Merge branch 'main' into auth/pm-22975/client-version-validator

.github/ISSUE_TEMPLATE/bw-lite.yml

@@ -70,15 +70,6 @@ body:
         mariadb:10
         # Postgres Example
         postgres:14
-  - type: textarea
-    id: epic-label
-    attributes:
-      label: Issue-Link
-      description: Link to our pinned issue, tracking all Bitwarden lite
-      value: |
-        https://github.com/bitwarden/server/issues/2480
-    validations:
-      required: true
   - type: checkboxes
     id: issue-tracking-info
     attributes:

.github/workflows/repository-management.yml

@@ -22,9 +22,7 @@ on:
         required: false
         type: string
 
-permissions:
-  pull-requests: write
-  contents: write
+permissions: {}
 
 jobs:
   setup:
@@ -32,6 +30,7 @@ jobs:
     runs-on: ubuntu-24.04
     outputs:
       branch: ${{ steps.set-branch.outputs.branch }}
+    permissions: {}
     steps:
       - name: Set branch
         id: set-branch
@@ -89,6 +88,7 @@ jobs:
         with:
           app-id: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-ID }}
           private-key: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-KEY }}
+          permission-contents: write
 
       - name: Check out branch
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -212,6 +212,7 @@ jobs:
         with:
           app-id: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-ID }}
           private-key: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-KEY }}
+          permission-contents: write
 
       - name: Check out target ref
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -240,10 +241,5 @@ jobs:
   move_edd_db_scripts:
     name: Move EDD database scripts
     needs: cut_branch
-    permissions:
-      actions: read
-      contents: write
-      id-token: write
-      pull-requests: write
+    permissions: {}
     uses: ./.github/workflows/_move_edd_db_scripts.yml
-    secrets: inherit

Directory.Build.props

@@ -16,7 +16,7 @@
   
   <PropertyGroup>
     
-    <MicrosoftNetTestSdkVersion>17.8.0</MicrosoftNetTestSdkVersion>
+    <MicrosoftNetTestSdkVersion>18.0.1</MicrosoftNetTestSdkVersion>
     
     <XUnitVersion>2.6.6</XUnitVersion>
     

src/Api/Auth/Controllers/TwoFactorController.cs

@@ -9,7 +9,6 @@ using Bit.Api.Models.Response;
 using Bit.Core.Auth.Enums;
 using Bit.Core.Auth.Identity;
 using Bit.Core.Auth.Identity.TokenProviders;
-using Bit.Core.Auth.LoginFeatures.PasswordlessLogin.Interfaces;
 using Bit.Core.Auth.Models.Business.Tokenables;
 using Bit.Core.Auth.Services;
 using Bit.Core.Context;
@@ -35,7 +34,7 @@ public class TwoFactorController : Controller
     private readonly IOrganizationService _organizationService;
     private readonly UserManager<User> _userManager;
     private readonly ICurrentContext _currentContext;
-    private readonly IVerifyAuthRequestCommand _verifyAuthRequestCommand;
+    private readonly IAuthRequestRepository _authRequestRepository;
     private readonly IDuoUniversalTokenService _duoUniversalTokenService;
     private readonly IDataProtectorTokenFactory<TwoFactorAuthenticatorUserVerificationTokenable> _twoFactorAuthenticatorDataProtector;
     private readonly IDataProtectorTokenFactory<SsoEmail2faSessionTokenable> _ssoEmailTwoFactorSessionDataProtector;
@@ -47,7 +46,7 @@ public class TwoFactorController : Controller
         IOrganizationService organizationService,
         UserManager<User> userManager,
         ICurrentContext currentContext,
-        IVerifyAuthRequestCommand verifyAuthRequestCommand,
+        IAuthRequestRepository authRequestRepository,
         IDuoUniversalTokenService duoUniversalConfigService,
         IDataProtectorTokenFactory<TwoFactorAuthenticatorUserVerificationTokenable> twoFactorAuthenticatorDataProtector,
         IDataProtectorTokenFactory<SsoEmail2faSessionTokenable> ssoEmailTwoFactorSessionDataProtector,
@@ -58,7 +57,7 @@ public class TwoFactorController : Controller
         _organizationService = organizationService;
         _userManager = userManager;
         _currentContext = currentContext;
-        _verifyAuthRequestCommand = verifyAuthRequestCommand;
+        _authRequestRepository = authRequestRepository;
         _duoUniversalTokenService = duoUniversalConfigService;
         _twoFactorAuthenticatorDataProtector = twoFactorAuthenticatorDataProtector;
         _ssoEmailTwoFactorSessionDataProtector = ssoEmailTwoFactorSessionDataProtector;
@@ -350,14 +349,15 @@ public class TwoFactorController : Controller
 
         if (user != null)
         {
-            // Check if 2FA email is from Passwordless.
+            // Check if 2FA email is from a device approval ("Log in with device") scenario.
             if (!string.IsNullOrEmpty(requestModel.AuthRequestAccessCode))
             {
-                if (await _verifyAuthRequestCommand
-                        .VerifyAuthRequestAsync(new Guid(requestModel.AuthRequestId),
-                            requestModel.AuthRequestAccessCode))
+                var authRequest = await _authRequestRepository.GetByIdAsync(new Guid(requestModel.AuthRequestId));
+                if (authRequest != null &&
+                    authRequest.IsValidForAuthentication(user.Id, requestModel.AuthRequestAccessCode))
                 {
                     await _twoFactorEmailService.SendTwoFactorEmailAsync(user);
+                    return;
                 }
             }
             else if (!string.IsNullOrEmpty(requestModel.SsoEmail2FaSessionToken))

src/Api/Billing/Controllers/AccountsBillingController.cs

@@ -1,7 +1,5 @@
-#nullable enable
-using Bit.Api.Billing.Models.Responses;
+using Bit.Api.Billing.Models.Responses;
 using Bit.Core.Billing.Services;
-using Bit.Core.Billing.Tax.Requests;
 using Bit.Core.Services;
 using Bit.Core.Utilities;
 using Microsoft.AspNetCore.Authorization;
@@ -16,6 +14,7 @@ public class AccountsBillingController(
     IUserService userService,
     IPaymentHistoryService paymentHistoryService) : Controller
 {
+    // TODO: Migrate to Query / AccountBillingVNextController
     [HttpGet("history")]
     [SelfHosted(NotSelfHostedOnly = true)]
     public async Task<BillingHistoryResponseModel> GetBillingHistoryAsync()
@@ -30,20 +29,7 @@ public class AccountsBillingController(
         return new BillingHistoryResponseModel(billingInfo);
     }
 
-    [HttpGet("payment-method")]
-    [SelfHosted(NotSelfHostedOnly = true)]
-    public async Task<BillingPaymentResponseModel> GetPaymentMethodAsync()
-    {
-        var user = await userService.GetUserByPrincipalAsync(User);
-        if (user == null)
-        {
-            throw new UnauthorizedAccessException();
-        }
-
-        var billingInfo = await paymentService.GetBillingAsync(user);
-        return new BillingPaymentResponseModel(billingInfo);
-    }
-
+    // TODO: Migrate to Query / AccountBillingVNextController
     [HttpGet("invoices")]
     public async Task<IResult> GetInvoicesAsync([FromQuery] string? status = null, [FromQuery] string? startAfter = null)
     {
@@ -62,6 +48,7 @@ public class AccountsBillingController(
         return TypedResults.Ok(invoices);
     }
 
+    // TODO: Migrate to Query / AccountBillingVNextController
     [HttpGet("transactions")]
     public async Task<IResult> GetTransactionsAsync([FromQuery] DateTime? startAfter = null)
     {
@@ -78,18 +65,4 @@ public class AccountsBillingController(
 
         return TypedResults.Ok(transactions);
     }
-
-    [HttpPost("preview-invoice")]
-    public async Task<IResult> PreviewInvoiceAsync([FromBody] PreviewIndividualInvoiceRequestBody model)
-    {
-        var user = await userService.GetUserByPrincipalAsync(User);
-        if (user == null)
-        {
-            throw new UnauthorizedAccessException();
-        }
-
-        var invoice = await paymentService.PreviewInvoiceAsync(model, user.GatewayCustomerId, user.GatewaySubscriptionId);
-
-        return TypedResults.Ok(invoice);
-    }
 }

src/Api/Billing/Controllers/AccountsController.cs

@@ -1,6 +1,4 @@
-#nullable enable
-
-using Bit.Api.Models.Request;
+using Bit.Api.Models.Request;
 using Bit.Api.Models.Request.Accounts;
 using Bit.Api.Models.Response;
 using Bit.Api.Utilities;
@@ -29,6 +27,7 @@ public class AccountsController(
     IFeatureService featureService,
     ILicensingService licensingService) : Controller
 {
+    // TODO: Remove when pm-24996-implement-upgrade-from-free-dialog is removed
     [HttpPost("premium")]
     public async Task<PaymentResponseModel> PostPremiumAsync(
         PremiumRequestModel model,
@@ -76,6 +75,7 @@ public class AccountsController(
         };
     }
 
+    // TODO: Migrate to Query / AccountBillingVNextController as part of Premium -> Organization upgrade work.
     [HttpGet("subscription")]
     public async Task<SubscriptionResponseModel> GetSubscriptionAsync(
         [FromServices] GlobalSettings globalSettings,
@@ -114,29 +114,7 @@ public class AccountsController(
         }
     }
 
-    [HttpPost("payment")]
-    [SelfHosted(NotSelfHostedOnly = true)]
-    public async Task PostPaymentAsync([FromBody] PaymentRequestModel model)
-    {
-        var user = await userService.GetUserByPrincipalAsync(User);
-        if (user == null)
-        {
-            throw new UnauthorizedAccessException();
-        }
-
-        await userService.ReplacePaymentMethodAsync(user, model.PaymentToken, model.PaymentMethodType!.Value,
-            new TaxInfo
-            {
-                BillingAddressLine1 = model.Line1,
-                BillingAddressLine2 = model.Line2,
-                BillingAddressCity = model.City,
-                BillingAddressState = model.State,
-                BillingAddressCountry = model.Country,
-                BillingAddressPostalCode = model.PostalCode,
-                TaxIdNumber = model.TaxId
-            });
-    }
-
+    // TODO: Migrate to Command / AccountBillingVNextController as PUT /account/billing/vnext/subscription
     [HttpPost("storage")]
     [SelfHosted(NotSelfHostedOnly = true)]
     public async Task<PaymentResponseModel> PostStorageAsync([FromBody] StorageRequestModel model)
@@ -151,8 +129,11 @@ public class AccountsController(
         return new PaymentResponseModel { Success = true, PaymentIntentClientSecret = result };
     }
 
-
-
+    /*
+     * TODO: A new version of this exists in the AccountBillingVNextController.
+     * The individual-self-hosting-license-uploader.component needs to be updated to use it.
+     * Then, this can be removed.
+     */
     [HttpPost("license")]
     [SelfHosted(SelfHostedOnly = true)]
     public async Task PostLicenseAsync(LicenseRequestModel model)
@@ -172,6 +153,7 @@ public class AccountsController(
         await userService.UpdateLicenseAsync(user, license);
     }
 
+    // TODO: Migrate to Command / AccountBillingVNextController as DELETE /account/billing/vnext/subscription
     [HttpPost("cancel")]
     public async Task PostCancelAsync(
         [FromBody] SubscriptionCancellationRequestModel request,
@@ -189,6 +171,7 @@ public class AccountsController(
             user.IsExpired());
     }
 
+    // TODO: Migrate to Command / AccountBillingVNextController as POST /account/billing/vnext/subscription/reinstate
     [HttpPost("reinstate-premium")]
     [SelfHosted(NotSelfHostedOnly = true)]
     public async Task PostReinstateAsync()
@@ -202,41 +185,6 @@ public class AccountsController(
         await userService.ReinstatePremiumAsync(user);
     }
 
-    [HttpGet("tax")]
-    [SelfHosted(NotSelfHostedOnly = true)]
-    public async Task<TaxInfoResponseModel> GetTaxInfoAsync(
-        [FromServices] IPaymentService paymentService)
-    {
-        var user = await userService.GetUserByPrincipalAsync(User);
-        if (user == null)
-        {
-            throw new UnauthorizedAccessException();
-        }
-
-        var taxInfo = await paymentService.GetTaxInfoAsync(user);
-        return new TaxInfoResponseModel(taxInfo);
-    }
-
-    [HttpPut("tax")]
-    [SelfHosted(NotSelfHostedOnly = true)]
-    public async Task PutTaxInfoAsync(
-        [FromBody] TaxInfoUpdateRequestModel model,
-        [FromServices] IPaymentService paymentService)
-    {
-        var user = await userService.GetUserByPrincipalAsync(User);
-        if (user == null)
-        {
-            throw new UnauthorizedAccessException();
-        }
-
-        var taxInfo = new TaxInfo
-        {
-            BillingAddressPostalCode = model.PostalCode,
-            BillingAddressCountry = model.Country,
-        };
-        await paymentService.SaveTaxInfoAsync(user, taxInfo);
-    }
-
     private async Task<IEnumerable<Guid>> GetOrganizationIdsClaimingUserAsync(Guid userId)
     {
         var organizationsClaimingUser = await userService.GetOrganizationsClaimingUserAsync(userId);

src/Api/Billing/Controllers/InvoicesController.cs

@@ -1,45 +0,0 @@
-// FIXME: Update this file to be null safe and then delete the line below
-#nullable disable
-
-using Bit.Core.AdminConsole.Entities;
-using Bit.Core.Billing.Tax.Requests;
-using Bit.Core.Context;
-using Bit.Core.Repositories;
-using Bit.Core.Services;
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Mvc;
-
-namespace Bit.Api.Billing.Controllers;
-
-[Route("invoices")]
-[Authorize("Application")]
-public class InvoicesController : BaseBillingController
-{
-    [HttpPost("preview-organization")]
-    public async Task<IResult> PreviewInvoiceAsync(
-        [FromBody] PreviewOrganizationInvoiceRequestBody model,
-        [FromServices] ICurrentContext currentContext,
-        [FromServices] IOrganizationRepository organizationRepository,
-        [FromServices] IPaymentService paymentService)
-    {
-        Organization organization = null;
-        if (model.OrganizationId != default)
-        {
-            if (!await currentContext.EditPaymentMethods(model.OrganizationId))
-            {
-                return Error.Unauthorized();
-            }
-
-            organization = await organizationRepository.GetByIdAsync(model.OrganizationId);
-            if (organization == null)
-            {
-                return Error.NotFound();
-            }
-        }
-
-        var invoice = await paymentService.PreviewInvoiceAsync(model, organization?.GatewayCustomerId,
-            organization?.GatewaySubscriptionId);
-
-        return TypedResults.Ok(invoice);
-    }
-}

src/Api/Billing/Controllers/LicensesController.cs

@@ -1,91 +0,0 @@
-// FIXME: Update this file to be null safe and then delete the line below
-#nullable disable
-
-using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationConnections.Interfaces;
-using Bit.Core.Billing.Models.Business;
-using Bit.Core.Billing.Organizations.Models;
-using Bit.Core.Billing.Organizations.Queries;
-using Bit.Core.Context;
-using Bit.Core.Exceptions;
-using Bit.Core.Models.Api.OrganizationLicenses;
-using Bit.Core.Repositories;
-using Bit.Core.Services;
-using Bit.Core.Utilities;
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Mvc;
-
-namespace Bit.Api.Billing.Controllers;
-
-[Route("licenses")]
-[Authorize("Licensing")]
-[SelfHosted(NotSelfHostedOnly = true)]
-public class LicensesController : Controller
-{
-    private readonly IUserRepository _userRepository;
-    private readonly IUserService _userService;
-    private readonly IOrganizationRepository _organizationRepository;
-    private readonly IGetCloudOrganizationLicenseQuery _getCloudOrganizationLicenseQuery;
-    private readonly IValidateBillingSyncKeyCommand _validateBillingSyncKeyCommand;
-    private readonly ICurrentContext _currentContext;
-
-    public LicensesController(
-        IUserRepository userRepository,
-        IUserService userService,
-        IOrganizationRepository organizationRepository,
-        IGetCloudOrganizationLicenseQuery getCloudOrganizationLicenseQuery,
-        IValidateBillingSyncKeyCommand validateBillingSyncKeyCommand,
-        ICurrentContext currentContext)
-    {
-        _userRepository = userRepository;
-        _userService = userService;
-        _organizationRepository = organizationRepository;
-        _getCloudOrganizationLicenseQuery = getCloudOrganizationLicenseQuery;
-        _validateBillingSyncKeyCommand = validateBillingSyncKeyCommand;
-        _currentContext = currentContext;
-    }
-
-    [HttpGet("user/{id}")]
-    public async Task<UserLicense> GetUser(string id, [FromQuery] string key)
-    {
-        var user = await _userRepository.GetByIdAsync(new Guid(id));
-        if (user == null)
-        {
-            return null;
-        }
-        else if (!user.LicenseKey.Equals(key))
-        {
-            await Task.Delay(2000);
-            throw new BadRequestException("Invalid license key.");
-        }
-
-        var license = await _userService.GenerateLicenseAsync(user, null);
-        return license;
-    }
-
-    /// <summary>
-    /// Used by self-hosted installations to get an updated license file
-    /// </summary>
-    [HttpGet("organization/{id}")]
-    public async Task<OrganizationLicense> OrganizationSync(string id, [FromBody] SelfHostedOrganizationLicenseRequestModel model)
-    {
-        var organization = await _organizationRepository.GetByIdAsync(new Guid(id));
-        if (organization == null)
-        {
-            throw new NotFoundException("Organization not found.");
-        }
-
-        if (!organization.LicenseKey.Equals(model.LicenseKey))
-        {
-            await Task.Delay(2000);
-            throw new BadRequestException("Invalid license key.");
-        }
-
-        if (!await _validateBillingSyncKeyCommand.ValidateBillingSyncKeyAsync(organization, model.BillingSyncKey))
-        {
-            throw new BadRequestException("Invalid Billing Sync Key");
-        }
-
-        var license = await _getCloudOrganizationLicenseQuery.GetLicenseAsync(organization, _currentContext.InstallationId.Value);
-        return license;
-    }
-}

src/Api/Billing/Controllers/OrganizationBillingController.cs

@@ -20,9 +20,9 @@ public class OrganizationBillingController(
     IOrganizationBillingService organizationBillingService,
     IOrganizationRepository organizationRepository,
     IPaymentService paymentService,
-    ISubscriberService subscriberService,
     IPaymentHistoryService paymentHistoryService) : BaseBillingController
 {
+    // TODO: Remove when pm-25379-use-new-organization-metadata-structure is removed.
     [HttpGet("metadata")]
     public async Task<IResult> GetMetadataAsync([FromRoute] Guid organizationId)
     {
@@ -41,6 +41,7 @@ public class OrganizationBillingController(
         return TypedResults.Ok(metadata);
     }
 
+    // TODO: Migrate to Query / OrganizationBillingVNextController
     [HttpGet("history")]
     public async Task<IResult> GetHistoryAsync([FromRoute] Guid organizationId)
     {
@@ -61,6 +62,7 @@ public class OrganizationBillingController(
         return TypedResults.Ok(billingInfo);
     }
 
+    // TODO: Migrate to Query / OrganizationBillingVNextController
     [HttpGet("invoices")]
     public async Task<IResult> GetInvoicesAsync([FromRoute] Guid organizationId, [FromQuery] string? status = null, [FromQuery] string? startAfter = null)
     {
@@ -85,6 +87,7 @@ public class OrganizationBillingController(
         return TypedResults.Ok(invoices);
     }
 
+    // TODO: Migrate to Query / OrganizationBillingVNextController
     [HttpGet("transactions")]
     public async Task<IResult> GetTransactionsAsync([FromRoute] Guid organizationId, [FromQuery] DateTime? startAfter = null)
     {
@@ -108,6 +111,7 @@ public class OrganizationBillingController(
         return TypedResults.Ok(transactions);
     }
 
+    // TODO: Can be removed once we do away with the organization-plans.component.
     [HttpGet]
     [SelfHosted(NotSelfHostedOnly = true)]
     public async Task<IResult> GetBillingAsync(Guid organizationId)
@@ -131,127 +135,7 @@ public class OrganizationBillingController(
         return TypedResults.Ok(response);
     }
 
-    [HttpGet("payment-method")]
-    public async Task<IResult> GetPaymentMethodAsync([FromRoute] Guid organizationId)
-    {
-        if (!await currentContext.EditPaymentMethods(organizationId))
-        {
-            return Error.Unauthorized();
-        }
-
-        var organization = await organizationRepository.GetByIdAsync(organizationId);
-
-        if (organization == null)
-        {
-            return Error.NotFound();
-        }
-
-        var paymentMethod = await subscriberService.GetPaymentMethod(organization);
-
-        var response = PaymentMethodResponse.From(paymentMethod);
-
-        return TypedResults.Ok(response);
-    }
-
-    [HttpPut("payment-method")]
-    public async Task<IResult> UpdatePaymentMethodAsync(
-        [FromRoute] Guid organizationId,
-        [FromBody] UpdatePaymentMethodRequestBody requestBody)
-    {
-        if (!await currentContext.EditPaymentMethods(organizationId))
-        {
-            return Error.Unauthorized();
-        }
-
-        var organization = await organizationRepository.GetByIdAsync(organizationId);
-
-        if (organization == null)
-        {
-            return Error.NotFound();
-        }
-
-        var tokenizedPaymentSource = requestBody.PaymentSource.ToDomain();
-
-        var taxInformation = requestBody.TaxInformation.ToDomain();
-
-        await organizationBillingService.UpdatePaymentMethod(organization, tokenizedPaymentSource, taxInformation);
-
-        return TypedResults.Ok();
-    }
-
-    [HttpPost("payment-method/verify-bank-account")]
-    public async Task<IResult> VerifyBankAccountAsync(
-        [FromRoute] Guid organizationId,
-        [FromBody] VerifyBankAccountRequestBody requestBody)
-    {
-        if (!await currentContext.EditPaymentMethods(organizationId))
-        {
-            return Error.Unauthorized();
-        }
-
-        if (requestBody.DescriptorCode.Length != 6 || !requestBody.DescriptorCode.StartsWith("SM"))
-        {
-            return Error.BadRequest("Statement descriptor should be a 6-character value that starts with 'SM'");
-        }
-
-        var organization = await organizationRepository.GetByIdAsync(organizationId);
-
-        if (organization == null)
-        {
-            return Error.NotFound();
-        }
-
-        await subscriberService.VerifyBankAccount(organization, requestBody.DescriptorCode);
-
-        return TypedResults.Ok();
-    }
-
-    [HttpGet("tax-information")]
-    public async Task<IResult> GetTaxInformationAsync([FromRoute] Guid organizationId)
-    {
-        if (!await currentContext.EditPaymentMethods(organizationId))
-        {
-            return Error.Unauthorized();
-        }
-
-        var organization = await organizationRepository.GetByIdAsync(organizationId);
-
-        if (organization == null)
-        {
-            return Error.NotFound();
-        }
-
-        var taxInformation = await subscriberService.GetTaxInformation(organization);
-
-        var response = TaxInformationResponse.From(taxInformation);
-
-        return TypedResults.Ok(response);
-    }
-
-    [HttpPut("tax-information")]
-    public async Task<IResult> UpdateTaxInformationAsync(
-        [FromRoute] Guid organizationId,
-        [FromBody] TaxInformationRequestBody requestBody)
-    {
-        if (!await currentContext.EditPaymentMethods(organizationId))
-        {
-            return Error.Unauthorized();
-        }
-
-        var organization = await organizationRepository.GetByIdAsync(organizationId);
-
-        if (organization == null)
-        {
-            return Error.NotFound();
-        }
-
-        var taxInformation = requestBody.ToDomain();
-
-        await subscriberService.UpdateTaxInformation(organization, taxInformation);
-
-        return TypedResults.Ok();
-    }
-
+    // TODO: Migrate to Command / OrganizationBillingVNextController
     [HttpPost("setup-business-unit")]
     [SelfHosted(NotSelfHostedOnly = true)]
     public async Task<IResult> SetupBusinessUnitAsync(
@@ -280,6 +164,7 @@ public class OrganizationBillingController(
         return TypedResults.Ok(providerId);
     }
 
+    // TODO: Migrate to Command / OrganizationBillingVNextController
     [HttpPost("change-frequency")]
     [SelfHosted(NotSelfHostedOnly = true)]
     public async Task<IResult> ChangePlanSubscriptionFrequencyAsync(

src/Api/Billing/Controllers/OrganizationsController.cs

@@ -19,7 +19,6 @@ using Bit.Core.Billing.Services;
 using Bit.Core.Context;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;
-using Bit.Core.Models.Business;
 using Bit.Core.OrganizationFeatures.OrganizationSubscriptions.Interface;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
@@ -249,53 +248,6 @@ public class OrganizationsController(
         await organizationService.ReinstateSubscriptionAsync(id);
     }
 
-    [HttpGet("{id:guid}/tax")]
-    [SelfHosted(NotSelfHostedOnly = true)]
-    public async Task<TaxInfoResponseModel> GetTaxInfo(Guid id)
-    {
-        if (!await currentContext.OrganizationOwner(id))
-        {
-            throw new NotFoundException();
-        }
-
-        var organization = await organizationRepository.GetByIdAsync(id);
-        if (organization == null)
-        {
-            throw new NotFoundException();
-        }
-
-        var taxInfo = await paymentService.GetTaxInfoAsync(organization);
-        return new TaxInfoResponseModel(taxInfo);
-    }
-
-    [HttpPut("{id:guid}/tax")]
-    [SelfHosted(NotSelfHostedOnly = true)]
-    public async Task PutTaxInfo(Guid id, [FromBody] ExpandedTaxInfoUpdateRequestModel model)
-    {
-        if (!await currentContext.OrganizationOwner(id))
-        {
-            throw new NotFoundException();
-        }
-
-        var organization = await organizationRepository.GetByIdAsync(id);
-        if (organization == null)
-        {
-            throw new NotFoundException();
-        }
-
-        var taxInfo = new TaxInfo
-        {
-            TaxIdNumber = model.TaxId,
-            BillingAddressLine1 = model.Line1,
-            BillingAddressLine2 = model.Line2,
-            BillingAddressCity = model.City,
-            BillingAddressState = model.State,
-            BillingAddressPostalCode = model.PostalCode,
-            BillingAddressCountry = model.Country,
-        };
-        await paymentService.SaveTaxInfoAsync(organization, taxInfo);
-    }
-
     /// <summary>
     /// Tries to grant owner access to the Secrets Manager for the organization
     /// </summary>

src/Api/Billing/Controllers/ProviderBillingController.cs

@@ -1,7 +1,6 @@
 // FIXME: Update this file to be null safe and then delete the line below
 #nullable disable
 
-using Bit.Api.Billing.Models.Requests;
 using Bit.Api.Billing.Models.Responses;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Billing.Pricing;
@@ -9,7 +8,6 @@ using Bit.Core.Billing.Providers.Models;
 using Bit.Core.Billing.Providers.Repositories;
 using Bit.Core.Billing.Providers.Services;
 using Bit.Core.Billing.Services;
-using Bit.Core.Billing.Tax.Models;
 using Bit.Core.Context;
 using Bit.Core.Models.BitStripe;
 using Bit.Core.Services;
@@ -34,6 +32,7 @@ public class ProviderBillingController(
     IStripeAdapter stripeAdapter,
     IUserService userService) : BaseProviderController(currentContext, logger, providerRepository, userService)
 {
+    // TODO: Migrate to Query / ProviderBillingVNextController
     [HttpGet("invoices")]
     public async Task<IResult> GetInvoicesAsync([FromRoute] Guid providerId)
     {
@@ -54,6 +53,7 @@ public class ProviderBillingController(
         return TypedResults.Ok(response);
     }
 
+    // TODO: Migrate to Query / ProviderBillingVNextController
     [HttpGet("invoices/{invoiceId}")]
     public async Task<IResult> GenerateClientInvoiceReportAsync([FromRoute] Guid providerId, string invoiceId)
     {
@@ -76,51 +76,7 @@ public class ProviderBillingController(
             "text/csv");
     }
 
-    [HttpPut("payment-method")]
-    public async Task<IResult> UpdatePaymentMethodAsync(
-        [FromRoute] Guid providerId,
-        [FromBody] UpdatePaymentMethodRequestBody requestBody)
-    {
-        var (provider, result) = await TryGetBillableProviderForAdminOperation(providerId);
-
-        if (provider == null)
-        {
-            return result;
-        }
-
-        var tokenizedPaymentSource = requestBody.PaymentSource.ToDomain();
-        var taxInformation = requestBody.TaxInformation.ToDomain();
-
-        await providerBillingService.UpdatePaymentMethod(
-            provider,
-            tokenizedPaymentSource,
-            taxInformation);
-
-        return TypedResults.Ok();
-    }
-
-    [HttpPost("payment-method/verify-bank-account")]
-    public async Task<IResult> VerifyBankAccountAsync(
-        [FromRoute] Guid providerId,
-        [FromBody] VerifyBankAccountRequestBody requestBody)
-    {
-        var (provider, result) = await TryGetBillableProviderForAdminOperation(providerId);
-
-        if (provider == null)
-        {
-            return result;
-        }
-
-        if (requestBody.DescriptorCode.Length != 6 || !requestBody.DescriptorCode.StartsWith("SM"))
-        {
-            return Error.BadRequest("Statement descriptor should be a 6-character value that starts with 'SM'");
-        }
-
-        await subscriberService.VerifyBankAccount(provider, requestBody.DescriptorCode);
-
-        return TypedResults.Ok();
-    }
-
+    // TODO: Migrate to Query / ProviderBillingVNextController
     [HttpGet("subscription")]
     public async Task<IResult> GetSubscriptionAsync([FromRoute] Guid providerId)
     {
@@ -172,53 +128,4 @@ public class ProviderBillingController(
 
         return TypedResults.Ok(response);
     }
-
-    [HttpGet("tax-information")]
-    public async Task<IResult> GetTaxInformationAsync([FromRoute] Guid providerId)
-    {
-        var (provider, result) = await TryGetBillableProviderForAdminOperation(providerId);
-
-        if (provider == null)
-        {
-            return result;
-        }
-
-        var taxInformation = await subscriberService.GetTaxInformation(provider);
-
-        var response = TaxInformationResponse.From(taxInformation);
-
-        return TypedResults.Ok(response);
-    }
-
-    [HttpPut("tax-information")]
-    public async Task<IResult> UpdateTaxInformationAsync(
-        [FromRoute] Guid providerId,
-        [FromBody] TaxInformationRequestBody requestBody)
-    {
-        var (provider, result) = await TryGetBillableProviderForAdminOperation(providerId);
-
-        if (provider == null)
-        {
-            return result;
-        }
-
-        if (requestBody is not { Country: not null, PostalCode: not null })
-        {
-            return Error.BadRequest("Country and postal code are required to update your tax information.");
-        }
-
-        var taxInformation = new TaxInformation(
-            requestBody.Country,
-            requestBody.PostalCode,
-            requestBody.TaxId,
-            requestBody.TaxIdType,
-            requestBody.Line1,
-            requestBody.Line2,
-            requestBody.City,
-            requestBody.State);
-
-        await subscriberService.UpdateTaxInformation(provider, taxInformation);
-
-        return TypedResults.Ok();
-    }
 }

src/Api/Billing/Controllers/VNext/SelfHostedAccountBillingVNextController.cs

@@ -1,5 +1,4 @@
-#nullable enable
-using Bit.Api.Billing.Attributes;
+using Bit.Api.Billing.Attributes;
 using Bit.Api.Billing.Models.Requests.Premium;
 using Bit.Api.Utilities;
 using Bit.Core;
@@ -17,7 +16,7 @@ namespace Bit.Api.Billing.Controllers.VNext;
 [Authorize("Application")]
 [Route("account/billing/vnext/self-host")]
 [SelfHosted(SelfHostedOnly = true)]
-public class SelfHostedAccountBillingController(
+public class SelfHostedAccountBillingVNextController(
     ICreatePremiumSelfHostedSubscriptionCommand createPremiumSelfHostedSubscriptionCommand) : BaseBillingController
 {
     [HttpPost("license")]

src/Api/Billing/Controllers/VNext/SelfHostedOrganizationBillingVNextController.cs

@@ -14,7 +14,7 @@ namespace Bit.Api.Billing.Controllers.VNext;
 [Authorize("Application")]
 [Route("organizations/{organizationId:guid}/billing/vnext/self-host")]
 [SelfHosted(SelfHostedOnly = true)]
-public class SelfHostedBillingController(
+public class SelfHostedOrganizationBillingVNextController(
     IGetOrganizationMetadataQuery getOrganizationMetadataQuery) : BaseBillingController
 {
     [Authorize<MemberOrProviderRequirement>]

src/Api/Billing/Models/Requests/TaxInformationRequestBody.cs

@@ -1,31 +0,0 @@
-// FIXME: Update this file to be null safe and then delete the line below
-#nullable disable
-
-using System.ComponentModel.DataAnnotations;
-using Bit.Core.Billing.Tax.Models;
-
-namespace Bit.Api.Billing.Models.Requests;
-
-public class TaxInformationRequestBody
-{
-    [Required]
-    public string Country { get; set; }
-    [Required]
-    public string PostalCode { get; set; }
-    public string TaxId { get; set; }
-    public string TaxIdType { get; set; }
-    public string Line1 { get; set; }
-    public string Line2 { get; set; }
-    public string City { get; set; }
-    public string State { get; set; }
-
-    public TaxInformation ToDomain() => new(
-        Country,
-        PostalCode,
-        TaxId,
-        TaxIdType,
-        Line1,
-        Line2,
-        City,
-        State);
-}

src/Api/Billing/Models/Requests/TokenizedPaymentSourceRequestBody.cs

@@ -1,25 +0,0 @@
-// FIXME: Update this file to be null safe and then delete the line below
-#nullable disable
-
-using System.ComponentModel.DataAnnotations;
-using Bit.Api.Utilities;
-using Bit.Core.Billing.Models;
-using Bit.Core.Enums;
-
-namespace Bit.Api.Billing.Models.Requests;
-
-public class TokenizedPaymentSourceRequestBody
-{
-    [Required]
-    [EnumMatches<PaymentMethodType>(
-        PaymentMethodType.BankAccount,
-        PaymentMethodType.Card,
-        PaymentMethodType.PayPal,
-        ErrorMessage = "'type' must be BankAccount, Card or PayPal")]
-    public PaymentMethodType Type { get; set; }
-
-    [Required]
-    public string Token { get; set; }
-
-    public TokenizedPaymentSource ToDomain() => new(Type, Token);
-}

src/Api/Billing/Models/Requests/UpdatePaymentMethodRequestBody.cs

@@ -1,15 +0,0 @@
-// FIXME: Update this file to be null safe and then delete the line below
-#nullable disable
-
-using System.ComponentModel.DataAnnotations;
-
-namespace Bit.Api.Billing.Models.Requests;
-
-public class UpdatePaymentMethodRequestBody
-{
-    [Required]
-    public TokenizedPaymentSourceRequestBody PaymentSource { get; set; }
-
-    [Required]
-    public TaxInformationRequestBody TaxInformation { get; set; }
-}

src/Api/Billing/Models/Requests/VerifyBankAccountRequestBody.cs

@@ -1,12 +0,0 @@
-// FIXME: Update this file to be null safe and then delete the line below
-#nullable disable
-
-using System.ComponentModel.DataAnnotations;
-
-namespace Bit.Api.Billing.Models.Requests;
-
-public class VerifyBankAccountRequestBody
-{
-    [Required]
-    public string DescriptorCode { get; set; }
-}

src/Api/Billing/Models/Responses/BillingPaymentResponseModel.cs

@@ -1,20 +0,0 @@
-// FIXME: Update this file to be null safe and then delete the line below
-#nullable disable
-
-using Bit.Core.Billing.Models;
-using Bit.Core.Models.Api;
-
-namespace Bit.Api.Billing.Models.Responses;
-
-public class BillingPaymentResponseModel : ResponseModel
-{
-    public BillingPaymentResponseModel(BillingInfo billing)
-        : base("billingPayment")
-    {
-        Balance = billing.Balance;
-        PaymentSource = billing.PaymentSource != null ? new BillingSource(billing.PaymentSource) : null;
-    }
-
-    public decimal Balance { get; set; }
-    public BillingSource PaymentSource { get; set; }
-}

src/Api/Billing/Models/Responses/PaymentMethodResponse.cs

@@ -1,18 +0,0 @@
-using Bit.Core.Billing.Models;
-using Bit.Core.Billing.Tax.Models;
-
-namespace Bit.Api.Billing.Models.Responses;
-
-public record PaymentMethodResponse(
-    decimal AccountCredit,
-    PaymentSource PaymentSource,
-    string SubscriptionStatus,
-    TaxInformation TaxInformation)
-{
-    public static PaymentMethodResponse From(PaymentMethod paymentMethod) =>
-        new(
-            paymentMethod.AccountCredit,
-            paymentMethod.PaymentSource,
-            paymentMethod.SubscriptionStatus,
-            paymentMethod.TaxInformation);
-}

src/Api/Billing/Models/Responses/PaymentSourceResponse.cs

@@ -1,16 +0,0 @@
-using Bit.Core.Billing.Models;
-using Bit.Core.Enums;
-
-namespace Bit.Api.Billing.Models.Responses;
-
-public record PaymentSourceResponse(
-    PaymentMethodType Type,
-    string Description,
-    bool NeedsVerification)
-{
-    public static PaymentSourceResponse From(PaymentSource paymentMethod)
-        => new(
-            paymentMethod.Type,
-            paymentMethod.Description,
-            paymentMethod.NeedsVerification);
-}

src/Api/Billing/Models/Responses/TaxInformationResponse.cs

@@ -1,23 +0,0 @@
-using Bit.Core.Billing.Tax.Models;
-
-namespace Bit.Api.Billing.Models.Responses;
-
-public record TaxInformationResponse(
-    string Country,
-    string PostalCode,
-    string TaxId,
-    string Line1,
-    string Line2,
-    string City,
-    string State)
-{
-    public static TaxInformationResponse From(TaxInformation taxInformation)
-        => new(
-            taxInformation.Country,
-            taxInformation.PostalCode,
-            taxInformation.TaxId,
-            taxInformation.Line1,
-            taxInformation.Line2,
-            taxInformation.City,
-            taxInformation.State);
-}

src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs

@@ -1,8 +1,8 @@
-#nullable enable
-using Bit.Api.AdminConsole.Models.Request.Organizations;
+using Bit.Api.AdminConsole.Models.Request.Organizations;
 using Bit.Api.Auth.Models.Request;
 using Bit.Api.Auth.Models.Request.WebAuthn;
 using Bit.Api.KeyManagement.Models.Requests;
+using Bit.Api.KeyManagement.Models.Responses;
 using Bit.Api.KeyManagement.Validators;
 using Bit.Api.Tools.Models.Request;
 using Bit.Api.Vault.Models.Request;
@@ -14,6 +14,7 @@ using Bit.Core.Entities;
 using Bit.Core.Exceptions;
 using Bit.Core.KeyManagement.Commands.Interfaces;
 using Bit.Core.KeyManagement.Models.Data;
+using Bit.Core.KeyManagement.Queries.Interfaces;
 using Bit.Core.KeyManagement.UserKey;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
@@ -45,11 +46,13 @@ public class AccountsKeyManagementController : Controller
     private readonly IRotationValidator<IEnumerable<WebAuthnLoginRotateKeyRequestModel>, IEnumerable<WebAuthnLoginRotateKeyData>>
         _webauthnKeyValidator;
     private readonly IRotationValidator<IEnumerable<OtherDeviceKeysUpdateRequestModel>, IEnumerable<Device>> _deviceValidator;
+    private readonly IKeyConnectorConfirmationDetailsQuery _keyConnectorConfirmationDetailsQuery;
 
     public AccountsKeyManagementController(IUserService userService,
         IFeatureService featureService,
         IOrganizationUserRepository organizationUserRepository,
         IEmergencyAccessRepository emergencyAccessRepository,
+        IKeyConnectorConfirmationDetailsQuery keyConnectorConfirmationDetailsQuery,
         IRegenerateUserAsymmetricKeysCommand regenerateUserAsymmetricKeysCommand,
         IRotateUserAccountKeysCommand rotateUserKeyCommandV2,
         IRotationValidator<IEnumerable<CipherWithIdRequestModel>, IEnumerable<Cipher>> cipherValidator,
@@ -75,6 +78,7 @@ public class AccountsKeyManagementController : Controller
         _organizationUserValidator = organizationUserValidator;
         _webauthnKeyValidator = webAuthnKeyValidator;
         _deviceValidator = deviceValidator;
+        _keyConnectorConfirmationDetailsQuery = keyConnectorConfirmationDetailsQuery;
     }
 
     [HttpPost("key-management/regenerate-keys")]
@@ -178,4 +182,17 @@ public class AccountsKeyManagementController : Controller
 
         throw new BadRequestException(ModelState);
     }
+
+    [HttpGet("key-connector/confirmation-details/{orgSsoIdentifier}")]
+    public async Task<KeyConnectorConfirmationDetailsResponseModel> GetKeyConnectorConfirmationDetailsAsync(string orgSsoIdentifier)
+    {
+        var user = await _userService.GetUserByPrincipalAsync(User);
+        if (user == null)
+        {
+            throw new UnauthorizedAccessException();
+        }
+
+        var details = await _keyConnectorConfirmationDetailsQuery.Run(orgSsoIdentifier, user.Id);
+        return new KeyConnectorConfirmationDetailsResponseModel(details);
+    }
 }

src/Api/KeyManagement/Models/Responses/KeyConnectorConfirmationDetailsResponseModel.cs

@@ -0,0 +1,24 @@
+using Bit.Core.KeyManagement.Models.Data;
+using Bit.Core.Models.Api;
+
+namespace Bit.Api.KeyManagement.Models.Responses;
+
+public class KeyConnectorConfirmationDetailsResponseModel : ResponseModel
+{
+    private const string _objectName = "keyConnectorConfirmationDetails";
+
+    public KeyConnectorConfirmationDetailsResponseModel(KeyConnectorConfirmationDetails details,
+        string obj = _objectName) : base(obj)
+    {
+        ArgumentNullException.ThrowIfNull(details);
+
+        OrganizationName = details.OrganizationName;
+    }
+
+    public KeyConnectorConfirmationDetailsResponseModel() : base(_objectName)
+    {
+        OrganizationName = string.Empty;
+    }
+
+    public string OrganizationName { get; set; }
+}

src/Api/Vault/Controllers/CiphersController.cs

@@ -760,7 +760,7 @@ public class CiphersController : Controller
         ValidateClientVersionForFido2CredentialSupport(cipher);
 
         var original = cipher.Clone();
-        await _cipherService.ShareAsync(original, model.Cipher.ToCipher(cipher), new Guid(model.Cipher.OrganizationId),
+        await _cipherService.ShareAsync(original, model.Cipher.ToCipher(cipher, user.Id), new Guid(model.Cipher.OrganizationId),
             model.CollectionIds.Select(c => new Guid(c)), user.Id, model.Cipher.LastKnownRevisionDate);
 
         var sharedCipher = await GetByIdAsync(id, user.Id);

src/Api/Vault/Models/Request/CipherRequestModel.cs

@@ -84,7 +84,7 @@ public class CipherRequestModel
         return existingCipher;
     }
 
-    public Cipher ToCipher(Cipher existingCipher)
+    public Cipher ToCipher(Cipher existingCipher, Guid? userId = null)
     {
         // If Data field is provided, use it directly
         if (!string.IsNullOrWhiteSpace(Data))
@@ -124,9 +124,12 @@ public class CipherRequestModel
             }
         }
 
+        var userIdKey = userId.HasValue ? userId.ToString().ToUpperInvariant() : null;
         existingCipher.Reprompt = Reprompt;
         existingCipher.Key = Key;
         existingCipher.ArchivedDate = ArchivedDate;
+        existingCipher.Folders = UpdateUserSpecificJsonField(existingCipher.Folders, userIdKey, FolderId);
+        existingCipher.Favorites = UpdateUserSpecificJsonField(existingCipher.Favorites, userIdKey, Favorite);
 
         var hasAttachments2 = (Attachments2?.Count ?? 0) > 0;
         var hasAttachments = (Attachments?.Count ?? 0) > 0;
@@ -291,6 +294,37 @@ public class CipherRequestModel
             KeyFingerprint = SSHKey.KeyFingerprint,
         };
     }
+
+    /// <summary>
+    /// Updates a JSON string representing a dictionary by adding, updating, or removing a key-value pair
+    /// based on the provided userIdKey and newValue.
+    /// </summary>
+    private static string UpdateUserSpecificJsonField(string existingJson, string userIdKey, object newValue)
+    {
+        if (userIdKey == null)
+        {
+            return existingJson;
+        }
+
+        var jsonDict = string.IsNullOrWhiteSpace(existingJson)
+            ? new Dictionary<string, object>()
+            : JsonSerializer.Deserialize<Dictionary<string, object>>(existingJson) ?? new Dictionary<string, object>();
+
+        var shouldRemove = newValue == null ||
+                          (newValue is string strValue && string.IsNullOrWhiteSpace(strValue)) ||
+                          (newValue is bool boolValue && !boolValue);
+
+        if (shouldRemove)
+        {
+            jsonDict.Remove(userIdKey);
+        }
+        else
+        {
+            jsonDict[userIdKey] = newValue is string str ? str.ToUpperInvariant() : newValue;
+        }
+
+        return jsonDict.Count == 0 ? null : JsonSerializer.Serialize(jsonDict);
+    }
 }
 
 public class CipherWithIdRequestModel : CipherRequestModel

src/Billing/Billing.csproj

@@ -11,7 +11,7 @@
     <ProjectReference Include="..\Core\Core.csproj" />
   </ItemGroup>
   <ItemGroup>
-    <PackageReference Include="MarkDig" Version="0.41.3" />
+    <PackageReference Include="MarkDig" Version="0.44.0" />
     <PackageReference Include="Swashbuckle.AspNetCore" Version="9.0.4" />
   </ItemGroup>
 

src/Core/AdminConsole/Enums/EventType.cs

@@ -81,6 +81,8 @@ public enum EventType : int
     Organization_CollectionManagement_LimitItemDeletionDisabled = 1615,
     Organization_CollectionManagement_AllowAdminAccessToAllCollectionItemsEnabled = 1616,
     Organization_CollectionManagement_AllowAdminAccessToAllCollectionItemsDisabled = 1617,
+    Organization_ItemOrganization_Accepted = 1618,
+    Organization_ItemOrganization_Declined = 1619,
 
     Policy_Updated = 1700,
 

src/Core/AdminConsole/Models/Data/Organizations/OrganizationUsers/OrganizationUserUserDetails.cs

@@ -63,11 +63,6 @@ public class OrganizationUserUserDetails : IExternal, ITwoFactorProvidersUser, I
         return UserId;
     }
 
-    public bool GetPremium()
-    {
-        return Premium.GetValueOrDefault(false);
-    }
-
     public Permissions GetPermissions()
     {
         return string.IsNullOrWhiteSpace(Permissions) ? null

src/Core/Auth/Entities/AuthRequest.cs

@@ -49,11 +49,9 @@ public class AuthRequest : ITableObject<Guid>
 
     public bool IsExpired()
     {
-        // TODO: PM-24252 - consider using TimeProvider for better mocking in tests
         return GetExpirationDate() < DateTime.UtcNow;
     }
 
-    // TODO: PM-24252 - this probably belongs in a service.
     public bool IsValidForAuthentication(Guid userId,
         string password)
     {

src/Core/Auth/LoginFeatures/LoginServiceCollectionExtensions.cs

@@ -1,14 +0,0 @@
-using Bit.Core.Auth.LoginFeatures.PasswordlessLogin;
-using Bit.Core.Auth.LoginFeatures.PasswordlessLogin.Interfaces;
-using Microsoft.Extensions.DependencyInjection;
-
-namespace Bit.Core.Auth.LoginFeatures;
-
-public static class LoginServiceCollectionExtensions
-{
-    public static void AddLoginServices(this IServiceCollection services)
-    {
-        services.AddScoped<IVerifyAuthRequestCommand, VerifyAuthRequestCommand>();
-    }
-}
-

src/Core/Auth/LoginFeatures/PasswordlessLogin/Interfaces/IVerifyAuthRequest.cs

@@ -1,6 +0,0 @@
-namespace Bit.Core.Auth.LoginFeatures.PasswordlessLogin.Interfaces;
-
-public interface IVerifyAuthRequestCommand
-{
-    Task<bool> VerifyAuthRequestAsync(Guid authRequestId, string accessCode);
-}

src/Core/Auth/LoginFeatures/PasswordlessLogin/VerifyAuthRequest.cs

@@ -1,25 +0,0 @@
-using Bit.Core.Auth.LoginFeatures.PasswordlessLogin.Interfaces;
-using Bit.Core.Repositories;
-using Bit.Core.Utilities;
-
-namespace Bit.Core.Auth.LoginFeatures.PasswordlessLogin;
-
-public class VerifyAuthRequestCommand : IVerifyAuthRequestCommand
-{
-    private readonly IAuthRequestRepository _authRequestRepository;
-
-    public VerifyAuthRequestCommand(IAuthRequestRepository authRequestRepository)
-    {
-        _authRequestRepository = authRequestRepository;
-    }
-
-    public async Task<bool> VerifyAuthRequestAsync(Guid authRequestId, string accessCode)
-    {
-        var authRequest = await _authRequestRepository.GetByIdAsync(authRequestId);
-        if (authRequest == null || !CoreHelpers.FixedTimeEquals(authRequest.AccessCode, accessCode))
-        {
-            return false;
-        }
-        return true;
-    }
-}

src/Core/Auth/Models/ITwoFactorProvidersUser.cs

@@ -1,14 +1,14 @@
-// FIXME: Update this file to be null safe and then delete the line below
-#nullable disable
-
-using Bit.Core.Auth.Enums;
+using Bit.Core.Auth.Enums;
 using Bit.Core.Services;
 
 namespace Bit.Core.Auth.Models;
 
+/// <summary>
+/// An interface representing a user entity that supports two-factor providers
+/// </summary>
 public interface ITwoFactorProvidersUser
 {
-    string TwoFactorProviders { get; }
+    string? TwoFactorProviders { get; }
     /// <summary>
     /// Get the two factor providers for the user. Currently it can be assumed providers are enabled
     /// if they exists in the dictionary. When two factor providers are disabled they are removed
@@ -16,7 +16,10 @@ public interface ITwoFactorProvidersUser
     /// <see cref="IOrganizationService.DisableTwoFactorProviderAsync"/>
     /// </summary>
     /// <returns>Dictionary of providers with the type enum as the key</returns>
-    Dictionary<TwoFactorProviderType, TwoFactorProvider> GetTwoFactorProviders();
+    Dictionary<TwoFactorProviderType, TwoFactorProvider>? GetTwoFactorProviders();
+    /// <summary>
+    /// The unique `UserId` of the user entity for which there are two-factor providers configured.
+    /// </summary>
+    /// <returns>The unique identifier for the user</returns>
     Guid? GetUserId();
-    bool GetPremium();
 }

src/Core/Billing/Services/ISubscriberService.cs

@@ -6,7 +6,6 @@ using Bit.Core.Billing.Tax.Models;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Stripe;
-using PaymentMethod = Bit.Core.Billing.Models.PaymentMethod;
 
 namespace Bit.Core.Billing.Services;
 
@@ -64,16 +63,6 @@ public interface ISubscriberService
         ISubscriber subscriber,
         CustomerGetOptions customerGetOptions = null);
 
-    /// <summary>
-    /// Retrieves the account credit, a masked representation of the default payment source and the tax information for the
-    /// provided <paramref name="subscriber"/>. This is essentially a consolidated invocation of the <see cref="GetPaymentSource"/>
-    /// and <see cref="GetTaxInformation"/> methods with a response that includes the customer's <see cref="Stripe.Customer.Balance"/> as account credit in order to cut down on Stripe API calls.
-    /// </summary>
-    /// <param name="subscriber">The subscriber to retrieve payment method for.</param>
-    /// <returns>A <see cref="Models.PaymentMethod"/> containing the subscriber's account credit, payment source and tax information.</returns>
-    Task<PaymentMethod> GetPaymentMethod(
-        ISubscriber subscriber);
-
     /// <summary>
     /// Retrieves a masked representation of the subscriber's payment source for presentation to a client.
     /// </summary>
@@ -107,16 +96,6 @@ public interface ISubscriberService
         ISubscriber subscriber,
         SubscriptionGetOptions subscriptionGetOptions = null);
 
-    /// <summary>
-    /// Retrieves the <paramref name="subscriber"/>'s tax information using their Stripe <see cref="Stripe.Customer"/>'s <see cref="Stripe.Customer.Address"/>.
-    /// </summary>
-    /// <param name="subscriber">The subscriber to retrieve the tax information for.</param>
-    /// <returns>A <see cref="TaxInformation"/> representing the <paramref name="subscriber"/>'s tax information.</returns>
-    /// <exception cref="ArgumentNullException">Thrown when the <paramref name="subscriber"/> is <see langword="null"/>.</exception>
-    /// <remarks>This method opts for returning <see langword="null"/> rather than throwing exceptions, making it ideal for surfacing data from API endpoints.</remarks>
-    Task<TaxInformation> GetTaxInformation(
-        ISubscriber subscriber);
-
     /// <summary>
     /// Attempts to remove a subscriber's saved payment source. If the Stripe <see cref="Stripe.Customer"/> representing the
     /// <paramref name="subscriber"/> contains a valid <b>"btCustomerId"</b> key in its <see cref="Stripe.Customer.Metadata"/> property,
@@ -147,17 +126,6 @@ public interface ISubscriberService
         ISubscriber subscriber,
         TaxInformation taxInformation);
 
-    /// <summary>
-    /// Verifies the subscriber's pending bank account using the provided <paramref name="descriptorCode"/>.
-    /// </summary>
-    /// <param name="subscriber">The subscriber to verify the bank account for.</param>
-    /// <param name="descriptorCode">The code attached to a deposit made to the subscriber's bank account in order to ensure they have access to it.
-    /// <a href="https://docs.stripe.com/payments/ach-debit/set-up-payment">Learn more.</a></param>
-    /// <returns></returns>
-    Task VerifyBankAccount(
-        ISubscriber subscriber,
-        string descriptorCode);
-
     /// <summary>
     /// Validates whether the <paramref name="subscriber"/>'s <see cref="ISubscriber.GatewayCustomerId"/> exists in the gateway.
     /// If the <paramref name="subscriber"/>'s <see cref="ISubscriber.GatewayCustomerId"/> is <see langword="null"/> or empty, returns <see langword="true"/>.

src/Core/Billing/Services/Implementations/SubscriberService.cs

@@ -24,7 +24,6 @@ using Stripe;
 
 using static Bit.Core.Billing.Utilities;
 using Customer = Stripe.Customer;
-using PaymentMethod = Bit.Core.Billing.Models.PaymentMethod;
 using Subscription = Stripe.Subscription;
 
 namespace Bit.Core.Billing.Services.Implementations;
@@ -330,38 +329,6 @@ public class SubscriberService(
         }
     }
 
-    public async Task<PaymentMethod> GetPaymentMethod(
-        ISubscriber subscriber)
-    {
-        ArgumentNullException.ThrowIfNull(subscriber);
-
-        var customer = await GetCustomer(subscriber, new CustomerGetOptions
-        {
-            Expand = ["default_source", "invoice_settings.default_payment_method", "subscriptions", "tax_ids"]
-        });
-
-        if (customer == null)
-        {
-            return PaymentMethod.Empty;
-        }
-
-        var accountCredit = customer.Balance * -1 / 100M;
-
-        var paymentMethod = await GetPaymentSourceAsync(subscriber.Id, customer);
-
-        var subscriptionStatus = customer.Subscriptions
-            .FirstOrDefault(subscription => subscription.Id == subscriber.GatewaySubscriptionId)?
-            .Status;
-
-        var taxInformation = GetTaxInformation(customer);
-
-        return new PaymentMethod(
-            accountCredit,
-            paymentMethod,
-            subscriptionStatus,
-            taxInformation);
-    }
-
     public async Task<PaymentSource> GetPaymentSource(
         ISubscriber subscriber)
     {
@@ -449,16 +416,6 @@ public class SubscriberService(
         }
     }
 
-    public async Task<TaxInformation> GetTaxInformation(
-        ISubscriber subscriber)
-    {
-        ArgumentNullException.ThrowIfNull(subscriber);
-
-        var customer = await GetCustomerOrThrow(subscriber, new CustomerGetOptions { Expand = ["tax_ids"] });
-
-        return GetTaxInformation(customer);
-    }
-
     public async Task RemovePaymentSource(
         ISubscriber subscriber)
     {
@@ -823,57 +780,6 @@ public class SubscriberService(
         }
     }
 
-    public async Task VerifyBankAccount(
-        ISubscriber subscriber,
-        string descriptorCode)
-    {
-        var setupIntentId = await setupIntentCache.GetSetupIntentIdForSubscriber(subscriber.Id);
-
-        if (string.IsNullOrEmpty(setupIntentId))
-        {
-            logger.LogError("No setup intent ID exists to verify for subscriber with ID ({SubscriberID})", subscriber.Id);
-            throw new BillingException();
-        }
-
-        try
-        {
-            await stripeAdapter.SetupIntentVerifyMicroDeposit(setupIntentId,
-                new SetupIntentVerifyMicrodepositsOptions { DescriptorCode = descriptorCode });
-
-            var setupIntent = await stripeAdapter.SetupIntentGet(setupIntentId);
-
-            await stripeAdapter.PaymentMethodAttachAsync(setupIntent.PaymentMethodId,
-                new PaymentMethodAttachOptions { Customer = subscriber.GatewayCustomerId });
-
-            await stripeAdapter.CustomerUpdateAsync(subscriber.GatewayCustomerId,
-                new CustomerUpdateOptions
-                {
-                    InvoiceSettings = new CustomerInvoiceSettingsOptions
-                    {
-                        DefaultPaymentMethod = setupIntent.PaymentMethodId
-                    }
-                });
-        }
-        catch (StripeException stripeException)
-        {
-            if (!string.IsNullOrEmpty(stripeException.StripeError?.Code))
-            {
-                var message = stripeException.StripeError.Code switch
-                {
-                    StripeConstants.ErrorCodes.PaymentMethodMicroDepositVerificationAttemptsExceeded => "You have exceeded the number of allowed verification attempts. Please contact support.",
-                    StripeConstants.ErrorCodes.PaymentMethodMicroDepositVerificationDescriptorCodeMismatch => "The verification code you provided does not match the one sent to your bank account. Please try again.",
-                    StripeConstants.ErrorCodes.PaymentMethodMicroDepositVerificationTimeout => "Your bank account was not verified within the required time period. Please contact support.",
-                    _ => BillingException.DefaultMessage
-                };
-
-                throw new BadRequestException(message);
-            }
-
-            logger.LogError(stripeException, "An unhandled Stripe exception was thrown while verifying subscriber's ({SubscriberID}) bank account", subscriber.Id);
-            throw new BillingException();
-        }
-    }
-
     public async Task<bool> IsValidGatewayCustomerIdAsync(ISubscriber subscriber)
     {
         ArgumentNullException.ThrowIfNull(subscriber);
@@ -970,25 +876,6 @@ public class SubscriberService(
         return PaymentSource.From(setupIntent);
     }
 
-    private static TaxInformation GetTaxInformation(
-        Customer customer)
-    {
-        if (customer.Address == null)
-        {
-            return null;
-        }
-
-        return new TaxInformation(
-            customer.Address.Country,
-            customer.Address.PostalCode,
-            customer.TaxIds?.FirstOrDefault()?.Value,
-            customer.TaxIds?.FirstOrDefault()?.Type,
-            customer.Address.Line1,
-            customer.Address.Line2,
-            customer.Address.City,
-            customer.Address.State);
-    }
-
     private async Task RemoveBraintreeCustomerIdAsync(
         Customer customer)
     {

src/Core/Constants.cs

@@ -156,7 +156,6 @@ public static class FeatureFlagKeys
     public const string SetInitialPasswordRefactor = "pm-16117-set-initial-password-refactor";
     public const string ChangeExistingPasswordRefactor = "pm-16117-change-existing-password-refactor";
     public const string Otp6Digits = "pm-18612-otp-6-digits";
-    public const string FailedTwoFactorEmail = "pm-24425-send-2fa-failed-email";
     public const string PM24579_PreventSsoOnExistingNonCompliantUsers = "pm-24579-prevent-sso-on-existing-non-compliant-users";
     public const string DisableAlternateLoginMethods = "pm-22110-disable-alternate-login-methods";
     public const string PM23174ManageAccountRecoveryPermissionDrivesTheNeedToSetMasterPassword =
@@ -239,6 +238,7 @@ public static class FeatureFlagKeys
     public const string UseSdkPasswordGenerators = "pm-19976-use-sdk-password-generators";
     public const string UseChromiumImporter = "pm-23982-chromium-importer";
     public const string ChromiumImporterWithABE = "pm-25855-chromium-importer-abe";
+    public const string SendUIRefresh = "pm-28175-send-ui-refresh";
 
     /* Vault Team */
     public const string CipherKeyEncryption = "cipher-key-encryption";
@@ -251,6 +251,7 @@ public static class FeatureFlagKeys
     public const string PM25083_AutofillConfirmFromSearch = "pm-25083-autofill-confirm-from-search";
     public const string VaultLoadingSkeletons = "pm-25081-vault-skeleton-loaders";
     public const string BrowserPremiumSpotlight = "pm-23384-browser-premium-spotlight";
+    public const string MigrateMyVaultToMyItems = "pm-20558-migrate-myvault-to-myitems";
 
     /* Innovation Team */
     public const string ArchiveVaultItems = "pm-19148-innovation-archive";

src/Core/Entities/User.cs

@@ -201,11 +201,6 @@ public class User : ITableObject<Guid>, IStorableSubscriber, IRevisable, ITwoFac
         return Id;
     }
 
-    public bool GetPremium()
-    {
-        return Premium;
-    }
-
     public int GetSecurityVersion()
     {
         // If no security version is set, it is version 1. The minimum initialized version is 2.

src/Core/KeyManagement/KeyManagementServiceCollectionExtensions.cs

@@ -26,5 +26,6 @@ public static class KeyManagementServiceCollectionExtensions
     private static void AddKeyManagementQueries(this IServiceCollection services)
     {
         services.AddScoped<IUserAccountKeysQuery, UserAccountKeysQuery>();
+        services.AddScoped<IKeyConnectorConfirmationDetailsQuery, KeyConnectorConfirmationDetailsQuery>();
     }
 }

src/Core/KeyManagement/Models/Data/KeyConnectorConfirmationDetails.cs

@@ -0,0 +1,6 @@
+namespace Bit.Core.KeyManagement.Models.Data;
+
+public class KeyConnectorConfirmationDetails
+{
+    public required string OrganizationName { get; set; }
+}

src/Core/KeyManagement/Models/Data/UserAccountKeysData.cs

@@ -1,9 +1,34 @@
 namespace Bit.Core.KeyManagement.Models.Data;
 
-
+/// <summary>
+/// Represents an expanded account cryptographic state for a user. Expanded here means
+/// that it does not only contain the (wrapped) private / signing key, but also the public
+/// key / verifying key. The client side only needs a subset of this data to unlock
+/// their vault and the public parts can be derived.
+/// </summary>
 public class UserAccountKeysData
 {
     public required PublicKeyEncryptionKeyPairData PublicKeyEncryptionKeyPairData { get; set; }
     public SignatureKeyPairData? SignatureKeyPairData { get; set; }
     public SecurityStateData? SecurityStateData { get; set; }
+
+    /// <summary>
+    /// Checks whether the account cryptographic state is for a V1 encryption user or a V2 encryption user.
+    /// Throws if the state is invalid
+    /// </summary>
+    public bool IsV2Encryption()
+    {
+        if (PublicKeyEncryptionKeyPairData.SignedPublicKey != null && SignatureKeyPairData != null && SecurityStateData != null)
+        {
+            return true;
+        }
+        else if (PublicKeyEncryptionKeyPairData.SignedPublicKey == null && SignatureKeyPairData == null && SecurityStateData == null)
+        {
+            return false;
+        }
+        else
+        {
+            throw new InvalidOperationException("Invalid account cryptographic state: V2 encryption fields must be either all present or all absent.");
+        }
+    }
 }

src/Core/KeyManagement/Queries/Interfaces/IKeyConnectorConfirmationDetailsQuery.cs

@@ -0,0 +1,8 @@
+using Bit.Core.KeyManagement.Models.Data;
+
+namespace Bit.Core.KeyManagement.Queries.Interfaces;
+
+public interface IKeyConnectorConfirmationDetailsQuery
+{
+    public Task<KeyConnectorConfirmationDetails> Run(string orgSsoIdentifier, Guid userId);
+}

src/Core/KeyManagement/Queries/KeyConnectorConfirmationDetailsQuery.cs

@@ -0,0 +1,35 @@
+using Bit.Core.Exceptions;
+using Bit.Core.KeyManagement.Models.Data;
+using Bit.Core.KeyManagement.Queries.Interfaces;
+using Bit.Core.Repositories;
+
+namespace Bit.Core.KeyManagement.Queries;
+
+public class KeyConnectorConfirmationDetailsQuery : IKeyConnectorConfirmationDetailsQuery
+{
+    private readonly IOrganizationRepository _organizationRepository;
+    private readonly IOrganizationUserRepository _organizationUserRepository;
+
+    public KeyConnectorConfirmationDetailsQuery(IOrganizationRepository organizationRepository, IOrganizationUserRepository organizationUserRepository)
+    {
+        _organizationRepository = organizationRepository;
+        _organizationUserRepository = organizationUserRepository;
+    }
+
+    public async Task<KeyConnectorConfirmationDetails> Run(string orgSsoIdentifier, Guid userId)
+    {
+        var org = await _organizationRepository.GetByIdentifierAsync(orgSsoIdentifier);
+        if (org is not { UseKeyConnector: true })
+        {
+            throw new NotFoundException();
+        }
+
+        var orgUser = await _organizationUserRepository.GetByOrganizationAsync(org.Id, userId);
+        if (orgUser == null)
+        {
+            throw new NotFoundException();
+        }
+
+        return new KeyConnectorConfirmationDetails { OrganizationName = org.Name, };
+    }
+}

src/Core/MailTemplates/Handlebars/MJML/AdminConsole/OrganizationConfirmation/organization-confirmation-enterprise-teams.html.hbs

@@ -0,0 +1,815 @@
+<!doctype html>
+<html lang="und" dir="auto" xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office">
+  <head>
+    <title></title>
+    <!--[if !mso]><!-->
+    <meta http-equiv="X-UA-Compatible" content="IE=edge">
+    <!--<![endif]-->
+    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <style type="text/css">
+      #outlook a { padding:0; }
+      body { margin:0;padding:0;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%; }
+      table, td { border-collapse:collapse;mso-table-lspace:0pt;mso-table-rspace:0pt; }
+      img { border:0;height:auto;line-height:100%; outline:none;text-decoration:none;-ms-interpolation-mode:bicubic; }
+      p { display:block;margin:13px 0; }
+    </style>
+    <!--[if mso]>
+    <noscript>
+    <xml>
+    <o:OfficeDocumentSettings>
+      <o:AllowPNG/>
+      <o:PixelsPerInch>96</o:PixelsPerInch>
+    </o:OfficeDocumentSettings>
+    </xml>
+    </noscript>
+    <![endif]-->
+    <!--[if lte mso 11]>
+    <style type="text/css">
+      .mj-outlook-group-fix { width:100% !important; }
+    </style>
+    <![endif]-->
+    
+      <!--[if !mso]><!-->
+        <link href="https://fonts.googleapis.com/css?family=Roboto:300,400,500,700" rel="stylesheet" type="text/css">
+        <style type="text/css">
+          @import url(https://fonts.googleapis.com/css?family=Roboto:300,400,500,700);
+        </style>
+      <!--<![endif]-->
+
+    
+    
+    <style type="text/css">
+      @media only screen and (min-width:480px) {
+        .mj-column-per-70 { width:70% !important; max-width: 70%; }
+.mj-column-per-30 { width:30% !important; max-width: 30%; }
+.mj-column-per-100 { width:100% !important; max-width: 100%; }
+.mj-column-per-15 { width:15% !important; max-width: 15%; }
+.mj-column-per-85 { width:85% !important; max-width: 85%; }
+      }
+    </style>
+    <style media="screen and (min-width:480px)">
+      .moz-text-html .mj-column-per-70 { width:70% !important; max-width: 70%; }
+.moz-text-html .mj-column-per-30 { width:30% !important; max-width: 30%; }
+.moz-text-html .mj-column-per-100 { width:100% !important; max-width: 100%; }
+.moz-text-html .mj-column-per-15 { width:15% !important; max-width: 15%; }
+.moz-text-html .mj-column-per-85 { width:85% !important; max-width: 85%; }
+    </style>
+    
+    
+  
+    
+    <style type="text/css">
+
+      @media only screen and (max-width:480px) {
+        .mj-bw-hero-responsive-img {
+          display: none !important;
+        }
+      }
+    
+
+      @media only screen and (max-width:480px) {
+        .mj-bw-learn-more-footer-responsive-img {
+          display: none !important;
+        }
+      }
+    
+
+    @media only screen and (max-width:479px) {
+      table.mj-full-width-mobile { width: 100% !important; }
+      td.mj-full-width-mobile { width: auto !important; }
+    }
+  
+
+      @media only screen and (max-width:480px) {
+        .mj-bw-icon-row-text {
+          padding-left: 5px !important;
+          line-height: 20px;
+        }
+        .mj-bw-icon-row {
+          padding: 10px 15px;
+          width: fit-content !important;
+        }
+      }
+    
+    </style>
+     
+    <style type="text/css">
+.border-fix > table {
+    border-collapse: separate !important;
+  }
+  .border-fix > table > tbody > tr > td {
+    border-radius: 3px;
+  }
+    </style>
+    
+  </head>
+  <body style="word-spacing:normal;background-color:#e6e9ef;">
+    
+    
+      <div class="border-fix" style="background-color:#e6e9ef;" lang="und" dir="auto">
+        <!-- Blue Header Section -->
+      
+      <!--[if mso | IE]><table align="center" border="0" cellpadding="0" cellspacing="0" class="border-fix-outlook" role="presentation" style="width:660px;" width="660" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
+    
+      
+      <div class="border-fix" style="margin:0px auto;max-width:660px;">
+        
+        <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+          <tbody>
+            <tr>
+              <td style="direction:ltr;font-size:0px;padding:20px 20px 10px 20px;text-align:center;">
+                <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td class="" width="660px" ><![endif]-->
+            
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="background:#175ddc;background-color:#175ddc;width:100%;border-radius:4px 4px 0px 0px;">
+        <tbody>
+          <tr>
+            <td>
+              
+        
+      <!--[if mso | IE]><table align="center" border="0" cellpadding="0" cellspacing="0" class="" role="presentation" style="width:620px;" width="620" bgcolor="#175ddc" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
+    
+        
+      <div style="margin:0px auto;border-radius:4px 4px 0px 0px;max-width:620px;">
+        
+        <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;border-radius:4px 4px 0px 0px;">
+          <tbody>
+            <tr>
+              <td style="direction:ltr;font-size:0px;padding:20px 0;text-align:center;">
+                <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td class="" style="vertical-align:top;width:434px;" ><![endif]-->
+            
+      <div class="mj-column-per-70 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+        
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+        <tbody>
+          
+              <tr>
+                <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                  
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:collapse;border-spacing:0px;">
+        <tbody>
+          <tr>
+            <td style="width:150px;">
+              
+      <img alt src="https://bitwarden.com/images/logo-horizontal-white.png" style="border:0;display:block;outline:none;text-decoration:none;height:30px;width:100%;font-size:16px;" width="150" height="30">
+    
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    
+                </td>
+              </tr>
+            
+              <tr>
+                <td align="left" style="font-size:0px;padding:10px 25px;padding-top:0;padding-bottom:0;word-break:break-word;">
+                  
+      <div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:16px;line-height:1;text-align:left;color:#ffffff;"><h1 style="font-weight: normal; font-size: 24px; line-height: 32px">
+              You can now share passwords with members of {{OrganizationName}}!
+            </h1></div>
+    
+                </td>
+              </tr>
+            
+              <tr>
+                <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                  
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:separate;line-height:100%;">
+        <tbody>
+          <tr>
+            <td align="center" bgcolor="#ffffff" role="presentation" style="border:none;border-radius:20px;cursor:auto;mso-padding-alt:10px 25px;background:#ffffff;" valign="middle">
+              <a href="https://vault.bitwarden.com" style="display:inline-block;background:#ffffff;color:#1A41AC;font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:16px;font-weight:normal;line-height:120%;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:20px;" target="_blank">
+                Log in
+              </a>
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    
+                </td>
+              </tr>
+            
+        </tbody>
+      </table>
+    
+      </div>
+    
+          <!--[if mso | IE]></td><td class="" style="vertical-align:bottom;width:186px;" ><![endif]-->
+            
+      <div class="mj-column-per-30 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:bottom;width:100%;">
+        
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:bottom;" width="100%">
+        <tbody>
+          
+              <tr>
+                <td align="center" class="mj-bw-hero-responsive-img" style="font-size:0px;padding:0px;word-break:break-word;">
+                  
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:collapse;border-spacing:0px;">
+        <tbody>
+          <tr>
+            <td style="width:155px;">
+              
+      <img alt src="https://assets.bitwarden.com/email/v1/spot-enterprise.png" style="border:0;display:block;outline:none;text-decoration:none;height:auto;width:100%;font-size:16px;" width="155" height="auto">
+    
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    
+                </td>
+              </tr>
+            
+        </tbody>
+      </table>
+    
+      </div>
+    
+          <!--[if mso | IE]></td></tr></table><![endif]-->
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        
+      </div>
+    
+        
+      <!--[if mso | IE]></td></tr></table><![endif]-->
+    
+      
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    
+          <!--[if mso | IE]></td></tr></table><![endif]-->
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        
+      </div>
+    
+      
+      <!--[if mso | IE]></td></tr></table><![endif]-->
+    
+    <!-- Main Content -->
+      
+      <!--[if mso | IE]><table align="center" border="0" cellpadding="0" cellspacing="0" class="" role="presentation" style="width:660px;" width="660" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
+    
+      
+      <div style="margin:0px auto;max-width:660px;">
+        
+        <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+          <tbody>
+            <tr>
+              <td style="direction:ltr;font-size:0px;padding:5px 20px 10px 20px;text-align:center;">
+                <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td class="" width="660px" ><table align="center" border="0" cellpadding="0" cellspacing="0" class="" role="presentation" style="width:620px;" width="620" bgcolor="#ffffff" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
+    
+      
+      <div style="background:#ffffff;background-color:#ffffff;margin:0px auto;max-width:620px;">
+        
+        <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="background:#ffffff;background-color:#ffffff;width:100%;">
+          <tbody>
+            <tr>
+              <td style="direction:ltr;font-size:0px;padding:15px 10px 10px 10px;text-align:center;">
+                <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td class="" style="vertical-align:top;width:600px;" ><![endif]-->
+            
+      <div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+        
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+        <tbody>
+          
+              <tr>
+                <td align="left" style="font-size:0px;padding:10px 15px;word-break:break-word;">
+                  
+      <div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:16px;line-height:24px;text-align:left;color:#1B2029;">As a member of <b>{{OrganizationName}}</b>:</div>
+    
+                </td>
+              </tr>
+            
+        </tbody>
+      </table>
+    
+      </div>
+    
+          <!--[if mso | IE]></td></tr></table><![endif]-->
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        
+      </div>
+    
+      
+      <!--[if mso | IE]></td></tr></table></td></tr><tr><td class="" width="660px" ><table align="center" border="0" cellpadding="0" cellspacing="0" class="" role="presentation" style="width:620px;" width="620" bgcolor="#ffffff" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
+    
+      
+      <div style="background:#ffffff;background-color:#ffffff;margin:0px auto;max-width:620px;">
+        
+        <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="background:#ffffff;background-color:#ffffff;width:100%;">
+          <tbody>
+            <tr>
+              <td style="direction:ltr;font-size:0px;padding:10px 10px 10px 10px;text-align:center;">
+                <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td class="mj-bw-icon-row-outlook" style="width:600px;" ><![endif]-->
+            
+      <div class="mj-column-per-100 mj-outlook-group-fix mj-bw-icon-row" style="font-size:0;line-height:0;text-align:left;display:inline-block;width:100%;direction:ltr;">
+        <!--[if mso | IE]><table border="0" cellpadding="0" cellspacing="0" role="presentation" ><tr><td style="vertical-align:top;width:90px;" ><![endif]-->
+                
+      <div class="mj-column-per-15 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:15%;">
+        
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+        <tbody>
+          
+              <tr>
+                <td align="center" style="font-size:0px;padding:0px;word-break:break-word;">
+                  
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:collapse;border-spacing:0px;">
+        <tbody>
+          <tr>
+            <td style="width:48px;">
+              
+      <img alt="Organization Icon" src="https://assets.bitwarden.com/email/v1/icon-enterprise.png" style="border:0;border-radius:8px;display:block;outline:none;text-decoration:none;height:auto;width:100%;font-size:16px;" width="48" height="auto">
+    
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    
+                </td>
+              </tr>
+            
+        </tbody>
+      </table>
+    
+      </div>
+    
+              <!--[if mso | IE]></td><td style="vertical-align:top;width:510px;" ><![endif]-->
+                
+      <div class="mj-column-per-85 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:85%;">
+        
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+        <tbody>
+          
+              <tr>
+                <td align="left" class="mj-bw-icon-row-text" style="font-size:0px;padding:5px 10px 0px 10px;word-break:break-word;">
+                  
+      <div style="font-family:Roboto, 'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:16px;font-weight:400;line-height:24px;text-align:left;color:#1B2029;">Your account is owned by {{OrganizationName}} and is subject to their security and management policies.</div>
+    
+                </td>
+              </tr>
+            
+        </tbody>
+      </table>
+    
+      </div>
+    
+              <!--[if mso | IE]></td></tr></table><![endif]-->
+      </div>
+    
+          <!--[if mso | IE]></td></tr></table><![endif]-->
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        
+      </div>
+    
+      
+      <!--[if mso | IE]></td></tr></table></td></tr><tr><td class="" width="660px" ><table align="center" border="0" cellpadding="0" cellspacing="0" class="" role="presentation" style="width:620px;" width="620" bgcolor="#ffffff" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
+    
+      
+      <div style="background:#ffffff;background-color:#ffffff;margin:0px auto;max-width:620px;">
+        
+        <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="background:#ffffff;background-color:#ffffff;width:100%;">
+          <tbody>
+            <tr>
+              <td style="direction:ltr;font-size:0px;padding:10px 10px 10px 10px;text-align:center;">
+                <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td class="mj-bw-icon-row-outlook" style="width:600px;" ><![endif]-->
+            
+      <div class="mj-column-per-100 mj-outlook-group-fix mj-bw-icon-row" style="font-size:0;line-height:0;text-align:left;display:inline-block;width:100%;direction:ltr;">
+        <!--[if mso | IE]><table border="0" cellpadding="0" cellspacing="0" role="presentation" ><tr><td style="vertical-align:top;width:90px;" ><![endif]-->
+                
+      <div class="mj-column-per-15 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:15%;">
+        
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+        <tbody>
+          
+              <tr>
+                <td align="center" style="font-size:0px;padding:0px;word-break:break-word;">
+                  
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:collapse;border-spacing:0px;">
+        <tbody>
+          <tr>
+            <td style="width:48px;">
+              
+      <img alt="Group Users Icon" src="https://assets.bitwarden.com/email/v1/icon-account-switching-new.png" style="border:0;border-radius:8px;display:block;outline:none;text-decoration:none;height:auto;width:100%;font-size:16px;" width="48" height="auto">
+    
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    
+                </td>
+              </tr>
+            
+        </tbody>
+      </table>
+    
+      </div>
+    
+              <!--[if mso | IE]></td><td style="vertical-align:top;width:510px;" ><![endif]-->
+                
+      <div class="mj-column-per-85 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:85%;">
+        
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+        <tbody>
+          
+              <tr>
+                <td align="left" class="mj-bw-icon-row-text" style="font-size:0px;padding:5px 10px 0px 10px;word-break:break-word;">
+                  
+      <div style="font-family:Roboto, 'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:16px;font-weight:400;line-height:24px;text-align:left;color:#1B2029;">You can easily access and share passwords with your team.</div>
+    
+                </td>
+              </tr>
+            
+              <tr>
+                <td align="left" class="mj-bw-icon-row-text" style="font-size:0px;padding:5px 10px 0px 10px;word-break:break-word;">
+                  
+      <div style="font-family:Roboto, 'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:16px;font-weight:400;line-height:24px;text-align:left;color:#1B2029;"><a href="https://bitwarden.com/help/share-to-a-collection/" class="link" style="text-decoration: none; color: #175ddc; font-weight: 600;">
+                    Share passwords in Bitwarden
+                    <span style="text-decoration: none">
+                      <img src="https://assets.bitwarden.com/email/v1/bwi-external-link-16px.png" alt="External Link Icon" width="16px" style="vertical-align: middle;">
+                    </span>
+              </a></div>
+    
+                </td>
+              </tr>
+            
+        </tbody>
+      </table>
+    
+      </div>
+    
+              <!--[if mso | IE]></td></tr></table><![endif]-->
+      </div>
+    
+          <!--[if mso | IE]></td></tr></table><![endif]-->
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        
+      </div>
+    
+      
+      <!--[if mso | IE]></td></tr></table></td></tr><tr><td class="" width="660px" ><table align="center" border="0" cellpadding="0" cellspacing="0" class="" role="presentation" style="width:620px;" width="620" bgcolor="#ffffff" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
+    
+      
+      <div style="background:#ffffff;background-color:#ffffff;margin:0px auto;max-width:620px;">
+        
+        <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="background:#ffffff;background-color:#ffffff;width:100%;">
+          <tbody>
+            <tr>
+              <td style="direction:ltr;font-size:0px;padding:0 20px 20px 20px;text-align:center;">
+                <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr></tr></table><![endif]-->
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        
+      </div>
+    
+      
+      <!--[if mso | IE]></td></tr></table></td></tr></table><![endif]-->
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        
+      </div>
+    
+      
+      <!--[if mso | IE]></td></tr></table><![endif]-->
+    
+    <!-- Learn More Section -->
+      
+      <!--[if mso | IE]><table align="center" border="0" cellpadding="0" cellspacing="0" class="" role="presentation" style="width:660px;" width="660" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
+    
+      
+      <div style="margin:0px auto;max-width:660px;">
+        
+        <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+          <tbody>
+            <tr>
+              <td style="direction:ltr;font-size:0px;padding:5px 20px 10px 20px;text-align:center;">
+                <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td class="" width="660px" ><table align="center" border="0" cellpadding="0" cellspacing="0" class="" role="presentation" style="width:620px;" width="620" bgcolor="#f6f6f6" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
+    
+      
+      <div style="background:#f6f6f6;background-color:#f6f6f6;margin:0px auto;border-radius:0px 0px 4px 4px;max-width:620px;">
+        
+        <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="background:#f6f6f6;background-color:#f6f6f6;width:100%;border-radius:0px 0px 4px 4px;">
+          <tbody>
+            <tr>
+              <td style="direction:ltr;font-size:0px;padding:5px 10px 10px 10px;text-align:center;">
+                <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td class="" style="vertical-align:top;width:420px;" ><![endif]-->
+            
+      <div class="mj-column-per-70 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+        
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+        <tbody>
+          
+              <tr>
+                <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                  
+      <div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:16px;line-height:24px;text-align:left;color:#1B2029;"><p style="font-size: 18px; line-height: 28px; font-weight: bold;">
+              Learn more about Bitwarden
+            </p>
+            Find user guides, product documentation, and videos on the
+            <a href="https://bitwarden.com/help/" class="link" style="text-decoration: none; color: #175ddc; font-weight: 600;"> Bitwarden Help Center</a>.</div>
+    
+                </td>
+              </tr>
+            
+        </tbody>
+      </table>
+    
+      </div>
+    
+          <!--[if mso | IE]></td><td class="" style="vertical-align:top;width:180px;" ><![endif]-->
+            
+      <div class="mj-column-per-30 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+        
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+        <tbody>
+          
+              <tr>
+                <td align="center" class="mj-bw-learn-more-footer-responsive-img" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                  
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:collapse;border-spacing:0px;">
+        <tbody>
+          <tr>
+            <td style="width:94px;">
+              
+      <img alt src="https://assets.bitwarden.com/email/v1/spot-community.png" style="border:0;display:block;outline:none;text-decoration:none;height:auto;width:100%;font-size:16px;" width="94" height="auto">
+    
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    
+                </td>
+              </tr>
+            
+        </tbody>
+      </table>
+    
+      </div>
+    
+          <!--[if mso | IE]></td></tr></table><![endif]-->
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        
+      </div>
+    
+      
+      <!--[if mso | IE]></td></tr></table></td></tr></table><![endif]-->
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        
+      </div>
+    
+      
+      <!--[if mso | IE]></td></tr></table><![endif]-->
+    
+    <!-- Footer -->
+      
+      <!--[if mso | IE]><table align="center" border="0" cellpadding="0" cellspacing="0" class="" role="presentation" style="width:660px;" width="660" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
+    
+      
+      <div style="margin:0px auto;max-width:660px;">
+        
+        <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+          <tbody>
+            <tr>
+              <td style="direction:ltr;font-size:0px;padding:20px 0;text-align:center;">
+                <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td class="" style="vertical-align:top;width:660px;" ><![endif]-->
+            
+      <div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+        
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+        <tbody>
+          
+              <tr>
+                <td align="center" style="font-size:0px;padding:0;word-break:break-word;">
+                  
+      
+     <!--[if mso | IE]><table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" ><tr><td><![endif]-->
+              <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
+                <tbody>
+                  
+      <tr>
+        <td style="padding:10px;vertical-align:middle;">
+          <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:30px;">
+            <tbody>
+              <tr>
+                <td style="font-size:0;height:30px;vertical-align:middle;width:30px;">
+                  <a href="https://x.com/bitwarden" target="_blank">
+                    <img alt height="30" src="https://assets.bitwarden.com/email/v1/mail-x.png" style="border-radius:3px;display:block;" width="30">
+                  </a>
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </td>
+        
+      </tr>
+    
+                </tbody>
+              </table>
+            <!--[if mso | IE]></td><td><![endif]-->
+              <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
+                <tbody>
+                  
+      <tr>
+        <td style="padding:10px;vertical-align:middle;">
+          <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:30px;">
+            <tbody>
+              <tr>
+                <td style="font-size:0;height:30px;vertical-align:middle;width:30px;">
+                  <a href="https://www.reddit.com/r/Bitwarden/" target="_blank">
+                    <img alt height="30" src="https://assets.bitwarden.com/email/v1/mail-reddit.png" style="border-radius:3px;display:block;" width="30">
+                  </a>
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </td>
+        
+      </tr>
+    
+                </tbody>
+              </table>
+            <!--[if mso | IE]></td><td><![endif]-->
+              <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
+                <tbody>
+                  
+      <tr>
+        <td style="padding:10px;vertical-align:middle;">
+          <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:30px;">
+            <tbody>
+              <tr>
+                <td style="font-size:0;height:30px;vertical-align:middle;width:30px;">
+                  <a href="https://community.bitwarden.com/" target="_blank">
+                    <img alt height="30" src="https://assets.bitwarden.com/email/v1/mail-discourse.png" style="border-radius:3px;display:block;" width="30">
+                  </a>
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </td>
+        
+      </tr>
+    
+                </tbody>
+              </table>
+            <!--[if mso | IE]></td><td><![endif]-->
+              <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
+                <tbody>
+                  
+      <tr>
+        <td style="padding:10px;vertical-align:middle;">
+          <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:30px;">
+            <tbody>
+              <tr>
+                <td style="font-size:0;height:30px;vertical-align:middle;width:30px;">
+                  <a href="https://github.com/bitwarden" target="_blank">
+                    <img alt height="30" src="https://assets.bitwarden.com/email/v1/mail-github.png" style="border-radius:3px;display:block;" width="30">
+                  </a>
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </td>
+        
+      </tr>
+    
+                </tbody>
+              </table>
+            <!--[if mso | IE]></td><td><![endif]-->
+              <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
+                <tbody>
+                  
+      <tr>
+        <td style="padding:10px;vertical-align:middle;">
+          <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:30px;">
+            <tbody>
+              <tr>
+                <td style="font-size:0;height:30px;vertical-align:middle;width:30px;">
+                  <a href="https://www.youtube.com/channel/UCId9a_jQqvJre0_dE2lE_Rw" target="_blank">
+                    <img alt height="30" src="https://assets.bitwarden.com/email/v1/mail-youtube.png" style="border-radius:3px;display:block;" width="30">
+                  </a>
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </td>
+        
+      </tr>
+    
+                </tbody>
+              </table>
+            <!--[if mso | IE]></td><td><![endif]-->
+              <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
+                <tbody>
+                  
+      <tr>
+        <td style="padding:10px;vertical-align:middle;">
+          <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:30px;">
+            <tbody>
+              <tr>
+                <td style="font-size:0;height:30px;vertical-align:middle;width:30px;">
+                  <a href="https://www.linkedin.com/company/bitwarden1/" target="_blank">
+                    <img alt height="30" src="https://assets.bitwarden.com/email/v1/mail-linkedin.png" style="border-radius:3px;display:block;" width="30">
+                  </a>
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </td>
+        
+      </tr>
+    
+                </tbody>
+              </table>
+            <!--[if mso | IE]></td><td><![endif]-->
+              <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
+                <tbody>
+                  
+      <tr>
+        <td style="padding:10px;vertical-align:middle;">
+          <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:30px;">
+            <tbody>
+              <tr>
+                <td style="font-size:0;height:30px;vertical-align:middle;width:30px;">
+                  <a href="https://www.facebook.com/bitwarden/" target="_blank">
+                    <img alt height="30" src="https://assets.bitwarden.com/email/v1/mail-facebook.png" style="border-radius:3px;display:block;" width="30">
+                  </a>
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </td>
+        
+      </tr>
+    
+                </tbody>
+              </table>
+            <!--[if mso | IE]></td></tr></table><![endif]-->
+    
+    
+                </td>
+              </tr>
+            
+              <tr>
+                <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                  
+      <div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:12px;line-height:16px;text-align:center;color:#5A6D91;"><p style="margin-bottom: 5px">
+        © 2025 Bitwarden Inc. 1 N. Calle Cesar Chavez, Suite 102, Santa
+        Barbara, CA, USA
+      </p>
+      <p style="margin-top: 5px">
+        Always confirm you are on a trusted Bitwarden domain before logging
+        in:<br>
+        <a href="https://bitwarden.com/">bitwarden.com</a> |
+        <a href="https://bitwarden.com/help/emails-from-bitwarden/">Learn why we include this</a>
+      </p></div>
+    
+                </td>
+              </tr>
+            
+        </tbody>
+      </table>
+    
+      </div>
+    
+          <!--[if mso | IE]></td></tr></table><![endif]-->
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        
+      </div>
+    
+      
+      <!--[if mso | IE]></td></tr></table><![endif]-->
+    
+    
+      </div>
+    
+  </body>
+</html>
+  

src/Core/MailTemplates/Handlebars/MJML/AdminConsole/OrganizationConfirmation/organization-confirmation-enterprise-teams.text.hbs

@@ -0,0 +1,4 @@
+{{#>TitleContactUsTextLayout}}
+    You may now access logins and other items {{OrganizationName}} has shared with you from your Bitwarden vault.
+    Tip: Use the Bitwarden mobile app to quickly save logins and auto-fill forms. Download from the App Store or Google Play.
+{{/TitleContactUsTextLayout}}

src/Core/MailTemplates/Handlebars/MJML/AdminConsole/OrganizationConfirmation/organization-confirmation-family-free.html.hbs

@@ -0,0 +1,983 @@
+<!doctype html>
+<html lang="und" dir="auto" xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office">
+  <head>
+    <title></title>
+    <!--[if !mso]><!-->
+    <meta http-equiv="X-UA-Compatible" content="IE=edge">
+    <!--<![endif]-->
+    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <style type="text/css">
+      #outlook a { padding:0; }
+      body { margin:0;padding:0;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%; }
+      table, td { border-collapse:collapse;mso-table-lspace:0pt;mso-table-rspace:0pt; }
+      img { border:0;height:auto;line-height:100%; outline:none;text-decoration:none;-ms-interpolation-mode:bicubic; }
+      p { display:block;margin:13px 0; }
+    </style>
+    <!--[if mso]>
+    <noscript>
+    <xml>
+    <o:OfficeDocumentSettings>
+      <o:AllowPNG/>
+      <o:PixelsPerInch>96</o:PixelsPerInch>
+    </o:OfficeDocumentSettings>
+    </xml>
+    </noscript>
+    <![endif]-->
+    <!--[if lte mso 11]>
+    <style type="text/css">
+      .mj-outlook-group-fix { width:100% !important; }
+    </style>
+    <![endif]-->
+    
+      <!--[if !mso]><!-->
+        <link href="https://fonts.googleapis.com/css?family=Roboto:300,400,500,700" rel="stylesheet" type="text/css">
+        <style type="text/css">
+          @import url(https://fonts.googleapis.com/css?family=Roboto:300,400,500,700);
+        </style>
+      <!--<![endif]-->
+
+    
+    
+    <style type="text/css">
+      @media only screen and (min-width:480px) {
+        .mj-column-per-70 { width:70% !important; max-width: 70%; }
+.mj-column-per-30 { width:30% !important; max-width: 30%; }
+.mj-column-per-100 { width:100% !important; max-width: 100%; }
+.mj-column-per-15 { width:15% !important; max-width: 15%; }
+.mj-column-per-85 { width:85% !important; max-width: 85%; }
+.mj-column-px-120 { width:120px !important; max-width: 120px; }
+.mj-column-px-150 { width:150px !important; max-width: 150px; }
+      }
+    </style>
+    <style media="screen and (min-width:480px)">
+      .moz-text-html .mj-column-per-70 { width:70% !important; max-width: 70%; }
+.moz-text-html .mj-column-per-30 { width:30% !important; max-width: 30%; }
+.moz-text-html .mj-column-per-100 { width:100% !important; max-width: 100%; }
+.moz-text-html .mj-column-per-15 { width:15% !important; max-width: 15%; }
+.moz-text-html .mj-column-per-85 { width:85% !important; max-width: 85%; }
+.moz-text-html .mj-column-px-120 { width:120px !important; max-width: 120px; }
+.moz-text-html .mj-column-px-150 { width:150px !important; max-width: 150px; }
+    </style>
+    
+    
+  
+    
+    <style type="text/css">
+
+      @media only screen and (max-width:480px) {
+        .mj-bw-hero-responsive-img {
+          display: none !important;
+        }
+      }
+    
+
+      @media only screen and (max-width:480px) {
+        .mj-bw-learn-more-footer-responsive-img {
+          display: none !important;
+        }
+      }
+    
+
+    @media only screen and (max-width:479px) {
+      table.mj-full-width-mobile { width: 100% !important; }
+      td.mj-full-width-mobile { width: auto !important; }
+    }
+  
+
+      @media only screen and (max-width:480px) {
+        .mj-bw-icon-row-text {
+          padding-left: 5px !important;
+          line-height: 20px;
+        }
+        .mj-bw-icon-row {
+          padding: 10px 15px;
+          width: fit-content !important;
+        }
+      }
+    
+    </style>
+     
+    <style type="text/css">
+.border-fix > table {
+    border-collapse: separate !important;
+  }
+  .border-fix > table > tbody > tr > td {
+    border-radius: 3px;
+  }
+    </style>
+    
+  </head>
+  <body style="word-spacing:normal;background-color:#e6e9ef;">
+    
+    
+      <div class="border-fix" style="background-color:#e6e9ef;" lang="und" dir="auto">
+        <!-- Blue Header Section -->
+      
+      <!--[if mso | IE]><table align="center" border="0" cellpadding="0" cellspacing="0" class="border-fix-outlook" role="presentation" style="width:660px;" width="660" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
+    
+      
+      <div class="border-fix" style="margin:0px auto;max-width:660px;">
+        
+        <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+          <tbody>
+            <tr>
+              <td style="direction:ltr;font-size:0px;padding:20px 20px 10px 20px;text-align:center;">
+                <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td class="" width="660px" ><![endif]-->
+            
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="background:#175ddc;background-color:#175ddc;width:100%;border-radius:4px 4px 0px 0px;">
+        <tbody>
+          <tr>
+            <td>
+              
+        
+      <!--[if mso | IE]><table align="center" border="0" cellpadding="0" cellspacing="0" class="" role="presentation" style="width:620px;" width="620" bgcolor="#175ddc" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
+    
+        
+      <div style="margin:0px auto;border-radius:4px 4px 0px 0px;max-width:620px;">
+        
+        <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;border-radius:4px 4px 0px 0px;">
+          <tbody>
+            <tr>
+              <td style="direction:ltr;font-size:0px;padding:20px 0;text-align:center;">
+                <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td class="" style="vertical-align:top;width:434px;" ><![endif]-->
+            
+      <div class="mj-column-per-70 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+        
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+        <tbody>
+          
+              <tr>
+                <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                  
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:collapse;border-spacing:0px;">
+        <tbody>
+          <tr>
+            <td style="width:150px;">
+              
+      <img alt src="https://bitwarden.com/images/logo-horizontal-white.png" style="border:0;display:block;outline:none;text-decoration:none;height:30px;width:100%;font-size:16px;" width="150" height="30">
+    
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    
+                </td>
+              </tr>
+            
+              <tr>
+                <td align="left" style="font-size:0px;padding:10px 25px;padding-top:0;padding-bottom:0;word-break:break-word;">
+                  
+      <div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:16px;line-height:1;text-align:left;color:#ffffff;"><h1 style="font-weight: normal; font-size: 24px; line-height: 32px">
+              You can now share passwords with members of {{OrganizationName}}!
+            </h1></div>
+    
+                </td>
+              </tr>
+            
+              <tr>
+                <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                  
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:separate;line-height:100%;">
+        <tbody>
+          <tr>
+            <td align="center" bgcolor="#ffffff" role="presentation" style="border:none;border-radius:20px;cursor:auto;mso-padding-alt:10px 25px;background:#ffffff;" valign="middle">
+              <a href="https://vault.bitwarden.com" style="display:inline-block;background:#ffffff;color:#1A41AC;font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:16px;font-weight:normal;line-height:120%;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:20px;" target="_blank">
+                Log in
+              </a>
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    
+                </td>
+              </tr>
+            
+        </tbody>
+      </table>
+    
+      </div>
+    
+          <!--[if mso | IE]></td><td class="" style="vertical-align:bottom;width:186px;" ><![endif]-->
+            
+      <div class="mj-column-per-30 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:bottom;width:100%;">
+        
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:bottom;" width="100%">
+        <tbody>
+          
+              <tr>
+                <td align="center" class="mj-bw-hero-responsive-img" style="font-size:0px;padding:0px;word-break:break-word;">
+                  
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:collapse;border-spacing:0px;">
+        <tbody>
+          <tr>
+            <td style="width:155px;">
+              
+      <img alt src="https://assets.bitwarden.com/email/v1/spot-family-homes.png" style="border:0;display:block;outline:none;text-decoration:none;height:auto;width:100%;font-size:16px;" width="155" height="auto">
+    
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    
+                </td>
+              </tr>
+            
+        </tbody>
+      </table>
+    
+      </div>
+    
+          <!--[if mso | IE]></td></tr></table><![endif]-->
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        
+      </div>
+    
+        
+      <!--[if mso | IE]></td></tr></table><![endif]-->
+    
+      
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    
+          <!--[if mso | IE]></td></tr></table><![endif]-->
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        
+      </div>
+    
+      
+      <!--[if mso | IE]></td></tr></table><![endif]-->
+    
+    <!-- Main Content -->
+      
+      <!--[if mso | IE]><table align="center" border="0" cellpadding="0" cellspacing="0" class="" role="presentation" style="width:660px;" width="660" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
+    
+      
+      <div style="margin:0px auto;max-width:660px;">
+        
+        <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+          <tbody>
+            <tr>
+              <td style="direction:ltr;font-size:0px;padding:5px 20px 10px 20px;text-align:center;">
+                <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td class="" width="660px" ><table align="center" border="0" cellpadding="0" cellspacing="0" class="" role="presentation" style="width:620px;" width="620" bgcolor="#ffffff" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
+    
+      
+      <div style="background:#ffffff;background-color:#ffffff;margin:0px auto;max-width:620px;">
+        
+        <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="background:#ffffff;background-color:#ffffff;width:100%;">
+          <tbody>
+            <tr>
+              <td style="direction:ltr;font-size:0px;padding:15px 10px 10px 10px;text-align:center;">
+                <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td class="" style="vertical-align:top;width:600px;" ><![endif]-->
+            
+      <div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+        
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+        <tbody>
+          
+              <tr>
+                <td align="left" style="font-size:0px;padding:10px 15px;word-break:break-word;">
+                  
+      <div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:16px;line-height:24px;text-align:left;color:#1B2029;">As a member of <b>{{OrganizationName}}</b>:</div>
+    
+                </td>
+              </tr>
+            
+        </tbody>
+      </table>
+    
+      </div>
+    
+          <!--[if mso | IE]></td></tr></table><![endif]-->
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        
+      </div>
+    
+      
+      <!--[if mso | IE]></td></tr></table></td></tr><tr><td class="" width="660px" ><table align="center" border="0" cellpadding="0" cellspacing="0" class="" role="presentation" style="width:620px;" width="620" bgcolor="#ffffff" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
+    
+      
+      <div style="background:#ffffff;background-color:#ffffff;margin:0px auto;max-width:620px;">
+        
+        <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="background:#ffffff;background-color:#ffffff;width:100%;">
+          <tbody>
+            <tr>
+              <td style="direction:ltr;font-size:0px;padding:10px 10px 10px 10px;text-align:center;">
+                <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td class="mj-bw-icon-row-outlook" style="width:600px;" ><![endif]-->
+            
+      <div class="mj-column-per-100 mj-outlook-group-fix mj-bw-icon-row" style="font-size:0;line-height:0;text-align:left;display:inline-block;width:100%;direction:ltr;">
+        <!--[if mso | IE]><table border="0" cellpadding="0" cellspacing="0" role="presentation" ><tr><td style="vertical-align:top;width:90px;" ><![endif]-->
+                
+      <div class="mj-column-per-15 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:15%;">
+        
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+        <tbody>
+          
+              <tr>
+                <td align="center" style="font-size:0px;padding:0px;word-break:break-word;">
+                  
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:collapse;border-spacing:0px;">
+        <tbody>
+          <tr>
+            <td style="width:48px;">
+              
+      <img alt="Collections Icon" src="https://assets.bitwarden.com/email/v1/icon-item-type.png" style="border:0;border-radius:8px;display:block;outline:none;text-decoration:none;height:auto;width:100%;font-size:16px;" width="48" height="auto">
+    
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    
+                </td>
+              </tr>
+            
+        </tbody>
+      </table>
+    
+      </div>
+    
+              <!--[if mso | IE]></td><td style="vertical-align:top;width:510px;" ><![endif]-->
+                
+      <div class="mj-column-per-85 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:85%;">
+        
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+        <tbody>
+          
+              <tr>
+                <td align="left" class="mj-bw-icon-row-text" style="font-size:0px;padding:5px 10px 0px 10px;word-break:break-word;">
+                  
+      <div style="font-family:Roboto, 'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:16px;font-weight:400;line-height:24px;text-align:left;color:#1B2029;">You can access passwords {{OrganizationName}} has shared with you.</div>
+    
+                </td>
+              </tr>
+            
+        </tbody>
+      </table>
+    
+      </div>
+    
+              <!--[if mso | IE]></td></tr></table><![endif]-->
+      </div>
+    
+          <!--[if mso | IE]></td></tr></table><![endif]-->
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        
+      </div>
+    
+      
+      <!--[if mso | IE]></td></tr></table></td></tr><tr><td class="" width="660px" ><table align="center" border="0" cellpadding="0" cellspacing="0" class="" role="presentation" style="width:620px;" width="620" bgcolor="#ffffff" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
+    
+      
+      <div style="background:#ffffff;background-color:#ffffff;margin:0px auto;max-width:620px;">
+        
+        <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="background:#ffffff;background-color:#ffffff;width:100%;">
+          <tbody>
+            <tr>
+              <td style="direction:ltr;font-size:0px;padding:10px 10px 10px 10px;text-align:center;">
+                <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td class="mj-bw-icon-row-outlook" style="width:600px;" ><![endif]-->
+            
+      <div class="mj-column-per-100 mj-outlook-group-fix mj-bw-icon-row" style="font-size:0;line-height:0;text-align:left;display:inline-block;width:100%;direction:ltr;">
+        <!--[if mso | IE]><table border="0" cellpadding="0" cellspacing="0" role="presentation" ><tr><td style="vertical-align:top;width:90px;" ><![endif]-->
+                
+      <div class="mj-column-per-15 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:15%;">
+        
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+        <tbody>
+          
+              <tr>
+                <td align="center" style="font-size:0px;padding:0px;word-break:break-word;">
+                  
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:collapse;border-spacing:0px;">
+        <tbody>
+          <tr>
+            <td style="width:48px;">
+              
+      <img alt="Group Users Icon" src="https://assets.bitwarden.com/email/v1/icon-account-switching-new.png" style="border:0;border-radius:8px;display:block;outline:none;text-decoration:none;height:auto;width:100%;font-size:16px;" width="48" height="auto">
+    
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    
+                </td>
+              </tr>
+            
+        </tbody>
+      </table>
+    
+      </div>
+    
+              <!--[if mso | IE]></td><td style="vertical-align:top;width:510px;" ><![endif]-->
+                
+      <div class="mj-column-per-85 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:85%;">
+        
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+        <tbody>
+          
+              <tr>
+                <td align="left" class="mj-bw-icon-row-text" style="font-size:0px;padding:5px 10px 0px 10px;word-break:break-word;">
+                  
+      <div style="font-family:Roboto, 'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:16px;font-weight:400;line-height:24px;text-align:left;color:#1B2029;">You can easily share passwords with friends, family, or coworkers.</div>
+    
+                </td>
+              </tr>
+            
+              <tr>
+                <td align="left" class="mj-bw-icon-row-text" style="font-size:0px;padding:5px 10px 0px 10px;word-break:break-word;">
+                  
+      <div style="font-family:Roboto, 'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:16px;font-weight:400;line-height:24px;text-align:left;color:#1B2029;"><a href="https://bitwarden.com/help/share-to-a-collection/" class="link" style="text-decoration: none; color: #175ddc; font-weight: 600;">
+                    Share passwords in Bitwarden
+                    <span style="text-decoration: none">
+                      <img src="https://assets.bitwarden.com/email/v1/bwi-external-link-16px.png" alt="External Link Icon" width="16px" style="vertical-align: middle;">
+                    </span>
+              </a></div>
+    
+                </td>
+              </tr>
+            
+        </tbody>
+      </table>
+    
+      </div>
+    
+              <!--[if mso | IE]></td></tr></table><![endif]-->
+      </div>
+    
+          <!--[if mso | IE]></td></tr></table><![endif]-->
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        
+      </div>
+    
+      
+      <!--[if mso | IE]></td></tr></table></td></tr><tr><td class="" width="660px" ><table align="center" border="0" cellpadding="0" cellspacing="0" class="" role="presentation" style="width:620px;" width="620" bgcolor="#ffffff" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
+    
+      
+      <div style="background:#ffffff;background-color:#ffffff;margin:0px auto;max-width:620px;">
+        
+        <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="background:#ffffff;background-color:#ffffff;width:100%;">
+          <tbody>
+            <tr>
+              <td style="direction:ltr;font-size:0px;padding:0 20px 20px 20px;text-align:center;">
+                <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr></tr></table><![endif]-->
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        
+      </div>
+    
+      
+      <!--[if mso | IE]></td></tr></table></td></tr></table><![endif]-->
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        
+      </div>
+    
+      
+      <!--[if mso | IE]></td></tr></table><![endif]-->
+    
+    <!-- Download Mobile Apps Section -->
+      
+      <!--[if mso | IE]><table align="center" border="0" cellpadding="0" cellspacing="0" class="" role="presentation" style="width:660px;" width="660" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
+    
+      
+      <div style="margin:0px auto;max-width:660px;">
+        
+        <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+          <tbody>
+            <tr>
+              <td style="direction:ltr;font-size:0px;padding:5px 20px 10px 20px;text-align:center;">
+                <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td class="" width="660px" ><table align="center" border="0" cellpadding="0" cellspacing="0" class="" role="presentation" style="width:620px;" width="620" bgcolor="#ffffff" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
+    
+      
+      <div style="background:#ffffff;background-color:#ffffff;margin:0px auto;max-width:620px;">
+        
+        <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="background:#ffffff;background-color:#ffffff;width:100%;">
+          <tbody>
+            <tr>
+              <td style="direction:ltr;font-size:0px;padding:30px 30px 10px 30px;text-align:center;">
+                <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td class="" style="vertical-align:top;width:560px;" ><![endif]-->
+            
+      <div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+        
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+        <tbody>
+          
+              <tr>
+                <td align="left" style="font-size:0px;padding:0 0 15px 0;word-break:break-word;">
+                  
+      <div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:18px;font-weight:700;line-height:32px;text-align:left;color:#1B2029;">Download Bitwarden on all devices</div>
+    
+                </td>
+              </tr>
+            
+              <tr>
+                <td align="left" style="font-size:0px;padding:0 0 20px 0;word-break:break-word;">
+                  
+      <div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:15px;line-height:16px;text-align:left;color:#1B2029;">Already using the <a href="https://bitwarden.com/download/" class="link" style="text-decoration: none; color: #175ddc; font-weight: 600;">browser extension</a>?
+            Download the Bitwarden mobile app from the
+            <a href="https://apps.apple.com/us/app/bitwarden-password-manager/id1137397744" class="link" style="text-decoration: none; color: #175ddc; font-weight: 600;">App Store</a>
+            or <a href="https://play.google.com/store/apps/details?id=com.x8bit.bitwarden" class="link" style="text-decoration: none; color: #175ddc; font-weight: 600;">Google Play</a>
+            to quickly save logins and autofill forms on the go.</div>
+    
+                </td>
+              </tr>
+            
+        </tbody>
+      </table>
+    
+      </div>
+    
+          <!--[if mso | IE]></td></tr></table><![endif]-->
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        
+      </div>
+    
+      
+      <!--[if mso | IE]></td></tr></table></td></tr><tr><td class="" width="660px" ><table align="center" border="0" cellpadding="0" cellspacing="0" class="" role="presentation" style="width:620px;" width="620" bgcolor="#ffffff" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
+    
+      
+      <div style="background:#ffffff;background-color:#ffffff;margin:0px auto;max-width:620px;">
+        
+        <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="background:#ffffff;background-color:#ffffff;width:100%;">
+          <tbody>
+            <tr>
+              <td style="direction:ltr;font-size:0px;padding:0 30px 20px 30px;text-align:center;">
+                <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td class="" style="width:560px;" ><![endif]-->
+            
+      <div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0;line-height:0;text-align:left;display:inline-block;width:100%;direction:ltr;">
+        <!--[if mso | IE]><table border="0" cellpadding="0" cellspacing="0" role="presentation" ><tr><td style="vertical-align:middle;width:120px;" ><![endif]-->
+                
+      <div class="mj-column-px-120 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:middle;width:21.428571428571427%;">
+        
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:middle;" width="100%">
+        <tbody>
+          
+              <tr>
+                <td align="center" style="font-size:0px;padding:0;word-break:break-word;">
+                  
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:collapse;border-spacing:0px;">
+        <tbody>
+          <tr>
+            <td style="width:120px;">
+              
+        <a href="https://apps.apple.com/us/app/bitwarden-password-manager/id1137397744" target="_blank">
+          
+      <img alt="Download on the App Store" src="https://assets.bitwarden.com/email/v1/App-store.png" style="border:0;display:block;outline:none;text-decoration:none;height:auto;width:100%;font-size:16px;" width="120" height="auto">
+    
+        </a>
+      
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    
+                </td>
+              </tr>
+            
+        </tbody>
+      </table>
+    
+      </div>
+    
+              <!--[if mso | IE]></td><td style="vertical-align:middle;width:150px;" ><![endif]-->
+                
+      <div class="mj-column-px-150 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:middle;width:26.785714285714285%;">
+        
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:middle;" width="100%">
+        <tbody>
+          
+              <tr>
+                <td align="center" style="font-size:0px;padding:0 0 0 10px;word-break:break-word;">
+                  
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:collapse;border-spacing:0px;">
+        <tbody>
+          <tr>
+            <td style="width:140px;">
+              
+        <a href="https://play.google.com/store/apps/details?id=com.x8bit.bitwarden" target="_blank">
+          
+      <img alt="Get it on Google Play" src="https://assets.bitwarden.com/email/v1/google-play-badge.png" style="border:0;display:block;outline:none;text-decoration:none;height:auto;width:100%;font-size:16px;" width="140" height="auto">
+    
+        </a>
+      
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    
+                </td>
+              </tr>
+            
+        </tbody>
+      </table>
+    
+      </div>
+    
+              <!--[if mso | IE]></td></tr></table><![endif]-->
+      </div>
+    
+          <!--[if mso | IE]></td></tr></table><![endif]-->
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        
+      </div>
+    
+      
+      <!--[if mso | IE]></td></tr></table></td></tr></table><![endif]-->
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        
+      </div>
+    
+      
+      <!--[if mso | IE]></td></tr></table><![endif]-->
+    
+    <!-- Learn More Section -->
+      
+      <!--[if mso | IE]><table align="center" border="0" cellpadding="0" cellspacing="0" class="" role="presentation" style="width:660px;" width="660" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
+    
+      
+      <div style="margin:0px auto;max-width:660px;">
+        
+        <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+          <tbody>
+            <tr>
+              <td style="direction:ltr;font-size:0px;padding:5px 20px 10px 20px;text-align:center;">
+                <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td class="" width="660px" ><table align="center" border="0" cellpadding="0" cellspacing="0" class="" role="presentation" style="width:620px;" width="620" bgcolor="#f6f6f6" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
+    
+      
+      <div style="background:#f6f6f6;background-color:#f6f6f6;margin:0px auto;border-radius:0px 0px 4px 4px;max-width:620px;">
+        
+        <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="background:#f6f6f6;background-color:#f6f6f6;width:100%;border-radius:0px 0px 4px 4px;">
+          <tbody>
+            <tr>
+              <td style="direction:ltr;font-size:0px;padding:5px 10px 10px 10px;text-align:center;">
+                <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td class="" style="vertical-align:top;width:420px;" ><![endif]-->
+            
+      <div class="mj-column-per-70 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+        
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+        <tbody>
+          
+              <tr>
+                <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                  
+      <div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:16px;line-height:24px;text-align:left;color:#1B2029;"><p style="font-size: 18px; line-height: 28px; font-weight: bold;">
+              Learn more about Bitwarden
+            </p>
+            Find user guides, product documentation, and videos on the
+            <a href="https://bitwarden.com/help/" class="link" style="text-decoration: none; color: #175ddc; font-weight: 600;"> Bitwarden Help Center</a>.</div>
+    
+                </td>
+              </tr>
+            
+        </tbody>
+      </table>
+    
+      </div>
+    
+          <!--[if mso | IE]></td><td class="" style="vertical-align:top;width:180px;" ><![endif]-->
+            
+      <div class="mj-column-per-30 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+        
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+        <tbody>
+          
+              <tr>
+                <td align="center" class="mj-bw-learn-more-footer-responsive-img" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                  
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:collapse;border-spacing:0px;">
+        <tbody>
+          <tr>
+            <td style="width:94px;">
+              
+      <img alt src="https://assets.bitwarden.com/email/v1/spot-community.png" style="border:0;display:block;outline:none;text-decoration:none;height:auto;width:100%;font-size:16px;" width="94" height="auto">
+    
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    
+                </td>
+              </tr>
+            
+        </tbody>
+      </table>
+    
+      </div>
+    
+          <!--[if mso | IE]></td></tr></table><![endif]-->
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        
+      </div>
+    
+      
+      <!--[if mso | IE]></td></tr></table></td></tr></table><![endif]-->
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        
+      </div>
+    
+      
+      <!--[if mso | IE]></td></tr></table><![endif]-->
+    
+    <!-- Footer -->
+      
+      <!--[if mso | IE]><table align="center" border="0" cellpadding="0" cellspacing="0" class="" role="presentation" style="width:660px;" width="660" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
+    
+      
+      <div style="margin:0px auto;max-width:660px;">
+        
+        <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+          <tbody>
+            <tr>
+              <td style="direction:ltr;font-size:0px;padding:20px 0;text-align:center;">
+                <!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td class="" style="vertical-align:top;width:660px;" ><![endif]-->
+            
+      <div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+        
+      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+        <tbody>
+          
+              <tr>
+                <td align="center" style="font-size:0px;padding:0;word-break:break-word;">
+                  
+      
+     <!--[if mso | IE]><table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" ><tr><td><![endif]-->
+              <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
+                <tbody>
+                  
+      <tr>
+        <td style="padding:10px;vertical-align:middle;">
+          <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:30px;">
+            <tbody>
+              <tr>
+                <td style="font-size:0;height:30px;vertical-align:middle;width:30px;">
+                  <a href="https://x.com/bitwarden" target="_blank">
+                    <img alt height="30" src="https://assets.bitwarden.com/email/v1/mail-x.png" style="border-radius:3px;display:block;" width="30">
+                  </a>
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </td>
+        
+      </tr>
+    
+                </tbody>
+              </table>
+            <!--[if mso | IE]></td><td><![endif]-->
+              <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
+                <tbody>
+                  
+      <tr>
+        <td style="padding:10px;vertical-align:middle;">
+          <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:30px;">
+            <tbody>
+              <tr>
+                <td style="font-size:0;height:30px;vertical-align:middle;width:30px;">
+                  <a href="https://www.reddit.com/r/Bitwarden/" target="_blank">
+                    <img alt height="30" src="https://assets.bitwarden.com/email/v1/mail-reddit.png" style="border-radius:3px;display:block;" width="30">
+                  </a>
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </td>
+        
+      </tr>
+    
+                </tbody>
+              </table>
+            <!--[if mso | IE]></td><td><![endif]-->
+              <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
+                <tbody>
+                  
+      <tr>
+        <td style="padding:10px;vertical-align:middle;">
+          <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:30px;">
+            <tbody>
+              <tr>
+                <td style="font-size:0;height:30px;vertical-align:middle;width:30px;">
+                  <a href="https://community.bitwarden.com/" target="_blank">
+                    <img alt height="30" src="https://assets.bitwarden.com/email/v1/mail-discourse.png" style="border-radius:3px;display:block;" width="30">
+                  </a>
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </td>
+        
+      </tr>
+    
+                </tbody>
+              </table>
+            <!--[if mso | IE]></td><td><![endif]-->
+              <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
+                <tbody>
+                  
+      <tr>
+        <td style="padding:10px;vertical-align:middle;">
+          <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:30px;">
+            <tbody>
+              <tr>
+                <td style="font-size:0;height:30px;vertical-align:middle;width:30px;">
+                  <a href="https://github.com/bitwarden" target="_blank">
+                    <img alt height="30" src="https://assets.bitwarden.com/email/v1/mail-github.png" style="border-radius:3px;display:block;" width="30">
+                  </a>
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </td>
+        
+      </tr>
+    
+                </tbody>
+              </table>
+            <!--[if mso | IE]></td><td><![endif]-->
+              <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
+                <tbody>
+                  
+      <tr>
+        <td style="padding:10px;vertical-align:middle;">
+          <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:30px;">
+            <tbody>
+              <tr>
+                <td style="font-size:0;height:30px;vertical-align:middle;width:30px;">
+                  <a href="https://www.youtube.com/channel/UCId9a_jQqvJre0_dE2lE_Rw" target="_blank">
+                    <img alt height="30" src="https://assets.bitwarden.com/email/v1/mail-youtube.png" style="border-radius:3px;display:block;" width="30">
+                  </a>
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </td>
+        
+      </tr>
+    
+                </tbody>
+              </table>
+            <!--[if mso | IE]></td><td><![endif]-->
+              <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
+                <tbody>
+                  
+      <tr>
+        <td style="padding:10px;vertical-align:middle;">
+          <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:30px;">
+            <tbody>
+              <tr>
+                <td style="font-size:0;height:30px;vertical-align:middle;width:30px;">
+                  <a href="https://www.linkedin.com/company/bitwarden1/" target="_blank">
+                    <img alt height="30" src="https://assets.bitwarden.com/email/v1/mail-linkedin.png" style="border-radius:3px;display:block;" width="30">
+                  </a>
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </td>
+        
+      </tr>
+    
+                </tbody>
+              </table>
+            <!--[if mso | IE]></td><td><![endif]-->
+              <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
+                <tbody>
+                  
+      <tr>
+        <td style="padding:10px;vertical-align:middle;">
+          <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:30px;">
+            <tbody>
+              <tr>
+                <td style="font-size:0;height:30px;vertical-align:middle;width:30px;">
+                  <a href="https://www.facebook.com/bitwarden/" target="_blank">
+                    <img alt height="30" src="https://assets.bitwarden.com/email/v1/mail-facebook.png" style="border-radius:3px;display:block;" width="30">
+                  </a>
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </td>
+        
+      </tr>
+    
+                </tbody>
+              </table>
+            <!--[if mso | IE]></td></tr></table><![endif]-->
+    
+    
+                </td>
+              </tr>
+            
+              <tr>
+                <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                  
+      <div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:12px;line-height:16px;text-align:center;color:#5A6D91;"><p style="margin-bottom: 5px">
+        © 2025 Bitwarden Inc. 1 N. Calle Cesar Chavez, Suite 102, Santa
+        Barbara, CA, USA
+      </p>
+      <p style="margin-top: 5px">
+        Always confirm you are on a trusted Bitwarden domain before logging
+        in:<br>
+        <a href="https://bitwarden.com/">bitwarden.com</a> |
+        <a href="https://bitwarden.com/help/emails-from-bitwarden/">Learn why we include this</a>
+      </p></div>
+    
+                </td>
+              </tr>
+            
+        </tbody>
+      </table>
+    
+      </div>
+    
+          <!--[if mso | IE]></td></tr></table><![endif]-->
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        
+      </div>
+    
+      
+      <!--[if mso | IE]></td></tr></table><![endif]-->
+    
+    
+      </div>
+    
+  </body>
+</html>
+  

src/Core/MailTemplates/Handlebars/MJML/AdminConsole/OrganizationConfirmation/organization-confirmation-family-free.text.hbs

@@ -0,0 +1,4 @@
+{{#>TitleContactUsTextLayout}}
+    You may now access logins and other items {{OrganizationName}} has shared with you from your Bitwarden vault.
+    Tip: Use the Bitwarden mobile app to quickly save logins and auto-fill forms. Download from the App Store or Google Play.
+{{/TitleContactUsTextLayout}}

src/Core/MailTemplates/Mjml/components/mj-bw-icon-row.js

@@ -1,4 +1,12 @@
 const { BodyComponent } = require("mjml-core");
+
+const BODY_TEXT_STYLES = `
+  font-family="Roboto, 'Helvetica Neue', Helvetica, Arial, sans-serif"
+  font-size="16px"
+  font-weight="400"
+  line-height="24px"
+`;
+
 class MjBwIconRow extends BodyComponent {
   static dependencies = {
     "mj-column": ["mj-bw-icon-row"],
@@ -18,7 +26,7 @@ class MjBwIconRow extends BodyComponent {
 
   static defaultAttributes = {};
 
-  headStyle = (breakpoint) => {
+   headStyle = (breakpoint) => {
     return `
       @media only screen and (max-width:${breakpoint}) {
         .mj-bw-icon-row-text {
@@ -36,30 +44,35 @@ class MjBwIconRow extends BodyComponent {
   render() {
     const headAnchorElement =
       this.getAttribute("head-url-text") && this.getAttribute("head-url")
-        ? `<a href="${this.getAttribute("head-url")}" class="link">
-                ${this.getAttribute("head-url-text")}
-                <span style="text-decoration: none">
-                  <img src="https://assets.bitwarden.com/email/v1/bwi-external-link-16px.png"
-                    alt="External Link Icon"
-                    width="16px"
-                    style="vertical-align: middle;"
-                  />
-                </span>
-              </a>`
+        ? `
+            <mj-text css-class="mj-bw-icon-row-text" padding="5px 10px 0px 10px" ${BODY_TEXT_STYLES}>
+                <a href="${this.getAttribute("head-url")}" class="link">
+                    ${this.getAttribute("head-url-text")}
+                    <span style="text-decoration: none">
+                      <img src="https://assets.bitwarden.com/email/v1/bwi-external-link-16px.png"
+                        alt="External Link Icon"
+                        width="16px"
+                        style="vertical-align: middle;"
+                      />
+                    </span>
+                  </a>
+            </mj-text>`
         : "";
 
     const footAnchorElement =
       this.getAttribute("foot-url-text") && this.getAttribute("foot-url")
-        ? `<a href="${this.getAttribute("foot-url")}" class="link">
-                ${this.getAttribute("foot-url-text")}
-                <span style="text-decoration: none">
-                  <img src="https://assets.bitwarden.com/email/v1/bwi-external-link-16px.png"
-                    alt="External Link Icon"
-                    width="16px"
-                    style="vertical-align: middle;"
-                  />
-                </span>
-          </a>`
+        ? `<mj-text css-class="mj-bw-icon-row-text" padding="5px 10px 0px 10px" ${BODY_TEXT_STYLES}>
+                <a href="${this.getAttribute("foot-url")}" class="link">
+                    ${this.getAttribute("foot-url-text")}
+                    <span style="text-decoration: none">
+                      <img src="https://assets.bitwarden.com/email/v1/bwi-external-link-16px.png"
+                        alt="External Link Icon"
+                        width="16px"
+                        style="vertical-align: middle;"
+                      />
+                    </span>
+              </a>
+          </mj-text>`
         : "";
 
     return this.renderMJML(
@@ -76,19 +89,11 @@ class MjBwIconRow extends BodyComponent {
             />
           </mj-column>
           <mj-column width="85%" vertical-align="top">
-            <mj-text css-class="mj-bw-icon-row-text" padding="5px 10px 0px 10px">
-              ` +
-        headAnchorElement +
-        `
-              </mj-text>
-              <mj-text css-class="mj-bw-icon-row-text" padding="5px 10px 0px 10px">
+              ${headAnchorElement}
+              <mj-text css-class="mj-bw-icon-row-text" padding="5px 10px 0px 10px" ${BODY_TEXT_STYLES}>
                 ${this.getAttribute("text")}
               </mj-text>
-              <mj-text css-class="mj-bw-icon-row-text" padding="5px 10px 0px 10px">
-              ` +
-        footAnchorElement +
-        `
-              </mj-text>
+              ${footAnchorElement}
           </mj-column>
         </mj-group>
       </mj-section>

src/Core/MailTemplates/Mjml/emails/AdminConsole/OrganizationConfirmation/organization-confirmation-enterprise-teams.mjml

@@ -0,0 +1,50 @@
+<mjml>
+  <mj-head>
+    <mj-include path="../../../components/head.mjml" />
+  </mj-head>
+
+  <mj-body css-class="border-fix">
+    <!-- Blue Header Section -->
+    <mj-wrapper css-class="border-fix" padding="20px 20px 10px 20px">
+      <mj-bw-hero
+        img-src="https://assets.bitwarden.com/email/v1/spot-enterprise.png"
+        title="You can now share passwords with members of {{OrganizationName}}!"
+        button-text="Log in"
+        button-url="https://vault.bitwarden.com"
+      />
+    </mj-wrapper>
+
+    <!-- Main Content -->
+    <mj-wrapper padding="5px 20px 10px 20px">
+      <mj-section background-color="#fff" padding="15px 10px 10px 10px">
+        <mj-column>
+          <mj-text font-size="16px" line-height="24px" padding="10px 15px">
+            As a member of <b>{{OrganizationName}}</b>:
+          </mj-text>
+        </mj-column>
+      </mj-section>
+      <mj-bw-icon-row
+        icon-src="https://assets.bitwarden.com/email/v1/icon-enterprise.png"
+        icon-alt="Organization Icon"
+        text="Your account is owned by {{OrganizationName}} and is subject to their security and management policies."
+      />
+      <mj-bw-icon-row
+        icon-src="https://assets.bitwarden.com/email/v1/icon-account-switching-new.png"
+        icon-alt="Group Users Icon"
+        text="You can easily access and share passwords with your team."
+        foot-url-text="Share passwords in Bitwarden"
+        foot-url="https://bitwarden.com/help/share-to-a-collection/"
+      />
+      <mj-section background-color="#fff" padding="0 20px 20px 20px">
+      </mj-section>
+    </mj-wrapper>
+
+    <!-- Learn More Section -->
+    <mj-wrapper padding="5px 20px 10px 20px">
+      <mj-bw-learn-more-footer />
+    </mj-wrapper>
+
+    <!-- Footer -->
+    <mj-include path="../../../components/footer.mjml" />
+  </mj-body>
+</mjml>

src/Core/MailTemplates/Mjml/emails/AdminConsole/OrganizationConfirmation/organization-confirmation-family-free.mjml

@@ -0,0 +1,55 @@
+<mjml>
+  <mj-head>
+    <mj-include path="../../../components/head.mjml" />
+  </mj-head>
+
+  <mj-body css-class="border-fix">
+    <!-- Blue Header Section -->
+    <mj-wrapper css-class="border-fix" padding="20px 20px 10px 20px">
+      <mj-bw-hero
+        img-src="https://assets.bitwarden.com/email/v1/spot-family-homes.png"
+        title="You can now share passwords with members of {{OrganizationName}}!"
+        button-text="Log in"
+        button-url="https://vault.bitwarden.com"
+      />
+    </mj-wrapper>
+
+    <!-- Main Content -->
+    <mj-wrapper padding="5px 20px 10px 20px">
+      <mj-section background-color="#fff" padding="15px 10px 10px 10px">
+        <mj-column>
+          <mj-text font-size="16px" line-height="24px" padding="10px 15px">
+            As a member of <b>{{OrganizationName}}</b>:
+          </mj-text>
+        </mj-column>
+      </mj-section>
+      <mj-bw-icon-row
+        icon-src="https://assets.bitwarden.com/email/v1/icon-item-type.png"
+        icon-alt="Collections Icon"
+        text="You can access passwords {{OrganizationName}} has shared with you."
+      />
+      <mj-bw-icon-row
+        icon-src="https://assets.bitwarden.com/email/v1/icon-account-switching-new.png"
+        icon-alt="Group Users Icon"
+        text="You can easily share passwords with friends, family, or coworkers."
+        foot-url-text="Share passwords in Bitwarden"
+        foot-url="https://bitwarden.com/help/share-to-a-collection/"
+      />
+      <mj-section background-color="#fff" padding="0 20px 20px 20px">
+      </mj-section>
+    </mj-wrapper>
+
+    <!-- Download Mobile Apps Section -->
+    <mj-wrapper padding="5px 20px 10px 20px">
+      <mj-include path="../components/mobile-app-download.mjml" />
+    </mj-wrapper>
+
+    <!-- Learn More Section -->
+    <mj-wrapper padding="5px 20px 10px 20px">
+      <mj-bw-learn-more-footer />
+    </mj-wrapper>
+
+    <!-- Footer -->
+    <mj-include path="../../../components/footer.mjml" />
+  </mj-body>
+</mjml>

src/Core/MailTemplates/README.md

@@ -76,3 +76,13 @@ The `IMailService` automatically uses both versions when sending emails:
 
 ## `*.mjml`
 This is a templating language we use to increase efficiency when creating email content. See the `MJML` [documentation](./Mjml/README.md) for more details.
+
+# Managing email assets
+
+We host assets that are included in emails at `assets.bitwarden.com`, at the `/email/v1` path. This corresponds to a static file storage container that is managed by our SRE team.  For example: https://assets.bitwarden.com/email/v1/mail-github.png. This is the URL for all assets for emails sent from any environment.
+
+## Adding an asset
+
+When you are creating an email that needs a new asset, you should first check to see if that asset already exists. The easiest way to do this is check at the corresponding `https://assets.bitwarden.com/email/v1/` URL (e.g. https://assets.bitwarden.com/email/v1/my_new_image.png). 
+
+If the asset you are adding is not there, enter a ticket for the SRE team to add the asset to the email asset container. The preferred format for assets is a `.png` file, and the file(s) should be attached to the ticket.

src/Core/Repositories/IUserRepository.cs

@@ -1,4 +1,5 @@
 using Bit.Core.Entities;
+using Bit.Core.KeyManagement.Models.Data;
 using Bit.Core.KeyManagement.UserKey;
 using Bit.Core.Models.Data;
 
@@ -44,5 +45,17 @@ public interface IUserRepository : IRepository<User, Guid>
         IEnumerable<UpdateEncryptedDataForKeyRotation> updateDataActions);
     Task UpdateUserKeyAndEncryptedDataV2Async(User user,
         IEnumerable<UpdateEncryptedDataForKeyRotation> updateDataActions);
+    /// <summary>
+    /// Sets the account cryptographic state to a user in a single transaction. The provided
+    /// MUST be a V2 encryption state. Passing in a V1 encryption state will throw.
+    /// Extra actions can be passed in case other user data needs to be updated in the same transaction.
+    /// </summary>
+    Task SetV2AccountCryptographicStateAsync(
+        Guid userId,
+        UserAccountKeysData accountKeysData,
+        IEnumerable<UpdateUserData>? updateUserDataActions = null);
     Task DeleteManyAsync(IEnumerable<User> users);
 }
+
+public delegate Task UpdateUserData(Microsoft.Data.SqlClient.SqlConnection? connection = null,
+    Microsoft.Data.SqlClient.SqlTransaction? transaction = null);

src/Core/Services/IPaymentService.cs

@@ -4,8 +4,6 @@
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.AdminConsole.Models.Business;
 using Bit.Core.Billing.Models;
-using Bit.Core.Billing.Tax.Requests;
-using Bit.Core.Billing.Tax.Responses;
 using Bit.Core.Entities;
 using Bit.Core.Models.Business;
 using Bit.Core.Models.StaticStore;
@@ -44,8 +42,6 @@ public interface IPaymentService
     Task<BillingInfo> GetBillingAsync(ISubscriber subscriber);
     Task<BillingHistoryInfo> GetBillingHistoryAsync(ISubscriber subscriber);
     Task<SubscriptionInfo> GetSubscriptionAsync(ISubscriber subscriber);
-    Task<TaxInfo> GetTaxInfoAsync(ISubscriber subscriber);
-    Task SaveTaxInfoAsync(ISubscriber subscriber, TaxInfo taxInfo);
     Task<string> AddSecretsManagerToSubscription(Organization org, Plan plan, int additionalSmSeats, int additionalServiceAccount);
     /// <summary>
     /// Secrets Manager Standalone is a discount in Stripe that is used to give an organization access to Secrets Manager.
@@ -68,7 +64,4 @@ public interface IPaymentService
     /// <param name="organization">Organization Representation used for Inviting Organization Users</param>
     /// <returns>If the organization has Secrets Manager and has the Standalone Stripe Discount</returns>
     Task<bool> HasSecretsManagerStandalone(InviteOrganization organization);
-    Task<PreviewInvoiceResponseModel> PreviewInvoiceAsync(PreviewIndividualInvoiceRequestBody parameters, string gatewayCustomerId, string gatewaySubscriptionId);
-    Task<PreviewInvoiceResponseModel> PreviewInvoiceAsync(PreviewOrganizationInvoiceRequestBody parameters, string gatewayCustomerId, string gatewaySubscriptionId);
-
 }

src/Core/Services/IUserService.cs

@@ -4,7 +4,6 @@
 using System.Security.Claims;
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.Auth.Enums;
-using Bit.Core.Auth.Models;
 using Bit.Core.Billing.Models.Business;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
@@ -60,11 +59,22 @@ public interface IUserService
     Task<bool> CheckPasswordAsync(User user, string password);
     /// <summary>
     /// Checks if the user has access to premium features, either through a personal subscription or through an organization.
+    ///
+    /// This is the preferred way to definitively know if a user has access to premium features.
     /// </summary>
     /// <param name="user">user being acted on</param>
     /// <returns>true if they can access premium; false otherwise.</returns>
-    Task<bool> CanAccessPremium(ITwoFactorProvidersUser user);
-    Task<bool> HasPremiumFromOrganization(ITwoFactorProvidersUser user);
+    Task<bool> CanAccessPremium(User user);
+
+    /// <summary>
+    /// Checks if the user has inherited access to premium features through an organization.
+    ///
+    /// This primarily serves as a means to communicate to the client when a user has inherited their premium status
+    /// through an organization. Feature gating logic probably should not be behind this check.
+    /// </summary>
+    /// <param name="user">user being acted on</param>
+    /// <returns>true if they can access premium because of organization membership; false otherwise.</returns>
+    Task<bool> HasPremiumFromOrganization(User user);
     Task<string> GenerateSignInTokenAsync(User user, string purpose);
 
     Task<IdentityResult> UpdatePasswordHash(User user, string newPassword,

src/Core/Services/Implementations/StripePaymentService.cs

@@ -8,11 +8,7 @@ using Bit.Core.Billing.Constants;
 using Bit.Core.Billing.Extensions;
 using Bit.Core.Billing.Models;
 using Bit.Core.Billing.Organizations.Models;
-using Bit.Core.Billing.Premium.Commands;
 using Bit.Core.Billing.Pricing;
-using Bit.Core.Billing.Tax.Requests;
-using Bit.Core.Billing.Tax.Responses;
-using Bit.Core.Billing.Tax.Services;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;
@@ -36,8 +32,6 @@ public class StripePaymentService : IPaymentService
     private readonly Braintree.IBraintreeGateway _btGateway;
     private readonly IStripeAdapter _stripeAdapter;
     private readonly IGlobalSettings _globalSettings;
-    private readonly IFeatureService _featureService;
-    private readonly ITaxService _taxService;
     private readonly IPricingClient _pricingClient;
 
     public StripePaymentService(
@@ -46,8 +40,6 @@ public class StripePaymentService : IPaymentService
         IStripeAdapter stripeAdapter,
         Braintree.IBraintreeGateway braintreeGateway,
         IGlobalSettings globalSettings,
-        IFeatureService featureService,
-        ITaxService taxService,
         IPricingClient pricingClient)
     {
         _transactionRepository = transactionRepository;
@@ -55,8 +47,6 @@ public class StripePaymentService : IPaymentService
         _stripeAdapter = stripeAdapter;
         _btGateway = braintreeGateway;
         _globalSettings = globalSettings;
-        _featureService = featureService;
-        _taxService = taxService;
         _pricingClient = pricingClient;
     }
 
@@ -705,133 +695,6 @@ public class StripePaymentService : IPaymentService
         return subscriptionInfo;
     }
 
-    public async Task<TaxInfo> GetTaxInfoAsync(ISubscriber subscriber)
-    {
-        if (subscriber == null || string.IsNullOrWhiteSpace(subscriber.GatewayCustomerId))
-        {
-            return null;
-        }
-
-        var customer = await _stripeAdapter.CustomerGetAsync(subscriber.GatewayCustomerId,
-            new CustomerGetOptions { Expand = ["tax_ids"] });
-
-        if (customer == null)
-        {
-            return null;
-        }
-
-        var address = customer.Address;
-        var taxId = customer.TaxIds?.FirstOrDefault();
-
-        // Line1 is required, so if missing we're using the subscriber name,
-        // see: https://stripe.com/docs/api/customers/create#create_customer-address-line1
-        if (address != null && string.IsNullOrWhiteSpace(address.Line1))
-        {
-            address.Line1 = null;
-        }
-
-        return new TaxInfo
-        {
-            TaxIdNumber = taxId?.Value,
-            TaxIdType = taxId?.Type,
-            BillingAddressLine1 = address?.Line1,
-            BillingAddressLine2 = address?.Line2,
-            BillingAddressCity = address?.City,
-            BillingAddressState = address?.State,
-            BillingAddressPostalCode = address?.PostalCode,
-            BillingAddressCountry = address?.Country,
-        };
-    }
-
-    public async Task SaveTaxInfoAsync(ISubscriber subscriber, TaxInfo taxInfo)
-    {
-        if (string.IsNullOrWhiteSpace(subscriber?.GatewayCustomerId) || subscriber.IsUser())
-        {
-            return;
-        }
-
-        var customer = await _stripeAdapter.CustomerUpdateAsync(subscriber.GatewayCustomerId,
-            new CustomerUpdateOptions
-            {
-                Address = new AddressOptions
-                {
-                    Line1 = taxInfo.BillingAddressLine1 ?? string.Empty,
-                    Line2 = taxInfo.BillingAddressLine2,
-                    City = taxInfo.BillingAddressCity,
-                    State = taxInfo.BillingAddressState,
-                    PostalCode = taxInfo.BillingAddressPostalCode,
-                    Country = taxInfo.BillingAddressCountry,
-                },
-                Expand = ["tax_ids"]
-            });
-
-        if (customer == null)
-        {
-            return;
-        }
-
-        var taxId = customer.TaxIds?.FirstOrDefault();
-
-        if (taxId != null)
-        {
-            await _stripeAdapter.TaxIdDeleteAsync(customer.Id, taxId.Id);
-        }
-
-        if (string.IsNullOrWhiteSpace(taxInfo.TaxIdNumber))
-        {
-            return;
-        }
-
-        var taxIdType = taxInfo.TaxIdType;
-
-        if (string.IsNullOrWhiteSpace(taxIdType))
-        {
-            taxIdType = _taxService.GetStripeTaxCode(taxInfo.BillingAddressCountry, taxInfo.TaxIdNumber);
-
-            if (taxIdType == null)
-            {
-                _logger.LogWarning("Could not infer tax ID type in country '{Country}' with tax ID '{TaxID}'.",
-                    taxInfo.BillingAddressCountry,
-                    taxInfo.TaxIdNumber);
-                throw new BadRequestException("billingTaxIdTypeInferenceError");
-            }
-        }
-
-        try
-        {
-            await _stripeAdapter.TaxIdCreateAsync(customer.Id,
-                new TaxIdCreateOptions { Type = taxInfo.TaxIdType, Value = taxInfo.TaxIdNumber });
-
-            if (taxInfo.TaxIdType == StripeConstants.TaxIdType.SpanishNIF)
-            {
-                await _stripeAdapter.TaxIdCreateAsync(customer.Id,
-                    new TaxIdCreateOptions
-                    {
-                        Type = StripeConstants.TaxIdType.EUVAT,
-                        Value = $"ES{taxInfo.TaxIdNumber}"
-                    });
-            }
-        }
-        catch (StripeException e)
-        {
-            switch (e.StripeError.Code)
-            {
-                case StripeConstants.ErrorCodes.TaxIdInvalid:
-                    _logger.LogWarning("Invalid tax ID '{TaxID}' for country '{Country}'.",
-                        taxInfo.TaxIdNumber,
-                        taxInfo.BillingAddressCountry);
-                    throw new BadRequestException("billingInvalidTaxIdError");
-                default:
-                    _logger.LogError(e,
-                        "Error creating tax ID '{TaxId}' in country '{Country}' for customer '{CustomerID}'.",
-                        taxInfo.TaxIdNumber,
-                        taxInfo.BillingAddressCountry,
-                        customer.Id);
-                    throw new BadRequestException("billingTaxIdCreationError");
-            }
-        }
-    }
-
     public async Task<string> AddSecretsManagerToSubscription(
         Organization org,
         StaticStore.Plan plan,
@@ -909,309 +772,6 @@ public class StripePaymentService : IPaymentService
         }
     }
 
-    [Obsolete($"Use {nameof(PreviewPremiumTaxCommand)} instead.")]
-    public async Task<PreviewInvoiceResponseModel> PreviewInvoiceAsync(
-        PreviewIndividualInvoiceRequestBody parameters,
-        string gatewayCustomerId,
-        string gatewaySubscriptionId)
-    {
-        var premiumPlan = await _pricingClient.GetAvailablePremiumPlan();
-
-        var options = new InvoiceCreatePreviewOptions
-        {
-            AutomaticTax = new InvoiceAutomaticTaxOptions { Enabled = true, },
-            Currency = "usd",
-            SubscriptionDetails = new InvoiceSubscriptionDetailsOptions
-            {
-                Items =
-                [
-                    new InvoiceSubscriptionDetailsItemOptions
-                    {
-                        Quantity = 1,
-                        Plan = premiumPlan.Seat.StripePriceId
-                    },
-
-                    new InvoiceSubscriptionDetailsItemOptions
-                    {
-                        Quantity = parameters.PasswordManager.AdditionalStorage,
-                        Plan = premiumPlan.Storage.StripePriceId
-                    }
-                ]
-            },
-            CustomerDetails = new InvoiceCustomerDetailsOptions
-            {
-                Address = new AddressOptions
-                {
-                    PostalCode = parameters.TaxInformation.PostalCode,
-                    Country = parameters.TaxInformation.Country,
-                }
-            },
-        };
-
-        if (!string.IsNullOrEmpty(parameters.TaxInformation.TaxId))
-        {
-            var taxIdType = _taxService.GetStripeTaxCode(
-                options.CustomerDetails.Address.Country,
-                parameters.TaxInformation.TaxId);
-
-            if (taxIdType == null)
-            {
-                _logger.LogWarning("Invalid tax ID '{TaxID}' for country '{Country}'.",
-                    parameters.TaxInformation.TaxId,
-                    parameters.TaxInformation.Country);
-                throw new BadRequestException("billingPreviewInvalidTaxIdError");
-            }
-
-            options.CustomerDetails.TaxIds =
-            [
-                new InvoiceCustomerDetailsTaxIdOptions { Type = taxIdType, Value = parameters.TaxInformation.TaxId }
-            ];
-
-            if (taxIdType == StripeConstants.TaxIdType.SpanishNIF)
-            {
-                options.CustomerDetails.TaxIds.Add(new InvoiceCustomerDetailsTaxIdOptions
-                {
-                    Type = StripeConstants.TaxIdType.EUVAT,
-                    Value = $"ES{parameters.TaxInformation.TaxId}"
-                });
-            }
-        }
-
-        if (!string.IsNullOrWhiteSpace(gatewayCustomerId))
-        {
-            var gatewayCustomer = await _stripeAdapter.CustomerGetAsync(gatewayCustomerId);
-
-            if (gatewayCustomer.Discount != null)
-            {
-                options.Discounts = [new InvoiceDiscountOptions { Coupon = gatewayCustomer.Discount.Coupon.Id }];
-            }
-        }
-
-        if (!string.IsNullOrWhiteSpace(gatewaySubscriptionId))
-        {
-            var gatewaySubscription = await _stripeAdapter.SubscriptionGetAsync(gatewaySubscriptionId);
-
-            if (gatewaySubscription?.Discounts is { Count: > 0 })
-            {
-                options.Discounts = gatewaySubscription.Discounts.Select(x => new InvoiceDiscountOptions { Coupon = x.Coupon.Id }).ToList();
-            }
-        }
-
-        if (options.Discounts is { Count: > 0 })
-        {
-            options.Discounts = options.Discounts.DistinctBy(invoiceDiscountOptions => invoiceDiscountOptions.Coupon).ToList();
-        }
-
-        try
-        {
-            var invoice = await _stripeAdapter.InvoiceCreatePreviewAsync(options);
-
-            var tax = invoice.TotalTaxes.Sum(invoiceTotalTax => invoiceTotalTax.Amount);
-
-            var effectiveTaxRate = invoice.TotalExcludingTax != null && invoice.TotalExcludingTax.Value != 0
-                ? tax.ToMajor() / invoice.TotalExcludingTax.Value.ToMajor()
-                : 0M;
-
-            var result = new PreviewInvoiceResponseModel(
-                effectiveTaxRate,
-                invoice.TotalExcludingTax.ToMajor() ?? 0,
-                tax.ToMajor(),
-                invoice.Total.ToMajor());
-            return result;
-        }
-        catch (StripeException e)
-        {
-            switch (e.StripeError.Code)
-            {
-                case StripeConstants.ErrorCodes.TaxIdInvalid:
-                    _logger.LogWarning("Invalid tax ID '{TaxID}' for country '{Country}'.",
-                        parameters.TaxInformation.TaxId,
-                        parameters.TaxInformation.Country);
-                    throw new BadRequestException("billingPreviewInvalidTaxIdError");
-                default:
-                    _logger.LogError(e,
-                        "Unexpected error previewing invoice with tax ID '{TaxId}' in country '{Country}'.",
-                        parameters.TaxInformation.TaxId,
-                        parameters.TaxInformation.Country);
-                    throw new BadRequestException("billingPreviewInvoiceError");
-            }
-        }
-    }
-
-    public async Task<PreviewInvoiceResponseModel> PreviewInvoiceAsync(
-        PreviewOrganizationInvoiceRequestBody parameters,
-        string gatewayCustomerId,
-        string gatewaySubscriptionId)
-    {
-        var plan = await _pricingClient.GetPlanOrThrow(parameters.PasswordManager.Plan);
-        var isSponsored = parameters.PasswordManager.SponsoredPlan.HasValue;
-
-        var options = new InvoiceCreatePreviewOptions
-        {
-            Currency = "usd",
-            SubscriptionDetails = new InvoiceSubscriptionDetailsOptions
-            {
-                Items =
-                [
-                    new InvoiceSubscriptionDetailsItemOptions
-                    {
-                        Quantity = parameters.PasswordManager.AdditionalStorage,
-                        Plan = plan.PasswordManager.StripeStoragePlanId
-                    }
-                ]
-            },
-            CustomerDetails = new InvoiceCustomerDetailsOptions
-            {
-                Address = new AddressOptions
-                {
-                    PostalCode = parameters.TaxInformation.PostalCode,
-                    Country = parameters.TaxInformation.Country,
-                }
-            },
-        };
-
-        if (isSponsored)
-        {
-            var sponsoredPlan = SponsoredPlans.Get(parameters.PasswordManager.SponsoredPlan.Value);
-            options.SubscriptionDetails.Items.Add(
-                new InvoiceSubscriptionDetailsItemOptions { Quantity = 1, Plan = sponsoredPlan.StripePlanId }
-            );
-        }
-        else
-        {
-            if (plan.PasswordManager.HasAdditionalSeatsOption)
-            {
-                options.SubscriptionDetails.Items.Add(
-                    new InvoiceSubscriptionDetailsItemOptions { Quantity = parameters.PasswordManager.Seats, Plan = plan.PasswordManager.StripeSeatPlanId }
-                );
-            }
-            else
-            {
-                options.SubscriptionDetails.Items.Add(
-                    new InvoiceSubscriptionDetailsItemOptions { Quantity = 1, Plan = plan.PasswordManager.StripePlanId }
-                );
-            }
-
-            if (plan.SupportsSecretsManager)
-            {
-                if (plan.SecretsManager.HasAdditionalSeatsOption)
-                {
-                    options.SubscriptionDetails.Items.Add(new InvoiceSubscriptionDetailsItemOptions
-                    {
-                        Quantity = parameters.SecretsManager?.Seats ?? 0,
-                        Plan = plan.SecretsManager.StripeSeatPlanId
-                    });
-                }
-
-                if (plan.SecretsManager.HasAdditionalServiceAccountOption)
-                {
-                    options.SubscriptionDetails.Items.Add(new InvoiceSubscriptionDetailsItemOptions
-                    {
-                        Quantity = parameters.SecretsManager?.AdditionalMachineAccounts ?? 0,
-                        Plan = plan.SecretsManager.StripeServiceAccountPlanId
-                    });
-                }
-            }
-        }
-
-        if (!string.IsNullOrWhiteSpace(parameters.TaxInformation.TaxId))
-        {
-            var taxIdType = _taxService.GetStripeTaxCode(
-                options.CustomerDetails.Address.Country,
-                parameters.TaxInformation.TaxId);
-
-            if (taxIdType == null)
-            {
-                _logger.LogWarning("Invalid tax ID '{TaxID}' for country '{Country}'.",
-                    parameters.TaxInformation.TaxId,
-                    parameters.TaxInformation.Country);
-                throw new BadRequestException("billingTaxIdTypeInferenceError");
-            }
-
-            options.CustomerDetails.TaxIds =
-            [
-                new InvoiceCustomerDetailsTaxIdOptions { Type = taxIdType, Value = parameters.TaxInformation.TaxId }
-            ];
-
-            if (taxIdType == StripeConstants.TaxIdType.SpanishNIF)
-            {
-                options.CustomerDetails.TaxIds.Add(new InvoiceCustomerDetailsTaxIdOptions
-                {
-                    Type = StripeConstants.TaxIdType.EUVAT,
-                    Value = $"ES{parameters.TaxInformation.TaxId}"
-                });
-            }
-        }
-
-        Customer gatewayCustomer = null;
-
-        if (!string.IsNullOrWhiteSpace(gatewayCustomerId))
-        {
-            gatewayCustomer = await _stripeAdapter.CustomerGetAsync(gatewayCustomerId);
-
-            if (gatewayCustomer.Discount != null)
-            {
-                options.Discounts =
-                [
-                    new InvoiceDiscountOptions { Coupon = gatewayCustomer.Discount.Coupon.Id }
-                ];
-            }
-        }
-
-        if (!string.IsNullOrWhiteSpace(gatewaySubscriptionId))
-        {
-            var gatewaySubscription = await _stripeAdapter.SubscriptionGetAsync(gatewaySubscriptionId);
-
-            if (gatewaySubscription?.Discounts != null)
-            {
-                options.Discounts = gatewaySubscription.Discounts
-                    .Select(discount => new InvoiceDiscountOptions { Coupon = discount.Coupon.Id }).ToList();
-            }
-        }
-
-        options.AutomaticTax = new InvoiceAutomaticTaxOptions { Enabled = true };
-        if (parameters.PasswordManager.Plan.IsBusinessProductTierType() &&
-            parameters.TaxInformation.Country != Constants.CountryAbbreviations.UnitedStates)
-        {
-            options.CustomerDetails.TaxExempt = StripeConstants.TaxExempt.Reverse;
-        }
-
-        try
-        {
-            var invoice = await _stripeAdapter.InvoiceCreatePreviewAsync(options);
-
-            var tax = invoice.TotalTaxes.Sum(invoiceTotalTax => invoiceTotalTax.Amount);
-
-            var effectiveTaxRate = invoice.TotalExcludingTax != null && invoice.TotalExcludingTax.Value != 0
-                ? tax.ToMajor() / invoice.TotalExcludingTax.Value.ToMajor()
-                : 0M;
-
-            var result = new PreviewInvoiceResponseModel(
-                effectiveTaxRate,
-                invoice.TotalExcludingTax.ToMajor() ?? 0,
-                tax.ToMajor(),
-                invoice.Total.ToMajor());
-            return result;
-        }
-        catch (StripeException e)
-        {
-            switch (e.StripeError.Code)
-            {
-                case StripeConstants.ErrorCodes.TaxIdInvalid:
-                    _logger.LogWarning("Invalid tax ID '{TaxID}' for country '{Country}'.",
-                        parameters.TaxInformation.TaxId,
-                        parameters.TaxInformation.Country);
-                    throw new BadRequestException("billingPreviewInvalidTaxIdError");
-                default:
-                    _logger.LogError(e,
-                        "Unexpected error previewing invoice with tax ID '{TaxId}' in country '{Country}'.",
-                        parameters.TaxInformation.TaxId,
-                        parameters.TaxInformation.Country);
-                    throw new BadRequestException("billingPreviewInvoiceError");
-            }
-        }
-    }
-
     private PaymentMethod GetLatestCardPaymentMethod(string customerId)
     {
         var cardPaymentMethods = _stripeAdapter.PaymentMethodListAutoPaging(

src/Core/Services/Implementations/UserService.cs

@@ -1104,7 +1104,7 @@ public class UserService : UserManager<User>, IUserService
         return success;
     }
 
-    public async Task<bool> CanAccessPremium(ITwoFactorProvidersUser user)
+    public async Task<bool> CanAccessPremium(User user)
     {
         var userId = user.GetUserId();
         if (!userId.HasValue)
@@ -1112,10 +1112,10 @@ public class UserService : UserManager<User>, IUserService
             return false;
         }
 
-        return user.GetPremium() || await this.HasPremiumFromOrganization(user);
+        return user.Premium || await HasPremiumFromOrganization(user);
     }
 
-    public async Task<bool> HasPremiumFromOrganization(ITwoFactorProvidersUser user)
+    public async Task<bool> HasPremiumFromOrganization(User user)
     {
         var userId = user.GetUserId();
         if (!userId.HasValue)
@@ -1138,6 +1138,7 @@ public class UserService : UserManager<User>, IUserService
             orgAbility.UsersGetPremium &&
             orgAbility.Enabled);
     }
+
     public async Task<string> GenerateSignInTokenAsync(User user, string purpose)
     {
         var token = await GenerateUserTokenAsync(user, Options.Tokens.PasswordResetTokenProvider,

src/EventsProcessor/AzureQueueHostedService.cs

@@ -57,14 +57,16 @@ public class AzureQueueHostedService : IHostedService, IDisposable
     private async Task ExecuteAsync(CancellationToken cancellationToken)
     {
         var storageConnectionString = _configuration["azureStorageConnectionString"];
-        if (string.IsNullOrWhiteSpace(storageConnectionString))
+        var queueName = _configuration["azureQueueServiceQueueName"];
+        if (string.IsNullOrWhiteSpace(storageConnectionString) ||
+            string.IsNullOrWhiteSpace(queueName))
         {
             return;
         }
 
         var repo = new Core.Repositories.TableStorage.EventRepository(storageConnectionString);
         _eventWriteService = new RepositoryEventWriteService(repo);
-        _queueClient = new QueueClient(storageConnectionString, "event");
+        _queueClient = new QueueClient(storageConnectionString, queueName);
 
         while (!cancellationToken.IsCancellationRequested)
         {

src/Identity/IdentityServer/RequestValidators/BaseRequestValidator.cs

@@ -770,11 +770,8 @@ public abstract class BaseRequestValidator<T> where T : class
 
     private async Task SendFailedTwoFactorEmail(User user, TwoFactorProviderType failedAttemptType)
     {
-        if (_featureService.IsEnabled(FeatureFlagKeys.FailedTwoFactorEmail))
-        {
-            await _mailService.SendFailedTwoFactorAttemptEmailAsync(user.Email, failedAttemptType, DateTime.UtcNow,
-                CurrentContext.IpAddress);
-        }
+        await _mailService.SendFailedTwoFactorAttemptEmailAsync(user.Email, failedAttemptType, DateTime.UtcNow,
+            CurrentContext.IpAddress);
     }
 
     private async Task<MasterPasswordPolicyResponseModel> GetMasterPasswordPolicyAsync(User user)

src/Infrastructure.Dapper/Repositories/UserRepository.cs

@@ -2,16 +2,16 @@
 using System.Text.Json;
 using Bit.Core;
 using Bit.Core.Entities;
+using Bit.Core.KeyManagement.Models.Data;
 using Bit.Core.KeyManagement.UserKey;
 using Bit.Core.Models.Data;
 using Bit.Core.Repositories;
 using Bit.Core.Settings;
+using Bit.Core.Utilities;
 using Dapper;
 using Microsoft.AspNetCore.DataProtection;
 using Microsoft.Data.SqlClient;
 
-#nullable enable
-
 namespace Bit.Infrastructure.Dapper.Repositories;
 
 public class UserRepository : Repository<User, Guid>, IUserRepository
@@ -288,6 +288,63 @@ public class UserRepository : Repository<User, Guid>, IUserRepository
         UnprotectData(user);
     }
 
+    public async Task SetV2AccountCryptographicStateAsync(
+        Guid userId,
+        UserAccountKeysData accountKeysData,
+        IEnumerable<UpdateUserData>? updateUserDataActions = null)
+    {
+        if (!accountKeysData.IsV2Encryption())
+        {
+            throw new ArgumentException("Provided account keys data is not valid V2 encryption data.", nameof(accountKeysData));
+        }
+
+        var timestamp = DateTime.UtcNow;
+        var signatureKeyPairId = CoreHelpers.GenerateComb();
+
+        await using var connection = new SqlConnection(ConnectionString);
+        await connection.OpenAsync();
+
+        await using var transaction = connection.BeginTransaction();
+        try
+        {
+            await connection.ExecuteAsync(
+                "[dbo].[User_UpdateAccountCryptographicState]",
+                new
+                {
+                    Id = userId,
+                    PublicKey = accountKeysData.PublicKeyEncryptionKeyPairData.PublicKey,
+                    PrivateKey = accountKeysData.PublicKeyEncryptionKeyPairData.WrappedPrivateKey,
+                    SignedPublicKey = accountKeysData.PublicKeyEncryptionKeyPairData.SignedPublicKey,
+                    SecurityState = accountKeysData.SecurityStateData!.SecurityState,
+                    SecurityVersion = accountKeysData.SecurityStateData!.SecurityVersion,
+                    SignatureKeyPairId = signatureKeyPairId,
+                    SignatureAlgorithm = accountKeysData.SignatureKeyPairData!.SignatureAlgorithm,
+                    SigningKey = accountKeysData.SignatureKeyPairData!.WrappedSigningKey,
+                    VerifyingKey = accountKeysData.SignatureKeyPairData!.VerifyingKey,
+                    RevisionDate = timestamp,
+                    AccountRevisionDate = timestamp
+                },
+                transaction: transaction,
+                commandType: CommandType.StoredProcedure);
+
+            //  Update user data that depends on cryptographic state
+            if (updateUserDataActions != null)
+            {
+                foreach (var action in updateUserDataActions)
+                {
+                    await action(connection, transaction);
+                }
+            }
+
+            await transaction.CommitAsync();
+        }
+        catch
+        {
+            await transaction.RollbackAsync();
+            throw;
+        }
+    }
+
     public async Task<IEnumerable<User>> GetManyAsync(IEnumerable<Guid> ids)
     {
         using (var connection = new SqlConnection(ReadOnlyConnectionString))

src/Infrastructure.EntityFramework/Repositories/UserRepository.cs

@@ -1,4 +1,5 @@
 using AutoMapper;
+using Bit.Core.KeyManagement.Models.Data;
 using Bit.Core.KeyManagement.UserKey;
 using Bit.Core.Models.Data;
 using Bit.Core.Repositories;
@@ -241,6 +242,80 @@ public class UserRepository : Repository<Core.Entities.User, User, Guid>, IUserR
         await transaction.CommitAsync();
     }
 
+    public async Task SetV2AccountCryptographicStateAsync(
+        Guid userId,
+        UserAccountKeysData accountKeysData,
+        IEnumerable<UpdateUserData>? updateUserDataActions = null)
+    {
+        if (!accountKeysData.IsV2Encryption())
+        {
+            throw new ArgumentException("Provided account keys data is not valid V2 encryption data.", nameof(accountKeysData));
+        }
+
+        using var scope = ServiceScopeFactory.CreateScope();
+        var dbContext = GetDatabaseContext(scope);
+
+        await using var transaction = await dbContext.Database.BeginTransactionAsync();
+
+        // Update user
+        var userEntity = await dbContext.Users.FindAsync(userId);
+        if (userEntity == null)
+        {
+            throw new ArgumentException("User not found", nameof(userId));
+        }
+
+        // Update public key encryption key pair
+        var timestamp = DateTime.UtcNow;
+
+        userEntity.RevisionDate = timestamp;
+        userEntity.AccountRevisionDate = timestamp;
+
+        // V1 + V2 user crypto changes
+        userEntity.PublicKey = accountKeysData.PublicKeyEncryptionKeyPairData.PublicKey;
+        userEntity.PrivateKey = accountKeysData.PublicKeyEncryptionKeyPairData.WrappedPrivateKey;
+
+        userEntity.SecurityState = accountKeysData.SecurityStateData!.SecurityState;
+        userEntity.SecurityVersion = accountKeysData.SecurityStateData.SecurityVersion;
+        userEntity.SignedPublicKey = accountKeysData.PublicKeyEncryptionKeyPairData.SignedPublicKey;
+
+        // Replace existing keypair if it exists
+        var existingKeyPair = await dbContext.UserSignatureKeyPairs
+            .FirstOrDefaultAsync(x => x.UserId == userId);
+        if (existingKeyPair != null)
+        {
+            existingKeyPair.SignatureAlgorithm = accountKeysData.SignatureKeyPairData!.SignatureAlgorithm;
+            existingKeyPair.SigningKey = accountKeysData.SignatureKeyPairData.WrappedSigningKey;
+            existingKeyPair.VerifyingKey = accountKeysData.SignatureKeyPairData.VerifyingKey;
+            existingKeyPair.RevisionDate = timestamp;
+        }
+        else
+        {
+            var newKeyPair = new UserSignatureKeyPair
+            {
+                UserId = userId,
+                SignatureAlgorithm = accountKeysData.SignatureKeyPairData!.SignatureAlgorithm,
+                SigningKey = accountKeysData.SignatureKeyPairData.WrappedSigningKey,
+                VerifyingKey = accountKeysData.SignatureKeyPairData.VerifyingKey,
+                CreationDate = timestamp,
+                RevisionDate = timestamp
+            };
+            newKeyPair.SetNewId();
+            await dbContext.UserSignatureKeyPairs.AddAsync(newKeyPair);
+        }
+
+        await dbContext.SaveChangesAsync();
+
+        // Update additional user data within the same transaction
+        if (updateUserDataActions != null)
+        {
+            foreach (var action in updateUserDataActions)
+            {
+                await action();
+            }
+        }
+        await transaction.CommitAsync();
+    }
+
     public async Task<IEnumerable<Core.Entities.User>> GetManyAsync(IEnumerable<Guid> ids)
     {
         using (var scope = ServiceScopeFactory.CreateScope())

src/Infrastructure.EntityFramework/Vault/Repositories/CipherRepository.cs

@@ -704,6 +704,9 @@ public class CipherRepository : Repository<Core.Vault.Entities.Cipher, Cipher, G
             trackedCipher.RevisionDate = cipher.RevisionDate;
             trackedCipher.DeletedDate = cipher.DeletedDate;
             trackedCipher.Key = cipher.Key;
+            trackedCipher.Folders = cipher.Folders;
+            trackedCipher.Favorites = cipher.Favorites;
+            trackedCipher.Reprompt = cipher.Reprompt;
 
             await transaction.CommitAsync();
 

src/SharedWeb/Utilities/ServiceCollectionExtensions.cs

@@ -20,7 +20,6 @@ using Bit.Core.Auth.Enums;
 using Bit.Core.Auth.Identity;
 using Bit.Core.Auth.Identity.TokenProviders;
 using Bit.Core.Auth.IdentityServer;
-using Bit.Core.Auth.LoginFeatures;
 using Bit.Core.Auth.Models.Business.Tokenables;
 using Bit.Core.Auth.Repositories;
 using Bit.Core.Auth.Services;
@@ -140,7 +139,6 @@ public static class ServiceCollectionExtensions
         services.AddScoped<IAuthRequestService, AuthRequestService>();
         services.AddScoped<IDuoUniversalTokenService, DuoUniversalTokenService>();
         services.AddScoped<ISendAuthorizationService, SendAuthorizationService>();
-        services.AddLoginServices();
         services.AddScoped<IOrganizationDomainService, OrganizationDomainService>();
         services.AddVaultServices();
         services.AddReportingServices();

src/Sql/dbo/Stored Procedures/User_UpdateAccountCryptographicState.sql

@@ -0,0 +1,65 @@
+CREATE PROCEDURE [dbo].[User_UpdateAccountCryptographicState]
+    @Id UNIQUEIDENTIFIER,
+    @PublicKey NVARCHAR(MAX),
+    @PrivateKey NVARCHAR(MAX),
+    @SignedPublicKey NVARCHAR(MAX) = NULL,
+    @SecurityState NVARCHAR(MAX) = NULL,
+    @SecurityVersion INT = NULL,
+    @SignatureKeyPairId UNIQUEIDENTIFIER = NULL,
+    @SignatureAlgorithm TINYINT = NULL,
+    @SigningKey VARCHAR(MAX) = NULL,
+    @VerifyingKey VARCHAR(MAX) = NULL,
+    @RevisionDate DATETIME2(7),
+    @AccountRevisionDate DATETIME2(7)
+AS
+BEGIN
+    SET NOCOUNT ON
+
+    UPDATE
+        [dbo].[User]
+    SET
+        [PublicKey] = @PublicKey,
+        [PrivateKey] = @PrivateKey,
+        [SignedPublicKey] = @SignedPublicKey,
+        [SecurityState] = @SecurityState,
+        [SecurityVersion] = @SecurityVersion,
+        [RevisionDate] = @RevisionDate,
+        [AccountRevisionDate] = @AccountRevisionDate
+    WHERE
+        [Id] = @Id
+
+    IF EXISTS (SELECT 1 FROM [dbo].[UserSignatureKeyPair] WHERE [UserId] = @Id)
+    BEGIN
+        UPDATE [dbo].[UserSignatureKeyPair]
+        SET
+            [SignatureAlgorithm] = @SignatureAlgorithm,
+            [SigningKey] = @SigningKey,
+            [VerifyingKey] = @VerifyingKey,
+            [RevisionDate] = @RevisionDate
+        WHERE
+            [UserId] = @Id
+    END
+    ELSE
+    BEGIN
+        INSERT INTO [dbo].[UserSignatureKeyPair]
+        (
+            [Id],
+            [UserId],
+            [SignatureAlgorithm],
+            [SigningKey],
+            [VerifyingKey],
+            [CreationDate],
+            [RevisionDate]
+        )
+        VALUES
+        (
+            @SignatureKeyPairId,
+            @Id,
+            @SignatureAlgorithm,
+            @SigningKey,
+            @VerifyingKey,
+            @RevisionDate,
+            @RevisionDate
+        )
+    END
+END

src/Sql/dbo/Vault/Stored Procedures/Cipher/Cipher_UpdateWithCollections.sql

@@ -38,8 +38,13 @@ BEGIN
         [Data] = @Data,
         [Attachments] = @Attachments,
         [RevisionDate] = @RevisionDate,
-        [DeletedDate] = @DeletedDate, [Key] = @Key, [ArchivedDate] = @ArchivedDate
-        -- No need to update CreationDate, Favorites, Folders, or Type since that data will not change
+        [DeletedDate] = @DeletedDate,
+        [Key] = @Key,
+        [ArchivedDate] = @ArchivedDate,
+        [Folders] = @Folders,
+        [Favorites] = @Favorites,
+        [Reprompt] = @Reprompt
+        -- No need to update CreationDate or Type since that data will not change
     WHERE
         [Id] = @Id
 

test/Api.IntegrationTest/KeyManagement/Controllers/AccountsKeyManagementControllerTests.cs

@@ -3,9 +3,11 @@ using System.Net;
 using Bit.Api.IntegrationTest.Factories;
 using Bit.Api.IntegrationTest.Helpers;
 using Bit.Api.KeyManagement.Models.Requests;
+using Bit.Api.KeyManagement.Models.Responses;
 using Bit.Api.Tools.Models.Request;
 using Bit.Api.Vault.Models;
 using Bit.Api.Vault.Models.Request;
+using Bit.Core.AdminConsole.Entities;
 using Bit.Core.Auth.Entities;
 using Bit.Core.Auth.Enums;
 using Bit.Core.Auth.Models.Api.Request.Accounts;
@@ -286,20 +288,7 @@ public class AccountsKeyManagementControllerTests : IClassFixture<ApiApplication
     public async Task PostSetKeyConnectorKeyAsync_Success(string organizationSsoIdentifier,
         SetKeyConnectorKeyRequestModel request)
     {
-        var (organization, _) = await OrganizationTestHelpers.SignUpAsync(_factory,
-            PlanType.EnterpriseAnnually, _ownerEmail, passwordManagerSeats: 10,
-            paymentMethod: PaymentMethodType.Card);
-        organization.UseKeyConnector = true;
-        organization.UseSso = true;
-        organization.Identifier = organizationSsoIdentifier;
-        await _organizationRepository.ReplaceAsync(organization);
-
-        var ssoUserEmail = $"integration-test{Guid.NewGuid()}@bitwarden.com";
-        await _factory.LoginWithNewAccount(ssoUserEmail);
-        await _loginHelper.LoginAsync(ssoUserEmail);
-
-        await OrganizationTestHelpers.CreateUserAsync(_factory, organization.Id, ssoUserEmail,
-            OrganizationUserType.User, userStatusType: OrganizationUserStatusType.Invited);
+        var (ssoUserEmail, organization) = await SetupKeyConnectorTestAsync(OrganizationUserStatusType.Invited, organizationSsoIdentifier);
 
         var ssoUser = await _userRepository.GetByEmailAsync(ssoUserEmail);
         Assert.NotNull(ssoUser);
@@ -340,19 +329,7 @@ public class AccountsKeyManagementControllerTests : IClassFixture<ApiApplication
     [Fact]
     public async Task PostConvertToKeyConnectorAsync_Success()
     {
-        var (organization, _) = await OrganizationTestHelpers.SignUpAsync(_factory,
-            PlanType.EnterpriseAnnually, _ownerEmail, passwordManagerSeats: 10,
-            paymentMethod: PaymentMethodType.Card);
-        organization.UseKeyConnector = true;
-        organization.UseSso = true;
-        await _organizationRepository.ReplaceAsync(organization);
-
-        var ssoUserEmail = $"integration-test{Guid.NewGuid()}@bitwarden.com";
-        await _factory.LoginWithNewAccount(ssoUserEmail);
-        await _loginHelper.LoginAsync(ssoUserEmail);
-
-        await OrganizationTestHelpers.CreateUserAsync(_factory, organization.Id, ssoUserEmail,
-            OrganizationUserType.User, userStatusType: OrganizationUserStatusType.Accepted);
+        var (ssoUserEmail, organization) = await SetupKeyConnectorTestAsync(OrganizationUserStatusType.Accepted);
 
         var response = await _client.PostAsJsonAsync("/accounts/convert-to-key-connector", new { });
         response.EnsureSuccessStatusCode();
@@ -556,4 +533,41 @@ public class AccountsKeyManagementControllerTests : IClassFixture<ApiApplication
         Assert.Equal(request.AccountUnlockData.MasterPasswordUnlockData.KdfMemory, userNewState.KdfMemory);
         Assert.Equal(request.AccountUnlockData.MasterPasswordUnlockData.KdfParallelism, userNewState.KdfParallelism);
     }
+
+    [Fact]
+    public async Task GetKeyConnectorConfirmationDetailsAsync_Success()
+    {
+        var (ssoUserEmail, organization) = await SetupKeyConnectorTestAsync(OrganizationUserStatusType.Invited);
+
+        await OrganizationTestHelpers.CreateUserAsync(_factory, organization.Id, ssoUserEmail,
+            OrganizationUserType.User, userStatusType: OrganizationUserStatusType.Accepted);
+
+        var response = await _client.GetAsync($"/accounts/key-connector/confirmation-details/{organization.Identifier}");
+        response.EnsureSuccessStatusCode();
+        var result = await response.Content.ReadFromJsonAsync<KeyConnectorConfirmationDetailsResponseModel>();
+
+        Assert.NotNull(result);
+        Assert.Equal(organization.Name, result.OrganizationName);
+    }
+
+    private async Task<(string, Organization)> SetupKeyConnectorTestAsync(OrganizationUserStatusType userStatusType,
+        string organizationSsoIdentifier = "test-sso-identifier")
+    {
+        var (organization, _) = await OrganizationTestHelpers.SignUpAsync(_factory,
+            PlanType.EnterpriseAnnually, _ownerEmail, passwordManagerSeats: 10,
+            paymentMethod: PaymentMethodType.Card);
+        organization.UseKeyConnector = true;
+        organization.UseSso = true;
+        organization.Identifier = organizationSsoIdentifier;
+        await _organizationRepository.ReplaceAsync(organization);
+
+        var ssoUserEmail = $"integration-test{Guid.NewGuid()}@bitwarden.com";
+        await _factory.LoginWithNewAccount(ssoUserEmail);
+        await _loginHelper.LoginAsync(ssoUserEmail);
+
+        await OrganizationTestHelpers.CreateUserAsync(_factory, organization.Id, ssoUserEmail,
+            OrganizationUserType.User, userStatusType: userStatusType);
+
+        return (ssoUserEmail, organization);
+    }
 }

test/Api.Test/Billing/Controllers/ProviderBillingControllerTests.cs

@@ -1,5 +1,4 @@
 using Bit.Api.Billing.Controllers;
-using Bit.Api.Billing.Models.Requests;
 using Bit.Api.Billing.Models.Responses;
 using Bit.Core.AdminConsole.Entities.Provider;
 using Bit.Core.AdminConsole.Enums.Provider;
@@ -11,8 +10,6 @@ using Bit.Core.Billing.Pricing;
 using Bit.Core.Billing.Providers.Entities;
 using Bit.Core.Billing.Providers.Repositories;
 using Bit.Core.Billing.Providers.Services;
-using Bit.Core.Billing.Services;
-using Bit.Core.Billing.Tax.Models;
 using Bit.Core.Context;
 using Bit.Core.Models.Api;
 using Bit.Core.Models.BitStripe;
@@ -521,49 +518,4 @@ public class ProviderBillingControllerTests
     }
 
     #endregion
-
-    #region UpdateTaxInformationAsync
-
-    [Theory, BitAutoData]
-    public async Task UpdateTaxInformation_NoCountry_BadRequest(
-        Provider provider,
-        TaxInformationRequestBody requestBody,
-        SutProvider<ProviderBillingController> sutProvider)
-    {
-        ConfigureStableProviderAdminInputs(provider, sutProvider);
-
-        requestBody.Country = null;
-
-        var result = await sutProvider.Sut.UpdateTaxInformationAsync(provider.Id, requestBody);
-
-        Assert.IsType<BadRequest<ErrorResponseModel>>(result);
-
-        var response = (BadRequest<ErrorResponseModel>)result;
-
-        Assert.Equal("Country and postal code are required to update your tax information.", response.Value.Message);
-    }
-
-    [Theory, BitAutoData]
-    public async Task UpdateTaxInformation_Ok(
-        Provider provider,
-        TaxInformationRequestBody requestBody,
-        SutProvider<ProviderBillingController> sutProvider)
-    {
-        ConfigureStableProviderAdminInputs(provider, sutProvider);
-
-        await sutProvider.Sut.UpdateTaxInformationAsync(provider.Id, requestBody);
-
-        await sutProvider.GetDependency<ISubscriberService>().Received(1).UpdateTaxInformation(
-            provider, Arg.Is<TaxInformation>(
-                options =>
-                    options.Country == requestBody.Country &&
-                    options.PostalCode == requestBody.PostalCode &&
-                    options.TaxId == requestBody.TaxId &&
-                    options.Line1 == requestBody.Line1 &&
-                    options.Line2 == requestBody.Line2 &&
-                    options.City == requestBody.City &&
-                    options.State == requestBody.State));
-    }
-
-    #endregion
 }

test/Api.Test/KeyManagement/Controllers/AccountsKeyManagementControllerTests.cs

@@ -16,6 +16,7 @@ using Bit.Core.Exceptions;
 using Bit.Core.KeyManagement.Commands.Interfaces;
 using Bit.Core.KeyManagement.Models.Api.Request;
 using Bit.Core.KeyManagement.Models.Data;
+using Bit.Core.KeyManagement.Queries.Interfaces;
 using Bit.Core.KeyManagement.UserKey;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
@@ -363,4 +364,39 @@ public class AccountsKeyManagementControllerTests
         await sutProvider.GetDependency<IUserService>().Received(1)
             .ConvertToKeyConnectorAsync(Arg.Is(expectedUser));
     }
+
+    [Theory]
+    [BitAutoData]
+    public async Task GetKeyConnectorConfirmationDetailsAsync_NoUser_Throws(
+        SutProvider<AccountsKeyManagementController> sutProvider, string orgSsoIdentifier)
+    {
+        sutProvider.GetDependency<IUserService>().GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>())
+            .ReturnsNull();
+
+        await Assert.ThrowsAsync<UnauthorizedAccessException>(() =>
+            sutProvider.Sut.GetKeyConnectorConfirmationDetailsAsync(orgSsoIdentifier));
+
+        await sutProvider.GetDependency<IKeyConnectorConfirmationDetailsQuery>().ReceivedWithAnyArgs(0)
+            .Run(Arg.Any<string>(), Arg.Any<Guid>());
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task GetKeyConnectorConfirmationDetailsAsync_Success(
+        SutProvider<AccountsKeyManagementController> sutProvider, User expectedUser, string orgSsoIdentifier)
+    {
+        sutProvider.GetDependency<IUserService>().GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>())
+            .Returns(expectedUser);
+        sutProvider.GetDependency<IKeyConnectorConfirmationDetailsQuery>().Run(orgSsoIdentifier, expectedUser.Id)
+            .Returns(
+                new KeyConnectorConfirmationDetails { OrganizationName = "test" }
+            );
+
+        var result = await sutProvider.Sut.GetKeyConnectorConfirmationDetailsAsync(orgSsoIdentifier);
+
+        Assert.NotNull(result);
+        Assert.Equal("test", result.OrganizationName);
+        await sutProvider.GetDependency<IKeyConnectorConfirmationDetailsQuery>().Received(1)
+            .Run(orgSsoIdentifier, expectedUser.Id);
+    }
 }

test/Api.Test/Vault/Controllers/CiphersControllerTests.cs

@@ -1909,4 +1909,237 @@ public class CiphersControllerTests
 
         await Assert.ThrowsAsync<NotFoundException>(() => sutProvider.Sut.PostPurge(model, organizationId));
     }
+
+    [Theory, BitAutoData]
+    public async Task PutShare_WithNullFolderAndFalseFavorite_UpdatesFieldsCorrectly(
+        Guid cipherId,
+        Guid userId,
+        Guid organizationId,
+        Guid folderId,
+        SutProvider<CiphersController> sutProvider)
+    {
+        var user = new User { Id = userId };
+        var userIdKey = userId.ToString().ToUpperInvariant();
+
+        var existingCipher = new Cipher
+        {
+            Id = cipherId,
+            UserId = userId,
+            Type = CipherType.Login,
+            Data = JsonSerializer.Serialize(new { Username = "test", Password = "test" }),
+            Folders = JsonSerializer.Serialize(new Dictionary<string, object> { { userIdKey, folderId.ToString().ToUpperInvariant() } }),
+            Favorites = JsonSerializer.Serialize(new Dictionary<string, object> { { userIdKey, true } })
+        };
+
+        // Clears folder and favorite when sharing
+        var model = new CipherShareRequestModel
+        {
+            Cipher = new CipherRequestModel
+            {
+                Type = CipherType.Login,
+                OrganizationId = organizationId.ToString(),
+                Name = "SharedCipher",
+                Data = JsonSerializer.Serialize(new { Username = "test", Password = "test" }),
+                FolderId = null,
+                Favorite = false,
+                EncryptedFor = userId
+            },
+            CollectionIds = [Guid.NewGuid().ToString()]
+        };
+
+        sutProvider.GetDependency<IUserService>()
+            .GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>())
+            .Returns(user);
+
+        sutProvider.GetDependency<ICipherRepository>()
+            .GetByIdAsync(cipherId)
+            .Returns(existingCipher);
+
+        sutProvider.GetDependency<ICurrentContext>()
+            .OrganizationUser(organizationId)
+            .Returns(true);
+
+        var sharedCipher = new CipherDetails
+        {
+            Id = cipherId,
+            OrganizationId = organizationId,
+            Type = CipherType.Login,
+            Data = JsonSerializer.Serialize(new { Username = "test", Password = "test" }),
+            FolderId = null,
+            Favorite = false
+        };
+
+        sutProvider.GetDependency<ICipherRepository>()
+            .GetByIdAsync(cipherId, userId)
+            .Returns(sharedCipher);
+
+        sutProvider.GetDependency<IApplicationCacheService>()
+            .GetOrganizationAbilitiesAsync()
+            .Returns(new Dictionary<Guid, OrganizationAbility>
+            {
+                { organizationId, new OrganizationAbility { Id = organizationId } }
+            });
+
+        var result = await sutProvider.Sut.PutShare(cipherId, model);
+
+        Assert.Null(result.FolderId);
+        Assert.False(result.Favorite);
+    }
+
+    [Theory, BitAutoData]
+    public async Task PutShare_WithFolderAndFavoriteSet_AddsUserSpecificFields(
+        Guid cipherId,
+        Guid userId,
+        Guid organizationId,
+        Guid folderId,
+        SutProvider<CiphersController> sutProvider)
+    {
+        var user = new User { Id = userId };
+        var userIdKey = userId.ToString().ToUpperInvariant();
+
+        var existingCipher = new Cipher
+        {
+            Id = cipherId,
+            UserId = userId,
+            Type = CipherType.Login,
+            Data = JsonSerializer.Serialize(new { Username = "test", Password = "test" }),
+            Folders = null,
+            Favorites = null
+        };
+
+        // Sets folder and favorite when sharing
+        var model = new CipherShareRequestModel
+        {
+            Cipher = new CipherRequestModel
+            {
+                Type = CipherType.Login,
+                OrganizationId = organizationId.ToString(),
+                Name = "SharedCipher",
+                Data = JsonSerializer.Serialize(new { Username = "test", Password = "test" }),
+                FolderId = folderId.ToString(),
+                Favorite = true,
+                EncryptedFor = userId
+            },
+            CollectionIds = [Guid.NewGuid().ToString()]
+        };
+
+        sutProvider.GetDependency<IUserService>()
+            .GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>())
+            .Returns(user);
+
+        sutProvider.GetDependency<ICipherRepository>()
+            .GetByIdAsync(cipherId)
+            .Returns(existingCipher);
+
+        sutProvider.GetDependency<ICurrentContext>()
+            .OrganizationUser(organizationId)
+            .Returns(true);
+
+        var sharedCipher = new CipherDetails
+        {
+            Id = cipherId,
+            OrganizationId = organizationId,
+            Type = CipherType.Login,
+            Data = JsonSerializer.Serialize(new { Username = "test", Password = "test" }),
+            Folders = JsonSerializer.Serialize(new Dictionary<string, object> { { userIdKey, folderId.ToString().ToUpperInvariant() } }),
+            Favorites = JsonSerializer.Serialize(new Dictionary<string, object> { { userIdKey, true } }),
+            FolderId = folderId,
+            Favorite = true
+        };
+
+        sutProvider.GetDependency<ICipherRepository>()
+            .GetByIdAsync(cipherId, userId)
+            .Returns(sharedCipher);
+
+        sutProvider.GetDependency<IApplicationCacheService>()
+            .GetOrganizationAbilitiesAsync()
+            .Returns(new Dictionary<Guid, OrganizationAbility>
+            {
+                { organizationId, new OrganizationAbility { Id = organizationId } }
+            });
+
+        var result = await sutProvider.Sut.PutShare(cipherId, model);
+
+        Assert.Equal(folderId, result.FolderId);
+        Assert.True(result.Favorite);
+    }
+
+    [Theory, BitAutoData]
+    public async Task PutShare_UpdateExistingFolderAndFavorite_UpdatesUserSpecificFields(
+        Guid cipherId,
+        Guid userId,
+        Guid organizationId,
+        Guid oldFolderId,
+        Guid newFolderId,
+        SutProvider<CiphersController> sutProvider)
+    {
+        var user = new User { Id = userId };
+        var userIdKey = userId.ToString().ToUpperInvariant();
+
+        // Existing cipher with old folder and not favorited
+        var existingCipher = new Cipher
+        {
+            Id = cipherId,
+            UserId = userId,
+            Type = CipherType.Login,
+            Data = JsonSerializer.Serialize(new { Username = "test", Password = "test" }),
+            Folders = JsonSerializer.Serialize(new Dictionary<string, object> { { userIdKey, oldFolderId.ToString().ToUpperInvariant() } }),
+            Favorites = null
+        };
+
+        var model = new CipherShareRequestModel
+        {
+            Cipher = new CipherRequestModel
+            {
+                Type = CipherType.Login,
+                OrganizationId = organizationId.ToString(),
+                Name = "SharedCipher",
+                Data = JsonSerializer.Serialize(new { Username = "test", Password = "test" }),
+                FolderId = newFolderId.ToString(),  // Update to new folder
+                Favorite = true,  // Add favorite
+                EncryptedFor = userId
+            },
+            CollectionIds = [Guid.NewGuid().ToString()]
+        };
+
+        sutProvider.GetDependency<IUserService>()
+            .GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>())
+            .Returns(user);
+
+        sutProvider.GetDependency<ICipherRepository>()
+            .GetByIdAsync(cipherId)
+            .Returns(existingCipher);
+
+        sutProvider.GetDependency<ICurrentContext>()
+            .OrganizationUser(organizationId)
+            .Returns(true);
+
+        var sharedCipher = new CipherDetails
+        {
+            Id = cipherId,
+            OrganizationId = organizationId,
+            Type = CipherType.Login,
+            Data = JsonSerializer.Serialize(new { Username = "test", Password = "test" }),
+            Folders = JsonSerializer.Serialize(new Dictionary<string, object> { { userIdKey, newFolderId.ToString().ToUpperInvariant() } }),
+            Favorites = JsonSerializer.Serialize(new Dictionary<string, object> { { userIdKey, true } }),
+            FolderId = newFolderId,
+            Favorite = true
+        };
+
+        sutProvider.GetDependency<ICipherRepository>()
+            .GetByIdAsync(cipherId, userId)
+            .Returns(sharedCipher);
+
+        sutProvider.GetDependency<IApplicationCacheService>()
+            .GetOrganizationAbilitiesAsync()
+            .Returns(new Dictionary<Guid, OrganizationAbility>
+            {
+                { organizationId, new OrganizationAbility { Id = organizationId } }
+            });
+
+        var result = await sutProvider.Sut.PutShare(cipherId, model);
+
+        Assert.Equal(newFolderId, result.FolderId);
+        Assert.True(result.Favorite);
+    }
 }

test/Billing.Test/Billing.Test.csproj

@@ -5,8 +5,8 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Divergic.Logging.Xunit" Version="4.3.0" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="$(MicrosoftNetTestSdkVersion)" />
+    <PackageReference Include="Neovolve.Logging.Xunit" Version="6.3.0" />
     <PackageReference Include="RichardSzalay.MockHttp" Version="7.0.0" />
     <PackageReference Include="xunit" Version="$(XUnitVersion)" />
     <PackageReference Include="xunit.runner.visualstudio" Version="$(XUnitRunnerVisualStudioVersion)">

test/Billing.Test/Controllers/PayPalControllerTests.cs

@@ -8,13 +8,13 @@ using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
-using Divergic.Logging.Xunit;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.Infrastructure;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
 using Microsoft.Extensions.Primitives;
+using Neovolve.Logging.Xunit;
 using NSubstitute;
 using NSubstitute.ReturnsExtensions;
 using Xunit;
@@ -23,10 +23,8 @@ using Transaction = Bit.Core.Entities.Transaction;
 
 namespace Bit.Billing.Test.Controllers;
 
-public class PayPalControllerTests
+public class PayPalControllerTests(ITestOutputHelper testOutputHelper)
 {
-    private readonly ITestOutputHelper _testOutputHelper;
-
     private readonly IOptions<BillingSettings> _billingSettings = Substitute.For<IOptions<BillingSettings>>();
     private readonly IMailService _mailService = Substitute.For<IMailService>();
     private readonly IOrganizationRepository _organizationRepository = Substitute.For<IOrganizationRepository>();
@@ -38,15 +36,10 @@ public class PayPalControllerTests
 
     private const string _defaultWebhookKey = "webhook-key";
 
-    public PayPalControllerTests(ITestOutputHelper testOutputHelper)
-    {
-        _testOutputHelper = testOutputHelper;
-    }
-
     [Fact]
     public async Task PostIpn_NullKey_BadRequest()
     {
-        var logger = _testOutputHelper.BuildLoggerFor<PayPalController>();
+        var logger = testOutputHelper.BuildLoggerFor<PayPalController>();
 
         var controller = ConfigureControllerContextWith(logger, null, null);
 
@@ -60,7 +53,7 @@ public class PayPalControllerTests
     [Fact]
     public async Task PostIpn_IncorrectKey_BadRequest()
     {
-        var logger = _testOutputHelper.BuildLoggerFor<PayPalController>();
+        var logger = testOutputHelper.BuildLoggerFor<PayPalController>();
 
         _billingSettings.Value.Returns(new BillingSettings
         {
@@ -79,7 +72,7 @@ public class PayPalControllerTests
     [Fact]
     public async Task PostIpn_EmptyIPNBody_BadRequest()
     {
-        var logger = _testOutputHelper.BuildLoggerFor<PayPalController>();
+        var logger = testOutputHelper.BuildLoggerFor<PayPalController>();
 
         _billingSettings.Value.Returns(new BillingSettings
         {
@@ -98,7 +91,7 @@ public class PayPalControllerTests
     [Fact]
     public async Task PostIpn_IPNHasNoEntityId_BadRequest()
     {
-        var logger = _testOutputHelper.BuildLoggerFor<PayPalController>();
+        var logger = testOutputHelper.BuildLoggerFor<PayPalController>();
 
         _billingSettings.Value.Returns(new BillingSettings
         {
@@ -119,15 +112,13 @@ public class PayPalControllerTests
     [Fact]
     public async Task PostIpn_OtherTransactionType_Unprocessed_Ok()
     {
-        var logger = _testOutputHelper.BuildLoggerFor<PayPalController>();
+        var logger = testOutputHelper.BuildLoggerFor<PayPalController>();
 
         _billingSettings.Value.Returns(new BillingSettings
         {
             PayPal = { WebhookKey = _defaultWebhookKey }
         });
 
-        var organizationId = new Guid("ca8c6f2b-2d7b-4639-809f-b0e5013a304e");
-
         var ipnBody = await PayPalTestIPN.GetAsync(IPNBody.UnsupportedTransactionType);
 
         var controller = ConfigureControllerContextWith(logger, _defaultWebhookKey, ipnBody);
@@ -142,7 +133,7 @@ public class PayPalControllerTests
     [Fact]
     public async Task PostIpn_MismatchedReceiverID_Unprocessed_Ok()
     {
-        var logger = _testOutputHelper.BuildLoggerFor<PayPalController>();
+        var logger = testOutputHelper.BuildLoggerFor<PayPalController>();
 
         _billingSettings.Value.Returns(new BillingSettings
         {
@@ -153,8 +144,6 @@ public class PayPalControllerTests
             }
         });
 
-        var organizationId = new Guid("ca8c6f2b-2d7b-4639-809f-b0e5013a304e");
-
         var ipnBody = await PayPalTestIPN.GetAsync(IPNBody.SuccessfulPayment);
 
         var controller = ConfigureControllerContextWith(logger, _defaultWebhookKey, ipnBody);
@@ -169,7 +158,7 @@ public class PayPalControllerTests
     [Fact]
     public async Task PostIpn_RefundMissingParent_Unprocessed_Ok()
     {
-        var logger = _testOutputHelper.BuildLoggerFor<PayPalController>();
+        var logger = testOutputHelper.BuildLoggerFor<PayPalController>();
 
         _billingSettings.Value.Returns(new BillingSettings
         {
@@ -180,8 +169,6 @@ public class PayPalControllerTests
             }
         });
 
-        var organizationId = new Guid("ca8c6f2b-2d7b-4639-809f-b0e5013a304e");
-
         var ipnBody = await PayPalTestIPN.GetAsync(IPNBody.RefundMissingParentTransaction);
 
         var controller = ConfigureControllerContextWith(logger, _defaultWebhookKey, ipnBody);
@@ -196,7 +183,7 @@ public class PayPalControllerTests
     [Fact]
     public async Task PostIpn_eCheckPayment_Unprocessed_Ok()
     {
-        var logger = _testOutputHelper.BuildLoggerFor<PayPalController>();
+        var logger = testOutputHelper.BuildLoggerFor<PayPalController>();
 
         _billingSettings.Value.Returns(new BillingSettings
         {
@@ -207,8 +194,6 @@ public class PayPalControllerTests
             }
         });
 
-        var organizationId = new Guid("ca8c6f2b-2d7b-4639-809f-b0e5013a304e");
-
         var ipnBody = await PayPalTestIPN.GetAsync(IPNBody.ECheckPayment);
 
         var controller = ConfigureControllerContextWith(logger, _defaultWebhookKey, ipnBody);
@@ -223,7 +208,7 @@ public class PayPalControllerTests
     [Fact]
     public async Task PostIpn_NonUSD_Unprocessed_Ok()
     {
-        var logger = _testOutputHelper.BuildLoggerFor<PayPalController>();
+        var logger = testOutputHelper.BuildLoggerFor<PayPalController>();
 
         _billingSettings.Value.Returns(new BillingSettings
         {
@@ -234,8 +219,6 @@ public class PayPalControllerTests
             }
         });
 
-        var organizationId = new Guid("ca8c6f2b-2d7b-4639-809f-b0e5013a304e");
-
         var ipnBody = await PayPalTestIPN.GetAsync(IPNBody.NonUSDPayment);
 
         var controller = ConfigureControllerContextWith(logger, _defaultWebhookKey, ipnBody);
@@ -250,7 +233,7 @@ public class PayPalControllerTests
     [Fact]
     public async Task PostIpn_Completed_ExistingTransaction_Unprocessed_Ok()
     {
-        var logger = _testOutputHelper.BuildLoggerFor<PayPalController>();
+        var logger = testOutputHelper.BuildLoggerFor<PayPalController>();
 
         _billingSettings.Value.Returns(new BillingSettings
         {
@@ -261,8 +244,6 @@ public class PayPalControllerTests
             }
         });
 
-        var organizationId = new Guid("ca8c6f2b-2d7b-4639-809f-b0e5013a304e");
-
         var ipnBody = await PayPalTestIPN.GetAsync(IPNBody.SuccessfulPayment);
 
         _transactionRepository.GetByGatewayIdAsync(
@@ -281,7 +262,7 @@ public class PayPalControllerTests
     [Fact]
     public async Task PostIpn_Completed_CreatesTransaction_Ok()
     {
-        var logger = _testOutputHelper.BuildLoggerFor<PayPalController>();
+        var logger = testOutputHelper.BuildLoggerFor<PayPalController>();
 
         _billingSettings.Value.Returns(new BillingSettings
         {
@@ -292,8 +273,6 @@ public class PayPalControllerTests
             }
         });
 
-        var organizationId = new Guid("ca8c6f2b-2d7b-4639-809f-b0e5013a304e");
-
         var ipnBody = await PayPalTestIPN.GetAsync(IPNBody.SuccessfulPayment);
 
         _transactionRepository.GetByGatewayIdAsync(
@@ -314,7 +293,7 @@ public class PayPalControllerTests
     [Fact]
     public async Task PostIpn_Completed_CreatesTransaction_CreditsOrganizationAccount_Ok()
     {
-        var logger = _testOutputHelper.BuildLoggerFor<PayPalController>();
+        var logger = testOutputHelper.BuildLoggerFor<PayPalController>();
 
         _billingSettings.Value.Returns(new BillingSettings
         {
@@ -362,7 +341,7 @@ public class PayPalControllerTests
     [Fact]
     public async Task PostIpn_Completed_CreatesTransaction_CreditsUserAccount_Ok()
     {
-        var logger = _testOutputHelper.BuildLoggerFor<PayPalController>();
+        var logger = testOutputHelper.BuildLoggerFor<PayPalController>();
 
         _billingSettings.Value.Returns(new BillingSettings
         {
@@ -406,7 +385,7 @@ public class PayPalControllerTests
     [Fact]
     public async Task PostIpn_Refunded_ExistingTransaction_Unprocessed_Ok()
     {
-        var logger = _testOutputHelper.BuildLoggerFor<PayPalController>();
+        var logger = testOutputHelper.BuildLoggerFor<PayPalController>();
 
         _billingSettings.Value.Returns(new BillingSettings
         {
@@ -417,8 +396,6 @@ public class PayPalControllerTests
             }
         });
 
-        var organizationId = new Guid("ca8c6f2b-2d7b-4639-809f-b0e5013a304e");
-
         var ipnBody = await PayPalTestIPN.GetAsync(IPNBody.SuccessfulRefund);
 
         _transactionRepository.GetByGatewayIdAsync(
@@ -441,7 +418,7 @@ public class PayPalControllerTests
     [Fact]
     public async Task PostIpn_Refunded_MissingParentTransaction_Ok()
     {
-        var logger = _testOutputHelper.BuildLoggerFor<PayPalController>();
+        var logger = testOutputHelper.BuildLoggerFor<PayPalController>();
 
         _billingSettings.Value.Returns(new BillingSettings
         {
@@ -452,8 +429,6 @@ public class PayPalControllerTests
             }
         });
 
-        var organizationId = new Guid("ca8c6f2b-2d7b-4639-809f-b0e5013a304e");
-
         var ipnBody = await PayPalTestIPN.GetAsync(IPNBody.SuccessfulRefund);
 
         _transactionRepository.GetByGatewayIdAsync(
@@ -480,7 +455,7 @@ public class PayPalControllerTests
     [Fact]
     public async Task PostIpn_Refunded_ReplacesParent_CreatesTransaction_Ok()
     {
-        var logger = _testOutputHelper.BuildLoggerFor<PayPalController>();
+        var logger = testOutputHelper.BuildLoggerFor<PayPalController>();
 
         _billingSettings.Value.Returns(new BillingSettings
         {
@@ -531,8 +506,8 @@ public class PayPalControllerTests
 
     private PayPalController ConfigureControllerContextWith(
         ILogger<PayPalController> logger,
-        string webhookKey,
-        string ipnBody)
+        string? webhookKey,
+        string? ipnBody)
     {
         var controller = new PayPalController(
             _billingSettings,
@@ -578,16 +553,16 @@ public class PayPalControllerTests
         Assert.Equal(statusCode, statusCodeActionResult.StatusCode);
     }
 
-    private static void Logged(ICacheLogger logger, LogLevel logLevel, string message)
+    private static void Logged(ICacheLogger<PayPalController> logger, LogLevel logLevel, string message)
     {
         Assert.NotNull(logger.Last);
         Assert.Equal(logLevel, logger.Last!.LogLevel);
         Assert.Equal(message, logger.Last!.Message);
     }
 
-    private static void LoggedError(ICacheLogger logger, string message)
+    private static void LoggedError(ICacheLogger<PayPalController> logger, string message)
         => Logged(logger, LogLevel.Error, message);
 
-    private static void LoggedWarning(ICacheLogger logger, string message)
+    private static void LoggedWarning(ICacheLogger<PayPalController> logger, string message)
         => Logged(logger, LogLevel.Warning, message);
 }

test/Core.IntegrationTest/Core.IntegrationTest.csproj

@@ -12,7 +12,7 @@
   <ItemGroup>
     <PackageReference Include="coverlet.collector" Version="6.0.4" />
     <PackageReference Include="MartinCostello.Logging.XUnit" Version="0.7.0" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.8.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="$(MicrosoftNetTestSdkVersion)" />
     <PackageReference Include="Rnwood.SmtpServer" Version="3.1.0-ci0868" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />

test/Core.Test/Auth/Entities/AuthRequestTests.cs

@@ -0,0 +1,224 @@
+using Bit.Core.Auth.Entities;
+using Bit.Core.Auth.Enums;
+using Xunit;
+
+namespace Bit.Core.Test.Auth.Entities;
+
+public class AuthRequestTests
+{
+    [Fact]
+    public void IsValidForAuthentication_WithValidRequest_ReturnsTrue()
+    {
+        // Arrange
+        var userId = Guid.NewGuid();
+        var accessCode = "test-access-code";
+        var authRequest = new AuthRequest
+        {
+            UserId = userId,
+            Type = AuthRequestType.AuthenticateAndUnlock,
+            ResponseDate = DateTime.UtcNow,
+            Approved = true,
+            CreationDate = DateTime.UtcNow,
+            AuthenticationDate = null,
+            AccessCode = accessCode
+        };
+
+        // Act
+        var result = authRequest.IsValidForAuthentication(userId, accessCode);
+
+        // Assert
+        Assert.True(result);
+    }
+
+    [Fact]
+    public void IsValidForAuthentication_WithWrongUserId_ReturnsFalse()
+    {
+        // Arrange
+        var userId = Guid.NewGuid();
+        var differentUserId = Guid.NewGuid();
+        var accessCode = "test-access-code";
+        var authRequest = new AuthRequest
+        {
+            UserId = userId,
+            Type = AuthRequestType.AuthenticateAndUnlock,
+            ResponseDate = DateTime.UtcNow,
+            Approved = true,
+            CreationDate = DateTime.UtcNow,
+            AuthenticationDate = null,
+            AccessCode = accessCode
+        };
+
+        // Act
+        var result = authRequest.IsValidForAuthentication(differentUserId, accessCode);
+
+        // Assert
+        Assert.False(result, "Auth request should not validate for a different user");
+    }
+
+    [Fact]
+    public void IsValidForAuthentication_WithWrongAccessCode_ReturnsFalse()
+    {
+        // Arrange
+        var userId = Guid.NewGuid();
+        var authRequest = new AuthRequest
+        {
+            UserId = userId,
+            Type = AuthRequestType.AuthenticateAndUnlock,
+            ResponseDate = DateTime.UtcNow,
+            Approved = true,
+            CreationDate = DateTime.UtcNow,
+            AuthenticationDate = null,
+            AccessCode = "correct-code"
+        };
+
+        // Act
+        var result = authRequest.IsValidForAuthentication(userId, "wrong-code");
+
+        // Assert
+        Assert.False(result);
+    }
+
+    [Fact]
+    public void IsValidForAuthentication_WithoutResponseDate_ReturnsFalse()
+    {
+        // Arrange
+        var userId = Guid.NewGuid();
+        var accessCode = "test-access-code";
+        var authRequest = new AuthRequest
+        {
+            UserId = userId,
+            Type = AuthRequestType.AuthenticateAndUnlock,
+            ResponseDate = null, // Not responded to
+            Approved = true,
+            CreationDate = DateTime.UtcNow,
+            AuthenticationDate = null,
+            AccessCode = accessCode
+        };
+
+        // Act
+        var result = authRequest.IsValidForAuthentication(userId, accessCode);
+
+        // Assert
+        Assert.False(result, "Unanswered auth requests should not be valid");
+    }
+
+    [Fact]
+    public void IsValidForAuthentication_WithApprovedFalse_ReturnsFalse()
+    {
+        // Arrange
+        var userId = Guid.NewGuid();
+        var accessCode = "test-access-code";
+        var authRequest = new AuthRequest
+        {
+            UserId = userId,
+            Type = AuthRequestType.AuthenticateAndUnlock,
+            ResponseDate = DateTime.UtcNow,
+            Approved = false, // Denied
+            CreationDate = DateTime.UtcNow,
+            AuthenticationDate = null,
+            AccessCode = accessCode
+        };
+
+        // Act
+        var result = authRequest.IsValidForAuthentication(userId, accessCode);
+
+        // Assert
+        Assert.False(result, "Denied auth requests should not be valid");
+    }
+
+    [Fact]
+    public void IsValidForAuthentication_WithApprovedNull_ReturnsFalse()
+    {
+        // Arrange
+        var userId = Guid.NewGuid();
+        var accessCode = "test-access-code";
+        var authRequest = new AuthRequest
+        {
+            UserId = userId,
+            Type = AuthRequestType.AuthenticateAndUnlock,
+            ResponseDate = DateTime.UtcNow,
+            Approved = null, // Pending
+            CreationDate = DateTime.UtcNow,
+            AuthenticationDate = null,
+            AccessCode = accessCode
+        };
+
+        // Act
+        var result = authRequest.IsValidForAuthentication(userId, accessCode);
+
+        // Assert
+        Assert.False(result, "Pending auth requests should not be valid");
+    }
+
+    [Fact]
+    public void IsValidForAuthentication_WithExpiredRequest_ReturnsFalse()
+    {
+        // Arrange
+        var userId = Guid.NewGuid();
+        var accessCode = "test-access-code";
+        var authRequest = new AuthRequest
+        {
+            UserId = userId,
+            Type = AuthRequestType.AuthenticateAndUnlock,
+            ResponseDate = DateTime.UtcNow,
+            Approved = true,
+            CreationDate = DateTime.UtcNow.AddMinutes(-20), // Expired (15 min timeout)
+            AuthenticationDate = null,
+            AccessCode = accessCode
+        };
+
+        // Act
+        var result = authRequest.IsValidForAuthentication(userId, accessCode);
+
+        // Assert
+        Assert.False(result, "Expired auth requests should not be valid");
+    }
+
+    [Fact]
+    public void IsValidForAuthentication_WithWrongType_ReturnsFalse()
+    {
+        // Arrange
+        var userId = Guid.NewGuid();
+        var accessCode = "test-access-code";
+        var authRequest = new AuthRequest
+        {
+            UserId = userId,
+            Type = AuthRequestType.Unlock, // Wrong type
+            ResponseDate = DateTime.UtcNow,
+            Approved = true,
+            CreationDate = DateTime.UtcNow,
+            AuthenticationDate = null,
+            AccessCode = accessCode
+        };
+
+        // Act
+        var result = authRequest.IsValidForAuthentication(userId, accessCode);
+
+        // Assert
+        Assert.False(result, "Only AuthenticateAndUnlock type should be valid");
+    }
+
+    [Fact]
+    public void IsValidForAuthentication_WithAlreadyUsed_ReturnsFalse()
+    {
+        // Arrange
+        var userId = Guid.NewGuid();
+        var accessCode = "test-access-code";
+        var authRequest = new AuthRequest
+        {
+            UserId = userId,
+            Type = AuthRequestType.AuthenticateAndUnlock,
+            ResponseDate = DateTime.UtcNow,
+            Approved = true,
+            CreationDate = DateTime.UtcNow,
+            AuthenticationDate = DateTime.UtcNow, // Already used
+            AccessCode = accessCode
+        };
+
+        // Act
+        var result = authRequest.IsValidForAuthentication(userId, accessCode);
+
+        // Assert
+        Assert.False(result, "Auth requests should only be valid for one-time use");
+    }
+}

test/Core.Test/Billing/Extensions/InvoiceExtensionsTests.cs

@@ -1,4 +1,5 @@
-using Bit.Core.Billing.Extensions;
+using System.Globalization;
+using Bit.Core.Billing.Extensions;
 using Stripe;
 using Xunit;
 
@@ -356,9 +357,18 @@ public class InvoiceExtensionsTests
     [Fact]
     public void FormatForProvider_ComplexScenario_HandlesAllLineTypes()
     {
-        // Arrange
-        var lineItems = new StripeList<InvoiceLineItem>();
-        lineItems.Data = new List<InvoiceLineItem>
+        // Set culture to en-US to ensure consistent decimal formatting in tests
+        // This ensures tests pass on all machines regardless of system locale
+        var originalCulture = Thread.CurrentThread.CurrentCulture;
+        var originalUICulture = Thread.CurrentThread.CurrentUICulture;
+        try
+        {
+            Thread.CurrentThread.CurrentCulture = new CultureInfo("en-US");
+            Thread.CurrentThread.CurrentUICulture = new CultureInfo("en-US");
+
+            // Arrange
+            var lineItems = new StripeList<InvoiceLineItem>();
+            lineItems.Data = new List<InvoiceLineItem>
         {
             new InvoiceLineItem
             {
@@ -372,23 +382,29 @@ public class InvoiceExtensionsTests
             new InvoiceLineItem { Description = "Custom Service", Quantity = 2, Amount = 2000 }
         };
 
-        var invoice = new Invoice
+            var invoice = new Invoice
+            {
+                Lines = lineItems,
+                TotalTaxes = [new InvoiceTotalTax { Amount = 200 }] // Additional $2.00 tax
+            };
+            var subscription = new Subscription();
+
+            // Act
+            var result = invoice.FormatForProvider(subscription);
+
+            // Assert
+            Assert.Equal(5, result.Count);
+            Assert.Equal("5 × Manage service provider (at $6.00 / month)", result[0]);
+            Assert.Equal("10 × Manage service provider (at $4.00 / month)", result[1]);
+            Assert.Equal("1 × Tax (at $8.00 / month)", result[2]);
+            Assert.Equal("Custom Service", result[3]);
+            Assert.Equal("1 × Tax (at $2.00 / month)", result[4]);
+        }
+        finally
         {
-            Lines = lineItems,
-            TotalTaxes = [new InvoiceTotalTax { Amount = 200 }] // Additional $2.00 tax
-        };
-        var subscription = new Subscription();
-
-        // Act
-        var result = invoice.FormatForProvider(subscription);
-
-        // Assert
-        Assert.Equal(5, result.Count);
-        Assert.Equal("5 × Manage service provider (at $6.00 / month)", result[0]);
-        Assert.Equal("10 × Manage service provider (at $4.00 / month)", result[1]);
-        Assert.Equal("1 × Tax (at $8.00 / month)", result[2]);
-        Assert.Equal("Custom Service", result[3]);
-        Assert.Equal("1 × Tax (at $2.00 / month)", result[4]);
+            Thread.CurrentThread.CurrentCulture = originalCulture;
+            Thread.CurrentThread.CurrentUICulture = originalUICulture;
+        }
     }
 
     #endregion

test/Core.Test/Billing/Services/SubscriberServiceTests.cs

@@ -328,157 +328,6 @@ public class SubscriberServiceTests
 
     #endregion
 
-    #region GetPaymentMethod
-
-    [Theory, BitAutoData]
-    public async Task GetPaymentMethod_NullSubscriber_ThrowsArgumentNullException(
-        SutProvider<SubscriberService> sutProvider) =>
-        await Assert.ThrowsAsync<ArgumentNullException>(() => sutProvider.Sut.GetPaymentSource(null));
-
-    [Theory, BitAutoData]
-    public async Task GetPaymentMethod_WithNegativeStripeAccountBalance_ReturnsCorrectAccountCreditAmount(Organization organization,
-        SutProvider<SubscriberService> sutProvider)
-    {
-        // Arrange
-        // Stripe reports balance in cents as a negative number for credit
-        const int stripeAccountBalance = -593; // $5.93 credit (negative cents)
-        const decimal creditAmount = 5.93M;    // Same value in dollars
-
-
-        var customer = new Customer
-        {
-            Balance = stripeAccountBalance,
-            Subscriptions = new StripeList<Subscription>()
-            {
-                Data =
-                [new Subscription { Id = organization.GatewaySubscriptionId, Status = "active" }]
-            },
-            InvoiceSettings = new CustomerInvoiceSettings
-            {
-                DefaultPaymentMethod = new PaymentMethod
-                {
-                    Type = StripeConstants.PaymentMethodTypes.USBankAccount,
-                    UsBankAccount = new PaymentMethodUsBankAccount { BankName = "Chase", Last4 = "9999" }
-                }
-            }
-        };
-        sutProvider.GetDependency<IStripeAdapter>().CustomerGetAsync(organization.GatewayCustomerId,
-                Arg.Is<CustomerGetOptions>(options => options.Expand.Contains("default_source") &&
-                                                      options.Expand.Contains("invoice_settings.default_payment_method")
-                                                      && options.Expand.Contains("subscriptions")
-                                                      && options.Expand.Contains("tax_ids")))
-            .Returns(customer);
-
-        // Act
-        var result = await sutProvider.Sut.GetPaymentMethod(organization);
-
-        // Assert
-        Assert.NotNull(result);
-        Assert.Equal(creditAmount, result.AccountCredit);
-        await sutProvider.GetDependency<IStripeAdapter>().Received(1).CustomerGetAsync(
-            organization.GatewayCustomerId,
-            Arg.Is<CustomerGetOptions>(options =>
-                options.Expand.Contains("default_source") &&
-                options.Expand.Contains("invoice_settings.default_payment_method") &&
-                options.Expand.Contains("subscriptions") &&
-                options.Expand.Contains("tax_ids")));
-
-    }
-
-    [Theory, BitAutoData]
-    public async Task GetPaymentMethod_WithZeroStripeAccountBalance_ReturnsCorrectAccountCreditAmount(
-        Organization organization, SutProvider<SubscriberService> sutProvider)
-    {
-        // Arrange
-        const int stripeAccountBalance = 0;
-
-        var customer = new Customer
-        {
-            Balance = stripeAccountBalance,
-            Subscriptions = new StripeList<Subscription>()
-            {
-                Data =
-                [new Subscription { Id = organization.GatewaySubscriptionId, Status = "active" }]
-            },
-            InvoiceSettings = new CustomerInvoiceSettings
-            {
-                DefaultPaymentMethod = new PaymentMethod
-                {
-                    Type = StripeConstants.PaymentMethodTypes.USBankAccount,
-                    UsBankAccount = new PaymentMethodUsBankAccount { BankName = "Chase", Last4 = "9999" }
-                }
-            }
-        };
-        sutProvider.GetDependency<IStripeAdapter>().CustomerGetAsync(organization.GatewayCustomerId,
-                Arg.Is<CustomerGetOptions>(options => options.Expand.Contains("default_source") &&
-                                                      options.Expand.Contains("invoice_settings.default_payment_method")
-                                                      && options.Expand.Contains("subscriptions")
-                                                      && options.Expand.Contains("tax_ids")))
-            .Returns(customer);
-
-        // Act
-        var result = await sutProvider.Sut.GetPaymentMethod(organization);
-
-        // Assert
-        Assert.NotNull(result);
-        Assert.Equal(0, result.AccountCredit);
-        await sutProvider.GetDependency<IStripeAdapter>().Received(1).CustomerGetAsync(
-            organization.GatewayCustomerId,
-            Arg.Is<CustomerGetOptions>(options =>
-                options.Expand.Contains("default_source") &&
-                options.Expand.Contains("invoice_settings.default_payment_method") &&
-                options.Expand.Contains("subscriptions") &&
-                options.Expand.Contains("tax_ids")));
-    }
-
-    [Theory, BitAutoData]
-    public async Task GetPaymentMethod_WithPositiveStripeAccountBalance_ReturnsCorrectAccountCreditAmount(
-        Organization organization, SutProvider<SubscriberService> sutProvider)
-    {
-        // Arrange
-        const int stripeAccountBalance = 593; // $5.93 charge balance
-        const decimal accountBalance = -5.93M;    // account balance
-        var customer = new Customer
-        {
-            Balance = stripeAccountBalance,
-            Subscriptions = new StripeList<Subscription>()
-            {
-                Data =
-                [new Subscription { Id = organization.GatewaySubscriptionId, Status = "active" }]
-            },
-            InvoiceSettings = new CustomerInvoiceSettings
-            {
-                DefaultPaymentMethod = new PaymentMethod
-                {
-                    Type = StripeConstants.PaymentMethodTypes.USBankAccount,
-                    UsBankAccount = new PaymentMethodUsBankAccount { BankName = "Chase", Last4 = "9999" }
-                }
-            }
-        };
-        sutProvider.GetDependency<IStripeAdapter>().CustomerGetAsync(organization.GatewayCustomerId,
-                Arg.Is<CustomerGetOptions>(options => options.Expand.Contains("default_source") &&
-                                                      options.Expand.Contains("invoice_settings.default_payment_method")
-                                                      && options.Expand.Contains("subscriptions")
-                                                      && options.Expand.Contains("tax_ids")))
-            .Returns(customer);
-
-        // Act
-        var result = await sutProvider.Sut.GetPaymentMethod(organization);
-
-        // Assert
-        Assert.NotNull(result);
-        Assert.Equal(accountBalance, result.AccountCredit);
-        await sutProvider.GetDependency<IStripeAdapter>().Received(1).CustomerGetAsync(
-            organization.GatewayCustomerId,
-            Arg.Is<CustomerGetOptions>(options =>
-                options.Expand.Contains("default_source") &&
-                options.Expand.Contains("invoice_settings.default_payment_method") &&
-                options.Expand.Contains("subscriptions") &&
-                options.Expand.Contains("tax_ids")));
-
-    }
-    #endregion
-
     #region GetPaymentSource
 
     [Theory, BitAutoData]
@@ -889,65 +738,6 @@ public class SubscriberServiceTests
     }
     #endregion
 
-    #region GetTaxInformation
-
-    [Theory, BitAutoData]
-    public async Task GetTaxInformation_NullSubscriber_ThrowsArgumentNullException(
-        SutProvider<SubscriberService> sutProvider) =>
-        await Assert.ThrowsAsync<ArgumentNullException>(() => sutProvider.Sut.GetTaxInformation(null));
-
-    [Theory, BitAutoData]
-    public async Task GetTaxInformation_NullAddress_ReturnsNull(
-        Organization organization,
-        SutProvider<SubscriberService> sutProvider)
-    {
-        sutProvider.GetDependency<IStripeAdapter>().CustomerGetAsync(organization.GatewayCustomerId, Arg.Any<CustomerGetOptions>())
-            .Returns(new Customer());
-
-        var taxInformation = await sutProvider.Sut.GetTaxInformation(organization);
-
-        Assert.Null(taxInformation);
-    }
-
-    [Theory, BitAutoData]
-    public async Task GetTaxInformation_Success(
-        Organization organization,
-        SutProvider<SubscriberService> sutProvider)
-    {
-        var address = new Address
-        {
-            Country = "US",
-            PostalCode = "12345",
-            Line1 = "123 Example St.",
-            Line2 = "Unit 1",
-            City = "Example Town",
-            State = "NY"
-        };
-
-        sutProvider.GetDependency<IStripeAdapter>().CustomerGetAsync(organization.GatewayCustomerId, Arg.Any<CustomerGetOptions>())
-            .Returns(new Customer
-            {
-                Address = address,
-                TaxIds = new StripeList<TaxId>
-                {
-                    Data = [new TaxId { Value = "tax_id" }]
-                }
-            });
-
-        var taxInformation = await sutProvider.Sut.GetTaxInformation(organization);
-
-        Assert.NotNull(taxInformation);
-        Assert.Equal(address.Country, taxInformation.Country);
-        Assert.Equal(address.PostalCode, taxInformation.PostalCode);
-        Assert.Equal("tax_id", taxInformation.TaxId);
-        Assert.Equal(address.Line1, taxInformation.Line1);
-        Assert.Equal(address.Line2, taxInformation.Line2);
-        Assert.Equal(address.City, taxInformation.City);
-        Assert.Equal(address.State, taxInformation.State);
-    }
-
-    #endregion
-
     #region RemovePaymentMethod
     [Theory, BitAutoData]
     public async Task RemovePaymentMethod_NullSubscriber_ThrowsArgumentNullException(
@@ -1844,48 +1634,6 @@ public class SubscriberServiceTests
 
     #endregion
 
-    #region VerifyBankAccount
-
-    [Theory, BitAutoData]
-    public async Task VerifyBankAccount_NoSetupIntentId_ThrowsBillingException(
-        Provider provider,
-        SutProvider<SubscriberService> sutProvider) => await ThrowsBillingExceptionAsync(() => sutProvider.Sut.VerifyBankAccount(provider, ""));
-
-    [Theory, BitAutoData]
-    public async Task VerifyBankAccount_MakesCorrectInvocations(
-        Provider provider,
-        SutProvider<SubscriberService> sutProvider)
-    {
-        const string descriptorCode = "SM1234";
-
-        var setupIntent = new SetupIntent
-        {
-            Id = "setup_intent_id",
-            PaymentMethodId = "payment_method_id"
-        };
-
-        sutProvider.GetDependency<ISetupIntentCache>().GetSetupIntentIdForSubscriber(provider.Id).Returns(setupIntent.Id);
-
-        var stripeAdapter = sutProvider.GetDependency<IStripeAdapter>();
-
-        stripeAdapter.SetupIntentGet(setupIntent.Id).Returns(setupIntent);
-
-        await sutProvider.Sut.VerifyBankAccount(provider, descriptorCode);
-
-        await stripeAdapter.Received(1).SetupIntentVerifyMicroDeposit(setupIntent.Id,
-            Arg.Is<SetupIntentVerifyMicrodepositsOptions>(
-                options => options.DescriptorCode == descriptorCode));
-
-        await stripeAdapter.Received(1).PaymentMethodAttachAsync(setupIntent.PaymentMethodId,
-            Arg.Is<PaymentMethodAttachOptions>(
-                options => options.Customer == provider.GatewayCustomerId));
-
-        await stripeAdapter.Received(1).CustomerUpdateAsync(provider.GatewayCustomerId, Arg.Is<CustomerUpdateOptions>(
-            options => options.InvoiceSettings.DefaultPaymentMethod == setupIntent.PaymentMethodId));
-    }
-
-    #endregion
-
     #region IsValidGatewayCustomerIdAsync
 
     [Theory, BitAutoData]

test/Core.Test/KeyManagement/Queries/KeyConnectorConfirmationDetailsQueryTests.cs

@@ -0,0 +1,86 @@
+using Bit.Core.AdminConsole.Entities;
+using Bit.Core.Entities;
+using Bit.Core.Exceptions;
+using Bit.Core.KeyManagement.Queries;
+using Bit.Core.Repositories;
+using Bit.Test.Common.AutoFixture;
+using Bit.Test.Common.AutoFixture.Attributes;
+using NSubstitute;
+using Xunit;
+
+namespace Bit.Core.Test.KeyManagement.Queries;
+
+[SutProviderCustomize]
+public class KeyConnectorConfirmationDetailsQueryTests
+{
+    [Theory]
+    [BitAutoData]
+    public async Task Run_OrganizationNotFound_Throws(SutProvider<KeyConnectorConfirmationDetailsQuery> sutProvider,
+        Guid userId, string orgSsoIdentifier)
+    {
+        await Assert.ThrowsAsync<NotFoundException>(() => sutProvider.Sut.Run(orgSsoIdentifier, userId));
+
+        await sutProvider.GetDependency<IOrganizationUserRepository>()
+            .ReceivedWithAnyArgs(0)
+            .GetByOrganizationAsync(Arg.Any<Guid>(), Arg.Any<Guid>());
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task Run_OrganizationNotKeyConnector_Throws(
+        SutProvider<KeyConnectorConfirmationDetailsQuery> sutProvider,
+        Guid userId, string orgSsoIdentifier, Organization org)
+    {
+        org.Identifier = orgSsoIdentifier;
+        org.UseKeyConnector = false;
+        sutProvider.GetDependency<IOrganizationRepository>().GetByIdentifierAsync(orgSsoIdentifier).Returns(org);
+
+        await Assert.ThrowsAsync<NotFoundException>(() => sutProvider.Sut.Run(orgSsoIdentifier, userId));
+
+        await sutProvider.GetDependency<IOrganizationUserRepository>()
+            .ReceivedWithAnyArgs(0)
+            .GetByOrganizationAsync(Arg.Any<Guid>(), Arg.Any<Guid>());
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task Run_OrganizationUserNotFound_Throws(SutProvider<KeyConnectorConfirmationDetailsQuery> sutProvider,
+        Guid userId, string orgSsoIdentifier
+        , Organization org)
+    {
+        org.Identifier = orgSsoIdentifier;
+        org.UseKeyConnector = true;
+        sutProvider.GetDependency<IOrganizationRepository>().GetByIdentifierAsync(orgSsoIdentifier).Returns(org);
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByOrganizationAsync(Arg.Any<Guid>(), Arg.Any<Guid>()).Returns(Task.FromResult<OrganizationUser>(null));
+
+        await Assert.ThrowsAsync<NotFoundException>(() => sutProvider.Sut.Run(orgSsoIdentifier, userId));
+
+        await sutProvider.GetDependency<IOrganizationUserRepository>()
+            .Received(1)
+            .GetByOrganizationAsync(org.Id, userId);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task Run_Success(SutProvider<KeyConnectorConfirmationDetailsQuery> sutProvider, Guid userId,
+        string orgSsoIdentifier
+        , Organization org, OrganizationUser orgUser)
+    {
+        org.Identifier = orgSsoIdentifier;
+        org.UseKeyConnector = true;
+        orgUser.OrganizationId = org.Id;
+        orgUser.UserId = userId;
+
+        sutProvider.GetDependency<IOrganizationRepository>().GetByIdentifierAsync(orgSsoIdentifier).Returns(org);
+        sutProvider.GetDependency<IOrganizationUserRepository>().GetByOrganizationAsync(org.Id, userId)
+            .Returns(orgUser);
+
+        var result = await sutProvider.Sut.Run(orgSsoIdentifier, userId);
+
+        Assert.Equal(org.Name, result.OrganizationName);
+        await sutProvider.GetDependency<IOrganizationUserRepository>()
+            .Received(1)
+            .GetByOrganizationAsync(org.Id, userId);
+    }
+}

test/Core.Test/Services/StripePaymentServiceTests.cs

@@ -1,11 +1,7 @@
 using Bit.Core.Billing.Constants;
-using Bit.Core.Billing.Enums;
-using Bit.Core.Billing.Pricing;
-using Bit.Core.Billing.Tax.Requests;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Services;
-using Bit.Core.Test.Billing.Mocks.Plans;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using NSubstitute;
@@ -17,506 +13,6 @@ namespace Bit.Core.Test.Services;
 [SutProviderCustomize]
 public class StripePaymentServiceTests
 {
-    [Theory]
-    [BitAutoData]
-    public async Task
-        PreviewInvoiceAsync_ForOrganization_CalculatesSalesTaxCorrectlyForFamiliesWithoutAdditionalStorage(
-            SutProvider<StripePaymentService> sutProvider)
-    {
-        var familiesPlan = new FamiliesPlan();
-        sutProvider.GetDependency<IPricingClient>()
-            .GetPlanOrThrow(Arg.Is<PlanType>(p => p == PlanType.FamiliesAnnually))
-            .Returns(familiesPlan);
-
-        var parameters = new PreviewOrganizationInvoiceRequestBody
-        {
-            PasswordManager =
-                new OrganizationPasswordManagerRequestModel
-                {
-                    Plan = PlanType.FamiliesAnnually,
-                    AdditionalStorage = 0
-                },
-            TaxInformation = new TaxInformationRequestModel { Country = "FR", PostalCode = "12345" }
-        };
-
-        sutProvider.GetDependency<IStripeAdapter>()
-            .InvoiceCreatePreviewAsync(Arg.Is<InvoiceCreatePreviewOptions>(p =>
-                p.Currency == "usd" &&
-                p.SubscriptionDetails.Items.Any(x =>
-                    x.Plan == familiesPlan.PasswordManager.StripePlanId &&
-                    x.Quantity == 1) &&
-                p.SubscriptionDetails.Items.Any(x =>
-                    x.Plan == familiesPlan.PasswordManager.StripeStoragePlanId &&
-                    x.Quantity == 0)))
-            .Returns(new Invoice
-            {
-                TotalExcludingTax = 4000,
-                TotalTaxes = [new InvoiceTotalTax { Amount = 800 }],
-                Total = 4800
-            });
-
-        var actual = await sutProvider.Sut.PreviewInvoiceAsync(parameters, null, null);
-
-        Assert.Equal(8M, actual.TaxAmount);
-        Assert.Equal(48M, actual.TotalAmount);
-        Assert.Equal(40M, actual.TaxableBaseAmount);
-    }
-
-    [Theory]
-    [BitAutoData]
-    public async Task PreviewInvoiceAsync_ForOrganization_CalculatesSalesTaxCorrectlyForFamiliesWithAdditionalStorage(
-        SutProvider<StripePaymentService> sutProvider)
-    {
-        var familiesPlan = new FamiliesPlan();
-        sutProvider.GetDependency<IPricingClient>()
-            .GetPlanOrThrow(Arg.Is<PlanType>(p => p == PlanType.FamiliesAnnually))
-            .Returns(familiesPlan);
-
-        var parameters = new PreviewOrganizationInvoiceRequestBody
-        {
-            PasswordManager =
-                new OrganizationPasswordManagerRequestModel
-                {
-                    Plan = PlanType.FamiliesAnnually,
-                    AdditionalStorage = 1
-                },
-            TaxInformation = new TaxInformationRequestModel { Country = "FR", PostalCode = "12345" }
-        };
-
-        sutProvider.GetDependency<IStripeAdapter>()
-            .InvoiceCreatePreviewAsync(Arg.Is<InvoiceCreatePreviewOptions>(p =>
-                p.Currency == "usd" &&
-                p.SubscriptionDetails.Items.Any(x =>
-                    x.Plan == familiesPlan.PasswordManager.StripePlanId &&
-                    x.Quantity == 1) &&
-                p.SubscriptionDetails.Items.Any(x =>
-                    x.Plan == familiesPlan.PasswordManager.StripeStoragePlanId &&
-                    x.Quantity == 1)))
-            .Returns(new Invoice { TotalExcludingTax = 4000, TotalTaxes = [new InvoiceTotalTax { Amount = 800 }], Total = 4800 });
-
-        var actual = await sutProvider.Sut.PreviewInvoiceAsync(parameters, null, null);
-
-        Assert.Equal(8M, actual.TaxAmount);
-        Assert.Equal(48M, actual.TotalAmount);
-        Assert.Equal(40M, actual.TaxableBaseAmount);
-    }
-
-    [Theory]
-    [BitAutoData]
-    public async Task
-        PreviewInvoiceAsync_ForOrganization_CalculatesSalesTaxCorrectlyForFamiliesForEnterpriseWithoutAdditionalStorage(
-            SutProvider<StripePaymentService> sutProvider)
-    {
-        var familiesPlan = new FamiliesPlan();
-        sutProvider.GetDependency<IPricingClient>()
-            .GetPlanOrThrow(Arg.Is<PlanType>(p => p == PlanType.FamiliesAnnually))
-            .Returns(familiesPlan);
-
-        var parameters = new PreviewOrganizationInvoiceRequestBody
-        {
-            PasswordManager = new OrganizationPasswordManagerRequestModel
-            {
-                Plan = PlanType.FamiliesAnnually,
-                SponsoredPlan = PlanSponsorshipType.FamiliesForEnterprise,
-                AdditionalStorage = 0
-            },
-            TaxInformation = new TaxInformationRequestModel { Country = "FR", PostalCode = "12345" }
-        };
-
-        sutProvider.GetDependency<IStripeAdapter>()
-            .InvoiceCreatePreviewAsync(Arg.Is<InvoiceCreatePreviewOptions>(p =>
-                p.Currency == "usd" &&
-                p.SubscriptionDetails.Items.Any(x =>
-                    x.Plan == "2021-family-for-enterprise-annually" &&
-                    x.Quantity == 1) &&
-                p.SubscriptionDetails.Items.Any(x =>
-                    x.Plan == familiesPlan.PasswordManager.StripeStoragePlanId &&
-                    x.Quantity == 0)))
-            .Returns(new Invoice { TotalExcludingTax = 0, TotalTaxes = [new InvoiceTotalTax { Amount = 0 }], Total = 0 });
-
-        var actual = await sutProvider.Sut.PreviewInvoiceAsync(parameters, null, null);
-
-        Assert.Equal(0M, actual.TaxAmount);
-        Assert.Equal(0M, actual.TotalAmount);
-        Assert.Equal(0M, actual.TaxableBaseAmount);
-    }
-
-    [Theory]
-    [BitAutoData]
-    public async Task
-        PreviewInvoiceAsync_ForOrganization_CalculatesSalesTaxCorrectlyForFamiliesForEnterpriseWithAdditionalStorage(
-            SutProvider<StripePaymentService> sutProvider)
-    {
-        var familiesPlan = new FamiliesPlan();
-        sutProvider.GetDependency<IPricingClient>()
-            .GetPlanOrThrow(Arg.Is<PlanType>(p => p == PlanType.FamiliesAnnually))
-            .Returns(familiesPlan);
-
-        var parameters = new PreviewOrganizationInvoiceRequestBody
-        {
-            PasswordManager = new OrganizationPasswordManagerRequestModel
-            {
-                Plan = PlanType.FamiliesAnnually,
-                SponsoredPlan = PlanSponsorshipType.FamiliesForEnterprise,
-                AdditionalStorage = 1
-            },
-            TaxInformation = new TaxInformationRequestModel { Country = "FR", PostalCode = "12345" }
-        };
-
-        sutProvider.GetDependency<IStripeAdapter>()
-            .InvoiceCreatePreviewAsync(Arg.Is<InvoiceCreatePreviewOptions>(p =>
-                p.Currency == "usd" &&
-                p.SubscriptionDetails.Items.Any(x =>
-                    x.Plan == "2021-family-for-enterprise-annually" &&
-                    x.Quantity == 1) &&
-                p.SubscriptionDetails.Items.Any(x =>
-                    x.Plan == familiesPlan.PasswordManager.StripeStoragePlanId &&
-                    x.Quantity == 1)))
-            .Returns(new Invoice { TotalExcludingTax = 400, TotalTaxes = [new InvoiceTotalTax { Amount = 8 }], Total = 408 });
-
-        var actual = await sutProvider.Sut.PreviewInvoiceAsync(parameters, null, null);
-
-        Assert.Equal(0.08M, actual.TaxAmount);
-        Assert.Equal(4.08M, actual.TotalAmount);
-        Assert.Equal(4M, actual.TaxableBaseAmount);
-    }
-
-    [Theory]
-    [BitAutoData]
-    public async Task PreviewInvoiceAsync_USBased_PersonalUse_SetsAutomaticTaxEnabled(SutProvider<StripePaymentService> sutProvider)
-    {
-        // Arrange
-        var familiesPlan = new FamiliesPlan();
-        sutProvider.GetDependency<IPricingClient>()
-            .GetPlanOrThrow(Arg.Is<PlanType>(p => p == PlanType.FamiliesAnnually))
-            .Returns(familiesPlan);
-
-        var parameters = new PreviewOrganizationInvoiceRequestBody
-        {
-            PasswordManager = new OrganizationPasswordManagerRequestModel
-            {
-                Plan = PlanType.FamiliesAnnually
-            },
-            TaxInformation = new TaxInformationRequestModel
-            {
-                Country = "US",
-                PostalCode = "12345"
-            }
-        };
-
-        var stripeAdapter = sutProvider.GetDependency<IStripeAdapter>();
-        stripeAdapter
-            .InvoiceCreatePreviewAsync(Arg.Any<InvoiceCreatePreviewOptions>())
-            .Returns(new Invoice
-            {
-                TotalExcludingTax = 400,
-                TotalTaxes = [new InvoiceTotalTax { Amount = 8 }],
-                Total = 408
-            });
-
-        // Act
-        await sutProvider.Sut.PreviewInvoiceAsync(parameters, null, null);
-
-        // Assert
-        await stripeAdapter.Received(1).InvoiceCreatePreviewAsync(Arg.Is<InvoiceCreatePreviewOptions>(options =>
-            options.AutomaticTax.Enabled == true
-        ));
-    }
-
-    [Theory]
-    [BitAutoData]
-    public async Task PreviewInvoiceAsync_USBased_BusinessUse_SetsAutomaticTaxEnabled(SutProvider<StripePaymentService> sutProvider)
-    {
-        // Arrange
-        var plan = new EnterprisePlan(true);
-        sutProvider.GetDependency<IPricingClient>()
-            .GetPlanOrThrow(Arg.Is<PlanType>(p => p == PlanType.EnterpriseAnnually))
-            .Returns(plan);
-
-        var parameters = new PreviewOrganizationInvoiceRequestBody
-        {
-            PasswordManager = new OrganizationPasswordManagerRequestModel
-            {
-                Plan = PlanType.EnterpriseAnnually
-            },
-            TaxInformation = new TaxInformationRequestModel
-            {
-                Country = "US",
-                PostalCode = "12345"
-            }
-        };
-
-        var stripeAdapter = sutProvider.GetDependency<IStripeAdapter>();
-        stripeAdapter
-            .InvoiceCreatePreviewAsync(Arg.Any<InvoiceCreatePreviewOptions>())
-            .Returns(new Invoice
-            {
-                TotalExcludingTax = 400,
-                TotalTaxes = [new InvoiceTotalTax { Amount = 8 }],
-                Total = 408
-            });
-
-        // Act
-        await sutProvider.Sut.PreviewInvoiceAsync(parameters, null, null);
-
-        // Assert
-        await stripeAdapter.Received(1).InvoiceCreatePreviewAsync(Arg.Is<InvoiceCreatePreviewOptions>(options =>
-            options.AutomaticTax.Enabled == true
-        ));
-    }
-
-    [Theory]
-    [BitAutoData]
-    public async Task PreviewInvoiceAsync_NonUSBased_PersonalUse_SetsAutomaticTaxEnabled(SutProvider<StripePaymentService> sutProvider)
-    {
-        // Arrange
-        var familiesPlan = new FamiliesPlan();
-        sutProvider.GetDependency<IPricingClient>()
-            .GetPlanOrThrow(Arg.Is<PlanType>(p => p == PlanType.FamiliesAnnually))
-            .Returns(familiesPlan);
-
-        var parameters = new PreviewOrganizationInvoiceRequestBody
-        {
-            PasswordManager = new OrganizationPasswordManagerRequestModel
-            {
-                Plan = PlanType.FamiliesAnnually
-            },
-            TaxInformation = new TaxInformationRequestModel
-            {
-                Country = "FR",
-                PostalCode = "12345"
-            }
-        };
-
-        var stripeAdapter = sutProvider.GetDependency<IStripeAdapter>();
-        stripeAdapter
-            .InvoiceCreatePreviewAsync(Arg.Any<InvoiceCreatePreviewOptions>())
-            .Returns(new Invoice
-            {
-                TotalExcludingTax = 400,
-                TotalTaxes = [new InvoiceTotalTax { Amount = 8 }],
-                Total = 408
-            });
-
-        // Act
-        await sutProvider.Sut.PreviewInvoiceAsync(parameters, null, null);
-
-        // Assert
-        await stripeAdapter.Received(1).InvoiceCreatePreviewAsync(Arg.Is<InvoiceCreatePreviewOptions>(options =>
-            options.AutomaticTax.Enabled == true
-        ));
-    }
-
-    [Theory]
-    [BitAutoData]
-    public async Task PreviewInvoiceAsync_NonUSBased_BusinessUse_SetsAutomaticTaxEnabled(SutProvider<StripePaymentService> sutProvider)
-    {
-        // Arrange
-        var plan = new EnterprisePlan(true);
-        sutProvider.GetDependency<IPricingClient>()
-            .GetPlanOrThrow(Arg.Is<PlanType>(p => p == PlanType.EnterpriseAnnually))
-            .Returns(plan);
-
-        var parameters = new PreviewOrganizationInvoiceRequestBody
-        {
-            PasswordManager = new OrganizationPasswordManagerRequestModel
-            {
-                Plan = PlanType.EnterpriseAnnually
-            },
-            TaxInformation = new TaxInformationRequestModel
-            {
-                Country = "FR",
-                PostalCode = "12345"
-            }
-        };
-
-        var stripeAdapter = sutProvider.GetDependency<IStripeAdapter>();
-        stripeAdapter
-            .InvoiceCreatePreviewAsync(Arg.Any<InvoiceCreatePreviewOptions>())
-            .Returns(new Invoice
-            {
-                TotalExcludingTax = 400,
-                TotalTaxes = [new InvoiceTotalTax { Amount = 8 }],
-                Total = 408
-            });
-
-        // Act
-        await sutProvider.Sut.PreviewInvoiceAsync(parameters, null, null);
-
-        // Assert
-        await stripeAdapter.Received(1).InvoiceCreatePreviewAsync(Arg.Is<InvoiceCreatePreviewOptions>(options =>
-            options.AutomaticTax.Enabled == true
-        ));
-    }
-
-    [Theory]
-    [BitAutoData]
-    public async Task PreviewInvoiceAsync_USBased_PersonalUse_DoesNotSetTaxExempt(SutProvider<StripePaymentService> sutProvider)
-    {
-        // Arrange
-        var familiesPlan = new FamiliesPlan();
-        sutProvider.GetDependency<IPricingClient>()
-            .GetPlanOrThrow(Arg.Is<PlanType>(p => p == PlanType.FamiliesAnnually))
-            .Returns(familiesPlan);
-
-        var parameters = new PreviewOrganizationInvoiceRequestBody
-        {
-            PasswordManager = new OrganizationPasswordManagerRequestModel
-            {
-                Plan = PlanType.FamiliesAnnually
-            },
-            TaxInformation = new TaxInformationRequestModel
-            {
-                Country = "US",
-                PostalCode = "12345"
-            }
-        };
-
-        var stripeAdapter = sutProvider.GetDependency<IStripeAdapter>();
-        stripeAdapter
-            .InvoiceCreatePreviewAsync(Arg.Any<InvoiceCreatePreviewOptions>())
-            .Returns(new Invoice
-            {
-                TotalExcludingTax = 400,
-                TotalTaxes = [new InvoiceTotalTax { Amount = 8 }],
-                Total = 408
-            });
-
-        // Act
-        await sutProvider.Sut.PreviewInvoiceAsync(parameters, null, null);
-
-        // Assert
-        await stripeAdapter.Received(1).InvoiceCreatePreviewAsync(Arg.Is<InvoiceCreatePreviewOptions>(options =>
-            options.CustomerDetails.TaxExempt == null
-        ));
-    }
-
-    [Theory]
-    [BitAutoData]
-    public async Task PreviewInvoiceAsync_USBased_BusinessUse_DoesNotSetTaxExempt(SutProvider<StripePaymentService> sutProvider)
-    {
-        // Arrange
-        var plan = new EnterprisePlan(true);
-        sutProvider.GetDependency<IPricingClient>()
-            .GetPlanOrThrow(Arg.Is<PlanType>(p => p == PlanType.EnterpriseAnnually))
-            .Returns(plan);
-
-        var parameters = new PreviewOrganizationInvoiceRequestBody
-        {
-            PasswordManager = new OrganizationPasswordManagerRequestModel
-            {
-                Plan = PlanType.EnterpriseAnnually
-            },
-            TaxInformation = new TaxInformationRequestModel
-            {
-                Country = "US",
-                PostalCode = "12345"
-            }
-        };
-
-        var stripeAdapter = sutProvider.GetDependency<IStripeAdapter>();
-        stripeAdapter
-            .InvoiceCreatePreviewAsync(Arg.Any<InvoiceCreatePreviewOptions>())
-            .Returns(new Invoice
-            {
-                TotalExcludingTax = 400,
-                TotalTaxes = [new InvoiceTotalTax { Amount = 8 }],
-                Total = 408
-            });
-
-        // Act
-        await sutProvider.Sut.PreviewInvoiceAsync(parameters, null, null);
-
-        // Assert
-        await stripeAdapter.Received(1).InvoiceCreatePreviewAsync(Arg.Is<InvoiceCreatePreviewOptions>(options =>
-            options.CustomerDetails.TaxExempt == null
-        ));
-    }
-
-    [Theory]
-    [BitAutoData]
-    public async Task PreviewInvoiceAsync_NonUSBased_PersonalUse_DoesNotSetTaxExempt(SutProvider<StripePaymentService> sutProvider)
-    {
-        // Arrange
-        var familiesPlan = new FamiliesPlan();
-        sutProvider.GetDependency<IPricingClient>()
-            .GetPlanOrThrow(Arg.Is<PlanType>(p => p == PlanType.FamiliesAnnually))
-            .Returns(familiesPlan);
-
-        var parameters = new PreviewOrganizationInvoiceRequestBody
-        {
-            PasswordManager = new OrganizationPasswordManagerRequestModel
-            {
-                Plan = PlanType.FamiliesAnnually
-            },
-            TaxInformation = new TaxInformationRequestModel
-            {
-                Country = "FR",
-                PostalCode = "12345"
-            }
-        };
-
-        var stripeAdapter = sutProvider.GetDependency<IStripeAdapter>();
-        stripeAdapter
-            .InvoiceCreatePreviewAsync(Arg.Any<InvoiceCreatePreviewOptions>())
-            .Returns(new Invoice
-            {
-                TotalExcludingTax = 400,
-                TotalTaxes = [new InvoiceTotalTax { Amount = 8 }],
-                Total = 408
-            });
-
-        // Act
-        await sutProvider.Sut.PreviewInvoiceAsync(parameters, null, null);
-
-        // Assert
-        await stripeAdapter.Received(1).InvoiceCreatePreviewAsync(Arg.Is<InvoiceCreatePreviewOptions>(options =>
-            options.CustomerDetails.TaxExempt == null
-        ));
-    }
-
-    [Theory]
-    [BitAutoData]
-    public async Task PreviewInvoiceAsync_NonUSBased_BusinessUse_SetsTaxExemptReverse(SutProvider<StripePaymentService> sutProvider)
-    {
-        // Arrange
-        var plan = new EnterprisePlan(true);
-        sutProvider.GetDependency<IPricingClient>()
-            .GetPlanOrThrow(Arg.Is<PlanType>(p => p == PlanType.EnterpriseAnnually))
-            .Returns(plan);
-
-        var parameters = new PreviewOrganizationInvoiceRequestBody
-        {
-            PasswordManager = new OrganizationPasswordManagerRequestModel
-            {
-                Plan = PlanType.EnterpriseAnnually
-            },
-            TaxInformation = new TaxInformationRequestModel
-            {
-                Country = "FR",
-                PostalCode = "12345"
-            }
-        };
-
-        var stripeAdapter = sutProvider.GetDependency<IStripeAdapter>();
-        stripeAdapter
-            .InvoiceCreatePreviewAsync(Arg.Any<InvoiceCreatePreviewOptions>())
-            .Returns(new Invoice
-            {
-                TotalExcludingTax = 400,
-                TotalTaxes = [new InvoiceTotalTax { Amount = 8 }],
-                Total = 408
-            });
-
-        // Act
-        await sutProvider.Sut.PreviewInvoiceAsync(parameters, null, null);
-
-        // Assert
-        await stripeAdapter.Received(1).InvoiceCreatePreviewAsync(Arg.Is<InvoiceCreatePreviewOptions>(options =>
-            options.CustomerDetails.TaxExempt == StripeConstants.TaxExempt.Reverse
-        ));
-    }
-
     [Theory]
     [BitAutoData]
     public async Task GetSubscriptionAsync_WithCustomerDiscount_ReturnsDiscountFromCustomer(

test/Identity.Test/IdentityServer/BaseRequestValidatorTests.cs

@@ -380,19 +380,16 @@ public class BaseRequestValidatorTests
         // 1 -> initial validation passes
         _sut.isValid = true;
 
-        // 2 -> enable the FailedTwoFactorEmail feature flag
-        _featureService.IsEnabled(FeatureFlagKeys.FailedTwoFactorEmail).Returns(true);
-
-        // 3 -> set up 2FA as required
+        // 2 -> set up 2FA as required
         _twoFactorAuthenticationValidator
             .RequiresTwoFactorAsync(Arg.Any<User>(), tokenRequest)
             .Returns(Task.FromResult(new Tuple<bool, Organization>(true, null)));
 
-        // 4 -> provide invalid 2FA token
+        // 3 -> provide invalid 2FA token
         tokenRequest.Raw["TwoFactorToken"] = "invalid_token";
         tokenRequest.Raw["TwoFactorProvider"] = TwoFactorProviderType.Email.ToString();
 
-        // 5 -> set up 2FA verification to fail
+        // 4 -> set up 2FA verification to fail
         _twoFactorAuthenticationValidator
             .VerifyTwoFactorAsync(user, null, TwoFactorProviderType.Email, "invalid_token")
             .Returns(Task.FromResult(false));
@@ -427,24 +424,21 @@ public class BaseRequestValidatorTests
         // 1 -> initial validation passes
         _sut.isValid = true;
 
-        // 2 -> enable the FailedTwoFactorEmail feature flag
-        _featureService.IsEnabled(FeatureFlagKeys.FailedTwoFactorEmail).Returns(true);
-
-        // 3 -> set up 2FA as required
+        // 2 -> set up 2FA as required
         _twoFactorAuthenticationValidator
             .RequiresTwoFactorAsync(Arg.Any<User>(), tokenRequest)
             .Returns(Task.FromResult(new Tuple<bool, Organization>(true, null)));
 
-        // 4 -> provide invalid remember token (remember token expired)
+        // 3 -> provide invalid remember token (remember token expired)
         tokenRequest.Raw["TwoFactorToken"] = "expired_remember_token";
         tokenRequest.Raw["TwoFactorProvider"] = "5"; // Remember provider
 
-        // 5 -> set up remember token verification to fail
+        // 4 -> set up remember token verification to fail
         _twoFactorAuthenticationValidator
             .VerifyTwoFactorAsync(user, null, TwoFactorProviderType.Remember, "expired_remember_token")
             .Returns(Task.FromResult(false));
 
-        // 6 -> set up dummy BuildTwoFactorResultAsync
+        // 5 -> set up dummy BuildTwoFactorResultAsync
         var twoFactorResultDict = new Dictionary<string, object>
         {
             { "TwoFactorProviders", new[] { "0", "1" } },
@@ -1127,9 +1121,6 @@ public class BaseRequestValidatorTests
             .VerifyTwoFactorAsync(user, null, TwoFactorProviderType.RecoveryCode, "INVALID-recovery-code")
             .Returns(Task.FromResult(false));
 
-        // 6. Setup for failed 2FA email (if feature flag enabled)
-        _featureService.IsEnabled(FeatureFlagKeys.FailedTwoFactorEmail).Returns(true);
-
         // Act
         await _sut.ValidateAsync(context);
 

test/Infrastructure.Dapper.Test/Infrastructure.Dapper.Test.csproj

@@ -8,7 +8,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="$(MicrosoftNetTestSdkVersion)" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.2">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>

test/Infrastructure.EFIntegration.Test/Repositories/UserRepositoryTests.cs

@@ -2,6 +2,8 @@
 using Bit.Core.Auth.Entities;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
+using Bit.Core.KeyManagement.Enums;
+using Bit.Core.KeyManagement.Models.Data;
 using Bit.Core.Models.Data;
 using Bit.Core.Test.AutoFixture.Attributes;
 using Bit.Infrastructure.EFIntegration.Test.AutoFixture;
@@ -313,4 +315,66 @@ public class UserRepositoryTests
         Assert.Equal(sqlUser.MasterPasswordHint, updatedUser.MasterPasswordHint);
         Assert.Equal(sqlUser.Email, updatedUser.Email);
     }
+
+    [CiSkippedTheory, EfUserAutoData]
+    public async Task UpdateAccountCryptographicStateAsync_Works_DataMatches(
+        User user,
+        List<EfRepo.UserRepository> suts,
+        SqlRepo.UserRepository sqlUserRepo)
+    {
+        // Test for V1 user (no signature key pair or security state)
+        var accountKeysDataV1 = new UserAccountKeysData
+        {
+            PublicKeyEncryptionKeyPairData = new PublicKeyEncryptionKeyPairData(
+                wrappedPrivateKey: "v1-wrapped-private-key",
+                publicKey: "v1-public-key"
+            )
+        };
+
+        foreach (var sut in suts)
+        {
+            var createdUser = await sut.CreateAsync(user);
+            sut.ClearChangeTracking();
+
+            await sut.SetV2AccountCryptographicStateAsync(createdUser.Id, accountKeysDataV1);
+            sut.ClearChangeTracking();
+
+            var updatedUser = await sut.GetByIdAsync(createdUser.Id);
+            Assert.Equal("v1-public-key", updatedUser.PublicKey);
+            Assert.Equal("v1-wrapped-private-key", updatedUser.PrivateKey);
+            Assert.Null(updatedUser.SignedPublicKey);
+            Assert.Null(updatedUser.SecurityState);
+            Assert.Null(updatedUser.SecurityVersion);
+        }
+
+        // Test for V2 user (with signature key pair and security state)
+        var accountKeysDataV2 = new UserAccountKeysData
+        {
+            PublicKeyEncryptionKeyPairData = new PublicKeyEncryptionKeyPairData(
+                wrappedPrivateKey: "v2-wrapped-private-key",
+                publicKey: "v2-public-key",
+                signedPublicKey: "v2-signed-public-key"
+            ),
+            SignatureKeyPairData = new SignatureKeyPairData(
+                signatureAlgorithm: SignatureAlgorithm.Ed25519,
+                wrappedSigningKey: "v2-wrapped-signing-key",
+                verifyingKey: "v2-verifying-key"
+            ),
+            SecurityStateData = new SecurityStateData
+            {
+                SecurityState = "v2-security-state",
+                SecurityVersion = 2
+            }
+        };
+
+        var sqlUser = await sqlUserRepo.CreateAsync(user);
+        await sqlUserRepo.SetV2AccountCryptographicStateAsync(sqlUser.Id, accountKeysDataV2);
+
+        var updatedSqlUser = await sqlUserRepo.GetByIdAsync(sqlUser.Id);
+        Assert.Equal("v2-public-key", updatedSqlUser.PublicKey);
+        Assert.Equal("v2-wrapped-private-key", updatedSqlUser.PrivateKey);
+        Assert.Equal("v2-signed-public-key", updatedSqlUser.SignedPublicKey);
+        Assert.Equal("v2-security-state", updatedSqlUser.SecurityState);
+        Assert.Equal(2, updatedSqlUser.SecurityVersion);
+    }
 }

test/Infrastructure.EFIntegration.Test/Vault/Repositories/CipherRepositoryTests.cs

@@ -225,4 +225,58 @@ public class CipherRepositoryTests
             Assert.True(savedCipher == null);
         }
     }
+
+    [CiSkippedTheory, EfOrganizationCipherCustomize, BitAutoData]
+    public async Task ReplaceAsync_WithCollections_UpdatesFoldersFavoritesRepromptAndArchivedDateAsync(
+        Cipher cipher,
+        User user,
+        Organization org,
+        Collection collection,
+        List<EfVaultRepo.CipherRepository> suts,
+        List<EfRepo.UserRepository> efUserRepos,
+        List<EfRepo.OrganizationRepository> efOrgRepos,
+        List<EfRepo.CollectionRepository> efCollectionRepos)
+    {
+        foreach (var sut in suts)
+        {
+            var i = suts.IndexOf(sut);
+
+            var postEfOrg = await efOrgRepos[i].CreateAsync(org);
+            efOrgRepos[i].ClearChangeTracking();
+            var postEfUser = await efUserRepos[i].CreateAsync(user);
+            efUserRepos[i].ClearChangeTracking();
+
+            collection.OrganizationId = postEfOrg.Id;
+            var postEfCollection = await efCollectionRepos[i].CreateAsync(collection);
+            efCollectionRepos[i].ClearChangeTracking();
+
+            cipher.UserId = postEfUser.Id;
+            cipher.OrganizationId = null;
+            cipher.Folders = $"{{\"{postEfUser.Id}\":\"some-folder-id\"}}";
+            cipher.Favorites = $"{{\"{postEfUser.Id}\":true}}";
+            cipher.Reprompt = Core.Vault.Enums.CipherRepromptType.Password;
+
+            var createdCipher = await sut.CreateAsync(cipher);
+            sut.ClearChangeTracking();
+
+            var updatedCipher = await sut.GetByIdAsync(createdCipher.Id);
+            updatedCipher.UserId = postEfUser.Id;
+            updatedCipher.OrganizationId = postEfOrg.Id;
+            updatedCipher.Folders = $"{{\"{postEfUser.Id}\":\"new-folder-id\"}}";
+            updatedCipher.Favorites = $"{{\"{postEfUser.Id}\":true}}";
+            updatedCipher.Reprompt = Core.Vault.Enums.CipherRepromptType.Password;
+
+            await sut.ReplaceAsync(updatedCipher, new List<Guid> { postEfCollection.Id });
+            sut.ClearChangeTracking();
+
+
+            var savedCipher = await sut.GetByIdAsync(createdCipher.Id);
+            Assert.NotNull(savedCipher);
+            Assert.Null(savedCipher.UserId);
+            Assert.Equal(postEfOrg.Id, savedCipher.OrganizationId);
+            Assert.Equal($"{{\"{postEfUser.Id}\":\"new-folder-id\"}}", savedCipher.Folders);
+            Assert.Equal($"{{\"{postEfUser.Id}\":true}}", savedCipher.Favorites);
+            Assert.Equal(Core.Vault.Enums.CipherRepromptType.Password, savedCipher.Reprompt);
+        }
+    }
 }

util/Migrator/DbScripts/2025-12-08_00_User_UpdateAccountCryptographicState.sql

@@ -0,0 +1,72 @@
+IF OBJECT_ID('[dbo].[User_UpdateAccountCryptographicState]') IS NOT NULL
+BEGIN
+    DROP PROCEDURE [dbo].[User_UpdateAccountCryptographicState]
+END
+GO
+
+CREATE PROCEDURE [dbo].[User_UpdateAccountCryptographicState]
+    @Id UNIQUEIDENTIFIER,
+    @PublicKey NVARCHAR(MAX),
+    @PrivateKey NVARCHAR(MAX),
+    @SignedPublicKey NVARCHAR(MAX) = NULL,
+    @SecurityState NVARCHAR(MAX) = NULL,
+    @SecurityVersion INT = NULL,
+    @SignatureKeyPairId UNIQUEIDENTIFIER = NULL,
+    @SignatureAlgorithm TINYINT = NULL,
+    @SigningKey VARCHAR(MAX) = NULL,
+    @VerifyingKey VARCHAR(MAX) = NULL,
+    @RevisionDate DATETIME2(7),
+    @AccountRevisionDate DATETIME2(7)
+AS
+BEGIN
+    SET NOCOUNT ON
+
+    UPDATE
+        [dbo].[User]
+    SET
+        [PublicKey] = @PublicKey,
+        [PrivateKey] = @PrivateKey,
+        [SignedPublicKey] = @SignedPublicKey,
+        [SecurityState] = @SecurityState,
+        [SecurityVersion] = @SecurityVersion,
+        [RevisionDate] = @RevisionDate,
+        [AccountRevisionDate] = @AccountRevisionDate
+    WHERE
+        [Id] = @Id
+
+    IF EXISTS (SELECT 1 FROM [dbo].[UserSignatureKeyPair] WHERE [UserId] = @Id)
+    BEGIN
+        UPDATE [dbo].[UserSignatureKeyPair]
+        SET
+            [SignatureAlgorithm] = @SignatureAlgorithm,
+            [SigningKey] = @SigningKey,
+            [VerifyingKey] = @VerifyingKey,
+            [RevisionDate] = @RevisionDate
+        WHERE
+            [UserId] = @Id
+    END
+    ELSE
+    BEGIN
+        INSERT INTO [dbo].[UserSignatureKeyPair]
+        (
+            [Id],
+            [UserId],
+            [SignatureAlgorithm],
+            [SigningKey],
+            [VerifyingKey],
+            [CreationDate],
+            [RevisionDate]
+        )
+        VALUES
+        (
+            @SignatureKeyPairId,
+            @Id,
+            @SignatureAlgorithm,
+            @SigningKey,
+            @VerifyingKey,
+            @RevisionDate,
+            @RevisionDate
+        )
+    END
+END
+GO

util/Migrator/DbScripts/2025-12-09_00_ShareFavoriteFolderReprompt.sql

@@ -0,0 +1,62 @@
+CREATE OR ALTER PROCEDURE [dbo].[Cipher_UpdateWithCollections]
+    @Id UNIQUEIDENTIFIER,
+    @UserId UNIQUEIDENTIFIER,
+    @OrganizationId UNIQUEIDENTIFIER,
+    @Type TINYINT,
+    @Data NVARCHAR(MAX),
+    @Favorites NVARCHAR(MAX),
+    @Folders NVARCHAR(MAX),
+    @Attachments NVARCHAR(MAX),
+    @CreationDate DATETIME2(7),
+    @RevisionDate DATETIME2(7),
+    @DeletedDate DATETIME2(7),
+    @Reprompt TINYINT,
+    @Key VARCHAR(MAX) = NULL,
+    @CollectionIds AS [dbo].[GuidIdArray] READONLY,
+    @ArchivedDate DATETIME2(7) = NULL
+AS
+BEGIN
+    SET NOCOUNT ON
+
+    BEGIN TRANSACTION Cipher_UpdateWithCollections
+
+    DECLARE @UpdateCollectionsSuccess INT
+    EXEC @UpdateCollectionsSuccess = [dbo].[Cipher_UpdateCollections] @Id, @UserId, @OrganizationId, @CollectionIds
+
+    IF @UpdateCollectionsSuccess < 0
+    BEGIN
+        COMMIT TRANSACTION Cipher_UpdateWithCollections
+        SELECT -1 -- -1 = Failure
+        RETURN
+    END
+
+    UPDATE
+        [dbo].[Cipher]
+    SET
+        [UserId] = NULL,
+        [OrganizationId] = @OrganizationId,
+        [Data] = @Data,
+        [Attachments] = @Attachments,
+        [RevisionDate] = @RevisionDate,
+        [DeletedDate] = @DeletedDate,
+        [Key] = @Key,
+        [ArchivedDate] = @ArchivedDate,
+        [Folders] = @Folders,
+        [Favorites] = @Favorites,
+        [Reprompt] = @Reprompt
+        -- No need to update CreationDate or Type since that data will not change
+    WHERE
+        [Id] = @Id
+
+    COMMIT TRANSACTION Cipher_UpdateWithCollections
+
+    IF @Attachments IS NOT NULL
+    BEGIN
+        EXEC [dbo].[Organization_UpdateStorage] @OrganizationId
+        EXEC [dbo].[User_UpdateStorage] @UserId
+    END
+
+    EXEC [dbo].[User_BumpAccountRevisionDateByCipherId] @Id, @OrganizationId
+
+    SELECT 0 -- 0 = Success
+END