* Removed 2FA user interface from premium method signatures
* Added some more comments for clarity and small touchups.
* Add PremiumAccessCacheCheck feature flag to Constants.cs
* Add IPremiumAccessQuery interface and PremiumAccessQuery implementation for checking user premium access status
* Add unit tests for PremiumAccessQuery to validate user premium access logic
* Add XML documentation to Premium in OrganizationUserUserDetails and User classes
* Add PremiumAccessQueries to UserServiceCollectionExtensions
* Refactor TwoFactorIsEnabledQuery to incorporate PremiumAccessQuery and feature flag for premium access checks. Enhanced user premium status retrieval logic and improved handling of user details based on feature flag state.
* Mark methods in IUserRepository and IUserService as obsolete, directing users to new methods in IPremiumAccessQuery for premium access checks.
* Rename CanAccessPremiumBulkAsync to CanAccessPremiumAsync in IPremiumAccessQuery
* Update TwoFactorIsEnabledQuery to use CanAccessPremiumAsync for premium status checks
* Refactor TwoFactorIsEnabledQuery to introduce VNextAsync methods for improved premium access checks and user detail handling. Removed obsolete feature service dependency and enhanced test coverage for new functionality.
* Refactor IPremiumAccessQuery and PremiumAccessQuery to remove the overloaded CanAccessPremiumAsync method. Update related methods to streamline premium access checks using the User object directly. Enhance test coverage by removing obsolete tests and ensuring proper functionality with the new method signatures.
* Add new sync static method to determine if TwoFactor is enabled
* Enhance XML documentation for Premium property in OrganizationUserUserDetails and User classes to clarify its usage and limitations regarding personal and organizational premium access.
* Refactor IPremiumAccessQuery and PremiumAccessQuery to replace User parameter with Guid for user ID in CanAccessPremiumAsync methods. Update related methods and tests to streamline premium access checks and improve clarity in method signatures.
* Update feature flag references in IUserRepository and IUserService to use 'PremiumAccessQuery' instead of 'PremiumAccessCacheCheck'. Adjust related XML documentation for clarity on premium access methods.
* Rename IPremiumAccessQuery to IHasPremiumAccessQuery and move to Billing owned folder
* Remove unnecessary whitespace from IHasPremiumAccessQuery interface.
* Refactor HasPremiumAccessQuery to throw NotFoundException for null users
* Add NotFoundException handling in HasPremiumAccessQuery for mismatched user counts
* Refactor TwoFactorIsEnabledQuery to optimize premium access checks and improve two-factor provider handling. Introduced bulk fetching of premium status for users with only premium providers and streamlined the logic for determining if two-factor authentication is enabled.
* Refactor TwoFactorIsEnabledQueryTests to enhance clarity and optimize test scenarios. Consolidated test cases for two-factor authentication, improved naming conventions, and ensured premium access checks are only performed when necessary.
* Add UserPremiumAccess model to represent user premium access status from personal subscriptions and memberships
* Add User_ReadPremiumAccessByIds stored procedure and UserPremiumAccessView view to enhance premium access retrieval. Updated Organization table index to include UsersGetPremium for optimized queries.
* Add SQL migration script
* Add premium access retrieval methods to IUserRepository and implementations in UserRepository classes. Introduced GetPremiumAccessByIdsAsync and GetPremiumAccessAsync methods to fetch premium status for multiple users and a single user, respectively. Updated using directives to include necessary models.
* Refactor HasPremiumAccessQuery and IHasPremiumAccessQuery to streamline premium access checks. Updated method names for clarity and improved documentation. Adjusted test cases to reflect changes in user premium access retrieval logic.
* Update IUserRepository to reflect new method names for premium access retrieval. Changed obsolete method messages to point to GetPremiumAccessByIdsAsync and GetPremiumAccessAsync. Added internal use notes for IHasPremiumAccessQuery. Improved documentation for clarity.
* Refactor TwoFactorIsEnabledQuery to utilize IFeatureService for premium access checks.
* Enhance EF UserRepository to improve premium access retrieval by including related organization data.
* Add unit tests for premium access retrieval in UserRepositoryTests.
* Optimize HasPremiumAccessQuery to eliminate duplicate user IDs before checking premium access. Updated logic to ensure accurate comparison of premium users against distinct user IDs.
* Refactor TwoFactorIsEnabledQuery to improve handling of users without two-factor providers. Added early exit for users lacking providers and streamlined premium status checks for enabled two-factor authentication.
* Update HasPremiumAccessQueryTests to use simplified exception handling and improve test clarity
* Replaced fully qualified exception references with simplified ones.
* Refactored test setup to use individual user variables for better readability.
* Ensured assertions reflect the updated user variable structure.
* Enhance TwoFactorIsEnabledQuery to throw NotFoundException for non-existent users
* Updated TwoFactorIsEnabledQuery to throw NotFoundException when a user is not found instead of returning false.
* Added a new unit test to verify that the NotFoundException is thrown when a user is not found while premium access query is enabled.
* Move premium access query to Billing owned ServiceCollectionExtensions
* Refactor IUserService to enhance premium access checks
* Updated CanAccessPremium and HasPremiumFromOrganization methods to clarify usage with the new premium access query.
* Integrated IHasPremiumAccessQuery into UserService for improved premium access handling based on feature flag.
* Adjusted method documentation to reflect changes in premium access logic.
* Update IUserRepository to clarify usage of premium access methods
* Modified Obsolete attribute messages for GetManyWithCalculatedPremiumAsync and GetCalculatedPremiumAsync to indicate that callers should use the new methods when the 'PremiumAccessQuery' feature flag is enabled.
* Enhanced documentation to improve clarity regarding premium access handling.
* Update IUserRepository and IUserService to clarify deprecation of premium access methods
* Modified Obsolete attribute messages for GetManyWithCalculatedPremiumAsync and GetCalculatedPremiumAsync in IUserRepository to indicate these methods will be removed in a future version.
* Updated Obsolete attribute message for HasPremiumFromOrganization in IUserService to reflect the same deprecation notice.
* Refactor TwoFactorIsEnabledQuery to streamline user ID retrieval
* Consolidated user ID retrieval logic to avoid redundancy.
* Ensured consistent handling of user ID checks for premium access queries.
* Improved code readability by reducing duplicate code blocks.
* Rename migration script to fix the date
* Update migration script to create the index with DROP_EXISTING = ON
* Refactor UserPremiumAccessView to use LEFT JOINs and GROUP BY for improved performance and clarity
* Update HasPremiumAccessQueryTests to return null for GetPremiumAccessAsync instead of throwing NotFoundException
* Add unit tests for premium access scenarios in UserRepositoryTests
- Implement tests for GetPremiumAccessAsync to cover various user and organization premium access combinations.
- Validate behavior when users belong to multiple organizations, including cases with and without premium access.
- Update email generation for user creation to ensure uniqueness without specific prefixes.
- Enhance assertions to verify expected premium access results across different test cases.
* Bump date on migration script
* Update OrganizationEntityTypeConfiguration to include UsersGetPremium in index properties
* Add migration scripts for OrganizationUsersGetPremiumIndex across MySQL, PostgreSQL, and SQLite
- Introduced new migration files to create the OrganizationUsersGetPremiumIndex.
- Updated the DatabaseContextModelSnapshot to include UsersGetPremium in index properties for all database types.
- Ensured consistency in index creation across different database implementations.
---------
Co-authored-by: Todd Martin <tmartin@bitwarden.com>
Co-authored-by: Patrick Pimentel <ppimentel@bitwarden.com>
* Removed 2FA user interface from premium method signatures
* Added some more comments for clarity and small touchups.
* Suggested documentation updates.
---------
Co-authored-by: Patrick Pimentel <ppimentel@bitwarden.com>
* Added MasterPasswordUnlock to UserDecryptionOptions as part of identity response
* Implement support for authentication data and unlock data in kdf change
* Extract to kdf command and add tests
* Fix namespace
* Delete empty file
* Fix build
* Clean up tests
* Fix tests
* Add comments
* Cleanup
* Cleanup
* Cleanup
* Clean-up and fix build
* Address feedback; force new parameters on KDF change request
* Clean-up and add tests
* Re-add logger
* Update logger to interface
* Clean up, remove Kdf Request Model
* Remove kdf request model tests
* Fix types in test
* Address feedback to rename request model and re-add tests
* Fix namespace
* Move comments
* Rename InnerKdfRequestModel to KdfRequestModel
---------
Co-authored-by: Maciej Zieniuk <mzieniuk@bitwarden.com>
* Avoid multiple lookups in dictionaries
* Consistency in fallback to empty CollectionIds
* Readability at the cost of lines changed
* Readability
* Changes after running dotnet format
* Remove gathering and reporting of ReferenceEvents
* Fix test that relied on reference events throwing
---------
Co-authored-by: Daniel James Smith <djsmith85@users.noreply.github.com>
* Check for UserId instead of passing potentially default value to
bump account revision date method.
* Pass explicit UserId into CipherRepository.CreateAsync method
used for imports.
* fix : split out the interface from the TwoFactorAuthenticationValidator into separate file.
* fix: replacing IUserService.TwoFactorEnabled with ITwoFactorEnabledQuery
* fix: combined logic for both bulk and single user look ups for TwoFactorIsEnabledQuery.
* fix: return two factor provider enabled on CanGenerate() method.
* tech debt: modfifying MFA providers to call the database less to validate if two factor is enabled.
* tech debt: removed unused service from AuthenticatorTokenProvider
* doc: added documentation to ITwoFactorProviderUsers
* doc: updated comments for TwoFactorIsEnabled impl
* test: fixing tests for ITwoFactorIsEnabledQuery
* test: updating tests to have correct DI and removing test for automatic email of TOTP.
* test: adding better test coverage
feat(NewDeviceVerification) :
* Created database migration scripts for VerifyDevices column in [dbo].[User].
* Updated DeviceValidator to check if user has opted out of device verification.
* Added endpoint to AccountsController.cs to allow editing of new User.VerifyDevices property.
* Added tests for new methods and endpoint.
* Updating queries to track [dbo].[User].[VerifyDevices].
* Updated DeviceValidator to set `User.EmailVerified` property during the New Device Verification flow.
* Enable `nullable` For Collection
* Enable `nullable` For `CollectionCipher`
* Enable `nullable` For `CollectionGroup`
* Enable `nullable` For `CollectionUser`
* Enable `nullable` For `Device`
* Enable `nullable` For `Event`
* Enable `nullable` For `Folder`
* Enable `nullable` For `Installation`
* Enable `nullable` For `IRevisable`
* Enable `nullable` For `IStorable`
* Enable `nullable` For `IStorableSubscriber`
* Enable `nullable` For `ITableObject`
* Enable `nullable` For `OrganizationApiKey`
* Enable `nullable` For `OrganizationConnection`
* Enable `nullable` For `OrganizationDomain`
* Enable `nullable` For `OrganizationSponsorship`
* Enable `nullable` For `Role`
* Enable `nullable` For `TaxRate`
* Enable `nullable` For `Transaction`
* Enable `nullable` For `User`
* Added offboarding survey response to cancellation when FF is on.
* Removed service methods to prevent unnecessary upstream registrations
* Forgot to actually remove the injected command in the services
* Rui's feedback
* Add missing summary
* Missed [FromBody]
* [PM-1203] feat: allow verification for all passwordless accounts (#3038)
* [PM-1033] Org invite user creation flow 1 (#3028)
* [PM-1033] feat: remove user verification from password enrollment
* [PM-1033] feat: auto accept invitation when enrolling into password reset
* [PM-1033] fix: controller tests
* [PM-1033] refactor: `UpdateUserResetPasswordEnrollmentCommand`
* [PM-1033] refactor(wip): make `AcceptUserCommand`
* Revert "[PM-1033] refactor(wip): make `AcceptUserCommand`"
This reverts commit dc1319e7fa.
* Revert "[PM-1033] refactor: `UpdateUserResetPasswordEnrollmentCommand`"
This reverts commit 43df689c7f.
* [PM-1033] refactor: move invite accept to controller
This avoids creating yet another method that depends on having `IUserService` passed in as a parameter
* [PM-1033] fix: add missing changes
* [PM-1381] Add Trusted Device Keys to Auth Response (#3066)
* Return Keys for Trusted Device
- Check whether the current logging in device is trusted
- Return their keys on successful login
* Formatting
* Address PR Feedback
* Add Remarks Comment
* [PM-1338] `AuthRequest` Event Logs (#3046)
* Update AuthRequestController
- Only allow AdminApproval Requests to be created from authed endpoint
- Add endpoint that has authentication to be able to create admin approval
* Add PasswordlessAuthSettings
- Add settings for customizing expiration times
* Add new EventTypes
* Add Logic for AdminApproval Type
- Add logic for validating AdminApproval expiration
- Add event logging for Approval/Disapproval of AdminApproval
- Add logic for creating AdminApproval types
* Add Test Helpers
- Change BitAutoData to allow you to use string representations of common types.
* Add/Update AuthRequestService Tests
* Run Formatting
* Switch to 7 Days
* Add Test Covering ResponseDate Being Set
* Address PR Feedback
- Create helper for checking if date is expired
- Move validation logic into smaller methods
* Switch to User Event Type
- Make RequestDeviceApproval user type
- User types will log for each org user is in
* [PM-2998] Move Approving Device Check (#3101)
* Move Check for Approving Devices
- Exclude currently logging in device
- Remove old way of checking
- Add tests asserting behavior
* Update DeviceType list
* Update Naming & Address PR Feedback
* Fix Tests
* Address PR Feedback
* Formatting
* Now Fully Update Naming?
* Feature/auth/pm 2759/add can reset password to user decryption options (#3113)
* PM-2759 - BaseRequestValidator.cs - CreateUserDecryptionOptionsAsync - Add new hasManageResetPasswordPermission for post SSO redirect logic required on client.
* PM-2759 - Update IdentityServerSsoTests.cs to all pass based on the addition of HasManageResetPasswordPermission to TrustedDeviceUserDecryptionOption
* IdentityServerSsoTests.cs - fix typo in test name: LoggingApproval --> LoginApproval
* PM1259 - Add test case for verifying that TrustedDeviceOption.hasManageResetPasswordPermission is set properly based on user permission
* dotnet format run
* Feature/auth/pm 2759/add can reset password to user decryption options fix jit users (#3120)
* PM-2759 - IdentityServer - CreateUserDecryptionOptionsAsync - hasManageResetPasswordPermission set logic was broken for JIT provisioned users as I assumed we would always have a list of at least 1 org during the SSO process. Added TODO for future test addition but getting this out there now as QA is blocked by being unable to create JIT provisioned users.
* dotnet format
* Tiny tweak
* [PM-1339] Allow Rotating Device Keys (#3096)
* Allow Rotation of Trusted Device Keys
- Add endpoint for getting keys relating to rotation
- Add endpoint for rotating your current device
- In the same endpoint allow a list of other devices to rotate
* Formatting
* Use Extension Method
* Add Tests from PR
Co-authored-by: Jared Snider <jsnider@bitwarden.com>
---------
Co-authored-by: Jared Snider <jsnider@bitwarden.com>
* Check the user directly if they have the ResetPasswordKey (#3153)
* PM-3327 - UpdateKeyAsync must exempt the currently calling device from the logout notification in order to prevent prematurely logging the user out before the client side key rotation process can complete. The calling device will log itself out once it is done. (#3170)
* Allow OTP Requests When Users Are On TDE (#3184)
* [PM-3356][PM-3292] Allow OTP For All (#3188)
* Allow OTP For All
- On a trusted device isn't a good check because a user might be using a trusted device locally but not trusted it long term
- The logic wasn't working for KC users anyways
* Remove Old Comment
* [AC-1601] Added RequireSso policy as a dependency of TDE (#3209)
* Added RequireSso policy as a dependency of TDE.
* Added test for RequireSso for TDE.
* Added save.
* Fixed policy name.
---------
Co-authored-by: Andreas Coroiu <acoroiu@bitwarden.com>
Co-authored-by: Justin Baur <19896123+justindbaur@users.noreply.github.com>
Co-authored-by: Vincent Salucci <vincesalucci21@gmail.com>
Co-authored-by: Jared Snider <116684653+JaredSnider-Bitwarden@users.noreply.github.com>
Co-authored-by: Jared Snider <jsnider@bitwarden.com>
* Extract Import-Api endpoints into separate controller
Moved ciphers/import and ciphers/import-organization into new ImportController
Paths have been kept intact for now (no changes on clients needed)
Moved request-models used for import into tools-subfolder
* Update CODEOWNERS for team-tools-dev
* Move HibpController (reports) to tools
* Moving files related to Send
* Moving files related to ReferenceEvent
* Removed unneeded newline
* Adding organization name on subscription and update
* Changes after running dotnet format -v diag
* Change the OrganizationName to GetName
* Change GetName to OwnerName
* Change the OwnerName to SubscriberName
* Reverting the changes made by dotnet format-v diag
* Removing extract space
* resolve the lint issue
* Fix whitespace formatting issue
* Resolving pr comment on changing organization
* Fixing the failing test
* Using the ISubscriber interface for consistent
* fixing the whitescapes
* Resolving the PR comments
* resolving the whitespace format
* Remove unnecessary directive
* Resolving the whitespace issue
* changes for organization instead of subscriber
* resolving the failing test
* Resolve lint issue by removing unnecessary directive
* Resolve the PR comment
* remove these blank lines
* Fixing whitespace formatting
* add timestamps to user table for security related events
* ef migrations
* fix lint problems
* formatting
* add missing namespace back
* move `now` up some
* review fixes
* add missing view rebuild to migration script
* Add KdfMemory and KDFParallelism fields
* Revise argon2 support
This pull request makes the new attribues for argon2, kdfMemory and
kdfParallelism optional. Furthermore it adds checks for the argon2
parametrs and improves the database migration script.
* Add validation for argon2 in RegisterRequestModel
* update validation messages
* update sql scripts
* register data protection with migration factories
* add ef migrations
* update kdf option validation
* adjust validation
* Centralize and Test KDF Validation
Co-authored-by: Kyle Spearrin <kspearrin@users.noreply.github.com>
Co-authored-by: Kyle Spearrin <kyle.spearrin@gmail.com>
Co-authored-by: Justin Baur <19896123+justindbaur@users.noreply.github.com>
* Added UnknownDeviceVerificationEnabled on User that is turned off when emergency contact takes over the account. Also added endpoints to get and update 2fa device verification settings. And Updated migrations & tests
* Applied dotnet format
* Fixed method rename call on TwoFactorController
* PS-589 Format fixes
* PS-589 changed UnknownDeviceVerificationEnabled to be non-nullable
* Start switch to System.Text.Json
* Work on switching to System.Text.Json
* Main work on STJ refactor
* Fix build errors
* Run formatting
* Delete unused file
* Use legacy for two factor providers
* Run formatter
* Add TokenProviderTests
* Run formatting
* Fix merge issues
* Switch to use JsonSerializer
* Address PR feedback
* Fix formatting
* Ran formatter
* Switch to async
* Ensure Enums are serialized as strings
* Fix formatting
* Enqueue single items as arrays
* Remove CreateAsync method on AzureQueueService
