From 90b70ce35488b937b48cc49d99654af81576cc28 Mon Sep 17 00:00:00 2001
From: Conner Turnbull <133619638+cturnbull-bitwarden@users.noreply.github.com>
Date: Thu, 20 Mar 2025 09:56:03 -0400
Subject: [PATCH] Wrapped phishing detection feature behind feature flag
 (#5532)

---
 src/Api/Controllers/PhishingDomainsController.cs | 16 ++++++++++++++--
 src/Api/Jobs/UpdatePhishingDomainsJob.cs         | 11 ++++++++++-
 src/Core/Constants.cs                            |  1 +
 3 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/src/Api/Controllers/PhishingDomainsController.cs b/src/Api/Controllers/PhishingDomainsController.cs
index b353dd2cbd..f0c1a65648 100644
--- a/src/Api/Controllers/PhishingDomainsController.cs
+++ b/src/Api/Controllers/PhishingDomainsController.cs
@@ -1,14 +1,21 @@
-using Bit.Core.Repositories;
+using Bit.Core;
+using Bit.Core.Repositories;
+using Bit.Core.Services;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Bit.Api.Controllers;
 
 [Route("phishing-domains")]
-public class PhishingDomainsController(IPhishingDomainRepository phishingDomainRepository) : Controller
+public class PhishingDomainsController(IPhishingDomainRepository phishingDomainRepository, IFeatureService featureService) : Controller
 {
     [HttpGet]
     public async Task<ActionResult<ICollection<string>>> GetPhishingDomainsAsync()
     {
+        if (!featureService.IsEnabled(FeatureFlagKeys.PhishingDetection))
+        {
+            return NotFound();
+        }
+
         var domains = await phishingDomainRepository.GetActivePhishingDomainsAsync();
         return Ok(domains);
     }
@@ -16,6 +23,11 @@ public class PhishingDomainsController(IPhishingDomainRepository phishingDomainR
     [HttpGet("checksum")]
     public async Task<ActionResult<string>> GetChecksumAsync()
     {
+        if (!featureService.IsEnabled(FeatureFlagKeys.PhishingDetection))
+        {
+            return NotFound();
+        }
+
         var checksum = await phishingDomainRepository.GetCurrentChecksumAsync();
         return Ok(checksum);
     }
diff --git a/src/Api/Jobs/UpdatePhishingDomainsJob.cs b/src/Api/Jobs/UpdatePhishingDomainsJob.cs
index 64a26f51af..355f2af69b 100644
--- a/src/Api/Jobs/UpdatePhishingDomainsJob.cs
+++ b/src/Api/Jobs/UpdatePhishingDomainsJob.cs
@@ -2,6 +2,7 @@
 using Bit.Core.Jobs;
 using Bit.Core.PhishingDomainFeatures.Interfaces;
 using Bit.Core.Repositories;
+using Bit.Core.Services;
 using Bit.Core.Settings;
 using Quartz;
 
@@ -12,21 +13,29 @@ public class UpdatePhishingDomainsJob : BaseJob
     private readonly GlobalSettings _globalSettings;
     private readonly IPhishingDomainRepository _phishingDomainRepository;
     private readonly ICloudPhishingDomainQuery _cloudPhishingDomainQuery;
-
+    private readonly IFeatureService _featureService;
     public UpdatePhishingDomainsJob(
         GlobalSettings globalSettings,
         IPhishingDomainRepository phishingDomainRepository,
         ICloudPhishingDomainQuery cloudPhishingDomainQuery,
+        IFeatureService featureService,
         ILogger<UpdatePhishingDomainsJob> logger)
         : base(logger)
     {
         _globalSettings = globalSettings;
         _phishingDomainRepository = phishingDomainRepository;
         _cloudPhishingDomainQuery = cloudPhishingDomainQuery;
+        _featureService = featureService;
     }
 
     protected override async Task ExecuteJobAsync(IJobExecutionContext context)
     {
+        if (!_featureService.IsEnabled(FeatureFlagKeys.PhishingDetection))
+        {
+            _logger.LogInformation(Constants.BypassFiltersEventId, "Skipping phishing domain update. Feature flag is disabled.");
+            return;
+        }
+
         if (string.IsNullOrWhiteSpace(_globalSettings.PhishingDomain?.UpdateUrl))
         {
             _logger.LogInformation(Constants.BypassFiltersEventId, "Skipping phishing domain update. No URL configured.");
diff --git a/src/Core/Constants.cs b/src/Core/Constants.cs
index e09422871d..2372132596 100644
--- a/src/Core/Constants.cs
+++ b/src/Core/Constants.cs
@@ -177,6 +177,7 @@ public static class FeatureFlagKeys
     public const string PM12276Breadcrumbing = "pm-12276-breadcrumbing-for-business-features";
     public const string PM18794_ProviderPaymentMethod = "pm-18794-provider-payment-method";
     public const string PM3553_MobileSimpleLoginSelfHostAlias = "simple-login-self-host-alias";
+    public const string PhishingDetection = "phishing-detection";
 
     public static List<string> GetAllKeys()
     {