1
0
mirror of https://github.com/bitwarden/server synced 2025-12-06 00:03:34 +00:00
Commit Graph

6264 Commits

Author SHA1 Message Date
Vijay Oommen
a3b3e370f2 PM-26208 updated api endpoint (#6431)
(cherry picked from commit a6726d2e04)
v2025.10.0
2025-10-10 11:28:11 -04:00
Alex Morask
d26e290cf4 Resolve tax estimation for Families scenarios (#6437) 2025-10-10 08:20:13 -05:00
Github Actions
a15974029e Bumped version to 2025.10.0 2025-10-06 10:45:33 +00:00
renovate[bot]
baf53d1a5a [deps] Tools: Update MailKit to 4.14.0 (#6413)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-10-06 11:51:07 +02:00
renovate[bot]
53d9d52405 [deps] Tools: Update aws-sdk-net monorepo (#6412)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-10-06 11:50:18 +02:00
Kyle Spearrin
60d701c945 [PM-25427] Allow reading mail templates from disk (#6123)
* Allow reading mail templates from self host disk

* Update src/Core/Services/Implementations/HandlebarsMailService.cs

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update src/Core/Services/Implementations/HandlebarsMailService.cs

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* tweak logic

* some error handling reading templates from disk

* fix: broken test

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Andreas Coroiu <andreas.coroiu@gmail.com>
2025-10-06 10:13:56 +02:00
cd-bitwarden
d2577f670e [Sm-1615] ma identifiers (#6407)
* Adding new logging for secrets

* fixing secrest controller tests

* fixing the tests

* Server side changes for adding ProjectId to Event table, adding Project event logging to projectsController

* Rough draft with TODO's need to work on EventRepository.cs, and ProjectRepository.cs

* Undoing changes to make projects soft delete, we want those to be fully deleted still. Adding GetManyTrashedSecretsByIds to secret repo so we can get soft deleted secrets, getSecrets in eventsController takes in orgdId, so that we can check the permission even if the secret was permanently deleted and doesn' thave the org Id set. Adding Secret Perm Deleted, and Restored to event logs

* db changes

* fixing the way we log events

* Trying to undo some manual changes that should have been migrations

* adding migration files

* fixing test

* setting up userid for project controller tests

* adding sql

* sql

* Rename file

* Trying to get it to for sure add the column before we try and update sprocs

* Adding code to refresh the view to include ProjectId I hope

* code improvements

* Suggested changes

* suggested changes

* trying to fix sql issues

* fixing swagger issue

* Update src/Core/SecretsManager/Repositories/Noop/NoopSecretRepository.cs

Co-authored-by: Justin Baur <19896123+justindbaur@users.noreply.github.com>

* Suggested changes

* Adding event logging for machine accounts

* fixing two tests

* trying to fix all tests

* trying to fix tests

* fixing test

* Migrations

* fix

* updating eps

* adding migration

* Adding missing SQL changes

* updating sql

* fixing sql

* running migration again

* fixing sql

* adding query to add grantedSErviceAccountId to event table

* Suggested improvements

* removing more migrations

* more removal

* removing all migrations to them redo them

* redoing migration

* Copilot suggested fixes

* fixing view

* fixing test

* fix?

* trying to fix failing test

* fixing db test

* Fix

* "fix"

* last "fix" before I lose my mind

* ef migrations

* Removing bad migration and adding indexes properly

* order results chronologically

* order by desc on machine account events

* Changing the queries to not unecessarily create the event view again

* Fixing dapper for grantedServiceAccountId

---------

Co-authored-by: Justin Baur <19896123+justindbaur@users.noreply.github.com>
2025-10-03 12:50:01 -04:00
Rui Tomé
a14cc9f932 [PM-25315] Mark enum EventType.Organization_CollectionManagement_Updated as obsolete for historical data reference (#6373) 2025-10-03 14:32:31 +01:00
Brant DeBow
cde458760c Refactor Slack Callback Mechanism (#6388)
* Refactor Slack Callback

* Add more safety to state param, clarify if logic, update tests

* Added an additional 2 possible cases to test: integration is not a slack integration, and the integration has already been claimed

* Implement SonarQube suggestion

* Adjusted org hash to include timestamp; addressed PR feedback
2025-10-03 09:30:29 -04:00
cyprain-okeke
1dc4c327e4 Add the feature flag (#6405) 2025-10-02 16:11:04 +01:00
Brant DeBow
fe88275cd0 Add default values for MaxConcurrentCalls and PrefetchCount across event and integration ASB listeners (#6403)
* Add default values for MaxConcurrentCalls and PrefetchCount across all event and integration ASB listeners

* Fix test failure
2025-10-02 08:34:51 -04:00
renovate[bot]
28fa3037a4 [deps] BRE: Update rabbitmq Docker tag to v4.1.3 (#6205)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-10-01 13:04:44 -04:00
rr-bw
e2f96be4dc refactor(sso-config-tweaks): [Auth/PM-933] Make Single Sign-On URL required regardless of EntityId (#6314)
Makes the Single Sign-On URL required regardless of the EntityId
2025-10-01 08:55:03 -07:00
Alex Morask
61265c7533 [PM-25463] Work towards complete usage of Payments domain (#6363)
* Use payment domain

* Run dotnet format and remove unused code

* Fix swagger

* Stephon's feedback

* Run dotnet format
2025-10-01 10:26:39 -05:00
Rui Tomé
7cefca330b [PM-26050] Migrate all DefaultUserCollection when claimed user is deleted (#6366)
* feat: migrate DefaultUserCollection to SharedCollection during user deletion

- Implemented migration of DefaultUserCollection to SharedCollection in EF UserRepository before deleting organization users.
- Updated stored procedures User_DeleteById and User_DeleteByIds to include migration logic.
- Added new migration script for updating stored procedures.

* Add unit test for user deletion and DefaultUserCollection migration

- Implemented a new test to verify the migration of DefaultUserCollection to SharedCollection during user deletion in UserRepository.
- The test ensures that the user is deleted and the associated collection is updated correctly.

* Refactor user deletion process in UserRepository

- Moved migrating DefaultUserCollection to SharedCollection to happen before the deletion of user-related entities.
- Updated the deletion logic to use ExecuteDeleteAsync for improved performance and clarity.
- Ensured that all related entities are removed in a single transaction to maintain data integrity.

* Add unit test for DeleteManyAsync in UserRepository

- Implemented a new test to verify the deletion of multiple users and the migration of their DefaultUserCollections to SharedCollections.
- Ensured that both users are deleted and their associated collections are updated correctly in a single transaction.

* Refactor UserRepositoryTests to use test user creation methods and streamline collection creation

* Ensure changes are saved after deleting users in bulk

* Refactor UserRepository to simplify migration queries and remove unnecessary loops for better performance

* Refactor UserRepository to encapsulate DefaultUserCollection migration logic in a separate method

* Refactor UserRepository to optimize deletion queries by using joins instead of subqueries for improved performance

* Refactor UserRepositoryTest DeleteManyAsync_Works to ensure GroupUser and CollectionUser deletion

---------

Co-authored-by: Thomas Rittson <31796059+eliykat@users.noreply.github.com>
2025-10-01 14:28:19 +01:00
cd-bitwarden
bca1d585c5 [SM-1489] machine account events (#6187)
* Adding new logging for secrets

* fixing secrest controller tests

* fixing the tests

* Server side changes for adding ProjectId to Event table, adding Project event logging to projectsController

* Rough draft with TODO's need to work on EventRepository.cs, and ProjectRepository.cs

* Undoing changes to make projects soft delete, we want those to be fully deleted still. Adding GetManyTrashedSecretsByIds to secret repo so we can get soft deleted secrets, getSecrets in eventsController takes in orgdId, so that we can check the permission even if the secret was permanently deleted and doesn' thave the org Id set. Adding Secret Perm Deleted, and Restored to event logs

* db changes

* fixing the way we log events

* Trying to undo some manual changes that should have been migrations

* adding migration files

* fixing test

* setting up userid for project controller tests

* adding sql

* sql

* Rename file

* Trying to get it to for sure add the column before we try and update sprocs

* Adding code to refresh the view to include ProjectId I hope

* code improvements

* Suggested changes

* suggested changes

* trying to fix sql issues

* fixing swagger issue

* Update src/Core/SecretsManager/Repositories/Noop/NoopSecretRepository.cs

Co-authored-by: Justin Baur <19896123+justindbaur@users.noreply.github.com>

* Suggested changes

* Adding event logging for machine accounts

* fixing two tests

* trying to fix all tests

* trying to fix tests

* fixing test

* Migrations

* fix

* updating eps

* adding migration

* Adding missing SQL changes

* updating sql

* fixing sql

* running migration again

* fixing sql

* adding query to add grantedSErviceAccountId to event table

* Suggested improvements

* removing more migrations

* more removal

* removing all migrations to them redo them

* redoing migration

---------

Co-authored-by: Justin Baur <19896123+justindbaur@users.noreply.github.com>
2025-10-01 13:13:49 +00:00
Maciej Zieniuk
721fda0aaa [PM-25473] Non-encryption passkeys prevent key rotation (#6359)
* use webauthn credentials that have encrypted user key for user key rotation

* where condition simplification
2025-09-30 17:30:00 +02:00
Nick Krantz
12303b3acf When deleting an archived clear the archived date so it will be restored to the vault (#6398) 2025-09-30 10:04:11 -05:00
John Harrington
fc07dec3a6 PM-25915 tools exclude items in my items collections and my items collection from org vault export endpoint (#6362)
Exclude MyItems and MyItems collection from Organizational Exports when CreateDefaultLocation feature flag is enabled
2025-09-30 07:43:43 -07:00
Alexey Zilber
718d96cc58 Increased usable port range for ephemeral ports from 26,669 to 59,976 (#6394) 2025-09-30 12:28:30 +08:00
rr-bw
8784907736 chore(flag-removal): [Auth/PM20439] Remove Flagging Logic for BrowserExtensionLoginApproval (#6368) 2025-09-29 13:29:18 -07:00
Maciej Zieniuk
f6b99a7906 adds pm-23995-no-logout-on-kdf-change feature flag (#6397) 2025-09-29 21:00:09 +02:00
Tyler
ca3d05c723 BRE-1040 Dockerfiles shared ownership (#6257)
* Include AppSec team and BRE dept for repository-level ownership of Dockerfile, and Dockerfile related, files.
2025-09-29 14:40:20 -04:00
Nick Krantz
46958cc838 [PM-25982] Restrict Ciphers being assigned to Default from Shared collections (#6382)
* validate that any change in collection does not allow only shared ciphers to migrate to a default cipher

* refactor order of checks to avoid any unnecessary calls

* remove unneeded conditional
2025-09-29 13:06:52 -05:00
Brandon Treston
f1af331a0c remove feature flag (#6395) 2025-09-29 13:22:39 -04:00
Patrick-Pimentel-Bitwarden
e0ccd7f578 chore(global-settings): [PM-24717] New Global Settings For New Device Verification - Updated secrets in the example secrets.json (#6387) 2025-09-29 13:06:52 -04:00
renovate[bot]
a36340e9ad [deps]: Update prettier to v3.6.2 (#6212)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-09-29 09:17:13 -04:00
Mick Letofsky
3dd4ee7a07 Create new Action for Claude code review of Vault Team code (#6379)
Create new action for Claude Code Review of Vault Team Code. Worked to align what we have here with the initial `mcp-server` repo's code review action.
2025-09-29 08:31:56 +02:00
Jordan Aasen
3a6b9564d5 [PM-26004] - fix DeleteByOrganizationIdAsync_ExcludesDefaultCollectionCiphers test (#6389)
* fix test

* fix test
2025-09-26 14:30:34 -07:00
Jordan Aasen
b9e8b11311 update collections admin proc and repo (#6374) 2025-09-26 10:05:56 -07:00
renovate[bot]
80e7f4d85c [deps] Billing: Update BenchmarkDotNet to 0.15.3 (#6041)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Alex Morask <144709477+amorask-bitwarden@users.noreply.github.com>
2025-09-26 15:05:23 +00:00
renovate[bot]
9e0b767c98 [deps] Billing: Update CsvHelper to 33.1.0 (#6042)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Alex Morask <144709477+amorask-bitwarden@users.noreply.github.com>
2025-09-26 09:56:28 -05:00
Mick Letofsky
ef54bc814d Fix a couple broken links found during self-onboarding (#6386)
* Fix a couple broken links found during self-onboarding
2025-09-26 15:46:57 +02:00
Kyle Spearrin
0df22ff581 null coalesce collections to an empty array (#6381) 2025-09-25 19:05:48 -04:00
Dave
6466c00acd fix(user-decryption-options) [PM-23174]: ManageAccountRecovery Permission Forces Master Password Set (#6230)
* fix(user-decryption-options): ManageAccountRecovery Permission Forces MP Set - Update tests, add OrganizationUser fixture customization for Permissions

* fix(user-decryption-options): ManageAccountRecovery Permission Forces MP Set - Update hasManageResetPasswordPermission evaluation.

* PM-23174 - Add TODO for endpoint per sync discussion with Dave

* fix(user-decryption-options): ManageAccountRecovery Permission Forces MP Set - Clean up comments.

* fix(user-decryption-options): ManageAccountRecovery Permission Forces MP Set - Remove an outdated comment.

* fix(user-decryption-options): ManageAccountRecovery Permission Forces MP Set - Elaborate on comments around Organization User invite-time evaluation.

* fix(user-decryption-options): Use currentContext for Provider relationships, update comments, and feature flag the change.

* fix(user-decryption-options): Update test suite and provide additional comments for future flag removal.

---------

Co-authored-by: Jared Snider <jsnider@bitwarden.com>
2025-09-25 13:37:36 -04:00
Matt Bishop
222436589c Enhance Claude instructions (#6378)
* Enhance Claude instructions

* Further simplify language
2025-09-25 12:37:29 -04:00
Mick Letofsky
179684a9e6 Begin pilot program for Claude code reviews with initial system prompt (#6371)
* Rough draft of a markdown file to give context to Claude.
2025-09-25 07:46:59 +02:00
Thomas Rittson
b83f95f78c [PM-25097] Remove DeleteClaimedUserAccountRefactor flag (#6364)
* Remove feature flag
* Remove old code
2025-09-25 10:14:02 +10:00
Nik Gilmore
f0953ed6b0 [PM-26126] Add includeMemberItems query param to GET /organization-details (#6376) 2025-09-24 15:25:40 -07:00
Patrick-Pimentel-Bitwarden
4b10c16419 fix(global-settings): [PM-26092] Token Refresh Doc Enhancement (#6367)
* fix(global-settings): [PM-26092] Token Refresh Doc Enhancement - Enhanced documentation and wording for token refresh.
2025-09-24 18:23:15 -04:00
Todd Martin
68f7e8c15c chore(feature-flag) Added feature flag for pm-22110-disable-alternate-login-methods 2025-09-24 19:30:43 +00:00
Nick Krantz
6edab46d97 [PM-24357] Do not purge ciphers in the default collection (#6320)
* do not purge ciphers in the default collection

* Update `DeleteByOrganizationId` procedure to be more performant based on PR review feedback

* update EF integration for purge to match new SQL implementation

* update Cipher_DeleteByOrganizationId based on PR feedback from dbops team
2025-09-24 12:52:04 -05:00
Ike
6e4f05ebd3 fix: change policies to static strings and update auth owned endpoints (#6296) 2025-09-24 08:42:56 -04:00
Bernd Schoolmann
ff092a031e [PM-23229] Add extra validation to kdf changes + authentication data + unlock data (#6121)
* Added MasterPasswordUnlock to UserDecryptionOptions as part of identity response

* Implement support for authentication data and unlock data in kdf change

* Extract to kdf command and add tests

* Fix namespace

* Delete empty file

* Fix build

* Clean up tests

* Fix tests

* Add comments

* Cleanup

* Cleanup

* Cleanup

* Clean-up and fix build

* Address feedback; force new parameters on KDF change request

* Clean-up and add tests

* Re-add logger

* Update logger to interface

* Clean up, remove Kdf Request Model

* Remove kdf request model tests

* Fix types in test

* Address feedback to rename request model and re-add tests

* Fix namespace

* Move comments

* Rename InnerKdfRequestModel to KdfRequestModel

---------

Co-authored-by: Maciej Zieniuk <mzieniuk@bitwarden.com>
2025-09-23 16:10:46 -04:00
Todd Martin
744f11733d Revert "Bumped version to 2025.9.3" (#6369)
This reverts commit 0b4b605524.
2025-09-23 13:07:42 -04:00
Github Actions
0b4b605524 Bumped version to 2025.9.3 2025-09-23 15:52:56 +00:00
Ike
3b54fea309 [PM-22696] send enumeration protection (#6352)
* feat: add static enumeration helper class
* test: add enumeration helper class unit tests

* feat: implement NeverAuthenticateValidator
* test: unit and integration tests SendNeverAuthenticateValidator

* test: use static class for common integration test setup for Send Access unit and integration tests
* test: update tests to use static helper
2025-09-23 06:38:22 -04:00
Daniel Riera
c6f5d5e36e [PM-25986] Add server side enum type for AutotypeDefaultSetting policy (#6356)
* PM-25986 Add server side enum type for AutotypeDefaultSetting policy

* Update PolicyType.cs

remove space
2025-09-22 15:39:15 -04:00
Stephon Brown
ed5e4271df [PM-25123] Remove VerifyBankAsync Code (#6355)
* refactor: remove VerifyBankAsync from interface and implementation

* refactor: remove controller endpoint
2025-09-22 13:51:36 -04:00
Addison Beck
8c238ce08d fix: adjust permissions of repo management workflow (#6130)
- Specify permissions needed for the repo_management job
- Add required permissions (actions: read, contents: write, id-token: write, pull-requests: write) to the move_edd_db_scripts job
2025-09-22 13:46:35 -04:00