theory, BitAutoData]
+    public async Task BuildContextAsync_OrganizationUserIdNull_SkipsCache(EventMessage eventMessage)
+    {
+        var sutProvider = GetSutProvider(OneConfiguration(_templateWithUser));
+        var cache = sutProvider.GetDependency<IFusionCache>();
+
+        eventMessage.OrganizationId ??= Guid.NewGuid();
+        eventMessage.UserId = null;
+
+        var context = await sutProvider.Sut.BuildContextAsync(eventMessage, _templateWithUser);
+
+        await cache.DidNotReceive().GetOrSetAsync(
+            key: Arg.Any<string>(),
+            factory: Arg.Any<Func<FusionCacheFactoryExecutionContext<OrganizationUserUserDetails?>, CancellationToken, Task<OrganizationUserUserDetails?>>>()
+        );
+
+        Assert.Null(context.User);
+    }
+
+    [Theory, BitAutoData]
+    public async Task BuildContextAsync_NoSpecialTokens_DoesNotCallAnyCache(EventMessage eventMessage)
+    {
+        var sutProvider = GetSutProvider(OneConfiguration(_templateWithUser));
+        var cache = sutProvider.GetDependency<IFusionCache>();
+
+        eventMessage.ActingUserId ??= Guid.NewGuid();
+        eventMessage.GroupId ??= Guid.NewGuid();
+        eventMessage.OrganizationId ??= Guid.NewGuid();
+        eventMessage.UserId ??= Guid.NewGuid();
+
+        await sutProvider.Sut.BuildContextAsync(eventMessage, _templateBase);
+
+        await cache.DidNotReceive().GetOrSetAsync(
+            key: Arg.Any<string>(),
+            factory: Arg.Any<Func<FusionCacheFactoryExecutionContext<Group?>, CancellationToken, Task<Group?>>>()
+        );
+        await cache.DidNotReceive().GetOrSetAsync(
+            key: Arg.Any<string>(),
+            factory: Arg.Any<Func<FusionCacheFactoryExecutionContext<Organization?>, CancellationToken, Task<Organization?>>>()
+        );
+        await cache.DidNotReceive().GetOrSetAsync(
+            key: Arg.Any<string>(),
+            factory: Arg.Any<Func<FusionCacheFactoryExecutionContext<OrganizationUserUserDetails?>, CancellationToken, Task<OrganizationUserUserDetails?>>>()
+        );
+    }
 
     [Theory, BitAutoData]
     public async Task HandleEventAsync_BaseTemplateNoConfigurations_DoesNothing(EventMessage eventMessage)
@@ -120,6 +349,16 @@ public class EventIntegrationHandlerTests
         Assert.Empty(_eventIntegrationPublisher.ReceivedCalls());
     }
 
+    [Theory, BitAutoData]
+    public async Task HandleEventAsync_NoOrganizationId_DoesNothing(EventMessage eventMessage)
+    {
+        var sutProvider = GetSutProvider(OneConfiguration(_templateBase));
+        eventMessage.OrganizationId = null;
+
+        await sutProvider.Sut.HandleEventAsync(eventMessage);
+        Assert.Empty(_eventIntegrationPublisher.ReceivedCalls());
+    }
+
     [Theory, BitAutoData]
     public async Task HandleEventAsync_BaseTemplateOneConfiguration_PublishesIntegrationMessage(EventMessage eventMessage)
     {
@@ -128,15 +367,16 @@ public class EventIntegrationHandlerTests
 
         await sutProvider.Sut.HandleEventAsync(eventMessage);
 
-        var expectedMessage = EventIntegrationHandlerTests.expectedMessage(
+        var expectedMessage = EventIntegrationHandlerTests.ExpectedMessage(
             $"Date: {eventMessage.Date}, Type: {eventMessage.Type}, UserId: {eventMessage.UserId}"
         );
 
         Assert.Single(_eventIntegrationPublisher.ReceivedCalls());
         await _eventIntegrationPublisher.Received(1).PublishAsync(Arg.Is(
             AssertHelper.AssertPropertyEqual(expectedMessage, new[] { "MessageId" })));
+        await sutProvider.GetDependency<IGroupRepository>().DidNotReceiveWithAnyArgs().GetByIdAsync(Arg.Any<Guid>());
         await sutProvider.GetDependency<IOrganizationRepository>().DidNotReceiveWithAnyArgs().GetByIdAsync(Arg.Any<Guid>());
-        await sutProvider.GetDependency<IUserRepository>().DidNotReceiveWithAnyArgs().GetByIdAsync(Arg.Any<Guid>());
+        await sutProvider.GetDependency<IOrganizationUserRepository>().DidNotReceiveWithAnyArgs().GetDetailsByOrganizationIdUserIdAsync(Arg.Any<Guid>(), Arg.Any<Guid>());
     }
 
     [Theory, BitAutoData]
@@ -147,7 +387,7 @@ public class EventIntegrationHandlerTests
 
         await sutProvider.Sut.HandleEventAsync(eventMessage);
 
-        var expectedMessage = EventIntegrationHandlerTests.expectedMessage(
+        var expectedMessage = EventIntegrationHandlerTests.ExpectedMessage(
             $"Date: {eventMessage.Date}, Type: {eventMessage.Type}, UserId: {eventMessage.UserId}"
         );
         await _eventIntegrationPublisher.Received(1).PublishAsync(Arg.Is(
@@ -157,72 +397,9 @@ public class EventIntegrationHandlerTests
         await _eventIntegrationPublisher.Received(1).PublishAsync(Arg.Is(
             AssertHelper.AssertPropertyEqual(expectedMessage, new[] { "MessageId" })));
 
+        await sutProvider.GetDependency<IGroupRepository>().DidNotReceiveWithAnyArgs().GetByIdAsync(Arg.Any<Guid>());
         await sutProvider.GetDependency<IOrganizationRepository>().DidNotReceiveWithAnyArgs().GetByIdAsync(Arg.Any<Guid>());
-        await sutProvider.GetDependency<IUserRepository>().DidNotReceiveWithAnyArgs().GetByIdAsync(Arg.Any<Guid>());
-    }
-
-    [Theory, BitAutoData]
-    public async Task HandleEventAsync_ActingUserTemplate_LoadsUserFromRepository(EventMessage eventMessage)
-    {
-        var sutProvider = GetSutProvider(OneConfiguration(_templateWithActingUser));
-        var user = Substitute.For<User>();
-        user.Email = "test@example.com";
-        user.Name = "Test";
-        eventMessage.OrganizationId = _organizationId;
-
-        sutProvider.GetDependency<IUserRepository>().GetByIdAsync(Arg.Any<Guid>()).Returns(user);
-        await sutProvider.Sut.HandleEventAsync(eventMessage);
-
-        var expectedMessage = EventIntegrationHandlerTests.expectedMessage($"{user.Name}, {user.Email}");
-
-        Assert.Single(_eventIntegrationPublisher.ReceivedCalls());
-        await _eventIntegrationPublisher.Received(1).PublishAsync(Arg.Is(
-            AssertHelper.AssertPropertyEqual(expectedMessage, new[] { "MessageId" })));
-        await sutProvider.GetDependency<IOrganizationRepository>().DidNotReceiveWithAnyArgs().GetByIdAsync(Arg.Any<Guid>());
-        await sutProvider.GetDependency<IUserRepository>().Received(1).GetByIdAsync(eventMessage.ActingUserId ?? Guid.Empty);
-    }
-
-    [Theory, BitAutoData]
-    public async Task HandleEventAsync_OrganizationTemplate_LoadsOrganizationFromRepository(EventMessage eventMessage)
-    {
-        var sutProvider = GetSutProvider(OneConfiguration(_templateWithOrganization));
-        var organization = Substitute.For<Organization>();
-        organization.Name = "Test";
-        eventMessage.OrganizationId = _organizationId;
-
-        sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(Arg.Any<Guid>()).Returns(organization);
-        await sutProvider.Sut.HandleEventAsync(eventMessage);
-
-        Assert.Single(_eventIntegrationPublisher.ReceivedCalls());
-
-        var expectedMessage = EventIntegrationHandlerTests.expectedMessage($"Org: {organization.Name}");
-
-        Assert.Single(_eventIntegrationPublisher.ReceivedCalls());
-        await _eventIntegrationPublisher.Received(1).PublishAsync(Arg.Is(
-            AssertHelper.AssertPropertyEqual(expectedMessage, new[] { "MessageId" })));
-        await sutProvider.GetDependency<IOrganizationRepository>().Received(1).GetByIdAsync(eventMessage.OrganizationId ?? Guid.Empty);
-        await sutProvider.GetDependency<IUserRepository>().DidNotReceiveWithAnyArgs().GetByIdAsync(Arg.Any<Guid>());
-    }
-
-    [Theory, BitAutoData]
-    public async Task HandleEventAsync_UserTemplate_LoadsUserFromRepository(EventMessage eventMessage)
-    {
-        var sutProvider = GetSutProvider(OneConfiguration(_templateWithUser));
-        var user = Substitute.For<User>();
-        user.Email = "test@example.com";
-        user.Name = "Test";
-        eventMessage.OrganizationId = _organizationId;
-
-        sutProvider.GetDependency<IUserRepository>().GetByIdAsync(Arg.Any<Guid>()).Returns(user);
-        await sutProvider.Sut.HandleEventAsync(eventMessage);
-
-        var expectedMessage = EventIntegrationHandlerTests.expectedMessage($"{user.Name}, {user.Email}");
-
-        Assert.Single(_eventIntegrationPublisher.ReceivedCalls());
-        await _eventIntegrationPublisher.Received(1).PublishAsync(Arg.Is(
-            AssertHelper.AssertPropertyEqual(expectedMessage, new[] { "MessageId" })));
-        await sutProvider.GetDependency<IOrganizationRepository>().DidNotReceiveWithAnyArgs().GetByIdAsync(Arg.Any<Guid>());
-        await sutProvider.GetDependency<IUserRepository>().Received(1).GetByIdAsync(eventMessage.UserId ?? Guid.Empty);
+        await sutProvider.GetDependency<IOrganizationUserRepository>().DidNotReceiveWithAnyArgs().GetDetailsByOrganizationIdUserIdAsync(Arg.Any<Guid>(), Arg.Any<Guid>());
     }
 
     [Theory, BitAutoData]
@@ -246,7 +423,7 @@ public class EventIntegrationHandlerTests
 
         await sutProvider.Sut.HandleEventAsync(eventMessage);
 
-        var expectedMessage = EventIntegrationHandlerTests.expectedMessage(
+        var expectedMessage = EventIntegrationHandlerTests.ExpectedMessage(
             $"Date: {eventMessage.Date}, Type: {eventMessage.Type}, UserId: {eventMessage.UserId}"
         );
 
@@ -288,7 +465,7 @@ public class EventIntegrationHandlerTests
 
         foreach (var eventMessage in eventMessages)
         {
-            var expectedMessage = EventIntegrationHandlerTests.expectedMessage(
+            var expectedMessage = EventIntegrationHandlerTests.ExpectedMessage(
                 $"Date: {eventMessage.Date}, Type: {eventMessage.Type}, UserId: {eventMessage.UserId}"
             );
             await _eventIntegrationPublisher.Received(1).PublishAsync(Arg.Is(
@@ -306,7 +483,7 @@ public class EventIntegrationHandlerTests
 
         foreach (var eventMessage in eventMessages)
         {
-            var expectedMessage = EventIntegrationHandlerTests.expectedMessage(
+            var expectedMessage = EventIntegrationHandlerTests.ExpectedMessage(
                 $"Date: {eventMessage.Date}, Type: {eventMessage.Type}, UserId: {eventMessage.UserId}"
             );
             await _eventIntegrationPublisher.Received(1).PublishAsync(Arg.Is(AssertHelper.AssertPropertyEqual(

test/Core.Test/AdminConsole/Services/EventRouteServiceTests.cs

@@ -1,65 +0,0 @@
-using Bit.Core.Models.Data;
-using Bit.Core.Services;
-using Bit.Test.Common.AutoFixture.Attributes;
-using NSubstitute;
-using Xunit;
-
-namespace Bit.Core.Test.Services;
-
-[SutProviderCustomize]
-public class EventRouteServiceTests
-{
-    private readonly IEventWriteService _broadcastEventWriteService = Substitute.For<IEventWriteService>();
-    private readonly IEventWriteService _storageEventWriteService = Substitute.For<IEventWriteService>();
-    private readonly IFeatureService _featureService = Substitute.For<IFeatureService>();
-    private readonly EventRouteService Subject;
-
-    public EventRouteServiceTests()
-    {
-        Subject = new EventRouteService(_broadcastEventWriteService, _storageEventWriteService, _featureService);
-    }
-
-    [Theory, BitAutoData]
-    public async Task CreateAsync_FlagDisabled_EventSentToStorageService(EventMessage eventMessage)
-    {
-        _featureService.IsEnabled(FeatureFlagKeys.EventBasedOrganizationIntegrations).Returns(false);
-
-        await Subject.CreateAsync(eventMessage);
-
-        await _broadcastEventWriteService.DidNotReceiveWithAnyArgs().CreateAsync(Arg.Any<EventMessage>());
-        await _storageEventWriteService.Received(1).CreateAsync(eventMessage);
-    }
-
-    [Theory, BitAutoData]
-    public async Task CreateAsync_FlagEnabled_EventSentToBroadcastService(EventMessage eventMessage)
-    {
-        _featureService.IsEnabled(FeatureFlagKeys.EventBasedOrganizationIntegrations).Returns(true);
-
-        await Subject.CreateAsync(eventMessage);
-
-        await _broadcastEventWriteService.Received(1).CreateAsync(eventMessage);
-        await _storageEventWriteService.DidNotReceiveWithAnyArgs().CreateAsync(Arg.Any<EventMessage>());
-    }
-
-    [Theory, BitAutoData]
-    public async Task CreateManyAsync_FlagDisabled_EventsSentToStorageService(IEnumerable<EventMessage> eventMessages)
-    {
-        _featureService.IsEnabled(FeatureFlagKeys.EventBasedOrganizationIntegrations).Returns(false);
-
-        await Subject.CreateManyAsync(eventMessages);
-
-        await _broadcastEventWriteService.DidNotReceiveWithAnyArgs().CreateManyAsync(Arg.Any<IEnumerable<EventMessage>>());
-        await _storageEventWriteService.Received(1).CreateManyAsync(eventMessages);
-    }
-
-    [Theory, BitAutoData]
-    public async Task CreateManyAsync_FlagEnabled_EventsSentToBroadcastService(IEnumerable<EventMessage> eventMessages)
-    {
-        _featureService.IsEnabled(FeatureFlagKeys.EventBasedOrganizationIntegrations).Returns(true);
-
-        await Subject.CreateManyAsync(eventMessages);
-
-        await _broadcastEventWriteService.Received(1).CreateManyAsync(eventMessages);
-        await _storageEventWriteService.DidNotReceiveWithAnyArgs().CreateManyAsync(Arg.Any<IEnumerable<EventMessage>>());
-    }
-}

test/Core.Test/AdminConsole/Services/IntegrationFilterServiceTests.cs

@@ -42,6 +42,35 @@ public class IntegrationFilterServiceTests
         Assert.True(_service.EvaluateFilterGroup(roundtrippedGroup, eventMessage));
     }
 
+    [Theory, BitAutoData]
+    public void EvaluateFilterGroup_EqualsUserIdString_Matches(EventMessage eventMessage)
+    {
+        var userId = Guid.NewGuid();
+        eventMessage.UserId = userId;
+
+        var group = new IntegrationFilterGroup
+        {
+            AndOperator = true,
+            Rules =
+            [
+                new()
+                {
+                    Property = "UserId",
+                    Operation = IntegrationFilterOperation.Equals,
+                    Value = userId.ToString()
+                }
+            ]
+        };
+
+        var result = _service.EvaluateFilterGroup(group, eventMessage);
+        Assert.True(result);
+
+        var jsonGroup = JsonSerializer.Serialize(group);
+        var roundtrippedGroup = JsonSerializer.Deserialize<IntegrationFilterGroup>(jsonGroup);
+        Assert.NotNull(roundtrippedGroup);
+        Assert.True(_service.EvaluateFilterGroup(roundtrippedGroup, eventMessage));
+    }
+
     [Theory, BitAutoData]
     public void EvaluateFilterGroup_EqualsUserId_DoesNotMatch(EventMessage eventMessage)
     {
@@ -281,6 +310,45 @@ public class IntegrationFilterServiceTests
         Assert.True(_service.EvaluateFilterGroup(roundtrippedGroup, eventMessage));
     }
 
+
+    [Theory, BitAutoData]
+    public void EvaluateFilterGroup_NestedGroups_AnyMatch(EventMessage eventMessage)
+    {
+        var id = Guid.NewGuid();
+        var collectionId = Guid.NewGuid();
+        eventMessage.UserId = id;
+        eventMessage.CollectionId = collectionId;
+
+        var nestedGroup = new IntegrationFilterGroup
+        {
+            AndOperator = false,
+            Rules =
+            [
+                new() { Property = "UserId", Operation = IntegrationFilterOperation.Equals, Value = id },
+                new()
+                {
+                    Property = "CollectionId",
+                    Operation = IntegrationFilterOperation.In,
+                    Value = new Guid?[] { Guid.NewGuid() }
+                }
+            ]
+        };
+
+        var topGroup = new IntegrationFilterGroup
+        {
+            AndOperator = false,
+            Groups = [nestedGroup]
+        };
+
+        var result = _service.EvaluateFilterGroup(topGroup, eventMessage);
+        Assert.True(result);
+
+        var jsonGroup = JsonSerializer.Serialize(topGroup);
+        var roundtrippedGroup = JsonSerializer.Deserialize<IntegrationFilterGroup>(jsonGroup);
+        Assert.NotNull(roundtrippedGroup);
+        Assert.True(_service.EvaluateFilterGroup(roundtrippedGroup, eventMessage));
+    }
+
     [Theory, BitAutoData]
     public void EvaluateFilterGroup_UnknownProperty_ReturnsFalse(EventMessage eventMessage)
     {

test/Core.Test/AdminConsole/Services/OrganizationServiceTests.cs

@@ -21,8 +21,8 @@ using Bit.Core.Services;
 using Bit.Core.Settings;
 using Bit.Core.Test.AutoFixture.OrganizationFixtures;
 using Bit.Core.Test.AutoFixture.OrganizationUserFixtures;
+using Bit.Core.Test.Billing.Mocks;
 using Bit.Core.Tokens;
-using Bit.Core.Utilities;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using Bit.Test.Common.Fakes;
@@ -618,7 +618,7 @@ public class OrganizationServiceTests
         SetupOrgUserRepositoryCreateManyAsyncMock(organizationUserRepository);
         SetupOrgUserRepositoryCreateAsyncMock(organizationUserRepository);
 
-        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(organization.PlanType).Returns(StaticStore.GetPlan(organization.PlanType));
+        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(organization.PlanType).Returns(MockPlans.Get(organization.PlanType));
 
         await sutProvider.Sut.InviteUsersAsync(organization.Id, savingUser.Id, systemUser: null, invites);
 
@@ -666,7 +666,7 @@ public class OrganizationServiceTests
             .SendInvitesAsync(Arg.Any<SendInvitesRequest>()).ThrowsAsync<Exception>();
 
         sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(organization.PlanType)
-            .Returns(StaticStore.GetPlan(organization.PlanType));
+            .Returns(MockPlans.Get(organization.PlanType));
 
         await Assert.ThrowsAsync<AggregateException>(async () =>
             await sutProvider.Sut.InviteUsersAsync(organization.Id, savingUser.Id, systemUser: null, invites));
@@ -732,7 +732,7 @@ public class OrganizationServiceTests
         sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(organization.Id).Returns(organization);
 
         sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(organization.PlanType)
-            .Returns(StaticStore.GetPlan(organization.PlanType));
+            .Returns(MockPlans.Get(organization.PlanType));
 
         var exception = await Assert.ThrowsAsync<BadRequestException>(() => sutProvider.Sut.UpdateSubscription(organization.Id,
             seatAdjustment, maxAutoscaleSeats));
@@ -757,7 +757,7 @@ public class OrganizationServiceTests
         organization.SmSeats = 100;
 
         sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(organization.PlanType)
-            .Returns(StaticStore.GetPlan(organization.PlanType));
+            .Returns(MockPlans.Get(organization.PlanType));
         sutProvider.GetDependency<IOrganizationRepository>()
             .GetOccupiedSeatCountByOrganizationIdAsync(organization.Id).Returns(new OrganizationSeatCounts
             {
@@ -837,7 +837,7 @@ public class OrganizationServiceTests
     [BitAutoData(PlanType.EnterpriseMonthly)]
     public void ValidateSecretsManagerPlan_ThrowsException_WhenNoSecretsManagerSeats(PlanType planType, SutProvider<OrganizationService> sutProvider)
     {
-        var plan = StaticStore.GetPlan(planType);
+        var plan = MockPlans.Get(planType);
         var signup = new OrganizationUpgrade
         {
             UseSecretsManager = true,
@@ -854,7 +854,7 @@ public class OrganizationServiceTests
     [BitAutoData(PlanType.Free)]
     public void ValidateSecretsManagerPlan_ThrowsException_WhenSubtractingSeats(PlanType planType, SutProvider<OrganizationService> sutProvider)
     {
-        var plan = StaticStore.GetPlan(planType);
+        var plan = MockPlans.Get(planType);
         var signup = new OrganizationUpgrade
         {
             UseSecretsManager = true,
@@ -871,7 +871,7 @@ public class OrganizationServiceTests
         PlanType planType,
         SutProvider<OrganizationService> sutProvider)
     {
-        var plan = StaticStore.GetPlan(planType);
+        var plan = MockPlans.Get(planType);
         var signup = new OrganizationUpgrade
         {
             UseSecretsManager = true,
@@ -890,7 +890,7 @@ public class OrganizationServiceTests
     [BitAutoData(PlanType.EnterpriseMonthly)]
     public void ValidateSecretsManagerPlan_ThrowsException_WhenMoreSeatsThanPasswordManagerSeats(PlanType planType, SutProvider<OrganizationService> sutProvider)
     {
-        var plan = StaticStore.GetPlan(planType);
+        var plan = MockPlans.Get(planType);
         var signup = new OrganizationUpgrade
         {
             UseSecretsManager = true,
@@ -912,7 +912,7 @@ public class OrganizationServiceTests
         PlanType planType,
         SutProvider<OrganizationService> sutProvider)
     {
-        var plan = StaticStore.GetPlan(planType);
+        var plan = MockPlans.Get(planType);
         var signup = new OrganizationUpgrade
         {
             UseSecretsManager = true,
@@ -930,7 +930,7 @@ public class OrganizationServiceTests
         PlanType planType,
         SutProvider<OrganizationService> sutProvider)
     {
-        var plan = StaticStore.GetPlan(planType);
+        var plan = MockPlans.Get(planType);
         var signup = new OrganizationUpgrade
         {
             UseSecretsManager = true,
@@ -952,7 +952,7 @@ public class OrganizationServiceTests
         PlanType planType,
         SutProvider<OrganizationService> sutProvider)
     {
-        var plan = StaticStore.GetPlan(planType);
+        var plan = MockPlans.Get(planType);
         var signup = new OrganizationUpgrade
         {
             UseSecretsManager = true,

test/Core.Test/AdminConsole/Services/SlackIntegrationHandlerTests.cs

@@ -1,4 +1,5 @@
 using Bit.Core.AdminConsole.Models.Data.EventIntegrations;
+using Bit.Core.Models.Slack;
 using Bit.Core.Services;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
@@ -28,6 +29,9 @@ public class SlackIntegrationHandlerTests
         var sutProvider = GetSutProvider();
         message.Configuration = new SlackIntegrationConfigurationDetails(_channelId, _token);
 
+        _slackService.SendSlackMessageByChannelIdAsync(Arg.Any<string>(), Arg.Any<string>(), Arg.Any<string>())
+            .Returns(new SlackSendMessageResponse() { Ok = true, Channel = _channelId });
+
         var result = await sutProvider.Sut.HandleAsync(message);
 
         Assert.True(result.Success);
@@ -39,4 +43,97 @@ public class SlackIntegrationHandlerTests
             Arg.Is(AssertHelper.AssertPropertyEqual(_channelId))
         );
     }
+
+    [Theory]
+    [InlineData("service_unavailable")]
+    [InlineData("ratelimited")]
+    [InlineData("rate_limited")]
+    [InlineData("internal_error")]
+    [InlineData("message_limit_exceeded")]
+    public async Task HandleAsync_FailedRetryableRequest_ReturnsFailureWithRetryable(string error)
+    {
+        var sutProvider = GetSutProvider();
+        var message = new IntegrationMessage<SlackIntegrationConfigurationDetails>()
+        {
+            Configuration = new SlackIntegrationConfigurationDetails(_channelId, _token),
+            MessageId = "MessageId",
+            RenderedTemplate = "Test Message"
+        };
+
+        _slackService.SendSlackMessageByChannelIdAsync(Arg.Any<string>(), Arg.Any<string>(), Arg.Any<string>())
+            .Returns(new SlackSendMessageResponse() { Ok = false, Channel = _channelId, Error = error });
+
+        var result = await sutProvider.Sut.HandleAsync(message);
+
+        Assert.False(result.Success);
+        Assert.True(result.Retryable);
+        Assert.NotNull(result.FailureReason);
+        Assert.Equal(result.Message, message);
+
+        await sutProvider.GetDependency<ISlackService>().Received(1).SendSlackMessageByChannelIdAsync(
+            Arg.Is(AssertHelper.AssertPropertyEqual(_token)),
+            Arg.Is(AssertHelper.AssertPropertyEqual(message.RenderedTemplate)),
+            Arg.Is(AssertHelper.AssertPropertyEqual(_channelId))
+        );
+    }
+
+    [Theory]
+    [InlineData("access_denied")]
+    [InlineData("channel_not_found")]
+    [InlineData("token_expired")]
+    [InlineData("token_revoked")]
+    public async Task HandleAsync_FailedNonRetryableRequest_ReturnsNonRetryableFailure(string error)
+    {
+        var sutProvider = GetSutProvider();
+        var message = new IntegrationMessage<SlackIntegrationConfigurationDetails>()
+        {
+            Configuration = new SlackIntegrationConfigurationDetails(_channelId, _token),
+            MessageId = "MessageId",
+            RenderedTemplate = "Test Message"
+        };
+
+        _slackService.SendSlackMessageByChannelIdAsync(Arg.Any<string>(), Arg.Any<string>(), Arg.Any<string>())
+            .Returns(new SlackSendMessageResponse() { Ok = false, Channel = _channelId, Error = error });
+
+        var result = await sutProvider.Sut.HandleAsync(message);
+
+        Assert.False(result.Success);
+        Assert.False(result.Retryable);
+        Assert.NotNull(result.FailureReason);
+        Assert.Equal(result.Message, message);
+
+        await sutProvider.GetDependency<ISlackService>().Received(1).SendSlackMessageByChannelIdAsync(
+            Arg.Is(AssertHelper.AssertPropertyEqual(_token)),
+            Arg.Is(AssertHelper.AssertPropertyEqual(message.RenderedTemplate)),
+            Arg.Is(AssertHelper.AssertPropertyEqual(_channelId))
+        );
+    }
+
+    [Fact]
+    public async Task HandleAsync_NullResponse_ReturnsNonRetryableFailure()
+    {
+        var sutProvider = GetSutProvider();
+        var message = new IntegrationMessage<SlackIntegrationConfigurationDetails>()
+        {
+            Configuration = new SlackIntegrationConfigurationDetails(_channelId, _token),
+            MessageId = "MessageId",
+            RenderedTemplate = "Test Message"
+        };
+
+        _slackService.SendSlackMessageByChannelIdAsync(Arg.Any<string>(), Arg.Any<string>(), Arg.Any<string>())
+            .Returns((SlackSendMessageResponse?)null);
+
+        var result = await sutProvider.Sut.HandleAsync(message);
+
+        Assert.False(result.Success);
+        Assert.False(result.Retryable);
+        Assert.Equal("Slack response was null", result.FailureReason);
+        Assert.Equal(result.Message, message);
+
+        await sutProvider.GetDependency<ISlackService>().Received(1).SendSlackMessageByChannelIdAsync(
+            Arg.Is(AssertHelper.AssertPropertyEqual(_token)),
+            Arg.Is(AssertHelper.AssertPropertyEqual(message.RenderedTemplate)),
+            Arg.Is(AssertHelper.AssertPropertyEqual(_channelId))
+        );
+    }
 }

test/Core.Test/AdminConsole/Services/SlackServiceTests.cs

@@ -146,6 +146,27 @@ public class SlackServiceTests
         Assert.Empty(result);
     }
 
+    [Fact]
+    public async Task GetChannelIdAsync_NoChannelFound_ReturnsEmptyResult()
+    {
+        var emptyResponse = JsonSerializer.Serialize(
+            new
+            {
+                ok = true,
+                channels = Array.Empty<string>(),
+                response_metadata = new { next_cursor = "" }
+            });
+
+        _handler.When(HttpMethod.Get)
+            .RespondWith(HttpStatusCode.OK)
+            .WithContent(new StringContent(emptyResponse));
+
+        var sutProvider = GetSutProvider();
+        var result = await sutProvider.Sut.GetChannelIdAsync(_token, "general");
+
+        Assert.Empty(result);
+    }
+
     [Fact]
     public async Task GetChannelIdAsync_ReturnsCorrectChannelId()
     {
@@ -235,6 +256,32 @@ public class SlackServiceTests
         Assert.Equal(string.Empty, result);
     }
 
+    [Fact]
+    public async Task GetDmChannelByEmailAsync_ApiErrorUnparsableDmResponse_ReturnsEmptyString()
+    {
+        var sutProvider = GetSutProvider();
+        var email = "user@example.com";
+        var userId = "U12345";
+
+        var userResponse = new
+        {
+            ok = true,
+            user = new { id = userId }
+        };
+
+        _handler.When($"https://slack.com/api/users.lookupByEmail?email={email}")
+            .RespondWith(HttpStatusCode.OK)
+            .WithContent(new StringContent(JsonSerializer.Serialize(userResponse)));
+
+        _handler.When("https://slack.com/api/conversations.open")
+            .RespondWith(HttpStatusCode.OK)
+            .WithContent(new StringContent("NOT JSON"));
+
+        var result = await sutProvider.Sut.GetDmChannelByEmailAsync(_token, email);
+
+        Assert.Equal(string.Empty, result);
+    }
+
     [Fact]
     public async Task GetDmChannelByEmailAsync_ApiErrorUserResponse_ReturnsEmptyString()
     {
@@ -244,7 +291,7 @@ public class SlackServiceTests
         var userResponse = new
         {
             ok = false,
-            error = "An error occured"
+            error = "An error occurred"
         };
 
         _handler.When($"https://slack.com/api/users.lookupByEmail?email={email}")
@@ -256,6 +303,21 @@ public class SlackServiceTests
         Assert.Equal(string.Empty, result);
     }
 
+    [Fact]
+    public async Task GetDmChannelByEmailAsync_ApiErrorUnparsableUserResponse_ReturnsEmptyString()
+    {
+        var sutProvider = GetSutProvider();
+        var email = "user@example.com";
+
+        _handler.When($"https://slack.com/api/users.lookupByEmail?email={email}")
+            .RespondWith(HttpStatusCode.OK)
+            .WithContent(new StringContent("Not JSON"));
+
+        var result = await sutProvider.Sut.GetDmChannelByEmailAsync(_token, email);
+
+        Assert.Equal(string.Empty, result);
+    }
+
     [Fact]
     public void GetRedirectUrl_ReturnsCorrectUrl()
     {
@@ -341,18 +403,29 @@ public class SlackServiceTests
     }
 
     [Fact]
-    public async Task SendSlackMessageByChannelId_Sends_Correct_Message()
+    public async Task SendSlackMessageByChannelId_Success_ReturnsSuccessfulResponse()
     {
         var sutProvider = GetSutProvider();
         var channelId = "C12345";
         var message = "Hello, Slack!";
 
+        var jsonResponse = JsonSerializer.Serialize(new
+        {
+            ok = true,
+            channel = channelId,
+        });
+
         _handler.When(HttpMethod.Post)
             .RespondWith(HttpStatusCode.OK)
-            .WithContent(new StringContent(string.Empty));
+            .WithContent(new StringContent(jsonResponse));
 
-        await sutProvider.Sut.SendSlackMessageByChannelIdAsync(_token, message, channelId);
+        var result = await sutProvider.Sut.SendSlackMessageByChannelIdAsync(_token, message, channelId);
 
+        // Response was parsed correctly
+        Assert.NotNull(result);
+        Assert.True(result.Ok);
+
+        // Request was sent correctly
         Assert.Single(_handler.CapturedRequests);
         var request = _handler.CapturedRequests[0];
         Assert.NotNull(request);
@@ -365,4 +438,62 @@ public class SlackServiceTests
         Assert.Equal(message, json.RootElement.GetProperty("text").GetString() ?? string.Empty);
         Assert.Equal(channelId, json.RootElement.GetProperty("channel").GetString() ?? string.Empty);
     }
+
+    [Fact]
+    public async Task SendSlackMessageByChannelId_Failure_ReturnsErrorResponse()
+    {
+        var sutProvider = GetSutProvider();
+        var channelId = "C12345";
+        var message = "Hello, Slack!";
+
+        var jsonResponse = JsonSerializer.Serialize(new
+        {
+            ok = false,
+            channel = channelId,
+            error = "error"
+        });
+
+        _handler.When(HttpMethod.Post)
+            .RespondWith(HttpStatusCode.OK)
+            .WithContent(new StringContent(jsonResponse));
+
+        var result = await sutProvider.Sut.SendSlackMessageByChannelIdAsync(_token, message, channelId);
+
+        // Response was parsed correctly
+        Assert.NotNull(result);
+        Assert.False(result.Ok);
+        Assert.NotNull(result.Error);
+    }
+
+    [Fact]
+    public async Task SendSlackMessageByChannelIdAsync_InvalidJson_ReturnsNull()
+    {
+        var sutProvider = GetSutProvider();
+        var channelId = "C12345";
+        var message = "Hello world!";
+
+        _handler.When(HttpMethod.Post)
+            .RespondWith(HttpStatusCode.OK)
+            .WithContent(new StringContent("Not JSON"));
+
+        var result = await sutProvider.Sut.SendSlackMessageByChannelIdAsync(_token, message, channelId);
+
+        Assert.Null(result);
+    }
+
+    [Fact]
+    public async Task SendSlackMessageByChannelIdAsync_HttpServerError_ReturnsNull()
+    {
+        var sutProvider = GetSutProvider();
+        var channelId = "C12345";
+        var message = "Hello world!";
+
+        _handler.When(HttpMethod.Post)
+            .RespondWith(HttpStatusCode.InternalServerError)
+            .WithContent(new StringContent(string.Empty));
+
+        var result = await sutProvider.Sut.SendSlackMessageByChannelIdAsync(_token, message, channelId);
+
+        Assert.Null(result);
+    }
 }

test/Core.Test/AdminConsole/Utilities/IntegrationTemplateProcessorTests.cs

@@ -83,6 +83,7 @@ public class IntegrationTemplateProcessorTests
     [Theory]
     [InlineData("User name is #UserName#")]
     [InlineData("Email: #UserEmail#")]
+    [InlineData("User type = #UserType#")]
     public void TemplateRequiresUser_ContainingKeys_ReturnsTrue(string template)
     {
         var result = IntegrationTemplateProcessor.TemplateRequiresUser(template);
@@ -102,6 +103,7 @@ public class IntegrationTemplateProcessorTests
     [Theory]
     [InlineData("Acting user is #ActingUserName#")]
     [InlineData("Acting user's email is #ActingUserEmail#")]
+    [InlineData("Acting user's type is #ActingUserType#")]
     public void TemplateRequiresActingUser_ContainingKeys_ReturnsTrue(string template)
     {
         var result = IntegrationTemplateProcessor.TemplateRequiresActingUser(template);
@@ -118,6 +120,25 @@ public class IntegrationTemplateProcessorTests
         Assert.False(result);
     }
 
+    [Theory]
+    [InlineData("Group name is #GroupName#!")]
+    [InlineData("Group: #GroupName#")]
+    public void TemplateRequiresGroup_ContainingKeys_ReturnsTrue(string template)
+    {
+        var result = IntegrationTemplateProcessor.TemplateRequiresGroup(template);
+        Assert.True(result);
+    }
+
+    [Theory]
+    [InlineData("#GroupId#")]  // This is on the base class, not fetched, so should be false
+    [InlineData("No Group Tokens")]
+    [InlineData("")]
+    public void TemplateRequiresGroup_EmptyInputOrNoMatchingKeys_ReturnsFalse(string template)
+    {
+        var result = IntegrationTemplateProcessor.TemplateRequiresGroup(template);
+        Assert.False(result);
+    }
+
     [Theory]
     [InlineData("Organization: #OrganizationName#")]
     [InlineData("Welcome to #OrganizationName#")]

test/Core.Test/Auth/Attributes/MarketingInitiativeValidationAttributeTests.cs

@@ -0,0 +1,70 @@
+using Bit.Core.Auth.Attributes;
+using Bit.Core.Auth.Models.Api.Request.Accounts;
+using Xunit;
+
+namespace Bit.Core.Test.Auth.Attributes;
+
+public class MarketingInitiativeValidationAttributeTests
+{
+    [Fact]
+    public void IsValid_NullValue_ReturnsTrue()
+    {
+        var sut = new MarketingInitiativeValidationAttribute();
+
+        var actual = sut.IsValid(null);
+
+        Assert.True(actual);
+    }
+
+    [Theory]
+    [InlineData(MarketingInitiativeConstants.Premium)]
+    public void IsValid_AcceptedValue_ReturnsTrue(string value)
+    {
+        var sut = new MarketingInitiativeValidationAttribute();
+
+        var actual = sut.IsValid(value);
+
+        Assert.True(actual);
+    }
+
+    [Theory]
+    [InlineData("invalid")]
+    [InlineData("")]
+    [InlineData("Premium")]          // case sensitive - capitalized
+    [InlineData("PREMIUM")]          // case sensitive - uppercase
+    [InlineData("premium ")]         // trailing space
+    [InlineData(" premium")]         // leading space
+    public void IsValid_InvalidStringValue_ReturnsFalse(string value)
+    {
+        var sut = new MarketingInitiativeValidationAttribute();
+
+        var actual = sut.IsValid(value);
+
+        Assert.False(actual);
+    }
+
+    [Theory]
+    [InlineData(123)]                   // integer
+    [InlineData(true)]                  // boolean
+    [InlineData(45.67)]                 // double
+    public void IsValid_NonStringValue_ReturnsFalse(object value)
+    {
+        var sut = new MarketingInitiativeValidationAttribute();
+
+        var actual = sut.IsValid(value);
+
+        Assert.False(actual);
+    }
+
+    [Fact]
+    public void ErrorMessage_ContainsAcceptedValues()
+    {
+        var sut = new MarketingInitiativeValidationAttribute();
+
+        var errorMessage = sut.ErrorMessage;
+
+        Assert.NotNull(errorMessage);
+        Assert.Contains("premium", errorMessage);
+        Assert.Contains("Marketing initiative type must be one of:", errorMessage);
+    }
+}

test/Core.Test/Auth/Models/Api/Request/Accounts/MarketingInitiativeConstantsSnapshotTests.cs

@@ -0,0 +1,18 @@
+using Bit.Core.Auth.Models.Api.Request.Accounts;
+using Xunit;
+
+namespace Bit.Core.Test.Auth.Models.Api.Request.Accounts;
+
+/// <summary>
+/// Snapshot tests to ensure the string constants in <see cref="MarketingInitiativeConstants"/> do not change unintentionally.
+/// If you intentionally change any of these values, please update the tests to reflect the new expected values.
+/// </summary>
+public class MarketingInitiativeConstantsSnapshotTests
+{
+    [Fact]
+    public void MarketingInitiativeConstants_HaveCorrectValues()
+    {
+        // Assert
+        Assert.Equal("premium", MarketingInitiativeConstants.Premium);
+    }
+}

test/Core.Test/Auth/UserFeatures/Registration/RegisterUserCommandTests.cs

@@ -7,6 +7,7 @@ using Bit.Core.Auth.Enums;
 using Bit.Core.Auth.Models;
 using Bit.Core.Auth.Models.Business.Tokenables;
 using Bit.Core.Auth.UserFeatures.Registration.Implementations;
+using Bit.Core.Billing.Enums;
 using Bit.Core.Entities;
 using Bit.Core.Exceptions;
 using Bit.Core.OrganizationFeatures.OrganizationSponsorships.FamiliesForEnterprise.Interfaces;
@@ -37,6 +38,12 @@ public class RegisterUserCommandTests
     public async Task RegisterUser_Succeeds(SutProvider<RegisterUserCommand> sutProvider, User user)
     {
         // Arrange
+        user.Email = $"test+{Guid.NewGuid()}@example.com";
+
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync(Arg.Any<string>())
+            .Returns(false);
+
         sutProvider.GetDependency<IUserService>()
             .CreateUserAsync(user)
             .Returns(IdentityResult.Success);
@@ -61,6 +68,12 @@ public class RegisterUserCommandTests
     public async Task RegisterUser_WhenCreateUserFails_ReturnsIdentityResultFailed(SutProvider<RegisterUserCommand> sutProvider, User user)
     {
         // Arrange
+        user.Email = $"test+{Guid.NewGuid()}@example.com";
+
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync(Arg.Any<string>())
+            .Returns(false);
+
         sutProvider.GetDependency<IUserService>()
             .CreateUserAsync(user)
             .Returns(IdentityResult.Failed());
@@ -80,6 +93,120 @@ public class RegisterUserCommandTests
             .SendWelcomeEmailAsync(Arg.Any<User>());
     }
 
+    // -----------------------------------------------------------------------------------------------
+    // RegisterSSOAutoProvisionedUserAsync tests
+    // -----------------------------------------------------------------------------------------------
+    [Theory, BitAutoData]
+    public async Task RegisterSSOAutoProvisionedUserAsync_Success(
+        User user,
+        Organization organization,
+        SutProvider<RegisterUserCommand> sutProvider)
+    {
+        // Arrange
+        user.Id = Guid.NewGuid();
+        organization.Id = Guid.NewGuid();
+        organization.Name = "Test Organization";
+
+        sutProvider.GetDependency<IUserService>()
+            .CreateUserAsync(user)
+            .Returns(IdentityResult.Success);
+
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.MjmlWelcomeEmailTemplates)
+            .Returns(true);
+
+        // Act
+        var result = await sutProvider.Sut.RegisterSSOAutoProvisionedUserAsync(user, organization);
+
+        // Assert
+        Assert.True(result.Succeeded);
+        await sutProvider.GetDependency<IUserService>()
+            .Received(1)
+            .CreateUserAsync(user);
+    }
+
+    [Theory, BitAutoData]
+    public async Task RegisterSSOAutoProvisionedUserAsync_UserRegistrationFails_ReturnsFailedResult(
+        User user,
+        Organization organization,
+        SutProvider<RegisterUserCommand> sutProvider)
+    {
+        // Arrange
+        var expectedError = new IdentityError();
+        sutProvider.GetDependency<IUserService>()
+            .CreateUserAsync(user)
+            .Returns(IdentityResult.Failed(expectedError));
+
+        // Act
+        var result = await sutProvider.Sut.RegisterSSOAutoProvisionedUserAsync(user, organization);
+
+        // Assert
+        Assert.False(result.Succeeded);
+        Assert.Contains(expectedError, result.Errors);
+        await sutProvider.GetDependency<IMailService>()
+            .DidNotReceive()
+            .SendOrganizationUserWelcomeEmailAsync(Arg.Any<User>(), Arg.Any<string>());
+    }
+
+    [Theory]
+    [BitAutoData(PlanType.EnterpriseAnnually)]
+    [BitAutoData(PlanType.EnterpriseMonthly)]
+    [BitAutoData(PlanType.TeamsAnnually)]
+    public async Task RegisterSSOAutoProvisionedUserAsync_EnterpriseOrg_SendsOrganizationWelcomeEmail(
+        PlanType planType,
+        User user,
+        Organization organization,
+        SutProvider<RegisterUserCommand> sutProvider)
+    {
+        // Arrange
+        organization.PlanType = planType;
+        organization.Name = "Enterprise Org";
+
+        sutProvider.GetDependency<IUserService>()
+            .CreateUserAsync(user)
+            .Returns(IdentityResult.Success);
+
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.MjmlWelcomeEmailTemplates)
+            .Returns(true);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByIdAsync(Arg.Any<Guid>())
+            .Returns((OrganizationUser)null);
+
+        // Act
+        await sutProvider.Sut.RegisterSSOAutoProvisionedUserAsync(user, organization);
+
+        // Assert
+        await sutProvider.GetDependency<IMailService>()
+            .Received(1)
+            .SendOrganizationUserWelcomeEmailAsync(user, organization.Name);
+    }
+
+    [Theory, BitAutoData]
+    public async Task RegisterSSOAutoProvisionedUserAsync_FeatureFlagDisabled_SendsLegacyWelcomeEmail(
+        User user,
+        Organization organization,
+        SutProvider<RegisterUserCommand> sutProvider)
+    {
+        // Arrange
+        sutProvider.GetDependency<IUserService>()
+            .CreateUserAsync(user)
+            .Returns(IdentityResult.Success);
+
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.MjmlWelcomeEmailTemplates)
+            .Returns(false);
+
+        // Act
+        await sutProvider.Sut.RegisterSSOAutoProvisionedUserAsync(user, organization);
+
+        // Assert
+        await sutProvider.GetDependency<IMailService>()
+            .Received(1)
+            .SendWelcomeEmailAsync(user);
+    }
+
     // -----------------------------------------------------------------------------------------------
     // RegisterUserWithOrganizationInviteToken tests
     // -----------------------------------------------------------------------------------------------
@@ -301,6 +428,138 @@ public class RegisterUserCommandTests
         Assert.Equal(expectedErrorMessage, exception.Message);
     }
 
+    [Theory]
+    [BitAutoData]
+    public async Task RegisterUserViaOrganizationInviteToken_BlockedDomainFromDifferentOrg_ThrowsBadRequestException(
+        SutProvider<RegisterUserCommand> sutProvider, User user, string masterPasswordHash, OrganizationUser orgUser, string orgInviteToken, Guid orgUserId)
+    {
+        // Arrange
+        user.Email = "user@blocked-domain.com";
+        orgUser.Email = user.Email;
+        orgUser.Id = orgUserId;
+        var blockingOrganizationId = Guid.NewGuid(); // Different org that has the domain blocked
+        orgUser.OrganizationId = Guid.NewGuid(); // The org they're trying to join
+
+        var orgInviteTokenable = new OrgUserInviteTokenable(orgUser);
+
+        sutProvider.GetDependency<IDataProtectorTokenFactory<OrgUserInviteTokenable>>()
+            .TryUnprotect(orgInviteToken, out Arg.Any<OrgUserInviteTokenable>())
+            .Returns(callInfo =>
+            {
+                callInfo[1] = orgInviteTokenable;
+                return true;
+            });
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByIdAsync(orgUserId)
+            .Returns(orgUser);
+
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.BlockClaimedDomainAccountCreation)
+            .Returns(true);
+
+        // Mock the new overload that excludes the organization - it should return true (domain IS blocked by another org)
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync("blocked-domain.com", orgUser.OrganizationId)
+            .Returns(true);
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(() =>
+            sutProvider.Sut.RegisterUserViaOrganizationInviteToken(user, masterPasswordHash, orgInviteToken, orgUserId));
+        Assert.Equal("This email address is claimed by an organization using Bitwarden.", exception.Message);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task RegisterUserViaOrganizationInviteToken_BlockedDomainFromSameOrg_Succeeds(
+        SutProvider<RegisterUserCommand> sutProvider, User user, string masterPasswordHash, OrganizationUser orgUser, string orgInviteToken, Guid orgUserId)
+    {
+        // Arrange
+        user.Email = "user@company-domain.com";
+        user.ReferenceData = null;
+        orgUser.Email = user.Email;
+        orgUser.Id = orgUserId;
+        // The organization owns the domain and is trying to invite the user
+        orgUser.OrganizationId = Guid.NewGuid();
+
+        var orgInviteTokenable = new OrgUserInviteTokenable(orgUser);
+
+        sutProvider.GetDependency<IDataProtectorTokenFactory<OrgUserInviteTokenable>>()
+            .TryUnprotect(orgInviteToken, out Arg.Any<OrgUserInviteTokenable>())
+            .Returns(callInfo =>
+            {
+                callInfo[1] = orgInviteTokenable;
+                return true;
+            });
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByIdAsync(orgUserId)
+            .Returns(orgUser);
+
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.BlockClaimedDomainAccountCreation)
+            .Returns(true);
+
+        // Mock the new overload - it should return false (domain is NOT blocked by OTHER orgs)
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync("company-domain.com", orgUser.OrganizationId)
+            .Returns(false);
+
+        sutProvider.GetDependency<IUserService>()
+            .CreateUserAsync(user, masterPasswordHash)
+            .Returns(IdentityResult.Success);
+
+        // Act
+        var result = await sutProvider.Sut.RegisterUserViaOrganizationInviteToken(user, masterPasswordHash, orgInviteToken, orgUserId);
+
+        // Assert
+        Assert.True(result.Succeeded);
+        await sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .Received(1)
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync("company-domain.com", orgUser.OrganizationId);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task RegisterUserViaOrganizationInviteToken_WithValidTokenButNullOrgUser_ThrowsBadRequestException(
+        SutProvider<RegisterUserCommand> sutProvider, User user, string masterPasswordHash, OrganizationUser orgUser, string orgInviteToken, Guid orgUserId)
+    {
+        // Arrange
+        user.Email = "user@example.com";
+        orgUser.Email = user.Email;
+        orgUser.Id = orgUserId;
+
+        var orgInviteTokenable = new OrgUserInviteTokenable(orgUser);
+
+        sutProvider.GetDependency<IDataProtectorTokenFactory<OrgUserInviteTokenable>>()
+            .TryUnprotect(orgInviteToken, out Arg.Any<OrgUserInviteTokenable>())
+            .Returns(callInfo =>
+            {
+                callInfo[1] = orgInviteTokenable;
+                return true;
+            });
+
+        // Mock GetByIdAsync to return null - simulating a deleted or non-existent organization user
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByIdAsync(orgUserId)
+            .Returns((OrganizationUser)null);
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(() =>
+            sutProvider.Sut.RegisterUserViaOrganizationInviteToken(user, masterPasswordHash, orgInviteToken, orgUserId));
+        Assert.Equal("Invalid organization user invitation.", exception.Message);
+
+        // Verify that GetByIdAsync was called
+        await sutProvider.GetDependency<IOrganizationUserRepository>()
+            .Received(1)
+            .GetByIdAsync(orgUserId);
+
+        // Verify that user creation was never attempted
+        await sutProvider.GetDependency<IUserService>()
+            .DidNotReceive()
+            .CreateUserAsync(Arg.Any<User>(), Arg.Any<string>());
+    }
+
     // -----------------------------------------------------------------------------------------------
     // RegisterUserViaEmailVerificationToken tests
     // -----------------------------------------------------------------------------------------------
@@ -310,6 +569,12 @@ public class RegisterUserCommandTests
     public async Task RegisterUserViaEmailVerificationToken_Succeeds(SutProvider<RegisterUserCommand> sutProvider, User user, string masterPasswordHash, string emailVerificationToken, bool receiveMarketingMaterials)
     {
         // Arrange
+        user.Email = $"test+{Guid.NewGuid()}@example.com";
+
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync(Arg.Any<string>())
+            .Returns(false);
+
         sutProvider.GetDependency<IDataProtectorTokenFactory<RegistrationEmailVerificationTokenable>>()
             .TryUnprotect(emailVerificationToken, out Arg.Any<RegistrationEmailVerificationTokenable>())
             .Returns(callInfo =>
@@ -342,6 +607,12 @@ public class RegisterUserCommandTests
     public async Task RegisterUserViaEmailVerificationToken_InvalidToken_ThrowsBadRequestException(SutProvider<RegisterUserCommand> sutProvider, User user, string masterPasswordHash, string emailVerificationToken, bool receiveMarketingMaterials)
     {
         // Arrange
+        user.Email = $"test+{Guid.NewGuid()}@example.com";
+
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync(Arg.Any<string>())
+            .Returns(false);
+
         sutProvider.GetDependency<IDataProtectorTokenFactory<RegistrationEmailVerificationTokenable>>()
             .TryUnprotect(emailVerificationToken, out Arg.Any<RegistrationEmailVerificationTokenable>())
             .Returns(callInfo =>
@@ -380,6 +651,12 @@ public class RegisterUserCommandTests
         string orgSponsoredFreeFamilyPlanInviteToken)
     {
         // Arrange
+        user.Email = $"test+{Guid.NewGuid()}@example.com";
+
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync(Arg.Any<string>())
+            .Returns(false);
+
         sutProvider.GetDependency<IValidateRedemptionTokenCommand>()
             .ValidateRedemptionTokenAsync(orgSponsoredFreeFamilyPlanInviteToken, user.Email)
             .Returns((true, new OrganizationSponsorship()));
@@ -409,6 +686,12 @@ public class RegisterUserCommandTests
         string masterPasswordHash, string orgSponsoredFreeFamilyPlanInviteToken)
     {
         // Arrange
+        user.Email = $"test+{Guid.NewGuid()}@example.com";
+
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync(Arg.Any<string>())
+            .Returns(false);
+
         sutProvider.GetDependency<IValidateRedemptionTokenCommand>()
             .ValidateRedemptionTokenAsync(orgSponsoredFreeFamilyPlanInviteToken, user.Email)
             .Returns((false, new OrganizationSponsorship()));
@@ -446,9 +729,14 @@ public class RegisterUserCommandTests
         EmergencyAccess emergencyAccess, string acceptEmergencyAccessInviteToken, Guid acceptEmergencyAccessId)
     {
         // Arrange
+        user.Email = $"test+{Guid.NewGuid()}@example.com";
         emergencyAccess.Email = user.Email;
         emergencyAccess.Id = acceptEmergencyAccessId;
 
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync(Arg.Any<string>())
+            .Returns(false);
+
         sutProvider.GetDependency<IDataProtectorTokenFactory<EmergencyAccessInviteTokenable>>()
             .TryUnprotect(acceptEmergencyAccessInviteToken, out Arg.Any<EmergencyAccessInviteTokenable>())
             .Returns(callInfo =>
@@ -482,9 +770,14 @@ public class RegisterUserCommandTests
         string masterPasswordHash, EmergencyAccess emergencyAccess, string acceptEmergencyAccessInviteToken, Guid acceptEmergencyAccessId)
     {
         // Arrange
+        user.Email = $"test+{Guid.NewGuid()}@example.com";
         emergencyAccess.Email = "wrong@email.com";
         emergencyAccess.Id = acceptEmergencyAccessId;
 
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync(Arg.Any<string>())
+            .Returns(false);
+
         sutProvider.GetDependency<IDataProtectorTokenFactory<EmergencyAccessInviteTokenable>>()
             .TryUnprotect(acceptEmergencyAccessInviteToken, out Arg.Any<EmergencyAccessInviteTokenable>())
             .Returns(callInfo =>
@@ -525,6 +818,8 @@ public class RegisterUserCommandTests
         User user, string masterPasswordHash, Guid providerUserId)
     {
         // Arrange
+        user.Email = $"test+{Guid.NewGuid()}@example.com";
+
         // Start with plaintext
         var nowMillis = CoreHelpers.ToEpocMilliseconds(DateTime.UtcNow);
         var decryptedProviderInviteToken = $"ProviderUserInvite {providerUserId} {user.Email} {nowMillis}";
@@ -547,6 +842,10 @@ public class RegisterUserCommandTests
         sutProvider.GetDependency<IGlobalSettings>()
             .OrganizationInviteExpirationHours.Returns(120); // 5 days
 
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync(Arg.Any<string>())
+            .Returns(false);
+
         sutProvider.GetDependency<IUserService>()
             .CreateUserAsync(user, masterPasswordHash)
             .Returns(IdentityResult.Success);
@@ -576,6 +875,8 @@ public class RegisterUserCommandTests
         User user, string masterPasswordHash, Guid providerUserId)
     {
         // Arrange
+        user.Email = $"test+{Guid.NewGuid()}@example.com";
+
         // Start with plaintext
         var nowMillis = CoreHelpers.ToEpocMilliseconds(DateTime.UtcNow);
         var decryptedProviderInviteToken = $"ProviderUserInvite {providerUserId} {user.Email} {nowMillis}";
@@ -598,6 +899,10 @@ public class RegisterUserCommandTests
         sutProvider.GetDependency<IGlobalSettings>()
             .OrganizationInviteExpirationHours.Returns(120); // 5 days
 
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync(Arg.Any<string>())
+            .Returns(false);
+
         // Using sutProvider in the parameters of the function means that the constructor has already run for the
         // command so we have to recreate it in order for our mock overrides to be used.
         sutProvider.Create();
@@ -646,5 +951,434 @@ public class RegisterUserCommandTests
         Assert.Equal("Open registration has been disabled by the system administrator.", result.Message);
     }
 
+    // -----------------------------------------------------------------------------------------------
+    // Domain blocking tests (BlockClaimedDomainAccountCreation policy)
+    // -----------------------------------------------------------------------------------------------
 
+    [Theory]
+    [BitAutoData]
+    public async Task RegisterUser_BlockedDomain_ThrowsBadRequestException(
+        SutProvider<RegisterUserCommand> sutProvider, User user)
+    {
+        // Arrange
+        user.Email = "user@blocked-domain.com";
+
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.BlockClaimedDomainAccountCreation)
+            .Returns(true);
+
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync("blocked-domain.com")
+            .Returns(true);
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(() =>
+            sutProvider.Sut.RegisterUser(user));
+        Assert.Equal("This email address is claimed by an organization using Bitwarden.", exception.Message);
+
+        // Verify user creation was never attempted
+        await sutProvider.GetDependency<IUserService>()
+            .DidNotReceive()
+            .CreateUserAsync(Arg.Any<User>());
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task RegisterUser_AllowedDomain_Succeeds(
+        SutProvider<RegisterUserCommand> sutProvider, User user)
+    {
+        // Arrange
+        user.Email = "user@allowed-domain.com";
+
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.BlockClaimedDomainAccountCreation)
+            .Returns(true);
+
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync("allowed-domain.com")
+            .Returns(false);
+
+        sutProvider.GetDependency<IUserService>()
+            .CreateUserAsync(user)
+            .Returns(IdentityResult.Success);
+
+        // Act
+        var result = await sutProvider.Sut.RegisterUser(user);
+
+        // Assert
+        Assert.True(result.Succeeded);
+        await sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .Received(1)
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync("allowed-domain.com");
+    }
+
+    // SendWelcomeEmail tests
+    // -----------------------------------------------------------------------------------------------
+    [Theory]
+    [BitAutoData(PlanType.FamiliesAnnually)]
+    [BitAutoData(PlanType.FamiliesAnnually2019)]
+    [BitAutoData(PlanType.Free)]
+    public async Task SendWelcomeEmail_FamilyOrg_SendsFamilyWelcomeEmail(
+        PlanType planType,
+        User user,
+        Organization organization,
+        SutProvider<RegisterUserCommand> sutProvider)
+    {
+        // Arrange
+        organization.PlanType = planType;
+        organization.Name = "Family Org";
+
+        sutProvider.GetDependency<IUserService>()
+            .CreateUserAsync(user)
+            .Returns(IdentityResult.Success);
+
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.MjmlWelcomeEmailTemplates)
+            .Returns(true);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByIdAsync(Arg.Any<Guid>())
+            .Returns((OrganizationUser)null);
+
+        // Act
+        await sutProvider.Sut.RegisterSSOAutoProvisionedUserAsync(user, organization);
+
+        // Assert
+        await sutProvider.GetDependency<IMailService>()
+            .Received(1)
+            .SendFreeOrgOrFamilyOrgUserWelcomeEmailAsync(user, organization.Name);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task RegisterUserViaEmailVerificationToken_BlockedDomain_ThrowsBadRequestException(
+        SutProvider<RegisterUserCommand> sutProvider, User user, string masterPasswordHash,
+        string emailVerificationToken, bool receiveMarketingMaterials)
+    {
+        // Arrange
+        user.Email = "user@blocked-domain.com";
+
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.BlockClaimedDomainAccountCreation)
+            .Returns(true);
+
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync("blocked-domain.com")
+            .Returns(true);
+
+        sutProvider.GetDependency<IDataProtectorTokenFactory<RegistrationEmailVerificationTokenable>>()
+            .TryUnprotect(emailVerificationToken, out Arg.Any<RegistrationEmailVerificationTokenable>())
+            .Returns(callInfo =>
+            {
+                callInfo[1] = new RegistrationEmailVerificationTokenable(user.Email, user.Name, receiveMarketingMaterials);
+                return true;
+            });
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(() =>
+            sutProvider.Sut.RegisterUserViaEmailVerificationToken(user, masterPasswordHash, emailVerificationToken));
+        Assert.Equal("This email address is claimed by an organization using Bitwarden.", exception.Message);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task RegisterUserViaOrganizationSponsoredFreeFamilyPlanInviteToken_BlockedDomain_ThrowsBadRequestException(
+        SutProvider<RegisterUserCommand> sutProvider, User user, string masterPasswordHash,
+        string orgSponsoredFreeFamilyPlanInviteToken)
+    {
+        // Arrange
+        user.Email = "user@blocked-domain.com";
+
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.BlockClaimedDomainAccountCreation)
+            .Returns(true);
+
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync("blocked-domain.com")
+            .Returns(true);
+
+        sutProvider.GetDependency<IValidateRedemptionTokenCommand>()
+            .ValidateRedemptionTokenAsync(orgSponsoredFreeFamilyPlanInviteToken, user.Email)
+            .Returns((true, new OrganizationSponsorship()));
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(() =>
+            sutProvider.Sut.RegisterUserViaOrganizationSponsoredFreeFamilyPlanInviteToken(user, masterPasswordHash, orgSponsoredFreeFamilyPlanInviteToken));
+        Assert.Equal("This email address is claimed by an organization using Bitwarden.", exception.Message);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task RegisterUserViaAcceptEmergencyAccessInviteToken_BlockedDomain_ThrowsBadRequestException(
+        SutProvider<RegisterUserCommand> sutProvider, User user, string masterPasswordHash,
+        EmergencyAccess emergencyAccess, string acceptEmergencyAccessInviteToken, Guid acceptEmergencyAccessId)
+    {
+        // Arrange
+        user.Email = "user@blocked-domain.com";
+        emergencyAccess.Email = user.Email;
+        emergencyAccess.Id = acceptEmergencyAccessId;
+
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.BlockClaimedDomainAccountCreation)
+            .Returns(true);
+
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync("blocked-domain.com")
+            .Returns(true);
+
+        sutProvider.GetDependency<IDataProtectorTokenFactory<EmergencyAccessInviteTokenable>>()
+            .TryUnprotect(acceptEmergencyAccessInviteToken, out Arg.Any<EmergencyAccessInviteTokenable>())
+            .Returns(callInfo =>
+            {
+                callInfo[1] = new EmergencyAccessInviteTokenable(emergencyAccess, 10);
+                return true;
+            });
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(() =>
+            sutProvider.Sut.RegisterUserViaAcceptEmergencyAccessInviteToken(user, masterPasswordHash, acceptEmergencyAccessInviteToken, acceptEmergencyAccessId));
+        Assert.Equal("This email address is claimed by an organization using Bitwarden.", exception.Message);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task RegisterUserViaProviderInviteToken_BlockedDomain_ThrowsBadRequestException(
+        SutProvider<RegisterUserCommand> sutProvider, User user, string masterPasswordHash, Guid providerUserId)
+    {
+        // Arrange
+        user.Email = "user@blocked-domain.com";
+
+        // Start with plaintext
+        var nowMillis = CoreHelpers.ToEpocMilliseconds(DateTime.UtcNow);
+        var decryptedProviderInviteToken = $"ProviderUserInvite {providerUserId} {user.Email} {nowMillis}";
+
+        // Get the byte array of the plaintext
+        var decryptedProviderInviteTokenByteArray = Encoding.UTF8.GetBytes(decryptedProviderInviteToken);
+
+        // Base64 encode the byte array (this is passed to protector.protect(bytes))
+        var base64EncodedProviderInvToken = WebEncoders.Base64UrlEncode(decryptedProviderInviteTokenByteArray);
+
+        var mockDataProtector = Substitute.For<IDataProtector>();
+
+        // Given any byte array, just return the decryptedProviderInviteTokenByteArray (sidestepping any actual encryption)
+        mockDataProtector.Unprotect(Arg.Any<byte[]>()).Returns(decryptedProviderInviteTokenByteArray);
+
+        sutProvider.GetDependency<IDataProtectionProvider>()
+            .CreateProtector("ProviderServiceDataProtector")
+            .Returns(mockDataProtector);
+
+        sutProvider.GetDependency<IGlobalSettings>()
+            .OrganizationInviteExpirationHours.Returns(120); // 5 days
+
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.BlockClaimedDomainAccountCreation)
+            .Returns(true);
+
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync("blocked-domain.com")
+            .Returns(true);
+
+        // Using sutProvider in the parameters of the function means that the constructor has already run for the
+        // command so we have to recreate it in order for our mock overrides to be used.
+        sutProvider.Create();
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(() =>
+            sutProvider.Sut.RegisterUserViaProviderInviteToken(user, masterPasswordHash, base64EncodedProviderInvToken, providerUserId));
+        Assert.Equal("This email address is claimed by an organization using Bitwarden.", exception.Message);
+    }
+
+    // -----------------------------------------------------------------------------------------------
+    // Invalid email format tests
+    // -----------------------------------------------------------------------------------------------
+
+    [Theory]
+    [BitAutoData]
+    public async Task RegisterUser_InvalidEmailFormat_ThrowsBadRequestException(
+        SutProvider<RegisterUserCommand> sutProvider, User user)
+    {
+        // Arrange
+        user.Email = "invalid-email-format";
+
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.BlockClaimedDomainAccountCreation)
+            .Returns(true);
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(() =>
+            sutProvider.Sut.RegisterUser(user));
+        Assert.Equal("Invalid email address format.", exception.Message);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task RegisterUserViaEmailVerificationToken_InvalidEmailFormat_ThrowsBadRequestException(
+        SutProvider<RegisterUserCommand> sutProvider, User user, string masterPasswordHash,
+        string emailVerificationToken, bool receiveMarketingMaterials)
+    {
+        // Arrange
+        user.Email = "invalid-email-format";
+
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.BlockClaimedDomainAccountCreation)
+            .Returns(true);
+
+        sutProvider.GetDependency<IDataProtectorTokenFactory<RegistrationEmailVerificationTokenable>>()
+            .TryUnprotect(emailVerificationToken, out Arg.Any<RegistrationEmailVerificationTokenable>())
+            .Returns(callInfo =>
+            {
+                callInfo[1] = new RegistrationEmailVerificationTokenable(user.Email, user.Name, receiveMarketingMaterials);
+                return true;
+            });
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(() =>
+            sutProvider.Sut.RegisterUserViaEmailVerificationToken(user, masterPasswordHash, emailVerificationToken));
+        Assert.Equal("Invalid email address format.", exception.Message);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task SendWelcomeEmail_OrganizationNull_SendsIndividualWelcomeEmail(
+        User user,
+        OrganizationUser orgUser,
+        string orgInviteToken,
+        string masterPasswordHash,
+        SutProvider<RegisterUserCommand> sutProvider)
+    {
+        // Arrange
+        user.ReferenceData = null;
+        orgUser.Email = user.Email;
+
+        sutProvider.GetDependency<IUserService>()
+            .CreateUserAsync(user, masterPasswordHash)
+            .Returns(IdentityResult.Success);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByIdAsync(orgUser.Id)
+            .Returns(orgUser);
+
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(Arg.Any<Guid>(), PolicyType.TwoFactorAuthentication)
+            .Returns((Policy)null);
+
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdAsync(orgUser.OrganizationId)
+            .Returns((Organization)null);
+
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.MjmlWelcomeEmailTemplates)
+            .Returns(true);
+
+        var orgInviteTokenable = new OrgUserInviteTokenable(orgUser);
+
+        sutProvider.GetDependency<IDataProtectorTokenFactory<OrgUserInviteTokenable>>()
+            .TryUnprotect(orgInviteToken, out Arg.Any<OrgUserInviteTokenable>())
+            .Returns(callInfo =>
+            {
+                callInfo[1] = orgInviteTokenable;
+                return true;
+            });
+
+        // Act
+        var result = await sutProvider.Sut.RegisterUserViaOrganizationInviteToken(user, masterPasswordHash, orgInviteToken, orgUser.Id);
+
+        // Assert
+        await sutProvider.GetDependency<IMailService>()
+            .Received(1)
+            .SendIndividualUserWelcomeEmailAsync(user);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task SendWelcomeEmail_OrganizationDisplayNameNull_SendsIndividualWelcomeEmail(
+        User user,
+        SutProvider<RegisterUserCommand> sutProvider)
+    {
+        // Arrange
+        Organization organization = new Organization
+        {
+            Name = null
+        };
+
+        sutProvider.GetDependency<IUserService>()
+            .CreateUserAsync(user)
+            .Returns(IdentityResult.Success);
+
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.MjmlWelcomeEmailTemplates)
+            .Returns(true);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByIdAsync(Arg.Any<Guid>())
+            .Returns((OrganizationUser)null);
+
+        // Act
+        await sutProvider.Sut.RegisterSSOAutoProvisionedUserAsync(user, organization);
+
+        // Assert
+        await sutProvider.GetDependency<IMailService>()
+            .Received(1)
+            .SendIndividualUserWelcomeEmailAsync(user);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task GetOrganizationWelcomeEmailDetailsAsync_HappyPath_ReturnsOrganizationWelcomeEmailDetails(
+        Organization organization,
+        User user,
+        OrganizationUser orgUser,
+        string masterPasswordHash,
+        string orgInviteToken,
+        SutProvider<RegisterUserCommand> sutProvider)
+    {
+        // Arrange
+        user.ReferenceData = null;
+        orgUser.Email = user.Email;
+        organization.PlanType = PlanType.EnterpriseAnnually;
+
+        sutProvider.GetDependency<IUserService>()
+            .CreateUserAsync(user, masterPasswordHash)
+            .Returns(IdentityResult.Success);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByIdAsync(orgUser.Id)
+            .Returns(orgUser);
+
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(Arg.Any<Guid>(), PolicyType.TwoFactorAuthentication)
+            .Returns((Policy)null);
+
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdAsync(orgUser.OrganizationId)
+            .Returns(organization);
+
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.MjmlWelcomeEmailTemplates)
+            .Returns(true);
+
+        var orgInviteTokenable = new OrgUserInviteTokenable(orgUser);
+
+        sutProvider.GetDependency<IDataProtectorTokenFactory<OrgUserInviteTokenable>>()
+            .TryUnprotect(orgInviteToken, out Arg.Any<OrgUserInviteTokenable>())
+            .Returns(callInfo =>
+            {
+                callInfo[1] = orgInviteTokenable;
+                return true;
+            });
+
+        // Act
+        var result = await sutProvider.Sut.RegisterUserViaOrganizationInviteToken(user, masterPasswordHash, orgInviteToken, orgUser.Id);
+
+        // Assert
+        Assert.True(result.Succeeded);
+
+        await sutProvider.GetDependency<IOrganizationRepository>()
+            .Received(1)
+            .GetByIdAsync(orgUser.OrganizationId);
+
+        await sutProvider.GetDependency<IMailService>()
+            .Received(1)
+            .SendOrganizationUserWelcomeEmailAsync(user, organization.DisplayName());
+    }
 }

test/Core.Test/Auth/UserFeatures/Registration/SendVerificationEmailForRegistrationCommandTests.cs

@@ -1,4 +1,5 @@
-using Bit.Core.Auth.Models.Business.Tokenables;
+using Bit.Core.Auth.Models.Api.Request.Accounts;
+using Bit.Core.Auth.Models.Business.Tokenables;
 using Bit.Core.Auth.UserFeatures.Registration.Implementations;
 using Bit.Core.Entities;
 using Bit.Core.Exceptions;
@@ -21,6 +22,43 @@ public class SendVerificationEmailForRegistrationCommandTests
     [Theory]
     [BitAutoData]
     public async Task SendVerificationEmailForRegistrationCommand_WhenIsNewUserAndEnableEmailVerificationTrue_SendsEmailAndReturnsNull(SutProvider<SendVerificationEmailForRegistrationCommand> sutProvider,
+        string name, bool receiveMarketingEmails)
+    {
+        // Arrange
+        var email = $"test+{Guid.NewGuid()}@example.com";
+
+        sutProvider.GetDependency<IUserRepository>()
+            .GetByEmailAsync(email)
+            .ReturnsNull();
+
+        sutProvider.GetDependency<GlobalSettings>()
+            .EnableEmailVerification = true;
+
+        sutProvider.GetDependency<GlobalSettings>()
+            .DisableUserRegistration = false;
+
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync(Arg.Any<string>())
+            .Returns(false);
+
+        var mockedToken = "token";
+        sutProvider.GetDependency<IDataProtectorTokenFactory<RegistrationEmailVerificationTokenable>>()
+            .Protect(Arg.Any<RegistrationEmailVerificationTokenable>())
+            .Returns(mockedToken);
+
+        // Act
+        var result = await sutProvider.Sut.Run(email, name, receiveMarketingEmails, null);
+
+        // Assert
+        await sutProvider.GetDependency<IMailService>()
+            .Received(1)
+            .SendRegistrationVerificationEmailAsync(email, mockedToken, null);
+        Assert.Null(result);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task SendVerificationEmailForRegistrationCommand_WhenFromMarketingIsPremium_SendsEmailWithMarketingParameterAndReturnsNull(SutProvider<SendVerificationEmailForRegistrationCommand> sutProvider,
         string email, string name, bool receiveMarketingEmails)
     {
         // Arrange
@@ -34,31 +72,35 @@ public class SendVerificationEmailForRegistrationCommandTests
         sutProvider.GetDependency<GlobalSettings>()
             .DisableUserRegistration = false;
 
-        sutProvider.GetDependency<IMailService>()
-            .SendRegistrationVerificationEmailAsync(email, Arg.Any<string>())
-            .Returns(Task.CompletedTask);
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync(Arg.Any<string>())
+            .Returns(false);
 
         var mockedToken = "token";
         sutProvider.GetDependency<IDataProtectorTokenFactory<RegistrationEmailVerificationTokenable>>()
             .Protect(Arg.Any<RegistrationEmailVerificationTokenable>())
             .Returns(mockedToken);
 
+        var fromMarketing = MarketingInitiativeConstants.Premium;
+
         // Act
-        var result = await sutProvider.Sut.Run(email, name, receiveMarketingEmails);
+        var result = await sutProvider.Sut.Run(email, name, receiveMarketingEmails, fromMarketing);
 
         // Assert
         await sutProvider.GetDependency<IMailService>()
             .Received(1)
-            .SendRegistrationVerificationEmailAsync(email, mockedToken);
+            .SendRegistrationVerificationEmailAsync(email, mockedToken, fromMarketing);
         Assert.Null(result);
     }
 
     [Theory]
     [BitAutoData]
     public async Task SendVerificationEmailForRegistrationCommand_WhenIsExistingUserAndEnableEmailVerificationTrue_ReturnsNull(SutProvider<SendVerificationEmailForRegistrationCommand> sutProvider,
-        string email, string name, bool receiveMarketingEmails)
+        string name, bool receiveMarketingEmails)
     {
         // Arrange
+        var email = $"test+{Guid.NewGuid()}@example.com";
+
         sutProvider.GetDependency<IUserRepository>()
             .GetByEmailAsync(email)
             .Returns(new User());
@@ -69,27 +111,33 @@ public class SendVerificationEmailForRegistrationCommandTests
         sutProvider.GetDependency<GlobalSettings>()
             .DisableUserRegistration = false;
 
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync(Arg.Any<string>())
+            .Returns(false);
+
         var mockedToken = "token";
         sutProvider.GetDependency<IDataProtectorTokenFactory<RegistrationEmailVerificationTokenable>>()
             .Protect(Arg.Any<RegistrationEmailVerificationTokenable>())
             .Returns(mockedToken);
 
         // Act
-        var result = await sutProvider.Sut.Run(email, name, receiveMarketingEmails);
+        var result = await sutProvider.Sut.Run(email, name, receiveMarketingEmails, null);
 
         // Assert
         await sutProvider.GetDependency<IMailService>()
             .DidNotReceive()
-            .SendRegistrationVerificationEmailAsync(email, mockedToken);
+            .SendRegistrationVerificationEmailAsync(email, mockedToken, null);
         Assert.Null(result);
     }
 
     [Theory]
     [BitAutoData]
     public async Task SendVerificationEmailForRegistrationCommand_WhenIsNewUserAndEnableEmailVerificationFalse_ReturnsToken(SutProvider<SendVerificationEmailForRegistrationCommand> sutProvider,
-        string email, string name, bool receiveMarketingEmails)
+        string name, bool receiveMarketingEmails)
     {
         // Arrange
+        var email = $"test+{Guid.NewGuid()}@example.com";
+
         sutProvider.GetDependency<IUserRepository>()
             .GetByEmailAsync(email)
             .ReturnsNull();
@@ -100,13 +148,17 @@ public class SendVerificationEmailForRegistrationCommandTests
         sutProvider.GetDependency<GlobalSettings>()
             .DisableUserRegistration = false;
 
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync(Arg.Any<string>())
+            .Returns(false);
+
         var mockedToken = "token";
         sutProvider.GetDependency<IDataProtectorTokenFactory<RegistrationEmailVerificationTokenable>>()
             .Protect(Arg.Any<RegistrationEmailVerificationTokenable>())
             .Returns(mockedToken);
 
         // Act
-        var result = await sutProvider.Sut.Run(email, name, receiveMarketingEmails);
+        var result = await sutProvider.Sut.Run(email, name, receiveMarketingEmails, null);
 
         // Assert
         Assert.Equal(mockedToken, result);
@@ -122,15 +174,17 @@ public class SendVerificationEmailForRegistrationCommandTests
             .DisableUserRegistration = true;
 
         // Act & Assert
-        await Assert.ThrowsAsync<BadRequestException>(() => sutProvider.Sut.Run(email, name, receiveMarketingEmails));
+        await Assert.ThrowsAsync<BadRequestException>(() => sutProvider.Sut.Run(email, name, receiveMarketingEmails, null));
     }
 
     [Theory]
     [BitAutoData]
     public async Task SendVerificationEmailForRegistrationCommand_WhenIsExistingUserAndEnableEmailVerificationFalse_ThrowsBadRequestException(SutProvider<SendVerificationEmailForRegistrationCommand> sutProvider,
-        string email, string name, bool receiveMarketingEmails)
+        string name, bool receiveMarketingEmails)
     {
         // Arrange
+        var email = $"test+{Guid.NewGuid()}@example.com";
+
         sutProvider.GetDependency<IUserRepository>()
             .GetByEmailAsync(email)
             .Returns(new User());
@@ -138,8 +192,15 @@ public class SendVerificationEmailForRegistrationCommandTests
         sutProvider.GetDependency<GlobalSettings>()
             .EnableEmailVerification = false;
 
+        sutProvider.GetDependency<GlobalSettings>()
+            .DisableUserRegistration = false;
+
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync(Arg.Any<string>())
+            .Returns(false);
+
         // Act & Assert
-        await Assert.ThrowsAsync<BadRequestException>(() => sutProvider.Sut.Run(email, name, receiveMarketingEmails));
+        await Assert.ThrowsAsync<BadRequestException>(() => sutProvider.Sut.Run(email, name, receiveMarketingEmails, null));
     }
 
     [Theory]
@@ -150,7 +211,7 @@ public class SendVerificationEmailForRegistrationCommandTests
         sutProvider.GetDependency<GlobalSettings>()
             .DisableUserRegistration = false;
 
-        await Assert.ThrowsAsync<ArgumentNullException>(async () => await sutProvider.Sut.Run(null, name, receiveMarketingEmails));
+        await Assert.ThrowsAsync<ArgumentNullException>(async () => await sutProvider.Sut.Run(null, name, receiveMarketingEmails, null));
     }
 
     [Theory]
@@ -160,6 +221,90 @@ public class SendVerificationEmailForRegistrationCommandTests
     {
         sutProvider.GetDependency<GlobalSettings>()
             .DisableUserRegistration = false;
-        await Assert.ThrowsAsync<ArgumentNullException>(async () => await sutProvider.Sut.Run("", name, receiveMarketingEmails));
+        await Assert.ThrowsAsync<ArgumentNullException>(async () => await sutProvider.Sut.Run("", name, receiveMarketingEmails, null));
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task SendVerificationEmailForRegistrationCommand_WhenBlockedDomain_ThrowsBadRequestException(SutProvider<SendVerificationEmailForRegistrationCommand> sutProvider,
+        string name, bool receiveMarketingEmails)
+    {
+        // Arrange
+        var email = $"test+{Guid.NewGuid()}@blockedcompany.com";
+
+        sutProvider.GetDependency<GlobalSettings>()
+            .DisableUserRegistration = false;
+
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.BlockClaimedDomainAccountCreation)
+            .Returns(true);
+
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync("blockedcompany.com")
+            .Returns(true);
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(() => sutProvider.Sut.Run(email, name, receiveMarketingEmails, null));
+        Assert.Equal("This email address is claimed by an organization using Bitwarden.", exception.Message);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task SendVerificationEmailForRegistrationCommand_WhenAllowedDomain_Succeeds(SutProvider<SendVerificationEmailForRegistrationCommand> sutProvider,
+        string name, bool receiveMarketingEmails)
+    {
+        // Arrange
+        var email = $"test+{Guid.NewGuid()}@allowedcompany.com";
+
+        sutProvider.GetDependency<IUserRepository>()
+            .GetByEmailAsync(email)
+            .ReturnsNull();
+
+        sutProvider.GetDependency<GlobalSettings>()
+            .EnableEmailVerification = false;
+
+        sutProvider.GetDependency<GlobalSettings>()
+            .DisableUserRegistration = false;
+
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.BlockClaimedDomainAccountCreation)
+            .Returns(true);
+
+        sutProvider.GetDependency<IOrganizationDomainRepository>()
+            .HasVerifiedDomainWithBlockClaimedDomainPolicyAsync("allowedcompany.com")
+            .Returns(false);
+
+        var mockedToken = "token";
+        sutProvider.GetDependency<IDataProtectorTokenFactory<RegistrationEmailVerificationTokenable>>()
+            .Protect(Arg.Any<RegistrationEmailVerificationTokenable>())
+            .Returns(mockedToken);
+
+        // Act
+        var result = await sutProvider.Sut.Run(email, name, receiveMarketingEmails, null);
+
+        // Assert
+        Assert.Equal(mockedToken, result);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task SendVerificationEmailForRegistrationCommand_InvalidEmailFormat_ThrowsBadRequestException(
+        SutProvider<SendVerificationEmailForRegistrationCommand> sutProvider,
+        string name, bool receiveMarketingEmails)
+    {
+        // Arrange
+        var email = "invalid-email-format";
+
+        sutProvider.GetDependency<GlobalSettings>()
+            .DisableUserRegistration = false;
+
+        sutProvider.GetDependency<IFeatureService>()
+            .IsEnabled(FeatureFlagKeys.BlockClaimedDomainAccountCreation)
+            .Returns(true);
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(() =>
+            sutProvider.Sut.Run(email, name, receiveMarketingEmails, null));
+        Assert.Equal("Invalid email address format.", exception.Message);
     }
 }

test/Core.Test/Auth/UserFeatures/Sso/UserSsoOrganizationIdentifierQueryTests.cs

@@ -0,0 +1,275 @@
+using Bit.Core.AdminConsole.Entities;
+using Bit.Core.Auth.Sso;
+using Bit.Core.Entities;
+using Bit.Core.Enums;
+using Bit.Core.Repositories;
+using Bit.Test.Common.AutoFixture;
+using Bit.Test.Common.AutoFixture.Attributes;
+using NSubstitute;
+using Xunit;
+
+namespace Bit.Core.Test.Auth.UserFeatures.Sso;
+
+[SutProviderCustomize]
+public class UserSsoOrganizationIdentifierQueryTests
+{
+    [Theory, BitAutoData]
+    public async Task GetSsoOrganizationIdentifierAsync_UserHasSingleConfirmedOrganization_ReturnsIdentifier(
+        SutProvider<UserSsoOrganizationIdentifierQuery> sutProvider,
+        Guid userId,
+        Organization organization,
+        OrganizationUser organizationUser)
+    {
+        // Arrange
+        organizationUser.UserId = userId;
+        organizationUser.OrganizationId = organization.Id;
+        organizationUser.Status = OrganizationUserStatusType.Confirmed;
+        organization.Identifier = "test-org-identifier";
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByUserAsync(userId)
+            .Returns([organizationUser]);
+
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdAsync(organization.Id)
+            .Returns(organization);
+
+        // Act
+        var result = await sutProvider.Sut.GetSsoOrganizationIdentifierAsync(userId);
+
+        // Assert
+        Assert.Equal("test-org-identifier", result);
+        await sutProvider.GetDependency<IOrganizationUserRepository>()
+            .Received(1)
+            .GetManyByUserAsync(userId);
+        await sutProvider.GetDependency<IOrganizationRepository>()
+            .Received(1)
+            .GetByIdAsync(organization.Id);
+    }
+
+    [Theory, BitAutoData]
+    public async Task GetSsoOrganizationIdentifierAsync_UserHasNoOrganizations_ReturnsNull(
+        SutProvider<UserSsoOrganizationIdentifierQuery> sutProvider,
+        Guid userId)
+    {
+        // Arrange
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByUserAsync(userId)
+            .Returns(Array.Empty<OrganizationUser>());
+
+        // Act
+        var result = await sutProvider.Sut.GetSsoOrganizationIdentifierAsync(userId);
+
+        // Assert
+        Assert.Null(result);
+        await sutProvider.GetDependency<IOrganizationUserRepository>()
+            .Received(1)
+            .GetManyByUserAsync(userId);
+        await sutProvider.GetDependency<IOrganizationRepository>()
+            .DidNotReceive()
+            .GetByIdAsync(Arg.Any<Guid>());
+    }
+
+    [Theory, BitAutoData]
+    public async Task GetSsoOrganizationIdentifierAsync_UserHasMultipleConfirmedOrganizations_ReturnsNull(
+        SutProvider<UserSsoOrganizationIdentifierQuery> sutProvider,
+        Guid userId,
+        OrganizationUser organizationUser1,
+        OrganizationUser organizationUser2)
+    {
+        // Arrange
+        organizationUser1.UserId = userId;
+        organizationUser1.Status = OrganizationUserStatusType.Confirmed;
+        organizationUser2.UserId = userId;
+        organizationUser2.Status = OrganizationUserStatusType.Confirmed;
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByUserAsync(userId)
+            .Returns([organizationUser1, organizationUser2]);
+
+        // Act
+        var result = await sutProvider.Sut.GetSsoOrganizationIdentifierAsync(userId);
+
+        // Assert
+        Assert.Null(result);
+        await sutProvider.GetDependency<IOrganizationUserRepository>()
+            .Received(1)
+            .GetManyByUserAsync(userId);
+        await sutProvider.GetDependency<IOrganizationRepository>()
+            .DidNotReceive()
+            .GetByIdAsync(Arg.Any<Guid>());
+    }
+
+    [Theory]
+    [BitAutoData(OrganizationUserStatusType.Invited)]
+    [BitAutoData(OrganizationUserStatusType.Accepted)]
+    [BitAutoData(OrganizationUserStatusType.Revoked)]
+    public async Task GetSsoOrganizationIdentifierAsync_UserHasOnlyInvitedOrganization_ReturnsNull(
+        OrganizationUserStatusType status,
+        SutProvider<UserSsoOrganizationIdentifierQuery> sutProvider,
+        Guid userId,
+        OrganizationUser organizationUser)
+    {
+        // Arrange
+        organizationUser.UserId = userId;
+        organizationUser.Status = status;
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByUserAsync(userId)
+            .Returns([organizationUser]);
+
+        // Act
+        var result = await sutProvider.Sut.GetSsoOrganizationIdentifierAsync(userId);
+
+        // Assert
+        Assert.Null(result);
+        await sutProvider.GetDependency<IOrganizationUserRepository>()
+            .Received(1)
+            .GetManyByUserAsync(userId);
+        await sutProvider.GetDependency<IOrganizationRepository>()
+            .DidNotReceive()
+            .GetByIdAsync(Arg.Any<Guid>());
+    }
+
+    [Theory, BitAutoData]
+    public async Task GetSsoOrganizationIdentifierAsync_UserHasMixedStatusOrganizations_OnlyOneConfirmed_ReturnsIdentifier(
+        SutProvider<UserSsoOrganizationIdentifierQuery> sutProvider,
+        Guid userId,
+        Organization organization,
+        OrganizationUser confirmedOrgUser,
+        OrganizationUser invitedOrgUser,
+        OrganizationUser revokedOrgUser)
+    {
+        // Arrange
+        confirmedOrgUser.UserId = userId;
+        confirmedOrgUser.OrganizationId = organization.Id;
+        confirmedOrgUser.Status = OrganizationUserStatusType.Confirmed;
+
+        invitedOrgUser.UserId = userId;
+        invitedOrgUser.Status = OrganizationUserStatusType.Invited;
+
+        revokedOrgUser.UserId = userId;
+        revokedOrgUser.Status = OrganizationUserStatusType.Revoked;
+
+        organization.Identifier = "mixed-status-org";
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByUserAsync(userId)
+            .Returns(new[] { confirmedOrgUser, invitedOrgUser, revokedOrgUser });
+
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdAsync(organization.Id)
+            .Returns(organization);
+
+        // Act
+        var result = await sutProvider.Sut.GetSsoOrganizationIdentifierAsync(userId);
+
+        // Assert
+        Assert.Equal("mixed-status-org", result);
+        await sutProvider.GetDependency<IOrganizationUserRepository>()
+            .Received(1)
+            .GetManyByUserAsync(userId);
+        await sutProvider.GetDependency<IOrganizationRepository>()
+            .Received(1)
+            .GetByIdAsync(organization.Id);
+    }
+
+    [Theory, BitAutoData]
+    public async Task GetSsoOrganizationIdentifierAsync_OrganizationNotFound_ReturnsNull(
+        SutProvider<UserSsoOrganizationIdentifierQuery> sutProvider,
+        Guid userId,
+        OrganizationUser organizationUser)
+    {
+        // Arrange
+        organizationUser.UserId = userId;
+        organizationUser.Status = OrganizationUserStatusType.Confirmed;
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByUserAsync(userId)
+            .Returns([organizationUser]);
+
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdAsync(organizationUser.OrganizationId)
+            .Returns((Organization)null);
+
+        // Act
+        var result = await sutProvider.Sut.GetSsoOrganizationIdentifierAsync(userId);
+
+        // Assert
+        Assert.Null(result);
+        await sutProvider.GetDependency<IOrganizationUserRepository>()
+            .Received(1)
+            .GetManyByUserAsync(userId);
+        await sutProvider.GetDependency<IOrganizationRepository>()
+            .Received(1)
+            .GetByIdAsync(organizationUser.OrganizationId);
+    }
+
+    [Theory, BitAutoData]
+    public async Task GetSsoOrganizationIdentifierAsync_OrganizationIdentifierIsNull_ReturnsNull(
+        SutProvider<UserSsoOrganizationIdentifierQuery> sutProvider,
+        Guid userId,
+        Organization organization,
+        OrganizationUser organizationUser)
+    {
+        // Arrange
+        organizationUser.UserId = userId;
+        organizationUser.OrganizationId = organization.Id;
+        organizationUser.Status = OrganizationUserStatusType.Confirmed;
+        organization.Identifier = null;
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByUserAsync(userId)
+            .Returns(new[] { organizationUser });
+
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdAsync(organization.Id)
+            .Returns(organization);
+
+        // Act
+        var result = await sutProvider.Sut.GetSsoOrganizationIdentifierAsync(userId);
+
+        // Assert
+        Assert.Null(result);
+        await sutProvider.GetDependency<IOrganizationUserRepository>()
+            .Received(1)
+            .GetManyByUserAsync(userId);
+        await sutProvider.GetDependency<IOrganizationRepository>()
+            .Received(1)
+            .GetByIdAsync(organization.Id);
+    }
+
+    [Theory, BitAutoData]
+    public async Task GetSsoOrganizationIdentifierAsync_OrganizationIdentifierIsEmpty_ReturnsEmpty(
+        SutProvider<UserSsoOrganizationIdentifierQuery> sutProvider,
+        Guid userId,
+        Organization organization,
+        OrganizationUser organizationUser)
+    {
+        // Arrange
+        organizationUser.UserId = userId;
+        organizationUser.OrganizationId = organization.Id;
+        organizationUser.Status = OrganizationUserStatusType.Confirmed;
+        organization.Identifier = string.Empty;
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByUserAsync(userId)
+            .Returns(new[] { organizationUser });
+
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdAsync(organization.Id)
+            .Returns(organization);
+
+        // Act
+        var result = await sutProvider.Sut.GetSsoOrganizationIdentifierAsync(userId);
+
+        // Assert
+        Assert.Equal(string.Empty, result);
+        await sutProvider.GetDependency<IOrganizationUserRepository>()
+            .Received(1)
+            .GetManyByUserAsync(userId);
+        await sutProvider.GetDependency<IOrganizationRepository>()
+            .Received(1)
+            .GetByIdAsync(organization.Id);
+    }
+}

test/Core.Test/Billing/Mocks/MockPlans.cs

@@ -0,0 +1,37 @@
+using Bit.Core.Billing.Enums;
+using Bit.Core.Models.StaticStore;
+using Bit.Core.Test.Billing.Mocks.Plans;
+
+namespace Bit.Core.Test.Billing.Mocks;
+
+public class MockPlans
+{
+    public static List<Plan> Plans =>
+    [
+        new CustomPlan(),
+        new Enterprise2019Plan(false),
+        new Enterprise2019Plan(true),
+        new Enterprise2020Plan(false),
+        new Enterprise2020Plan(true),
+        new Enterprise2023Plan(false),
+        new Enterprise2023Plan(true),
+        new EnterprisePlan(false),
+        new EnterprisePlan(true),
+        new Families2019Plan(),
+        new Families2025Plan(),
+        new FamiliesPlan(),
+        new FreePlan(),
+        new Teams2019Plan(false),
+        new Teams2019Plan(true),
+        new Teams2020Plan(false),
+        new Teams2020Plan(true),
+        new Teams2023Plan(false),
+        new Teams2023Plan(true),
+        new TeamsPlan(false),
+        new TeamsPlan(true),
+        new TeamsStarterPlan(),
+        new TeamsStarterPlan2023()
+    ];
+
+    public static Plan Get(PlanType planType) => Plans.SingleOrDefault(p => p.Type == planType)!;
+}

test/Core.Test/Billing/Mocks/Plans/CustomPlan.cs

@@ -0,0 +1,21 @@
+using Bit.Core.Billing.Enums;
+using Bit.Core.Models.StaticStore;
+
+namespace Bit.Core.Test.Billing.Mocks.Plans;
+
+public record CustomPlan : Plan
+{
+    public CustomPlan()
+    {
+        Type = PlanType.Custom;
+        PasswordManager = new CustomPasswordManagerFeatures();
+    }
+
+    private record CustomPasswordManagerFeatures : PasswordManagerPlanFeatures
+    {
+        public CustomPasswordManagerFeatures()
+        {
+            AllowSeatAutoscale = true;
+        }
+    }
+}

test/Core.Test/Billing/Mocks/Plans/Enterprise2019Plan.cs

@@ -0,0 +1,103 @@
+using Bit.Core.Billing.Enums;
+using Bit.Core.Models.StaticStore;
+
+namespace Bit.Core.Test.Billing.Mocks.Plans;
+
+public record Enterprise2019Plan : Plan
+{
+    public Enterprise2019Plan(bool isAnnual)
+    {
+        Type = isAnnual ? PlanType.EnterpriseAnnually2019 : PlanType.EnterpriseMonthly2019;
+        ProductTier = ProductTierType.Enterprise;
+        Name = isAnnual ? "Enterprise (Annually) 2019" : "Enterprise (Monthly) 2019";
+        IsAnnual = isAnnual;
+        NameLocalizationKey = "planNameEnterprise";
+        DescriptionLocalizationKey = "planDescEnterprise";
+        CanBeUsedByBusiness = true;
+
+        TrialPeriodDays = 7;
+
+        HasPolicies = true;
+        HasSelfHost = true;
+        HasGroups = true;
+        HasDirectory = true;
+        HasEvents = true;
+        HasTotp = true;
+        Has2fa = true;
+        HasApi = true;
+        HasSso = true;
+        HasOrganizationDomains = true;
+        HasKeyConnector = true;
+        HasScim = true;
+        HasResetPassword = true;
+        UsersGetPremium = true;
+        HasCustomPermissions = true;
+
+        UpgradeSortOrder = 4;
+        DisplaySortOrder = 4;
+        LegacyYear = 2020;
+
+        SecretsManager = new Enterprise2019SecretsManagerFeatures(isAnnual);
+        PasswordManager = new Enterprise2019PasswordManagerFeatures(isAnnual);
+    }
+
+    private record Enterprise2019SecretsManagerFeatures : SecretsManagerPlanFeatures
+    {
+        public Enterprise2019SecretsManagerFeatures(bool isAnnual)
+        {
+            BaseSeats = 0;
+            BasePrice = 0;
+            BaseServiceAccount = 200;
+
+            HasAdditionalSeatsOption = true;
+            HasAdditionalServiceAccountOption = true;
+
+            AllowSeatAutoscale = true;
+            AllowServiceAccountsAutoscale = true;
+
+            if (isAnnual)
+            {
+                StripeSeatPlanId = "secrets-manager-enterprise-seat-annually";
+                StripeServiceAccountPlanId = "secrets-manager-service-account-annually";
+                SeatPrice = 144;
+                AdditionalPricePerServiceAccount = 6;
+            }
+            else
+            {
+                StripeSeatPlanId = "secrets-manager-enterprise-seat-monthly";
+                StripeServiceAccountPlanId = "secrets-manager-service-account-monthly";
+                SeatPrice = 13;
+                AdditionalPricePerServiceAccount = 0.5M;
+            }
+        }
+    }
+
+    private record Enterprise2019PasswordManagerFeatures : PasswordManagerPlanFeatures
+    {
+        public Enterprise2019PasswordManagerFeatures(bool isAnnual)
+        {
+            BaseSeats = 0;
+            BaseStorageGb = 1;
+
+            HasAdditionalStorageOption = true;
+            HasAdditionalSeatsOption = true;
+
+            AllowSeatAutoscale = true;
+
+            if (isAnnual)
+            {
+                StripeStoragePlanId = "storage-gb-annually";
+                StripeSeatPlanId = "enterprise-org-seat-annually";
+                SeatPrice = 36;
+                AdditionalStoragePricePerGb = 4;
+            }
+            else
+            {
+                StripeSeatPlanId = "enterprise-org-seat-monthly";
+                StripeStoragePlanId = "storage-gb-monthly";
+                SeatPrice = 4M;
+                AdditionalStoragePricePerGb = 0.5M;
+            }
+        }
+    }
+}

test/Core.Test/Billing/Mocks/Plans/Enterprise2020Plan.cs

@@ -0,0 +1,103 @@
+using Bit.Core.Billing.Enums;
+using Bit.Core.Models.StaticStore;
+
+namespace Bit.Core.Test.Billing.Mocks.Plans;
+
+public record Enterprise2020Plan : Plan
+{
+    public Enterprise2020Plan(bool isAnnual)
+    {
+        Type = isAnnual ? PlanType.EnterpriseAnnually2020 : PlanType.EnterpriseMonthly2020;
+        ProductTier = ProductTierType.Enterprise;
+        Name = isAnnual ? "Enterprise (Annually) 2020" : "Enterprise (Monthly) 2020";
+        IsAnnual = isAnnual;
+        NameLocalizationKey = "planNameEnterprise";
+        DescriptionLocalizationKey = "planDescEnterprise";
+        CanBeUsedByBusiness = true;
+
+        TrialPeriodDays = 7;
+
+        HasPolicies = true;
+        HasSelfHost = true;
+        HasGroups = true;
+        HasDirectory = true;
+        HasEvents = true;
+        HasTotp = true;
+        Has2fa = true;
+        HasApi = true;
+        HasSso = true;
+        HasOrganizationDomains = true;
+        HasKeyConnector = true;
+        HasScim = true;
+        HasResetPassword = true;
+        UsersGetPremium = true;
+        HasCustomPermissions = true;
+
+        UpgradeSortOrder = 4;
+        DisplaySortOrder = 4;
+        LegacyYear = 2023;
+
+        PasswordManager = new Enterprise2020PasswordManagerFeatures(isAnnual);
+        SecretsManager = new Enterprise2020SecretsManagerFeatures(isAnnual);
+    }
+
+    private record Enterprise2020SecretsManagerFeatures : SecretsManagerPlanFeatures
+    {
+        public Enterprise2020SecretsManagerFeatures(bool isAnnual)
+        {
+            BaseSeats = 0;
+            BasePrice = 0;
+            BaseServiceAccount = 200;
+
+            HasAdditionalSeatsOption = true;
+            HasAdditionalServiceAccountOption = true;
+
+            AllowSeatAutoscale = true;
+            AllowServiceAccountsAutoscale = true;
+
+            if (isAnnual)
+            {
+                StripeSeatPlanId = "secrets-manager-enterprise-seat-annually";
+                StripeServiceAccountPlanId = "secrets-manager-service-account-annually";
+                SeatPrice = 144;
+                AdditionalPricePerServiceAccount = 6;
+            }
+            else
+            {
+                StripeSeatPlanId = "secrets-manager-enterprise-seat-monthly";
+                StripeServiceAccountPlanId = "secrets-manager-service-account-monthly";
+                SeatPrice = 13;
+                AdditionalPricePerServiceAccount = 0.5M;
+            }
+        }
+    }
+
+    private record Enterprise2020PasswordManagerFeatures : PasswordManagerPlanFeatures
+    {
+        public Enterprise2020PasswordManagerFeatures(bool isAnnual)
+        {
+            BaseSeats = 0;
+            BaseStorageGb = 1;
+
+            HasAdditionalStorageOption = true;
+            HasAdditionalSeatsOption = true;
+
+            AllowSeatAutoscale = true;
+
+            if (isAnnual)
+            {
+                AdditionalStoragePricePerGb = 4;
+                StripeStoragePlanId = "storage-gb-annually";
+                StripeSeatPlanId = "2020-enterprise-org-seat-annually";
+                SeatPrice = 60;
+            }
+            else
+            {
+                StripeSeatPlanId = "2020-enterprise-seat-monthly";
+                StripeStoragePlanId = "storage-gb-monthly";
+                SeatPrice = 6;
+                AdditionalStoragePricePerGb = 0.5M;
+            }
+        }
+    }
+}

test/Core.Test/Billing/Mocks/Plans/EnterprisePlan.cs

@@ -0,0 +1,106 @@
+using Bit.Core.Billing.Enums;
+using Bit.Core.Models.StaticStore;
+
+namespace Bit.Core.Test.Billing.Mocks.Plans;
+
+public record EnterprisePlan : Plan
+{
+    public EnterprisePlan(bool isAnnual)
+    {
+        Type = isAnnual ? PlanType.EnterpriseAnnually : PlanType.EnterpriseMonthly;
+        ProductTier = ProductTierType.Enterprise;
+        Name = isAnnual ? "Enterprise (Annually)" : "Enterprise (Monthly)";
+        IsAnnual = isAnnual;
+        NameLocalizationKey = "planNameEnterprise";
+        DescriptionLocalizationKey = "planDescEnterprise";
+        CanBeUsedByBusiness = true;
+
+        TrialPeriodDays = 7;
+
+        HasPolicies = true;
+        HasSelfHost = true;
+        HasGroups = true;
+        HasDirectory = true;
+        HasEvents = true;
+        HasTotp = true;
+        Has2fa = true;
+        HasApi = true;
+        HasSso = true;
+        HasOrganizationDomains = true;
+        HasKeyConnector = true;
+        HasScim = true;
+        HasResetPassword = true;
+        UsersGetPremium = true;
+        HasCustomPermissions = true;
+
+        UpgradeSortOrder = 4;
+        DisplaySortOrder = 4;
+
+        PasswordManager = new EnterprisePasswordManagerFeatures(isAnnual);
+        SecretsManager = new EnterpriseSecretsManagerFeatures(isAnnual);
+    }
+
+    private record EnterpriseSecretsManagerFeatures : SecretsManagerPlanFeatures
+    {
+        public EnterpriseSecretsManagerFeatures(bool isAnnual)
+        {
+            BaseSeats = 0;
+            BasePrice = 0;
+            BaseServiceAccount = 50;
+
+            HasAdditionalSeatsOption = true;
+            HasAdditionalServiceAccountOption = true;
+
+            AllowSeatAutoscale = true;
+            AllowServiceAccountsAutoscale = true;
+
+            if (isAnnual)
+            {
+                StripeSeatPlanId = "secrets-manager-enterprise-seat-annually";
+                StripeServiceAccountPlanId = "secrets-manager-service-account-2024-annually";
+                SeatPrice = 144;
+                AdditionalPricePerServiceAccount = 12;
+            }
+            else
+            {
+                StripeSeatPlanId = "secrets-manager-enterprise-seat-monthly";
+                StripeServiceAccountPlanId = "secrets-manager-service-account-2024-monthly";
+                SeatPrice = 13;
+                AdditionalPricePerServiceAccount = 1;
+            }
+        }
+    }
+
+    private record EnterprisePasswordManagerFeatures : PasswordManagerPlanFeatures
+    {
+        public EnterprisePasswordManagerFeatures(bool isAnnual)
+        {
+            BaseSeats = 0;
+            BaseStorageGb = 1;
+
+            HasAdditionalStorageOption = true;
+            HasAdditionalSeatsOption = true;
+
+            AllowSeatAutoscale = true;
+
+            if (isAnnual)
+            {
+                AdditionalStoragePricePerGb = 4;
+                StripeStoragePlanId = "storage-gb-annually";
+                StripeSeatPlanId = "2023-enterprise-org-seat-annually";
+                StripeProviderPortalSeatPlanId = "password-manager-provider-portal-enterprise-annually-2024";
+                SeatPrice = 72;
+                ProviderPortalSeatPrice = 72;
+            }
+            else
+            {
+                StripeSeatPlanId = "2023-enterprise-seat-monthly";
+                StripeProviderPortalSeatPlanId = "password-manager-provider-portal-enterprise-monthly-2024";
+                StripeStoragePlanId = "storage-gb-monthly";
+                SeatPrice = 7;
+                ProviderPortalSeatPrice = 6;
+                AdditionalStoragePricePerGb = 0.5M;
+            }
+        }
+    }
+}

test/Core.Test/Billing/Mocks/Plans/EnterprisePlan2023.cs

@@ -0,0 +1,104 @@
+using Bit.Core.Billing.Enums;
+using Bit.Core.Models.StaticStore;
+
+namespace Bit.Core.Test.Billing.Mocks.Plans;
+
+public record Enterprise2023Plan : Plan
+{
+    public Enterprise2023Plan(bool isAnnual)
+    {
+        Type = isAnnual ? PlanType.EnterpriseAnnually2023 : PlanType.EnterpriseMonthly2023;
+        ProductTier = ProductTierType.Enterprise;
+        Name = isAnnual ? "Enterprise (Annually)" : "Enterprise (Monthly)";
+        IsAnnual = isAnnual;
+        NameLocalizationKey = "planNameEnterprise";
+        DescriptionLocalizationKey = "planDescEnterprise";
+        CanBeUsedByBusiness = true;
+
+        TrialPeriodDays = 7;
+
+        HasPolicies = true;
+        HasSelfHost = true;
+        HasGroups = true;
+        HasDirectory = true;
+        HasEvents = true;
+        HasTotp = true;
+        Has2fa = true;
+        HasApi = true;
+        HasSso = true;
+        HasOrganizationDomains = true;
+        HasKeyConnector = true;
+        HasScim = true;
+        HasResetPassword = true;
+        UsersGetPremium = true;
+        HasCustomPermissions = true;
+
+        UpgradeSortOrder = 4;
+        DisplaySortOrder = 4;
+
+        LegacyYear = 2024;
+
+        PasswordManager = new Enterprise2023PasswordManagerFeatures(isAnnual);
+        SecretsManager = new Enterprise2023SecretsManagerFeatures(isAnnual);
+    }
+
+    private record Enterprise2023SecretsManagerFeatures : SecretsManagerPlanFeatures
+    {
+        public Enterprise2023SecretsManagerFeatures(bool isAnnual)
+        {
+            BaseSeats = 0;
+            BasePrice = 0;
+            BaseServiceAccount = 200;
+
+            HasAdditionalSeatsOption = true;
+            HasAdditionalServiceAccountOption = true;
+
+            AllowSeatAutoscale = true;
+            AllowServiceAccountsAutoscale = true;
+
+            if (isAnnual)
+            {
+                StripeSeatPlanId = "secrets-manager-enterprise-seat-annually";
+                StripeServiceAccountPlanId = "secrets-manager-service-account-annually";
+                SeatPrice = 144;
+                AdditionalPricePerServiceAccount = 6;
+            }
+            else
+            {
+                StripeSeatPlanId = "secrets-manager-enterprise-seat-monthly";
+                StripeServiceAccountPlanId = "secrets-manager-service-account-monthly";
+                SeatPrice = 13;
+                AdditionalPricePerServiceAccount = 0.5M;
+            }
+        }
+    }
+
+    private record Enterprise2023PasswordManagerFeatures : PasswordManagerPlanFeatures
+    {
+        public Enterprise2023PasswordManagerFeatures(bool isAnnual)
+        {
+            BaseSeats = 0;
+            BaseStorageGb = 1;
+
+            HasAdditionalStorageOption = true;
+            HasAdditionalSeatsOption = true;
+
+            AllowSeatAutoscale = true;
+
+            if (isAnnual)
+            {
+                AdditionalStoragePricePerGb = 4;
+                StripeStoragePlanId = "storage-gb-annually";
+                StripeSeatPlanId = "2023-enterprise-org-seat-annually";
+                SeatPrice = 72;
+            }
+            else
+            {
+                StripeSeatPlanId = "2023-enterprise-seat-monthly";
+                StripeStoragePlanId = "storage-gb-monthly";
+                SeatPrice = 7;
+                AdditionalStoragePricePerGb = 0.5M;
+            }
+        }
+    }
+}

test/Core.Test/Billing/Mocks/Plans/Families2019Plan.cs

@@ -0,0 +1,50 @@
+using Bit.Core.Billing.Enums;
+using Bit.Core.Models.StaticStore;
+
+namespace Bit.Core.Test.Billing.Mocks.Plans;
+
+public record Families2019Plan : Plan
+{
+    public Families2019Plan()
+    {
+        Type = PlanType.FamiliesAnnually2019;
+        ProductTier = ProductTierType.Families;
+        Name = "Families 2019";
+        IsAnnual = true;
+        NameLocalizationKey = "planNameFamilies";
+        DescriptionLocalizationKey = "planDescFamilies";
+
+        TrialPeriodDays = 7;
+
+        HasSelfHost = true;
+        HasTotp = true;
+
+        UpgradeSortOrder = 1;
+        DisplaySortOrder = 1;
+        LegacyYear = 2020;
+
+        PasswordManager = new Families2019PasswordManagerFeatures();
+    }
+
+    private record Families2019PasswordManagerFeatures : PasswordManagerPlanFeatures
+    {
+        public Families2019PasswordManagerFeatures()
+        {
+            BaseSeats = 5;
+            BaseStorageGb = 1;
+            MaxSeats = 5;
+
+            HasAdditionalStorageOption = true;
+            HasPremiumAccessOption = true;
+
+            StripePlanId = "personal-org-annually";
+            StripeStoragePlanId = "personal-storage-gb-annually";
+            StripePremiumAccessPlanId = "personal-org-premium-access-annually";
+            BasePrice = 12;
+            AdditionalStoragePricePerGb = 4;
+            PremiumAccessOptionPrice = 40;
+
+            AllowSeatAutoscale = false;
+        }
+    }
+}

test/Core.Test/Billing/Mocks/Plans/Families2025Plan.cs

@@ -0,0 +1,47 @@
+using Bit.Core.Billing.Enums;
+using Bit.Core.Models.StaticStore;
+
+namespace Bit.Core.Test.Billing.Mocks.Plans;
+
+public record Families2025Plan : Plan
+{
+    public Families2025Plan()
+    {
+        Type = PlanType.FamiliesAnnually2025;
+        ProductTier = ProductTierType.Families;
+        Name = "Families 2025";
+        IsAnnual = true;
+        NameLocalizationKey = "planNameFamilies";
+        DescriptionLocalizationKey = "planDescFamilies";
+
+        TrialPeriodDays = 7;
+
+        HasSelfHost = true;
+        HasTotp = true;
+        UsersGetPremium = true;
+
+        UpgradeSortOrder = 1;
+        DisplaySortOrder = 1;
+
+        PasswordManager = new Families2025PasswordManagerFeatures();
+    }
+
+    private record Families2025PasswordManagerFeatures : PasswordManagerPlanFeatures
+    {
+        public Families2025PasswordManagerFeatures()
+        {
+            BaseSeats = 6;
+            BaseStorageGb = 1;
+            MaxSeats = 6;
+
+            HasAdditionalStorageOption = true;
+
+            StripePlanId = "2020-families-org-annually";
+            StripeStoragePlanId = "personal-storage-gb-annually";
+            BasePrice = 40;
+            AdditionalStoragePricePerGb = 4;
+
+            AllowSeatAutoscale = false;
+        }
+    }
+}

test/Core.Test/Billing/Mocks/Plans/FamiliesPlan.cs

@@ -0,0 +1,47 @@
+using Bit.Core.Billing.Enums;
+using Bit.Core.Models.StaticStore;
+
+namespace Bit.Core.Test.Billing.Mocks.Plans;
+
+public record FamiliesPlan : Plan
+{
+    public FamiliesPlan()
+    {
+        Type = PlanType.FamiliesAnnually;
+        ProductTier = ProductTierType.Families;
+        Name = "Families";
+        IsAnnual = true;
+        NameLocalizationKey = "planNameFamilies";
+        DescriptionLocalizationKey = "planDescFamilies";
+
+        TrialPeriodDays = 7;
+
+        HasSelfHost = true;
+        HasTotp = true;
+        UsersGetPremium = true;
+
+        UpgradeSortOrder = 1;
+        DisplaySortOrder = 1;
+
+        PasswordManager = new FamiliesPasswordManagerFeatures();
+    }
+
+    private record FamiliesPasswordManagerFeatures : PasswordManagerPlanFeatures
+    {
+        public FamiliesPasswordManagerFeatures()
+        {
+            BaseSeats = 6;
+            BaseStorageGb = 1;
+            MaxSeats = 6;
+
+            HasAdditionalStorageOption = true;
+
+            StripePlanId = "2020-families-org-annually";
+            StripeStoragePlanId = "personal-storage-gb-annually";
+            BasePrice = 40;
+            AdditionalStoragePricePerGb = 4;
+
+            AllowSeatAutoscale = false;
+        }
+    }
+}

test/Core.Test/Billing/Mocks/Plans/FreePlan.cs

@@ -0,0 +1,48 @@
+using Bit.Core.Billing.Enums;
+using Bit.Core.Models.StaticStore;
+
+namespace Bit.Core.Test.Billing.Mocks.Plans;
+
+public record FreePlan : Plan
+{
+    public FreePlan()
+    {
+        Type = PlanType.Free;
+        ProductTier = ProductTierType.Free;
+        Name = "Free";
+        NameLocalizationKey = "planNameFree";
+        DescriptionLocalizationKey = "planDescFree";
+
+        UpgradeSortOrder = -1; // Always the lowest plan, cannot be upgraded to
+        DisplaySortOrder = -1;
+
+        PasswordManager = new FreePasswordManagerFeatures();
+        SecretsManager = new FreeSecretsManagerFeatures();
+    }
+
+    private record FreeSecretsManagerFeatures : SecretsManagerPlanFeatures
+    {
+        public FreeSecretsManagerFeatures()
+        {
+            BaseSeats = 2;
+            BaseServiceAccount = 3;
+            MaxProjects = 3;
+            MaxSeats = 2;
+            MaxServiceAccounts = 3;
+
+            AllowSeatAutoscale = false;
+        }
+    }
+
+    private record FreePasswordManagerFeatures : PasswordManagerPlanFeatures
+    {
+        public FreePasswordManagerFeatures()
+        {
+            BaseSeats = 2;
+            MaxCollections = 2;
+            MaxSeats = 2;
+
+            AllowSeatAutoscale = false;
+        }
+    }
+}

test/Core.Test/Billing/Mocks/Plans/Teams2019Plan.cs

@@ -0,0 +1,99 @@
+using Bit.Core.Billing.Enums;
+using Bit.Core.Models.StaticStore;
+
+namespace Bit.Core.Test.Billing.Mocks.Plans;
+
+public record Teams2019Plan : Plan
+{
+    public Teams2019Plan(bool isAnnual)
+    {
+        Type = isAnnual ? PlanType.TeamsAnnually2019 : PlanType.TeamsMonthly2019;
+        ProductTier = ProductTierType.Teams;
+        Name = isAnnual ? "Teams (Annually) 2019" : "Teams (Monthly) 2019";
+        IsAnnual = isAnnual;
+        NameLocalizationKey = "planNameTeams";
+        DescriptionLocalizationKey = "planDescTeams";
+        CanBeUsedByBusiness = true;
+
+        TrialPeriodDays = 7;
+
+        HasGroups = true;
+        HasDirectory = true;
+        HasEvents = true;
+        HasTotp = true;
+        Has2fa = true;
+        HasApi = true;
+        UsersGetPremium = true;
+
+        UpgradeSortOrder = 3;
+        DisplaySortOrder = 3;
+        LegacyYear = 2020;
+
+        SecretsManager = new Teams2019SecretsManagerFeatures(isAnnual);
+        PasswordManager = new Teams2019PasswordManagerFeatures(isAnnual);
+    }
+
+    private record Teams2019SecretsManagerFeatures : SecretsManagerPlanFeatures
+    {
+        public Teams2019SecretsManagerFeatures(bool isAnnual)
+        {
+            BaseSeats = 0;
+            BasePrice = 0;
+            BaseServiceAccount = 50;
+
+            HasAdditionalSeatsOption = true;
+            HasAdditionalServiceAccountOption = true;
+
+            AllowSeatAutoscale = true;
+            AllowServiceAccountsAutoscale = true;
+
+            if (isAnnual)
+            {
+                StripeSeatPlanId = "secrets-manager-teams-seat-annually";
+                StripeServiceAccountPlanId = "secrets-manager-service-account-annually";
+                SeatPrice = 72;
+                AdditionalPricePerServiceAccount = 6;
+            }
+            else
+            {
+                StripeSeatPlanId = "secrets-manager-teams-seat-monthly";
+                StripeServiceAccountPlanId = "secrets-manager-service-account-monthly";
+                SeatPrice = 7;
+                AdditionalPricePerServiceAccount = 0.5M;
+            }
+        }
+    }
+
+    private record Teams2019PasswordManagerFeatures : PasswordManagerPlanFeatures
+    {
+        public Teams2019PasswordManagerFeatures(bool isAnnual)
+        {
+            BaseSeats = 5;
+            BaseStorageGb = 1;
+
+            HasAdditionalStorageOption = true;
+            HasAdditionalSeatsOption = true;
+
+            AllowSeatAutoscale = true;
+
+            if (isAnnual)
+            {
+                StripePlanId = "teams-org-annually";
+                StripeStoragePlanId = "storage-gb-annually";
+                StripeSeatPlanId = "teams-org-seat-annually";
+                SeatPrice = 24;
+                BasePrice = 60;
+                AdditionalStoragePricePerGb = 4;
+            }
+            else
+            {
+                StripePlanId = "teams-org-monthly";
+                StripeSeatPlanId = "teams-org-seat-monthly";
+                StripeStoragePlanId = "storage-gb-monthly";
+                BasePrice = 8;
+                SeatPrice = 2.5M;
+                AdditionalStoragePricePerGb = 0.5M;
+            }
+        }
+    }
+}

test/Core.Test/Billing/Mocks/Plans/Teams2020Plan.cs

@@ -0,0 +1,96 @@
+using Bit.Core.Billing.Enums;
+using Bit.Core.Models.StaticStore;
+
+namespace Bit.Core.Test.Billing.Mocks.Plans;
+
+public record Teams2020Plan : Plan
+{
+    public Teams2020Plan(bool isAnnual)
+    {
+        Type = isAnnual ? PlanType.TeamsAnnually2020 : PlanType.TeamsMonthly2020;
+        ProductTier = ProductTierType.Teams;
+        Name = isAnnual ? "Teams (Annually) 2020" : "Teams (Monthly) 2020";
+        IsAnnual = isAnnual;
+        NameLocalizationKey = "planNameTeams";
+        DescriptionLocalizationKey = "planDescTeams";
+        CanBeUsedByBusiness = true;
+
+        TrialPeriodDays = 7;
+
+        HasGroups = true;
+        HasDirectory = true;
+        HasEvents = true;
+        HasTotp = true;
+        Has2fa = true;
+        HasApi = true;
+        UsersGetPremium = true;
+
+        UpgradeSortOrder = 3;
+        DisplaySortOrder = 3;
+        LegacyYear = 2023;
+
+        PasswordManager = new Teams2020PasswordManagerFeatures(isAnnual);
+        SecretsManager = new Teams2020SecretsManagerFeatures(isAnnual);
+    }
+
+    private record Teams2020SecretsManagerFeatures : SecretsManagerPlanFeatures
+    {
+        public Teams2020SecretsManagerFeatures(bool isAnnual)
+        {
+            BaseSeats = 0;
+            BasePrice = 0;
+            BaseServiceAccount = 50;
+
+            HasAdditionalSeatsOption = true;
+            HasAdditionalServiceAccountOption = true;
+
+            AllowSeatAutoscale = true;
+            AllowServiceAccountsAutoscale = true;
+
+            if (isAnnual)
+            {
+                StripeSeatPlanId = "secrets-manager-teams-seat-annually";
+                StripeServiceAccountPlanId = "secrets-manager-service-account-annually";
+                SeatPrice = 72;
+                AdditionalPricePerServiceAccount = 6;
+            }
+            else
+            {
+                StripeSeatPlanId = "secrets-manager-teams-seat-monthly";
+                StripeServiceAccountPlanId = "secrets-manager-service-account-monthly";
+                SeatPrice = 7;
+                AdditionalPricePerServiceAccount = 0.5M;
+            }
+        }
+    }
+
+    private record Teams2020PasswordManagerFeatures : PasswordManagerPlanFeatures
+    {
+        public Teams2020PasswordManagerFeatures(bool isAnnual)
+        {
+            BaseSeats = 0;
+            BaseStorageGb = 1;
+            BasePrice = 0;
+
+            HasAdditionalStorageOption = true;
+            HasAdditionalSeatsOption = true;
+
+            AllowSeatAutoscale = true;
+
+            if (isAnnual)
+            {
+                StripeStoragePlanId = "storage-gb-annually";
+                StripeSeatPlanId = "2020-teams-org-seat-annually";
+                SeatPrice = 36;
+                AdditionalStoragePricePerGb = 4;
+            }
+            else
+            {
+                StripeSeatPlanId = "2020-teams-org-seat-monthly";
+                StripeStoragePlanId = "storage-gb-monthly";
+                SeatPrice = 4;
+                AdditionalStoragePricePerGb = 0.5M;
+            }
+        }
+    }
+}

test/Core.Test/Billing/Mocks/Plans/TeamsPlan.cs

@@ -0,0 +1,98 @@
+using Bit.Core.Billing.Enums;
+using Bit.Core.Models.StaticStore;
+
+namespace Bit.Core.Test.Billing.Mocks.Plans;
+
+public record TeamsPlan : Plan
+{
+    public TeamsPlan(bool isAnnual)
+    {
+        Type = isAnnual ? PlanType.TeamsAnnually : PlanType.TeamsMonthly;
+        ProductTier = ProductTierType.Teams;
+        Name = isAnnual ? "Teams (Annually)" : "Teams (Monthly)";
+        IsAnnual = isAnnual;
+        NameLocalizationKey = "planNameTeams";
+        DescriptionLocalizationKey = "planDescTeams";
+        CanBeUsedByBusiness = true;
+
+        TrialPeriodDays = 7;
+
+        HasGroups = true;
+        HasDirectory = true;
+        HasEvents = true;
+        HasTotp = true;
+        Has2fa = true;
+        HasApi = true;
+        UsersGetPremium = true;
+        HasScim = true;
+
+        UpgradeSortOrder = 3;
+        DisplaySortOrder = 3;
+
+        PasswordManager = new TeamsPasswordManagerFeatures(isAnnual);
+        SecretsManager = new TeamsSecretsManagerFeatures(isAnnual);
+    }
+
+    private record TeamsSecretsManagerFeatures : SecretsManagerPlanFeatures
+    {
+        public TeamsSecretsManagerFeatures(bool isAnnual)
+        {
+            BaseSeats = 0;
+            BasePrice = 0;
+            BaseServiceAccount = 20;
+
+            HasAdditionalSeatsOption = true;
+            HasAdditionalServiceAccountOption = true;
+
+            AllowSeatAutoscale = true;
+            AllowServiceAccountsAutoscale = true;
+
+            if (isAnnual)
+            {
+                StripeSeatPlanId = "secrets-manager-teams-seat-annually";
+                StripeServiceAccountPlanId = "secrets-manager-service-account-2024-annually";
+                SeatPrice = 72;
+                AdditionalPricePerServiceAccount = 12;
+            }
+            else
+            {
+                StripeSeatPlanId = "secrets-manager-teams-seat-monthly";
+                StripeServiceAccountPlanId = "secrets-manager-service-account-2024-monthly";
+                SeatPrice = 7;
+                AdditionalPricePerServiceAccount = 1;
+            }
+        }
+    }
+
+    private record TeamsPasswordManagerFeatures : PasswordManagerPlanFeatures
+    {
+        public TeamsPasswordManagerFeatures(bool isAnnual)
+        {
+            BaseSeats = 0;
+            BaseStorageGb = 1;
+            BasePrice = 0;
+
+            HasAdditionalStorageOption = true;
+            HasAdditionalSeatsOption = true;
+
+            AllowSeatAutoscale = true;
+
+            if (isAnnual)
+            {
+                StripeStoragePlanId = "storage-gb-annually";
+                StripeSeatPlanId = "2023-teams-org-seat-annually";
+                SeatPrice = 48;
+                AdditionalStoragePricePerGb = 4;
+            }
+            else
+            {
+                StripeSeatPlanId = "2023-teams-org-seat-monthly";
+                StripeProviderPortalSeatPlanId = "password-manager-provider-portal-teams-monthly-2024";
+                StripeStoragePlanId = "storage-gb-monthly";
+                SeatPrice = 5;
+                ProviderPortalSeatPrice = 4;
+                AdditionalStoragePricePerGb = 0.5M;
+            }
+        }
+    }
+}

test/Core.Test/Billing/Mocks/Plans/TeamsPlan2023.cs

@@ -0,0 +1,97 @@
+using Bit.Core.Billing.Enums;
+using Bit.Core.Models.StaticStore;
+
+namespace Bit.Core.Test.Billing.Mocks.Plans;
+
+public record Teams2023Plan : Plan
+{
+    public Teams2023Plan(bool isAnnual)
+    {
+        Type = isAnnual ? PlanType.TeamsAnnually2023 : PlanType.TeamsMonthly2023;
+        ProductTier = ProductTierType.Teams;
+        Name = isAnnual ? "Teams (Annually)" : "Teams (Monthly)";
+        IsAnnual = isAnnual;
+        NameLocalizationKey = "planNameTeams";
+        DescriptionLocalizationKey = "planDescTeams";
+        CanBeUsedByBusiness = true;
+
+        TrialPeriodDays = 7;
+
+        HasGroups = true;
+        HasDirectory = true;
+        HasEvents = true;
+        HasTotp = true;
+        Has2fa = true;
+        HasApi = true;
+        UsersGetPremium = true;
+
+        UpgradeSortOrder = 3;
+        DisplaySortOrder = 3;
+
+        LegacyYear = 2024;
+
+        PasswordManager = new Teams2023PasswordManagerFeatures(isAnnual);
+        SecretsManager = new Teams2023SecretsManagerFeatures(isAnnual);
+    }
+
+    private record Teams2023SecretsManagerFeatures : SecretsManagerPlanFeatures
+    {
+        public Teams2023SecretsManagerFeatures(bool isAnnual)
+        {
+            BaseSeats = 0;
+            BasePrice = 0;
+            BaseServiceAccount = 50;
+
+            HasAdditionalSeatsOption = true;
+            HasAdditionalServiceAccountOption = true;
+
+            AllowSeatAutoscale = true;
+            AllowServiceAccountsAutoscale = true;
+
+            if (isAnnual)
+            {
+                StripeSeatPlanId = "secrets-manager-teams-seat-annually";
+                StripeServiceAccountPlanId = "secrets-manager-service-account-annually";
+                SeatPrice = 72;
+                AdditionalPricePerServiceAccount = 6;
+            }
+            else
+            {
+                StripeSeatPlanId = "secrets-manager-teams-seat-monthly";
+                StripeServiceAccountPlanId = "secrets-manager-service-account-monthly";
+                SeatPrice = 7;
+                AdditionalPricePerServiceAccount = 0.5M;
+            }
+        }
+    }
+
+    private record Teams2023PasswordManagerFeatures : PasswordManagerPlanFeatures
+    {
+        public Teams2023PasswordManagerFeatures(bool isAnnual)
+        {
+            BaseSeats = 0;
+            BaseStorageGb = 1;
+            BasePrice = 0;
+
+            HasAdditionalStorageOption = true;
+            HasAdditionalSeatsOption = true;
+
+            AllowSeatAutoscale = true;
+
+            if (isAnnual)
+            {
+                StripeStoragePlanId = "storage-gb-annually";
+                StripeSeatPlanId = "2023-teams-org-seat-annually";
+                SeatPrice = 48;
+                AdditionalStoragePricePerGb = 4;
+            }
+            else
+            {
+                StripeSeatPlanId = "2023-teams-org-seat-monthly";
+                StripeStoragePlanId = "storage-gb-monthly";
+                SeatPrice = 5;
+                AdditionalStoragePricePerGb = 0.5M;
+            }
+        }
+    }
+}

test/Core.Test/Billing/Mocks/Plans/TeamsStarterPlan.cs

@@ -0,0 +1,74 @@
+using Bit.Core.Billing.Enums;
+using Bit.Core.Models.StaticStore;
+
+namespace Bit.Core.Test.Billing.Mocks.Plans;
+
+public record TeamsStarterPlan : Plan
+{
+    public TeamsStarterPlan()
+    {
+        Type = PlanType.TeamsStarter;
+        ProductTier = ProductTierType.TeamsStarter;
+        Name = "Teams (Starter)";
+        NameLocalizationKey = "planNameTeamsStarter";
+        DescriptionLocalizationKey = "planDescTeams";
+        CanBeUsedByBusiness = true;
+
+        TrialPeriodDays = 7;
+
+        HasGroups = true;
+        HasDirectory = true;
+        HasEvents = true;
+        HasTotp = true;
+        Has2fa = true;
+        HasApi = true;
+        UsersGetPremium = true;
+
+        UpgradeSortOrder = 2;
+        DisplaySortOrder = 2;
+
+        PasswordManager = new TeamsStarterPasswordManagerFeatures();
+        SecretsManager = new TeamsStarterSecretsManagerFeatures();
+
+        LegacyYear = 2024;
+    }
+
+    private record TeamsStarterSecretsManagerFeatures : SecretsManagerPlanFeatures
+    {
+        public TeamsStarterSecretsManagerFeatures()
+        {
+            BaseSeats = 0;
+            BasePrice = 0;
+            BaseServiceAccount = 20;
+
+            HasAdditionalSeatsOption = true;
+            HasAdditionalServiceAccountOption = true;
+
+            AllowSeatAutoscale = true;
+            AllowServiceAccountsAutoscale = true;
+
+            StripeSeatPlanId = "secrets-manager-teams-seat-monthly";
+            StripeServiceAccountPlanId = "secrets-manager-service-account-2024-monthly";
+            SeatPrice = 7;
+            AdditionalPricePerServiceAccount = 1;
+        }
+    }
+
+    private record TeamsStarterPasswordManagerFeatures : PasswordManagerPlanFeatures
+    {
+        public TeamsStarterPasswordManagerFeatures()
+        {
+            BaseSeats = 10;
+            BaseStorageGb = 1;
+            BasePrice = 20;
+
+            MaxSeats = 10;
+
+            HasAdditionalStorageOption = true;
+
+            StripePlanId = "teams-org-starter";
+            StripeStoragePlanId = "storage-gb-monthly";
+            AdditionalStoragePricePerGb = 0.5M;
+        }
+    }
+}

test/Core.Test/Billing/Mocks/Plans/TeamsStarterPlan2023.cs

@@ -0,0 +1,73 @@
+using Bit.Core.Billing.Enums;
+using Bit.Core.Models.StaticStore;
+
+namespace Bit.Core.Test.Billing.Mocks.Plans;
+
+public record TeamsStarterPlan2023 : Plan
+{
+    public TeamsStarterPlan2023()
+    {
+        Type = PlanType.TeamsStarter2023;
+        ProductTier = ProductTierType.TeamsStarter;
+        Name = "Teams (Starter)";
+        NameLocalizationKey = "planNameTeamsStarter";
+        DescriptionLocalizationKey = "planDescTeams";
+        CanBeUsedByBusiness = true;
+
+        TrialPeriodDays = 7;
+
+        HasGroups = true;
+        HasDirectory = true;
+        HasEvents = true;
+        HasTotp = true;
+        Has2fa = true;
+        HasApi = true;
+        UsersGetPremium = true;
+
+        UpgradeSortOrder = 2;
+        DisplaySortOrder = 2;
+
+        PasswordManager = new TeamsStarter2023PasswordManagerFeatures();
+        SecretsManager = new TeamsStarter2023SecretsManagerFeatures();
+        LegacyYear = 2024;
+    }
+
+    private record TeamsStarter2023SecretsManagerFeatures : SecretsManagerPlanFeatures
+    {
+        public TeamsStarter2023SecretsManagerFeatures()
+        {
+            BaseSeats = 0;
+            BasePrice = 0;
+            BaseServiceAccount = 50;
+
+            HasAdditionalSeatsOption = true;
+            HasAdditionalServiceAccountOption = true;
+
+            AllowSeatAutoscale = true;
+            AllowServiceAccountsAutoscale = true;
+
+            StripeSeatPlanId = "secrets-manager-teams-seat-monthly";
+            StripeServiceAccountPlanId = "secrets-manager-service-account-monthly";
+            SeatPrice = 7;
+            AdditionalPricePerServiceAccount = 0.5M;
+        }
+    }
+
+    private record TeamsStarter2023PasswordManagerFeatures : PasswordManagerPlanFeatures
+    {
+        public TeamsStarter2023PasswordManagerFeatures()
+        {
+            BaseSeats = 10;
+            BaseStorageGb = 1;
+            BasePrice = 20;
+
+            MaxSeats = 10;
+
+            HasAdditionalStorageOption = true;
+
+            StripePlanId = "teams-org-starter";
+            StripeStoragePlanId = "storage-gb-monthly";
+            AdditionalStoragePricePerGb = 0.5M;
+        }
+    }
+}

test/Core.Test/Billing/Models/Business/OrganizationLicenseTests.cs

@@ -215,6 +215,7 @@ If you believe you need to change the version for a valid reason, please discuss
             UseOrganizationDomains = true,
             UseAdminSponsoredFamilies = false,
             UseDisableSmAdsForUsers = false
+            UsePhishingBlocker = false,
         };
     }
 

test/Core.Test/Billing/Organizations/Commands/PreviewOrganizationTaxCommandTests.cs

@@ -1,11 +1,11 @@
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.Billing.Enums;
-using Bit.Core.Billing.Models.StaticStore.Plans;
 using Bit.Core.Billing.Organizations.Commands;
 using Bit.Core.Billing.Organizations.Models;
 using Bit.Core.Billing.Payment.Models;
 using Bit.Core.Billing.Pricing;
 using Bit.Core.Services;
+using Bit.Core.Test.Billing.Mocks.Plans;
 using Microsoft.Extensions.Logging;
 using NSubstitute;
 using Stripe;

test/Core.Test/Billing/Organizations/Commands/UpdateOrganizationLicenseCommandTests.cs

@@ -88,7 +88,7 @@ public class UpdateOrganizationLicenseCommandTests
                         "Hash", "Signature", "SignatureBytes", "InstallationId", "Expires",
                         "ExpirationWithoutGracePeriod", "Token", "LimitCollectionCreationDeletion",
                         "LimitCollectionCreation", "LimitCollectionDeletion", "AllowAdminAccessToAllCollectionItems",
-                        "UseOrganizationDomains", "UseAdminSponsoredFamilies", "UseAutomaticUserConfirmation") &&
+                        "UseOrganizationDomains", "UseAdminSponsoredFamilies", "UseAutomaticUserConfirmation", "UsePhishingBlocker") &&
                          // Same property but different name, use explicit mapping
                          org.ExpirationDate == license.Expires));
         }

test/Core.Test/Billing/Organizations/Queries/GetOrganizationMetadataQueryTests.cs

@@ -8,7 +8,7 @@ using Bit.Core.Billing.Services;
 using Bit.Core.Models.Data.Organizations.OrganizationUsers;
 using Bit.Core.Repositories;
 using Bit.Core.Settings;
-using Bit.Core.Utilities;
+using Bit.Core.Test.Billing.Mocks;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using NSubstitute;
@@ -21,15 +21,6 @@ namespace Bit.Core.Test.Billing.Organizations.Queries;
 [SutProviderCustomize]
 public class GetOrganizationMetadataQueryTests
 {
-    [Theory, BitAutoData]
-    public async Task Run_NullOrganization_ReturnsNull(
-        SutProvider<GetOrganizationMetadataQuery> sutProvider)
-    {
-        var result = await sutProvider.Sut.Run(null);
-
-        Assert.Null(result);
-    }
-
     [Theory, BitAutoData]
     public async Task Run_SelfHosted_ReturnsDefault(
         Organization organization,
@@ -74,8 +65,7 @@ public class GetOrganizationMetadataQueryTests
             .Returns(new OrganizationSeatCounts { Users = 5, Sponsored = 0 });
 
         sutProvider.GetDependency<ISubscriberService>()
-            .GetCustomer(organization, Arg.Is<CustomerGetOptions>(options =>
-                options.Expand.Contains("discount.coupon.applies_to")))
+            .GetCustomer(organization)
             .ReturnsNull();
 
         var result = await sutProvider.Sut.Run(organization);
@@ -100,12 +90,12 @@ public class GetOrganizationMetadataQueryTests
             .Returns(new OrganizationSeatCounts { Users = 7, Sponsored = 0 });
 
         sutProvider.GetDependency<ISubscriberService>()
-            .GetCustomer(organization, Arg.Is<CustomerGetOptions>(options =>
-                options.Expand.Contains("discount.coupon.applies_to")))
+            .GetCustomer(organization)
             .Returns(customer);
 
         sutProvider.GetDependency<ISubscriberService>()
-            .GetSubscription(organization)
+            .GetSubscription(organization, Arg.Is<SubscriptionGetOptions>(options =>
+                options.Expand.Contains("discounts.coupon.applies_to")))
             .ReturnsNull();
 
         var result = await sutProvider.Sut.Run(organization);
@@ -124,23 +114,24 @@ public class GetOrganizationMetadataQueryTests
         organization.PlanType = PlanType.EnterpriseAnnually;
 
         var productId = "product_123";
-        var customer = new Customer
-        {
-            Discount = new Discount
-            {
-                Coupon = new Coupon
-                {
-                    Id = StripeConstants.CouponIDs.SecretsManagerStandalone,
-                    AppliesTo = new CouponAppliesTo
-                    {
-                        Products = [productId]
-                    }
-                }
-            }
-        };
+        var customer = new Customer();
 
         var subscription = new Subscription
         {
+            Discounts =
+            [
+                new Discount
+                {
+                    Coupon = new Coupon
+                    {
+                        Id = StripeConstants.CouponIDs.SecretsManagerStandalone,
+                        AppliesTo = new CouponAppliesTo
+                        {
+                            Products = [productId]
+                        }
+                    }
+                }
+            ],
             Items = new StripeList<SubscriptionItem>
             {
                 Data =
@@ -162,17 +153,17 @@ public class GetOrganizationMetadataQueryTests
             .Returns(new OrganizationSeatCounts { Users = 15, Sponsored = 0 });
 
         sutProvider.GetDependency<ISubscriberService>()
-            .GetCustomer(organization, Arg.Is<CustomerGetOptions>(options =>
-                options.Expand.Contains("discount.coupon.applies_to")))
+            .GetCustomer(organization)
             .Returns(customer);
 
         sutProvider.GetDependency<ISubscriberService>()
-            .GetSubscription(organization)
+            .GetSubscription(organization, Arg.Is<SubscriptionGetOptions>(options =>
+                options.Expand.Contains("discounts.coupon.applies_to")))
             .Returns(subscription);
 
         sutProvider.GetDependency<IPricingClient>()
             .GetPlanOrThrow(organization.PlanType)
-            .Returns(StaticStore.GetPlan(organization.PlanType));
+            .Returns(MockPlans.Get(organization.PlanType));
 
         var result = await sutProvider.Sut.Run(organization);
 
@@ -189,13 +180,11 @@ public class GetOrganizationMetadataQueryTests
         organization.GatewaySubscriptionId = "sub_123";
         organization.PlanType = PlanType.TeamsAnnually;
 
-        var customer = new Customer
-        {
-            Discount = null
-        };
+        var customer = new Customer();
 
         var subscription = new Subscription
         {
+            Discounts = null,
             Items = new StripeList<SubscriptionItem>
             {
                 Data =
@@ -217,17 +206,17 @@ public class GetOrganizationMetadataQueryTests
             .Returns(new OrganizationSeatCounts { Users = 20, Sponsored = 0 });
 
         sutProvider.GetDependency<ISubscriberService>()
-            .GetCustomer(organization, Arg.Is<CustomerGetOptions>(options =>
-                options.Expand.Contains("discount.coupon.applies_to")))
+            .GetCustomer(organization)
             .Returns(customer);
 
         sutProvider.GetDependency<ISubscriberService>()
-            .GetSubscription(organization)
+            .GetSubscription(organization, Arg.Is<SubscriptionGetOptions>(options =>
+                options.Expand.Contains("discounts.coupon.applies_to")))
             .Returns(subscription);
 
         sutProvider.GetDependency<IPricingClient>()
             .GetPlanOrThrow(organization.PlanType)
-            .Returns(StaticStore.GetPlan(organization.PlanType));
+            .Returns(MockPlans.Get(organization.PlanType));
 
         var result = await sutProvider.Sut.Run(organization);
 
@@ -244,23 +233,24 @@ public class GetOrganizationMetadataQueryTests
         organization.GatewaySubscriptionId = "sub_123";
         organization.PlanType = PlanType.EnterpriseAnnually;
 
-        var customer = new Customer
-        {
-            Discount = new Discount
-            {
-                Coupon = new Coupon
-                {
-                    Id = StripeConstants.CouponIDs.SecretsManagerStandalone,
-                    AppliesTo = new CouponAppliesTo
-                    {
-                        Products = ["different_product_id"]
-                    }
-                }
-            }
-        };
+        var customer = new Customer();
 
         var subscription = new Subscription
         {
+            Discounts =
+            [
+                new Discount
+                {
+                    Coupon = new Coupon
+                    {
+                        Id = StripeConstants.CouponIDs.SecretsManagerStandalone,
+                        AppliesTo = new CouponAppliesTo
+                        {
+                            Products = ["different_product_id"]
+                        }
+                    }
+                }
+            ],
             Items = new StripeList<SubscriptionItem>
             {
                 Data =
@@ -282,17 +272,17 @@ public class GetOrganizationMetadataQueryTests
             .Returns(new OrganizationSeatCounts { Users = 12, Sponsored = 0 });
 
         sutProvider.GetDependency<ISubscriberService>()
-            .GetCustomer(organization, Arg.Is<CustomerGetOptions>(options =>
-                options.Expand.Contains("discount.coupon.applies_to")))
+            .GetCustomer(organization)
             .Returns(customer);
 
         sutProvider.GetDependency<ISubscriberService>()
-            .GetSubscription(organization)
+            .GetSubscription(organization, Arg.Is<SubscriptionGetOptions>(options =>
+                options.Expand.Contains("discounts.coupon.applies_to")))
             .Returns(subscription);
 
         sutProvider.GetDependency<IPricingClient>()
             .GetPlanOrThrow(organization.PlanType)
-            .Returns(StaticStore.GetPlan(organization.PlanType));
+            .Returns(MockPlans.Get(organization.PlanType));
 
         var result = await sutProvider.Sut.Run(organization);
 
@@ -310,23 +300,24 @@ public class GetOrganizationMetadataQueryTests
         organization.PlanType = PlanType.FamiliesAnnually;
 
         var productId = "product_123";
-        var customer = new Customer
-        {
-            Discount = new Discount
-            {
-                Coupon = new Coupon
-                {
-                    Id = StripeConstants.CouponIDs.SecretsManagerStandalone,
-                    AppliesTo = new CouponAppliesTo
-                    {
-                        Products = [productId]
-                    }
-                }
-            }
-        };
+        var customer = new Customer();
 
         var subscription = new Subscription
         {
+            Discounts =
+            [
+                new Discount
+                {
+                    Coupon = new Coupon
+                    {
+                        Id = StripeConstants.CouponIDs.SecretsManagerStandalone,
+                        AppliesTo = new CouponAppliesTo
+                        {
+                            Products = [productId]
+                        }
+                    }
+                }
+            ],
             Items = new StripeList<SubscriptionItem>
             {
                 Data =
@@ -348,17 +339,17 @@ public class GetOrganizationMetadataQueryTests
             .Returns(new OrganizationSeatCounts { Users = 8, Sponsored = 0 });
 
         sutProvider.GetDependency<ISubscriberService>()
-            .GetCustomer(organization, Arg.Is<CustomerGetOptions>(options =>
-                options.Expand.Contains("discount.coupon.applies_to")))
+            .GetCustomer(organization)
             .Returns(customer);
 
         sutProvider.GetDependency<ISubscriberService>()
-            .GetSubscription(organization)
+            .GetSubscription(organization, Arg.Is<SubscriptionGetOptions>(options =>
+                options.Expand.Contains("discounts.coupon.applies_to")))
             .Returns(subscription);
 
         sutProvider.GetDependency<IPricingClient>()
             .GetPlanOrThrow(organization.PlanType)
-            .Returns(StaticStore.GetPlan(organization.PlanType));
+            .Returns(MockPlans.Get(organization.PlanType));
 
         var result = await sutProvider.Sut.Run(organization);
 

test/Core.Test/Billing/Premium/Commands/CreatePremiumCloudHostedSubscriptionCommandTests.cs

@@ -53,7 +53,7 @@ public class CreatePremiumCloudHostedSubscriptionCommandTests
             Available = true,
             LegacyYear = null,
             Seat = new PremiumPurchasable { Price = 10M, StripePriceId = StripeConstants.Prices.PremiumAnnually },
-            Storage = new PremiumPurchasable { Price = 4M, StripePriceId = StripeConstants.Prices.StoragePlanPersonal }
+            Storage = new PremiumPurchasable { Price = 4M, StripePriceId = StripeConstants.Prices.StoragePlanPersonal, Provided = 1 }
         };
         _pricingClient.GetAvailablePremiumPlan().Returns(premiumPlan);
 
@@ -720,4 +720,63 @@ public class CreatePremiumCloudHostedSubscriptionCommandTests
         await _stripeAdapter.DidNotReceive().SubscriptionCreateAsync(Arg.Any<SubscriptionCreateOptions>());
         await _userService.DidNotReceive().SaveUserAsync(Arg.Any<User>());
     }
+
+    [Theory, BitAutoData]
+    public async Task Run_WithAdditionalStorage_SetsCorrectMaxStorageGb(
+        User user,
+        TokenizedPaymentMethod paymentMethod,
+        BillingAddress billingAddress)
+    {
+        // Arrange
+        user.Premium = false;
+        user.GatewayCustomerId = null;
+        user.Email = "test@example.com";
+        paymentMethod.Type = TokenizablePaymentMethodType.Card;
+        paymentMethod.Token = "card_token_123";
+        billingAddress.Country = "US";
+        billingAddress.PostalCode = "12345";
+        const short additionalStorage = 2;
+
+        // Setup premium plan with 5GB provided storage
+        var premiumPlan = new PremiumPlan
+        {
+            Name = "Premium",
+            Available = true,
+            LegacyYear = null,
+            Seat = new PremiumPurchasable { Price = 10M, StripePriceId = StripeConstants.Prices.PremiumAnnually },
+            Storage = new PremiumPurchasable { Price = 4M, StripePriceId = StripeConstants.Prices.StoragePlanPersonal, Provided = 1 }
+        };
+        _pricingClient.GetAvailablePremiumPlan().Returns(premiumPlan);
+
+        var mockCustomer = Substitute.For<StripeCustomer>();
+        mockCustomer.Id = "cust_123";
+        mockCustomer.Address = new Address { Country = "US", PostalCode = "12345" };
+        mockCustomer.Metadata = new Dictionary<string, string>();
+
+        var mockSubscription = Substitute.For<StripeSubscription>();
+        mockSubscription.Id = "sub_123";
+        mockSubscription.Status = "active";
+        mockSubscription.Items = new StripeList<SubscriptionItem>
+        {
+            Data =
+            [
+                new SubscriptionItem
+                {
+                    CurrentPeriodEnd = DateTime.UtcNow.AddDays(30)
+                }
+            ]
+        };
+
+        _stripeAdapter.CustomerCreateAsync(Arg.Any<CustomerCreateOptions>()).Returns(mockCustomer);
+        _stripeAdapter.SubscriptionCreateAsync(Arg.Any<SubscriptionCreateOptions>()).Returns(mockSubscription);
+
+        // Act
+        var result = await _command.Run(user, paymentMethod, billingAddress, additionalStorage);
+
+        // Assert
+        Assert.True(result.IsT0);
+        Assert.Equal((short)3, user.MaxStorageGb); // 1 (provided) + 2 (additional) = 3
+        await _userService.Received(1).SaveUserAsync(user);
+    }
+
 }

test/Core.Test/Billing/Pricing/PricingClientTests.cs

@@ -0,0 +1,474 @@
+using System.Net;
+using Bit.Core.Billing;
+using Bit.Core.Billing.Enums;
+using Bit.Core.Billing.Pricing;
+using Bit.Core.Services;
+using Bit.Test.Common.AutoFixture;
+using Bit.Test.Common.AutoFixture.Attributes;
+using Microsoft.Extensions.Logging;
+using NSubstitute;
+using RichardSzalay.MockHttp;
+using Xunit;
+using GlobalSettings = Bit.Core.Settings.GlobalSettings;
+
+namespace Bit.Core.Test.Billing.Pricing;
+
+[SutProviderCustomize]
+public class PricingClientTests
+{
+    #region GetLookupKey Tests (via GetPlan)
+
+    [Fact]
+    public async Task GetPlan_WithFamiliesAnnually2025AndFeatureFlagEnabled_UsesFamilies2025LookupKey()
+    {
+        // Arrange
+        var mockHttp = new MockHttpMessageHandler();
+        var planJson = CreatePlanJson("families-2025", "Families 2025", "families", 40M, "price_id");
+
+        mockHttp.Expect(HttpMethod.Get, "https://test.com/plans/organization/families-2025")
+            .Respond("application/json", planJson);
+
+        mockHttp.When(HttpMethod.Get, "*/plans/organization/*")
+            .Respond("application/json", planJson);
+
+        var featureService = Substitute.For<IFeatureService>();
+        featureService.IsEnabled(FeatureFlagKeys.PM26462_Milestone_3).Returns(true);
+
+        var globalSettings = new GlobalSettings { SelfHosted = false };
+
+        var httpClient = new HttpClient(mockHttp)
+        {
+            BaseAddress = new Uri("https://test.com/")
+        };
+
+        var logger = Substitute.For<ILogger<PricingClient>>();
+        var pricingClient = new PricingClient(featureService, globalSettings, httpClient, logger);
+
+        // Act
+        var result = await pricingClient.GetPlan(PlanType.FamiliesAnnually2025);
+
+        // Assert
+        Assert.NotNull(result);
+        Assert.Equal(PlanType.FamiliesAnnually2025, result.Type);
+        mockHttp.VerifyNoOutstandingExpectation();
+    }
+
+    [Fact]
+    public async Task GetPlan_WithFamiliesAnnually2025AndFeatureFlagDisabled_UsesFamiliesLookupKey()
+    {
+        // Arrange
+        var mockHttp = new MockHttpMessageHandler();
+        var planJson = CreatePlanJson("families", "Families", "families", 40M, "price_id");
+
+        mockHttp.Expect(HttpMethod.Get, "https://test.com/plans/organization/families")
+            .Respond("application/json", planJson);
+
+        mockHttp.When(HttpMethod.Get, "*/plans/organization/*")
+            .Respond("application/json", planJson);
+
+        var featureService = Substitute.For<IFeatureService>();
+        featureService.IsEnabled(FeatureFlagKeys.PM26462_Milestone_3).Returns(false);
+
+        var globalSettings = new GlobalSettings { SelfHosted = false };
+
+        var httpClient = new HttpClient(mockHttp)
+        {
+            BaseAddress = new Uri("https://test.com/")
+        };
+
+        var logger = Substitute.For<ILogger<PricingClient>>();
+        var pricingClient = new PricingClient(featureService, globalSettings, httpClient, logger);
+
+        // Act
+        var result = await pricingClient.GetPlan(PlanType.FamiliesAnnually2025);
+
+        // Assert
+        Assert.NotNull(result);
+        // PreProcessFamiliesPreMigrationPlan should change "families" to "families-2025" when FF is disabled
+        Assert.Equal(PlanType.FamiliesAnnually2025, result.Type);
+        mockHttp.VerifyNoOutstandingExpectation();
+    }
+
+    #endregion
+
+    #region PreProcessFamiliesPreMigrationPlan Tests (via GetPlan)
+
+    [Fact]
+    public async Task GetPlan_WithFamiliesAnnually2025AndFeatureFlagDisabled_ReturnsFamiliesAnnually2025PlanType()
+    {
+        // Arrange
+        var mockHttp = new MockHttpMessageHandler();
+        // billing-pricing returns "families" lookup key because the flag is off
+        var planJson = CreatePlanJson("families", "Families", "families", 40M, "price_id");
+
+        mockHttp.When(HttpMethod.Get, "*/plans/organization/*")
+            .Respond("application/json", planJson);
+
+        var featureService = Substitute.For<IFeatureService>();
+        featureService.IsEnabled(FeatureFlagKeys.PM26462_Milestone_3).Returns(false);
+
+        var globalSettings = new GlobalSettings { SelfHosted = false };
+
+        var httpClient = new HttpClient(mockHttp)
+        {
+            BaseAddress = new Uri("https://test.com/")
+        };
+
+        var logger = Substitute.For<ILogger<PricingClient>>();
+        var pricingClient = new PricingClient(featureService, globalSettings, httpClient, logger);
+
+        // Act
+        var result = await pricingClient.GetPlan(PlanType.FamiliesAnnually2025);
+
+        // Assert
+        Assert.NotNull(result);
+        // PreProcessFamiliesPreMigrationPlan should convert the families lookup key to families-2025
+        // and the PlanAdapter should assign the correct FamiliesAnnually2025 plan type
+        Assert.Equal(PlanType.FamiliesAnnually2025, result.Type);
+        mockHttp.VerifyNoOutstandingExpectation();
+    }
+
+    [Fact]
+    public async Task GetPlan_WithFamiliesAnnually2025AndFeatureFlagEnabled_ReturnsFamiliesAnnually2025PlanType()
+    {
+        // Arrange
+        var mockHttp = new MockHttpMessageHandler();
+        var planJson = CreatePlanJson("families-2025", "Families", "families", 40M, "price_id");
+
+        mockHttp.When(HttpMethod.Get, "*/plans/organization/*")
+            .Respond("application/json", planJson);
+
+        var featureService = Substitute.For<IFeatureService>();
+        featureService.IsEnabled(FeatureFlagKeys.PM26462_Milestone_3).Returns(true);
+
+        var globalSettings = new GlobalSettings { SelfHosted = false };
+
+        var httpClient = new HttpClient(mockHttp)
+        {
+            BaseAddress = new Uri("https://test.com/")
+        };
+
+        var logger = Substitute.For<ILogger<PricingClient>>();
+        var pricingClient = new PricingClient(featureService, globalSettings, httpClient, logger);
+
+        // Act
+        var result = await pricingClient.GetPlan(PlanType.FamiliesAnnually2025);
+
+        // Assert
+        Assert.NotNull(result);
+        // PreProcessFamiliesPreMigrationPlan should ignore the lookup key because the flag is on
+        // and the PlanAdapter should assign the correct FamiliesAnnually2025 plan type
+        Assert.Equal(PlanType.FamiliesAnnually2025, result.Type);
+        mockHttp.VerifyNoOutstandingExpectation();
+    }
+
+    [Fact]
+    public async Task GetPlan_WithFamiliesAnnuallyAndFeatureFlagEnabled_ReturnsFamiliesAnnuallyPlanType()
+    {
+        // Arrange
+        var mockHttp = new MockHttpMessageHandler();
+        var planJson = CreatePlanJson("families", "Families", "families", 40M, "price_id");
+
+        mockHttp.When(HttpMethod.Get, "*/plans/organization/*")
+            .Respond("application/json", planJson);
+
+        var featureService = Substitute.For<IFeatureService>();
+        featureService.IsEnabled(FeatureFlagKeys.PM26462_Milestone_3).Returns(true);
+
+        var globalSettings = new GlobalSettings { SelfHosted = false };
+
+        var httpClient = new HttpClient(mockHttp)
+        {
+            BaseAddress = new Uri("https://test.com/")
+        };
+
+        var logger = Substitute.For<ILogger<PricingClient>>();
+        var pricingClient = new PricingClient(featureService, globalSettings, httpClient, logger);
+
+        // Act
+        var result = await pricingClient.GetPlan(PlanType.FamiliesAnnually);
+
+        // Assert
+        Assert.NotNull(result);
+        // PreProcessFamiliesPreMigrationPlan should ignore the lookup key because the flag is on
+        // and the PlanAdapter should assign the correct FamiliesAnnually plan type
+        Assert.Equal(PlanType.FamiliesAnnually, result.Type);
+        mockHttp.VerifyNoOutstandingExpectation();
+    }
+
+    [Fact]
+    public async Task GetPlan_WithOtherLookupKey_KeepsLookupKeyUnchanged()
+    {
+        // Arrange
+        var mockHttp = new MockHttpMessageHandler();
+        var planJson = CreatePlanJson("enterprise-annually", "Enterprise", "enterprise", 144M, "price_id");
+
+        mockHttp.Expect(HttpMethod.Get, "https://test.com/plans/organization/enterprise-annually")
+            .Respond("application/json", planJson);
+
+        mockHttp.When(HttpMethod.Get, "*/plans/organization/*")
+            .Respond("application/json", planJson);
+
+        var featureService = Substitute.For<IFeatureService>();
+        featureService.IsEnabled(FeatureFlagKeys.PM26462_Milestone_3).Returns(false);
+
+        var globalSettings = new GlobalSettings { SelfHosted = false };
+
+        var httpClient = new HttpClient(mockHttp)
+        {
+            BaseAddress = new Uri("https://test.com/")
+        };
+
+        var logger = Substitute.For<ILogger<PricingClient>>();
+        var pricingClient = new PricingClient(featureService, globalSettings, httpClient, logger);
+
+        // Act
+        var result = await pricingClient.GetPlan(PlanType.EnterpriseAnnually);
+
+        // Assert
+        Assert.NotNull(result);
+        Assert.Equal(PlanType.EnterpriseAnnually, result.Type);
+        mockHttp.VerifyNoOutstandingExpectation();
+    }
+
+    #endregion
+
+    #region ListPlans Tests
+
+    [Fact]
+    public async Task ListPlans_WithFeatureFlagDisabled_ReturnsListWithPreProcessing()
+    {
+        // Arrange
+        var mockHttp = new MockHttpMessageHandler();
+        // biling-pricing would return "families" because the flag is disabled
+        var plansJson = $@"[
+            {CreatePlanJson("families", "Families", "families", 40M, "price_id")},
+            {CreatePlanJson("enterprise-annually", "Enterprise", "enterprise", 144M, "price_id")}
+        ]";
+
+        mockHttp.When(HttpMethod.Get, "*/plans/organization")
+            .Respond("application/json", plansJson);
+
+        var featureService = Substitute.For<IFeatureService>();
+        featureService.IsEnabled(FeatureFlagKeys.PM26462_Milestone_3).Returns(false);
+
+        var globalSettings = new GlobalSettings { SelfHosted = false };
+
+        var httpClient = new HttpClient(mockHttp)
+        {
+            BaseAddress = new Uri("https://test.com/")
+        };
+
+        var logger = Substitute.For<ILogger<PricingClient>>();
+        var pricingClient = new PricingClient(featureService, globalSettings, httpClient, logger);
+
+        // Act
+        var result = await pricingClient.ListPlans();
+
+        // Assert
+        Assert.NotNull(result);
+        Assert.Equal(2, result.Count);
+        // First plan should have been preprocessed from "families" to "families-2025"
+        Assert.Equal(PlanType.FamiliesAnnually2025, result[0].Type);
+        // Second plan should remain unchanged
+        Assert.Equal(PlanType.EnterpriseAnnually, result[1].Type);
+        mockHttp.VerifyNoOutstandingExpectation();
+    }
+
+    [Fact]
+    public async Task ListPlans_WithFeatureFlagEnabled_ReturnsListWithoutPreProcessing()
+    {
+        // Arrange
+        var mockHttp = new MockHttpMessageHandler();
+        var plansJson = $@"[
+            {CreatePlanJson("families", "Families", "families", 40M, "price_id")}
+        ]";
+
+        mockHttp.When(HttpMethod.Get, "*/plans/organization")
+            .Respond("application/json", plansJson);
+
+        var featureService = Substitute.For<IFeatureService>();
+        featureService.IsEnabled(FeatureFlagKeys.PM26462_Milestone_3).Returns(true);
+
+        var globalSettings = new GlobalSettings { SelfHosted = false };
+
+        var httpClient = new HttpClient(mockHttp)
+        {
+            BaseAddress = new Uri("https://test.com/")
+        };
+
+        var logger = Substitute.For<ILogger<PricingClient>>();
+        var pricingClient = new PricingClient(featureService, globalSettings, httpClient, logger);
+
+        // Act
+        var result = await pricingClient.ListPlans();
+
+        // Assert
+        Assert.NotNull(result);
+        Assert.Single(result);
+        // Plan should remain as FamiliesAnnually when FF is enabled
+        Assert.Equal(PlanType.FamiliesAnnually, result[0].Type);
+        mockHttp.VerifyNoOutstandingExpectation();
+    }
+
+    #endregion
+
+    #region GetPlan - Additional Coverage
+
+    [Theory, BitAutoData]
+    public async Task GetPlan_WhenSelfHosted_ReturnsNull(
+        SutProvider<PricingClient> sutProvider)
+    {
+        // Arrange
+        var globalSettings = sutProvider.GetDependency<GlobalSettings>();
+        globalSettings.SelfHosted = true;
+
+        // Act
+        var result = await sutProvider.Sut.GetPlan(PlanType.FamiliesAnnually2025);
+
+        // Assert
+        Assert.Null(result);
+    }
+
+    [Theory, BitAutoData]
+    public async Task GetPlan_WhenLookupKeyNotFound_ReturnsNull(
+        SutProvider<PricingClient> sutProvider)
+    {
+        // Arrange
+        sutProvider.GetDependency<GlobalSettings>().SelfHosted = false;
+
+        // Act - Using PlanType that doesn't have a lookup key mapping
+        var result = await sutProvider.Sut.GetPlan(unchecked((PlanType)999));
+
+        // Assert
+        Assert.Null(result);
+    }
+
+    [Fact]
+    public async Task GetPlan_WhenPricingServiceReturnsNotFound_ReturnsNull()
+    {
+        // Arrange
+        var mockHttp = new MockHttpMessageHandler();
+        mockHttp.When(HttpMethod.Get, "*/plans/organization/*")
+            .Respond(HttpStatusCode.NotFound);
+
+        var featureService = Substitute.For<IFeatureService>();
+        featureService.IsEnabled(FeatureFlagKeys.PM26462_Milestone_3).Returns(true);
+
+        var globalSettings = new GlobalSettings { SelfHosted = false };
+
+        var httpClient = new HttpClient(mockHttp)
+        {
+            BaseAddress = new Uri("https://test.com/")
+        };
+
+        var logger = Substitute.For<ILogger<PricingClient>>();
+        var pricingClient = new PricingClient(featureService, globalSettings, httpClient, logger);
+
+        // Act
+        var result = await pricingClient.GetPlan(PlanType.FamiliesAnnually2025);
+
+        // Assert
+        Assert.Null(result);
+    }
+
+    [Fact]
+    public async Task GetPlan_WhenPricingServiceReturnsError_ThrowsBillingException()
+    {
+        // Arrange
+        var mockHttp = new MockHttpMessageHandler();
+        mockHttp.When(HttpMethod.Get, "*/plans/organization/*")
+            .Respond(HttpStatusCode.InternalServerError);
+
+        var featureService = Substitute.For<IFeatureService>();
+        featureService.IsEnabled(FeatureFlagKeys.PM26462_Milestone_3).Returns(true);
+
+        var globalSettings = new GlobalSettings { SelfHosted = false };
+
+        var httpClient = new HttpClient(mockHttp)
+        {
+            BaseAddress = new Uri("https://test.com/")
+        };
+
+        var logger = Substitute.For<ILogger<PricingClient>>();
+        var pricingClient = new PricingClient(featureService, globalSettings, httpClient, logger);
+
+        // Act & Assert
+        await Assert.ThrowsAsync<BillingException>(() =>
+            pricingClient.GetPlan(PlanType.FamiliesAnnually2025));
+    }
+
+    #endregion
+
+    #region ListPlans - Additional Coverage
+
+    [Theory, BitAutoData]
+    public async Task ListPlans_WhenSelfHosted_ReturnsEmptyList(
+        SutProvider<PricingClient> sutProvider)
+    {
+        // Arrange
+        var globalSettings = sutProvider.GetDependency<GlobalSettings>();
+        globalSettings.SelfHosted = true;
+
+        // Act
+        var result = await sutProvider.Sut.ListPlans();
+
+        // Assert
+        Assert.NotNull(result);
+        Assert.Empty(result);
+    }
+
+    [Fact]
+    public async Task ListPlans_WhenPricingServiceReturnsError_ThrowsBillingException()
+    {
+        // Arrange
+        var mockHttp = new MockHttpMessageHandler();
+        mockHttp.When(HttpMethod.Get, "*/plans/organization")
+            .Respond(HttpStatusCode.InternalServerError);
+
+        var featureService = Substitute.For<IFeatureService>();
+
+        var globalSettings = new GlobalSettings { SelfHosted = false };
+
+        var httpClient = new HttpClient(mockHttp)
+        {
+            BaseAddress = new Uri("https://test.com/")
+        };
+
+        var logger = Substitute.For<ILogger<PricingClient>>();
+        var pricingClient = new PricingClient(featureService, globalSettings, httpClient, logger);
+
+        // Act & Assert
+        await Assert.ThrowsAsync<BillingException>(() =>
+            pricingClient.ListPlans());
+    }
+
+    #endregion
+
+    private static string CreatePlanJson(
+        string lookupKey,
+        string name,
+        string tier,
+        decimal seatsPrice,
+        string seatsStripePriceId,
+        int seatsQuantity = 1)
+    {
+        return $@"{{
+            ""lookupKey"": ""{lookupKey}"",
+            ""name"": ""{name}"",
+            ""tier"": ""{tier}"",
+            ""features"": [],
+            ""seats"": {{
+                ""type"": ""packaged"",
+                ""quantity"": {seatsQuantity},
+                ""price"": {seatsPrice},
+                ""stripePriceId"": ""{seatsStripePriceId}""
+            }},
+            ""canUpgradeTo"": [],
+            ""additionalData"": {{
+                ""nameLocalizationKey"": ""{lookupKey}Name"",
+                ""descriptionLocalizationKey"": ""{lookupKey}Description""
+            }}
+        }}";
+    }
+}

test/Core.Test/Billing/Services/OrganizationBillingServiceTests.cs

@@ -1,4 +1,5 @@
 using Bit.Core.AdminConsole.Entities;
+using Bit.Core.Billing;
 using Bit.Core.Billing.Constants;
 using Bit.Core.Billing.Enums;
 using Bit.Core.Billing.Models.Sales;
@@ -10,7 +11,7 @@ using Bit.Core.Billing.Services;
 using Bit.Core.Models.Data.Organizations.OrganizationUsers;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
-using Bit.Core.Utilities;
+using Bit.Core.Test.Billing.Mocks;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using NSubstitute;
@@ -31,38 +32,39 @@ public class OrganizationBillingServiceTests
         SutProvider<OrganizationBillingService> sutProvider)
     {
         sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(organizationId).Returns(organization);
-        sutProvider.GetDependency<IPricingClient>().ListPlans().Returns(StaticStore.Plans.ToList());
+        sutProvider.GetDependency<IPricingClient>().ListPlans().Returns(MockPlans.Plans.ToList());
 
         sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(organization.PlanType)
-            .Returns(StaticStore.GetPlan(organization.PlanType));
+            .Returns(MockPlans.Get(organization.PlanType));
 
         var subscriberService = sutProvider.GetDependency<ISubscriberService>();
         var organizationSeatCount = new OrganizationSeatCounts { Users = 1, Sponsored = 0 };
-        var customer = new Customer
-        {
-            Discount = new Discount
-            {
-                Coupon = new Coupon
-                {
-                    Id = StripeConstants.CouponIDs.SecretsManagerStandalone,
-                    AppliesTo = new CouponAppliesTo
-                    {
-                        Products = ["product_id"]
-                    }
-                }
-            }
-        };
+        var customer = new Customer();
 
         subscriberService
-            .GetCustomer(organization, Arg.Is<CustomerGetOptions>(options =>
-                options.Expand.Contains("discount.coupon.applies_to")))
+            .GetCustomer(organization)
             .Returns(customer);
 
-        subscriberService.GetSubscription(organization).Returns(new Subscription
-        {
-            Items = new StripeList<SubscriptionItem>
+        subscriberService.GetSubscription(organization, Arg.Is<SubscriptionGetOptions>(options =>
+            options.Expand.Contains("discounts.coupon.applies_to"))).Returns(new Subscription
             {
-                Data =
+                Discounts =
+            [
+                new Discount
+                {
+                    Coupon = new Coupon
+                    {
+                        Id = StripeConstants.CouponIDs.SecretsManagerStandalone,
+                        AppliesTo = new CouponAppliesTo
+                        {
+                            Products = ["product_id"]
+                        }
+                    }
+                }
+            ],
+                Items = new StripeList<SubscriptionItem>
+                {
+                    Data =
                 [
                     new SubscriptionItem
                     {
@@ -72,8 +74,8 @@ public class OrganizationBillingServiceTests
                         }
                     }
                 ]
-            }
-        });
+                }
+            });
 
         sutProvider.GetDependency<IOrganizationRepository>()
             .GetOccupiedSeatCountByOrganizationIdAsync(organization.Id)
@@ -96,10 +98,10 @@ public class OrganizationBillingServiceTests
     {
         sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(organizationId).Returns(organization);
 
-        sutProvider.GetDependency<IPricingClient>().ListPlans().Returns(StaticStore.Plans.ToList());
+        sutProvider.GetDependency<IPricingClient>().ListPlans().Returns(MockPlans.Plans.ToList());
 
         sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(organization.PlanType)
-            .Returns(StaticStore.GetPlan(organization.PlanType));
+            .Returns(MockPlans.Get(organization.PlanType));
 
         sutProvider.GetDependency<IOrganizationRepository>()
             .GetOccupiedSeatCountByOrganizationIdAsync(organization.Id)
@@ -109,11 +111,12 @@ public class OrganizationBillingServiceTests
 
         // Set up subscriber service to return null for customer
         subscriberService
-            .GetCustomer(organization, Arg.Is<CustomerGetOptions>(options => options.Expand.FirstOrDefault() == "discount.coupon.applies_to"))
+            .GetCustomer(organization)
             .Returns((Customer)null);
 
         // Set up subscriber service to return null for subscription
-        subscriberService.GetSubscription(organization).Returns((Subscription)null);
+        subscriberService.GetSubscription(organization, Arg.Is<SubscriptionGetOptions>(options =>
+            options.Expand.Contains("discounts.coupon.applies_to"))).Returns((Subscription)null);
 
         var metadata = await sutProvider.Sut.GetMetadata(organizationId);
 
@@ -132,7 +135,7 @@ public class OrganizationBillingServiceTests
         SutProvider<OrganizationBillingService> sutProvider)
     {
         // Arrange
-        var plan = StaticStore.GetPlan(PlanType.TeamsAnnually);
+        var plan = MockPlans.Get(PlanType.TeamsAnnually);
         organization.PlanType = PlanType.TeamsAnnually;
         organization.GatewayCustomerId = "cus_test123";
         organization.GatewaySubscriptionId = null;
@@ -208,7 +211,7 @@ public class OrganizationBillingServiceTests
         SutProvider<OrganizationBillingService> sutProvider)
     {
         // Arrange
-        var plan = StaticStore.GetPlan(PlanType.TeamsAnnually);
+        var plan = MockPlans.Get(PlanType.TeamsAnnually);
         organization.PlanType = PlanType.TeamsAnnually;
         organization.GatewayCustomerId = "cus_test123";
         organization.GatewaySubscriptionId = null;
@@ -282,7 +285,7 @@ public class OrganizationBillingServiceTests
         SutProvider<OrganizationBillingService> sutProvider)
     {
         // Arrange
-        var plan = StaticStore.GetPlan(PlanType.TeamsAnnually);
+        var plan = MockPlans.Get(PlanType.TeamsAnnually);
         organization.PlanType = PlanType.TeamsAnnually;
         organization.GatewayCustomerId = "cus_test123";
         organization.GatewaySubscriptionId = null;
@@ -351,4 +354,97 @@ public class OrganizationBillingServiceTests
     }
 
     #endregion
+
+    [Theory, BitAutoData]
+    public async Task UpdateOrganizationNameAndEmail_UpdatesStripeCustomer(
+        Organization organization,
+        SutProvider<OrganizationBillingService> sutProvider)
+    {
+        organization.Name = "Short name";
+
+        CustomerUpdateOptions capturedOptions = null;
+        sutProvider.GetDependency<IStripeAdapter>()
+            .CustomerUpdateAsync(
+                Arg.Is<string>(id => id == organization.GatewayCustomerId),
+                Arg.Do<CustomerUpdateOptions>(options => capturedOptions = options))
+            .Returns(new Customer());
+
+        // Act
+        await sutProvider.Sut.UpdateOrganizationNameAndEmail(organization);
+
+        // Assert
+        await sutProvider.GetDependency<IStripeAdapter>()
+            .Received(1)
+            .CustomerUpdateAsync(
+                organization.GatewayCustomerId,
+                Arg.Any<CustomerUpdateOptions>());
+
+        Assert.NotNull(capturedOptions);
+        Assert.Equal(organization.BillingEmail, capturedOptions.Email);
+        Assert.Equal(organization.DisplayName(), capturedOptions.Description);
+        Assert.NotNull(capturedOptions.InvoiceSettings);
+        Assert.NotNull(capturedOptions.InvoiceSettings.CustomFields);
+        Assert.Single(capturedOptions.InvoiceSettings.CustomFields);
+
+        var customField = capturedOptions.InvoiceSettings.CustomFields.First();
+        Assert.Equal(organization.SubscriberType(), customField.Name);
+        Assert.Equal(organization.DisplayName(), customField.Value);
+    }
+
+    [Theory, BitAutoData]
+    public async Task UpdateOrganizationNameAndEmail_WhenNameIsLong_TruncatesTo30Characters(
+        Organization organization,
+        SutProvider<OrganizationBillingService> sutProvider)
+    {
+        // Arrange
+        organization.Name = "This is a very long organization name that exceeds thirty characters";
+
+        CustomerUpdateOptions capturedOptions = null;
+        sutProvider.GetDependency<IStripeAdapter>()
+            .CustomerUpdateAsync(
+                Arg.Is<string>(id => id == organization.GatewayCustomerId),
+                Arg.Do<CustomerUpdateOptions>(options => capturedOptions = options))
+            .Returns(new Customer());
+
+        // Act
+        await sutProvider.Sut.UpdateOrganizationNameAndEmail(organization);
+
+        // Assert
+        await sutProvider.GetDependency<IStripeAdapter>()
+            .Received(1)
+            .CustomerUpdateAsync(
+                organization.GatewayCustomerId,
+                Arg.Any<CustomerUpdateOptions>());
+
+        Assert.NotNull(capturedOptions);
+        Assert.NotNull(capturedOptions.InvoiceSettings);
+        Assert.NotNull(capturedOptions.InvoiceSettings.CustomFields);
+
+        var customField = capturedOptions.InvoiceSettings.CustomFields.First();
+        Assert.Equal(30, customField.Value.Length);
+
+        var expectedCustomFieldDisplayName = "This is a very long organizati";
+        Assert.Equal(expectedCustomFieldDisplayName, customField.Value);
+    }
+
+    [Theory, BitAutoData]
+    public async Task UpdateOrganizationNameAndEmail_WhenGatewayCustomerIdIsNull_ThrowsBillingException(
+        Organization organization,
+        SutProvider<OrganizationBillingService> sutProvider)
+    {
+        // Arrange
+        organization.GatewayCustomerId = null;
+        organization.Name = "Test Organization";
+        organization.BillingEmail = "billing@example.com";
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BillingException>(
+            () => sutProvider.Sut.UpdateOrganizationNameAndEmail(organization));
+
+        Assert.Contains("Cannot update an organization in Stripe without a GatewayCustomerId.", exception.Response);
+
+        await sutProvider.GetDependency<IStripeAdapter>()
+            .DidNotReceiveWithAnyArgs()
+            .CustomerUpdateAsync(Arg.Any<string>(), Arg.Any<CustomerUpdateOptions>());
+    }
 }

test/Core.Test/Context/CurrentContextTests.cs

@@ -107,30 +107,6 @@ public class CurrentContextTests
         Assert.Equal(deviceType, sutProvider.Sut.DeviceType);
     }
 
-    [Theory, BitAutoData]
-    public async Task BuildAsync_HttpContext_SetsCloudflareFlags(
-        SutProvider<CurrentContext> sutProvider)
-    {
-        var httpContext = new DefaultHttpContext();
-        var globalSettings = new Core.Settings.GlobalSettings();
-        sutProvider.Sut.BotScore = null;
-        // Arrange
-        var botScore = 85;
-        httpContext.Request.Headers["X-Cf-Bot-Score"] = botScore.ToString();
-        httpContext.Request.Headers["X-Cf-Worked-Proxied"] = "1";
-        httpContext.Request.Headers["X-Cf-Is-Bot"] = "1";
-        httpContext.Request.Headers["X-Cf-Maybe-Bot"] = "1";
-
-        // Act
-        await sutProvider.Sut.BuildAsync(httpContext, globalSettings);
-
-        // Assert
-        Assert.True(sutProvider.Sut.CloudflareWorkerProxied);
-        Assert.True(sutProvider.Sut.IsBot);
-        Assert.True(sutProvider.Sut.MaybeBot);
-        Assert.Equal(botScore, sutProvider.Sut.BotScore);
-    }
-
     [Theory, BitAutoData]
     public async Task BuildAsync_HttpContext_SetsClientVersion(
         SutProvider<CurrentContext> sutProvider)

test/Core.Test/Models/Business/BillingCustomerDiscountTests.cs

@@ -0,0 +1,497 @@
+using Bit.Core.Models.Business;
+using Bit.Test.Common.AutoFixture.Attributes;
+using Stripe;
+using Xunit;
+
+namespace Bit.Core.Test.Models.Business;
+
+public class BillingCustomerDiscountTests
+{
+    [Theory]
+    [BitAutoData]
+    public void Constructor_PercentageDiscount_SetsIdActivePercentOffAndAppliesTo(string couponId)
+    {
+        // Arrange
+        var discount = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = couponId,
+                PercentOff = 25.5m,
+                AmountOff = null,
+                AppliesTo = new CouponAppliesTo
+                {
+                    Products = new List<string> { "product1", "product2" }
+                }
+            },
+            End = null // Active discount
+        };
+
+        // Act
+        var result = new SubscriptionInfo.BillingCustomerDiscount(discount);
+
+        // Assert
+        Assert.Equal(couponId, result.Id);
+        Assert.True(result.Active);
+        Assert.Equal(25.5m, result.PercentOff);
+        Assert.Null(result.AmountOff);
+        Assert.NotNull(result.AppliesTo);
+        Assert.Equal(2, result.AppliesTo.Count);
+        Assert.Contains("product1", result.AppliesTo);
+        Assert.Contains("product2", result.AppliesTo);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_AmountDiscount_ConvertsFromCentsToDollars(string couponId)
+    {
+        // Arrange - Stripe sends 1400 cents for $14.00
+        var discount = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = couponId,
+                PercentOff = null,
+                AmountOff = 1400, // 1400 cents
+                AppliesTo = new CouponAppliesTo
+                {
+                    Products = new List<string>()
+                }
+            },
+            End = null
+        };
+
+        // Act
+        var result = new SubscriptionInfo.BillingCustomerDiscount(discount);
+
+        // Assert
+        Assert.Equal(couponId, result.Id);
+        Assert.True(result.Active);
+        Assert.Null(result.PercentOff);
+        Assert.Equal(14.00m, result.AmountOff); // Converted to dollars
+        Assert.NotNull(result.AppliesTo);
+        Assert.Empty(result.AppliesTo);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_InactiveDiscount_SetsActiveToFalse(string couponId)
+    {
+        // Arrange
+        var discount = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = couponId,
+                PercentOff = 15m
+            },
+            End = DateTime.UtcNow.AddDays(-1) // Expired discount
+        };
+
+        // Act
+        var result = new SubscriptionInfo.BillingCustomerDiscount(discount);
+
+        // Assert
+        Assert.Equal(couponId, result.Id);
+        Assert.False(result.Active);
+        Assert.Equal(15m, result.PercentOff);
+    }
+
+    [Fact]
+    public void Constructor_NullCoupon_SetsDiscountPropertiesToNull()
+    {
+        // Arrange
+        var discount = new Discount
+        {
+            Coupon = null,
+            End = null
+        };
+
+        // Act
+        var result = new SubscriptionInfo.BillingCustomerDiscount(discount);
+
+        // Assert
+        Assert.Null(result.Id);
+        Assert.True(result.Active);
+        Assert.Null(result.PercentOff);
+        Assert.Null(result.AmountOff);
+        Assert.Null(result.AppliesTo);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_NullAmountOff_SetsAmountOffToNull(string couponId)
+    {
+        // Arrange
+        var discount = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = couponId,
+                PercentOff = 10m,
+                AmountOff = null
+            },
+            End = null
+        };
+
+        // Act
+        var result = new SubscriptionInfo.BillingCustomerDiscount(discount);
+
+        // Assert
+        Assert.Null(result.AmountOff);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_ZeroAmountOff_ConvertsCorrectly(string couponId)
+    {
+        // Arrange
+        var discount = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = couponId,
+                AmountOff = 0
+            },
+            End = null
+        };
+
+        // Act
+        var result = new SubscriptionInfo.BillingCustomerDiscount(discount);
+
+        // Assert
+        Assert.Equal(0m, result.AmountOff);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_LargeAmountOff_ConvertsCorrectly(string couponId)
+    {
+        // Arrange - $100.00 discount
+        var discount = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = couponId,
+                AmountOff = 10000 // 10000 cents = $100.00
+            },
+            End = null
+        };
+
+        // Act
+        var result = new SubscriptionInfo.BillingCustomerDiscount(discount);
+
+        // Assert
+        Assert.Equal(100.00m, result.AmountOff);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_SmallAmountOff_ConvertsCorrectly(string couponId)
+    {
+        // Arrange - $0.50 discount
+        var discount = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = couponId,
+                AmountOff = 50 // 50 cents = $0.50
+            },
+            End = null
+        };
+
+        // Act
+        var result = new SubscriptionInfo.BillingCustomerDiscount(discount);
+
+        // Assert
+        Assert.Equal(0.50m, result.AmountOff);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_BothDiscountTypes_SetsPercentOffAndAmountOff(string couponId)
+    {
+        // Arrange - Coupon with both percentage and amount (edge case)
+        var discount = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = couponId,
+                PercentOff = 20m,
+                AmountOff = 500 // $5.00
+            },
+            End = null
+        };
+
+        // Act
+        var result = new SubscriptionInfo.BillingCustomerDiscount(discount);
+
+        // Assert
+        Assert.Equal(20m, result.PercentOff);
+        Assert.Equal(5.00m, result.AmountOff);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_WithNullAppliesTo_SetsAppliesToNull(string couponId)
+    {
+        // Arrange
+        var discount = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = couponId,
+                PercentOff = 10m,
+                AppliesTo = null
+            },
+            End = null
+        };
+
+        // Act
+        var result = new SubscriptionInfo.BillingCustomerDiscount(discount);
+
+        // Assert
+        Assert.Null(result.AppliesTo);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_WithNullProductsList_SetsAppliesToNull(string couponId)
+    {
+        // Arrange
+        var discount = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = couponId,
+                PercentOff = 10m,
+                AppliesTo = new CouponAppliesTo
+                {
+                    Products = null
+                }
+            },
+            End = null
+        };
+
+        // Act
+        var result = new SubscriptionInfo.BillingCustomerDiscount(discount);
+
+        // Assert
+        Assert.Null(result.AppliesTo);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_WithDecimalAmountOff_RoundsCorrectly(string couponId)
+    {
+        // Arrange - 1425 cents = $14.25
+        var discount = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = couponId,
+                AmountOff = 1425
+            },
+            End = null
+        };
+
+        // Act
+        var result = new SubscriptionInfo.BillingCustomerDiscount(discount);
+
+        // Assert
+        Assert.Equal(14.25m, result.AmountOff);
+    }
+
+    [Fact]
+    public void Constructor_DefaultConstructor_InitializesAllPropertiesToNullOrFalse()
+    {
+        // Act
+        var result = new SubscriptionInfo.BillingCustomerDiscount();
+
+        // Assert
+        Assert.Null(result.Id);
+        Assert.False(result.Active);
+        Assert.Null(result.PercentOff);
+        Assert.Null(result.AmountOff);
+        Assert.Null(result.AppliesTo);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_WithFutureEndDate_SetsActiveToFalse(string couponId)
+    {
+        // Arrange - Discount expires in the future
+        var discount = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = couponId,
+                PercentOff = 20m
+            },
+            End = DateTime.UtcNow.AddDays(30) // Expires in 30 days
+        };
+
+        // Act
+        var result = new SubscriptionInfo.BillingCustomerDiscount(discount);
+
+        // Assert
+        Assert.False(result.Active); // Should be inactive because End is not null
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_WithPastEndDate_SetsActiveToFalse(string couponId)
+    {
+        // Arrange - Discount already expired
+        var discount = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = couponId,
+                PercentOff = 20m
+            },
+            End = DateTime.UtcNow.AddDays(-30) // Expired 30 days ago
+        };
+
+        // Act
+        var result = new SubscriptionInfo.BillingCustomerDiscount(discount);
+
+        // Assert
+        Assert.False(result.Active); // Should be inactive because End is not null
+    }
+
+    [Fact]
+    public void Constructor_WithNullCouponId_SetsIdToNull()
+    {
+        // Arrange
+        var discount = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = null,
+                PercentOff = 20m
+            },
+            End = null
+        };
+
+        // Act
+        var result = new SubscriptionInfo.BillingCustomerDiscount(discount);
+
+        // Assert
+        Assert.Null(result.Id);
+        Assert.True(result.Active);
+        Assert.Equal(20m, result.PercentOff);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_WithNullPercentOff_SetsPercentOffToNull(string couponId)
+    {
+        // Arrange
+        var discount = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = couponId,
+                PercentOff = null,
+                AmountOff = 1000
+            },
+            End = null
+        };
+
+        // Act
+        var result = new SubscriptionInfo.BillingCustomerDiscount(discount);
+
+        // Assert
+        Assert.Null(result.PercentOff);
+        Assert.Equal(10.00m, result.AmountOff);
+    }
+
+    [Fact]
+    public void Constructor_WithCompleteStripeDiscount_MapsAllProperties()
+    {
+        // Arrange - Comprehensive test with all Stripe Discount properties set
+        var discount = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = "premium_discount_2024",
+                PercentOff = 25m,
+                AmountOff = 1500, // $15.00
+                AppliesTo = new CouponAppliesTo
+                {
+                    Products = new List<string> { "prod_premium", "prod_family", "prod_teams" }
+                }
+            },
+            End = null // Active
+        };
+
+        // Act
+        var result = new SubscriptionInfo.BillingCustomerDiscount(discount);
+
+        // Assert - Verify all properties mapped correctly
+        Assert.Equal("premium_discount_2024", result.Id);
+        Assert.True(result.Active);
+        Assert.Equal(25m, result.PercentOff);
+        Assert.Equal(15.00m, result.AmountOff);
+        Assert.NotNull(result.AppliesTo);
+        Assert.Equal(3, result.AppliesTo.Count);
+        Assert.Contains("prod_premium", result.AppliesTo);
+        Assert.Contains("prod_family", result.AppliesTo);
+        Assert.Contains("prod_teams", result.AppliesTo);
+    }
+
+    [Fact]
+    public void Constructor_WithMinimalStripeDiscount_HandlesNullsGracefully()
+    {
+        // Arrange - Minimal Stripe Discount with most properties null
+        var discount = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = null,
+                PercentOff = null,
+                AmountOff = null,
+                AppliesTo = null
+            },
+            End = DateTime.UtcNow.AddDays(10) // Has end date
+        };
+
+        // Act
+        var result = new SubscriptionInfo.BillingCustomerDiscount(discount);
+
+        // Assert - Should handle all nulls gracefully
+        Assert.Null(result.Id);
+        Assert.False(result.Active);
+        Assert.Null(result.PercentOff);
+        Assert.Null(result.AmountOff);
+        Assert.Null(result.AppliesTo);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public void Constructor_WithEmptyProductsList_PreservesEmptyList(string couponId)
+    {
+        // Arrange
+        var discount = new Discount
+        {
+            Coupon = new Coupon
+            {
+                Id = couponId,
+                PercentOff = 10m,
+                AppliesTo = new CouponAppliesTo
+                {
+                    Products = new List<string>() // Empty but not null
+                }
+            },
+            End = null
+        };
+
+        // Act
+        var result = new SubscriptionInfo.BillingCustomerDiscount(discount);
+
+        // Assert
+        Assert.NotNull(result.AppliesTo);
+        Assert.Empty(result.AppliesTo);
+    }
+}

test/Core.Test/Models/Business/CompleteSubscriptionUpdateTests.cs

@@ -2,7 +2,7 @@
 using Bit.Core.Billing.Enums;
 using Bit.Core.Models.Business;
 using Bit.Core.Test.AutoFixture.OrganizationFixtures;
-using Bit.Core.Utilities;
+using Bit.Core.Test.Billing.Mocks;
 using Bit.Test.Common.AutoFixture.Attributes;
 using Stripe;
 using Xunit;
@@ -17,7 +17,7 @@ public class CompleteSubscriptionUpdateTests
     public void UpgradeItemOptions_TeamsStarterToTeams_ReturnsCorrectOptions(
         Organization organization)
     {
-        var teamsStarterPlan = StaticStore.GetPlan(PlanType.TeamsStarter);
+        var teamsStarterPlan = MockPlans.Get(PlanType.TeamsStarter);
 
         var subscription = new Subscription
         {
@@ -35,7 +35,7 @@ public class CompleteSubscriptionUpdateTests
             }
         };
 
-        var teamsMonthlyPlan = StaticStore.GetPlan(PlanType.TeamsMonthly);
+        var teamsMonthlyPlan = MockPlans.Get(PlanType.TeamsMonthly);
 
         var updatedSubscriptionData = new SubscriptionData
         {
@@ -66,7 +66,7 @@ public class CompleteSubscriptionUpdateTests
         // 5 purchased, 1 base
         organization.MaxStorageGb = 6;
 
-        var teamsMonthlyPlan = StaticStore.GetPlan(PlanType.TeamsMonthly);
+        var teamsMonthlyPlan = MockPlans.Get(PlanType.TeamsMonthly);
 
         var subscription = new Subscription
         {
@@ -102,7 +102,7 @@ public class CompleteSubscriptionUpdateTests
             }
         };
 
-        var enterpriseMonthlyPlan = StaticStore.GetPlan(PlanType.EnterpriseMonthly);
+        var enterpriseMonthlyPlan = MockPlans.Get(PlanType.EnterpriseMonthly);
 
         var updatedSubscriptionData = new SubscriptionData
         {
@@ -173,7 +173,7 @@ public class CompleteSubscriptionUpdateTests
         // 5 purchased, 1 base
         organization.MaxStorageGb = 6;
 
-        var teamsMonthlyPlan = StaticStore.GetPlan(PlanType.TeamsMonthly);
+        var teamsMonthlyPlan = MockPlans.Get(PlanType.TeamsMonthly);
 
         var subscription = new Subscription
         {
@@ -209,7 +209,7 @@ public class CompleteSubscriptionUpdateTests
             }
         };
 
-        var enterpriseMonthlyPlan = StaticStore.GetPlan(PlanType.EnterpriseMonthly);
+        var enterpriseMonthlyPlan = MockPlans.Get(PlanType.EnterpriseMonthly);
 
         var updatedSubscriptionData = new SubscriptionData
         {
@@ -277,8 +277,8 @@ public class CompleteSubscriptionUpdateTests
     public void RevertItemOptions_TeamsStarterToTeams_ReturnsCorrectOptions(
         Organization organization)
     {
-        var teamsStarterPlan = StaticStore.GetPlan(PlanType.TeamsStarter);
-        var teamsMonthlyPlan = StaticStore.GetPlan(PlanType.TeamsMonthly);
+        var teamsStarterPlan = MockPlans.Get(PlanType.TeamsStarter);
+        var teamsMonthlyPlan = MockPlans.Get(PlanType.TeamsMonthly);
 
         var subscription = new Subscription
         {
@@ -325,8 +325,8 @@ public class CompleteSubscriptionUpdateTests
         // 5 purchased, 1 base
         organization.MaxStorageGb = 6;
 
-        var teamsMonthlyPlan = StaticStore.GetPlan(PlanType.TeamsMonthly);
-        var enterpriseMonthlyPlan = StaticStore.GetPlan(PlanType.EnterpriseMonthly);
+        var teamsMonthlyPlan = MockPlans.Get(PlanType.TeamsMonthly);
+        var enterpriseMonthlyPlan = MockPlans.Get(PlanType.EnterpriseMonthly);
 
         var subscription = new Subscription
         {
@@ -431,8 +431,8 @@ public class CompleteSubscriptionUpdateTests
         // 5 purchased, 1 base
         organization.MaxStorageGb = 6;
 
-        var teamsMonthlyPlan = StaticStore.GetPlan(PlanType.TeamsMonthly);
-        var enterpriseMonthlyPlan = StaticStore.GetPlan(PlanType.EnterpriseMonthly);
+        var teamsMonthlyPlan = MockPlans.Get(PlanType.TeamsMonthly);
+        var enterpriseMonthlyPlan = MockPlans.Get(PlanType.EnterpriseMonthly);
 
         var subscription = new Subscription
         {

test/Core.Test/Models/Business/SeatSubscriptionUpdateTests.cs

@@ -1,7 +1,7 @@
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.Billing.Enums;
 using Bit.Core.Models.Business;
-using Bit.Core.Utilities;
+using Bit.Core.Test.Billing.Mocks;
 using Bit.Test.Common.AutoFixture.Attributes;
 using Stripe;
 using Xunit;
@@ -27,7 +27,7 @@ public class SeatSubscriptionUpdateTests
 
     public void UpgradeItemsOptions_ReturnsCorrectOptions(PlanType planType, Organization organization)
     {
-        var plan = StaticStore.GetPlan(planType);
+        var plan = MockPlans.Get(planType);
         organization.PlanType = planType;
         var subscription = new Subscription
         {
@@ -69,7 +69,7 @@ public class SeatSubscriptionUpdateTests
     [BitAutoData(PlanType.TeamsAnnually)]
     public void RevertItemsOptions_ReturnsCorrectOptions(PlanType planType, Organization organization)
     {
-        var plan = StaticStore.GetPlan(planType);
+        var plan = MockPlans.Get(planType);
         organization.PlanType = planType;
         var subscription = new Subscription
         {

test/Core.Test/Models/Business/SecretsManagerSubscriptionUpdateTests.cs

@@ -4,7 +4,7 @@ using Bit.Core.Exceptions;
 using Bit.Core.Models.Business;
 using Bit.Core.Models.StaticStore;
 using Bit.Core.Test.AutoFixture.OrganizationFixtures;
-using Bit.Core.Utilities;
+using Bit.Core.Test.Billing.Mocks;
 using Bit.Test.Common.AutoFixture.Attributes;
 using Xunit;
 
@@ -16,13 +16,13 @@ public class SecretsManagerSubscriptionUpdateTests
     private static TheoryData<Plan> ToPlanTheory(List<PlanType> types)
     {
         var theoryData = new TheoryData<Plan>();
-        var plans = types.Select(StaticStore.GetPlan).ToArray();
+        var plans = types.Select(MockPlans.Get).ToArray();
         theoryData.AddRange(plans);
         return theoryData;
     }
 
     public static TheoryData<Plan> NonSmPlans =>
-        ToPlanTheory([PlanType.Custom, PlanType.FamiliesAnnually, PlanType.FamiliesAnnually2019]);
+        ToPlanTheory([PlanType.Custom, PlanType.FamiliesAnnually, PlanType.FamiliesAnnually2025, PlanType.FamiliesAnnually2019]);
 
     public static TheoryData<Plan> SmPlans => ToPlanTheory([
         PlanType.EnterpriseAnnually2019,

test/Core.Test/Models/Business/ServiceAccountSubscriptionUpdateTests.cs

@@ -1,7 +1,7 @@
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.Billing.Enums;
 using Bit.Core.Models.Business;
-using Bit.Core.Utilities;
+using Bit.Core.Test.Billing.Mocks;
 using Bit.Test.Common.AutoFixture.Attributes;
 using Stripe;
 using Xunit;
@@ -27,7 +27,7 @@ public class ServiceAccountSubscriptionUpdateTests
 
     public void UpgradeItemsOptions_ReturnsCorrectOptions(PlanType planType, Organization organization)
     {
-        var plan = StaticStore.GetPlan(planType);
+        var plan = MockPlans.Get(planType);
         organization.PlanType = planType;
         var subscription = new Subscription
         {
@@ -69,7 +69,7 @@ public class ServiceAccountSubscriptionUpdateTests
     [BitAutoData(PlanType.TeamsAnnually)]
     public void RevertItemsOptions_ReturnsCorrectOptions(PlanType planType, Organization organization)
     {
-        var plan = StaticStore.GetPlan(planType);
+        var plan = MockPlans.Get(planType);
         organization.PlanType = planType;
         var quantity = 5;
         var subscription = new Subscription

test/Core.Test/Models/Business/SmSeatSubscriptionUpdateTests.cs

@@ -1,7 +1,7 @@
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.Billing.Enums;
 using Bit.Core.Models.Business;
-using Bit.Core.Utilities;
+using Bit.Core.Test.Billing.Mocks;
 using Bit.Test.Common.AutoFixture.Attributes;
 using Stripe;
 using Xunit;
@@ -27,7 +27,7 @@ public class SmSeatSubscriptionUpdateTests
 
     public void UpgradeItemsOptions_ReturnsCorrectOptions(PlanType planType, Organization organization)
     {
-        var plan = StaticStore.GetPlan(planType);
+        var plan = MockPlans.Get(planType);
         organization.PlanType = planType;
         var quantity = 3;
         var subscription = new Subscription
@@ -70,7 +70,7 @@ public class SmSeatSubscriptionUpdateTests
     [BitAutoData(PlanType.TeamsAnnually)]
     public void RevertItemsOptions_ReturnsCorrectOptions(PlanType planType, Organization organization)
     {
-        var plan = StaticStore.GetPlan(planType);
+        var plan = MockPlans.Get(planType);
         organization.PlanType = planType;
         var quantity = 5;
         var subscription = new Subscription

test/Core.Test/Models/Business/StorageSubscriptionUpdateTests.cs

@@ -1,6 +1,6 @@
 using Bit.Core.Billing.Enums;
 using Bit.Core.Models.Business;
-using Bit.Core.Utilities;
+using Bit.Core.Test.Billing.Mocks;
 using Bit.Test.Common.AutoFixture.Attributes;
 using Stripe;
 using Xunit;
@@ -26,7 +26,7 @@ public class StorageSubscriptionUpdateTests
 
     public void UpgradeItemsOptions_ReturnsCorrectOptions(PlanType planType)
     {
-        var plan = StaticStore.GetPlan(planType);
+        var plan = MockPlans.Get(planType);
         var subscription = new Subscription
         {
             Items = new StripeList<SubscriptionItem>
@@ -77,7 +77,7 @@ public class StorageSubscriptionUpdateTests
     [BitAutoData(PlanType.TeamsStarter)]
     public void RevertItemsOptions_ReturnsCorrectOptions(PlanType planType)
     {
-        var plan = StaticStore.GetPlan(planType);
+        var plan = MockPlans.Get(planType);
         var subscription = new Subscription
         {
             Items = new StripeList<SubscriptionItem>

test/Core.Test/Models/Business/SubscriptionInfoTests.cs

@@ -0,0 +1,125 @@
+using Bit.Core.Models.Business;
+using Stripe;
+using Xunit;
+
+namespace Bit.Core.Test.Models.Business;
+
+public class SubscriptionInfoTests
+{
+    [Fact]
+    public void BillingSubscriptionItem_NullPlan_HandlesGracefully()
+    {
+        // Arrange - SubscriptionItem with null Plan
+        var subscriptionItem = new SubscriptionItem
+        {
+            Plan = null,
+            Quantity = 1
+        };
+
+        // Act
+        var result = new SubscriptionInfo.BillingSubscription.BillingSubscriptionItem(subscriptionItem);
+
+        // Assert - Should handle null Plan gracefully
+        Assert.Null(result.ProductId);
+        Assert.Null(result.Name);
+        Assert.Equal(0m, result.Amount); // Defaults to 0 when Plan is null
+        Assert.Null(result.Interval);
+        Assert.Equal(1, result.Quantity);
+        Assert.False(result.SponsoredSubscriptionItem);
+        Assert.False(result.AddonSubscriptionItem);
+    }
+
+    [Fact]
+    public void BillingSubscriptionItem_NullAmount_SetsToZero()
+    {
+        // Arrange - SubscriptionItem with Plan but null Amount
+        var subscriptionItem = new SubscriptionItem
+        {
+            Plan = new Plan
+            {
+                ProductId = "prod_test",
+                Nickname = "Test Plan",
+                Amount = null, // Null amount
+                Interval = "month"
+            },
+            Quantity = 1
+        };
+
+        // Act
+        var result = new SubscriptionInfo.BillingSubscription.BillingSubscriptionItem(subscriptionItem);
+
+        // Assert - Should default to 0 when Amount is null
+        Assert.Equal("prod_test", result.ProductId);
+        Assert.Equal("Test Plan", result.Name);
+        Assert.Equal(0m, result.Amount); // Business rule: defaults to 0 when null
+        Assert.Equal("month", result.Interval);
+        Assert.Equal(1, result.Quantity);
+    }
+
+    [Fact]
+    public void BillingSubscriptionItem_ZeroAmount_PreservesZero()
+    {
+        // Arrange - SubscriptionItem with Plan and zero Amount
+        var subscriptionItem = new SubscriptionItem
+        {
+            Plan = new Plan
+            {
+                ProductId = "prod_test",
+                Nickname = "Test Plan",
+                Amount = 0, // Zero amount (0 cents)
+                Interval = "month"
+            },
+            Quantity = 1
+        };
+
+        // Act
+        var result = new SubscriptionInfo.BillingSubscription.BillingSubscriptionItem(subscriptionItem);
+
+        // Assert - Should preserve zero amount
+        Assert.Equal("prod_test", result.ProductId);
+        Assert.Equal("Test Plan", result.Name);
+        Assert.Equal(0m, result.Amount); // Zero amount preserved
+        Assert.Equal("month", result.Interval);
+    }
+
+    [Fact]
+    public void BillingUpcomingInvoice_ZeroAmountDue_ConvertsToZero()
+    {
+        // Arrange - Invoice with zero AmountDue
+        // Note: Stripe's Invoice.AmountDue is non-nullable long, so we test with 0
+        // The null-coalescing operator (?? 0) in the constructor handles the case where
+        // ConvertFromStripeMinorUnits returns null, but since AmountDue is non-nullable,
+        // this test verifies the conversion path works correctly for zero values
+        var invoice = new Invoice
+        {
+            AmountDue = 0, // Zero amount due (0 cents)
+            Created = DateTime.UtcNow
+        };
+
+        // Act
+        var result = new SubscriptionInfo.BillingUpcomingInvoice(invoice);
+
+        // Assert - Should convert zero correctly
+        Assert.Equal(0m, result.Amount);
+        Assert.NotNull(result.Date);
+    }
+
+    [Fact]
+    public void BillingUpcomingInvoice_ValidAmountDue_ConvertsCorrectly()
+    {
+        // Arrange - Invoice with valid AmountDue
+        var invoice = new Invoice
+        {
+            AmountDue = 2500, // 2500 cents = $25.00
+            Created = DateTime.UtcNow
+        };
+
+        // Act
+        var result = new SubscriptionInfo.BillingUpcomingInvoice(invoice);
+
+        // Assert - Should convert correctly
+        Assert.Equal(25.00m, result.Amount); // Converted from cents
+        Assert.NotNull(result.Date);
+    }
+}
+