Bitwarden

Recent Commits

• Leslie Tilton(24 Aug 26)

  [PM-33527] Implement Organization Delete Tasks with Events (#8182) * feat: add OrganizationDeleteTask schema, procedures, and MSSQL migrations * feat: add organization delete task contracts and feature flag * feat: implement organization delete task Dapper repositories * feat: implement organization delete task EF repositories and migrations * feat: drain organization delete tasks from an Admin background job * test: cover organization delete task queue and event cleanup * fix: use the SDK IFeatureService in the organization delete tasks job * docs: explain why the organization delete tasks job is cloud only * feat: implement the organization delete task repository for EF providers * feat: run the organization delete tasks job on self-hosted deployments * test: drop the OnlyOn provider filter from database test infrastructure * chore: re-date MSSQL migrations after merging main * chore: regenerate EF migrations after merging main * test: isolate the delete task claim tests from leftover rows * feat: log when an organization delete task is abandoned after repeated failures * fix: restore package lock entries dropped by the main merge * fix: give the organization delete tasks job its own Quartz trigger * fix: enqueue event cleanup on the admin portal and account deletion paths * fix: only complete a delete task when a batch confirms nothing remains * test: cover the organization event purge across SQL providers * style: apply file-scoped namespaces to generated EF migrations * fix: bound Table Storage event purge to stay within the claim lease * chore: use CombGuid.Generate instead of the obsolete CoreHelpers wrapper * chore: re-date OrganizationDeleteTask migrations to sort after main * chore: regenerate EF migrations to sort after main * chore: remove unnecessary using directives from regenerated EF migrations * docs: note IX_Event_OrganizationId is MSSQL-only and redundant on EF providers

• Jared(24 Aug 26)

  [PM-38329] policies stop converting policy data on every response (#8204) * Refactor PolicyResponseModel and PolicyStatusResponseModel to use RawJsonConverter for Data property, enhancing null safety and JSON handling. Introduce RawJsonConverter utility for efficient raw JSON serialization/deserialization. Update related namespaces and remove unnecessary deserialization logic. * Refactor PoliciesControllerTests to utilize JsonDocument for data assertions, improving JSON handling and readability. Introduce new tests for PolicyResponseModel and PolicyStatusResponseModel to ensure consistent serialization with legacy implementations. Add RawJsonConverterTests to validate raw JSON serialization/deserialization behavior. * Enhance PolicyStatusResponseModel to preserve legacy wire format for policies with no stored data by serializing as "{}" instead of null. Update PolicyResponseModel to allow setting Data property. Introduce RawJsonSchemaFilter to adjust OpenAPI schema generation for properties using RawJsonConverter. Add tests for PolicyStatusResponseModel and RawJsonSchemaFilter to ensure correct serialization and schema behavior. * Update RawJsonSchemaFilter to handle nullable object schemas in OpenAPI generation. Enhance tests to verify correct schema behavior for properties with and without nullability. This ensures accurate representation of JSON types in generated schemas. * refactor(policies): update policy response models and tests for improved serialization - Refactored PolicyStatusResponseModel and PolicyResponseModel to ensure consistent serialization behavior, preserving legacy wire format for policies with no stored data. - Updated unit tests to reflect changes in serialization logic, replacing legacy models with dictionary-based deserialization for accurate JSON output comparison. - Removed obsolete RawJsonConverterTests as they are no longer needed with the updated serialization approach. * refactor(policies): update PolicyStatusResponseModel to return empty JSON object for missing data - Modified PolicyStatusResponseModel to return an empty JSON object instead of null when no data is stored, ensuring compatibility with policy-specific initialization logic. - Updated comments for clarity regarding serialization behavior. - Adjusted RawJsonConverter and RawJsonSchemaFilter documentation for improved understanding of JSON handling. * chore(dependencies): update package versions to 10.0.10 across multiple projects - Upgraded various Microsoft.AspNetCore and Microsoft.Extensions packages to version 10.0.10 in the lock files for Commercial.Core, Commercial.Infrastructure.EntityFramework, Scim, Services.Pam, Sso, and test projects. - Ensured consistent dependency resolution and improved compatibility with the latest features and fixes in the updated packages. * refactor(policies): update PolicyResponseModel to allow setting Data property - Changed the Data property in PolicyResponseModel from private to public set, enabling modification of the property after object instantiation. - This adjustment enhances flexibility in handling policy data within the response model.

• Jared(24 Aug 26)

  [PM-42240] perms still returned for members who were previously custom (#8244) * Refactor permissions handling for organization users - Updated logic to clear permissions for non-Custom roles to prevent stale data. - Adjusted response models to ensure permissions are only returned for Custom roles. - Added unit tests to verify that permissions are correctly managed during role changes. - Ensured consistency across models and response handling for organization users. * Enhance permissions handling in MemberUpdateRequestModel and update tests - Added comments for clarity on the optional Permissions property for backward compatibility. - Updated unit tests in OrganizationUserControllerPutTests to ensure permissions are cleared when converting from Custom roles. - Adjusted setup methods to include model parameters for consistency in tests.

• Vince Grassia(24 Aug 26)

  [BRE-2166] Add metadata to container images (#8241)

• github-actions[bot](24 Aug 26)

  Bumped version to 2026.8.1 (#8247) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

• Jared McCannon(20 Aug 26)

  [PM-22405] - Remove invalid users from invites (#8151) * Remove invalid invited organization users when attempting to send out invites. * Fixing build issues :facepalm: * fix test * Healing Orguser by setting the email so we can bulk send invites even if SSO JIT user is misconfigured. * fixing up comment. * Updating org user with linkedemail. * Just update in place. Don't save to db. * fixing comment * fix comment

• John Harrington(20 Aug 26)

  Add ManagePolicies to roles allowed read-only access to organization claimed domains (#8220)

• Patrick Honkonen(20 Aug 26)

  [AI-88] llm: Remove .claude/CONTRIBUTING.md (#8233) * [AI-88] llm: Remove .claude/CONTRIBUTING.md The per-repo Claude context contribution guide is retired in favour of the org-level guide in contributing-docs. Relative Claude imports resolve against the importing file's directory, so the .claude/CLAUDE.md import block is repointed to the repository root. * [AI-88] llm: Keep heavyweight docs out of the always-on Claude context The root README is project overview rather than actionable code context, and importing it inlined it into every session. It is now referenced as a path Claude reads on demand, keeping the two small directly-relevant imports live. * [AI-88] llm: Read the contributing guide on demand rather than importing it The contributing guide is reference material a session reaches for when it needs it, not context every session needs resident.

• Mike Amirault(20 Aug 26)

  [PM-39979] Add full API support for Item-type Sends (#8192) * [PM-39979] Add full API support for Item-type Sends * Address AI comments * Formatting fixes

• Justin Baur(19 Aug 26)

  Prepare IPushNotificationService for extraction into a push library (#8199) * Prepare IPushNotificationService for extraction into a push library - Remove all 16 default interface methods (DIMs) from IPushNotificationService, leaving only PushAsync<T>; the three legacy properties (InstallationId, TimeProvider, Logger) are retained but marked [Obsolete(DiagnosticId="BWP0001")] - Extract each DIM as a static extension method in its owning team's domain folder (Auth, Vault, Tools, AdminConsole, NotificationCenter, Billing) - Move push notification payload types out of PushNotification.cs into their owning team's Models folder; namespace stays Bit.Core.Models to avoid touching callers (file location is the ownership signal, not the namespace—see comment in each file) - Fix LogOut PushType attribution from "not-specified" to @bitwarden/team-auth-dev - Update all service-level tests to assert on PushAsync<T> instead of the removed DIMs; delete the snapshot-style PushTestBase engine tests that were migration guards rather than living contracts - Add AzureQueuePushEngineWireFormatTests as a wire-format guard and HubHelpers routing guard for the Azure Queue push path * Add AzureQueuePipelineTests, replace AzureQueuePushEngineWireFormatTests Replaces the mock-based AzureQueuePushEngineWireFormatTests with a true end-to-end pipeline test (AzureQueuePipelineTests) that drives the full chain: AzureQueuePushEngine → ChannelQueueClient → AzureQueueHostedService → HubHelpers → SignalR hub mocks. - ChannelQueueClient: in-memory QueueClient backed by System.Threading.Channels, with a separate capture channel so producer and consumer sides don't race - AzureQueuePipelineTests: wire-format guard + routing guard + ClientType routing, including the AuthRequestResponse → anonymous hub case - NotificationsApplicationFactory: expose AnonymousHubClients for asserting auth-request-response routing - PostSendEndpointTests: add AuthRequestResponse routing case (anonymous hub) - AzureQueueHostedService: inject TimeProvider for delay control in tests; resolve QueueClient via keyed service provider - Startup: register TimeProvider.System and QueueClient as keyed singleton so tests can substitute ChannelQueueClient * Run dotnet format * Run dotnet format * Simplify boolean expressions flagged by code quality bot

• sven-bitwarden(18 Aug 26)

  prevent users/provider users from requesting account recovery details of owners/provider admins (#8103)

• renovate[bot](18 Aug 26)

  [deps]: Update dotnet monorepo (#8018) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

• Jared Snider(18 Aug 26)

  Auth/PM-41812 - Auth - New Org User Staged Status Audit - Comment changes only (#8225) * PM-41812 - Update auth-domain comments to reflect Staged organization-user status The Staged status added in PM-37953 introduced a second OrganizationUser row shape whose UserId is null and whose Status is not Invited. Several auth-owned comments described the SSO email-fallback lookup and the TDE permission gate in Invited-only / Revoked-only terms and no longer accurately describe the possible inputs. Reframed the comments to describe the intrinsic property (rows not yet linked to a User account) so they don't need to enumerate statuses and won't rot again when the enum grows. No behavior change. * PM-41812 - Tighten "not-yet-linked" phrasing to reference UserId Follow-up to the audit comment updates: use "linked to a User by Id" rather than "linked to a User account" so the phrasing points at the specific column that determines linkage. Keeps the SSO email-fallback doc comments consistent with the inline comment inside the helper.

• renovate[bot](18 Aug 26)

  [deps] Auth: Update jquery to v4 (#6932) * [deps]: Update jquery to v4 * add a resolve alias to Admin and SSO webpack configs --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Ike <[email protected]> Co-authored-by: rr-bw <[email protected]>

• Jared Snider(18 Aug 26)

  PM-42152 - Open Org Invite Status Endpoint - Decode org name (#8227) Organization.Name is stored HTML-encoded, so callers must invoke DisplayName() to return a human-readable value. The invite-link status query was returning the raw encoded value, causing clients to render literal entities (&amp;, &#39;, &quot;) in the invite landing UI.

• Maciej Zieniuk(18 Aug 26)

  [PM-39455] Reuse the connection and transaction during user key rotation (#8165) * Reuse the connection and transaction during user key rotation Replace UpdateEncryptedDataForKeyRotation with the generic DatabaseTransactionAction, which takes a DbConnection and DbTransaction rather than the SQL Server specific SqlConnection and SqlTransaction. This matches the delegate introduced in #7548. Every EF repository that takes part in a key rotation now binds its DatabaseContext to the caller's connection and transaction through GetTransactionalDatabaseContext, instead of opening a second connection. Opening a second connection deadlocks on single-writer providers such as SQLite, and left each write outside the rotation transaction on the others, which breaks integration tests. * remove redundant test

• Alex Morask(18 Aug 26)

  [PM-29460] feat: Authenticate PricingClient to the pricing service (#8054) Send the shared X-Pricing-Api-Key header on every cloud request to the pricing service so its use-pricing-api-key-authentication flag can be enabled without breaking plan retrieval. Adds an optional PricingApiKey to GlobalSettings and attaches it as a default request header in AddPricingClient when configured. The header is inert while the pricing service's flag is off (that middleware is a pass-through), so shipping it early is safe and decouples the server deploy from the flag flip.

• Oscar Hinton(18 Aug 26)

  Add dev.playground seeder preset with role-based login emails (#8223) * feat(seeder): implement the roster per-user email override roster.schema.json has documented an `email` override on roster users, but SeedRosterUser never carried the property, so the field was silently ignored and every roster user got the derived firstName.lastName@domain address. Wire it through CreateRosterStep with the precedence: --owner-email CLI override (first owner only), then the roster override, then the derived address. Group and collection references still resolve by the FirstName.LastName prefix, so only the stored email changes. Duplicate final emails now fail fast with the roster name instead of surfacing as a unique-index violation at commit time. * feat(seeder): add the dev.playground preset A developer-convenience preset over production-shaped data: one enterprise org (Dev Org, bw.test) whose four role accounts use the new roster email override so the login is the role — [email protected], [email protected], [email protected], [email protected] — alongside eight realistically named members across Engineering, Finance, People Ops, and Leadership groups. Collections use '/' hierarchy with a deliberate permission mix (manage, read-only, hidden passwords) so each role login sees a different vault; allowAdminAccessToAllCollectionItems is explicitly false and the owner gets direct Can Manage everywhere instead. The 21 vault items carry realistic names across logins with TOTP, secure notes, a card, an identity, and an SSH key; four are cipher-key encrypted, every item is collection-assigned, and user@/owner@ get folders and favorites. No attachments, so Azurite is not required. * feat(seeder): seed dev.playground as the default dev baseline Swap the qa.enterprise-basic entry in dev/seeds.json for the dev.playground preset so a fresh environment gets the role-based logins ([email protected], admin@, custom@, user@) out of the box. The individual Jane/John entries stay — the playground org does not cover individual accounts. * fix(seeder): address dev.playground review feedback Move the dev fixtures onto a `.example` domain (`bw.test` → `bw.example`), the convention already documented in `Seeds/docs/fixtures.md`. Covers the org, the roster's four role logins, the cipher usernames and URIs, the catalog table, both test files, and the Jane/John individual entries in `dev/seeds.json`. Drop the vault-item inventory paragraph from `presets.md`. Its cipher-key count had already drifted from the fixture, and re-counting on every fixture edit is maintenance the catalog does not need. Register the new `dev/` preset folder in `Seeds/README.md` and `util/Seeder/CLAUDE.md`, which was also missing `individual/`. Document the roster `email` override in `Seeds/docs/fixtures.md` and add a `CreateRosterStep` email-override row to `Seeds/docs/regression.md`, then add a Fixture Contract Sync section to `util/Seeder/CLAUDE.md` so the model/schema/docs sync and the `.example` domain rule are loaded rather than looked up. Fall back to the derived address when a roster `email` override is blank, matching the `--owner-email` path, and give the schema property a `minLength`. Nothing validates fixtures against the schemas at build or run time, so the step guard is the enforcing half. Promote `dev.playground` to the `fresh-database` scenario quick start now that it is the `dev/seeds.json` baseline, demoting `qa.enterprise-basic` to the variation that still carries attachments. * docs(seeder): align the whitespace bullet with CreateRosterStep The Fixture Contract Sync bullet told contributors to reject whitespace in the step, but `CreateRosterStep` treats a whitespace `email` as absent and falls back to the derived `firstName.lastName@domain`. Following the directive literally would add a throw and split the two override paths apart again — the `--owner-email` branch above it also treats whitespace as absent — so align the verb with the code.

• Eli Grubb(18 Aug 26)

  Add KeyProtectionPolicy env var for FIPS services (#8092)

• Bernd Schoolmann(17 Aug 26)

  fix(vault): skip key id validation for organization (#8219)

• Jared(17 Aug 26)

  [PM-41951] sponsored families email template copy (#8217) * refactor(mail-templates): update Families subscription messaging for clarity and consistency * feat(mail-templates): enhance Families subscription messaging with feature flag support - Updated email templates for existing and new accounts to include conditional messaging based on the VFO1FoundationEnabled feature flag. - Adjusted the HandlebarsMailService and related interfaces to support the new messaging logic. - Modified the FamiliesForEnterpriseOfferViewModel to include the feature flag property. - Ensured that the bulk email sending methods accommodate the new feature flag for dynamic content rendering. * refactor(mail-templates): simplify Families subscription messaging by removing feature flag conditions - Removed conditional messaging based on the VFO1FoundationEnabled feature flag from email templates for existing and new accounts. - Updated the HandlebarsMailService and related interfaces to reflect the removal of the feature flag. - Adjusted the FamiliesForEnterpriseOfferViewModel to eliminate the feature flag property. - Ensured that bulk email sending methods are streamlined without the feature flag logic. * fix(mail-templates): update Families subscription messaging for clarity - Revised text in FamiliesForEnterpriseOfferExistingAccount email templates to enhance clarity and consistency in the subscription activation message. - Changed "To activate your complimentary subscription, click the link below." to "Accept the offer to activate your complimentary plan." for improved user understanding. - Updated corresponding text template to reflect the same changes.

• MtnBurrit0(17 Aug 26)

  [SHOT-187] fix: Make database migration execution timeout configurable (#8143) * [SHOT-187] fix: Make database migration execution timeout configurable Migrations that rebuild an index on a large Event table can exceed the hardcoded five minute DbUp timeout. The whole upgrade is wrapped in a single transaction, so one slow script rolls the upgrade back and recovery needs manual SQL run against the customer database. The timeout can now be set through globalSettings__sqlServer__migrationExecutionTimeoutSeconds or the MsSqlMigratorUtility timeout option. Leaving it unset keeps the existing five minute default, so upgrades behave exactly as before. Setting it to zero applies no limit, matching sqlcmd and SqlCommand semantics. * Surface ignored and applied migration timeout values

• Jared(17 Aug 26)

  Remove unused PolicyDrawers constant from FeatureFlagKeys in Constants.cs (#8188)

• Jared(17 Aug 26)

  [PM-39422] Remove obsolete properties for organization management compatibility (#8206) * Remove obsolete properties for organization management compatibility * Enhance OrganizationUsersControllerTests by adding necessary using directives for exceptions and API models

• Jared(17 Aug 26)

  refactor(OrganizationsController): optimize GetUser method for concurrent data retrieval (#8202) Refactor the GetUser method to use Task.WhenAll for concurrent execution of organization retrieval and claiming user data, improving performance and reducing wait time for asynchronous operations.

• Jared(17 Aug 26)

  refactor(policies): replace organization repository with ability cache service in PoliciesController (#8205) Updated PoliciesController to utilize IOrganizationAbilityCacheService instead of IOrganizationRepository for fetching organization abilities. Adjusted related tests to reflect this change, ensuring proper handling of organization policies based on the new service.

• Rui Tomé(17 Aug 26)

  [PM-5108] fix: Show all owners and admins in admin portal org view (#8099) * [PM-5108] fix: Show all owners and admins in admin portal org view OrganizationViewModel was deriving an expected OrganizationUserStatusType from org.Status and filtering owners/admins to that single status. This caused confirmed owners to disappear when an org was in Pending state, which happens in the reseller flow while awaiting InitPendingOrganization. * Show organization status in admin portal org view

• Mike Amirault(17 Aug 26)

  [PM-40640] Adjust error messages for Send policy enforcement (#8196)

• Jared(17 Aug 26)

  [PM-38272] fix: handle null or empty permissions in OrganizationUserResponseModel (#8207) * fix: handle null or empty permissions in OrganizationUserResponseModel Updated the OrganizationUserResponseModel to set Permissions to null if the input is null or whitespace, ensuring proper handling of permissions data. Added JsonIgnore attribute to exclude null Permissions from JSON serialization. * refactor: simplify permissions handling in OrganizationUserResponseModel Replaced the previous permissions loading logic with a direct call to GetPermissions() method, enhancing code clarity and maintainability. Removed unnecessary null or whitespace checks for permissions.

• Rui Tomé(17 Aug 26)

  [PM-38269] refactor: remove redundant permissions round-trip in OrganizationUserUserDetailsQuery (#8119) * [PM-38269] refactor: remove redundant permissions round-trip in OrganizationUserUserDetailsQuery For each Custom-role user the query was deserializing the Permissions JSON string then immediately re-serializing it back — a no-op before the string reaches the response model, which deserializes it once anyway. Remove the three identical if (Type == Custom) blocks and the now-unused CoreHelpers import. * [PM-38269] refactor: drop dead GetOrganizationUserUserDetails method The method became a bare pass-through after the permissions round-trip was removed and has no callers in production code. Remove it from the interface and implementation, delete the unit tests that only covered it, and drop the stale stub from GetMany_Setup in the controller tests.