1
0
mirror of https://github.com/bitwarden/server synced 2026-02-25 08:53:21 +00:00
Commit Graph

5021 Commits

Author SHA1 Message Date
renovate[bot]
554d3a472b [deps] Tools: Pin dependencies 2026-02-24 18:18:24 +00:00
Thomas Avery
8f54ac306c [PM-15150] Remove ssh feature flags (#7061) 2026-02-24 12:14:26 -06:00
Rui Tomé
ef4f4e352f [PM-21179] Add interface to check if user is enrolled in account recovery (#6993)
* Add validation for reset password key and account recovery enrollment in OrganizationUser

* Update admin approval logic to check account recovery enrollment and add tests for reset password key validation

* Enhance UserService validation to include account recovery enrollment and add unit test for empty or whitespace reset password key handling

* Refactor OrganizationUserUserDetailsQuery to validate reset password keys and add unit tests for filtering out invalid keys

* Update AdminRecoverAccountCommand to validate account recovery enrollment and adjust tests for whitespace reset password keys

* Enhance OrganizationUserRotationValidator to validate reset password keys, including filtering out whitespace-only keys, and add corresponding unit tests for validation logic.

* Refactor OrganizationUserUserDetailsQueryTests to remove unnecessary whitespace-only test cases for account recovery key validation.

* Refactor MemberResponseModel to use OrganizationUser's validation method for ResetPasswordEnrolled status and update corresponding unit test for clarity.

* Refactor OrganizationUsersController and response models to utilize OrganizationUser's validation method for ResetPasswordKey, ensuring consistent validation across the application. Add unit tests for OrganizationUser to verify key validation logic.

* Update OrganizationUserRotationValidator to handle null reset password keys and adjust tests for client-side bug. Add comments for future migration after resolving PM-31001.

* Fix whitespace issue in UserServiceTests.cs by removing BOM character from the file header.
2026-02-24 14:16:54 +00:00
Rui Tomé
9eccb0001d [PM-30327] Fix SingleOrg policy not revoking non-compliant users (#7001) 2026-02-24 10:54:51 +00:00
Vijay Oommen
5c77ae9810 PM-31725 updated properties to match the pull in public/events (#6959) 2026-02-23 17:00:21 -06:00
renovate[bot]
98d6217b9b [deps]: Update webpack-cli to v6 (#6933)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Dave <3836813+enmande@users.noreply.github.com>
2026-02-23 15:50:58 -05:00
sven-bitwarden
b412826951 [PM-4142] Clean Up Pre-Tokenable Token Validation (#6972)
* Remove old pre-tokenable code

* Clean up dead code

* Remove unused imports
2026-02-23 10:23:38 -06:00
Kyle Denney
b88ce58b59 [PM-30109] edit discounts in bitwarden portal (#7032)
* [PM-30109] edit discounts in bitwarden portal

* forgot model error

* dotnet format

* pr feedback

* pr feedback
2026-02-23 09:43:36 -06:00
Patrick-Pimentel-Bitwarden
3dbd17f61d feat(auth-validator): [Auth/PM-22975] Client Version Validator (#6588)
* feat(auth-validator): [PM-22975] Client Version Validator - Implementation.

* test(auth-validator): [PM-22975] Client Version Validator - Added tests.
2026-02-23 15:00:10 +00:00
sven-bitwarden
993d3bc085 Validate loaded user's org matches pass-in organization when resetting password (#7019) 2026-02-20 15:58:50 -06:00
Jonathan Prusik
414a6d037e add feature flag fill-assist-targeting-rules (#7051) 2026-02-20 20:15:18 +00:00
cd-bitwarden
e6ce670404 [PM-29660] allowing null for continuationToken (#6753)
* allowing null for continuationToken

* Normalizing empty string to null on pagedlistresponsemodel
2026-02-20 15:08:18 -05:00
Maciej Zieniuk
6a7b8f5a89 [PM-31052][PM-32469] Add V2UpgradeToken for key rotation without logout (#6995)
* User V2UpgradeToken for key rotation without logout

* reset old v2 upgrade token on manual key rotation

* sql migration fix

* missing table column

* missing view update

* tests for V2UpgradeToken clearing on manual key rotation

* V2 to V2 rotation causes logout. Updated wrapped key 1 to be a valid V2 encrypted string in tests.

* integration tests failures - increase assert recent for date time type from 2 to 5 seconds (usually for UpdatedAt assertions)

* repository test coverage

* migration script update

* new EF migration scripts

* broken EF migration scripts fixed

* refresh views due to User table alternation
2026-02-20 20:19:14 +01:00
John Harrington
a961626957 gate add/edit endpoints behind premium membership and add test coverage (#7043) 2026-02-20 07:48:18 -07:00
Jared McCannon
708ea66393 [PM-27705] - Notify Admins/Owners/Managers Auto Confirm Enabled (#6938)
* Adding email for sending to owners, admins, and managers to notify that auto confirm feature has been enabled from admin portal
2026-02-20 08:26:31 -06:00
Thomas Rittson
ba1d1b851f Add missing reference to OrgAbility readme (#7028) 2026-02-20 15:46:09 +10:00
cd-bitwarden
6f8a6dccb5 Removing feature flag code from server (#7033) 2026-02-19 18:08:06 -05:00
Nick Krantz
418e6cbfed add prompt age feature flag (#7035) 2026-02-19 14:08:45 -06:00
Stephon Brown
c1fbcefa7e feat(billing): add pm-29593-premium-to-organization-upgrade feature flag (#7041) 2026-02-19 17:56:16 +00:00
Mike Amirault
232b325ed7 [PM-31776] Fix email-verified Send OTP email design discrepancies (#6990)
* [PM-31776] Fix email-verified Send OTP email design discrepancies

* Fix README
2026-02-19 09:52:35 -08:00
Brandon Treston
31fe7b0e12 [PM-26378] Auto confirm events (#7017)
* implement auto confirm push notification

* fix test

* fix test

* simplify LINQ

* add event logging for auto confirm

* fix test
2026-02-19 11:10:28 -06:00
Alex Morask
71a8116d4c [PM-29089] Remove FF: pm-26793-fetch-premium-price-from-pricing-service - Logic (#6989)
* refactor: [PM-39087] remove PM-26793 feature flag from PricingClient

* test: add ListPremiumPlans and GetAvailablePremiumPlan coverage to PricingClientTests
2026-02-19 08:57:29 -06:00
sven-bitwarden
4d91350fb7 [PM-29498] Remove Premium Feature Flagged Logic (#6967)
* Remove feature flag logic and fix unit tests

* Simplify query

* Fix test

* Fix local review
2026-02-19 08:06:17 -06:00
Alex Morask
cfd5bedae0 [PM-31040] Replace ISetupIntentCache with customer-based approach (#6954)
* docs(billing): add design document for replacing SetupIntent cache

* docs(billing): add implementation plan for replacing SetupIntent cache

* feat(db): add gateway lookup stored procedures for Organization, Provider, and User

* feat(db): add gateway lookup indexes to Organization, Provider, and User table definitions

* chore(db): add SQL Server migration for gateway lookup indexes and stored procedures

* feat(repos): add gateway lookup methods to IOrganizationRepository and Dapper implementation

* feat(repos): add gateway lookup methods to IProviderRepository and Dapper implementation

* feat(repos): add gateway lookup methods to IUserRepository and Dapper implementation

* feat(repos): add EF OrganizationRepository gateway lookup methods and index configuration

* feat(repos): add EF ProviderRepository gateway lookup methods and index configuration

* feat(repos): add EF UserRepository gateway lookup methods and index configuration

* chore(db): add EF migrations for gateway lookup indexes

* refactor(billing): update SetupIntentSucceededHandler to use repository instead of cache

* refactor(billing): simplify StripeEventService by expanding customer on SetupIntent

* refactor(billing): query Stripe for SetupIntents by customer ID in GetPaymentMethodQuery

* refactor(billing): query Stripe for SetupIntents by customer ID in HasPaymentMethodQuery

* refactor(billing): update OrganizationBillingService to set customer on SetupIntent

* refactor(billing): update ProviderBillingService to set customer on SetupIntent and query by customer

* refactor(billing): update UpdatePaymentMethodCommand to set customer on SetupIntent

* refactor(billing): remove bank account support from CreatePremiumCloudHostedSubscriptionCommand

* refactor(billing): remove OrganizationBillingService.UpdatePaymentMethod dead code

* refactor(billing): remove ProviderBillingService.UpdatePaymentMethod

* refactor(billing): remove PremiumUserBillingService.UpdatePaymentMethod and UserService.ReplacePaymentMethodAsync

* refactor(billing): remove SubscriberService.UpdatePaymentSource and related dead code

* refactor(billing): update SubscriberService.GetPaymentSourceAsync to query Stripe by customer ID

Add Task 15a to plan - this was a missed requirement for updating
GetPaymentSourceAsync which still used the cache.

* refactor(billing): complete removal of PremiumUserBillingService.Finalize and UserService.SignUpPremiumAsync

* refactor(billing): remove ISetupIntentCache and SetupIntentDistributedCache

* chore: remove temporary planning documents

* chore: run dotnet format

* fix(billing): add MaxLength(50) to Provider gateway ID properties

* chore(db): add EF migrations for Provider gateway column lengths

* chore: run dotnet format

* chore: rename SQL migration for chronological order
2026-02-18 13:20:25 -06:00
Alex Morask
2ce98277b4 chore: [PM-29055] remove pm-25379-use-new-organization-metadata-structure feature flag (#6966)
Remove the fully-released feature flag and clean up the old code path:
- Remove flag constant from FeatureFlagKeys
- Remove [RequireFeature] gate from VNext billing controllers
- Remove old GetMetadataAsync endpoint from OrganizationBillingController
- Remove GetMetadata from IOrganizationBillingService and implementation
- Remove IsOnSecretsManagerStandalone private helper
- Remove associated tests
2026-02-18 09:06:06 -06:00
Jared McCannon
8fefae98e4 [PM-18715] - SCIM Revoke User v2 (#7024)
* Migrated SCIM revoke user call to the v2 implementation.

* Correcting feature string
2026-02-18 08:09:45 -06:00
Thomas Rittson
24b988508c [PM-31978] Expand Organization Ability documentation (#6970) 2026-02-18 08:54:53 +10:00
Dave
e660bb3577 feat(salt-for-user) [PM-31088]: Add feature flag for saltForUser. (#7002) 2026-02-17 17:42:48 -05:00
SmithThe4th
88fa59ae80 Updated delete attachment actions to return a DeleteAttachmentResponseModel (#7013) 2026-02-17 21:06:32 +00:00
Kyle Denney
f0c69cedc2 [PM-30108] import discount from stripe (#6982)
* [PM-30108] import discount from stripe

* fix repo tests

* pr feedback

* wrap discounts in feature flag

* claude pr feedback
2026-02-17 12:57:14 -06:00
Brad
3753a5e853 [PM-31356] Event logs: Ensure User has access to Service Account Organization #6997
Fix a vulnerability in the service account events API that allowed any Premium/Enterprise User to retrieve events for any service account. This change ensures that the requesting User has access to the Organization the service account belongs to, by checking for it in the list of Orgs in request context. This matches the pattern from other endpoints in EventsController
2026-02-17 10:06:03 -08:00
sven-bitwarden
0874163911 [PM-24759] Add Method for Retrieving Policy Requirements for Multiple Users (#6876)
* Adds new method for retrieving policy requirements for a collection of user IDs

* Use Single instead of First for explicit correctness

* Fix xmldoc

* Refactor return type to include user ID
2026-02-17 10:33:27 -06:00
Jimmy Vo
072f6c57a8 [PM-27882] Revert row bulletin changes for confirmation templates. (#7018) 2026-02-17 11:33:15 -05:00
Todd Martin
3ae04026b3 chore(docs): Add new asset docs to README 2026-02-17 10:58:08 -05:00
Jimmy Vo
b03f8f8cae [PM-27882] Update row settings (#7010) 2026-02-16 11:09:17 -05:00
Rui Tomé
e65ed484f9 [PM-21740 / PM-27878] Update join organization email templates (#6941)
* Add new feature flag for updating the join organization email templates

* Add new MJML email template for organization invite to existing users

* Add new MJML email template for organization invite to new users

* Add new MJML email template for organization invite to existing families

* Add new MJML email template for organization invite to families for new users

* Add new MJML email template for organization invite to free users

* Add OrganizationInviteBaseView model for organization invite email templates

* Add required properties for email title customization in OrganizationInviteBaseView

* Add new MJML email templates for organization invites to existing and new users, including families and free users.

* Enhance SendInvitesRequest to include optional InvitingUserId and update related methods in OrganizationService for improved user invitation tracking.

* Refactor organization invite email handling to support customized templates for existing and new users, incorporating inviting user information and enhancing the SendInvitesRequest structure.

* Refactor OrganizationInviteBaseView and SendOrganizationInvitesCommand to remove unnecessary properties, streamlining the organization invite email structure and focusing on essential information for user invitations.

* Refactor SendOrganizationInvitesCommand to improve email invitation logic by removing the OrganizationCategory enum and consolidating plan type checks. Introduce a new method for formatting expiration dates to enhance code clarity and maintainability.

* Update organization invite email templates to enhance styling

* Enhance SendOrganizationInvitesCommand to include additional plan types for organization invites, allowing support for TeamsStarter, TeamsStarter2023, and Custom plans in the invitation logic.

* Add tests for SendOrganizationInvitesCommand to validate email sending logic for various plan types, including Enterprise, Teams, Families, Free, and Custom plans, based on user existence and feature flags.

* Update organization invite email templates to improve styling and layout consistency across various user types, including adjustments to padding, font weights, and vertical alignment for a more polished appearance.

* Refactor organization invite email templates to improve styling consistency and layout across various user types, including adjustments to padding, font families, and visibility of icon rows for a more polished appearance.

* [PM-30610] Break shared components into AC versions

* Revert changes to shared MJML components

* Refactor organization invite email templates to use admin console MJML components

* Update organization invite email templates to utilize new admin console MJML components

* Enhance organization invite email templates by adding bullet point for mobile views

* Update organization invite email templates to improve layout and visibility of bullet points by changing display properties and adding inline text spans.

---------

Co-authored-by: Jimmy Vo <huynhmaivo82@gmail.com>
2026-02-16 11:26:34 +00:00
Dave
ca35b9e26f [PM-29890] Refactor Two-factor WebAuthn Methods Out of UserService (#6920)
* refactor(2fa-webauthn) [PM-29890]: Add command for start 2fa WebAuthn.

* refactor(2fa-webauthn) [PM-29890]: Put files into iface-root /implementations structure to align with other feature areas.

* refactor(2fa-webauthn) [PM-29890]: Add complete WebAuthn registration command.

* test(2fa-webauthn) [PM-29890]: Refactor and imrove 2fa WebAuthn testing from UserService.

* refactor(2fa-webauthn) [PM-29890]: Add delete WebAuthn credential command.

* test(2fa-webauthn) [PM-29890]: Add tests for delete WebAuthn credential command.

* refactor(2fa-webauthn) [PM-29890]: Update docs.

* refctor(2fa-webauthn) [PM-29890]: Re-spell docs.

* refactor(2fa-webauthn) [PM-29890]: Add comment around last-credential deletion.
2026-02-13 13:35:42 -05:00
cyprain-okeke
84521a67c8 [PM-30908]Correct Premium subscription status handling (#6877)
* Implement the correct changes

* failing test has been removed

* Add unit testing and logs

* Resolve the pr comment on missed requirements

* fix the lint error

* resolve the build lint

* Fix the failing test

* Fix the failing test

* Add the IncompleteExpired status

* resolve the lint error

* Fix the build lint error

* Implement the IncompleteExpired flow
2026-02-13 18:56:26 +01:00
Jimmy Vo
ea2b9b73c2 [PM-30610] Address design feedback for the organization confirmation email templates. (#6873) 2026-02-13 12:34:29 -05:00
Brandon Treston
bf9cc01459 [PM-26379] Implement auto confirm push notification (#6980)
* implement auto confirm push notification

* fix test

* fix test

* simplify LINQ
2026-02-13 11:50:12 -05:00
Jackson Engstrom
3cf8c98e40 add feature flag pm-32180-premium-upsell-account-age (#7000) 2026-02-13 08:45:52 -08:00
Jared
9a3d8a0c86 Remove feature flag from server constants (#6983) 2026-02-13 11:44:58 -05:00
Alex Dragovich
94f7266feb [PM-31483] adding guard for when email verification FF is disabled (#6927)
* [PM-31483] adding guard for when email verification FF is disabled

* [PM-31483] removing need for client fallback endpoint

* [PM-31483] fixing test after main merge

* [PM-31483] changing error when email protected send should not be allowed to be viewed
2026-02-12 13:58:44 -08:00
Jordan Aasen
c15c41801a [PM-31964] - update feature flag name (#6991)
* add pm-31019-item-action-in-extension feature flag

* fix typo in flag name
2026-02-11 22:23:20 +00:00
Rui Tomé
17166dc0f5 [PM-28300] Remove BlockClaimedDomainAccountCreation feature flag checks (#6934)
* [PM-28300] Remove BlockClaimedDomainAccountCreation feature flag checks

* Fix user registration tests by adding proper email domains

* Remove redundant feature flag checks from user registration tests

* Remove BlockClaimedDomainAccountCreation constant from FeatureFlagKeys
2026-02-11 22:10:59 +00:00
John Harrington
d9b6df2692 [PM-31611] Improve readability by explicitly setting AuthType in SendRequestModel (#6962)
* improve readability by  explicitly setting AuthType in SendRequestModel

* fix failing tests to match updated behavior expectations
2026-02-11 13:37:41 -07:00
Jordan Aasen
1278c5af09 add pm-31019-item-action-in-extension feature flag (#6987) 2026-02-11 19:20:45 +00:00
Jared McCannon
0566de90d6 [PM-27145] - Block Auto Confirm Enable Admin Portal (#6981)
* Extracted policy compliance checking for the organization out and added a check when attempting to enable auto user confirm via Admin Portal

* Moved injection order. Fixed error message.
2026-02-11 09:59:18 -06:00
Bernd Schoolmann
946a03233b Add unlock-via-sdk feature flag (#6985) 2026-02-11 15:35:06 +01:00
Derek Nance
de330e987d [PM-32007] Use kebab instead of snake case for cookie vendor (#6977) 2026-02-10 15:26:19 -06:00