* initial changes
* Fixing some bits
* fixing issue when feature flag is `false`; also names;
* consume OTP on read if FF true
* comment typo
* fix formatting
* check access code first to not consume token
* add docs
* revert checking access code first
* update error messages
* remove line number from comment
---------
Co-authored-by: Jake Fink <jfink@bitwarden.com>
* Attempt to fix tde to mp flow
* Move tde offboarding to dedicated flag
* Add tde offboarding password request
* Validate tde offboarding input
* Correctly check whether tde is active when building trusted device options
* Refactor Tde offboarding into a separate command
* Add unit tests for tde offboarding
* Update tde offboarding request model
* Fix tests
* Fix further tests
* Fix documentation
* Add validation for updatetdepasswordasync key/newmasterpassword
* Add comment explaining test
* Remove unrelated changes
* PM-6198 - RegistrationEmailVerificationTokenable - add new static validate token method
* PM-6198 - Rename RegistrationStart to Registration as we now have to add another anonymous reference event.
* PM-6198 - rest of work
* PM-6198 - Unit test new account controller method.
* PM-6198 - Integration test new account controller endpoint
* remove validation from 2fa GET and mask sensitive data
* skip verification check on put email
* disable verification on send-email and reenable on put email
* validate authenticator on set instead of get
* Revert "validate authenticator on set instead of get"
This reverts commit 7bf2084531e811656c0d0b177554e3863399e8fc.
* fix tests
* fix more tests
* Narrow scope of verify bypass
* Defaulted to false on VerifySecretAsync
* fix default param value
---------
Co-authored-by: Ike Kottlowski <ikottlowski@bitwarden.com>
Co-authored-by: Todd Martin <tmartin@bitwarden.com>
* Resovled issue where free families line item isn't removed from the Stripe subscription when the sponsorship isn't in the database
* Moved SponsorOrganizationSubscriptionUpdate to Billing namespace
* chore: remove fc refs in CreateGroup and UpdateGroup commands, refs AC-2646
* chore: remove fc refs and update interface to represent usage/get rid of double enumeration warnings, refs AC-2646
* chore: remove org/provider service fc callers, refs AC-2646
* chore: remove collection service fc callers, refs AC-2646
* chore: remove cipher service import ciphers fc callers, refs AC-2646
* fix: UpdateOrganizationUserCommandTests collections to list, refs AC-2646
* fix: update CreateGroupCommandTests, refs AC-2646
* fix: adjust UpdateGroupCommandTests, refs AC-2646
* fix: adjust UpdateOrganizationUserCommandTests for FC always true, refs AC-2646
* fix: update CollectionServiceTests, refs AC-2646
* fix: remove unnecessary test with fc disabled, refs AC-2646
* fix: update tests to account for AccessAll removal and Manager removal, refs AC-2646
* chore: remove dependence on FC flag for tests, refs AC-2646
* Add Explicit Reference to Microsoft.AspNetCore.DataProtection
* Use Version That Doesn't Cause Downgrade
* Update src/Core/Core.csproj
Co-authored-by: Matt Bishop <mbishop@bitwarden.com>
---------
Co-authored-by: Matt Bishop <mbishop@bitwarden.com>
* [deps] Tools: Update MailKit to v4.7.0
* Add explicit reference to System.Formats.Asn1 to address Microsoft Security Advisory CVE-2024-38095
---------
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Daniel James Smith <djsmith85@users.noreply.github.com>
* Add AccessToSecretsAsync to the repository
* Add BulkSecretAuthorizationHandler
* Update controller to use the new authz handler
* Add integration test coverage
* Enable `nullable` for `ApiKey`
* Switch to Using `required`
* Make Scope Be Valid JSON
* Update test/Api.IntegrationTest/SecretsManager/Controllers/ServiceAccountsControllerTests.cs
Co-authored-by: Thomas Avery <43214426+Thomas-Avery@users.noreply.github.com>
* Apply suggestions from code review
Co-authored-by: Maciej Zieniuk <167752252+mzieniukbw@users.noreply.github.com>
* Move Nullable Directive
---------
Co-authored-by: Thomas Avery <43214426+Thomas-Avery@users.noreply.github.com>
Co-authored-by: Maciej Zieniuk <167752252+mzieniukbw@users.noreply.github.com>
* Enable `nullable` For Collection
* Enable `nullable` For `CollectionCipher`
* Enable `nullable` For `CollectionGroup`
* Enable `nullable` For `CollectionUser`
* Enable `nullable` For `Device`
* Enable `nullable` For `Event`
* Enable `nullable` For `Folder`
* Enable `nullable` For `Installation`
* Enable `nullable` For `IRevisable`
* Enable `nullable` For `IStorable`
* Enable `nullable` For `IStorableSubscriber`
* Enable `nullable` For `ITableObject`
* Enable `nullable` For `OrganizationApiKey`
* Enable `nullable` For `OrganizationConnection`
* Enable `nullable` For `OrganizationDomain`
* Enable `nullable` For `OrganizationSponsorship`
* Enable `nullable` For `Role`
* Enable `nullable` For `TaxRate`
* Enable `nullable` For `Transaction`
* Enable `nullable` For `User`
* Sql-backed IDistributedCache
* sqlserver cache table
* remove unused using
* setup EF entity
* cache indexes
* add back cipher
* revert SetupEntityFramework change
* ef cache
* EntityFrameworkCache
* IServiceScopeFactory for db context
* implement EntityFrameworkCache
* move to _serviceScopeFactory
* move to config file
* ef migrations
* fixes
* datetime and error codes
* revert migrations
* migrations
* format
* static and namespace fix
* use time provider
* Move SQL migration and remove EF one for the moment
* Add clean migration of just the new table
* Formatting
* Test Custom `IDistributedCache` Implementation
* Add Back Logging
* Remove Double Logging
* Skip Test When Not EntityFrameworkCache
* Format
---------
Co-authored-by: Matt Bishop <mbishop@bitwarden.com>
Co-authored-by: Justin Baur <19896123+justindbaur@users.noreply.github.com>
Remove FlexibleCollections feature flag logic for repository methods:
* GetManyByUserIdAsync
* GetManyByUserIdCipherIdAsync
* UpdateCollectionsAsync
* UpdateCollectionsForCiphersAsync
This feature flag was never turned on and we will update the sprocs
directly as required.
Remove FlexibleCollections feature flag logic for repository methods:
* CiphersController.GetByIdAsync
* CipherRepository.DeleteAsync
* CipherRepository.MoveAsync
* RestoreAsync
* SoftDeleteAsync
This feature flag was never turned on and we will update the sprocs
directly as required.
* PM-7322 - AccountsController.cs - create empty method + empty req model to be able to create draft PR.
* PM-7322 - Start on RegisterFinishRequestModel.cs
* PM-7322 - WIP on Complete Registration endpoint
* PM-7322 - UserService.cs - RegisterUserAsync - Tweak of token to be orgInviteToken as we are adding a new email verification token to the mix.
* PM-7322 - UserService - Rename MP to MPHash
* PM-7322 - More WIP progress on getting new finish registration process in place.
* PM-7322 Create IRegisterUserCommand
* PM-7322 - RegisterUserCommand.cs - first WIP draft
* PM-7322 - Implement use of new command in Identity.
* PM-7322 - Rename RegisterUserViaOrgInvite to just be RegisterUser as orgInvite is optional.
* PM07322 - Test RegisterUserCommand.RegisterUser(...) happy paths and one bad request path.
* PM-7322 - More WIP on RegisterUserCommand.cs and tests
* PM-7322 - RegisterUserCommand.cs - refactor ValidateOrgInviteToken logic to always validate the token if we have one.
* PM-7322 - RegisterUserCommand.cs - Refactor OrgInviteToken validation to be more clear + validate org invite token even in open registration scenarios + added tests.
* PM-7322 - Add more test coverage to RegisterUserWithOptionalOrgInvite
* PM-7322 - IRegisterUserCommand - DOCS
* PM-7322 - Test RegisterUser
* PM-7322 - IRegisterUserCommand - Add more docs.
* PM-7322 - Finish updating all existing user service register calls to use the new command.
* PM-7322 - RegistrationEmailVerificationTokenable.cs changes + tests
* PM-7322 - RegistrationEmailVerificationTokenable.cs changed to only verify email as it's the only thing we need to verify + updated tests.
* PM-7322 - Get RegisterUserViaEmailVerificationToken built and tested
* PM-7322 - AccountsController.cs - get bones of PostRegisterFinish in place
* PM-7322 - SendVerificationEmailForRegistrationCommand - Feature flag timing attack delays per architecture discussion with a default of keeping them around.
* PM-7322 - RegisterFinishRequestModel.cs - EmailVerificationToken must be optional for org invite scenarios.
* PM-7322 - HandlebarsMailService.cs - SendRegistrationVerificationEmailAsync - must URL encode email to avoid invalid email upon submission to server on complete registration step
* PM-7322 - RegisterUserCommandTests.cs - add API key assertions
* PM-7322 - Clean up RegisterUserCommand.cs
* PM-7322 - Refactor AccountsController.cs existing org invite method and new process to consider new feature flag for delays.
* PM-7322 - Add feature flag svc to AccountsControllerTests.cs + add TODO
* PM-7322 - AccountsController.cs - Refactor shared IdentityResult logic into private helper.
* PM-7322 - Work on getting PostRegisterFinish tests in place.
* PM-7322 - AccountsControllerTests.cs - test new method.
* PM-7322 - RegisterFinishRequestModel.cs - Update to use required keyword instead of required annotations as it is easier to catch mistakes.
* PM-7322 - Fix misspelling
* PM-7322 - Integration tests for RegistrationWithEmailVerification
* PM-7322 - Fix leaky integration tests.
* PM-7322 - Another leaky test fix.
* PM-7322 - AccountsControllerTests.cs - fix RegistrationWithEmailVerification_WithOrgInviteToken_Succeeds
* PM-7322 - AccountsControllerTests.cs - Finish out integration test suite!
