Merge branch 'main' into jmccannon/ac/pm-16811-scim-invite-optimization

# Conflicts:
#	src/Core/AdminConsole/Services/Implementations/OrganizationService.cs
#	test/Infrastructure.IntegrationTest/AdminConsole/Repositories/OrganizationUserRepositoryTests.cs

.github/renovate.json

@@ -1,199 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["github>bitwarden/renovate-config"],
-  "enabledManagers": [
-    "dockerfile",
-    "docker-compose",
-    "github-actions",
-    "npm",
-    "nuget"
-  ],
-  "packageRules": [
-    {
-      "groupName": "dockerfile minor",
-      "matchManagers": ["dockerfile"],
-      "matchUpdateTypes": ["minor"]
-    },
-    {
-      "groupName": "docker-compose minor",
-      "matchManagers": ["docker-compose"],
-      "matchUpdateTypes": ["minor"]
-    },
-    {
-      "groupName": "github-action minor",
-      "matchManagers": ["github-actions"],
-      "matchUpdateTypes": ["minor"]
-    },
-    {
-      "matchManagers": ["dockerfile", "docker-compose"],
-      "commitMessagePrefix": "[deps] BRE:"
-    },
-    {
-      "matchPackageNames": ["DnsClient"],
-      "description": "Admin Console owned dependencies",
-      "commitMessagePrefix": "[deps] AC:",
-      "reviewers": ["team:team-admin-console-dev"]
-    },
-    {
-      "matchFileNames": ["src/Admin/package.json", "src/Sso/package.json"],
-      "description": "Admin & SSO npm packages",
-      "commitMessagePrefix": "[deps] Auth:",
-      "reviewers": ["team:team-auth-dev"]
-    },
-    {
-      "matchPackageNames": [
-        "Azure.Extensions.AspNetCore.DataProtection.Blobs",
-        "DuoUniversal",
-        "Fido2.AspNet",
-        "Duende.IdentityServer",
-        "Microsoft.Extensions.Identity.Stores",
-        "Otp.NET",
-        "Sustainsys.Saml2.AspNetCore2",
-        "YubicoDotNetClient"
-      ],
-      "description": "Auth owned dependencies",
-      "commitMessagePrefix": "[deps] Auth:",
-      "reviewers": ["team:team-auth-dev"]
-    },
-    {
-      "matchPackageNames": [
-        "AutoFixture.AutoNSubstitute",
-        "AutoFixture.Xunit2",
-        "BenchmarkDotNet",
-        "BitPay.Light",
-        "Braintree",
-        "coverlet.collector",
-        "CsvHelper",
-        "Kralizek.AutoFixture.Extensions.MockHttp",
-        "Microsoft.AspNetCore.Mvc.Testing",
-        "Microsoft.Extensions.Logging",
-        "Microsoft.Extensions.Logging.Console",
-        "Newtonsoft.Json",
-        "NSubstitute",
-        "Sentry.Serilog",
-        "Serilog.AspNetCore",
-        "Serilog.Extensions.Logging",
-        "Serilog.Extensions.Logging.File",
-        "Serilog.Sinks.AzureCosmosDB",
-        "Serilog.Sinks.SyslogMessages",
-        "Stripe.net",
-        "Swashbuckle.AspNetCore",
-        "Swashbuckle.AspNetCore.SwaggerGen",
-        "xunit",
-        "xunit.runner.visualstudio"
-      ],
-      "description": "Billing owned dependencies",
-      "commitMessagePrefix": "[deps] Billing:",
-      "reviewers": ["team:team-billing-dev"]
-    },
-    {
-      "matchPackagePatterns": ["^Microsoft.Extensions.Logging"],
-      "groupName": "Microsoft.Extensions.Logging",
-      "description": "Group Microsoft.Extensions.Logging to exclude them from the dotnet monorepo preset"
-    },
-    {
-      "matchPackageNames": [
-        "Dapper",
-        "dbup-sqlserver",
-        "dotnet-ef",
-        "linq2db.EntityFrameworkCore",
-        "Microsoft.Azure.Cosmos",
-        "Microsoft.Data.SqlClient",
-        "Microsoft.EntityFrameworkCore.Design",
-        "Microsoft.EntityFrameworkCore.InMemory",
-        "Microsoft.EntityFrameworkCore.Relational",
-        "Microsoft.EntityFrameworkCore.Sqlite",
-        "Microsoft.EntityFrameworkCore.SqlServer",
-        "Microsoft.Extensions.Caching.Cosmos",
-        "Microsoft.Extensions.Caching.SqlServer",
-        "Microsoft.Extensions.Caching.StackExchangeRedis",
-        "Npgsql.EntityFrameworkCore.PostgreSQL",
-        "Pomelo.EntityFrameworkCore.MySql"
-      ],
-      "description": "DbOps owned dependencies",
-      "commitMessagePrefix": "[deps] DbOps:",
-      "reviewers": ["team:dept-dbops"]
-    },
-    {
-      "matchPackageNames": ["CommandDotNet", "YamlDotNet"],
-      "description": "DevOps owned dependencies",
-      "commitMessagePrefix": "[deps] BRE:",
-      "reviewers": ["team:dept-bre"]
-    },
-    {
-      "matchPackageNames": [
-        "AspNetCoreRateLimit",
-        "AspNetCoreRateLimit.Redis",
-        "Azure.Data.Tables",
-        "Azure.Messaging.EventGrid",
-        "Azure.Messaging.ServiceBus",
-        "Azure.Storage.Blobs",
-        "Azure.Storage.Queues",
-        "Microsoft.AspNetCore.Authentication.JwtBearer",
-        "Microsoft.AspNetCore.Http",
-        "Quartz"
-      ],
-      "description": "Platform owned dependencies",
-      "commitMessagePrefix": "[deps] Platform:",
-      "reviewers": ["team:team-platform-dev"]
-    },
-    {
-      "matchPackagePatterns": ["EntityFrameworkCore", "^dotnet-ef"],
-      "groupName": "EntityFrameworkCore",
-      "description": "Group EntityFrameworkCore to exclude them from the dotnet monorepo preset"
-    },
-    {
-      "matchPackageNames": [
-        "AutoMapper.Extensions.Microsoft.DependencyInjection",
-        "AWSSDK.SimpleEmail",
-        "AWSSDK.SQS",
-        "Handlebars.Net",
-        "LaunchDarkly.ServerSdk",
-        "MailKit",
-        "Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
-        "Microsoft.AspNetCore.SignalR.StackExchangeRedis",
-        "Microsoft.Azure.NotificationHubs",
-        "Microsoft.Extensions.Configuration.EnvironmentVariables",
-        "Microsoft.Extensions.Configuration.UserSecrets",
-        "Microsoft.Extensions.Configuration",
-        "Microsoft.Extensions.DependencyInjection.Abstractions",
-        "Microsoft.Extensions.DependencyInjection",
-        "SendGrid"
-      ],
-      "description": "Tools owned dependencies",
-      "commitMessagePrefix": "[deps] Tools:",
-      "reviewers": ["team:team-tools-dev"]
-    },
-    {
-      "matchPackagePatterns": ["^Microsoft.AspNetCore.SignalR"],
-      "groupName": "SignalR",
-      "description": "Group SignalR to exclude them from the dotnet monorepo preset"
-    },
-    {
-      "matchPackagePatterns": ["^Microsoft.Extensions.Configuration"],
-      "groupName": "Microsoft.Extensions.Configuration",
-      "description": "Group Microsoft.Extensions.Configuration to exclude them from the dotnet monorepo preset"
-    },
-    {
-      "matchPackagePatterns": ["^Microsoft.Extensions.DependencyInjection"],
-      "groupName": "Microsoft.Extensions.DependencyInjection",
-      "description": "Group Microsoft.Extensions.DependencyInjection to exclude them from the dotnet monorepo preset"
-    },
-    {
-      "matchPackageNames": [
-        "AngleSharp",
-        "AspNetCore.HealthChecks.AzureServiceBus",
-        "AspNetCore.HealthChecks.AzureStorage",
-        "AspNetCore.HealthChecks.Network",
-        "AspNetCore.HealthChecks.Redis",
-        "AspNetCore.HealthChecks.SendGrid",
-        "AspNetCore.HealthChecks.SqlServer",
-        "AspNetCore.HealthChecks.Uris"
-      ],
-      "description": "Vault owned dependencies",
-      "commitMessagePrefix": "[deps] Vault:",
-      "reviewers": ["team:team-vault-dev"]
-    }
-  ],
-  "ignoreDeps": ["dotnet-sdk"]
-}

.github/renovate.json5

@@ -0,0 +1,199 @@
+{
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+  extends: ["github>bitwarden/renovate-config"], // Extends our default configuration for pinned dependencies
+  enabledManagers: [
+    "dockerfile",
+    "docker-compose",
+    "github-actions",
+    "npm",
+    "nuget",
+  ],
+  packageRules: [
+    {
+      groupName: "dockerfile minor",
+      matchManagers: ["dockerfile"],
+      matchUpdateTypes: ["minor"],
+    },
+    {
+      groupName: "docker-compose minor",
+      matchManagers: ["docker-compose"],
+      matchUpdateTypes: ["minor"],
+    },
+    {
+      groupName: "github-action minor",
+      matchManagers: ["github-actions"],
+      matchUpdateTypes: ["minor"],
+    },
+    {
+      matchManagers: ["dockerfile", "docker-compose"],
+      commitMessagePrefix: "[deps] BRE:",
+    },
+    {
+      matchPackageNames: ["DnsClient"],
+      description: "Admin Console owned dependencies",
+      commitMessagePrefix: "[deps] AC:",
+      reviewers: ["team:team-admin-console-dev"],
+    },
+    {
+      matchFileNames: ["src/Admin/package.json", "src/Sso/package.json"],
+      description: "Admin & SSO npm packages",
+      commitMessagePrefix: "[deps] Auth:",
+      reviewers: ["team:team-auth-dev"],
+    },
+    {
+      matchPackageNames: [
+        "Azure.Extensions.AspNetCore.DataProtection.Blobs",
+        "DuoUniversal",
+        "Fido2.AspNet",
+        "Duende.IdentityServer",
+        "Microsoft.Extensions.Identity.Stores",
+        "Otp.NET",
+        "Sustainsys.Saml2.AspNetCore2",
+        "YubicoDotNetClient",
+      ],
+      description: "Auth owned dependencies",
+      commitMessagePrefix: "[deps] Auth:",
+      reviewers: ["team:team-auth-dev"],
+    },
+    {
+      matchPackageNames: [
+        "AutoFixture.AutoNSubstitute",
+        "AutoFixture.Xunit2",
+        "BenchmarkDotNet",
+        "BitPay.Light",
+        "Braintree",
+        "coverlet.collector",
+        "CsvHelper",
+        "Kralizek.AutoFixture.Extensions.MockHttp",
+        "Microsoft.AspNetCore.Mvc.Testing",
+        "Microsoft.Extensions.Logging",
+        "Microsoft.Extensions.Logging.Console",
+        "Newtonsoft.Json",
+        "NSubstitute",
+        "Sentry.Serilog",
+        "Serilog.AspNetCore",
+        "Serilog.Extensions.Logging",
+        "Serilog.Extensions.Logging.File",
+        "Serilog.Sinks.AzureCosmosDB",
+        "Serilog.Sinks.SyslogMessages",
+        "Stripe.net",
+        "Swashbuckle.AspNetCore",
+        "Swashbuckle.AspNetCore.SwaggerGen",
+        "xunit",
+        "xunit.runner.visualstudio",
+      ],
+      description: "Billing owned dependencies",
+      commitMessagePrefix: "[deps] Billing:",
+      reviewers: ["team:team-billing-dev"],
+    },
+    {
+      matchPackagePatterns: ["^Microsoft.Extensions.Logging"],
+      groupName: "Microsoft.Extensions.Logging",
+      description: "Group Microsoft.Extensions.Logging to exclude them from the dotnet monorepo preset",
+    },
+    {
+      matchPackageNames: [
+        "Dapper",
+        "dbup-sqlserver",
+        "dotnet-ef",
+        "linq2db.EntityFrameworkCore",
+        "Microsoft.Azure.Cosmos",
+        "Microsoft.Data.SqlClient",
+        "Microsoft.EntityFrameworkCore.Design",
+        "Microsoft.EntityFrameworkCore.InMemory",
+        "Microsoft.EntityFrameworkCore.Relational",
+        "Microsoft.EntityFrameworkCore.Sqlite",
+        "Microsoft.EntityFrameworkCore.SqlServer",
+        "Microsoft.Extensions.Caching.Cosmos",
+        "Microsoft.Extensions.Caching.SqlServer",
+        "Microsoft.Extensions.Caching.StackExchangeRedis",
+        "Npgsql.EntityFrameworkCore.PostgreSQL",
+        "Pomelo.EntityFrameworkCore.MySql",
+      ],
+      description: "DbOps owned dependencies",
+      commitMessagePrefix: "[deps] DbOps:",
+      reviewers: ["team:dept-dbops"],
+    },
+    {
+      matchPackageNames: ["CommandDotNet", "YamlDotNet"],
+      description: "DevOps owned dependencies",
+      commitMessagePrefix: "[deps] BRE:",
+      reviewers: ["team:dept-bre"],
+    },
+    {
+      matchPackageNames: [
+        "AspNetCoreRateLimit",
+        "AspNetCoreRateLimit.Redis",
+        "Azure.Data.Tables",
+        "Azure.Messaging.EventGrid",
+        "Azure.Messaging.ServiceBus",
+        "Azure.Storage.Blobs",
+        "Azure.Storage.Queues",
+        "Microsoft.AspNetCore.Authentication.JwtBearer",
+        "Microsoft.AspNetCore.Http",
+        "Quartz",
+      ],
+      description: "Platform owned dependencies",
+      commitMessagePrefix: "[deps] Platform:",
+      reviewers: ["team:team-platform-dev"],
+    },
+    {
+      matchPackagePatterns: ["EntityFrameworkCore", "^dotnet-ef"],
+      groupName: "EntityFrameworkCore",
+      description: "Group EntityFrameworkCore to exclude them from the dotnet monorepo preset",
+    },
+    {
+      matchPackageNames: [
+        "AutoMapper.Extensions.Microsoft.DependencyInjection",
+        "AWSSDK.SimpleEmail",
+        "AWSSDK.SQS",
+        "Handlebars.Net",
+        "LaunchDarkly.ServerSdk",
+        "MailKit",
+        "Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
+        "Microsoft.AspNetCore.SignalR.StackExchangeRedis",
+        "Microsoft.Azure.NotificationHubs",
+        "Microsoft.Extensions.Configuration.EnvironmentVariables",
+        "Microsoft.Extensions.Configuration.UserSecrets",
+        "Microsoft.Extensions.Configuration",
+        "Microsoft.Extensions.DependencyInjection.Abstractions",
+        "Microsoft.Extensions.DependencyInjection",
+        "SendGrid",
+      ],
+      description: "Tools owned dependencies",
+      commitMessagePrefix: "[deps] Tools:",
+      reviewers: ["team:team-tools-dev"],
+    },
+    {
+      matchPackagePatterns: ["^Microsoft.AspNetCore.SignalR"],
+      groupName: "SignalR",
+      description: "Group SignalR to exclude them from the dotnet monorepo preset",
+    },
+    {
+      matchPackagePatterns: ["^Microsoft.Extensions.Configuration"],
+      groupName: "Microsoft.Extensions.Configuration",
+      description: "Group Microsoft.Extensions.Configuration to exclude them from the dotnet monorepo preset",
+    },
+    {
+      matchPackagePatterns: ["^Microsoft.Extensions.DependencyInjection"],
+      groupName: "Microsoft.Extensions.DependencyInjection",
+      description: "Group Microsoft.Extensions.DependencyInjection to exclude them from the dotnet monorepo preset",
+    },
+    {
+      matchPackageNames: [
+        "AngleSharp",
+        "AspNetCore.HealthChecks.AzureServiceBus",
+        "AspNetCore.HealthChecks.AzureStorage",
+        "AspNetCore.HealthChecks.Network",
+        "AspNetCore.HealthChecks.Redis",
+        "AspNetCore.HealthChecks.SendGrid",
+        "AspNetCore.HealthChecks.SqlServer",
+        "AspNetCore.HealthChecks.Uris",
+      ],
+      description: "Vault owned dependencies",
+      commitMessagePrefix: "[deps] Vault:",
+      reviewers: ["team:team-vault-dev"],
+    },
+  ],
+  ignoreDeps: ["dotnet-sdk"],
+}

.github/workflows/test-database.yml

@@ -146,7 +146,7 @@ jobs:
           # Unified MariaDB
           BW_TEST_DATABASES__4__TYPE: "MySql"
           BW_TEST_DATABASES__4__CONNECTIONSTRING: "server=localhost;port=4306;uid=root;pwd=mariadb-password;database=vault_dev;Allow User Variables=true"
-        run: dotnet test --logger "trx;LogFileName=infrastructure-test-results.trx"
+        run: dotnet test --logger "trx;LogFileName=infrastructure-test-results.trx" /p:CoverletOutputFormatter="cobertura" --collect:"XPlat Code Coverage"
         shell: pwsh
 
       - name: Print MySQL Logs
@@ -174,6 +174,9 @@ jobs:
           reporter: dotnet-trx
           fail-on-error: true
 
+      - name: Upload to codecov.io
+        uses: codecov/codecov-action@1e68e06f1dbfde0e4cefc87efeba9e4643565303 # v5.1.2
+
       - name: Docker Compose down
         if: always()
         working-directory: "dev"

Directory.Build.props

@@ -3,7 +3,7 @@
   <PropertyGroup>
     <TargetFramework>net8.0</TargetFramework>
 
-    <Version>2025.2.0</Version>
+    <Version>2025.2.2</Version>
 
     <RootNamespace>Bit.$(MSBuildProjectName)</RootNamespace>
     <ImplicitUsings>enable</ImplicitUsings>

bitwarden_license/src/Commercial.Core/AdminConsole/Providers/RemoveOrganizationFromProviderCommand.cs

@@ -5,12 +5,12 @@ using Bit.Core.AdminConsole.Providers.Interfaces;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Billing.Constants;
 using Bit.Core.Billing.Extensions;
+using Bit.Core.Billing.Pricing;
 using Bit.Core.Billing.Services;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
-using Bit.Core.Utilities;
 using Stripe;
 
 namespace Bit.Commercial.Core.AdminConsole.Providers;
@@ -27,6 +27,7 @@ public class RemoveOrganizationFromProviderCommand : IRemoveOrganizationFromProv
     private readonly IProviderBillingService _providerBillingService;
     private readonly ISubscriberService _subscriberService;
     private readonly IHasConfirmedOwnersExceptQuery _hasConfirmedOwnersExceptQuery;
+    private readonly IPricingClient _pricingClient;
 
     public RemoveOrganizationFromProviderCommand(
         IEventService eventService,
@@ -38,7 +39,8 @@ public class RemoveOrganizationFromProviderCommand : IRemoveOrganizationFromProv
         IFeatureService featureService,
         IProviderBillingService providerBillingService,
         ISubscriberService subscriberService,
-        IHasConfirmedOwnersExceptQuery hasConfirmedOwnersExceptQuery)
+        IHasConfirmedOwnersExceptQuery hasConfirmedOwnersExceptQuery,
+        IPricingClient pricingClient)
     {
         _eventService = eventService;
         _mailService = mailService;
@@ -50,6 +52,7 @@ public class RemoveOrganizationFromProviderCommand : IRemoveOrganizationFromProv
         _providerBillingService = providerBillingService;
         _subscriberService = subscriberService;
         _hasConfirmedOwnersExceptQuery = hasConfirmedOwnersExceptQuery;
+        _pricingClient = pricingClient;
     }
 
     public async Task RemoveOrganizationFromProvider(
@@ -110,7 +113,7 @@ public class RemoveOrganizationFromProviderCommand : IRemoveOrganizationFromProv
                 Email = organization.BillingEmail
             });
 
-            var plan = StaticStore.GetPlan(organization.PlanType).PasswordManager;
+            var plan = await _pricingClient.GetPlanOrThrow(organization.PlanType);
 
             var subscriptionCreateOptions = new SubscriptionCreateOptions
             {
@@ -124,7 +127,7 @@ public class RemoveOrganizationFromProviderCommand : IRemoveOrganizationFromProv
                 },
                 OffSession = true,
                 ProrationBehavior = StripeConstants.ProrationBehavior.CreateProrations,
-                Items = [new SubscriptionItemOptions { Price = plan.StripeSeatPlanId, Quantity = organization.Seats }]
+                Items = [new SubscriptionItemOptions { Price = plan.PasswordManager.StripeSeatPlanId, Quantity = organization.Seats }]
             };
 
             var subscription = await _stripeAdapter.SubscriptionCreateAsync(subscriptionCreateOptions);

bitwarden_license/src/Commercial.Core/AdminConsole/Services/ProviderService.cs

@@ -8,6 +8,7 @@ using Bit.Core.AdminConsole.Models.Business.Tokenables;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.AdminConsole.Services;
 using Bit.Core.Billing.Enums;
+using Bit.Core.Billing.Pricing;
 using Bit.Core.Billing.Services;
 using Bit.Core.Context;
 using Bit.Core.Entities;
@@ -50,6 +51,7 @@ public class ProviderService : IProviderService
     private readonly IDataProtectorTokenFactory<ProviderDeleteTokenable> _providerDeleteTokenDataFactory;
     private readonly IApplicationCacheService _applicationCacheService;
     private readonly IProviderBillingService _providerBillingService;
+    private readonly IPricingClient _pricingClient;
 
     public ProviderService(IProviderRepository providerRepository, IProviderUserRepository providerUserRepository,
         IProviderOrganizationRepository providerOrganizationRepository, IUserRepository userRepository,
@@ -58,7 +60,7 @@ public class ProviderService : IProviderService
         IOrganizationRepository organizationRepository, GlobalSettings globalSettings,
         ICurrentContext currentContext, IStripeAdapter stripeAdapter, IFeatureService featureService,
         IDataProtectorTokenFactory<ProviderDeleteTokenable> providerDeleteTokenDataFactory,
-        IApplicationCacheService applicationCacheService, IProviderBillingService providerBillingService)
+        IApplicationCacheService applicationCacheService, IProviderBillingService providerBillingService, IPricingClient pricingClient)
     {
         _providerRepository = providerRepository;
         _providerUserRepository = providerUserRepository;
@@ -77,6 +79,7 @@ public class ProviderService : IProviderService
         _providerDeleteTokenDataFactory = providerDeleteTokenDataFactory;
         _applicationCacheService = applicationCacheService;
         _providerBillingService = providerBillingService;
+        _pricingClient = pricingClient;
     }
 
     public async Task<Provider> CompleteSetupAsync(Provider provider, Guid ownerUserId, string token, string key, TaxInfo taxInfo = null)
@@ -452,30 +455,31 @@ public class ProviderService : IProviderService
 
         if (!string.IsNullOrWhiteSpace(organization.GatewaySubscriptionId))
         {
-            var subscriptionItem = await GetSubscriptionItemAsync(organization.GatewaySubscriptionId,
+            var plan = await _pricingClient.GetPlanOrThrow(organization.PlanType);
-                GetStripeSeatPlanId(organization.PlanType));
+
+            var subscriptionItem = await GetSubscriptionItemAsync(
+                organization.GatewaySubscriptionId,
+                plan.PasswordManager.StripeSeatPlanId);
+
             var extractedPlanType = PlanTypeMappings(organization);
+            var extractedPlan = await _pricingClient.GetPlanOrThrow(extractedPlanType);
+
             if (subscriptionItem != null)
             {
-                await UpdateSubscriptionAsync(subscriptionItem, GetStripeSeatPlanId(extractedPlanType), organization);
+                await UpdateSubscriptionAsync(subscriptionItem, extractedPlan.PasswordManager.StripeSeatPlanId, organization);
             }
         }
 
         await _organizationRepository.UpsertAsync(organization);
     }
 
-    private async Task<Stripe.SubscriptionItem> GetSubscriptionItemAsync(string subscriptionId, string oldPlanId)
+    private async Task<SubscriptionItem> GetSubscriptionItemAsync(string subscriptionId, string oldPlanId)
     {
         var subscriptionDetails = await _stripeAdapter.SubscriptionGetAsync(subscriptionId);
         return subscriptionDetails.Items.Data.FirstOrDefault(item => item.Price.Id == oldPlanId);
     }
 
-    private static string GetStripeSeatPlanId(PlanType planType)
+    private async Task UpdateSubscriptionAsync(SubscriptionItem subscriptionItem, string extractedPlanType, Organization organization)
-    {
-        return StaticStore.GetPlan(planType).PasswordManager.StripeSeatPlanId;
-    }
-
-    private async Task UpdateSubscriptionAsync(Stripe.SubscriptionItem subscriptionItem, string extractedPlanType, Organization organization)
     {
         try
         {

bitwarden_license/src/Commercial.Core/Billing/ProviderBillingService.cs

@@ -10,6 +10,7 @@ using Bit.Core.Billing.Constants;
 using Bit.Core.Billing.Entities;
 using Bit.Core.Billing.Enums;
 using Bit.Core.Billing.Models;
+using Bit.Core.Billing.Pricing;
 using Bit.Core.Billing.Repositories;
 using Bit.Core.Billing.Services;
 using Bit.Core.Billing.Services.Contracts;
@@ -32,6 +33,7 @@ public class ProviderBillingService(
     ILogger<ProviderBillingService> logger,
     IOrganizationRepository organizationRepository,
     IPaymentService paymentService,
+    IPricingClient pricingClient,
     IProviderInvoiceItemRepository providerInvoiceItemRepository,
     IProviderOrganizationRepository providerOrganizationRepository,
     IProviderPlanRepository providerPlanRepository,
@@ -77,8 +79,7 @@ public class ProviderBillingService(
 
         var managedPlanType = await GetManagedPlanTypeAsync(provider, organization);
 
-        // TODO: Replace with PricingClient
+        var plan = await pricingClient.GetPlanOrThrow(managedPlanType);
-        var plan = StaticStore.GetPlan(managedPlanType);
         organization.Plan = plan.Name;
         organization.PlanType = plan.Type;
         organization.MaxCollections = plan.PasswordManager.MaxCollections;
@@ -111,12 +112,30 @@ public class ProviderBillingService(
             Key = key
         };
 
+        /*
+         * We have to scale the provider's seats before the ProviderOrganization
+         * row is inserted so the added organization's seats don't get double counted.
+         */
+        await ScaleSeats(provider, organization.PlanType, organization.Seats!.Value);
+
         await Task.WhenAll(
             organizationRepository.ReplaceAsync(organization),
-            providerOrganizationRepository.CreateAsync(providerOrganization),
+            providerOrganizationRepository.CreateAsync(providerOrganization)
-            ScaleSeats(provider, organization.PlanType, organization.Seats!.Value)
         );
 
+        var clientCustomer = await subscriberService.GetCustomer(organization);
+
+        if (clientCustomer.Balance != 0)
+        {
+            await stripeAdapter.CustomerBalanceTransactionCreate(provider.GatewayCustomerId,
+                new CustomerBalanceTransactionCreateOptions
+                {
+                    Amount = clientCustomer.Balance,
+                    Currency = "USD",
+                    Description = $"Unused, prorated time for client organization with ID {organization.Id}."
+                });
+        }
+
         await eventService.LogProviderOrganizationEventAsync(
             providerOrganization,
             EventType.ProviderOrganization_Added);
@@ -136,7 +155,8 @@ public class ProviderBillingService(
             return;
         }
 
-        var oldPlanConfiguration = StaticStore.GetPlan(plan.PlanType);
+        var oldPlanConfiguration = await pricingClient.GetPlanOrThrow(plan.PlanType);
+        var newPlanConfiguration = await pricingClient.GetPlanOrThrow(command.NewPlan);
 
         plan.PlanType = command.NewPlan;
         await providerPlanRepository.ReplaceAsync(plan);
@@ -160,7 +180,7 @@ public class ProviderBillingService(
             [
                 new SubscriptionItemOptions
                 {
-                    Price = StaticStore.GetPlan(command.NewPlan).PasswordManager.StripeProviderPortalSeatPlanId,
+                    Price = newPlanConfiguration.PasswordManager.StripeProviderPortalSeatPlanId,
                     Quantity = oldSubscriptionItem!.Quantity
                 },
                 new SubscriptionItemOptions
@@ -186,7 +206,7 @@ public class ProviderBillingService(
                 throw new ConflictException($"Organization '{providerOrganization.Id}' not found.");
             }
             organization.PlanType = command.NewPlan;
-            organization.Plan = StaticStore.GetPlan(command.NewPlan).Name;
+            organization.Plan = newPlanConfiguration.Name;
             await organizationRepository.ReplaceAsync(organization);
         }
     }
@@ -329,7 +349,7 @@ public class ProviderBillingService(
         {
             var (organization, _) = pair;
 
-            var planName = DerivePlanName(provider, organization);
+            var planName = await DerivePlanName(provider, organization);
 
             var addable = new AddableOrganization(
                 organization.Id,
@@ -350,7 +370,7 @@ public class ProviderBillingService(
             return addable with { Disabled = requiresPurchase };
         }));
 
-        string DerivePlanName(Provider localProvider, Organization localOrganization)
+        async Task<string> DerivePlanName(Provider localProvider, Organization localOrganization)
         {
             if (localProvider.Type == ProviderType.Msp)
             {
@@ -362,8 +382,7 @@ public class ProviderBillingService(
                 };
             }
 
-            // TODO: Replace with PricingClient
+            var plan = await pricingClient.GetPlanOrThrow(localOrganization.PlanType);
-            var plan = StaticStore.GetPlan(localOrganization.PlanType);
             return plan.Name;
         }
     }
@@ -456,20 +475,17 @@ public class ProviderBillingService(
         Provider provider,
         TaxInfo taxInfo)
     {
-        ArgumentNullException.ThrowIfNull(provider);
+        if (taxInfo is not
-        ArgumentNullException.ThrowIfNull(taxInfo);
+            {
-
+                BillingAddressCountry: not null and not "",
-        if (string.IsNullOrEmpty(taxInfo.BillingAddressCountry) ||
+                BillingAddressPostalCode: not null and not ""
-            string.IsNullOrEmpty(taxInfo.BillingAddressPostalCode))
+            })
         {
             logger.LogError("Cannot create customer for provider ({ProviderID}) without both a country and postal code", provider.Id);
-
             throw new BillingException();
         }
 
-        var providerDisplayName = provider.DisplayName();
+        var options = new CustomerCreateOptions
-
-        var customerCreateOptions = new CustomerCreateOptions
         {
             Address = new AddressOptions
             {
@@ -489,9 +505,9 @@ public class ProviderBillingService(
                     new CustomerInvoiceSettingsCustomFieldOptions
                     {
                         Name = provider.SubscriberType(),
-                        Value = providerDisplayName?.Length <= 30
+                        Value = provider.DisplayName()?.Length <= 30
-                            ? providerDisplayName
+                            ? provider.DisplayName()
-                            : providerDisplayName?[..30]
+                            : provider.DisplayName()?[..30]
                     }
                 ]
             },
@@ -503,7 +519,8 @@ public class ProviderBillingService(
 
         if (!string.IsNullOrEmpty(taxInfo.TaxIdNumber))
         {
-            var taxIdType = taxService.GetStripeTaxCode(taxInfo.BillingAddressCountry,
+            var taxIdType = taxService.GetStripeTaxCode(
+                taxInfo.BillingAddressCountry,
                 taxInfo.TaxIdNumber);
 
             if (taxIdType == null)
@@ -514,15 +531,20 @@ public class ProviderBillingService(
                 throw new BadRequestException("billingTaxIdTypeInferenceError");
             }
 
-            customerCreateOptions.TaxIdData =
+            options.TaxIdData =
             [
                 new CustomerTaxIdDataOptions { Type = taxIdType, Value = taxInfo.TaxIdNumber }
             ];
         }
 
+        if (!string.IsNullOrEmpty(provider.DiscountId))
+        {
+            options.Coupon = provider.DiscountId;
+        }
+
         try
         {
-            return await stripeAdapter.CustomerCreateAsync(customerCreateOptions);
+            return await stripeAdapter.CustomerCreateAsync(options);
         }
         catch (StripeException stripeException) when (stripeException.StripeError?.Code == StripeConstants.ErrorCodes.TaxIdInvalid)
         {
@@ -550,7 +572,7 @@ public class ProviderBillingService(
 
         foreach (var providerPlan in providerPlans)
         {
-            var plan = StaticStore.GetPlan(providerPlan.PlanType);
+            var plan = await pricingClient.GetPlanOrThrow(providerPlan.PlanType);
 
             if (!providerPlan.IsConfigured())
             {
@@ -634,8 +656,10 @@ public class ProviderBillingService(
 
             if (providerPlan.SeatMinimum != newPlanConfiguration.SeatsMinimum)
             {
-                var priceId = StaticStore.GetPlan(newPlanConfiguration.Plan).PasswordManager
+                var newPlan = await pricingClient.GetPlanOrThrow(newPlanConfiguration.Plan);
-                    .StripeProviderPortalSeatPlanId;
+
+                var priceId = newPlan.PasswordManager.StripeProviderPortalSeatPlanId;
+
                 var subscriptionItem = subscription.Items.First(item => item.Price.Id == priceId);
 
                 if (providerPlan.PurchasedSeats == 0)
@@ -699,7 +723,7 @@ public class ProviderBillingService(
         ProviderPlan providerPlan,
         int newlyAssignedSeats) => async (currentlySubscribedSeats, newlySubscribedSeats) =>
     {
-        var plan = StaticStore.GetPlan(providerPlan.PlanType);
+        var plan = await pricingClient.GetPlanOrThrow(providerPlan.PlanType);
 
         await paymentService.AdjustSeats(
             provider,
@@ -723,7 +747,7 @@ public class ProviderBillingService(
         var providerOrganizations =
             await providerOrganizationRepository.GetManyDetailsByProviderAsync(provider.Id);
 
-        var plan = StaticStore.GetPlan(planType);
+        var plan = await pricingClient.GetPlanOrThrow(planType);
 
         return providerOrganizations
             .Where(providerOrganization => providerOrganization.Plan == plan.Name && providerOrganization.Status == OrganizationStatusType.Managed)

bitwarden_license/src/Commercial.Core/SecretsManager/Queries/Projects/MaxProjectsQuery.cs

@@ -28,6 +28,7 @@ public class MaxProjectsQuery : IMaxProjectsQuery
             throw new NotFoundException();
         }
 
+        // TODO: PRICING -> https://bitwarden.atlassian.net/browse/PM-17122
         var plan = StaticStore.GetPlan(org.PlanType);
         if (plan?.SecretsManager == null)
         {

bitwarden_license/src/Scim/Startup.cs

@@ -8,7 +8,6 @@ using Bit.Core.Utilities;
 using Bit.Scim.Context;
 using Bit.Scim.Utilities;
 using Bit.SharedWeb.Utilities;
-using IdentityModel;
 using Microsoft.Extensions.DependencyInjection.Extensions;
 using Stripe;
 

bitwarden_license/src/Scim/Utilities/ApiKeyAuthenticationHandler.cs

@@ -3,7 +3,6 @@ using System.Text.Encodings.Web;
 using Bit.Core.Enums;
 using Bit.Core.Repositories;
 using Bit.Scim.Context;
-using IdentityModel;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.Extensions.Options;

bitwarden_license/src/Sso/Controllers/AccountController.cs

@@ -22,7 +22,6 @@ using Bit.Sso.Utilities;
 using Duende.IdentityServer;
 using Duende.IdentityServer.Services;
 using Duende.IdentityServer.Stores;
-using IdentityModel;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.AspNetCore.Mvc;

bitwarden_license/src/Sso/Utilities/DynamicAuthenticationSchemeProvider.cs

@@ -9,7 +9,6 @@ using Bit.Sso.Models;
 using Bit.Sso.Utilities;
 using Duende.IdentityServer;
 using Duende.IdentityServer.Infrastructure;
-using IdentityModel;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authentication.OpenIdConnect;
 using Microsoft.Extensions.Options;

bitwarden_license/src/Sso/package-lock.json

@@ -17,7 +17,7 @@
         "css-loader": "7.1.2",
         "expose-loader": "5.0.0",
         "mini-css-extract-plugin": "2.9.2",
-        "sass": "1.79.5",
+        "sass": "1.85.0",
         "sass-loader": "16.0.4",
         "webpack": "5.97.1",
         "webpack-cli": "5.1.4"
@@ -98,12 +98,13 @@
       }
     },
     "node_modules/@parcel/watcher": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher/-/watcher-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher/-/watcher-2.5.1.tgz",
-      "integrity": "sha512-i0GV1yJnm2n3Yq1qw6QrUrd/LI9bE8WEBOTtOkpCXHHdyN3TAGgqAK/DAT05z4fq2x04cARXt2pDmjWjL92iTQ==",
+      "integrity": "sha512-dfUnCxiN9H4ap84DvD2ubjw+3vUNpstxa0TneY/Paat8a3R4uQZDLSvWjmznAY/DoahqTHl9V46HF/Zs3F29pg==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
         "detect-libc": "^1.0.3",
         "is-glob": "^4.0.3",
@@ -118,25 +119,25 @@
         "url": "https://opencollective.com/parcel"
       },
       "optionalDependencies": {
-        "@parcel/watcher-android-arm64": "2.5.0",
+        "@parcel/watcher-android-arm64": "2.5.1",
-        "@parcel/watcher-darwin-arm64": "2.5.0",
+        "@parcel/watcher-darwin-arm64": "2.5.1",
-        "@parcel/watcher-darwin-x64": "2.5.0",
+        "@parcel/watcher-darwin-x64": "2.5.1",
-        "@parcel/watcher-freebsd-x64": "2.5.0",
+        "@parcel/watcher-freebsd-x64": "2.5.1",
-        "@parcel/watcher-linux-arm-glibc": "2.5.0",
+        "@parcel/watcher-linux-arm-glibc": "2.5.1",
-        "@parcel/watcher-linux-arm-musl": "2.5.0",
+        "@parcel/watcher-linux-arm-musl": "2.5.1",
-        "@parcel/watcher-linux-arm64-glibc": "2.5.0",
+        "@parcel/watcher-linux-arm64-glibc": "2.5.1",
-        "@parcel/watcher-linux-arm64-musl": "2.5.0",
+        "@parcel/watcher-linux-arm64-musl": "2.5.1",
-        "@parcel/watcher-linux-x64-glibc": "2.5.0",
+        "@parcel/watcher-linux-x64-glibc": "2.5.1",
-        "@parcel/watcher-linux-x64-musl": "2.5.0",
+        "@parcel/watcher-linux-x64-musl": "2.5.1",
-        "@parcel/watcher-win32-arm64": "2.5.0",
+        "@parcel/watcher-win32-arm64": "2.5.1",
-        "@parcel/watcher-win32-ia32": "2.5.0",
+        "@parcel/watcher-win32-ia32": "2.5.1",
-        "@parcel/watcher-win32-x64": "2.5.0"
+        "@parcel/watcher-win32-x64": "2.5.1"
       }
     },
     "node_modules/@parcel/watcher-android-arm64": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-android-arm64/-/watcher-android-arm64-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-android-arm64/-/watcher-android-arm64-2.5.1.tgz",
-      "integrity": "sha512-qlX4eS28bUcQCdribHkg/herLe+0A9RyYC+mm2PXpncit8z5b3nSqGVzMNR3CmtAOgRutiZ02eIJJgP/b1iEFQ==",
+      "integrity": "sha512-KF8+j9nNbUN8vzOFDpRMsaKBHZ/mcjEjMToVMJOhTozkDonQFFrRcfdLWn6yWKCmJKmdVxSgHiYvTCef4/qcBA==",
       "cpu": [
         "arm64"
       ],
@@ -155,9 +156,9 @@
       }
     },
     "node_modules/@parcel/watcher-darwin-arm64": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-darwin-arm64/-/watcher-darwin-arm64-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-darwin-arm64/-/watcher-darwin-arm64-2.5.1.tgz",
-      "integrity": "sha512-hyZ3TANnzGfLpRA2s/4U1kbw2ZI4qGxaRJbBH2DCSREFfubMswheh8TeiC1sGZ3z2jUf3s37P0BBlrD3sjVTUw==",
+      "integrity": "sha512-eAzPv5osDmZyBhou8PoF4i6RQXAfeKL9tjb3QzYuccXFMQU0ruIc/POh30ePnaOyD1UXdlKguHBmsTs53tVoPw==",
       "cpu": [
         "arm64"
       ],
@@ -176,9 +177,9 @@
       }
     },
     "node_modules/@parcel/watcher-darwin-x64": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-darwin-x64/-/watcher-darwin-x64-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-darwin-x64/-/watcher-darwin-x64-2.5.1.tgz",
-      "integrity": "sha512-9rhlwd78saKf18fT869/poydQK8YqlU26TMiNg7AIu7eBp9adqbJZqmdFOsbZ5cnLp5XvRo9wcFmNHgHdWaGYA==",
+      "integrity": "sha512-1ZXDthrnNmwv10A0/3AJNZ9JGlzrF82i3gNQcWOzd7nJ8aj+ILyW1MTxVk35Db0u91oD5Nlk9MBiujMlwmeXZg==",
       "cpu": [
         "x64"
       ],
@@ -197,9 +198,9 @@
       }
     },
     "node_modules/@parcel/watcher-freebsd-x64": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-freebsd-x64/-/watcher-freebsd-x64-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-freebsd-x64/-/watcher-freebsd-x64-2.5.1.tgz",
-      "integrity": "sha512-syvfhZzyM8kErg3VF0xpV8dixJ+RzbUaaGaeb7uDuz0D3FK97/mZ5AJQ3XNnDsXX7KkFNtyQyFrXZzQIcN49Tw==",
+      "integrity": "sha512-SI4eljM7Flp9yPuKi8W0ird8TI/JK6CSxju3NojVI6BjHsTyK7zxA9urjVjEKJ5MBYC+bLmMcbAWlZ+rFkLpJQ==",
       "cpu": [
         "x64"
       ],
@@ -218,9 +219,9 @@
       }
     },
     "node_modules/@parcel/watcher-linux-arm-glibc": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm-glibc/-/watcher-linux-arm-glibc-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm-glibc/-/watcher-linux-arm-glibc-2.5.1.tgz",
-      "integrity": "sha512-0VQY1K35DQET3dVYWpOaPFecqOT9dbuCfzjxoQyif1Wc574t3kOSkKevULddcR9znz1TcklCE7Ht6NIxjvTqLA==",
+      "integrity": "sha512-RCdZlEyTs8geyBkkcnPWvtXLY44BCeZKmGYRtSgtwwnHR4dxfHRG3gR99XdMEdQ7KeiDdasJwwvNSF5jKtDwdA==",
       "cpu": [
         "arm"
       ],
@@ -239,9 +240,9 @@
       }
     },
     "node_modules/@parcel/watcher-linux-arm-musl": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm-musl/-/watcher-linux-arm-musl-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm-musl/-/watcher-linux-arm-musl-2.5.1.tgz",
-      "integrity": "sha512-6uHywSIzz8+vi2lAzFeltnYbdHsDm3iIB57d4g5oaB9vKwjb6N6dRIgZMujw4nm5r6v9/BQH0noq6DzHrqr2pA==",
+      "integrity": "sha512-6E+m/Mm1t1yhB8X412stiKFG3XykmgdIOqhjWj+VL8oHkKABfu/gjFj8DvLrYVHSBNC+/u5PeNrujiSQ1zwd1Q==",
       "cpu": [
         "arm"
       ],
@@ -260,9 +261,9 @@
       }
     },
     "node_modules/@parcel/watcher-linux-arm64-glibc": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm64-glibc/-/watcher-linux-arm64-glibc-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm64-glibc/-/watcher-linux-arm64-glibc-2.5.1.tgz",
-      "integrity": "sha512-BfNjXwZKxBy4WibDb/LDCriWSKLz+jJRL3cM/DllnHH5QUyoiUNEp3GmL80ZqxeumoADfCCP19+qiYiC8gUBjA==",
+      "integrity": "sha512-LrGp+f02yU3BN9A+DGuY3v3bmnFUggAITBGriZHUREfNEzZh/GO06FF5u2kx8x+GBEUYfyTGamol4j3m9ANe8w==",
       "cpu": [
         "arm64"
       ],
@@ -281,9 +282,9 @@
       }
     },
     "node_modules/@parcel/watcher-linux-arm64-musl": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm64-musl/-/watcher-linux-arm64-musl-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm64-musl/-/watcher-linux-arm64-musl-2.5.1.tgz",
-      "integrity": "sha512-S1qARKOphxfiBEkwLUbHjCY9BWPdWnW9j7f7Hb2jPplu8UZ3nes7zpPOW9bkLbHRvWM0WDTsjdOTUgW0xLBN1Q==",
+      "integrity": "sha512-cFOjABi92pMYRXS7AcQv9/M1YuKRw8SZniCDw0ssQb/noPkRzA+HBDkwmyOJYp5wXcsTrhxO0zq1U11cK9jsFg==",
       "cpu": [
         "arm64"
       ],
@@ -302,9 +303,9 @@
       }
     },
     "node_modules/@parcel/watcher-linux-x64-glibc": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-x64-glibc/-/watcher-linux-x64-glibc-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-x64-glibc/-/watcher-linux-x64-glibc-2.5.1.tgz",
-      "integrity": "sha512-d9AOkusyXARkFD66S6zlGXyzx5RvY+chTP9Jp0ypSTC9d4lzyRs9ovGf/80VCxjKddcUvnsGwCHWuF2EoPgWjw==",
+      "integrity": "sha512-GcESn8NZySmfwlTsIur+49yDqSny2IhPeZfXunQi48DMugKeZ7uy1FX83pO0X22sHntJ4Ub+9k34XQCX+oHt2A==",
       "cpu": [
         "x64"
       ],
@@ -323,9 +324,9 @@
       }
     },
     "node_modules/@parcel/watcher-linux-x64-musl": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-x64-musl/-/watcher-linux-x64-musl-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-x64-musl/-/watcher-linux-x64-musl-2.5.1.tgz",
-      "integrity": "sha512-iqOC+GoTDoFyk/VYSFHwjHhYrk8bljW6zOhPuhi5t9ulqiYq1togGJB5e3PwYVFFfeVgc6pbz3JdQyDoBszVaA==",
+      "integrity": "sha512-n0E2EQbatQ3bXhcH2D1XIAANAcTZkQICBPVaxMeaCVBtOpBZpWJuf7LwyWPSBDITb7In8mqQgJ7gH8CILCURXg==",
       "cpu": [
         "x64"
       ],
@@ -344,9 +345,9 @@
       }
     },
     "node_modules/@parcel/watcher-win32-arm64": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-arm64/-/watcher-win32-arm64-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-arm64/-/watcher-win32-arm64-2.5.1.tgz",
-      "integrity": "sha512-twtft1d+JRNkM5YbmexfcH/N4znDtjgysFaV9zvZmmJezQsKpkfLYJ+JFV3uygugK6AtIM2oADPkB2AdhBrNig==",
+      "integrity": "sha512-RFzklRvmc3PkjKjry3hLF9wD7ppR4AKcWNzH7kXR7GUe0Igb3Nz8fyPwtZCSquGrhU5HhUNDr/mKBqj7tqA2Vw==",
       "cpu": [
         "arm64"
       ],
@@ -365,9 +366,9 @@
       }
     },
     "node_modules/@parcel/watcher-win32-ia32": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-ia32/-/watcher-win32-ia32-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-ia32/-/watcher-win32-ia32-2.5.1.tgz",
-      "integrity": "sha512-+rgpsNRKwo8A53elqbbHXdOMtY/tAtTzManTWShB5Kk54N8Q9mzNWV7tV+IbGueCbcj826MfWGU3mprWtuf1TA==",
+      "integrity": "sha512-c2KkcVN+NJmuA7CGlaGD1qJh1cLfDnQsHjE89E60vUEMlqduHGCdCLJCID5geFVM0dOtA3ZiIO8BoEQmzQVfpQ==",
       "cpu": [
         "ia32"
       ],
@@ -386,9 +387,9 @@
       }
     },
     "node_modules/@parcel/watcher-win32-x64": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-x64/-/watcher-win32-x64-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-x64/-/watcher-win32-x64-2.5.1.tgz",
-      "integrity": "sha512-lPrxve92zEHdgeff3aiu4gDOIt4u7sJYha6wbdEZDCDUhtjTsOMiaJzG5lMY4GkWH8p0fMmO2Ppq5G5XXG+DQw==",
+      "integrity": "sha512-9lHBdJITeNR++EvSQVUcaZoWupyHfXe1jZvGZ06O/5MflPcuPLtEphScIBL+AiCWBO46tDSHzWyD0uDmmZqsgA==",
       "cpu": [
         "x64"
       ],
@@ -454,9 +455,9 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "22.10.2",
+      "version": "22.13.5",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.10.2.tgz",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.13.5.tgz",
-      "integrity": "sha512-Xxr6BBRCAOQixvonOye19wnzyDiUtTeqldOOmj3CkeblonbccA12PFwlufvRdrpjXxqnmUaeiU5EOA+7s5diUQ==",
+      "integrity": "sha512-+lTU0PxZXn0Dr1NBtC7Y8cR21AJr87dLLU953CWA6pMxxv/UDc7jYAY90upcrie1nRcD6XNG5HOYEDtgW5TxAg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -771,6 +772,7 @@
       "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
         "fill-range": "^7.1.1"
       },
@@ -779,9 +781,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.24.3",
+      "version": "4.24.4",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.24.3.tgz",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.24.4.tgz",
-      "integrity": "sha512-1CPmv8iobE2fyRMV97dAcMVegvvWKxmq94hkLiAkUGwKVTyDLw33K+ZxiFrREKmmps4rIw6grcCFCnTMSZ/YiA==",
+      "integrity": "sha512-KDi1Ny1gSePi1vm0q4oxSF8b4DR44GF4BbmS2YdhPLOEqd8pDviZOGH/GsmRwoWJ2+5Lr085X7naowMwKHDG1A==",
       "dev": true,
       "funding": [
         {
@@ -819,9 +821,9 @@
       "license": "MIT"
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001690",
+      "version": "1.0.30001700",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001690.tgz",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001700.tgz",
-      "integrity": "sha512-5ExiE3qQN6oF8Clf8ifIDcMRCRE/dMGcETG/XGMD8/XiXm6HXQgQTh1yZYLXXpSOsEUlJm1Xr7kGULZTuGtP/w==",
+      "integrity": "sha512-2S6XIXwaE7K7erT8dY+kLQcpa5ms63XlRkMkReXjle+kf6c5g38vyMl+Z5y8dSxOFDhcFe+nxnn261PLxBSQsQ==",
       "dev": true,
       "funding": [
         {
@@ -964,6 +966,7 @@
       "integrity": "sha512-pGjwhsmsp4kL2RTz08wcOlGN83otlqHeD/Z5T8GXZB+/YcpQ/dgo+lbU8ZsGxV0HIvqqxo9l7mqYwyYMD9bKDg==",
       "dev": true,
       "license": "Apache-2.0",
+      "optional": true,
       "bin": {
         "detect-libc": "bin/detect-libc.js"
       },
@@ -972,16 +975,16 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.75",
+      "version": "1.5.103",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.75.tgz",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.103.tgz",
-      "integrity": "sha512-Lf3++DumRE/QmweGjU+ZcKqQ+3bKkU/qjaKYhIJKEOhgIO9Xs6IiAQFkfFoj+RhgDk4LUeNsLo6plExHqSyu6Q==",
+      "integrity": "sha512-P6+XzIkfndgsrjROJWfSvVEgNHtPgbhVyTkwLjUM2HU/h7pZRORgaTlHqfAikqxKmdJMLW8fftrdGWbd/Ds0FA==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/enhanced-resolve": {
-      "version": "5.18.0",
+      "version": "5.18.1",
-      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.18.0.tgz",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.18.1.tgz",
-      "integrity": "sha512-0/r0MySGYG8YqlayBZ6MuCfECmHFdJ5qyPh8s8wa5Hnm6SaFLSK1VYCbj+NKp090Nm1caZhD+QTnmxO7esYGyQ==",
+      "integrity": "sha512-ZSW3ma5GkcQBIpwZTSRAI8N71Uuwgs93IezB7mf7R60tC8ZbJideoDNKjHn2O9KIlx6rkGTTEk1xUCK2E1Y2Yg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1006,9 +1009,9 @@
       }
     },
     "node_modules/es-module-lexer": {
-      "version": "1.5.4",
+      "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-1.5.4.tgz",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-1.6.0.tgz",
-      "integrity": "sha512-MVNK56NiMrOwitFB7cqDwq0CQutbw+0BvLshJSse0MUNU+y1FC3bUS/AQg7oUng+/wKrrki7JfmwtVHkVfPLlw==",
+      "integrity": "sha512-qqnD1yMU6tk/jnaMosogGySTZP8YtUgAffA9nMN+E/rjxcfRQ6IEk7IiozUjgxKoFHBGjTLnrHB/YC45r/59EQ==",
       "dev": true,
       "license": "MIT"
     },
@@ -1111,10 +1114,20 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.0.3",
+      "version": "3.0.6",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.0.3.tgz",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.0.6.tgz",
-      "integrity": "sha512-aLrHthzCjH5He4Z2H9YZ+v6Ujb9ocRuW6ZzkJQOrTxleEijANq4v1TsaPaVG1PZcuurEzrLcWRyYBYXD5cEiaw==",
+      "integrity": "sha512-Atfo14OibSv5wAp4VWNsFYE1AchQRTv9cBGWET4pZWHzYshFSS9NQI6I57rdKn9croWVMbYFbLhJ+yJvmZIIHw==",
       "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
       "license": "BSD-3-Clause"
     },
     "node_modules/fastest-levenshtein": {
@@ -1133,6 +1146,7 @@
       "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
         "to-regex-range": "^5.0.1"
       },
@@ -1234,9 +1248,9 @@
       }
     },
     "node_modules/immutable": {
-      "version": "4.3.7",
+      "version": "5.0.3",
-      "resolved": "https://registry.npmjs.org/immutable/-/immutable-4.3.7.tgz",
+      "resolved": "https://registry.npmjs.org/immutable/-/immutable-5.0.3.tgz",
-      "integrity": "sha512-1hqclzwYwjRDFLjcFxOM5AYkkG0rpFPpr1RLPMEuGczoS7YA8gLhy8SWXYRAA/XwfEHpfo3cw5JGioS32fnMRw==",
+      "integrity": "sha512-P8IdPQHq3lA1xVeBRi5VPqUm5HDgKnx0Ru51wZz5mjxHr5n3RWhjIpOFU7ybkUxfB+5IToy+OLaHYDBIWsv+uw==",
       "dev": true,
       "license": "MIT"
     },
@@ -1292,6 +1306,7 @@
       "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "engines": {
         "node": ">=0.10.0"
       }
@@ -1302,6 +1317,7 @@
       "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
         "is-extglob": "^2.1.1"
       },
@@ -1315,6 +1331,7 @@
       "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "engines": {
         "node": ">=0.12.0"
       }
@@ -1430,6 +1447,7 @@
       "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
         "braces": "^3.0.3",
         "picomatch": "^2.3.1"
@@ -1513,7 +1531,8 @@
       "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-7.1.1.tgz",
       "integrity": "sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "optional": true
     },
     "node_modules/node-releases": {
       "version": "2.0.19",
@@ -1601,6 +1620,7 @@
       "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "engines": {
         "node": ">=8.6"
       },
@@ -1622,9 +1642,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.4.49",
+      "version": "8.5.3",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.49.tgz",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.3.tgz",
-      "integrity": "sha512-OCVPnIObs4N29kxTjzLfUryOkvZEq+pf8jTF0lg8E7uETuWHA+v7j3c/xJmiqpX450191LlmZfUKkXxkTry7nA==",
+      "integrity": "sha512-dle9A3yYxlBSrt8Fu+IpjGT8SY8hN0mlaA6GY8t0P5PjIOZemULz/E2Bnm/2dcUOena75OTNkHI76uZBNUUq3A==",
       "dev": true,
       "funding": [
         {
@@ -1642,7 +1662,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.7",
+        "nanoid": "^3.3.8",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
@@ -1714,9 +1734,9 @@
       }
     },
     "node_modules/postcss-selector-parser": {
-      "version": "7.0.0",
+      "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.0.tgz",
-      "integrity": "sha512-9RbEr1Y7FFfptd/1eEdntyjMwLeghW1bHX9GWjXo19vx4ytPQhANltvVxDggzJl7mnWM+dX28kb6cyS/4iQjlQ==",
+      "integrity": "sha512-8sLjZwK0R+JlxlYcTuVnyT2v+htpdrjDOKuMcOVdYjt52Lh8hWRYpxBPoKx/Zg+bcjc3wx6fmQevMmUztS/ccA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1755,13 +1775,13 @@
       }
     },
     "node_modules/readdirp": {
-      "version": "4.0.2",
+      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-4.0.2.tgz",
+      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-4.1.2.tgz",
-      "integrity": "sha512-yDMz9g+VaZkqBYS/ozoBJwaBhTbZo3UNYQHNRw1D3UFQB8oHB4uS/tAODO+ZLjGWmUbKnIlOWO+aaIiAxrUWHA==",
+      "integrity": "sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">= 14.16.0"
+        "node": ">= 14.18.0"
       },
       "funding": {
         "type": "individual",
@@ -1857,15 +1877,14 @@
       "license": "MIT"
     },
     "node_modules/sass": {
-      "version": "1.79.5",
+      "version": "1.85.0",
-      "resolved": "https://registry.npmjs.org/sass/-/sass-1.79.5.tgz",
+      "resolved": "https://registry.npmjs.org/sass/-/sass-1.85.0.tgz",
-      "integrity": "sha512-W1h5kp6bdhqFh2tk3DsI771MoEJjvrSY/2ihJRJS4pjIyfJCw0nTsxqhnrUzaLMOJjFchj8rOvraI/YUVjtx5g==",
+      "integrity": "sha512-3ToiC1xZ1Y8aU7+CkgCI/tqyuPXEmYGJXO7H4uqp0xkLXUqp88rQQ4j1HmP37xSJLbCJPaIiv+cT1y+grssrww==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@parcel/watcher": "^2.4.1",
         "chokidar": "^4.0.0",
-        "immutable": "^4.0.0",
+        "immutable": "^5.0.2",
         "source-map-js": ">=0.6.2 <2.0.0"
       },
       "bin": {
@@ -1873,6 +1892,9 @@
       },
       "engines": {
         "node": ">=14.0.0"
+      },
+      "optionalDependencies": {
+        "@parcel/watcher": "^2.4.1"
       }
     },
     "node_modules/sass-loader": {
@@ -1937,9 +1959,9 @@
       }
     },
     "node_modules/semver": {
-      "version": "7.6.3",
+      "version": "7.7.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.6.3.tgz",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.1.tgz",
-      "integrity": "sha512-oVekP1cKtI+CTDvHWYFUcMtsK/00wmAEfyqKfNdARm8u1wNVhSgaX7A8d4UuIlUI5e84iEwOhs7ZPYRmzU9U6A==",
+      "integrity": "sha512-hlq8tAfn0m/61p4BVRcPzIGr6LKiMwo4VM6dGi6pt4qcRkmNzTcWq6eCEjEh+qXjkMDvPlOFFSGwQjoEa6gyMA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -2066,9 +2088,9 @@
       }
     },
     "node_modules/terser": {
-      "version": "5.37.0",
+      "version": "5.39.0",
-      "resolved": "https://registry.npmjs.org/terser/-/terser-5.37.0.tgz",
+      "resolved": "https://registry.npmjs.org/terser/-/terser-5.39.0.tgz",
-      "integrity": "sha512-B8wRRkmre4ERucLM/uXx4MOV5cbnOlVAqUst+1+iLKPI0dOgFO28f84ptoQt9HEI537PMzfYa/d+GEPKTRXmYA==",
+      "integrity": "sha512-LBAhFyLho16harJoWMg/nZsQYgTrg5jXOn2nCYjRUcZZEdE3qa2zb8QEDRUGVZBW4rlazf2fxkg8tztybTaqWw==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -2125,6 +2147,7 @@
       "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
         "is-number": "^7.0.0"
       },
@@ -2140,9 +2163,9 @@
       "license": "MIT"
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.1.1",
+      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.1.1.tgz",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.1.2.tgz",
-      "integrity": "sha512-R8UzCaa9Az+38REPiJ1tXlImTJXlVfgHZsglwBD/k6nj76ctsH1E3q4doGrukiLQd3sGQYu56r5+lo5r94l29A==",
+      "integrity": "sha512-PPypAm5qvlD7XMZC3BujecnaOxwhrtoFR+Dqkk5Aa/6DssiH0ibKoketaj9w8LP7Bont1rYeoV5plxD7RTEPRg==",
       "dev": true,
       "funding": [
         {
@@ -2161,7 +2184,7 @@
       "license": "MIT",
       "dependencies": {
         "escalade": "^3.2.0",
-        "picocolors": "^1.1.0"
+        "picocolors": "^1.1.1"
       },
       "bin": {
         "update-browserslist-db": "cli.js"

bitwarden_license/src/Sso/package.json

@@ -16,7 +16,7 @@
     "css-loader": "7.1.2",
     "expose-loader": "5.0.0",
     "mini-css-extract-plugin": "2.9.2",
-    "sass": "1.79.5",
+    "sass": "1.85.0",
     "sass-loader": "16.0.4",
     "webpack": "5.97.1",
     "webpack-cli": "5.1.4"

bitwarden_license/test/Commercial.Core.Test/AdminConsole/ProviderFeatures/RemoveOrganizationFromProviderCommandTests.cs

@@ -6,6 +6,7 @@ using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Billing.Constants;
 using Bit.Core.Billing.Enums;
+using Bit.Core.Billing.Pricing;
 using Bit.Core.Billing.Services;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;
@@ -205,6 +206,8 @@ public class RemoveOrganizationFromProviderCommandTests
 
         var teamsMonthlyPlan = StaticStore.GetPlan(PlanType.TeamsMonthly);
 
+        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(PlanType.TeamsMonthly).Returns(teamsMonthlyPlan);
+
         sutProvider.GetDependency<IHasConfirmedOwnersExceptQuery>().HasConfirmedOwnersExceptAsync(
                 providerOrganization.OrganizationId,
                 [],

bitwarden_license/test/Commercial.Core.Test/AdminConsole/Services/ProviderServiceTests.cs

@@ -7,6 +7,7 @@ using Bit.Core.AdminConsole.Models.Business.Provider;
 using Bit.Core.AdminConsole.Models.Business.Tokenables;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Billing.Enums;
+using Bit.Core.Billing.Pricing;
 using Bit.Core.Billing.Services;
 using Bit.Core.Context;
 using Bit.Core.Entities;
@@ -550,8 +551,14 @@ public class ProviderServiceTests
         organization.PlanType = PlanType.EnterpriseMonthly;
         organization.Plan = "Enterprise (Monthly)";
 
+        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(organization.PlanType)
+            .Returns(StaticStore.GetPlan(organization.PlanType));
+
         var expectedPlanType = PlanType.EnterpriseMonthly2020;
 
+        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(expectedPlanType)
+            .Returns(StaticStore.GetPlan(expectedPlanType));
+
         var expectedPlanId = "2020-enterprise-org-seat-monthly";
 
         sutProvider.GetDependency<IProviderRepository>().GetByIdAsync(provider.Id).Returns(provider);

bitwarden_license/test/Commercial.Core.Test/Billing/ProviderBillingServiceTests.cs

@@ -9,6 +9,7 @@ using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Billing.Constants;
 using Bit.Core.Billing.Entities;
 using Bit.Core.Billing.Enums;
+using Bit.Core.Billing.Pricing;
 using Bit.Core.Billing.Repositories;
 using Bit.Core.Billing.Services;
 using Bit.Core.Billing.Services.Contracts;
@@ -128,6 +129,9 @@ public class ProviderBillingServiceTests
             .GetByIdAsync(Arg.Is<Guid>(p => p == providerPlanId))
             .Returns(existingPlan);
 
+        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(existingPlan.PlanType)
+            .Returns(StaticStore.GetPlan(existingPlan.PlanType));
+
         var stripeAdapter = sutProvider.GetDependency<IStripeAdapter>();
         stripeAdapter.ProviderSubscriptionGetAsync(
                 Arg.Is(provider.GatewaySubscriptionId),
@@ -156,6 +160,9 @@ public class ProviderBillingServiceTests
         var command =
             new ChangeProviderPlanCommand(providerPlanId, PlanType.EnterpriseMonthly, provider.GatewaySubscriptionId);
 
+        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(command.NewPlan)
+            .Returns(StaticStore.GetPlan(command.NewPlan));
+
         // Act
         await sutProvider.Sut.ChangePlan(command);
 
@@ -390,6 +397,12 @@ public class ProviderBillingServiceTests
             }
         };
 
+        foreach (var plan in providerPlans)
+        {
+            sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(plan.PlanType)
+                .Returns(StaticStore.GetPlan(plan.PlanType));
+        }
+
         sutProvider.GetDependency<IProviderPlanRepository>().GetByProviderId(provider.Id).Returns(providerPlans);
 
         // 50 seats currently assigned with a seat minimum of 100
@@ -451,6 +464,12 @@ public class ProviderBillingServiceTests
             }
         };
 
+        foreach (var plan in providerPlans)
+        {
+            sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(plan.PlanType)
+                .Returns(StaticStore.GetPlan(plan.PlanType));
+        }
+
         var providerPlan = providerPlans.First();
 
         sutProvider.GetDependency<IProviderPlanRepository>().GetByProviderId(provider.Id).Returns(providerPlans);
@@ -515,6 +534,12 @@ public class ProviderBillingServiceTests
             }
         };
 
+        foreach (var plan in providerPlans)
+        {
+            sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(plan.PlanType)
+                .Returns(StaticStore.GetPlan(plan.PlanType));
+        }
+
         var providerPlan = providerPlans.First();
 
         sutProvider.GetDependency<IProviderPlanRepository>().GetByProviderId(provider.Id).Returns(providerPlans);
@@ -579,6 +604,12 @@ public class ProviderBillingServiceTests
             }
         };
 
+        foreach (var plan in providerPlans)
+        {
+            sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(plan.PlanType)
+                .Returns(StaticStore.GetPlan(plan.PlanType));
+        }
+
         var providerPlan = providerPlans.First();
 
         sutProvider.GetDependency<IProviderPlanRepository>().GetByProviderId(provider.Id).Returns(providerPlans);
@@ -636,6 +667,8 @@ public class ProviderBillingServiceTests
             }
         ]);
 
+        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(planType).Returns(StaticStore.GetPlan(planType));
+
         sutProvider.GetDependency<IProviderOrganizationRepository>().GetManyDetailsByProviderAsync(provider.Id).Returns(
         [
             new ProviderOrganizationOrganizationDetails
@@ -672,6 +705,8 @@ public class ProviderBillingServiceTests
             }
         ]);
 
+        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(planType).Returns(StaticStore.GetPlan(planType));
+
         sutProvider.GetDependency<IProviderOrganizationRepository>().GetManyDetailsByProviderAsync(provider.Id).Returns(
         [
             new ProviderOrganizationOrganizationDetails
@@ -696,18 +731,6 @@ public class ProviderBillingServiceTests
 
     #region SetupCustomer
 
-    [Theory, BitAutoData]
-    public async Task SetupCustomer_NullProvider_ThrowsArgumentNullException(
-        SutProvider<ProviderBillingService> sutProvider,
-        TaxInfo taxInfo) =>
-        await Assert.ThrowsAsync<ArgumentNullException>(() => sutProvider.Sut.SetupCustomer(null, taxInfo));
-
-    [Theory, BitAutoData]
-    public async Task SetupCustomer_NullTaxInfo_ThrowsArgumentNullException(
-        SutProvider<ProviderBillingService> sutProvider,
-        Provider provider) =>
-        await Assert.ThrowsAsync<ArgumentNullException>(() => sutProvider.Sut.SetupCustomer(provider, null));
-
     [Theory, BitAutoData]
     public async Task SetupCustomer_MissingCountry_ContactSupport(
         SutProvider<ProviderBillingService> sutProvider,
@@ -856,6 +879,9 @@ public class ProviderBillingServiceTests
         sutProvider.GetDependency<IProviderPlanRepository>().GetByProviderId(provider.Id)
             .Returns(providerPlans);
 
+        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(PlanType.EnterpriseMonthly)
+            .Returns(StaticStore.GetPlan(PlanType.EnterpriseMonthly));
+
         await ThrowsBillingExceptionAsync(() => sutProvider.Sut.SetupSubscription(provider));
 
         await sutProvider.GetDependency<IStripeAdapter>()
@@ -881,6 +907,9 @@ public class ProviderBillingServiceTests
         sutProvider.GetDependency<IProviderPlanRepository>().GetByProviderId(provider.Id)
             .Returns(providerPlans);
 
+        sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(PlanType.TeamsMonthly)
+            .Returns(StaticStore.GetPlan(PlanType.TeamsMonthly));
+
         await ThrowsBillingExceptionAsync(() => sutProvider.Sut.SetupSubscription(provider));
 
         await sutProvider.GetDependency<IStripeAdapter>()
@@ -923,6 +952,12 @@ public class ProviderBillingServiceTests
             }
         };
 
+        foreach (var plan in providerPlans)
+        {
+            sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(plan.PlanType)
+                .Returns(StaticStore.GetPlan(plan.PlanType));
+        }
+
         sutProvider.GetDependency<IProviderPlanRepository>().GetByProviderId(provider.Id)
             .Returns(providerPlans);
 
@@ -968,6 +1003,12 @@ public class ProviderBillingServiceTests
             }
         };
 
+        foreach (var plan in providerPlans)
+        {
+            sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(plan.PlanType)
+                .Returns(StaticStore.GetPlan(plan.PlanType));
+        }
+
         sutProvider.GetDependency<IProviderPlanRepository>().GetByProviderId(provider.Id)
             .Returns(providerPlans);
 
@@ -1066,6 +1107,12 @@ public class ProviderBillingServiceTests
             new() { PlanType = PlanType.TeamsMonthly, SeatMinimum = 30, PurchasedSeats = 0, AllocatedSeats = 25 }
         };
 
+        foreach (var plan in providerPlans)
+        {
+            sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(plan.PlanType)
+                .Returns(StaticStore.GetPlan(plan.PlanType));
+        }
+
         providerPlanRepository.GetByProviderId(provider.Id).Returns(providerPlans);
 
         var command = new UpdateProviderSeatMinimumsCommand(
@@ -1139,6 +1186,12 @@ public class ProviderBillingServiceTests
             new() { PlanType = PlanType.TeamsMonthly, SeatMinimum = 30, PurchasedSeats = 0, AllocatedSeats = 15 }
         };
 
+        foreach (var plan in providerPlans)
+        {
+            sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(plan.PlanType)
+                .Returns(StaticStore.GetPlan(plan.PlanType));
+        }
+
         providerPlanRepository.GetByProviderId(provider.Id).Returns(providerPlans);
 
         var command = new UpdateProviderSeatMinimumsCommand(
@@ -1212,6 +1265,12 @@ public class ProviderBillingServiceTests
             new() { PlanType = PlanType.TeamsMonthly, SeatMinimum = 50, PurchasedSeats = 20 }
         };
 
+        foreach (var plan in providerPlans)
+        {
+            sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(plan.PlanType)
+                .Returns(StaticStore.GetPlan(plan.PlanType));
+        }
+
         providerPlanRepository.GetByProviderId(provider.Id).Returns(providerPlans);
 
         var command = new UpdateProviderSeatMinimumsCommand(
@@ -1279,6 +1338,12 @@ public class ProviderBillingServiceTests
             new() { PlanType = PlanType.TeamsMonthly, SeatMinimum = 50, PurchasedSeats = 20 }
         };
 
+        foreach (var plan in providerPlans)
+        {
+            sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(plan.PlanType)
+                .Returns(StaticStore.GetPlan(plan.PlanType));
+        }
+
         providerPlanRepository.GetByProviderId(provider.Id).Returns(providerPlans);
 
         var command = new UpdateProviderSeatMinimumsCommand(
@@ -1352,6 +1417,12 @@ public class ProviderBillingServiceTests
             new() { PlanType = PlanType.TeamsMonthly, SeatMinimum = 30, PurchasedSeats = 0 }
         };
 
+        foreach (var plan in providerPlans)
+        {
+            sutProvider.GetDependency<IPricingClient>().GetPlanOrThrow(plan.PlanType)
+                .Returns(StaticStore.GetPlan(plan.PlanType));
+        }
+
         providerPlanRepository.GetByProviderId(provider.Id).Returns(providerPlans);
 
         var command = new UpdateProviderSeatMinimumsCommand(

src/Admin/AdminConsole/Controllers/OrganizationsController.cs

@@ -10,6 +10,7 @@ using Bit.Core.AdminConsole.Providers.Interfaces;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Billing.Enums;
 using Bit.Core.Billing.Extensions;
+using Bit.Core.Billing.Pricing;
 using Bit.Core.Billing.Services;
 using Bit.Core.Context;
 using Bit.Core.Enums;
@@ -56,8 +57,8 @@ public class OrganizationsController : Controller
     private readonly IProviderOrganizationRepository _providerOrganizationRepository;
     private readonly IRemoveOrganizationFromProviderCommand _removeOrganizationFromProviderCommand;
     private readonly IProviderBillingService _providerBillingService;
-    private readonly IFeatureService _featureService;
     private readonly IOrganizationInitiateDeleteCommand _organizationInitiateDeleteCommand;
+    private readonly IPricingClient _pricingClient;
 
     public OrganizationsController(
         IOrganizationService organizationService,
@@ -84,8 +85,8 @@ public class OrganizationsController : Controller
         IProviderOrganizationRepository providerOrganizationRepository,
         IRemoveOrganizationFromProviderCommand removeOrganizationFromProviderCommand,
         IProviderBillingService providerBillingService,
-        IFeatureService featureService,
+        IOrganizationInitiateDeleteCommand organizationInitiateDeleteCommand,
-        IOrganizationInitiateDeleteCommand organizationInitiateDeleteCommand)
+        IPricingClient pricingClient)
     {
         _organizationService = organizationService;
         _organizationRepository = organizationRepository;
@@ -111,8 +112,8 @@ public class OrganizationsController : Controller
         _providerOrganizationRepository = providerOrganizationRepository;
         _removeOrganizationFromProviderCommand = removeOrganizationFromProviderCommand;
         _providerBillingService = providerBillingService;
-        _featureService = featureService;
         _organizationInitiateDeleteCommand = organizationInitiateDeleteCommand;
+        _pricingClient = pricingClient;
     }
 
     [RequirePermission(Permission.Org_List_View)]
@@ -212,6 +213,8 @@ public class OrganizationsController : Controller
             ? await _organizationUserRepository.GetOccupiedSmSeatCountByOrganizationIdAsync(organization.Id)
             : -1;
 
+        var plans = await _pricingClient.ListPlans();
+
         return View(new OrganizationEditModel(
             organization,
             provider,
@@ -224,6 +227,7 @@ public class OrganizationsController : Controller
             billingHistoryInfo,
             billingSyncConnection,
             _globalSettings,
+            plans,
             secrets,
             projects,
             serviceAccounts,
@@ -253,8 +257,9 @@ public class OrganizationsController : Controller
 
         UpdateOrganization(organization, model);
 
-        if (organization.UseSecretsManager &&
+        var plan = await _pricingClient.GetPlanOrThrow(organization.PlanType);
-            !StaticStore.GetPlan(organization.PlanType).SupportsSecretsManager)
+
+        if (organization.UseSecretsManager && !plan.SupportsSecretsManager)
         {
             TempData["Error"] = "Plan does not support Secrets Manager";
             return RedirectToAction("Edit", new { id });

src/Admin/AdminConsole/Controllers/ProvidersController.cs

@@ -3,7 +3,6 @@ using System.Net;
 using Bit.Admin.AdminConsole.Models;
 using Bit.Admin.Enums;
 using Bit.Admin.Utilities;
-using Bit.Core;
 using Bit.Core.AdminConsole.Entities.Provider;
 using Bit.Core.AdminConsole.Enums.Provider;
 using Bit.Core.AdminConsole.Providers.Interfaces;
@@ -133,11 +132,6 @@ public class ProvidersController : Controller
     [HttpGet("providers/create/multi-organization-enterprise")]
     public IActionResult CreateMultiOrganizationEnterprise(int enterpriseMinimumSeats, string ownerEmail = null)
     {
-        if (!_featureService.IsEnabled(FeatureFlagKeys.PM12275_MultiOrganizationEnterprises))
-        {
-            return RedirectToAction("Create");
-        }
-
         return View(new CreateMultiOrganizationEnterpriseProviderModel
         {
             OwnerEmail = ownerEmail,
@@ -211,10 +205,6 @@ public class ProvidersController : Controller
         }
         var provider = model.ToProvider();
 
-        if (!_featureService.IsEnabled(FeatureFlagKeys.PM12275_MultiOrganizationEnterprises))
-        {
-            return RedirectToAction("Create");
-        }
         await _createProviderCommand.CreateMultiOrganizationEnterpriseAsync(
             provider,
             model.OwnerEmail,
@@ -251,6 +241,18 @@ public class ProvidersController : Controller
         return View(provider);
     }
 
+    [SelfHosted(NotSelfHostedOnly = true)]
+    public async Task<IActionResult> Cancel(Guid id)
+    {
+        var provider = await GetEditModel(id);
+        if (provider == null)
+        {
+            return RedirectToAction("Index");
+        }
+
+        return RedirectToAction("Edit", new { id });
+    }
+
     [HttpPost]
     [ValidateAntiForgeryToken]
     [SelfHosted(NotSelfHostedOnly = true)]

src/Admin/AdminConsole/Models/CreateMspProviderModel.cs

@@ -10,6 +10,9 @@ public class CreateMspProviderModel : IValidatableObject
     [Display(Name = "Owner Email")]
     public string OwnerEmail { get; set; }
 
+    [Display(Name = "Subscription Discount")]
+    public string DiscountId { get; set; }
+
     [Display(Name = "Teams (Monthly) Seat Minimum")]
     public int TeamsMonthlySeatMinimum { get; set; }
 
@@ -20,7 +23,8 @@ public class CreateMspProviderModel : IValidatableObject
     {
         return new Provider
         {
-            Type = ProviderType.Msp
+            Type = ProviderType.Msp,
+            DiscountId = DiscountId
         };
     }
 

src/Admin/AdminConsole/Models/OrganizationEditModel.cs

@@ -8,6 +8,7 @@ using Bit.Core.Billing.Models;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Models.Data.Organizations.OrganizationUsers;
+using Bit.Core.Models.StaticStore;
 using Bit.Core.Settings;
 using Bit.Core.Utilities;
 using Bit.Core.Vault.Entities;
@@ -17,6 +18,8 @@ namespace Bit.Admin.AdminConsole.Models;
 
 public class OrganizationEditModel : OrganizationViewModel
 {
+    private readonly List<Plan> _plans;
+
     public OrganizationEditModel() { }
 
     public OrganizationEditModel(Provider provider)
@@ -40,6 +43,7 @@ public class OrganizationEditModel : OrganizationViewModel
         BillingHistoryInfo billingHistoryInfo,
         IEnumerable<OrganizationConnection> connections,
         GlobalSettings globalSettings,
+        List<Plan> plans,
         int secrets,
         int projects,
         int serviceAccounts,
@@ -96,6 +100,8 @@ public class OrganizationEditModel : OrganizationViewModel
         MaxAutoscaleSmSeats = org.MaxAutoscaleSmSeats;
         SmServiceAccounts = org.SmServiceAccounts;
         MaxAutoscaleSmServiceAccounts = org.MaxAutoscaleSmServiceAccounts;
+
+        _plans = plans;
     }
 
     public BillingInfo BillingInfo { get; set; }
@@ -183,7 +189,7 @@ public class OrganizationEditModel : OrganizationViewModel
      * Add mappings for individual properties as you need them
      */
     public object GetPlansHelper() =>
-        StaticStore.Plans
+        _plans
             .Select(p =>
             {
                 var plan = new

src/Admin/AdminConsole/Views/Providers/Create.cshtml

@@ -12,11 +12,6 @@
     var providerTypes = Enum.GetValues<ProviderType>()
         .OrderBy(x => x.GetDisplayAttribute().Order)
         .ToList();
-
-    if (!FeatureService.IsEnabled(FeatureFlagKeys.PM12275_MultiOrganizationEnterprises))
-    {
-        providerTypes.Remove(ProviderType.MultiOrganizationEnterprise);
-    }
 }
 
 <h1>Create Provider</h1>

src/Admin/AdminConsole/Views/Providers/CreateMsp.cshtml

@@ -1,3 +1,4 @@
+@using Bit.Core.Billing.Constants
 @model CreateMspProviderModel
 
 @{
@@ -12,6 +13,19 @@
             <label asp-for="OwnerEmail" class="form-label"></label>
             <input type="text" class="form-control" asp-for="OwnerEmail">
         </div>
+        <div class="mb-3">
+            @{
+                var selectList = new List<SelectListItem>
+                {
+                    new ("No discount", string.Empty, true),
+                    new ("20% - Open", StripeConstants.CouponIDs.MSPDiscounts.Open),
+                    new ("35% - Silver", StripeConstants.CouponIDs.MSPDiscounts.Silver),
+                    new ("50% - Gold", StripeConstants.CouponIDs.MSPDiscounts.Gold)
+                };
+            }
+            <label asp-for="DiscountId" class="form-label"></label>
+            <select class="form-select" asp-for="DiscountId" asp-items="selectList"></select>
+        </div>
         <div class="row">
             <div class="col-sm">
                 <div class="mb-3">

src/Admin/AdminConsole/Views/Providers/CreateOrganization.cshtml

@@ -19,7 +19,7 @@
 <div class="d-flex mt-4">
     <button type="submit" class="btn btn-primary" form="edit-form">Save</button>
     <div class="ms-auto d-flex">
-        <form asp-controller="Providers" asp-action="Edit" asp-route-id="@Model.Provider.Id"
+        <form asp-controller="Providers" asp-action="Cancel" asp-route-id="@Model.Provider.Id"
             onsubmit="return confirm('Are you sure you want to cancel?')">
             <button class="btn btn-outline-secondary" type="submit">Cancel</button>
         </form>

src/Admin/AdminConsole/Views/Providers/Edit.cshtml

@@ -75,8 +75,6 @@
                 break;
             }
             case ProviderType.MultiOrganizationEnterprise:
-            {
-                @if (FeatureService.IsEnabled(FeatureFlagKeys.PM12275_MultiOrganizationEnterprises) && Model.Provider.Type == ProviderType.MultiOrganizationEnterprise)
             {
                 <div class="row">
                     <div class="col-sm">
@@ -101,7 +99,6 @@
                         </div>
                     </div>
                 </div>
-                }
                 break;
             }
         }

src/Admin/Controllers/UsersController.cs

@@ -102,12 +102,13 @@ public class UsersController : Controller
             return RedirectToAction("Index");
         }
 
-        var ciphers = await _cipherRepository.GetManyByUserIdAsync(id);
+        var ciphers = await _cipherRepository.GetManyByUserIdAsync(id, withOrganizations: false);
         var billingInfo = await _paymentService.GetBillingAsync(user);
         var billingHistoryInfo = await _paymentService.GetBillingHistoryAsync(user);
         var isTwoFactorEnabled = await _twoFactorIsEnabledQuery.TwoFactorIsEnabledAsync(user);
         var verifiedDomain = await AccountDeprovisioningEnabled(user.Id);
         var deviceVerificationRequired = await _userService.ActiveNewDeviceVerificationException(user.Id);
+
         return View(new UserEditModel(user, isTwoFactorEnabled, ciphers, billingInfo, billingHistoryInfo, _globalSettings, verifiedDomain, deviceVerificationRequired));
     }
 

src/Admin/Views/Users/Edit.cshtml

@@ -9,8 +9,7 @@
 
     var canViewUserInformation = AccessControlService.UserHasPermission(Permission.User_UserInformation_View);
     var canViewNewDeviceException = AccessControlService.UserHasPermission(Permission.User_NewDeviceException_Edit) &&
-                                    GlobalSettings.EnableNewDeviceVerification &&
+                                    GlobalSettings.EnableNewDeviceVerification;
-                                    FeatureService.IsEnabled(Bit.Core.FeatureFlagKeys.NewDeviceVerification);
     var canViewBillingInformation = AccessControlService.UserHasPermission(Permission.User_BillingInformation_View);
     var canViewGeneral = AccessControlService.UserHasPermission(Permission.User_GeneralDetails_View);
     var canViewPremium = AccessControlService.UserHasPermission(Permission.User_Premium_View);

src/Admin/package-lock.json

@@ -18,7 +18,7 @@
         "css-loader": "7.1.2",
         "expose-loader": "5.0.0",
         "mini-css-extract-plugin": "2.9.2",
-        "sass": "1.79.5",
+        "sass": "1.85.0",
         "sass-loader": "16.0.4",
         "webpack": "5.97.1",
         "webpack-cli": "5.1.4"
@@ -99,12 +99,13 @@
       }
     },
     "node_modules/@parcel/watcher": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher/-/watcher-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher/-/watcher-2.5.1.tgz",
-      "integrity": "sha512-i0GV1yJnm2n3Yq1qw6QrUrd/LI9bE8WEBOTtOkpCXHHdyN3TAGgqAK/DAT05z4fq2x04cARXt2pDmjWjL92iTQ==",
+      "integrity": "sha512-dfUnCxiN9H4ap84DvD2ubjw+3vUNpstxa0TneY/Paat8a3R4uQZDLSvWjmznAY/DoahqTHl9V46HF/Zs3F29pg==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
         "detect-libc": "^1.0.3",
         "is-glob": "^4.0.3",
@@ -119,25 +120,25 @@
         "url": "https://opencollective.com/parcel"
       },
       "optionalDependencies": {
-        "@parcel/watcher-android-arm64": "2.5.0",
+        "@parcel/watcher-android-arm64": "2.5.1",
-        "@parcel/watcher-darwin-arm64": "2.5.0",
+        "@parcel/watcher-darwin-arm64": "2.5.1",
-        "@parcel/watcher-darwin-x64": "2.5.0",
+        "@parcel/watcher-darwin-x64": "2.5.1",
-        "@parcel/watcher-freebsd-x64": "2.5.0",
+        "@parcel/watcher-freebsd-x64": "2.5.1",
-        "@parcel/watcher-linux-arm-glibc": "2.5.0",
+        "@parcel/watcher-linux-arm-glibc": "2.5.1",
-        "@parcel/watcher-linux-arm-musl": "2.5.0",
+        "@parcel/watcher-linux-arm-musl": "2.5.1",
-        "@parcel/watcher-linux-arm64-glibc": "2.5.0",
+        "@parcel/watcher-linux-arm64-glibc": "2.5.1",
-        "@parcel/watcher-linux-arm64-musl": "2.5.0",
+        "@parcel/watcher-linux-arm64-musl": "2.5.1",
-        "@parcel/watcher-linux-x64-glibc": "2.5.0",
+        "@parcel/watcher-linux-x64-glibc": "2.5.1",
-        "@parcel/watcher-linux-x64-musl": "2.5.0",
+        "@parcel/watcher-linux-x64-musl": "2.5.1",
-        "@parcel/watcher-win32-arm64": "2.5.0",
+        "@parcel/watcher-win32-arm64": "2.5.1",
-        "@parcel/watcher-win32-ia32": "2.5.0",
+        "@parcel/watcher-win32-ia32": "2.5.1",
-        "@parcel/watcher-win32-x64": "2.5.0"
+        "@parcel/watcher-win32-x64": "2.5.1"
       }
     },
     "node_modules/@parcel/watcher-android-arm64": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-android-arm64/-/watcher-android-arm64-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-android-arm64/-/watcher-android-arm64-2.5.1.tgz",
-      "integrity": "sha512-qlX4eS28bUcQCdribHkg/herLe+0A9RyYC+mm2PXpncit8z5b3nSqGVzMNR3CmtAOgRutiZ02eIJJgP/b1iEFQ==",
+      "integrity": "sha512-KF8+j9nNbUN8vzOFDpRMsaKBHZ/mcjEjMToVMJOhTozkDonQFFrRcfdLWn6yWKCmJKmdVxSgHiYvTCef4/qcBA==",
       "cpu": [
         "arm64"
       ],
@@ -156,9 +157,9 @@
       }
     },
     "node_modules/@parcel/watcher-darwin-arm64": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-darwin-arm64/-/watcher-darwin-arm64-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-darwin-arm64/-/watcher-darwin-arm64-2.5.1.tgz",
-      "integrity": "sha512-hyZ3TANnzGfLpRA2s/4U1kbw2ZI4qGxaRJbBH2DCSREFfubMswheh8TeiC1sGZ3z2jUf3s37P0BBlrD3sjVTUw==",
+      "integrity": "sha512-eAzPv5osDmZyBhou8PoF4i6RQXAfeKL9tjb3QzYuccXFMQU0ruIc/POh30ePnaOyD1UXdlKguHBmsTs53tVoPw==",
       "cpu": [
         "arm64"
       ],
@@ -177,9 +178,9 @@
       }
     },
     "node_modules/@parcel/watcher-darwin-x64": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-darwin-x64/-/watcher-darwin-x64-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-darwin-x64/-/watcher-darwin-x64-2.5.1.tgz",
-      "integrity": "sha512-9rhlwd78saKf18fT869/poydQK8YqlU26TMiNg7AIu7eBp9adqbJZqmdFOsbZ5cnLp5XvRo9wcFmNHgHdWaGYA==",
+      "integrity": "sha512-1ZXDthrnNmwv10A0/3AJNZ9JGlzrF82i3gNQcWOzd7nJ8aj+ILyW1MTxVk35Db0u91oD5Nlk9MBiujMlwmeXZg==",
       "cpu": [
         "x64"
       ],
@@ -198,9 +199,9 @@
       }
     },
     "node_modules/@parcel/watcher-freebsd-x64": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-freebsd-x64/-/watcher-freebsd-x64-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-freebsd-x64/-/watcher-freebsd-x64-2.5.1.tgz",
-      "integrity": "sha512-syvfhZzyM8kErg3VF0xpV8dixJ+RzbUaaGaeb7uDuz0D3FK97/mZ5AJQ3XNnDsXX7KkFNtyQyFrXZzQIcN49Tw==",
+      "integrity": "sha512-SI4eljM7Flp9yPuKi8W0ird8TI/JK6CSxju3NojVI6BjHsTyK7zxA9urjVjEKJ5MBYC+bLmMcbAWlZ+rFkLpJQ==",
       "cpu": [
         "x64"
       ],
@@ -219,9 +220,9 @@
       }
     },
     "node_modules/@parcel/watcher-linux-arm-glibc": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm-glibc/-/watcher-linux-arm-glibc-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm-glibc/-/watcher-linux-arm-glibc-2.5.1.tgz",
-      "integrity": "sha512-0VQY1K35DQET3dVYWpOaPFecqOT9dbuCfzjxoQyif1Wc574t3kOSkKevULddcR9znz1TcklCE7Ht6NIxjvTqLA==",
+      "integrity": "sha512-RCdZlEyTs8geyBkkcnPWvtXLY44BCeZKmGYRtSgtwwnHR4dxfHRG3gR99XdMEdQ7KeiDdasJwwvNSF5jKtDwdA==",
       "cpu": [
         "arm"
       ],
@@ -240,9 +241,9 @@
       }
     },
     "node_modules/@parcel/watcher-linux-arm-musl": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm-musl/-/watcher-linux-arm-musl-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm-musl/-/watcher-linux-arm-musl-2.5.1.tgz",
-      "integrity": "sha512-6uHywSIzz8+vi2lAzFeltnYbdHsDm3iIB57d4g5oaB9vKwjb6N6dRIgZMujw4nm5r6v9/BQH0noq6DzHrqr2pA==",
+      "integrity": "sha512-6E+m/Mm1t1yhB8X412stiKFG3XykmgdIOqhjWj+VL8oHkKABfu/gjFj8DvLrYVHSBNC+/u5PeNrujiSQ1zwd1Q==",
       "cpu": [
         "arm"
       ],
@@ -261,9 +262,9 @@
       }
     },
     "node_modules/@parcel/watcher-linux-arm64-glibc": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm64-glibc/-/watcher-linux-arm64-glibc-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm64-glibc/-/watcher-linux-arm64-glibc-2.5.1.tgz",
-      "integrity": "sha512-BfNjXwZKxBy4WibDb/LDCriWSKLz+jJRL3cM/DllnHH5QUyoiUNEp3GmL80ZqxeumoADfCCP19+qiYiC8gUBjA==",
+      "integrity": "sha512-LrGp+f02yU3BN9A+DGuY3v3bmnFUggAITBGriZHUREfNEzZh/GO06FF5u2kx8x+GBEUYfyTGamol4j3m9ANe8w==",
       "cpu": [
         "arm64"
       ],
@@ -282,9 +283,9 @@
       }
     },
     "node_modules/@parcel/watcher-linux-arm64-musl": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm64-musl/-/watcher-linux-arm64-musl-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm64-musl/-/watcher-linux-arm64-musl-2.5.1.tgz",
-      "integrity": "sha512-S1qARKOphxfiBEkwLUbHjCY9BWPdWnW9j7f7Hb2jPplu8UZ3nes7zpPOW9bkLbHRvWM0WDTsjdOTUgW0xLBN1Q==",
+      "integrity": "sha512-cFOjABi92pMYRXS7AcQv9/M1YuKRw8SZniCDw0ssQb/noPkRzA+HBDkwmyOJYp5wXcsTrhxO0zq1U11cK9jsFg==",
       "cpu": [
         "arm64"
       ],
@@ -303,9 +304,9 @@
       }
     },
     "node_modules/@parcel/watcher-linux-x64-glibc": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-x64-glibc/-/watcher-linux-x64-glibc-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-x64-glibc/-/watcher-linux-x64-glibc-2.5.1.tgz",
-      "integrity": "sha512-d9AOkusyXARkFD66S6zlGXyzx5RvY+chTP9Jp0ypSTC9d4lzyRs9ovGf/80VCxjKddcUvnsGwCHWuF2EoPgWjw==",
+      "integrity": "sha512-GcESn8NZySmfwlTsIur+49yDqSny2IhPeZfXunQi48DMugKeZ7uy1FX83pO0X22sHntJ4Ub+9k34XQCX+oHt2A==",
       "cpu": [
         "x64"
       ],
@@ -324,9 +325,9 @@
       }
     },
     "node_modules/@parcel/watcher-linux-x64-musl": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-x64-musl/-/watcher-linux-x64-musl-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-x64-musl/-/watcher-linux-x64-musl-2.5.1.tgz",
-      "integrity": "sha512-iqOC+GoTDoFyk/VYSFHwjHhYrk8bljW6zOhPuhi5t9ulqiYq1togGJB5e3PwYVFFfeVgc6pbz3JdQyDoBszVaA==",
+      "integrity": "sha512-n0E2EQbatQ3bXhcH2D1XIAANAcTZkQICBPVaxMeaCVBtOpBZpWJuf7LwyWPSBDITb7In8mqQgJ7gH8CILCURXg==",
       "cpu": [
         "x64"
       ],
@@ -345,9 +346,9 @@
       }
     },
     "node_modules/@parcel/watcher-win32-arm64": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-arm64/-/watcher-win32-arm64-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-arm64/-/watcher-win32-arm64-2.5.1.tgz",
-      "integrity": "sha512-twtft1d+JRNkM5YbmexfcH/N4znDtjgysFaV9zvZmmJezQsKpkfLYJ+JFV3uygugK6AtIM2oADPkB2AdhBrNig==",
+      "integrity": "sha512-RFzklRvmc3PkjKjry3hLF9wD7ppR4AKcWNzH7kXR7GUe0Igb3Nz8fyPwtZCSquGrhU5HhUNDr/mKBqj7tqA2Vw==",
       "cpu": [
         "arm64"
       ],
@@ -366,9 +367,9 @@
       }
     },
     "node_modules/@parcel/watcher-win32-ia32": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-ia32/-/watcher-win32-ia32-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-ia32/-/watcher-win32-ia32-2.5.1.tgz",
-      "integrity": "sha512-+rgpsNRKwo8A53elqbbHXdOMtY/tAtTzManTWShB5Kk54N8Q9mzNWV7tV+IbGueCbcj826MfWGU3mprWtuf1TA==",
+      "integrity": "sha512-c2KkcVN+NJmuA7CGlaGD1qJh1cLfDnQsHjE89E60vUEMlqduHGCdCLJCID5geFVM0dOtA3ZiIO8BoEQmzQVfpQ==",
       "cpu": [
         "ia32"
       ],
@@ -387,9 +388,9 @@
       }
     },
     "node_modules/@parcel/watcher-win32-x64": {
-      "version": "2.5.0",
+      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-x64/-/watcher-win32-x64-2.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-x64/-/watcher-win32-x64-2.5.1.tgz",
-      "integrity": "sha512-lPrxve92zEHdgeff3aiu4gDOIt4u7sJYha6wbdEZDCDUhtjTsOMiaJzG5lMY4GkWH8p0fMmO2Ppq5G5XXG+DQw==",
+      "integrity": "sha512-9lHBdJITeNR++EvSQVUcaZoWupyHfXe1jZvGZ06O/5MflPcuPLtEphScIBL+AiCWBO46tDSHzWyD0uDmmZqsgA==",
       "cpu": [
         "x64"
       ],
@@ -455,9 +456,9 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "22.10.2",
+      "version": "22.13.5",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.10.2.tgz",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.13.5.tgz",
-      "integrity": "sha512-Xxr6BBRCAOQixvonOye19wnzyDiUtTeqldOOmj3CkeblonbccA12PFwlufvRdrpjXxqnmUaeiU5EOA+7s5diUQ==",
+      "integrity": "sha512-+lTU0PxZXn0Dr1NBtC7Y8cR21AJr87dLLU953CWA6pMxxv/UDc7jYAY90upcrie1nRcD6XNG5HOYEDtgW5TxAg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -772,6 +773,7 @@
       "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
         "fill-range": "^7.1.1"
       },
@@ -780,9 +782,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.24.3",
+      "version": "4.24.4",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.24.3.tgz",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.24.4.tgz",
-      "integrity": "sha512-1CPmv8iobE2fyRMV97dAcMVegvvWKxmq94hkLiAkUGwKVTyDLw33K+ZxiFrREKmmps4rIw6grcCFCnTMSZ/YiA==",
+      "integrity": "sha512-KDi1Ny1gSePi1vm0q4oxSF8b4DR44GF4BbmS2YdhPLOEqd8pDviZOGH/GsmRwoWJ2+5Lr085X7naowMwKHDG1A==",
       "dev": true,
       "funding": [
         {
@@ -820,9 +822,9 @@
       "license": "MIT"
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001690",
+      "version": "1.0.30001700",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001690.tgz",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001700.tgz",
-      "integrity": "sha512-5ExiE3qQN6oF8Clf8ifIDcMRCRE/dMGcETG/XGMD8/XiXm6HXQgQTh1yZYLXXpSOsEUlJm1Xr7kGULZTuGtP/w==",
+      "integrity": "sha512-2S6XIXwaE7K7erT8dY+kLQcpa5ms63XlRkMkReXjle+kf6c5g38vyMl+Z5y8dSxOFDhcFe+nxnn261PLxBSQsQ==",
       "dev": true,
       "funding": [
         {
@@ -965,6 +967,7 @@
       "integrity": "sha512-pGjwhsmsp4kL2RTz08wcOlGN83otlqHeD/Z5T8GXZB+/YcpQ/dgo+lbU8ZsGxV0HIvqqxo9l7mqYwyYMD9bKDg==",
       "dev": true,
       "license": "Apache-2.0",
+      "optional": true,
       "bin": {
         "detect-libc": "bin/detect-libc.js"
       },
@@ -973,16 +976,16 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.75",
+      "version": "1.5.103",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.75.tgz",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.103.tgz",
-      "integrity": "sha512-Lf3++DumRE/QmweGjU+ZcKqQ+3bKkU/qjaKYhIJKEOhgIO9Xs6IiAQFkfFoj+RhgDk4LUeNsLo6plExHqSyu6Q==",
+      "integrity": "sha512-P6+XzIkfndgsrjROJWfSvVEgNHtPgbhVyTkwLjUM2HU/h7pZRORgaTlHqfAikqxKmdJMLW8fftrdGWbd/Ds0FA==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/enhanced-resolve": {
-      "version": "5.18.0",
+      "version": "5.18.1",
-      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.18.0.tgz",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.18.1.tgz",
-      "integrity": "sha512-0/r0MySGYG8YqlayBZ6MuCfECmHFdJ5qyPh8s8wa5Hnm6SaFLSK1VYCbj+NKp090Nm1caZhD+QTnmxO7esYGyQ==",
+      "integrity": "sha512-ZSW3ma5GkcQBIpwZTSRAI8N71Uuwgs93IezB7mf7R60tC8ZbJideoDNKjHn2O9KIlx6rkGTTEk1xUCK2E1Y2Yg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1007,9 +1010,9 @@
       }
     },
     "node_modules/es-module-lexer": {
-      "version": "1.5.4",
+      "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-1.5.4.tgz",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-1.6.0.tgz",
-      "integrity": "sha512-MVNK56NiMrOwitFB7cqDwq0CQutbw+0BvLshJSse0MUNU+y1FC3bUS/AQg7oUng+/wKrrki7JfmwtVHkVfPLlw==",
+      "integrity": "sha512-qqnD1yMU6tk/jnaMosogGySTZP8YtUgAffA9nMN+E/rjxcfRQ6IEk7IiozUjgxKoFHBGjTLnrHB/YC45r/59EQ==",
       "dev": true,
       "license": "MIT"
     },
@@ -1112,10 +1115,20 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.0.3",
+      "version": "3.0.6",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.0.3.tgz",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.0.6.tgz",
-      "integrity": "sha512-aLrHthzCjH5He4Z2H9YZ+v6Ujb9ocRuW6ZzkJQOrTxleEijANq4v1TsaPaVG1PZcuurEzrLcWRyYBYXD5cEiaw==",
+      "integrity": "sha512-Atfo14OibSv5wAp4VWNsFYE1AchQRTv9cBGWET4pZWHzYshFSS9NQI6I57rdKn9croWVMbYFbLhJ+yJvmZIIHw==",
       "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
       "license": "BSD-3-Clause"
     },
     "node_modules/fastest-levenshtein": {
@@ -1134,6 +1147,7 @@
       "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
         "to-regex-range": "^5.0.1"
       },
@@ -1235,9 +1249,9 @@
       }
     },
     "node_modules/immutable": {
-      "version": "4.3.7",
+      "version": "5.0.3",
-      "resolved": "https://registry.npmjs.org/immutable/-/immutable-4.3.7.tgz",
+      "resolved": "https://registry.npmjs.org/immutable/-/immutable-5.0.3.tgz",
-      "integrity": "sha512-1hqclzwYwjRDFLjcFxOM5AYkkG0rpFPpr1RLPMEuGczoS7YA8gLhy8SWXYRAA/XwfEHpfo3cw5JGioS32fnMRw==",
+      "integrity": "sha512-P8IdPQHq3lA1xVeBRi5VPqUm5HDgKnx0Ru51wZz5mjxHr5n3RWhjIpOFU7ybkUxfB+5IToy+OLaHYDBIWsv+uw==",
       "dev": true,
       "license": "MIT"
     },
@@ -1293,6 +1307,7 @@
       "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "engines": {
         "node": ">=0.10.0"
       }
@@ -1303,6 +1318,7 @@
       "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
         "is-extglob": "^2.1.1"
       },
@@ -1316,6 +1332,7 @@
       "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "engines": {
         "node": ">=0.12.0"
       }
@@ -1431,6 +1448,7 @@
       "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
         "braces": "^3.0.3",
         "picomatch": "^2.3.1"
@@ -1514,7 +1532,8 @@
       "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-7.1.1.tgz",
       "integrity": "sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "optional": true
     },
     "node_modules/node-releases": {
       "version": "2.0.19",
@@ -1602,6 +1621,7 @@
       "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "engines": {
         "node": ">=8.6"
       },
@@ -1623,9 +1643,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.4.49",
+      "version": "8.5.3",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.49.tgz",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.3.tgz",
-      "integrity": "sha512-OCVPnIObs4N29kxTjzLfUryOkvZEq+pf8jTF0lg8E7uETuWHA+v7j3c/xJmiqpX450191LlmZfUKkXxkTry7nA==",
+      "integrity": "sha512-dle9A3yYxlBSrt8Fu+IpjGT8SY8hN0mlaA6GY8t0P5PjIOZemULz/E2Bnm/2dcUOena75OTNkHI76uZBNUUq3A==",
       "dev": true,
       "funding": [
         {
@@ -1643,7 +1663,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.7",
+        "nanoid": "^3.3.8",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
@@ -1715,9 +1735,9 @@
       }
     },
     "node_modules/postcss-selector-parser": {
-      "version": "7.0.0",
+      "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.0.tgz",
-      "integrity": "sha512-9RbEr1Y7FFfptd/1eEdntyjMwLeghW1bHX9GWjXo19vx4ytPQhANltvVxDggzJl7mnWM+dX28kb6cyS/4iQjlQ==",
+      "integrity": "sha512-8sLjZwK0R+JlxlYcTuVnyT2v+htpdrjDOKuMcOVdYjt52Lh8hWRYpxBPoKx/Zg+bcjc3wx6fmQevMmUztS/ccA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1756,13 +1776,13 @@
       }
     },
     "node_modules/readdirp": {
-      "version": "4.0.2",
+      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-4.0.2.tgz",
+      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-4.1.2.tgz",
-      "integrity": "sha512-yDMz9g+VaZkqBYS/ozoBJwaBhTbZo3UNYQHNRw1D3UFQB8oHB4uS/tAODO+ZLjGWmUbKnIlOWO+aaIiAxrUWHA==",
+      "integrity": "sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">= 14.16.0"
+        "node": ">= 14.18.0"
       },
       "funding": {
         "type": "individual",
@@ -1858,15 +1878,14 @@
       "license": "MIT"
     },
     "node_modules/sass": {
-      "version": "1.79.5",
+      "version": "1.85.0",
-      "resolved": "https://registry.npmjs.org/sass/-/sass-1.79.5.tgz",
+      "resolved": "https://registry.npmjs.org/sass/-/sass-1.85.0.tgz",
-      "integrity": "sha512-W1h5kp6bdhqFh2tk3DsI771MoEJjvrSY/2ihJRJS4pjIyfJCw0nTsxqhnrUzaLMOJjFchj8rOvraI/YUVjtx5g==",
+      "integrity": "sha512-3ToiC1xZ1Y8aU7+CkgCI/tqyuPXEmYGJXO7H4uqp0xkLXUqp88rQQ4j1HmP37xSJLbCJPaIiv+cT1y+grssrww==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@parcel/watcher": "^2.4.1",
         "chokidar": "^4.0.0",
-        "immutable": "^4.0.0",
+        "immutable": "^5.0.2",
         "source-map-js": ">=0.6.2 <2.0.0"
       },
       "bin": {
@@ -1874,6 +1893,9 @@
       },
       "engines": {
         "node": ">=14.0.0"
+      },
+      "optionalDependencies": {
+        "@parcel/watcher": "^2.4.1"
       }
     },
     "node_modules/sass-loader": {
@@ -1938,9 +1960,9 @@
       }
     },
     "node_modules/semver": {
-      "version": "7.6.3",
+      "version": "7.7.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.6.3.tgz",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.1.tgz",
-      "integrity": "sha512-oVekP1cKtI+CTDvHWYFUcMtsK/00wmAEfyqKfNdARm8u1wNVhSgaX7A8d4UuIlUI5e84iEwOhs7ZPYRmzU9U6A==",
+      "integrity": "sha512-hlq8tAfn0m/61p4BVRcPzIGr6LKiMwo4VM6dGi6pt4qcRkmNzTcWq6eCEjEh+qXjkMDvPlOFFSGwQjoEa6gyMA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -2067,9 +2089,9 @@
       }
     },
     "node_modules/terser": {
-      "version": "5.37.0",
+      "version": "5.39.0",
-      "resolved": "https://registry.npmjs.org/terser/-/terser-5.37.0.tgz",
+      "resolved": "https://registry.npmjs.org/terser/-/terser-5.39.0.tgz",
-      "integrity": "sha512-B8wRRkmre4ERucLM/uXx4MOV5cbnOlVAqUst+1+iLKPI0dOgFO28f84ptoQt9HEI537PMzfYa/d+GEPKTRXmYA==",
+      "integrity": "sha512-LBAhFyLho16harJoWMg/nZsQYgTrg5jXOn2nCYjRUcZZEdE3qa2zb8QEDRUGVZBW4rlazf2fxkg8tztybTaqWw==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -2126,6 +2148,7 @@
       "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
         "is-number": "^7.0.0"
       },
@@ -2149,9 +2172,9 @@
       "license": "MIT"
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.1.1",
+      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.1.1.tgz",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.1.2.tgz",
-      "integrity": "sha512-R8UzCaa9Az+38REPiJ1tXlImTJXlVfgHZsglwBD/k6nj76ctsH1E3q4doGrukiLQd3sGQYu56r5+lo5r94l29A==",
+      "integrity": "sha512-PPypAm5qvlD7XMZC3BujecnaOxwhrtoFR+Dqkk5Aa/6DssiH0ibKoketaj9w8LP7Bont1rYeoV5plxD7RTEPRg==",
       "dev": true,
       "funding": [
         {
@@ -2170,7 +2193,7 @@
       "license": "MIT",
       "dependencies": {
         "escalade": "^3.2.0",
-        "picocolors": "^1.1.0"
+        "picocolors": "^1.1.1"
       },
       "bin": {
         "update-browserslist-db": "cli.js"

src/Admin/package.json

@@ -17,7 +17,7 @@
     "css-loader": "7.1.2",
     "expose-loader": "5.0.0",
     "mini-css-extract-plugin": "2.9.2",
-    "sass": "1.79.5",
+    "sass": "1.85.0",
     "sass-loader": "16.0.4",
     "webpack": "5.97.1",
     "webpack-cli": "5.1.4"

src/Api/AdminConsole/Controllers/OrganizationUsersController.cs

@@ -13,6 +13,7 @@ using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Auth.Enums;
 using Bit.Core.Auth.Repositories;
 using Bit.Core.Auth.UserFeatures.TwoFactorAuth.Interfaces;
+using Bit.Core.Billing.Pricing;
 using Bit.Core.Context;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;
@@ -55,6 +56,7 @@ public class OrganizationUsersController : Controller
     private readonly IDeleteManagedOrganizationUserAccountCommand _deleteManagedOrganizationUserAccountCommand;
     private readonly IGetOrganizationUsersManagementStatusQuery _getOrganizationUsersManagementStatusQuery;
     private readonly IFeatureService _featureService;
+    private readonly IPricingClient _pricingClient;
 
     public OrganizationUsersController(
         IOrganizationRepository organizationRepository,
@@ -77,7 +79,8 @@ public class OrganizationUsersController : Controller
         IRemoveOrganizationUserCommand removeOrganizationUserCommand,
         IDeleteManagedOrganizationUserAccountCommand deleteManagedOrganizationUserAccountCommand,
         IGetOrganizationUsersManagementStatusQuery getOrganizationUsersManagementStatusQuery,
-        IFeatureService featureService)
+        IFeatureService featureService,
+        IPricingClient pricingClient)
     {
         _organizationRepository = organizationRepository;
         _organizationUserRepository = organizationUserRepository;
@@ -100,6 +103,7 @@ public class OrganizationUsersController : Controller
         _deleteManagedOrganizationUserAccountCommand = deleteManagedOrganizationUserAccountCommand;
         _getOrganizationUsersManagementStatusQuery = getOrganizationUsersManagementStatusQuery;
         _featureService = featureService;
+        _pricingClient = pricingClient;
     }
 
     [HttpGet("{id}")]
@@ -648,7 +652,9 @@ public class OrganizationUsersController : Controller
         if (additionalSmSeatsRequired > 0)
         {
             var organization = await _organizationRepository.GetByIdAsync(orgId);
-            var update = new SecretsManagerSubscriptionUpdate(organization, true)
+            // TODO: https://bitwarden.atlassian.net/browse/PM-17000
+            var plan = await _pricingClient.GetPlanOrThrow(organization!.PlanType);
+            var update = new SecretsManagerSubscriptionUpdate(organization, plan, true)
                 .AdjustSeats(additionalSmSeatsRequired);
             await _updateSecretsManagerSubscriptionCommand.UpdateSubscriptionAsync(update);
         }

src/Api/AdminConsole/Controllers/OrganizationsController.cs

@@ -22,6 +22,7 @@ using Bit.Core.Auth.Repositories;
 using Bit.Core.Auth.Services;
 using Bit.Core.Billing.Enums;
 using Bit.Core.Billing.Extensions;
+using Bit.Core.Billing.Pricing;
 using Bit.Core.Billing.Services;
 using Bit.Core.Context;
 using Bit.Core.Enums;
@@ -60,6 +61,7 @@ public class OrganizationsController : Controller
     private readonly IRemoveOrganizationUserCommand _removeOrganizationUserCommand;
     private readonly ICloudOrganizationSignUpCommand _cloudOrganizationSignUpCommand;
     private readonly IOrganizationDeleteCommand _organizationDeleteCommand;
+    private readonly IPricingClient _pricingClient;
 
     public OrganizationsController(
         IOrganizationRepository organizationRepository,
@@ -81,7 +83,8 @@ public class OrganizationsController : Controller
         IDataProtectorTokenFactory<OrgDeleteTokenable> orgDeleteTokenDataFactory,
         IRemoveOrganizationUserCommand removeOrganizationUserCommand,
         ICloudOrganizationSignUpCommand cloudOrganizationSignUpCommand,
-        IOrganizationDeleteCommand organizationDeleteCommand)
+        IOrganizationDeleteCommand organizationDeleteCommand,
+        IPricingClient pricingClient)
     {
         _organizationRepository = organizationRepository;
         _organizationUserRepository = organizationUserRepository;
@@ -103,6 +106,7 @@ public class OrganizationsController : Controller
         _removeOrganizationUserCommand = removeOrganizationUserCommand;
         _cloudOrganizationSignUpCommand = cloudOrganizationSignUpCommand;
         _organizationDeleteCommand = organizationDeleteCommand;
+        _pricingClient = pricingClient;
     }
 
     [HttpGet("{id}")]
@@ -120,7 +124,8 @@ public class OrganizationsController : Controller
             throw new NotFoundException();
         }
 
-        return new OrganizationResponseModel(organization);
+        var plan = await _pricingClient.GetPlan(organization.PlanType);
+        return new OrganizationResponseModel(organization, plan);
     }
 
     [HttpGet("")]
@@ -181,7 +186,8 @@ public class OrganizationsController : Controller
 
         var organizationSignup = model.ToOrganizationSignup(user);
         var result = await _cloudOrganizationSignUpCommand.SignUpOrganizationAsync(organizationSignup);
-        return new OrganizationResponseModel(result.Organization);
+        var plan = await _pricingClient.GetPlanOrThrow(result.Organization.PlanType);
+        return new OrganizationResponseModel(result.Organization, plan);
     }
 
     [HttpPost("create-without-payment")]
@@ -196,7 +202,8 @@ public class OrganizationsController : Controller
 
         var organizationSignup = model.ToOrganizationSignup(user);
         var result = await _cloudOrganizationSignUpCommand.SignUpOrganizationAsync(organizationSignup);
-        return new OrganizationResponseModel(result.Organization);
+        var plan = await _pricingClient.GetPlanOrThrow(result.Organization.PlanType);
+        return new OrganizationResponseModel(result.Organization, plan);
     }
 
     [HttpPut("{id}")]
@@ -224,7 +231,8 @@ public class OrganizationsController : Controller
         }
 
         await _organizationService.UpdateAsync(model.ToOrganization(organization, _globalSettings), updateBilling);
-        return new OrganizationResponseModel(organization);
+        var plan = await _pricingClient.GetPlan(organization.PlanType);
+        return new OrganizationResponseModel(organization, plan);
     }
 
     [HttpPost("{id}/storage")]
@@ -358,8 +366,8 @@ public class OrganizationsController : Controller
         if (model.Type == OrganizationApiKeyType.BillingSync || model.Type == OrganizationApiKeyType.Scim)
         {
             // Non-enterprise orgs should not be able to create or view an apikey of billing sync/scim key types
-            var plan = StaticStore.GetPlan(organization.PlanType);
+            var productTier = organization.PlanType.GetProductTier();
-            if (plan.ProductTier is not ProductTierType.Enterprise and not ProductTierType.Teams)
+            if (productTier is not ProductTierType.Enterprise and not ProductTierType.Teams)
             {
                 throw new NotFoundException();
             }
@@ -542,7 +550,8 @@ public class OrganizationsController : Controller
         }
 
         await _organizationService.UpdateAsync(model.ToOrganization(organization, _featureService), eventType: EventType.Organization_CollectionManagement_Updated);
-        return new OrganizationResponseModel(organization);
+        var plan = await _pricingClient.GetPlan(organization.PlanType);
+        return new OrganizationResponseModel(organization, plan);
     }
 
     [HttpGet("{id}/plan-type")]

src/Api/AdminConsole/Models/Response/Organizations/OrganizationResponseModel.cs

@@ -4,6 +4,7 @@ using Bit.Core.AdminConsole.Entities;
 using Bit.Core.Billing.Enums;
 using Bit.Core.Models.Api;
 using Bit.Core.Models.Business;
+using Bit.Core.Models.StaticStore;
 using Bit.Core.Utilities;
 using Constants = Bit.Core.Constants;
 
@@ -11,8 +12,10 @@ namespace Bit.Api.AdminConsole.Models.Response.Organizations;
 
 public class OrganizationResponseModel : ResponseModel
 {
-    public OrganizationResponseModel(Organization organization, string obj = "organization")
+    public OrganizationResponseModel(
-        : base(obj)
+        Organization organization,
+        Plan plan,
+        string obj = "organization") : base(obj)
     {
         if (organization == null)
         {
@@ -28,7 +31,8 @@ public class OrganizationResponseModel : ResponseModel
         BusinessCountry = organization.BusinessCountry;
         BusinessTaxNumber = organization.BusinessTaxNumber;
         BillingEmail = organization.BillingEmail;
-        Plan = new PlanResponseModel(StaticStore.GetPlan(organization.PlanType));
+        // Self-Host instances only require plan information that can be derived from the Organization record.
+        Plan = plan != null ? new PlanResponseModel(plan) : new PlanResponseModel(organization);
         PlanType = organization.PlanType;
         Seats = organization.Seats;
         MaxAutoscaleSeats = organization.MaxAutoscaleSeats;
@@ -110,7 +114,9 @@ public class OrganizationResponseModel : ResponseModel
 
 public class OrganizationSubscriptionResponseModel : OrganizationResponseModel
 {
-    public OrganizationSubscriptionResponseModel(Organization organization) : base(organization, "organizationSubscription")
+    public OrganizationSubscriptionResponseModel(
+        Organization organization,
+        Plan plan) : base(organization, plan, "organizationSubscription")
     {
         Expiration = organization.ExpirationDate;
         StorageName = organization.Storage.HasValue ?
@@ -119,8 +125,11 @@ public class OrganizationSubscriptionResponseModel : OrganizationResponseModel
             Math.Round(organization.Storage.Value / 1073741824D, 2) : 0; // 1 GB
     }
 
-    public OrganizationSubscriptionResponseModel(Organization organization, SubscriptionInfo subscription, bool hideSensitiveData)
+    public OrganizationSubscriptionResponseModel(
-        : this(organization)
+        Organization organization,
+        SubscriptionInfo subscription,
+        Plan plan,
+        bool hideSensitiveData) : this(organization, plan)
     {
         Subscription = subscription.Subscription != null ? new BillingSubscription(subscription.Subscription) : null;
         UpcomingInvoice = subscription.UpcomingInvoice != null ? new BillingSubscriptionUpcomingInvoice(subscription.UpcomingInvoice) : null;
@@ -142,7 +151,7 @@ public class OrganizationSubscriptionResponseModel : OrganizationResponseModel
     }
 
     public OrganizationSubscriptionResponseModel(Organization organization, OrganizationLicense license) :
-        this(organization)
+        this(organization, (Plan)null)
     {
         if (license != null)
         {

src/Api/AdminConsole/Models/Response/ProfileOrganizationResponseModel.cs

@@ -3,6 +3,7 @@ using Bit.Core.AdminConsole.Enums.Provider;
 using Bit.Core.Auth.Enums;
 using Bit.Core.Auth.Models.Data;
 using Bit.Core.Billing.Enums;
+using Bit.Core.Billing.Extensions;
 using Bit.Core.Enums;
 using Bit.Core.Models.Api;
 using Bit.Core.Models.Data;
@@ -37,7 +38,7 @@ public class ProfileOrganizationResponseModel : ResponseModel
         UsePasswordManager = organization.UsePasswordManager;
         UsersGetPremium = organization.UsersGetPremium;
         UseCustomPermissions = organization.UseCustomPermissions;
-        UseActivateAutofillPolicy = StaticStore.GetPlan(organization.PlanType).ProductTier == ProductTierType.Enterprise;
+        UseActivateAutofillPolicy = organization.PlanType.GetProductTier() == ProductTierType.Enterprise;
         SelfHost = organization.SelfHost;
         Seats = organization.Seats;
         MaxCollections = organization.MaxCollections;
@@ -60,7 +61,7 @@ public class ProfileOrganizationResponseModel : ResponseModel
         FamilySponsorshipAvailable = FamilySponsorshipFriendlyName == null &&
             StaticStore.GetSponsoredPlan(PlanSponsorshipType.FamiliesForEnterprise)
             .UsersCanSponsor(organization);
-        ProductTierType = StaticStore.GetPlan(organization.PlanType).ProductTier;
+        ProductTierType = organization.PlanType.GetProductTier();
         FamilySponsorshipLastSyncDate = organization.FamilySponsorshipLastSyncDate;
         FamilySponsorshipToDelete = organization.FamilySponsorshipToDelete;
         FamilySponsorshipValidUntil = organization.FamilySponsorshipValidUntil;

src/Api/AdminConsole/Models/Response/ProfileProviderOrganizationResponseModel.cs

@@ -1,8 +1,8 @@
 using Bit.Core.AdminConsole.Models.Data.Provider;
 using Bit.Core.Billing.Enums;
+using Bit.Core.Billing.Extensions;
 using Bit.Core.Enums;
 using Bit.Core.Models.Data;
-using Bit.Core.Utilities;
 
 namespace Bit.Api.AdminConsole.Models.Response;
 
@@ -26,7 +26,7 @@ public class ProfileProviderOrganizationResponseModel : ProfileOrganizationRespo
         UseResetPassword = organization.UseResetPassword;
         UsersGetPremium = organization.UsersGetPremium;
         UseCustomPermissions = organization.UseCustomPermissions;
-        UseActivateAutofillPolicy = StaticStore.GetPlan(organization.PlanType).ProductTier == ProductTierType.Enterprise;
+        UseActivateAutofillPolicy = organization.PlanType.GetProductTier() == ProductTierType.Enterprise;
         SelfHost = organization.SelfHost;
         Seats = organization.Seats;
         MaxCollections = organization.MaxCollections;
@@ -44,7 +44,7 @@ public class ProfileProviderOrganizationResponseModel : ProfileOrganizationRespo
         ProviderId = organization.ProviderId;
         ProviderName = organization.ProviderName;
         ProviderType = organization.ProviderType;
-        ProductTierType = StaticStore.GetPlan(organization.PlanType).ProductTier;
+        ProductTierType = organization.PlanType.GetProductTier();
         LimitCollectionCreation = organization.LimitCollectionCreation;
         LimitCollectionDeletion = organization.LimitCollectionDeletion;
         LimitItemDeletion = organization.LimitItemDeletion;

src/Api/Auth/Controllers/AccountsController.cs

@@ -149,11 +149,11 @@ public class AccountsController : Controller
             throw new BadRequestException("MasterPasswordHash", "Invalid password.");
         }
 
-        // If Account Deprovisioning is enabled, we need to check if the user is managed by any organization.
+        var managedUserValidationResult = await _userService.ValidateManagedUserDomainAsync(user, model.NewEmail);
-        if (_featureService.IsEnabled(FeatureFlagKeys.AccountDeprovisioning)
+
-            && await _userService.IsManagedByAnyOrganizationAsync(user.Id))
+        if (!managedUserValidationResult.Succeeded)
         {
-            throw new BadRequestException("Cannot change emails for accounts owned by an organization. Contact your organization administrator for additional details.");
+            throw new BadRequestException(managedUserValidationResult.Errors);
         }
 
         await _userService.InitiateEmailChangeAsync(user, model.NewEmail);
@@ -173,13 +173,6 @@ public class AccountsController : Controller
             throw new BadRequestException("You cannot change your email when using Key Connector.");
         }
 
-        // If Account Deprovisioning is enabled, we need to check if the user is managed by any organization.
-        if (_featureService.IsEnabled(FeatureFlagKeys.AccountDeprovisioning)
-            && await _userService.IsManagedByAnyOrganizationAsync(user.Id))
-        {
-            throw new BadRequestException("Cannot change emails for accounts owned by an organization. Contact your organization administrator for additional details.");
-        }
-
         var result = await _userService.ChangeEmailAsync(user, model.MasterPasswordHash, model.NewEmail,
             model.NewMasterPasswordHash, model.Token, model.Key);
         if (result.Succeeded)

src/Api/Auth/Controllers/TwoFactorController.cs

@@ -288,12 +288,17 @@ public class TwoFactorController : Controller
         return response;
     }
 
+    /// <summary>
+    /// This endpoint is only used to set-up email two factor authentication.
+    /// </summary>
+    /// <param name="model">secret verification model</param>
+    /// <returns>void</returns>
     [HttpPost("send-email")]
     public async Task SendEmail([FromBody] TwoFactorEmailRequestModel model)
     {
         var user = await CheckAsync(model, false, true);
         model.ToUser(user);
-        await _userService.SendTwoFactorEmailAsync(user);
+        await _userService.SendTwoFactorEmailAsync(user, false);
     }
 
     [AllowAnonymous]

src/Api/Auth/Models/Response/AuthRequestResponseModel.cs

@@ -18,6 +18,7 @@ public class AuthRequestResponseModel : ResponseModel
 
         Id = authRequest.Id;
         PublicKey = authRequest.PublicKey;
+        RequestDeviceIdentifier = authRequest.RequestDeviceIdentifier;
         RequestDeviceTypeValue = authRequest.RequestDeviceType;
         RequestDeviceType = authRequest.RequestDeviceType.GetType().GetMember(authRequest.RequestDeviceType.ToString())
             .FirstOrDefault()?.GetCustomAttribute<DisplayAttribute>()?.GetName();
@@ -32,6 +33,7 @@ public class AuthRequestResponseModel : ResponseModel
 
     public Guid Id { get; set; }
     public string PublicKey { get; set; }
+    public string RequestDeviceIdentifier { get; set; }
     public DeviceType RequestDeviceTypeValue { get; set; }
     public string RequestDeviceType { get; set; }
     public string RequestIpAddress { get; set; }

src/Api/Billing/Controllers/OrganizationBillingController.cs

@@ -4,6 +4,7 @@ using Bit.Api.Billing.Models.Requests;
 using Bit.Api.Billing.Models.Responses;
 using Bit.Core.Billing.Models;
 using Bit.Core.Billing.Models.Sales;
+using Bit.Core.Billing.Pricing;
 using Bit.Core.Billing.Services;
 using Bit.Core.Context;
 using Bit.Core.Repositories;
@@ -21,6 +22,7 @@ public class OrganizationBillingController(
     IOrganizationBillingService organizationBillingService,
     IOrganizationRepository organizationRepository,
     IPaymentService paymentService,
+    IPricingClient pricingClient,
     ISubscriberService subscriberService,
     IPaymentHistoryService paymentHistoryService,
     IUserService userService) : BaseBillingController
@@ -279,7 +281,7 @@ public class OrganizationBillingController(
         }
         var organizationSignup = model.ToOrganizationSignup(user);
         var sale = OrganizationSale.From(organization, organizationSignup);
-        var plan = StaticStore.GetPlan(model.PlanType);
+        var plan = await pricingClient.GetPlanOrThrow(model.PlanType);
         sale.Organization.PlanType = plan.Type;
         sale.Organization.Plan = plan.Name;
         sale.SubscriptionSetup.SkipTrial = true;

src/Api/Billing/Controllers/OrganizationsController.cs

@@ -8,6 +8,7 @@ using Bit.Core.AdminConsole.Entities;
 using Bit.Core.Billing.Constants;
 using Bit.Core.Billing.Entities;
 using Bit.Core.Billing.Models;
+using Bit.Core.Billing.Pricing;
 using Bit.Core.Billing.Repositories;
 using Bit.Core.Billing.Services;
 using Bit.Core.Context;
@@ -45,7 +46,8 @@ public class OrganizationsController(
     IAddSecretsManagerSubscriptionCommand addSecretsManagerSubscriptionCommand,
     IReferenceEventService referenceEventService,
     ISubscriberService subscriberService,
-    IOrganizationInstallationRepository organizationInstallationRepository)
+    IOrganizationInstallationRepository organizationInstallationRepository,
+    IPricingClient pricingClient)
     : Controller
 {
     [HttpGet("{id:guid}/subscription")]
@@ -62,8 +64,19 @@ public class OrganizationsController(
             throw new NotFoundException();
         }
 
-        if (!globalSettings.SelfHosted && organization.Gateway != null)
+        if (globalSettings.SelfHosted)
         {
+            var orgLicense = await licensingService.ReadOrganizationLicenseAsync(organization);
+            return new OrganizationSubscriptionResponseModel(organization, orgLicense);
+        }
+
+        var plan = await pricingClient.GetPlanOrThrow(organization.PlanType);
+
+        if (string.IsNullOrEmpty(organization.GatewaySubscriptionId))
+        {
+            return new OrganizationSubscriptionResponseModel(organization, plan);
+        }
+
         var subscriptionInfo = await paymentService.GetSubscriptionAsync(organization);
         if (subscriptionInfo == null)
         {
@@ -72,16 +85,7 @@ public class OrganizationsController(
 
         var hideSensitiveData = !await currentContext.EditSubscription(id);
 
-            return new OrganizationSubscriptionResponseModel(organization, subscriptionInfo, hideSensitiveData);
+        return new OrganizationSubscriptionResponseModel(organization, subscriptionInfo, plan, hideSensitiveData);
-        }
-
-        if (globalSettings.SelfHosted)
-        {
-            var orgLicense = await licensingService.ReadOrganizationLicenseAsync(organization);
-            return new OrganizationSubscriptionResponseModel(organization, orgLicense);
-        }
-
-        return new OrganizationSubscriptionResponseModel(organization);
     }
 
     [HttpGet("{id:guid}/license")]
@@ -165,7 +169,8 @@ public class OrganizationsController(
 
         organization = await AdjustOrganizationSeatsForSmTrialAsync(id, organization, model);
 
-        var organizationUpdate = model.ToSecretsManagerSubscriptionUpdate(organization);
+        var plan = await pricingClient.GetPlanOrThrow(organization.PlanType);
+        var organizationUpdate = model.ToSecretsManagerSubscriptionUpdate(organization, plan);
 
         await updateSecretsManagerSubscriptionCommand.UpdateSubscriptionAsync(organizationUpdate);
 

src/Api/Billing/Controllers/ProviderBillingController.cs

@@ -2,6 +2,7 @@
 using Bit.Api.Billing.Models.Responses;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Billing.Models;
+using Bit.Core.Billing.Pricing;
 using Bit.Core.Billing.Repositories;
 using Bit.Core.Billing.Services;
 using Bit.Core.Context;
@@ -20,6 +21,7 @@ namespace Bit.Api.Billing.Controllers;
 public class ProviderBillingController(
     ICurrentContext currentContext,
     ILogger<BaseProviderController> logger,
+    IPricingClient pricingClient,
     IProviderBillingService providerBillingService,
     IProviderPlanRepository providerPlanRepository,
     IProviderRepository providerRepository,
@@ -84,13 +86,25 @@ public class ProviderBillingController(
 
         var providerPlans = await providerPlanRepository.GetByProviderId(provider.Id);
 
+        var configuredProviderPlans = await Task.WhenAll(providerPlans.Select(async providerPlan =>
+        {
+            var plan = await pricingClient.GetPlanOrThrow(providerPlan.PlanType);
+            return new ConfiguredProviderPlan(
+                providerPlan.Id,
+                providerPlan.ProviderId,
+                plan,
+                providerPlan.SeatMinimum ?? 0,
+                providerPlan.PurchasedSeats ?? 0,
+                providerPlan.AllocatedSeats ?? 0);
+        }));
+
         var taxInformation = GetTaxInformation(subscription.Customer);
 
         var subscriptionSuspension = await GetSubscriptionSuspensionAsync(stripeAdapter, subscription);
 
         var response = ProviderSubscriptionResponse.From(
             subscription,
-            providerPlans,
+            configuredProviderPlans,
             taxInformation,
             subscriptionSuspension,
             provider);

src/Api/Billing/Models/Responses/ProviderSubscriptionResponse.cs

@@ -1,9 +1,7 @@
 using Bit.Core.AdminConsole.Entities.Provider;
 using Bit.Core.AdminConsole.Enums.Provider;
-using Bit.Core.Billing.Entities;
 using Bit.Core.Billing.Enums;
 using Bit.Core.Billing.Models;
-using Bit.Core.Utilities;
 using Stripe;
 
 namespace Bit.Api.Billing.Models.Responses;
@@ -25,26 +23,24 @@ public record ProviderSubscriptionResponse(
 
     public static ProviderSubscriptionResponse From(
         Subscription subscription,
-        ICollection<ProviderPlan> providerPlans,
+        ICollection<ConfiguredProviderPlan> providerPlans,
         TaxInformation taxInformation,
         SubscriptionSuspension subscriptionSuspension,
         Provider provider)
     {
         var providerPlanResponses = providerPlans
-            .Where(providerPlan => providerPlan.IsConfigured())
+            .Select(providerPlan =>
-            .Select(ConfiguredProviderPlan.From)
-            .Select(configuredProviderPlan =>
             {
-                var plan = StaticStore.GetPlan(configuredProviderPlan.PlanType);
+                var plan = providerPlan.Plan;
-                var cost = (configuredProviderPlan.SeatMinimum + configuredProviderPlan.PurchasedSeats) * plan.PasswordManager.ProviderPortalSeatPrice;
+                var cost = (providerPlan.SeatMinimum + providerPlan.PurchasedSeats) * plan.PasswordManager.ProviderPortalSeatPrice;
                 var cadence = plan.IsAnnual ? _annualCadence : _monthlyCadence;
                 return new ProviderPlanResponse(
                     plan.Name,
                     plan.Type,
                     plan.ProductTier,
-                    configuredProviderPlan.SeatMinimum,
+                    providerPlan.SeatMinimum,
-                    configuredProviderPlan.PurchasedSeats,
+                    providerPlan.PurchasedSeats,
-                    configuredProviderPlan.AssignedSeats,
+                    providerPlan.AssignedSeats,
                     cost,
                     cadence);
             });

src/Api/Billing/Public/Controllers/OrganizationController.cs

@@ -1,6 +1,7 @@
 using System.Net;
 using Bit.Api.Billing.Public.Models;
 using Bit.Api.Models.Public.Response;
+using Bit.Core.Billing.Pricing;
 using Bit.Core.Context;
 using Bit.Core.OrganizationFeatures.OrganizationSubscriptions.Interface;
 using Bit.Core.Repositories;
@@ -21,19 +22,22 @@ public class OrganizationController : Controller
     private readonly IOrganizationRepository _organizationRepository;
     private readonly IUpdateSecretsManagerSubscriptionCommand _updateSecretsManagerSubscriptionCommand;
     private readonly ILogger<OrganizationController> _logger;
+    private readonly IPricingClient _pricingClient;
 
     public OrganizationController(
         IOrganizationService organizationService,
         ICurrentContext currentContext,
         IOrganizationRepository organizationRepository,
         IUpdateSecretsManagerSubscriptionCommand updateSecretsManagerSubscriptionCommand,
-        ILogger<OrganizationController> logger)
+        ILogger<OrganizationController> logger,
+        IPricingClient pricingClient)
     {
         _organizationService = organizationService;
         _currentContext = currentContext;
         _organizationRepository = organizationRepository;
         _updateSecretsManagerSubscriptionCommand = updateSecretsManagerSubscriptionCommand;
         _logger = logger;
+        _pricingClient = pricingClient;
     }
 
     /// <summary>
@@ -140,7 +144,8 @@ public class OrganizationController : Controller
             return "Organization has no access to Secrets Manager.";
         }
 
-        var secretsManagerUpdate = model.SecretsManager.ToSecretsManagerSubscriptionUpdate(organization);
+        var plan = await _pricingClient.GetPlanOrThrow(organization.PlanType);
+        var secretsManagerUpdate = model.SecretsManager.ToSecretsManagerSubscriptionUpdate(organization, plan);
         await _updateSecretsManagerSubscriptionCommand.UpdateSubscriptionAsync(secretsManagerUpdate);
 
         return string.Empty;

src/Api/Billing/Public/Models/Request/OrganizationSubscriptionUpdateRequestModel.cs

@@ -1,6 +1,7 @@
 using System.ComponentModel.DataAnnotations;
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.Models.Business;
+using Bit.Core.Models.StaticStore;
 
 namespace Bit.Api.Billing.Public.Models;
 
@@ -93,17 +94,17 @@ public class SecretsManagerSubscriptionUpdateModel
         set { _maxAutoScaleServiceAccounts = value < 0 ? null : value; }
     }
 
-    public virtual SecretsManagerSubscriptionUpdate ToSecretsManagerSubscriptionUpdate(Organization organization)
+    public virtual SecretsManagerSubscriptionUpdate ToSecretsManagerSubscriptionUpdate(Organization organization, Plan plan)
     {
-        var update = UpdateUpdateMaxAutoScale(organization);
+        var update = UpdateUpdateMaxAutoScale(organization, plan);
         UpdateSeats(organization, update);
         UpdateServiceAccounts(organization, update);
         return update;
     }
 
-    private SecretsManagerSubscriptionUpdate UpdateUpdateMaxAutoScale(Organization organization)
+    private SecretsManagerSubscriptionUpdate UpdateUpdateMaxAutoScale(Organization organization, Plan plan)
     {
-        var update = new SecretsManagerSubscriptionUpdate(organization, false)
+        var update = new SecretsManagerSubscriptionUpdate(organization, plan, false)
         {
             MaxAutoscaleSmSeats = MaxAutoScaleSeats ?? organization.MaxAutoscaleSmSeats,
             MaxAutoscaleSmServiceAccounts = MaxAutoScaleServiceAccounts ?? organization.MaxAutoscaleSmServiceAccounts

src/Api/Controllers/ConfigController.cs

@@ -23,6 +23,6 @@ public class ConfigController : Controller
     [HttpGet("")]
     public ConfigResponseModel GetConfigs()
     {
-        return new ConfigResponseModel(_globalSettings, _featureService.GetAll());
+        return new ConfigResponseModel(_featureService, _globalSettings);
     }
 }

src/Api/Controllers/DevicesController.cs

@@ -186,6 +186,19 @@ public class DevicesController : Controller
         await _deviceService.SaveAsync(model.ToDevice(device));
     }
 
+    [HttpPut("identifier/{identifier}/web-push-auth")]
+    [HttpPost("identifier/{identifier}/web-push-auth")]
+    public async Task PutWebPushAuth(string identifier, [FromBody] WebPushAuthRequestModel model)
+    {
+        var device = await _deviceRepository.GetByIdentifierAsync(identifier, _userService.GetProperUserId(User).Value);
+        if (device == null)
+        {
+            throw new NotFoundException();
+        }
+
+        await _deviceService.SaveAsync(model.ToData(), device);
+    }
+
     [AllowAnonymous]
     [HttpPut("identifier/{identifier}/clear-token")]
     [HttpPost("identifier/{identifier}/clear-token")]

src/Api/Controllers/PlansController.cs

@@ -1,5 +1,5 @@
 using Bit.Api.Models.Response;
-using Bit.Core.Utilities;
+using Bit.Core.Billing.Pricing;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
@@ -7,13 +7,15 @@ namespace Bit.Api.Controllers;
 
 [Route("plans")]
 [Authorize("Web")]
-public class PlansController : Controller
+public class PlansController(
+    IPricingClient pricingClient) : Controller
 {
     [HttpGet("")]
     [AllowAnonymous]
-    public ListResponseModel<PlanResponseModel> Get()
+    public async Task<ListResponseModel<PlanResponseModel>> Get()
     {
-        var responses = StaticStore.Plans.Select(plan => new PlanResponseModel(plan));
+        var plans = await pricingClient.ListPlans();
+        var responses = plans.Select(plan => new PlanResponseModel(plan));
         return new ListResponseModel<PlanResponseModel>(responses);
     }
 }

src/Api/Controllers/SelfHosted/SelfHostedOrganizationLicensesController.cs

@@ -64,7 +64,8 @@ public class SelfHostedOrganizationLicensesController : Controller
 
         var result = await _organizationService.SignUpAsync(license, user, model.Key,
             model.CollectionName, model.Keys?.PublicKey, model.Keys?.EncryptedPrivateKey);
-        return new OrganizationResponseModel(result.Item1);
+
+        return new OrganizationResponseModel(result.Item1, null);
     }
 
     [HttpPost("{id}")]

src/Api/Models/Request/DeviceRequestModels.cs

@@ -1,6 +1,7 @@
 using System.ComponentModel.DataAnnotations;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
+using Bit.Core.NotificationHub;
 using Bit.Core.Utilities;
 
 namespace Bit.Api.Models.Request;
@@ -37,6 +38,26 @@ public class DeviceRequestModel
     }
 }
 
+public class WebPushAuthRequestModel
+{
+    [Required]
+    public string Endpoint { get; set; }
+    [Required]
+    public string P256dh { get; set; }
+    [Required]
+    public string Auth { get; set; }
+
+    public WebPushRegistrationData ToData()
+    {
+        return new WebPushRegistrationData
+        {
+            Endpoint = Endpoint,
+            P256dh = P256dh,
+            Auth = Auth
+        };
+    }
+}
+
 public class DeviceTokenRequestModel
 {
     [StringLength(255)]

src/Api/Models/Request/Organizations/SecretsManagerSubscriptionUpdateRequestModel.cs

@@ -1,6 +1,7 @@
 using System.ComponentModel.DataAnnotations;
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.Models.Business;
+using Bit.Core.Models.StaticStore;
 
 namespace Bit.Api.Models.Request.Organizations;
 
@@ -12,9 +13,9 @@ public class SecretsManagerSubscriptionUpdateRequestModel
     public int ServiceAccountAdjustment { get; set; }
     public int? MaxAutoscaleServiceAccounts { get; set; }
 
-    public virtual SecretsManagerSubscriptionUpdate ToSecretsManagerSubscriptionUpdate(Organization organization)
+    public virtual SecretsManagerSubscriptionUpdate ToSecretsManagerSubscriptionUpdate(Organization organization, Plan plan)
     {
-        return new SecretsManagerSubscriptionUpdate(organization, false)
+        return new SecretsManagerSubscriptionUpdate(organization, plan, false)
         {
             MaxAutoscaleSmSeats = MaxAutoscaleSeats,
             MaxAutoscaleSmServiceAccounts = MaxAutoscaleServiceAccounts

src/Api/Models/Response/ConfigResponseModel.cs

@@ -1,4 +1,7 @@
-using Bit.Core.Models.Api;
+using Bit.Core;
+using Bit.Core.Enums;
+using Bit.Core.Models.Api;
+using Bit.Core.Services;
 using Bit.Core.Settings;
 using Bit.Core.Utilities;
 
@@ -11,6 +14,7 @@ public class ConfigResponseModel : ResponseModel
     public ServerConfigResponseModel Server { get; set; }
     public EnvironmentConfigResponseModel Environment { get; set; }
     public IDictionary<string, object> FeatureStates { get; set; }
+    public PushSettings Push { get; set; }
     public ServerSettingsResponseModel Settings { get; set; }
 
     public ConfigResponseModel() : base("config")
@@ -23,8 +27,9 @@ public class ConfigResponseModel : ResponseModel
     }
 
     public ConfigResponseModel(
-        IGlobalSettings globalSettings,
+        IFeatureService featureService,
-        IDictionary<string, object> featureStates) : base("config")
+        IGlobalSettings globalSettings
+        ) : base("config")
     {
         Version = AssemblyHelpers.GetVersion();
         GitHash = AssemblyHelpers.GetGitHash();
@@ -37,7 +42,9 @@ public class ConfigResponseModel : ResponseModel
             Notifications = globalSettings.BaseServiceUri.Notifications,
             Sso = globalSettings.BaseServiceUri.Sso
         };
-        FeatureStates = featureStates;
+        FeatureStates = featureService.GetAll();
+        var webPushEnabled = FeatureStates.TryGetValue(FeatureFlagKeys.WebPush, out var webPushEnabledValue) ? (bool)webPushEnabledValue : false;
+        Push = PushSettings.Build(webPushEnabled, globalSettings);
         Settings = new ServerSettingsResponseModel
         {
             DisableUserRegistration = globalSettings.DisableUserRegistration
@@ -61,6 +68,23 @@ public class EnvironmentConfigResponseModel
     public string Sso { get; set; }
 }
 
+public class PushSettings
+{
+    public PushTechnologyType PushTechnology { get; private init; }
+    public string VapidPublicKey { get; private init; }
+
+    public static PushSettings Build(bool webPushEnabled, IGlobalSettings globalSettings)
+    {
+        var vapidPublicKey = webPushEnabled ? globalSettings.WebPush.VapidPublicKey : null;
+        var pushTechnology = vapidPublicKey != null ? PushTechnologyType.WebPush : PushTechnologyType.SignalR;
+        return new()
+        {
+            VapidPublicKey = vapidPublicKey,
+            PushTechnology = pushTechnology
+        };
+    }
+}
+
 public class ServerSettingsResponseModel
 {
     public bool DisableUserRegistration { get; set; }

src/Api/Models/Response/PlanResponseModel.cs

@@ -1,4 +1,6 @@
-using Bit.Core.Billing.Enums;
+using Bit.Core.AdminConsole.Entities;
+using Bit.Core.Billing.Enums;
+using Bit.Core.Billing.Extensions;
 using Bit.Core.Models.Api;
 using Bit.Core.Models.StaticStore;
 
@@ -44,6 +46,13 @@ public class PlanResponseModel : ResponseModel
         PasswordManager = new PasswordManagerPlanFeaturesResponseModel(plan.PasswordManager);
     }
 
+    public PlanResponseModel(Organization organization, string obj = "plan") : base(obj)
+    {
+        Type = organization.PlanType;
+        ProductTier = organization.PlanType.GetProductTier();
+        Name = organization.Plan;
+    }
+
     public PlanType Type { get; set; }
     public ProductTierType ProductTier { get; set; }
     public string Name { get; set; }

src/Api/Platform/Push/Controllers/PushController.cs

@@ -1,6 +1,7 @@
 using Bit.Core.Context;
 using Bit.Core.Exceptions;
 using Bit.Core.Models.Api;
+using Bit.Core.NotificationHub;
 using Bit.Core.Platform.Push;
 using Bit.Core.Settings;
 using Bit.Core.Utilities;
@@ -22,14 +23,14 @@ public class PushController : Controller
     private readonly IPushNotificationService _pushNotificationService;
     private readonly IWebHostEnvironment _environment;
     private readonly ICurrentContext _currentContext;
-    private readonly GlobalSettings _globalSettings;
+    private readonly IGlobalSettings _globalSettings;
 
     public PushController(
         IPushRegistrationService pushRegistrationService,
         IPushNotificationService pushNotificationService,
         IWebHostEnvironment environment,
         ICurrentContext currentContext,
-        GlobalSettings globalSettings)
+        IGlobalSettings globalSettings)
     {
         _currentContext = currentContext;
         _environment = environment;
@@ -39,22 +40,22 @@ public class PushController : Controller
     }
 
     [HttpPost("register")]
-    public async Task PostRegister([FromBody] PushRegistrationRequestModel model)
+    public async Task RegisterAsync([FromBody] PushRegistrationRequestModel model)
     {
         CheckUsage();
-        await _pushRegistrationService.CreateOrUpdateRegistrationAsync(model.PushToken, Prefix(model.DeviceId),
+        await _pushRegistrationService.CreateOrUpdateRegistrationAsync(new PushRegistrationData(model.PushToken), Prefix(model.DeviceId),
-            Prefix(model.UserId), Prefix(model.Identifier), model.Type, model.OrganizationIds.Select(Prefix));
+            Prefix(model.UserId), Prefix(model.Identifier), model.Type, model.OrganizationIds.Select(Prefix), model.InstallationId);
     }
 
     [HttpPost("delete")]
-    public async Task PostDelete([FromBody] PushDeviceRequestModel model)
+    public async Task DeleteAsync([FromBody] PushDeviceRequestModel model)
     {
         CheckUsage();
         await _pushRegistrationService.DeleteRegistrationAsync(Prefix(model.Id));
     }
 
     [HttpPut("add-organization")]
-    public async Task PutAddOrganization([FromBody] PushUpdateRequestModel model)
+    public async Task AddOrganizationAsync([FromBody] PushUpdateRequestModel model)
     {
         CheckUsage();
         await _pushRegistrationService.AddUserRegistrationOrganizationAsync(
@@ -63,7 +64,7 @@ public class PushController : Controller
     }
 
     [HttpPut("delete-organization")]
-    public async Task PutDeleteOrganization([FromBody] PushUpdateRequestModel model)
+    public async Task DeleteOrganizationAsync([FromBody] PushUpdateRequestModel model)
     {
         CheckUsage();
         await _pushRegistrationService.DeleteUserRegistrationOrganizationAsync(
@@ -72,11 +73,22 @@ public class PushController : Controller
     }
 
     [HttpPost("send")]
-    public async Task PostSend([FromBody] PushSendRequestModel model)
+    public async Task SendAsync([FromBody] PushSendRequestModel model)
     {
         CheckUsage();
 
-        if (!string.IsNullOrWhiteSpace(model.UserId))
+        if (!string.IsNullOrWhiteSpace(model.InstallationId))
+        {
+            if (_currentContext.InstallationId!.Value.ToString() != model.InstallationId!)
+            {
+                throw new BadRequestException("InstallationId does not match current context.");
+            }
+
+            await _pushNotificationService.SendPayloadToInstallationAsync(
+                _currentContext.InstallationId.Value.ToString(), model.Type, model.Payload, Prefix(model.Identifier),
+                Prefix(model.DeviceId), model.ClientType);
+        }
+        else if (!string.IsNullOrWhiteSpace(model.UserId))
         {
             await _pushNotificationService.SendPayloadToUserAsync(Prefix(model.UserId),
                 model.Type, model.Payload, Prefix(model.Identifier), Prefix(model.DeviceId), model.ClientType);
@@ -95,7 +107,7 @@ public class PushController : Controller
             return null;
         }
 
-        return $"{_currentContext.InstallationId.Value}_{value}";
+        return $"{_currentContext.InstallationId!.Value}_{value}";
     }
 
     private void CheckUsage()

src/Api/Platform/Push/PushTechnologyType.cs

@@ -0,0 +1,11 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Bit.Core.Enums;
+
+public enum PushTechnologyType
+{
+    [Display(Name = "SignalR")]
+    SignalR = 0,
+    [Display(Name = "WebPush")]
+    WebPush = 1,
+}

src/Api/SecretsManager/Controllers/ServiceAccountsController.cs

@@ -1,6 +1,7 @@
 using Bit.Api.Models.Response;
 using Bit.Api.SecretsManager.Models.Request;
 using Bit.Api.SecretsManager.Models.Response;
+using Bit.Core.Billing.Pricing;
 using Bit.Core.Context;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;
@@ -37,6 +38,7 @@ public class ServiceAccountsController : Controller
     private readonly IUpdateServiceAccountCommand _updateServiceAccountCommand;
     private readonly IDeleteServiceAccountsCommand _deleteServiceAccountsCommand;
     private readonly IRevokeAccessTokensCommand _revokeAccessTokensCommand;
+    private readonly IPricingClient _pricingClient;
 
     public ServiceAccountsController(
         ICurrentContext currentContext,
@@ -52,7 +54,8 @@ public class ServiceAccountsController : Controller
         ICreateServiceAccountCommand createServiceAccountCommand,
         IUpdateServiceAccountCommand updateServiceAccountCommand,
         IDeleteServiceAccountsCommand deleteServiceAccountsCommand,
-        IRevokeAccessTokensCommand revokeAccessTokensCommand)
+        IRevokeAccessTokensCommand revokeAccessTokensCommand,
+        IPricingClient pricingClient)
     {
         _currentContext = currentContext;
         _userService = userService;
@@ -66,6 +69,7 @@ public class ServiceAccountsController : Controller
         _updateServiceAccountCommand = updateServiceAccountCommand;
         _deleteServiceAccountsCommand = deleteServiceAccountsCommand;
         _revokeAccessTokensCommand = revokeAccessTokensCommand;
+        _pricingClient = pricingClient;
         _createAccessTokenCommand = createAccessTokenCommand;
         _updateSecretsManagerSubscriptionCommand = updateSecretsManagerSubscriptionCommand;
     }
@@ -124,7 +128,9 @@ public class ServiceAccountsController : Controller
         if (newServiceAccountSlotsRequired > 0)
         {
             var org = await _organizationRepository.GetByIdAsync(organizationId);
-            var update = new SecretsManagerSubscriptionUpdate(org, true)
+            // TODO: https://bitwarden.atlassian.net/browse/PM-17002
+            var plan = await _pricingClient.GetPlanOrThrow(org!.PlanType);
+            var update = new SecretsManagerSubscriptionUpdate(org, plan, true)
                 .AdjustServiceAccounts(newServiceAccountSlotsRequired);
             await _updateSecretsManagerSubscriptionCommand.UpdateSubscriptionAsync(update);
         }

src/Api/Startup.cs

@@ -5,7 +5,6 @@ using Bit.Core.Settings;
 using AspNetCoreRateLimit;
 using Stripe;
 using Bit.Core.Utilities;
-using IdentityModel;
 using System.Globalization;
 using Bit.Api.AdminConsole.Models.Request.Organizations;
 using Bit.Api.Auth.Models.Request;

src/Api/Utilities/ServiceCollectionExtensions.cs

@@ -36,8 +36,6 @@ public static class ServiceCollectionExtensions
                 }
             });
 
-            config.CustomSchemaIds(type => type.FullName);
-
             config.SwaggerDoc("internal", new OpenApiInfo { Title = "Bitwarden Internal API", Version = "latest" });
 
             config.AddSecurityDefinition("oauth2-client-credentials", new OpenApiSecurityScheme

src/Api/Vault/Controllers/SecurityTaskController.cs

@@ -22,19 +22,22 @@ public class SecurityTaskController : Controller
     private readonly IMarkTaskAsCompleteCommand _markTaskAsCompleteCommand;
     private readonly IGetTasksForOrganizationQuery _getTasksForOrganizationQuery;
     private readonly ICreateManyTasksCommand _createManyTasksCommand;
+    private readonly ICreateManyTaskNotificationsCommand _createManyTaskNotificationsCommand;
 
     public SecurityTaskController(
         IUserService userService,
         IGetTaskDetailsForUserQuery getTaskDetailsForUserQuery,
         IMarkTaskAsCompleteCommand markTaskAsCompleteCommand,
         IGetTasksForOrganizationQuery getTasksForOrganizationQuery,
-        ICreateManyTasksCommand createManyTasksCommand)
+        ICreateManyTasksCommand createManyTasksCommand,
+        ICreateManyTaskNotificationsCommand createManyTaskNotificationsCommand)
     {
         _userService = userService;
         _getTaskDetailsForUserQuery = getTaskDetailsForUserQuery;
         _markTaskAsCompleteCommand = markTaskAsCompleteCommand;
         _getTasksForOrganizationQuery = getTasksForOrganizationQuery;
         _createManyTasksCommand = createManyTasksCommand;
+        _createManyTaskNotificationsCommand = createManyTaskNotificationsCommand;
     }
 
     /// <summary>
@@ -87,6 +90,9 @@ public class SecurityTaskController : Controller
         [FromBody] BulkCreateSecurityTasksRequestModel model)
     {
         var securityTasks = await _createManyTasksCommand.CreateAsync(orgId, model.Tasks);
+
+        await _createManyTaskNotificationsCommand.CreateAsync(orgId, securityTasks);
+
         var response = securityTasks.Select(x => new SecurityTasksResponseModel(x)).ToList();
         return new ListResponseModel<SecurityTasksResponseModel>(response);
     }

src/Billing/Constants/BitPayInvoiceStatus.cs

@@ -0,0 +1,7 @@
+namespace Bit.Billing.Constants;
+
+public static class BitPayInvoiceStatus
+{
+    public const string Confirmed = "confirmed";
+    public const string Complete = "complete";
+}

src/Billing/Constants/BitPayNotificationCode.cs

@@ -0,0 +1,6 @@
+namespace Bit.Billing.Constants;
+
+public static class BitPayNotificationCode
+{
+    public const string InvoiceConfirmed = "invoice_confirmed";
+}

src/Billing/Controllers/BitPayController.cs

@@ -1,4 +1,5 @@
 using System.Globalization;
+using Bit.Billing.Constants;
 using Bit.Billing.Models;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Billing.Services;
@@ -65,7 +66,7 @@ public class BitPayController : Controller
             return new BadRequestResult();
         }
 
-        if (model.Event.Name != "invoice_confirmed")
+        if (model.Event.Name != BitPayNotificationCode.InvoiceConfirmed)
         {
             // Only processing confirmed invoice events for now.
             return new OkResult();
@@ -75,20 +76,20 @@ public class BitPayController : Controller
         if (invoice == null)
         {
             // Request forged...?
-            _logger.LogWarning("Invoice not found. #" + model.Data.Id);
+            _logger.LogWarning("Invoice not found. #{InvoiceId}", model.Data.Id);
             return new BadRequestResult();
         }
 
-        if (invoice.Status != "confirmed" && invoice.Status != "completed")
+        if (invoice.Status != BitPayInvoiceStatus.Confirmed && invoice.Status != BitPayInvoiceStatus.Complete)
         {
-            _logger.LogWarning("Invoice status of '" + invoice.Status + "' is not acceptable. #" + invoice.Id);
+            _logger.LogWarning("Invoice status of '{InvoiceStatus}' is not acceptable. #{InvoiceId}", invoice.Status, invoice.Id);
             return new BadRequestResult();
         }
 
         if (invoice.Currency != "USD")
         {
             // Only process USD payments
-            _logger.LogWarning("Non USD payment received. #" + invoice.Id);
+            _logger.LogWarning("Non USD payment received. #{InvoiceId}", invoice.Id);
             return new OkResult();
         }
 

src/Billing/Jobs/SubscriptionCancellationJob.cs

@@ -23,9 +23,9 @@ public class SubscriptionCancellationJob(
         }
 
         var subscription = await stripeFacade.GetSubscription(subscriptionId);
-        if (subscription?.Status != "unpaid")
+        if (subscription?.Status != "unpaid" ||
+            subscription.LatestInvoice?.BillingReason is not ("subscription_cycle" or "subscription_create"))
         {
-            // Subscription is no longer unpaid, skip cancellation
             return;
         }
 

src/Billing/Services/Implementations/PaymentSucceededHandler.cs

@@ -2,6 +2,7 @@
 using Bit.Core.AdminConsole.OrganizationFeatures.Organizations.Interfaces;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Billing.Enums;
+using Bit.Core.Billing.Pricing;
 using Bit.Core.Context;
 using Bit.Core.Platform.Push;
 using Bit.Core.Repositories;
@@ -9,7 +10,6 @@ using Bit.Core.Services;
 using Bit.Core.Tools.Enums;
 using Bit.Core.Tools.Models.Business;
 using Bit.Core.Tools.Services;
-using Bit.Core.Utilities;
 using Event = Stripe.Event;
 
 namespace Bit.Billing.Services.Implementations;
@@ -28,6 +28,7 @@ public class PaymentSucceededHandler : IPaymentSucceededHandler
     private readonly IStripeEventUtilityService _stripeEventUtilityService;
     private readonly IPushNotificationService _pushNotificationService;
     private readonly IOrganizationEnableCommand _organizationEnableCommand;
+    private readonly IPricingClient _pricingClient;
 
     public PaymentSucceededHandler(
         ILogger<PaymentSucceededHandler> logger,
@@ -41,7 +42,8 @@ public class PaymentSucceededHandler : IPaymentSucceededHandler
         IStripeEventUtilityService stripeEventUtilityService,
         IUserService userService,
         IPushNotificationService pushNotificationService,
-        IOrganizationEnableCommand organizationEnableCommand)
+        IOrganizationEnableCommand organizationEnableCommand,
+        IPricingClient pricingClient)
     {
         _logger = logger;
         _stripeEventService = stripeEventService;
@@ -55,6 +57,7 @@ public class PaymentSucceededHandler : IPaymentSucceededHandler
         _userService = userService;
         _pushNotificationService = pushNotificationService;
         _organizationEnableCommand = organizationEnableCommand;
+        _pricingClient = pricingClient;
     }
 
     /// <summary>
@@ -96,9 +99,9 @@ public class PaymentSucceededHandler : IPaymentSucceededHandler
                 return;
             }
 
-            var teamsMonthly = StaticStore.GetPlan(PlanType.TeamsMonthly);
+            var teamsMonthly = await _pricingClient.GetPlanOrThrow(PlanType.TeamsMonthly);
 
-            var enterpriseMonthly = StaticStore.GetPlan(PlanType.EnterpriseMonthly);
+            var enterpriseMonthly = await _pricingClient.GetPlanOrThrow(PlanType.EnterpriseMonthly);
 
             var teamsMonthlyLineItem =
                 subscription.Items.Data.FirstOrDefault(item =>
@@ -137,14 +140,21 @@ public class PaymentSucceededHandler : IPaymentSucceededHandler
         }
         else if (organizationId.HasValue)
         {
-            if (!subscription.Items.Any(i =>
+            var organization = await _organizationRepository.GetByIdAsync(organizationId.Value);
-                    StaticStore.Plans.Any(p => p.PasswordManager.StripePlanId == i.Plan.Id)))
+
+            if (organization == null)
+            {
+                return;
+            }
+
+            var plan = await _pricingClient.GetPlanOrThrow(organization.PlanType);
+
+            if (subscription.Items.All(item => plan.PasswordManager.StripePlanId != item.Plan.Id))
             {
                 return;
             }
 
             await _organizationEnableCommand.EnableAsync(organizationId.Value, subscription.CurrentPeriodEnd);
-            var organization = await _organizationRepository.GetByIdAsync(organizationId.Value);
             await _pushNotificationService.PushSyncOrganizationStatusAsync(organization);
 
             await _referenceEventService.RaiseEventAsync(

src/Billing/Services/Implementations/ProviderEventService.cs

@@ -1,15 +1,17 @@
 using Bit.Billing.Constants;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Billing.Entities;
+using Bit.Core.Billing.Pricing;
 using Bit.Core.Billing.Repositories;
 using Bit.Core.Enums;
-using Bit.Core.Utilities;
+using Bit.Core.Repositories;
 using Stripe;
 
 namespace Bit.Billing.Services.Implementations;
 
 public class ProviderEventService(
-    ILogger<ProviderEventService> logger,
+    IOrganizationRepository organizationRepository,
+    IPricingClient pricingClient,
     IProviderInvoiceItemRepository providerInvoiceItemRepository,
     IProviderOrganizationRepository providerOrganizationRepository,
     IProviderPlanRepository providerPlanRepository,
@@ -54,7 +56,14 @@ public class ProviderEventService(
                             continue;
                         }
 
-                        var plan = StaticStore.Plans.Single(x => x.Name == client.Plan && providerPlans.Any(y => y.PlanType == x.Type));
+                        var organization = await organizationRepository.GetByIdAsync(client.OrganizationId);
+
+                        if (organization == null)
+                        {
+                            return;
+                        }
+
+                        var plan = await pricingClient.GetPlanOrThrow(organization.PlanType);
 
                         var discountedPercentage = (100 - (invoice.Discount?.Coupon?.PercentOff ?? 0)) / 100;
 
@@ -76,7 +85,7 @@ public class ProviderEventService(
 
                     foreach (var providerPlan in providerPlans.Where(x => x.PurchasedSeats is null or 0))
                     {
-                        var plan = StaticStore.GetPlan(providerPlan.PlanType);
+                        var plan = await pricingClient.GetPlanOrThrow(providerPlan.PlanType);
 
                         var clientSeats = invoiceItems
                             .Where(item => item.PlanName == plan.Name)

src/Billing/Services/Implementations/SubscriptionDeletedHandler.cs

@@ -1,4 +1,5 @@
 using Bit.Billing.Constants;
+using Bit.Core.AdminConsole.OrganizationFeatures.Organizations.Interfaces;
 using Bit.Core.Services;
 using Event = Stripe.Event;
 namespace Bit.Billing.Services.Implementations;
@@ -6,20 +7,20 @@ namespace Bit.Billing.Services.Implementations;
 public class SubscriptionDeletedHandler : ISubscriptionDeletedHandler
 {
     private readonly IStripeEventService _stripeEventService;
-    private readonly IOrganizationService _organizationService;
     private readonly IUserService _userService;
     private readonly IStripeEventUtilityService _stripeEventUtilityService;
+    private readonly IOrganizationDisableCommand _organizationDisableCommand;
 
     public SubscriptionDeletedHandler(
         IStripeEventService stripeEventService,
-        IOrganizationService organizationService,
         IUserService userService,
-        IStripeEventUtilityService stripeEventUtilityService)
+        IStripeEventUtilityService stripeEventUtilityService,
+        IOrganizationDisableCommand organizationDisableCommand)
     {
         _stripeEventService = stripeEventService;
-        _organizationService = organizationService;
         _userService = userService;
         _stripeEventUtilityService = stripeEventUtilityService;
+        _organizationDisableCommand = organizationDisableCommand;
     }
 
     /// <summary>
@@ -33,15 +34,23 @@ public class SubscriptionDeletedHandler : ISubscriptionDeletedHandler
         var subCanceled = subscription.Status == StripeSubscriptionStatus.Canceled;
 
         const string providerMigrationCancellationComment = "Cancelled as part of provider migration to Consolidated Billing";
+        const string addedToProviderCancellationComment = "Organization was added to Provider";
 
         if (!subCanceled)
         {
             return;
         }
 
-        if (organizationId.HasValue && subscription is not { CancellationDetails.Comment: providerMigrationCancellationComment })
+        if (organizationId.HasValue)
         {
-            await _organizationService.DisableAsync(organizationId.Value, subscription.CurrentPeriodEnd);
+            if (!string.IsNullOrEmpty(subscription.CancellationDetails?.Comment) &&
+                (subscription.CancellationDetails.Comment == providerMigrationCancellationComment ||
+                 subscription.CancellationDetails.Comment.Contains(addedToProviderCancellationComment)))
+            {
+                return;
+            }
+
+            await _organizationDisableCommand.DisableAsync(organizationId.Value, subscription.CurrentPeriodEnd);
         }
         else if (userId.HasValue)
         {

src/Billing/Services/Implementations/SubscriptionUpdatedHandler.cs

@@ -2,11 +2,11 @@
 using Bit.Billing.Jobs;
 using Bit.Core;
 using Bit.Core.AdminConsole.OrganizationFeatures.Organizations.Interfaces;
+using Bit.Core.Billing.Pricing;
 using Bit.Core.OrganizationFeatures.OrganizationSponsorships.FamiliesForEnterprise.Interfaces;
 using Bit.Core.Platform.Push;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
-using Bit.Core.Utilities;
 using Quartz;
 using Stripe;
 using Event = Stripe.Event;
@@ -26,6 +26,8 @@ public class SubscriptionUpdatedHandler : ISubscriptionUpdatedHandler
     private readonly ISchedulerFactory _schedulerFactory;
     private readonly IFeatureService _featureService;
     private readonly IOrganizationEnableCommand _organizationEnableCommand;
+    private readonly IOrganizationDisableCommand _organizationDisableCommand;
+    private readonly IPricingClient _pricingClient;
 
     public SubscriptionUpdatedHandler(
         IStripeEventService stripeEventService,
@@ -38,7 +40,9 @@ public class SubscriptionUpdatedHandler : ISubscriptionUpdatedHandler
         IOrganizationRepository organizationRepository,
         ISchedulerFactory schedulerFactory,
         IFeatureService featureService,
-        IOrganizationEnableCommand organizationEnableCommand)
+        IOrganizationEnableCommand organizationEnableCommand,
+        IOrganizationDisableCommand organizationDisableCommand,
+        IPricingClient pricingClient)
     {
         _stripeEventService = stripeEventService;
         _stripeEventUtilityService = stripeEventUtilityService;
@@ -51,6 +55,8 @@ public class SubscriptionUpdatedHandler : ISubscriptionUpdatedHandler
         _schedulerFactory = schedulerFactory;
         _featureService = featureService;
         _organizationEnableCommand = organizationEnableCommand;
+        _organizationDisableCommand = organizationDisableCommand;
+        _pricingClient = pricingClient;
     }
 
     /// <summary>
@@ -59,7 +65,7 @@ public class SubscriptionUpdatedHandler : ISubscriptionUpdatedHandler
     /// <param name="parsedEvent"></param>
     public async Task HandleAsync(Event parsedEvent)
     {
-        var subscription = await _stripeEventService.GetSubscription(parsedEvent, true, ["customer", "discounts"]);
+        var subscription = await _stripeEventService.GetSubscription(parsedEvent, true, ["customer", "discounts", "latest_invoice"]);
         var (organizationId, userId, providerId) = _stripeEventUtilityService.GetIdsFromMetadata(subscription.Metadata);
 
         switch (subscription.Status)
@@ -67,8 +73,9 @@ public class SubscriptionUpdatedHandler : ISubscriptionUpdatedHandler
             case StripeSubscriptionStatus.Unpaid or StripeSubscriptionStatus.IncompleteExpired
                 when organizationId.HasValue:
                 {
-                    await _organizationService.DisableAsync(organizationId.Value, subscription.CurrentPeriodEnd);
+                    await _organizationDisableCommand.DisableAsync(organizationId.Value, subscription.CurrentPeriodEnd);
-                    if (subscription.Status == StripeSubscriptionStatus.Unpaid)
+                    if (subscription.Status == StripeSubscriptionStatus.Unpaid &&
+                        subscription.LatestInvoice is { BillingReason: "subscription_cycle" or "subscription_create" })
                     {
                         await ScheduleCancellationJobAsync(subscription.Id, organizationId.Value);
                     }
@@ -96,7 +103,10 @@ public class SubscriptionUpdatedHandler : ISubscriptionUpdatedHandler
                 {
                     await _organizationEnableCommand.EnableAsync(organizationId.Value);
                     var organization = await _organizationRepository.GetByIdAsync(organizationId.Value);
+                    if (organization != null)
+                    {
                         await _pushNotificationService.PushSyncOrganizationStatusAsync(organization);
+                    }
                     break;
                 }
             case StripeSubscriptionStatus.Active:
@@ -149,7 +159,8 @@ public class SubscriptionUpdatedHandler : ISubscriptionUpdatedHandler
     /// </summary>
     /// <param name="parsedEvent"></param>
     /// <param name="subscription"></param>
-    private async Task RemovePasswordManagerCouponIfRemovingSecretsManagerTrialAsync(Event parsedEvent,
+    private async Task RemovePasswordManagerCouponIfRemovingSecretsManagerTrialAsync(
+        Event parsedEvent,
         Subscription subscription)
     {
         if (parsedEvent.Data.PreviousAttributes?.items is null)
@@ -157,6 +168,22 @@ public class SubscriptionUpdatedHandler : ISubscriptionUpdatedHandler
             return;
         }
 
+        var organization = subscription.Metadata.TryGetValue("organizationId", out var organizationId)
+            ? await _organizationRepository.GetByIdAsync(Guid.Parse(organizationId))
+            : null;
+
+        if (organization == null)
+        {
+            return;
+        }
+
+        var plan = await _pricingClient.GetPlanOrThrow(organization.PlanType);
+
+        if (!plan.SupportsSecretsManager)
+        {
+            return;
+        }
+
         var previousSubscription = parsedEvent.Data
             .PreviousAttributes
             .ToObject<Subscription>() as Subscription;
@@ -164,17 +191,14 @@ public class SubscriptionUpdatedHandler : ISubscriptionUpdatedHandler
         // This being false doesn't necessarily mean that the organization doesn't subscribe to Secrets Manager.
         // If there are changes to any subscription item, Stripe sends every item in the subscription, both
         // changed and unchanged.
-        var previousSubscriptionHasSecretsManager = previousSubscription?.Items is not null &&
+        var previousSubscriptionHasSecretsManager =
-                                                    previousSubscription.Items.Any(previousItem =>
+            previousSubscription?.Items is not null &&
-                                                        StaticStore.Plans.Any(p =>
+            previousSubscription.Items.Any(
-                                                            p.SecretsManager is not null &&
+                previousSubscriptionItem => previousSubscriptionItem.Plan.Id == plan.SecretsManager.StripeSeatPlanId);
-                                                            p.SecretsManager.StripeSeatPlanId ==
-                                                            previousItem.Plan.Id));
 
-        var currentSubscriptionHasSecretsManager = subscription.Items.Any(i =>
+        var currentSubscriptionHasSecretsManager =
-            StaticStore.Plans.Any(p =>
+            subscription.Items.Any(
-                p.SecretsManager is not null &&
+                currentSubscriptionItem => currentSubscriptionItem.Plan.Id == plan.SecretsManager.StripeSeatPlanId);
-                p.SecretsManager.StripeSeatPlanId == i.Plan.Id));
 
         if (!previousSubscriptionHasSecretsManager || currentSubscriptionHasSecretsManager)
         {
@@ -204,9 +228,11 @@ public class SubscriptionUpdatedHandler : ISubscriptionUpdatedHandler
     private async Task ScheduleCancellationJobAsync(string subscriptionId, Guid organizationId)
     {
         var isResellerManagedOrgAlertEnabled = _featureService.IsEnabled(FeatureFlagKeys.ResellerManagedOrgAlert);
-
+        if (!isResellerManagedOrgAlertEnabled)
-        if (isResellerManagedOrgAlertEnabled)
         {
+            return;
+        }
+
         var scheduler = await _schedulerFactory.GetScheduler();
 
         var job = JobBuilder.Create<SubscriptionCancellationJob>()
@@ -223,4 +249,3 @@ public class SubscriptionUpdatedHandler : ISubscriptionUpdatedHandler
         await scheduler.ScheduleJob(job, trigger);
     }
 }
-}

src/Billing/Services/Implementations/UpcomingInvoiceHandler.cs

@@ -1,103 +1,79 @@
-using Bit.Billing.Constants;
+using Bit.Core.AdminConsole.Repositories;
-using Bit.Core.AdminConsole.Entities;
+using Bit.Core.Billing.Constants;
-using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.Billing.Enums;
+using Bit.Core.Billing.Extensions;
+using Bit.Core.Billing.Pricing;
 using Bit.Core.OrganizationFeatures.OrganizationSponsorships.FamiliesForEnterprise.Interfaces;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
-using Bit.Core.Utilities;
 using Stripe;
 using Event = Stripe.Event;
 
 namespace Bit.Billing.Services.Implementations;
 
-public class UpcomingInvoiceHandler : IUpcomingInvoiceHandler
+public class UpcomingInvoiceHandler(
-{
-    private readonly ILogger<StripeEventProcessor> _logger;
-    private readonly IStripeEventService _stripeEventService;
-    private readonly IUserService _userService;
-    private readonly IStripeFacade _stripeFacade;
-    private readonly IMailService _mailService;
-    private readonly IProviderRepository _providerRepository;
-    private readonly IValidateSponsorshipCommand _validateSponsorshipCommand;
-    private readonly IOrganizationRepository _organizationRepository;
-    private readonly IStripeEventUtilityService _stripeEventUtilityService;
-
-    public UpcomingInvoiceHandler(
     ILogger<StripeEventProcessor> logger,
-        IStripeEventService stripeEventService,
-        IUserService userService,
-        IStripeFacade stripeFacade,
     IMailService mailService,
-        IProviderRepository providerRepository,
-        IValidateSponsorshipCommand validateSponsorshipCommand,
     IOrganizationRepository organizationRepository,
-        IStripeEventUtilityService stripeEventUtilityService)
+    IPricingClient pricingClient,
+    IProviderRepository providerRepository,
+    IStripeFacade stripeFacade,
+    IStripeEventService stripeEventService,
+    IStripeEventUtilityService stripeEventUtilityService,
+    IUserRepository userRepository,
+    IValidateSponsorshipCommand validateSponsorshipCommand)
+    : IUpcomingInvoiceHandler
 {
-        _logger = logger;
-        _stripeEventService = stripeEventService;
-        _userService = userService;
-        _stripeFacade = stripeFacade;
-        _mailService = mailService;
-        _providerRepository = providerRepository;
-        _validateSponsorshipCommand = validateSponsorshipCommand;
-        _organizationRepository = organizationRepository;
-        _stripeEventUtilityService = stripeEventUtilityService;
-    }
-
-    /// <summary>
-    /// Handles the <see cref="HandledStripeWebhook.UpcomingInvoice"/> event type from Stripe.
-    /// </summary>
-    /// <param name="parsedEvent"></param>
-    /// <exception cref="Exception"></exception>
     public async Task HandleAsync(Event parsedEvent)
     {
-        var invoice = await _stripeEventService.GetInvoice(parsedEvent);
+        var invoice = await stripeEventService.GetInvoice(parsedEvent);
+
         if (string.IsNullOrEmpty(invoice.SubscriptionId))
         {
-            _logger.LogWarning("Received 'invoice.upcoming' Event with ID '{eventId}' that did not include a Subscription ID", parsedEvent.Id);
+            logger.LogInformation("Received 'invoice.upcoming' Event with ID '{eventId}' that did not include a Subscription ID", parsedEvent.Id);
             return;
         }
 
-        var subscription = await _stripeFacade.GetSubscription(invoice.SubscriptionId);
+        var subscription = await stripeFacade.GetSubscription(invoice.SubscriptionId, new SubscriptionGetOptions
-
-        if (subscription == null)
         {
-            throw new Exception(
+            Expand = ["customer.tax", "customer.tax_ids"]
-                $"Received null Subscription from Stripe for ID '{invoice.SubscriptionId}' while processing Event with ID '{parsedEvent.Id}'");
+        });
-        }
 
-        var updatedSubscription = await TryEnableAutomaticTaxAsync(subscription);
+        var (organizationId, userId, providerId) = stripeEventUtilityService.GetIdsFromMetadata(subscription.Metadata);
-
-        var (organizationId, userId, providerId) = _stripeEventUtilityService.GetIdsFromMetadata(updatedSubscription.Metadata);
-
-        var invoiceLineItemDescriptions = invoice.Lines.Select(i => i.Description).ToList();
 
         if (organizationId.HasValue)
         {
-            if (_stripeEventUtilityService.IsSponsoredSubscription(updatedSubscription))
+            var organization = await organizationRepository.GetByIdAsync(organizationId.Value);
-            {
-                var sponsorshipIsValid =
-                    await _validateSponsorshipCommand.ValidateSponsorshipAsync(organizationId.Value);
-                if (!sponsorshipIsValid)
-                {
-                    // If the sponsorship is invalid, then the subscription was updated to use the regular families plan
-                    // price. Given that this is the case, we need the new invoice amount
-                    subscription = await _stripeFacade.GetSubscription(subscription.Id,
-                        new SubscriptionGetOptions { Expand = ["latest_invoice"] });
 
-                    invoice = subscription.LatestInvoice;
+            if (organization == null)
-                    invoiceLineItemDescriptions = invoice.Lines.Select(i => i.Description).ToList();
-                }
-            }
-
-            var organization = await _organizationRepository.GetByIdAsync(organizationId.Value);
-
-            if (organization == null || !OrgPlanForInvoiceNotifications(organization))
             {
                 return;
             }
 
-            await SendEmails(new List<string> { organization.BillingEmail });
+            await TryEnableAutomaticTaxAsync(subscription);
+
+            var plan = await pricingClient.GetPlanOrThrow(organization.PlanType);
+
+            if (!plan.IsAnnual)
+            {
+                return;
+            }
+
+            if (stripeEventUtilityService.IsSponsoredSubscription(subscription))
+            {
+                var sponsorshipIsValid = await validateSponsorshipCommand.ValidateSponsorshipAsync(organizationId.Value);
+
+                if (!sponsorshipIsValid)
+                {
+                    /*
+                     * If the sponsorship is invalid, then the subscription was updated to use the regular families plan
+                     * price. Given that this is the case, we need the new invoice amount
+                     */
+                    invoice = await stripeFacade.GetInvoice(subscription.LatestInvoiceId);
+                }
+            }
+
+            await SendUpcomingInvoiceEmailsAsync(new List<string> { organization.BillingEmail }, invoice);
 
             /*
              * TODO: https://bitwarden.atlassian.net/browse/PM-4862
@@ -112,66 +88,81 @@ public class UpcomingInvoiceHandler : IUpcomingInvoiceHandler
         }
         else if (userId.HasValue)
         {
-            var user = await _userService.GetUserByIdAsync(userId.Value);
+            var user = await userRepository.GetByIdAsync(userId.Value);
 
-            if (user?.Premium == true)
+            if (user == null)
             {
-                await SendEmails(new List<string> { user.Email });
+                return;
+            }
+
+            await TryEnableAutomaticTaxAsync(subscription);
+
+            if (user.Premium)
+            {
+                await SendUpcomingInvoiceEmailsAsync(new List<string> { user.Email }, invoice);
             }
         }
         else if (providerId.HasValue)
         {
-            var provider = await _providerRepository.GetByIdAsync(providerId.Value);
+            var provider = await providerRepository.GetByIdAsync(providerId.Value);
 
             if (provider == null)
             {
-                _logger.LogError(
-                    "Received invoice.Upcoming webhook ({EventID}) for Provider ({ProviderID}) that does not exist",
-                    parsedEvent.Id,
-                    providerId.Value);
-
                 return;
             }
 
-            await SendEmails(new List<string> { provider.BillingEmail });
+            await TryEnableAutomaticTaxAsync(subscription);
 
+            await SendUpcomingInvoiceEmailsAsync(new List<string> { provider.BillingEmail }, invoice);
+        }
     }
 
-        return;
+    private async Task SendUpcomingInvoiceEmailsAsync(IEnumerable<string> emails, Invoice invoice)
-
-        /*
-         * Sends emails to the given email addresses.
-         */
-        async Task SendEmails(IEnumerable<string> emails)
     {
         var validEmails = emails.Where(e => !string.IsNullOrEmpty(e));
 
+        var items = invoice.Lines.Select(i => i.Description).ToList();
+
         if (invoice.NextPaymentAttempt.HasValue && invoice.AmountDue > 0)
         {
-                await _mailService.SendInvoiceUpcoming(
+            await mailService.SendInvoiceUpcoming(
                 validEmails,
                 invoice.AmountDue / 100M,
                 invoice.NextPaymentAttempt.Value,
-                    invoiceLineItemDescriptions,
+                items,
                 true);
         }
     }
+
+    private async Task TryEnableAutomaticTaxAsync(Subscription subscription)
+    {
+        if (subscription.AutomaticTax.Enabled ||
+            !subscription.Customer.HasBillingLocation() ||
+            await IsNonTaxableNonUSBusinessUseSubscription(subscription))
+        {
+            return;
         }
 
-    private async Task<Subscription> TryEnableAutomaticTaxAsync(Subscription subscription)
+        await stripeFacade.UpdateSubscription(subscription.Id,
-    {
+            new SubscriptionUpdateOptions
-        if (subscription.AutomaticTax.Enabled)
-        {
-            return subscription;
-        }
-
-        var subscriptionUpdateOptions = new SubscriptionUpdateOptions
             {
+                DefaultTaxRates = [],
                 AutomaticTax = new SubscriptionAutomaticTaxOptions { Enabled = true }
-        };
+            });
 
-        return await _stripeFacade.UpdateSubscription(subscription.Id, subscriptionUpdateOptions);
+        return;
-    }
 
-    private static bool OrgPlanForInvoiceNotifications(Organization org) => StaticStore.GetPlan(org.PlanType).IsAnnual;
+        async Task<bool> IsNonTaxableNonUSBusinessUseSubscription(Subscription localSubscription)
+        {
+            var familyPriceIds = (await Task.WhenAll(
+                    pricingClient.GetPlanOrThrow(PlanType.FamiliesAnnually2019),
+                    pricingClient.GetPlanOrThrow(PlanType.FamiliesAnnually)))
+                .Select(plan => plan.PasswordManager.StripePlanId);
+
+            return localSubscription.Customer.Address.Country != "US" &&
+                   localSubscription.Metadata.ContainsKey(StripeConstants.MetadataKeys.OrganizationId) &&
+                   !localSubscription.Items.Select(item => item.Price.Id).Intersect(familyPriceIds).Any() &&
+                   !localSubscription.Customer.TaxIds.Any();
+        }
+    }
 }

src/Core/AdminConsole/Entities/Provider/Provider.cs

@@ -35,6 +35,7 @@ public class Provider : ITableObject<Guid>, ISubscriber
     public GatewayType? Gateway { get; set; }
     public string? GatewayCustomerId { get; set; }
     public string? GatewaySubscriptionId { get; set; }
+    public string? DiscountId { get; set; }
 
     public string? BillingEmailAddress() => BillingEmail?.ToLowerInvariant().Trim();
 

src/Core/AdminConsole/Enums/PolicyType.cs

@@ -15,7 +15,8 @@ public enum PolicyType : byte
     DisablePersonalVaultExport = 10,
     ActivateAutofill = 11,
     AutomaticAppLogIn = 12,
-    FreeFamiliesSponsorshipPolicy = 13
+    FreeFamiliesSponsorshipPolicy = 13,
+    RemoveUnlockWithPin = 14,
 }
 
 public static class PolicyTypeExtensions
@@ -41,7 +42,8 @@ public static class PolicyTypeExtensions
             PolicyType.DisablePersonalVaultExport => "Remove individual vault export",
             PolicyType.ActivateAutofill => "Active auto-fill",
             PolicyType.AutomaticAppLogIn => "Automatically log in users for allowed applications",
-            PolicyType.FreeFamiliesSponsorshipPolicy => "Remove Free Bitwarden Families sponsorship"
+            PolicyType.FreeFamiliesSponsorshipPolicy => "Remove Free Bitwarden Families sponsorship",
+            PolicyType.RemoveUnlockWithPin => "Remove unlock with PIN"
         };
     }
 }

src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/UpdateOrganizationUserCommand.cs

@@ -2,6 +2,7 @@
 using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Billing.Enums;
+using Bit.Core.Billing.Pricing;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;
@@ -24,6 +25,7 @@ public class UpdateOrganizationUserCommand : IUpdateOrganizationUserCommand
     private readonly ICollectionRepository _collectionRepository;
     private readonly IGroupRepository _groupRepository;
     private readonly IHasConfirmedOwnersExceptQuery _hasConfirmedOwnersExceptQuery;
+    private readonly IPricingClient _pricingClient;
 
     public UpdateOrganizationUserCommand(
         IEventService eventService,
@@ -34,7 +36,8 @@ public class UpdateOrganizationUserCommand : IUpdateOrganizationUserCommand
         IUpdateSecretsManagerSubscriptionCommand updateSecretsManagerSubscriptionCommand,
         ICollectionRepository collectionRepository,
         IGroupRepository groupRepository,
-        IHasConfirmedOwnersExceptQuery hasConfirmedOwnersExceptQuery)
+        IHasConfirmedOwnersExceptQuery hasConfirmedOwnersExceptQuery,
+        IPricingClient pricingClient)
     {
         _eventService = eventService;
         _organizationService = organizationService;
@@ -45,6 +48,7 @@ public class UpdateOrganizationUserCommand : IUpdateOrganizationUserCommand
         _collectionRepository = collectionRepository;
         _groupRepository = groupRepository;
         _hasConfirmedOwnersExceptQuery = hasConfirmedOwnersExceptQuery;
+        _pricingClient = pricingClient;
     }
 
     /// <summary>
@@ -59,10 +63,10 @@ public class UpdateOrganizationUserCommand : IUpdateOrganizationUserCommand
         List<CollectionAccessSelection>? collectionAccess, IEnumerable<Guid>? groupAccess)
     {
         // Avoid multiple enumeration
-        collectionAccess = collectionAccess?.ToList();
+        var collectionAccessList = collectionAccess?.ToList() ?? [];
         groupAccess = groupAccess?.ToList();
 
-        if (organizationUser.Id.Equals(default(Guid)))
+        if (organizationUser.Id.Equals(Guid.Empty))
         {
             throw new BadRequestException("Invite the user first.");
         }
@@ -89,9 +93,9 @@ public class UpdateOrganizationUserCommand : IUpdateOrganizationUserCommand
             }
         }
 
-        if (collectionAccess?.Any() == true)
+        if (collectionAccessList.Count != 0)
         {
-            await ValidateCollectionAccessAsync(originalOrganizationUser, collectionAccess.ToList());
+            await ValidateCollectionAccessAsync(originalOrganizationUser, collectionAccessList);
         }
 
         if (groupAccess?.Any() == true)
@@ -107,14 +111,15 @@ public class UpdateOrganizationUserCommand : IUpdateOrganizationUserCommand
         await _organizationService.ValidateOrganizationCustomPermissionsEnabledAsync(organizationUser.OrganizationId, organizationUser.Type);
 
         if (organizationUser.Type != OrganizationUserType.Owner &&
-            !await _hasConfirmedOwnersExceptQuery.HasConfirmedOwnersExceptAsync(organizationUser.OrganizationId, new[] { organizationUser.Id }))
+            !await _hasConfirmedOwnersExceptQuery.HasConfirmedOwnersExceptAsync(organizationUser.OrganizationId,
+                [organizationUser.Id]))
         {
             throw new BadRequestException("Organization must have at least one confirmed owner.");
         }
 
-        if (collectionAccess?.Count > 0)
+        if (collectionAccessList.Count > 0)
         {
-            var invalidAssociations = collectionAccess.Where(cas => cas.Manage && (cas.ReadOnly || cas.HidePasswords));
+            var invalidAssociations = collectionAccessList.Where(cas => cas.Manage && (cas.ReadOnly || cas.HidePasswords));
             if (invalidAssociations.Any())
             {
                 throw new BadRequestException("The Manage property is mutually exclusive and cannot be true while the ReadOnly or HidePasswords properties are also true.");
@@ -128,13 +133,15 @@ public class UpdateOrganizationUserCommand : IUpdateOrganizationUserCommand
             var additionalSmSeatsRequired = await _countNewSmSeatsRequiredQuery.CountNewSmSeatsRequiredAsync(organizationUser.OrganizationId, 1);
             if (additionalSmSeatsRequired > 0)
             {
-                var update = new SecretsManagerSubscriptionUpdate(organization, true)
+                // TODO: https://bitwarden.atlassian.net/browse/PM-17012
+                var plan = await _pricingClient.GetPlanOrThrow(organization.PlanType);
+                var update = new SecretsManagerSubscriptionUpdate(organization, plan, true)
                     .AdjustSeats(additionalSmSeatsRequired);
                 await _updateSecretsManagerSubscriptionCommand.UpdateSubscriptionAsync(update);
             }
         }
 
-        await _organizationUserRepository.ReplaceAsync(organizationUser, collectionAccess);
+        await _organizationUserRepository.ReplaceAsync(organizationUser, collectionAccessList);
 
         if (groupAccess != null)
         {

src/Core/AdminConsole/OrganizationFeatures/Organizations/CloudOrganizationSignUpCommand.cs

@@ -3,6 +3,7 @@ using Bit.Core.AdminConsole.Enums;
 using Bit.Core.AdminConsole.Services;
 using Bit.Core.Billing.Enums;
 using Bit.Core.Billing.Models.Sales;
+using Bit.Core.Billing.Pricing;
 using Bit.Core.Billing.Services;
 using Bit.Core.Context;
 using Bit.Core.Entities;
@@ -23,8 +24,7 @@ namespace Bit.Core.AdminConsole.OrganizationFeatures.Organizations;
 
 public record SignUpOrganizationResponse(
     Organization Organization,
-    OrganizationUser OrganizationUser,
+    OrganizationUser OrganizationUser);
-    Collection DefaultCollection);
 
 public interface ICloudOrganizationSignUpCommand
 {
@@ -33,7 +33,6 @@ public interface ICloudOrganizationSignUpCommand
 
 public class CloudOrganizationSignUpCommand(
     IOrganizationUserRepository organizationUserRepository,
-    IFeatureService featureService,
     IOrganizationBillingService organizationBillingService,
     IPaymentService paymentService,
     IPolicyService policyService,
@@ -45,11 +44,12 @@ public class CloudOrganizationSignUpCommand(
     IPushRegistrationService pushRegistrationService,
     IPushNotificationService pushNotificationService,
     ICollectionRepository collectionRepository,
-    IDeviceRepository deviceRepository) : ICloudOrganizationSignUpCommand
+    IDeviceRepository deviceRepository,
+    IPricingClient pricingClient) : ICloudOrganizationSignUpCommand
 {
     public async Task<SignUpOrganizationResponse> SignUpOrganizationAsync(OrganizationSignup signup)
     {
-        var plan = StaticStore.GetPlan(signup.Plan);
+        var plan = await pricingClient.GetPlanOrThrow(signup.Plan);
 
         ValidatePasswordManagerPlan(plan, signup);
 
@@ -142,7 +142,7 @@ public class CloudOrganizationSignUpCommand(
                 // TODO: add reference events for SmSeats and Service Accounts - see AC-1481
             });
 
-        return new SignUpOrganizationResponse(returnValue.organization, returnValue.organizationUser, returnValue.defaultCollection);
+        return new SignUpOrganizationResponse(returnValue.organization, returnValue.organizationUser);
     }
 
     public void ValidatePasswordManagerPlan(Plan plan, OrganizationUpgrade upgrade)

src/Core/AdminConsole/OrganizationFeatures/Organizations/Interfaces/IOrganizationDeleteCommand.cs

@@ -1,4 +1,5 @@
 using Bit.Core.AdminConsole.Entities;
+using Bit.Core.Exceptions;
 
 namespace Bit.Core.AdminConsole.OrganizationFeatures.Organizations.Interfaces;
 

src/Core/AdminConsole/OrganizationFeatures/Organizations/Interfaces/IOrganizationDisableCommand.cs

@@ -0,0 +1,14 @@
+namespace Bit.Core.AdminConsole.OrganizationFeatures.Organizations.Interfaces;
+
+/// <summary>
+/// Command interface for disabling organizations.
+/// </summary>
+public interface IOrganizationDisableCommand
+{
+    /// <summary>
+    /// Disables an organization with an optional expiration date.
+    /// </summary>
+    /// <param name="organizationId">The unique identifier of the organization to disable.</param>
+    /// <param name="expirationDate">Optional date when the disable status should expire.</param>
+    Task DisableAsync(Guid organizationId, DateTime? expirationDate);
+}

src/Core/AdminConsole/OrganizationFeatures/Organizations/Interfaces/IOrganizationInitiateDeleteCommand.cs

@@ -1,4 +1,5 @@
 using Bit.Core.AdminConsole.Entities;
+using Bit.Core.Exceptions;
 
 namespace Bit.Core.AdminConsole.OrganizationFeatures.Organizations.Interfaces;
 

src/Core/AdminConsole/OrganizationFeatures/Organizations/OrganizationDisableCommand.cs

@@ -0,0 +1,33 @@
+using Bit.Core.AdminConsole.OrganizationFeatures.Organizations.Interfaces;
+using Bit.Core.Repositories;
+using Bit.Core.Services;
+
+namespace Bit.Core.AdminConsole.OrganizationFeatures.Organizations;
+
+public class OrganizationDisableCommand : IOrganizationDisableCommand
+{
+    private readonly IOrganizationRepository _organizationRepository;
+    private readonly IApplicationCacheService _applicationCacheService;
+
+    public OrganizationDisableCommand(
+        IOrganizationRepository organizationRepository,
+        IApplicationCacheService applicationCacheService)
+    {
+        _organizationRepository = organizationRepository;
+        _applicationCacheService = applicationCacheService;
+    }
+
+    public async Task DisableAsync(Guid organizationId, DateTime? expirationDate)
+    {
+        var organization = await _organizationRepository.GetByIdAsync(organizationId);
+        if (organization is { Enabled: true })
+        {
+            organization.Enabled = false;
+            organization.ExpirationDate = expirationDate;
+            organization.RevisionDate = DateTime.UtcNow;
+
+            await _organizationRepository.ReplaceAsync(organization);
+            await _applicationCacheService.UpsertOrganizationAbilityAsync(organization);
+        }
+    }
+}

src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyRequirements/SendPolicyRequirement.cs

@@ -0,0 +1,54 @@
+using Bit.Core.AdminConsole.Enums;
+using Bit.Core.AdminConsole.Models.Data.Organizations.Policies;
+using Bit.Core.Enums;
+
+namespace Bit.Core.AdminConsole.OrganizationFeatures.Policies.PolicyRequirements;
+
+/// <summary>
+/// Policy requirements for the Disable Send and Send Options policies.
+/// </summary>
+public class SendPolicyRequirement : IPolicyRequirement
+{
+    /// <summary>
+    /// Indicates whether Send is disabled for the user. If true, the user should not be able to create or edit Sends.
+    /// They may still delete existing Sends.
+    /// </summary>
+    public bool DisableSend { get; init; }
+    /// <summary>
+    /// Indicates whether the user is prohibited from hiding their email from the recipient of a Send.
+    /// </summary>
+    public bool DisableHideEmail { get; init; }
+
+    /// <summary>
+    /// Create a new SendPolicyRequirement.
+    /// </summary>
+    /// <param name="policyDetails">All PolicyDetails relating to the user.</param>
+    /// <remarks>
+    /// This is a <see cref="RequirementFactory{T}"/> for the SendPolicyRequirement.
+    /// </remarks>
+    public static SendPolicyRequirement Create(IEnumerable<PolicyDetails> policyDetails)
+    {
+        var filteredPolicies = policyDetails
+            .ExemptRoles([OrganizationUserType.Owner, OrganizationUserType.Admin])
+            .ExemptStatus([OrganizationUserStatusType.Invited, OrganizationUserStatusType.Revoked])
+            .ExemptProviders()
+            .ToList();
+
+        var result = filteredPolicies
+            .GetPolicyType(PolicyType.SendOptions)
+            .Select(p => p.GetDataModel<SendOptionsPolicyData>())
+            .Aggregate(
+                new SendPolicyRequirement
+                {
+                    // Set Disable Send requirement in the initial seed
+                    DisableSend = filteredPolicies.GetPolicyType(PolicyType.DisableSend).Any()
+                },
+                (result, data) => new SendPolicyRequirement
+                {
+                    DisableSend = result.DisableSend,
+                    DisableHideEmail = result.DisableHideEmail || data.DisableHideEmail
+                });
+
+        return result;
+    }
+}

src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyServiceCollectionExtensions.cs

@@ -32,6 +32,7 @@ public static class PolicyServiceCollectionExtensions
     private static void AddPolicyRequirements(this IServiceCollection services)
     {
         // Register policy requirement factories here
+        services.AddPolicyRequirement(SendPolicyRequirement.Create);
     }
 
     /// <summary>

src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyValidators/TwoFactorAuthenticationPolicyValidator.cs

@@ -73,6 +73,11 @@ public class TwoFactorAuthenticationPolicyValidator : IPolicyValidator
     {
         var organization = await _organizationRepository.GetByIdAsync(organizationId);
 
+        if (organization is null)
+        {
+            return;
+        }
+
         var currentActiveRevocableOrganizationUsers =
             (await _organizationUserRepository.GetManyDetailsByOrganizationAsync(organizationId))
             .Where(ou => ou.Status != OrganizationUserStatusType.Invited &&
@@ -90,9 +95,11 @@ public class TwoFactorAuthenticationPolicyValidator : IPolicyValidator
         var revocableUsersWithTwoFactorStatus =
             await _twoFactorIsEnabledQuery.TwoFactorIsEnabledAsync(currentActiveRevocableOrganizationUsers);
 
-        var nonCompliantUsers = revocableUsersWithTwoFactorStatus.Where(x => !x.twoFactorIsEnabled);
+        var nonCompliantUsers = revocableUsersWithTwoFactorStatus
+            .Where(x => !x.twoFactorIsEnabled)
+            .ToArray();
 
-        if (!nonCompliantUsers.Any())
+        if (nonCompliantUsers.Length == 0)
         {
             return;
         }

src/Core/AdminConsole/Services/IOrganizationService.cs

@@ -28,7 +28,6 @@ public interface IOrganizationService
     /// </summary>
     Task<(Organization organization, OrganizationUser organizationUser)> SignUpAsync(OrganizationLicense license, User owner,
         string ownerKey, string collectionName, string publicKey, string privateKey);
-    Task DisableAsync(Guid organizationId, DateTime? expirationDate);
     Task UpdateExpirationDateAsync(Guid organizationId, DateTime? expirationDate);
     Task UpdateAsync(Organization organization, bool updateBilling = false, EventType eventType = EventType.Organization_Updated);
     Task UpdateTwoFactorProviderAsync(Organization organization, TwoFactorProviderType type);

src/Core/AdminConsole/Services/Implementations/OrganizationService.cs

@@ -15,6 +15,7 @@ using Bit.Core.Auth.UserFeatures.TwoFactorAuth.Interfaces;
 using Bit.Core.Billing.Constants;
 using Bit.Core.Billing.Enums;
 using Bit.Core.Billing.Extensions;
+using Bit.Core.Billing.Pricing;
 using Bit.Core.Billing.Services;
 using Bit.Core.Context;
 using Bit.Core.Entities;
@@ -69,6 +70,7 @@ public class OrganizationService : IOrganizationService
     private readonly ITwoFactorIsEnabledQuery _twoFactorIsEnabledQuery;
     private readonly IOrganizationBillingService _organizationBillingService;
     private readonly IHasConfirmedOwnersExceptQuery _hasConfirmedOwnersExceptQuery;
+    private readonly IPricingClient _pricingClient;
     private readonly ISendOrganizationInvitesCommand _sendOrganizationInvitesCommand;
 
     public OrganizationService(
@@ -102,6 +104,7 @@ public class OrganizationService : IOrganizationService
         ITwoFactorIsEnabledQuery twoFactorIsEnabledQuery,
         IOrganizationBillingService organizationBillingService,
         IHasConfirmedOwnersExceptQuery hasConfirmedOwnersExceptQuery,
+        IPricingClient pricingClient,
         ISendOrganizationInvitesCommand sendOrganizationInvitesCommand)
     {
         _organizationRepository = organizationRepository;
@@ -134,6 +137,7 @@ public class OrganizationService : IOrganizationService
         _twoFactorIsEnabledQuery = twoFactorIsEnabledQuery;
         _organizationBillingService = organizationBillingService;
         _hasConfirmedOwnersExceptQuery = hasConfirmedOwnersExceptQuery;
+        _pricingClient = pricingClient;
         _sendOrganizationInvitesCommand = sendOrganizationInvitesCommand;
     }
 
@@ -202,11 +206,7 @@ public class OrganizationService : IOrganizationService
             throw new NotFoundException();
         }
 
-        var plan = StaticStore.Plans.FirstOrDefault(p => p.Type == organization.PlanType);
+        var plan = await _pricingClient.GetPlanOrThrow(organization.PlanType);
-        if (plan == null)
-        {
-            throw new BadRequestException("Existing plan not found.");
-        }
 
         if (!plan.PasswordManager.HasAdditionalStorageOption)
         {
@@ -260,7 +260,7 @@ public class OrganizationService : IOrganizationService
             throw new BadRequestException($"Cannot set max seat autoscaling below current seat count.");
         }
 
-        var plan = StaticStore.GetPlan(organization.PlanType);
+        var plan = await _pricingClient.GetPlanOrThrow(organization.PlanType);
         if (plan == null)
         {
             throw new BadRequestException("Existing plan not found.");
@@ -312,11 +312,7 @@ public class OrganizationService : IOrganizationService
             throw new BadRequestException("No subscription found.");
         }
 
-        var plan = StaticStore.Plans.FirstOrDefault(p => p.Type == organization.PlanType);
+        var plan = await _pricingClient.GetPlanOrThrow(organization.PlanType);
-        if (plan == null)
-        {
-            throw new BadRequestException("Existing plan not found.");
-        }
 
         if (!plan.PasswordManager.HasAdditionalSeatsOption)
         {
@@ -434,7 +430,7 @@ public class OrganizationService : IOrganizationService
 
     public async Task<(Organization organization, OrganizationUser organizationUser, Collection defaultCollection)> SignupClientAsync(OrganizationSignup signup)
     {
-        var plan = StaticStore.GetPlan(signup.Plan);
+        var plan = await _pricingClient.GetPlanOrThrow(signup.Plan);
 
         ValidatePlan(plan, signup.AdditionalSeats, "Password Manager");
 
@@ -522,17 +518,6 @@ public class OrganizationService : IOrganizationService
             throw new BadRequestException(exception);
         }
 
-        var plan = StaticStore.Plans.FirstOrDefault(p => p.Type == license.PlanType);
-        if (plan is null)
-        {
-            throw new BadRequestException($"Server must be updated to support {license.Plan}.");
-        }
-
-        if (license.PlanType != PlanType.Custom && plan.Disabled)
-        {
-            throw new BadRequestException($"Plan {plan.Name} is disabled.");
-        }
-
         var enabledOrgs = await _organizationRepository.GetManyByEnabledAsync();
         if (enabledOrgs.Any(o => string.Equals(o.LicenseKey, license.LicenseKey)))
         {
@@ -678,20 +663,6 @@ public class OrganizationService : IOrganizationService
         }
     }
 
-    public async Task DisableAsync(Guid organizationId, DateTime? expirationDate)
-    {
-        var org = await GetOrgById(organizationId);
-        if (org != null && org.Enabled)
-        {
-            org.Enabled = false;
-            org.ExpirationDate = expirationDate;
-            org.RevisionDate = DateTime.UtcNow;
-            await ReplaceAndUpdateCacheAsync(org);
-
-            // TODO: send email to owners?
-        }
-    }
-
     public async Task UpdateExpirationDateAsync(Guid organizationId, DateTime? expirationDate)
     {
         var org = await GetOrgById(organizationId);
@@ -888,7 +859,8 @@ public class OrganizationService : IOrganizationService
         var additionalSmSeatsRequired = await _countNewSmSeatsRequiredQuery.CountNewSmSeatsRequiredAsync(organization.Id, inviteWithSmAccessCount);
         if (additionalSmSeatsRequired > 0)
         {
-            smSubscriptionUpdate = new SecretsManagerSubscriptionUpdate(organization, true)
+            var plan = await _pricingClient.GetPlanOrThrow(organization.PlanType);
+            smSubscriptionUpdate = new SecretsManagerSubscriptionUpdate(organization, plan, true)
                 .AdjustSeats(additionalSmSeatsRequired);
         }
 
@@ -1014,7 +986,8 @@ public class OrganizationService : IOrganizationService
             if (initialSmSeatCount.HasValue && currentOrganization.SmSeats.HasValue &&
                 currentOrganization.SmSeats.Value != initialSmSeatCount.Value)
             {
-                var smSubscriptionUpdateRevert = new SecretsManagerSubscriptionUpdate(currentOrganization, false)
+                var plan = await _pricingClient.GetPlanOrThrow(currentOrganization.PlanType);
+                var smSubscriptionUpdateRevert = new SecretsManagerSubscriptionUpdate(currentOrganization, plan, false)
                 {
                     SmSeats = initialSmSeatCount.Value
                 };
@@ -2192,13 +2165,6 @@ public class OrganizationService : IOrganizationService
 
     public async Task CreatePendingOrganization(Organization organization, string ownerEmail, ClaimsPrincipal user, IUserService userService, bool salesAssistedTrialStarted)
     {
-        var plan = StaticStore.Plans.FirstOrDefault(p => p.Type == organization.PlanType);
-
-        if (plan!.Disabled)
-        {
-            throw new BadRequestException("Plan not found.");
-        }
-
         organization.Id = CoreHelpers.GenerateComb();
         organization.Enabled = false;
         organization.Status = OrganizationStatusType.Pending;

src/Core/Billing/Constants/StripeConstants.cs

@@ -18,8 +18,15 @@ public static class StripeConstants
 
     public static class CouponIDs
     {
-        public const string MSPDiscount35 = "msp-discount-35";
+        public const string LegacyMSPDiscount = "msp-discount-35";
         public const string SecretsManagerStandalone = "sm-standalone";
+
+        public static class MSPDiscounts
+        {
+            public const string Open = "msp-open-discount";
+            public const string Silver = "msp-silver-discount";
+            public const string Gold = "msp-gold-discount";
+        }
     }
 
     public static class ErrorCodes
@@ -34,6 +41,7 @@ public static class StripeConstants
     public static class InvoiceStatus
     {
         public const string Draft = "draft";
+        public const string Open = "open";
     }
 
     public static class MetadataKeys

src/Core/Billing/Extensions/BillingExtensions.cs

@@ -11,6 +11,17 @@ namespace Bit.Core.Billing.Extensions;
 
 public static class BillingExtensions
 {
+    public static ProductTierType GetProductTier(this PlanType planType)
+        => planType switch
+        {
+            PlanType.Custom or PlanType.Free => ProductTierType.Free,
+            PlanType.FamiliesAnnually or PlanType.FamiliesAnnually2019 => ProductTierType.Families,
+            PlanType.TeamsStarter or PlanType.TeamsStarter2023 => ProductTierType.TeamsStarter,
+            _ when planType.ToString().Contains("Teams") => ProductTierType.Teams,
+            _ when planType.ToString().Contains("Enterprise") => ProductTierType.Enterprise,
+            _ => throw new BillingException($"PlanType {planType} could not be matched to a ProductTierType")
+        };
+
     public static bool IsBillable(this Provider provider) =>
         provider is
         {

src/Core/Billing/Extensions/CustomerExtensions.cs

@@ -0,0 +1,25 @@
+using Bit.Core.Billing.Constants;
+using Stripe;
+
+namespace Bit.Core.Billing.Extensions;
+
+public static class CustomerExtensions
+{
+    public static bool HasBillingLocation(this Customer customer)
+        => customer is
+        {
+            Address:
+            {
+                Country: not null and not "",
+                PostalCode: not null and not ""
+            }
+        };
+
+    /// <summary>
+    /// Determines if a Stripe customer supports automatic tax
+    /// </summary>
+    /// <param name="customer"></param>
+    /// <returns></returns>
+    public static bool HasTaxLocationVerified(this Customer customer) =>
+        customer?.Tax?.AutomaticTax == StripeConstants.AutomaticTaxStatus.Supported;
+}

src/Core/Billing/Extensions/ServiceCollectionExtensions.cs

@@ -1,6 +1,7 @@
 using Bit.Core.Billing.Caches;
 using Bit.Core.Billing.Caches.Implementations;
 using Bit.Core.Billing.Licenses.Extensions;
+using Bit.Core.Billing.Pricing;
 using Bit.Core.Billing.Services;
 using Bit.Core.Billing.Services.Implementations;
 
@@ -17,7 +18,7 @@ public static class ServiceCollectionExtensions
         services.AddTransient<IPremiumUserBillingService, PremiumUserBillingService>();
         services.AddTransient<ISetupIntentCache, SetupIntentDistributedCache>();
         services.AddTransient<ISubscriberService, SubscriberService>();
-        // services.AddSingleton<IPricingClient, PricingClient>();
         services.AddLicenseServices();
+        services.AddPricingClient();
     }
 }

src/Core/Billing/Extensions/SubscriptionCreateOptionsExtensions.cs

@@ -0,0 +1,26 @@
+using Stripe;
+
+namespace Bit.Core.Billing.Extensions;
+
+public static class SubscriptionCreateOptionsExtensions
+{
+    /// <summary>
+    /// Attempts to enable automatic tax for given new subscription options.
+    /// </summary>
+    /// <param name="options"></param>
+    /// <param name="customer">The existing customer.</param>
+    /// <returns>Returns true when successful, false when conditions are not met.</returns>
+    public static bool EnableAutomaticTax(this SubscriptionCreateOptions options, Customer customer)
+    {
+        // We might only need to check the automatic tax status.
+        if (!customer.HasTaxLocationVerified() && string.IsNullOrWhiteSpace(customer.Address?.Country))
+        {
+            return false;
+        }
+
+        options.DefaultTaxRates = [];
+        options.AutomaticTax = new SubscriptionAutomaticTaxOptions { Enabled = true };
+
+        return true;
+    }
+}

src/Core/Billing/Extensions/SubscriptionUpdateOptionsExtensions.cs

@@ -0,0 +1,35 @@
+using Stripe;
+
+namespace Bit.Core.Billing.Extensions;
+
+public static class SubscriptionUpdateOptionsExtensions
+{
+    /// <summary>
+    /// Attempts to enable automatic tax for given subscription options.
+    /// </summary>
+    /// <param name="options"></param>
+    /// <param name="customer">The existing customer to which the subscription belongs.</param>
+    /// <param name="subscription">The existing subscription.</param>
+    /// <returns>Returns true when successful, false when conditions are not met.</returns>
+    public static bool EnableAutomaticTax(
+        this SubscriptionUpdateOptions options,
+        Customer customer,
+        Subscription subscription)
+    {
+        if (subscription.AutomaticTax.Enabled)
+        {
+            return false;
+        }
+
+        // We might only need to check the automatic tax status.
+        if (!customer.HasTaxLocationVerified() && string.IsNullOrWhiteSpace(customer.Address?.Country))
+        {
+            return false;
+        }
+
+        options.DefaultTaxRates = [];
+        options.AutomaticTax = new SubscriptionAutomaticTaxOptions { Enabled = true };
+
+        return true;
+    }
+}

src/Core/Billing/Extensions/UpcomingInvoiceOptionsExtensions.cs

@@ -0,0 +1,35 @@
+using Stripe;
+
+namespace Bit.Core.Billing.Extensions;
+
+public static class UpcomingInvoiceOptionsExtensions
+{
+    /// <summary>
+    /// Attempts to enable automatic tax for given upcoming invoice options.
+    /// </summary>
+    /// <param name="options"></param>
+    /// <param name="customer">The existing customer to which the upcoming invoice belongs.</param>
+    /// <param name="subscription">The existing subscription to which the upcoming invoice belongs.</param>
+    /// <returns>Returns true when successful, false when conditions are not met.</returns>
+    public static bool EnableAutomaticTax(
+        this UpcomingInvoiceOptions options,
+        Customer customer,
+        Subscription subscription)
+    {
+        if (subscription != null && subscription.AutomaticTax.Enabled)
+        {
+            return false;
+        }
+
+        // We might only need to check the automatic tax status.
+        if (!customer.HasTaxLocationVerified() && string.IsNullOrWhiteSpace(customer.Address?.Country))
+        {
+            return false;
+        }
+
+        options.AutomaticTax = new InvoiceAutomaticTaxOptions { Enabled = true };
+        options.SubscriptionDefaultTaxRates = [];
+
+        return true;
+    }
+}

src/Core/Billing/Migration/Services/Implementations/OrganizationMigrator.cs

@@ -3,11 +3,11 @@ using Bit.Core.Billing.Constants;
 using Bit.Core.Billing.Entities;
 using Bit.Core.Billing.Enums;
 using Bit.Core.Billing.Migration.Models;
+using Bit.Core.Billing.Pricing;
 using Bit.Core.Billing.Repositories;
 using Bit.Core.Enums;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
-using Bit.Core.Utilities;
 using Microsoft.Extensions.Logging;
 using Stripe;
 using Plan = Bit.Core.Models.StaticStore.Plan;
@@ -19,6 +19,7 @@ public class OrganizationMigrator(
     ILogger<OrganizationMigrator> logger,
     IMigrationTrackerCache migrationTrackerCache,
     IOrganizationRepository organizationRepository,
+    IPricingClient pricingClient,
     IStripeAdapter stripeAdapter) : IOrganizationMigrator
 {
     private const string _cancellationComment = "Cancelled as part of provider migration to Consolidated Billing";
@@ -137,7 +138,7 @@ public class OrganizationMigrator(
         logger.LogInformation("CB: Bringing organization ({OrganizationID}) under provider management",
             organization.Id);
 
-        var plan = StaticStore.GetPlan(organization.Plan.Contains("Teams") ? PlanType.TeamsMonthly : PlanType.EnterpriseMonthly);
+        var plan = await pricingClient.GetPlanOrThrow(organization.Plan.Contains("Teams") ? PlanType.TeamsMonthly : PlanType.EnterpriseMonthly);
 
         ResetOrganizationPlan(organization, plan);
         organization.MaxStorageGb = plan.PasswordManager.BaseStorageGb;
@@ -206,7 +207,7 @@ public class OrganizationMigrator(
                     ? StripeConstants.CollectionMethod.ChargeAutomatically
                     : StripeConstants.CollectionMethod.SendInvoice;
 
-            var plan = StaticStore.GetPlan(organization.PlanType);
+            var plan = await pricingClient.GetPlanOrThrow(organization.PlanType);
 
             var items = new List<SubscriptionItemOptions>
             {
@@ -279,7 +280,7 @@ public class OrganizationMigrator(
             throw new Exception();
         }
 
-        var plan = StaticStore.GetPlan(migrationRecord.PlanType);
+        var plan = await pricingClient.GetPlanOrThrow(migrationRecord.PlanType);
 
         ResetOrganizationPlan(organization, plan);
         organization.MaxStorageGb = migrationRecord.MaxStorageGb;

src/Core/Billing/Migration/Services/Implementations/ProviderMigrator.cs

@@ -254,7 +254,7 @@ public class ProviderMigrator(
 
             await stripeAdapter.CustomerUpdateAsync(customer.Id, new CustomerUpdateOptions
             {
-                Coupon = StripeConstants.CouponIDs.MSPDiscount35
+                Coupon = StripeConstants.CouponIDs.LegacyMSPDiscount
             });
 
             provider.GatewayCustomerId = customer.Id;

src/Core/Billing/Models/Api/Requests/Accounts/PreviewIndividualInvoiceRequestModel.cs

@@ -5,13 +5,13 @@ namespace Bit.Core.Billing.Models.Api.Requests.Accounts;
 public class PreviewIndividualInvoiceRequestBody
 {
     [Required]
-    public PasswordManagerRequestModel PasswordManager { get; set; }
+    public IndividualPasswordManagerRequestModel PasswordManager { get; set; }
 
     [Required]
     public TaxInformationRequestModel TaxInformation { get; set; }
 }
 
-public class PasswordManagerRequestModel
+public class IndividualPasswordManagerRequestModel
 {
     [Range(0, int.MaxValue)]
     public int AdditionalStorage { get; set; }

src/Core/Billing/Models/Api/Requests/Organizations/PreviewOrganizationInvoiceRequestModel.cs

@@ -8,7 +8,7 @@ public class PreviewOrganizationInvoiceRequestBody
     public Guid OrganizationId { get; set; }
 
     [Required]
-    public PasswordManagerRequestModel PasswordManager { get; set; }
+    public OrganizationPasswordManagerRequestModel PasswordManager { get; set; }
 
     public SecretsManagerRequestModel SecretsManager { get; set; }
 
@@ -16,7 +16,7 @@ public class PreviewOrganizationInvoiceRequestBody
     public TaxInformationRequestModel TaxInformation { get; set; }
 }
 
-public class PasswordManagerRequestModel
+public class OrganizationPasswordManagerRequestModel
 {
     public PlanType Plan { get; set; }
 

src/Core/Billing/Models/ConfiguredProviderPlan.cs

@@ -1,24 +1,11 @@
-using Bit.Core.Billing.Entities;
+using Bit.Core.Models.StaticStore;
-using Bit.Core.Billing.Enums;
 
 namespace Bit.Core.Billing.Models;
 
 public record ConfiguredProviderPlan(
     Guid Id,
     Guid ProviderId,
-    PlanType PlanType,
+    Plan Plan,
     int SeatMinimum,
     int PurchasedSeats,
-    int AssignedSeats)
+    int AssignedSeats);
-{
-    public static ConfiguredProviderPlan From(ProviderPlan providerPlan) =>
-        providerPlan.IsConfigured()
-            ? new ConfiguredProviderPlan(
-                providerPlan.Id,
-                providerPlan.ProviderId,
-                providerPlan.PlanType,
-                providerPlan.SeatMinimum.GetValueOrDefault(0),
-                providerPlan.PurchasedSeats.GetValueOrDefault(0),
-                providerPlan.AllocatedSeats.GetValueOrDefault(0))
-            : null;
-}

src/Core/Billing/Models/Mail/TrialInititaionVerifyEmail.cs

@@ -5,6 +5,7 @@ namespace Bit.Core.Billing.Models.Mail;
 
 public class TrialInitiationVerifyEmail : RegisterVerifyEmail
 {
+    public bool IsExistingUser { get; set; }
     /// <summary>
     /// See comment on <see cref="RegisterVerifyEmail"/>.<see cref="RegisterVerifyEmail.Url"/>
     /// </summary>
@@ -26,8 +27,18 @@ public class TrialInitiationVerifyEmail : RegisterVerifyEmail
     /// Currently we only support one product type at a time, despite Product being a collection.
     /// If we receive both PasswordManager and SecretsManager, we'll send the user to the PM trial route
     /// </summary>
-    private string Route =>
+    private string Route
-        Product.Any(p => p == ProductType.PasswordManager)
+    {
+        get
+        {
+            if (IsExistingUser)
+            {
+                return "create-organization";
+            }
+
+            return Product.Any(p => p == ProductType.PasswordManager)
                 ? "trial-initiation"
                 : "secrets-manager-trial-initiation";
         }
+    }
+}

src/Core/Billing/Models/OrganizationMetadata.cs

@@ -10,4 +10,17 @@ public record OrganizationMetadata(
     bool IsSubscriptionCanceled,
     DateTime? InvoiceDueDate,
     DateTime? InvoiceCreatedDate,
-    DateTime? SubPeriodEndDate);
+    DateTime? SubPeriodEndDate)
+{
+    public static OrganizationMetadata Default => new OrganizationMetadata(
+        false,
+        false,
+        false,
+        false,
+        false,
+        false,
+        false,
+        null,
+        null,
+        null);
+}

src/Core/Billing/Models/Sales/OrganizationSale.cs

@@ -46,7 +46,8 @@ public class OrganizationSale
         var customerSetup = new CustomerSetup
         {
             Coupon = signup.IsFromProvider
-            ? StripeConstants.CouponIDs.MSPDiscount35
+            // TODO: Remove when last of the legacy providers has been migrated.
+            ? StripeConstants.CouponIDs.LegacyMSPDiscount
             : signup.IsFromSecretsManagerTrial
                 ? StripeConstants.CouponIDs.SecretsManagerStandalone
                 : null
@@ -76,8 +77,6 @@ public class OrganizationSale
 
     private static SubscriptionSetup GetSubscriptionSetup(OrganizationUpgrade upgrade)
     {
-        var plan = Core.Utilities.StaticStore.GetPlan(upgrade.Plan);
-
         var passwordManagerOptions = new SubscriptionSetup.PasswordManager
         {
             Seats = upgrade.AdditionalSeats,
@@ -95,7 +94,7 @@ public class OrganizationSale
 
         return new SubscriptionSetup
         {
-            Plan = plan,
+            PlanType = upgrade.Plan,
             PasswordManagerOptions = passwordManagerOptions,
             SecretsManagerOptions = secretsManagerOptions
         };

src/Core/Billing/Models/Sales/SubscriptionSetup.cs

@@ -1,4 +1,4 @@
-using Bit.Core.Models.StaticStore;
+using Bit.Core.Billing.Enums;
 
 namespace Bit.Core.Billing.Models.Sales;
 
@@ -6,7 +6,7 @@ namespace Bit.Core.Billing.Models.Sales;
 
 public class SubscriptionSetup
 {
-    public required Plan Plan { get; set; }
+    public required PlanType PlanType { get; set; }
     public required PasswordManager PasswordManagerOptions { get; set; }
     public SecretsManager? SecretsManagerOptions { get; set; }
     public bool SkipTrial = false;

src/Core/Billing/Pricing/IPricingClient.cs

@@ -1,5 +1,7 @@
 using Bit.Core.Billing.Enums;
+using Bit.Core.Exceptions;
 using Bit.Core.Models.StaticStore;
+using Bit.Core.Utilities;
 
 #nullable enable
 
@@ -7,6 +9,30 @@ namespace Bit.Core.Billing.Pricing;
 
 public interface IPricingClient
 {
+    /// <summary>
+    /// Retrieve a Bitwarden plan by its <paramref name="planType"/>. If the feature flag 'use-pricing-service' is enabled,
+    /// this will trigger a request to the Bitwarden Pricing Service. Otherwise, it will use the existing <see cref="StaticStore"/>.
+    /// </summary>
+    /// <param name="planType">The type of plan to retrieve.</param>
+    /// <returns>A Bitwarden <see cref="Plan"/> record or null in the case the plan could not be found or the method was executed from a self-hosted instance.</returns>
+    /// <exception cref="BillingException">Thrown when the request to the Pricing Service fails unexpectedly.</exception>
     Task<Plan?> GetPlan(PlanType planType);
+
+    /// <summary>
+    /// Retrieve a Bitwarden plan by its <paramref name="planType"/>. If the feature flag 'use-pricing-service' is enabled,
+    /// this will trigger a request to the Bitwarden Pricing Service. Otherwise, it will use the existing <see cref="StaticStore"/>.
+    /// </summary>
+    /// <param name="planType">The type of plan to retrieve.</param>
+    /// <returns>A Bitwarden <see cref="Plan"/> record.</returns>
+    /// <exception cref="NotFoundException">Thrown when the <see cref="Plan"/> for the provided <paramref name="planType"/> could not be found or the method was executed from a self-hosted instance.</exception>
+    /// <exception cref="BillingException">Thrown when the request to the Pricing Service fails unexpectedly.</exception>
+    Task<Plan> GetPlanOrThrow(PlanType planType);
+
+    /// <summary>
+    /// Retrieve all the Bitwarden plans. If the feature flag 'use-pricing-service' is enabled,
+    /// this will trigger a request to the Bitwarden Pricing Service. Otherwise, it will use the existing <see cref="StaticStore"/>.
+    /// </summary>
+    /// <returns>A list of Bitwarden <see cref="Plan"/> records or an empty list in the case the method is executed from a self-hosted instance.</returns>
+    /// <exception cref="BillingException">Thrown when the request to the Pricing Service fails unexpectedly.</exception>
     Task<List<Plan>> ListPlans();
 }

src/Core/Billing/Pricing/JSON/FreeOrScalableDTOJsonConverter.cs

@@ -0,0 +1,35 @@
+using System.Text.Json;
+using Bit.Core.Billing.Pricing.Models;
+
+namespace Bit.Core.Billing.Pricing.JSON;
+
+#nullable enable
+
+public class FreeOrScalableDTOJsonConverter : TypeReadingJsonConverter<FreeOrScalableDTO>
+{
+    public override FreeOrScalableDTO? Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+    {
+        var type = ReadType(reader);
+
+        return type switch
+        {
+            "free" => JsonSerializer.Deserialize<FreeDTO>(ref reader, options) switch
+            {
+                null => null,
+                var free => new FreeOrScalableDTO(free)
+            },
+            "scalable" => JsonSerializer.Deserialize<ScalableDTO>(ref reader, options) switch
+            {
+                null => null,
+                var scalable => new FreeOrScalableDTO(scalable)
+            },
+            _ => null
+        };
+    }
+
+    public override void Write(Utf8JsonWriter writer, FreeOrScalableDTO value, JsonSerializerOptions options)
+        => value.Switch(
+            free => JsonSerializer.Serialize(writer, free, options),
+            scalable => JsonSerializer.Serialize(writer, scalable, options)
+        );
+}

src/Core/Billing/Pricing/JSON/PurchasableDTOJsonConverter.cs

@@ -0,0 +1,40 @@
+using System.Text.Json;
+using Bit.Core.Billing.Pricing.Models;
+
+namespace Bit.Core.Billing.Pricing.JSON;
+
+#nullable enable
+internal class PurchasableDTOJsonConverter : TypeReadingJsonConverter<PurchasableDTO>
+{
+    public override PurchasableDTO? Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+    {
+        var type = ReadType(reader);
+
+        return type switch
+        {
+            "free" => JsonSerializer.Deserialize<FreeDTO>(ref reader, options) switch
+            {
+                null => null,
+                var free => new PurchasableDTO(free)
+            },
+            "packaged" => JsonSerializer.Deserialize<PackagedDTO>(ref reader, options) switch
+            {
+                null => null,
+                var packaged => new PurchasableDTO(packaged)
+            },
+            "scalable" => JsonSerializer.Deserialize<ScalableDTO>(ref reader, options) switch
+            {
+                null => null,
+                var scalable => new PurchasableDTO(scalable)
+            },
+            _ => null
+        };
+    }
+
+    public override void Write(Utf8JsonWriter writer, PurchasableDTO value, JsonSerializerOptions options)
+        => value.Switch(
+            free => JsonSerializer.Serialize(writer, free, options),
+            packaged => JsonSerializer.Serialize(writer, packaged, options),
+            scalable => JsonSerializer.Serialize(writer, scalable, options)
+        );
+}

src/Core/Billing/Pricing/JSON/TypeReadingJsonConverter.cs

@@ -0,0 +1,28 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Bit.Core.Billing.Pricing.Models;
+
+namespace Bit.Core.Billing.Pricing.JSON;
+
+#nullable enable
+
+public abstract class TypeReadingJsonConverter<T> : JsonConverter<T>
+{
+    protected virtual string TypePropertyName => nameof(ScalableDTO.Type).ToLower();
+
+    protected string? ReadType(Utf8JsonReader reader)
+    {
+        while (reader.Read())
+        {
+            if (reader.TokenType != JsonTokenType.PropertyName || reader.GetString()?.ToLower() != TypePropertyName)
+            {
+                continue;
+            }
+
+            reader.Read();
+            return reader.GetString();
+        }
+
+        return null;
+    }
+}

src/Core/Billing/Pricing/Models/FeatureDTO.cs

@@ -0,0 +1,9 @@
+namespace Bit.Core.Billing.Pricing.Models;
+
+#nullable enable
+
+public class FeatureDTO
+{
+    public string Name { get; set; } = null!;
+    public string LookupKey { get; set; } = null!;
+}