[PM-11404] Account Management: Prevent a verified user from purging their vault #4853

r-tome · 2024-10-04T14:58:53Z

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-11404

📔 Objective

If the Account Deprovisioning feature flag is enabled then prevent organization managed users from purging their vault.

Clients PR: bitwarden/clients#11411

⏰ Reminders before review

Contributor guidelines followed
All formatters and local linters executed and passed
Written new unit and / or integration tests where applicable
Protected functional changes with optionality (feature flags)
Used internationalization (i18n) for all UI strings
CI builds passed
Communicated to DevOps any deployment requirements
Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

👍 (:+1:) or similar for great changes
📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
❓ (:question:) for questions
🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
🎨 (:art:) for suggestions / improvements
❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
⛏ (:pick:) for minor or nitpick changes

codecov · 2024-10-04T15:08:17Z

Codecov Report

Attention: Patch coverage is 53.84615% with 18 lines in your changes missing coverage. Please review.

Project coverage is 41.75%. Comparing base (da04218) to head (684f7d5).
Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
src/Api/Auth/Controllers/AccountsController.cs	33.33%	8 Missing ⚠️
src/Api/Vault/Controllers/CiphersController.cs	0.00%	4 Missing ⚠️
...dminConsole/Controllers/OrganizationsController.cs	0.00%	3 Missing ⚠️
src/Api/Models/Response/ProfileResponseModel.cs	50.00%	0 Missing and 1 partial ⚠️
...dminConsole/Repositories/OrganizationRepository.cs	0.00%	1 Missing ⚠️
...dminConsole/Repositories/OrganizationRepository.cs	0.00%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4853   +/-   ##
=======================================
  Coverage   41.75%   41.75%           
=======================================
  Files        1363     1363           
  Lines       63914    63915    +1     
  Branches     5857     5853    -4     
=======================================
+ Hits        26685    26686    +1     
- Misses      36024    36026    +2     
+ Partials     1205     1203    -2

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

github-actions · 2024-10-04T15:44:42Z

Checkmarx One – Scan Summary & Details – 0c35bf6c-73e5-4c66-9e0d-aee075f8c0d1

New Issues

Issue	Source File / Package	Checkmarx Insight
Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
Passwords And Secrets - Generic Password	/test-database.yml: 189	Query to find passwords and secrets in infrastructure code.
Passwords And Secrets - Generic Password	/test-database.yml: 182	Query to find passwords and secrets in infrastructure code.
Passwords And Secrets - Generic Password	/test-database.yml: 185	Query to find passwords and secrets in infrastructure code.
Passwords And Secrets - Generic Password	/test-database.yml: 111	Query to find passwords and secrets in infrastructure code.
Passwords And Secrets - Generic Password	/test-database.yml: 105	Query to find passwords and secrets in infrastructure code.
Passwords And Secrets - Generic Password	/test-database.yml: 80	Query to find passwords and secrets in infrastructure code.
Passwords And Secrets - Generic Password	/test-database.yml: 69	Query to find passwords and secrets in infrastructure code.
Passwords And Secrets - Generic Password	/test-database.yml: 92	Query to find passwords and secrets in infrastructure code.
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile-k8s: 8	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 1	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 1	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 1	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 7	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile-k8s: 8	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 7	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
CSRF	/src/Api/Controllers/CollectionsController.cs: 247	Attack Vector
CSRF	/src/Api/AdminConsole/Controllers/GroupsController.cs: 238	Attack Vector
Image Version Using 'latest'	/Dockerfile: 1	When building images, always tag them with useful tags which codify version information, intended destination (prod or test, for instance), stabili...
Privacy_Violation	/src/Api/Vault/Models/Request/CipherRequestModel.cs: 169	Attack Vector
Privacy_Violation	/src/Api/Vault/Models/Request/CipherRequestModel.cs: 198	Attack Vector
SSL_Verification_Bypass	/src/Api/Auth/Models/Request/OrganizationSsoRequestModel.cs: 146	Attack Vector
SSL_Verification_Bypass	/bitwarden_license/src/Sso/Utilities/DynamicAuthenticationSchemeProvider.cs: 405	Attack Vector
SSL_Verification_Bypass	/src/Core/Utilities/CoreHelpers.cs: 140	Attack Vector
SSL_Verification_Bypass	/src/Core/Utilities/CoreHelpers.cs: 105	Attack Vector
SSL_Verification_Bypass	/src/Core/Utilities/CoreHelpers.cs: 93	Attack Vector
SSL_Verification_Bypass	/src/Core/Utilities/CoreHelpers.cs: 115	Attack Vector
Unpinned Actions Full Length Commit SHA	/release.yml: 63	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
Unpinned Actions Full Length Commit SHA	/build.yml: 548	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
Unpinned Actions Full Length Commit SHA	/build.yml: 515	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
Unpinned Actions Full Length Commit SHA	/repository-management.yml: 104	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
Unpinned Actions Full Length Commit SHA	/repository-management.yml: 111	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
Unpinned Actions Full Length Commit SHA	/build.yml: 207	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
Unpinned Actions Full Length Commit SHA	/release.yml: 44	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
Unpinned Actions Full Length Commit SHA	/_move_finalization_db_scripts.yml: 103	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
Unpinned Actions Full Length Commit SHA	/_move_finalization_db_scripts.yml: 27	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
Unpinned Actions Full Length Commit SHA	/cleanup-rc-branch.yml: 21	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
Unpinned Actions Full Length Commit SHA	/build.yml: 631	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
Unpinned Actions Full Length Commit SHA	/repository-management.yml: 119	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
Unpinned Actions Full Length Commit SHA	/build.yml: 582	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
Unpinned Actions Full Length Commit SHA	/repository-management.yml: 60	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
Healthcheck Instruction Missing	/Dockerfile: 1	Ensure that HEALTHCHECK is being used. The HEALTHCHECK instruction tells Docker how to test a container to check that it is still working
Healthcheck Instruction Missing	/Dockerfile: 1	Ensure that HEALTHCHECK is being used. The HEALTHCHECK instruction tells Docker how to test a container to check that it is still working
Healthcheck Instruction Missing	/Dockerfile: 1	Ensure that HEALTHCHECK is being used. The HEALTHCHECK instruction tells Docker how to test a container to check that it is still working
Log_Forging	/src/Notifications/Controllers/SendController.cs: 27	Attack Vector
Log_Forging	/src/Api/Vault/Controllers/CiphersController.cs: 217	Attack Vector
Log_Forging	/bitwarden_license/src/Scim/Controllers/v2/GroupsController.cs: 98	Attack Vector
Multiple RUN, ADD, COPY, Instructions Listed	/Dockerfile: 13	Multiple commands (RUN, COPY, ADD) should be grouped in order to reduce the number of layers.
Multiple RUN, ADD, COPY, Instructions Listed	/Dockerfile-k8s: 17	Multiple commands (RUN, COPY, ADD) should be grouped in order to reduce the number of layers.
Multiple RUN, ADD, COPY, Instructions Listed	/Dockerfile: 11	Multiple commands (RUN, COPY, ADD) should be grouped in order to reduce the number of layers.
Open_Redirect	/bitwarden_license/src/Sso/Controllers/AccountController.cs: 167	Attack Vector
Open_Redirect	/src/Admin/Controllers/ToolsController.cs: 490	Attack Vector
Unpinned Actions Full Length Commit SHA	/repository-management.yml: 111	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
Unpinned Actions Full Length Commit SHA	/build.yml: 631	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
Unpinned Actions Full Length Commit SHA	/repository-management.yml: 60	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
Unpinned Actions Full Length Commit SHA	/repository-management.yml: 119	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
Unpinned Actions Full Length Commit SHA	/build.yml: 515	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
Unpinned Actions Full Length Commit SHA	/build.yml: 582	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
Unpinned Actions Full Length Commit SHA	/repository-management.yml: 104	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
Unpinned Actions Full Length Commit SHA	/build.yml: 548	Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...

Fixed Issues

Severity	Issue	Source File / Package
	CSRF	/src/Api/Billing/Controllers/OrganizationsController.cs: 49
	CSRF	/src/Billing/Controllers/RecoveryController.cs: 38
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 121
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 107
	CSRF	/src/Api/AdminConsole/Controllers/PoliciesController.cs: 78
	CSRF	/src/Api/AdminConsole/Controllers/PoliciesController.cs: 61
	CSRF	/src/Billing/Controllers/StripeController.cs: 164
	CSRF	/src/Api/AdminConsole/Public/Controllers/MembersController.cs: 96
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 227
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 662
	CSRF	/src/Api/AdminConsole/Controllers/PoliciesController.cs: 78
	CSRF	/src/Api/AdminConsole/Controllers/PoliciesController.cs: 61
	CSRF	/src/Api/AdminConsole/Public/Controllers/PoliciesController.cs: 46
	CSRF	/src/Api/AdminConsole/Public/Controllers/PoliciesController.cs: 66
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 107
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 121
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 929
	CSRF	/src/Api/SecretsManager/Controllers/SecretsTrashController.cs: 32
	CSRF	/src/Api/SecretsManager/Controllers/SecretsController.cs: 79
	CSRF	/src/Api/SecretsManager/Controllers/SecretsController.cs: 128
	Heap_Inspection	/src/Core/Vault/Services/Implementations/LocalAttachmentStorageService.cs: 34
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Api/AdminConsole/Controllers/ProvidersController.cs: 72
	Log_Forging	/src/Api/AdminConsole/Controllers/ProvidersController.cs: 72
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/StripeController.cs: 164
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/StripeController.cs: 164
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Identity/Billing/Controller/AccountsController.cs: 23
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/StripeController.cs: 164
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/StripeController.cs: 164
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Api/Billing/Controllers/ProviderBillingController.cs: 52

…ging-their-vault

…rifiedUserEmailDomainAsync and refactor to return a list. Remove ManagedByOrganizationId from ProfileResponseMode. Add ManagesActiveUser to ProfileOrganizationResponseModel

…ging-their-vault

JaredSnider-Bitwarden

Auth changes LGTM!

eliykat

I have a couple of comments based on our recent discussions, but I'll still defer to @jrmccannon for the full review.

eliykat · 2024-10-09T04:16:50Z

src/Core/Services/Implementations/UserService.cs

@@ -31,6 +31,8 @@
 using File = System.IO.File;
 using JsonSerializer = System.Text.Json.JsonSerializer;

+#nullable enable


Please don't enable nullable unless you've reviewed the code to make sure its null handling is correct. In this case, you've enabled it on this entire class, but if you look at it in the Github diff, there are null warnings everywhere because the existing code doesn't handle nullable types properly.

You should enable it just for your new methods by putting #nullable enable immediately before the block of new code, and then #nullable disable immediately after. Then double check the Github diff to find and fix any null warnings.

Same for any other files here.

eliykat · 2024-10-09T04:24:02Z

src/Api/AdminConsole/Models/Response/ProfileOrganizationResponseModel.cs

+ /// The organization must be enabled and able to have verified domains.
+ /// This property is null if the Account Deprovisioning feature flag is disabled.
+ /// </remarks>
+ public bool? ManagesActiveUser { get; set; }


I think "active" is confusing here. This class doesn't have any concept of whether the user it relates to is "active" in the client-side state or not.

This class (and Organization.cs on the client-side) already relates to a specific user - it has a UserId and an OrganizationUserId. So there is no need to qualify who the user is - it's not necessarily the "active" user, it's the user that matches the UserId in this class.

I suggest taking the "active" wording out of this. Maybe UserIsManagedByOrganization?

That is fair, I'll rename it to UserIsManagedByOrganization, thanks for suggesting it.
I named it "active" because when we return this object its always in relation to the active user. You're right that it doesn't have to be though.

eliykat

My feedback has been resolved, thanks!

Not a complete review

jrmccannon

Overall, I don't see any problems with this and it is consistent with the rest of the code base. I did have one ⛏️, but its a non-blocking change.

src/Core/Services/Implementations/UserService.cs

…sManagedByAnyOrganizationAsync to not return nullable objects. Update ProfileOrganizationResponseModel.UserIsManagedByOrganization to not be nullable

…ging-their-vault

gbubemismith

Vault changes look good

…ging-their-vault

Add check for managed user before purging account

8aa3915

Merge branch 'main' into ac/pm-11404/prevent-a-verified-user-from-pur…

2654a17

…ging-their-vault

r-tome marked this pull request as ready for review October 7, 2024 09:37

r-tome requested a review from a team as a code owner October 7, 2024 09:37

r-tome requested a review from cd-bitwarden October 7, 2024 09:37

Rename IOrganizationRepository.GetByClaimedUserDomainAsync to GetByVe…

fdb4a2c

…rifiedUserEmailDomainAsync and refactor to return a list. Remove ManagedByOrganizationId from ProfileResponseMode. Add ManagesActiveUser to ProfileOrganizationResponseModel

r-tome requested review from a team as code owners October 8, 2024 17:45

r-tome requested review from jrmccannon, rr-bw and JaredSnider-Bitwarden October 8, 2024 17:45

Merge branch 'main' into ac/pm-11404/prevent-a-verified-user-from-pur…

c8da05d

…ging-their-vault

JaredSnider-Bitwarden previously approved these changes Oct 8, 2024

View reviewed changes

rr-bw removed their request for review October 8, 2024 19:00

cturnbull-bitwarden previously approved these changes Oct 8, 2024

View reviewed changes

eliykat requested changes Oct 9, 2024

View reviewed changes

r-tome added 2 commits October 9, 2024 15:26

Rename the property ManagesActiveUser to UserIsManagedByOrganization

0c6107b

Remove whole class #nullable enable and add it to specific places

6d1859f

r-tome dismissed stale reviews from cturnbull-bitwarden and JaredSnider-Bitwarden via 6d1859f October 9, 2024 15:24

r-tome requested a review from eliykat October 9, 2024 15:27

eliykat reviewed Oct 10, 2024

View reviewed changes

eliykat previously approved these changes Oct 10, 2024

View reviewed changes

r-tome mentioned this pull request Oct 10, 2024

[PM-11404] Account Management: Prevent a verified user from purging their vault bitwarden/clients#11411

Merged

jrmccannon previously approved these changes Oct 10, 2024

View reviewed changes

src/Core/Services/Implementations/UserService.cs Outdated Show resolved Hide resolved

Remove unnecessary .ToList()

d6a3a10

r-tome dismissed jrmccannon’s stale review via d6a3a10 October 10, 2024 15:26

r-tome requested a review from jrmccannon October 10, 2024 15:26

jrmccannon previously approved these changes Oct 10, 2024

View reviewed changes

eliykat reviewed Oct 10, 2024

View reviewed changes

src/Core/Services/Implementations/UserService.cs Outdated Show resolved Hide resolved

eliykat reviewed Oct 10, 2024

View reviewed changes

src/Core/Services/Implementations/UserService.cs Outdated Show resolved Hide resolved

Refactor IUserService methods GetOrganizationsManagingUserAsync and I…

ee24a91

…sManagedByAnyOrganizationAsync to not return nullable objects. Update ProfileOrganizationResponseModel.UserIsManagedByOrganization to not be nullable

r-tome dismissed jrmccannon’s stale review via ee24a91 October 11, 2024 10:06

r-tome changed the title ~~[PM-11404] Account Deprovisioning: Prevent a verified user from purging their vault~~ [PM-11404] Account Management: Prevent a verified user from purging their vault Oct 11, 2024

cturnbull-bitwarden previously approved these changes Oct 11, 2024

View reviewed changes

eliykat previously approved these changes Oct 14, 2024

View reviewed changes

r-tome requested a review from JaredSnider-Bitwarden October 14, 2024 08:56

JaredSnider-Bitwarden previously approved these changes Oct 14, 2024

View reviewed changes

Merge branch 'main' into ac/pm-11404/prevent-a-verified-user-from-pur…

0214d43

…ging-their-vault

gbubemismith previously approved these changes Oct 15, 2024

View reviewed changes

Update error message when unable to purge vault for managed account

cfec28e

r-tome dismissed stale reviews from gbubemismith, cturnbull-bitwarden, JaredSnider-Bitwarden, and eliykat via cfec28e October 15, 2024 11:00

r-tome requested review from jrmccannon, gbubemismith, cturnbull-bitwarden and JaredSnider-Bitwarden October 15, 2024 11:00

cturnbull-bitwarden approved these changes Oct 15, 2024

View reviewed changes

JaredSnider-Bitwarden approved these changes Oct 15, 2024

View reviewed changes

gbubemismith approved these changes Oct 16, 2024

View reviewed changes

jrmccannon approved these changes Oct 17, 2024

View reviewed changes

Merge branch 'main' into ac/pm-11404/prevent-a-verified-user-from-pur…

684f7d5

…ging-their-vault

r-tome merged commit d6cd73c into main Oct 17, 2024
103 checks passed

r-tome deleted the ac/pm-11404/prevent-a-verified-user-from-purging-their-vault branch October 17, 2024 15:06

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[PM-11404] Account Management: Prevent a verified user from purging their vault #4853

[PM-11404] Account Management: Prevent a verified user from purging their vault #4853

r-tome commented Oct 4, 2024 •

edited

Loading

codecov bot commented Oct 4, 2024 •

edited

Loading

github-actions bot commented Oct 4, 2024 •

edited

Loading

JaredSnider-Bitwarden left a comment

eliykat left a comment

eliykat Oct 9, 2024

eliykat Oct 9, 2024

r-tome Oct 9, 2024

eliykat left a comment

jrmccannon left a comment

gbubemismith left a comment

[PM-11404] Account Management: Prevent a verified user from purging their vault #4853

[PM-11404] Account Management: Prevent a verified user from purging their vault #4853

Conversation

r-tome commented Oct 4, 2024 • edited Loading

🎟️ Tracking

📔 Objective

⏰ Reminders before review

🦮 Reviewer guidelines

codecov bot commented Oct 4, 2024 • edited Loading

Codecov Report

github-actions bot commented Oct 4, 2024 • edited Loading

New Issues

Fixed Issues

JaredSnider-Bitwarden left a comment

Choose a reason for hiding this comment

eliykat left a comment

Choose a reason for hiding this comment

eliykat Oct 9, 2024

Choose a reason for hiding this comment

eliykat Oct 9, 2024

Choose a reason for hiding this comment

r-tome Oct 9, 2024

Choose a reason for hiding this comment

eliykat left a comment

Choose a reason for hiding this comment

jrmccannon left a comment

Choose a reason for hiding this comment

gbubemismith left a comment

Choose a reason for hiding this comment

r-tome commented Oct 4, 2024 •

edited

Loading

codecov bot commented Oct 4, 2024 •

edited

Loading

github-actions bot commented Oct 4, 2024 •

edited

Loading