* Add Manage permission to UserCipherDetails and CipherDetails_ReadByIdUserId
* Add Manage property to CipherDetails and UserCipherDetailsQuery
* Add integration test for CipherRepository Manage permission rules
* Update CipherDetails_ReadWithoutOrganizationsByUserId to include Manage permission
* Refactor UserCipherDetailsQuery to include detailed permission and organization properties
* Refactor CipherRepositoryTests to improve test organization and readability
- Split large test method into smaller, focused methods
- Added helper methods for creating test data and performing assertions
- Improved test coverage for cipher permissions in different scenarios
- Maintained existing test logic while enhancing code structure
* Refactor CipherRepositoryTests to consolidate cipher permission tests
- Removed redundant helper methods for permission assertions
- Simplified test methods for GetCipherPermissionsForOrganizationAsync, GetManyByUserIdAsync, and GetByIdAsync
- Maintained existing test coverage for cipher manage permissions
- Improved code readability and reduced code duplication
* Add integration test for CipherRepository group collection manage permissions
- Added new test method GetCipherPermissionsForOrganizationAsync_ManageProperty_RespectsCollectionGroupRules
- Implemented helper method CreateCipherInOrganizationCollectionWithGroup to support group-based collection permission testing
- Verified manage permissions are correctly applied based on group collection access settings
* Add @Manage parameter to Cipher stored procedures
- Updated CipherDetails_Create, CipherDetails_CreateWithCollections, and CipherDetails_Update stored procedures
- Added @Manage parameter with comment "-- not used"
- Included new stored procedure implementations in migration script
- Consistent with previous work on adding Manage property to cipher details
* Update UserCipherDetails functions to reorder Manage and ViewPassword columns
* [PM-18086] Add CanRestore and CanDelete authorization methods.
* [PM-18086] Address code review feedback.
* [PM-18086] Add missing part.
* [PM-18087] Add CipherPermissionsResponseModel for cipher permissions
* Add GetManyOrganizationAbilityAsync method to application cache service
* Add organization ability context to cipher response models
This change introduces organization ability context to various cipher response models across multiple controllers. The modifications include:
- Updating CipherResponseModel to include permissions based on user and organization ability
- Modifying CiphersController methods to fetch and pass organization abilities
- Updating SyncController to include organization abilities in sync response
- Adding organization ability context to EmergencyAccessController response generation
* Remove organization ability context from EmergencyAccessController
This change simplifies the EmergencyAccessController by removing unnecessary organization ability fetching and passing. Since emergency access only retrieves personal ciphers, the organization ability context is no longer needed in the response generation.
* Remove unused IApplicationCacheService from EmergencyAccessController
* Refactor EmergencyAccessViewResponseModel constructor
Remove unnecessary JsonConstructor attribute and simplify constructor initialization for EmergencyAccessViewResponseModel
* Refactor organization ability retrieval in CiphersController
Extract methods to simplify organization ability fetching for ciphers, reducing code duplication and improving readability. Added two private helper methods:
- GetOrganizationAbilityAsync: Retrieves organization ability for a single cipher
- GetManyOrganizationAbilitiesAsync: Retrieves organization abilities for multiple ciphers
* Update CiphersControllerTests to use GetUserByPrincipalAsync
Modify test methods to:
- Replace GetProperUserId with GetUserByPrincipalAsync
- Use User object instead of separate userId
- Update mocking to return User object
- Ensure user ID is correctly set in test scenarios
* Refactor CipherPermissionsResponseModel to use constructor-based initialization
* Refactor CipherPermissionsResponseModel to use record type and init-only properties
* [PM-18086] Undo files
* [PM-18086] Undo files
* Refactor organization abilities retrieval in cipher-related controllers and models
- Update CiphersController to use GetOrganizationAbilitiesAsync instead of individual methods
- Modify CipherResponseModel and CipherDetailsResponseModel to accept organization abilities dictionary
- Update CipherPermissionsResponseModel to handle organization abilities lookup
- Remove deprecated organization ability retrieval methods
- Simplify sync and emergency access response model handling of organization abilities
* Remove GetManyOrganizationAbilityAsync method
- Delete unused method from IApplicationCacheService interface
- Remove corresponding implementation in InMemoryApplicationCacheService
- Continues cleanup of organization ability retrieval methods
* Update CiphersControllerTests to include organization abilities retrieval
- Add organization abilities retrieval in test setup for PutCollections_vNext method
- Ensure consistent mocking of IApplicationCacheService in test scenarios
* Update error message for missing organization ability
---------
Co-authored-by: Jimmy Vo <huynhmaivo82@gmail.com>
Pass in the current userId instead of trying to infer it from the folders or ciphers passed into the ImportCiphersCommand
Kudos go to @MJebran who pointed this out on https://github.com/bitwarden/server/pull/4896
Co-authored-by: Daniel James Smith <djsmith85@users.noreply.github.com>
* Remove gRPC and convert PricingClient to HttpClient wrapper
* Add PlanType.GetProductTier extension
Many instances of StaticStore use are just to get the ProductTierType of a PlanType, but this can be derived from the PlanType itself without having to fetch the entire plan.
* Remove invocations of the StaticStore in non-Test code
* Deprecate StaticStore entry points
* Run dotnet format
* Matt's feedback
* Run dotnet format
* Rui's feedback
* Run dotnet format
* Replacements since approval
* Run dotnet format
* Allow for binning of comb IDs by date and value
* Introduce notification hub pool
* Replace device type sharding with comb + range sharding
* Fix proxy interface
* Use enumerable services for multiServiceNotificationHub
* Fix push interface usage
* Fix push notification service dependencies
* Fix push notification keys
* Fixup documentation
* Remove deprecated settings
* Fix tests
* PascalCase method names
* Remove unused request model properties
* Remove unused setting
* Improve DateFromComb precision
* Prefer readonly service enumerable
* Pascal case template holes
* Name TryParse methods TryParse
* Apply suggestions from code review
Co-authored-by: Justin Baur <19896123+justindbaur@users.noreply.github.com>
* Include preferred push technology in config response
SignalR will be the fallback, but clients should attempt web push first if offered and available to the client.
* Register web push devices
* Working signing and content encrypting
* update to RFC-8291 and RFC-8188
* Notification hub is now working, no need to create our own
* Fix body
* Flip Success Check
* use nifty json attribute
* Remove vapid private key
This is only needed to encrypt data for transmission along webpush -- it's handled by NotificationHub for us
* Add web push feature flag to control config response
* Update src/Core/NotificationHub/NotificationHubConnection.cs
Co-authored-by: Justin Baur <19896123+justindbaur@users.noreply.github.com>
* Update src/Core/NotificationHub/NotificationHubConnection.cs
Co-authored-by: Justin Baur <19896123+justindbaur@users.noreply.github.com>
* fixup! Update src/Core/NotificationHub/NotificationHubConnection.cs
* Move to platform ownership
* Remove debugging extension
* Remove unused dependencies
* Set json content directly
* Name web push registration data
* Fix FCM type typo
* Determine specific feature flag from set of flags
* Fixup merged tests
* Fixup tests
* Code quality suggestions
* Fix merged tests
* Fix test
---------
Co-authored-by: Justin Baur <19896123+justindbaur@users.noreply.github.com>
* PM-10600: Notification push notification
* PM-10600: Sending to specific client types for relay push notifications
* PM-10600: Sending to specific client types for other clients
* PM-10600: Send push notification on notification creation
* PM-10600: Explicit group names
* PM-10600: Id typos
* PM-10600: Revert global push notifications
* PM-10600: Added DeviceType claim
* PM-10600: Sent to organization typo
* PM-10600: UT coverage
* PM-10600: Small refactor, UTs coverage
* PM-10600: UTs coverage
* PM-10600: Startup fix
* PM-10600: Test fix
* PM-10600: Required attribute, organization group for push notification fix
* PM-10600: UT coverage
* PM-10600: Fix Mobile devices not registering to organization push notifications
We only register devices for organization push notifications when the organization is being created. This does not work, since we have a use case (Notification Center) of delivering notifications to all users of organization. This fixes it, by adding the organization id tag when device registers for push notifications.
* PM-10600: Unit Test coverage for NotificationHubPushRegistrationService
Fixed IFeatureService substitute mocking for Android tests.
Added user part of organization test with organizationId tags expectation.
* PM-10600: Unit Tests fix to NotificationHubPushRegistrationService after merge conflict
* PM-10600: Organization push notifications not sending to mobile device from self-hosted.
Self-hosted instance uses relay to register the mobile device against Bitwarden Cloud Api. Only the self-hosted server knows client's organization membership, which means it needs to pass in the organization id's information to the relay. Similarly, for Bitwarden Cloud, the organizaton id will come directly from the server.
* PM-10600: Fix self-hosted organization notification not being received by mobile device.
When mobile device registers on self-hosted through the relay, every single id, like user id, device id and now organization id needs to be prefixed with the installation id. This have been missing in the PushController that handles this for organization id.
* PM-10600: Broken NotificationsController integration test
Device type is now part of JWT access token, so the notification center results in the integration test are now scoped to client type web and all.
* PM-10600: Merge conflicts fix
* merge conflict fix
* PM-10600: Push notification with full notification center content.
Notification Center push notification now includes all the fields.
* PM-10564: Push notification updates to other clients
Cherry-picked and squashed commits:
d9711b6031a1bc1d96b920e521e6f37de1b434ec 6e69c8a0ce9a5ee29df9988b20c6e531c0b4e4a3 01c814595e572911574066802b661c83b116a865 3885885d5f4be39fdc2b8d258867c8a7536491cd 1285a7e994921b0e6f9ba78f9b84d8e7a6ceda2f fcf346985f367c462ef7b65ce7d5d2612f7345cc 28ff53c293f4d37de5fa40d2964f924368e13c95 57804ae27cbf25d88d148f399ce81c1c09997e10 1c9339b6869926e59076202e06341e5d4a403cc7
* PM-15084: Push global notification creation to affected clients
Cherry-picked and squashed commits:
ed5051e0ebc578ac6c5fce1f406d66bede3fa2b6 181f3e4ae643072c737ac00bf44a2fbbdd458ee8 49fe7c93fd5eb6fd5df680194403cf4b2beabace a8efb45a63d685cce83a6e5ea28f2320c3e52dae 7b4122c8379df5444e839297b4e7f9163550861a d21d4a67b32af85f5cd4d7dff2491852fd7d2028 186a09bb9206417616d8645cbbd18478f31a305c 1531f564b54ec1a031399fc1e2754e59dbd7e743
* PM-15084: Log warning when invalid notification push notification sent
* explicit Guid default value
* push notification tests in wrong namespace
* Installation push notification not received for on global notification center message
* wrong merge conflict
* wrong merge conflict
* installation id type Guid in push registration request
* Prevent unintentionally corrupting private keys
* Deny key update only when replacing existing keys
* Fix incorrect use of existing user public/encrypted private key
* Fix test
* Fix tests
* Re-add test
* Pass through error for set-password
* Fix test
* Increase test coverage and simplify checks
Only users with Manage/Edit permissions will be allowed to Assign To Collections. If the user has Can Edit Except Password the collections dropdown will be disabled.
---------
Co-authored-by: Matt Bishop <mbishop@bitwarden.com>
Co-authored-by: kejaeger <138028972+kejaeger@users.noreply.github.com>
* Implement endpoints to add existing organization to provider
* Run dotnet format
* Support MOE
* Run dotnet format
* Move ProviderClientsController under AC ownership
* Move ProviderClientsControllerTests under AC ownership
* Jared's feedback
* Create organization deletion command with logic extracted from OrganizationService
* Add unit tests for OrganizationDeleteCommand
* Register OrganizationDeleteCommand for dependency injection
* Refactor organization deletion logic to use IOrganizationDeleteCommand and remove legacy IOrganizationService.DeleteAsync method
* Add organization deletion initiation command and refactor service usage
* Enhance organization deletion commands with detailed XML documentation
* Refactor organization command registration to include sign-up and deletion methods
feat(NewDeviceVerification) :
* Created database migration scripts for VerifyDevices column in [dbo].[User].
* Updated DeviceValidator to check if user has opted out of device verification.
* Added endpoint to AccountsController.cs to allow editing of new User.VerifyDevices property.
* Added tests for new methods and endpoint.
* Updating queries to track [dbo].[User].[VerifyDevices].
* Updated DeviceValidator to set `User.EmailVerified` property during the New Device Verification flow.
fix(auth): [PM-2996] Add Pending Auth Request Data to Devices Response
- New stored procedure to fetch the appropriate data.
- Updated devices controller to respond with the new data.
- Tests written at the controller and repository level.
Resolves PM-2996
* PM-10563: Notification Center API
* PM-10563: continuation token hack
* PM-10563: Resolving merge conflicts
* PM-10563: Unit Tests
* PM-10563: Paging simplification by page number and size in database
* PM-10563: Request validation
* PM-10563: Read, Deleted status filters change
* PM-10563: Plural name for tests
* PM-10563: Request validation to always for int type
* PM-10563: Continuation Token returns null on response when no more records available
* PM-10563: Integration tests for GET
* PM-10563: Mark notification read, deleted commands date typos fix
* PM-10563: Integration tests for PATCH read, deleted
* PM-10563: Request, Response models tests
* PM-10563: EditorConfig compliance
* PM-10563: Extracting to const
* PM-10563: Update db migration script date
* PM-10563: Update migration script date
* Add new RegenerateUserAsymmetricKeysCommand
* add new command tests
* Add regen controller
* Add regen controller tests
* add feature flag
* Add push notification to sync new asymmetric keys to other devices
GetByToken and GetMasterPasswordPolicy endpoints provide policy information, so if the organization is not using policies, then we avoid the rest of the logic.
* Add SQL files
* Add SQL Server migration
* Add Core entity
* Add Dapper repository
* Add EF repository
* Add EF migrations
* Save OrganizationInstallation during GetLicense invocation
* Run dotnet format
* Implement UserLeaveAsync in IRemoveOrganizationUserCommand and refactor OrganizationsController to use it
* Edit summary message for IRemoveOrganizationUserCommand.UserLeaveAsync
* Refactor RemoveOrganizationUserCommand.RemoveUsersAsync to log in bulk
---------
Co-authored-by: Matt Bishop <mbishop@bitwarden.com>
refactor(TwoFactorAuthentication): Remove references to old Duo SDK version 2 code and replace them with the Duo SDK version 4 supported library DuoUniversal code.
Increased unit test coverage in the Two Factor Authentication code space. We opted to use DI instead of Inheritance for the Duo and OrganizaitonDuo two factor tokens to increase testability, since creating a testing mock of the Duo.Client was non-trivial.
Reviewed-by: @JaredSnider-Bitwarden
* Remove flag from CreateProviderCommand
* Remove flag from OrganizationsController
* Consolidate provider extensions
* Remove flag from ProvidersController
* Remove flag from CreateMsp.cshtml
* Remove flag from Provider Edit.cshtml
Also ensured the editable Gateway fields show for Multi-organization enterprises
* Remove flag from OrganizationsController
* Remove flag from billing-owned provider controllers
* Remove flag from OrganizationService
* Remove flag from RemoveOrganizationFromProviderCommand
* Remove flag from ProviderService
* Remove flag
* Run dotnet format
* Fix failing tests
* PM-13236 PasswordHealthReportApplications db
* PM-13236 incorporated pr comments
* PM-13236 fixed error in SQL script
* PM-13236 resolve quality scan errors SQL71006, SQL7101, SQL70001
* PM-13236 fixed warnings on procedures
* PM-13236 added efMigrations
* PM-13236 renamed files to PasswordHealthReportApplication (singular)
* PM-13236 changed file name to more appropriate naming
* PM-13236 changed the file name singular
* PM-13236 PasswordHealthReportApplication Entities and Repos
* PM-13236 moved files under tools from core
* PM-13236 Entity PasswordHealthReportApplication namespace changed to tools/entities
* PM-13236 moved Repos and Interfaces to tools
* PM-13236 migrated model to tools namespace
* PM-13236 minor fixes to the unit tests
* PM-13236 fixed script errors during build
* PM-13236 Script to drop PasswordHealthReportApplications if it exists
* PM-13236 fixes to database snapshot
* PM-13236 updated databasesnapshots
* PM-13236 Update database model changes for Mysql
* PM-13236 update model changes for Sqlite
* PM-13236 updated the models to remove commented code
* PM-13236 added correct db snapshot for MySql
* PM-13236 updated database snapshot for Postgres
* PM-13236 updated database snapshot for Sqlite
* PM-13236 removed unwanted directive to fix linting error
* PM-13236 removed redundant script files
* PM-13237 Add entity command and unit tests
* PM-13237 Get query added with unit tests
* PM-13237 Controller to add/get PasswordHealthReportApplication
* PM-13237 Setup dependencies in the EF Service collection extensions
* PM-13237 Added unit tests for ReportsController
* Adding CanToggleState to PoliciesControllers (api/public) endpoints. Added mappings wrapped in feature flag.
* Updated logic for determining CanToggle. Removed setting of toggle from List endpoint. Added new details model for single policy response. Validator now returns after first error.
* Add check for managed user before purging account
* Rename IOrganizationRepository.GetByClaimedUserDomainAsync to GetByVerifiedUserEmailDomainAsync and refactor to return a list. Remove ManagedByOrganizationId from ProfileResponseMode. Add ManagesActiveUser to ProfileOrganizationResponseModel
* Rename the property ManagesActiveUser to UserIsManagedByOrganization
* Remove whole class #nullable enable and add it to specific places
* [PM-11405] Account Deprovisioning: Prevent a verified user from changing their email address
* Remove unnecessary .ToList()
* Refactor IUserService methods GetOrganizationsManagingUserAsync and IsManagedByAnyOrganizationAsync to not return nullable objects. Update ProfileOrganizationResponseModel.UserIsManagedByOrganization to not be nullable
* Prevent deletion of accounts managed by an organization when Account Deprovisioning is enabled
* Add CannotDeleteManagedAccountViewModel and email templates
- Added CannotDeleteManagedAccountViewModel class to handle emails related to preventing deletion of accounts managed by an organization.
- Added HTML and text email templates for sending notifications about the inability to delete an account owned by an organization.
- Updated IMailService interface with a new method to send the cannot delete managed account email.
- Implemented the SendCannotDeleteManagedAccountEmailAsync method in HandlebarsMailService.
- Added a check in UserService to send the cannot delete managed account email if the user is managed by any organization.
- Added a no-op implementation for SendCannotDeleteManagedAccountEmailAsync in NoopMailService.
* Update error message when unable to purge vault for managed account
* Update error message when unable to change email for managed account
* Update error message when unable to delete account when managed by organization
* Update error message in test for deleting organization-owned accounts
* changes to include subscription status metadata
Signed-off-by: Cy Okeke <cokeke@bitwarden.com>
* Fix the failing test
Signed-off-by: Cy Okeke <cokeke@bitwarden.com>
* Resolve the failing test
Signed-off-by: Cy Okeke <cokeke@bitwarden.com>
---------
Signed-off-by: Cy Okeke <cokeke@bitwarden.com>
* Return Policy object instead of NotFoundException
* Add unit tests, change orgId type to Guid
* Fix test cases, throw exception when manage not allowed
* Add check for managed user before purging account
* Rename IOrganizationRepository.GetByClaimedUserDomainAsync to GetByVerifiedUserEmailDomainAsync and refactor to return a list. Remove ManagedByOrganizationId from ProfileResponseMode. Add ManagesActiveUser to ProfileOrganizationResponseModel
* Rename the property ManagesActiveUser to UserIsManagedByOrganization
* Remove whole class #nullable enable and add it to specific places
* [PM-11405] Account Deprovisioning: Prevent a verified user from changing their email address
* Remove unnecessary .ToList()
* Refactor IUserService methods GetOrganizationsManagingUserAsync and IsManagedByAnyOrganizationAsync to not return nullable objects. Update ProfileOrganizationResponseModel.UserIsManagedByOrganization to not be nullable
* Update error message when unable to purge vault for managed account
* Update error message when unable to change email for managed account
* Update expected error messages on unit tests
* Add TestFeatureService to Api.IntegrationTest.Helpers and use it on ApiApplicationFactory to be able to enable specific features for each test
* Add CreateVerifiedDomainAsync method to OrganizationTestHelpers
* Add tests to AccountsControllerTest to prevent changing email for managed accounts
* Remove setting the feature flag value in ApiApplicationFactory and set it on AccountsControllerTest
* Remove TestFeatureService class from Api.IntegrationTest.Helpers
