* Implement error handling for suspended organizations in CipherForm component
- Added a new error message for when an item cannot be saved due to the associated organization being suspended.
- Updated the CipherForm component to check the status of the target organization before saving, displaying an error toast if the organization is suspended.
- Updated localization files for browser, desktop, and web to include the new error message.
* Refactor cipher creation logic to handle suspended organizations
- Removed the error message for saving items when the organization is suspended from localization files.
- Updated various components to check if a cipher can be created based on the organization's status, ensuring that new items cannot be saved to suspended organizations.
- Enhanced the user interface to conditionally display options for creating ciphers based on the organization's enabled state.
- Improved overall error handling and user experience when interacting with organizations in the vault.
* Enhance cipher creation logic to account for organization status
- Introduced checks across various components to determine if a cipher can be created based on the organization's enabled state.
- Added tests to verify behavior when organizations are suspended, ensuring that no cipher options are displayed or actions are allowed in such cases.
- Updated the NewItemDropdown and AddItemGrid components to conditionally render options based on the canCreateCipher input.
- Improved overall error handling and user experience when interacting with vault items related to organizational status.
* Implement organization status checks in vault components
- Added logic to disable creation buttons across various components when the organization is suspended, enhancing user experience by preventing actions that cannot be completed.
- Integrated tooltip messages to inform users why certain actions are disabled, improving clarity.
- Updated imports to include TooltipDirective where necessary to support new tooltip functionality.
- Ensured consistent handling of organization status across the vault interface, aligning with recent changes to cipher creation logic.
* Implement Automatic App Login Policy v2 and associated components
- Added a new description for the v2 version of the Automatic App Login policy in the localization file.
- Introduced `AutomaticAppLoginPolicyV2Component` with updated UI elements, including a switch for enabling the policy.
- Created story files for both the original and v2 components to facilitate visual testing.
- Updated the main policy component to reference the new v2 variant and its description.
- Added unit tests for the new policy component to ensure functionality and integration with existing services.
* Refactor automatic app login component layout by simplifying the HTML structure and removing unnecessary grid elements. Update related tests to reflect the changes in the component structure.
* Migrate from @angular/platform-browser-dynamic to @angular/platform-browser
@angular/platform-browser-dynamic has been marked as deprecated
* Remove @angular/platform-browser-dynamic as a direct dependency, but keep it as a peerDependency
* Remove @angular/platform-browser-dynamic from renovate updates, as it will get updated/removed by it's peer dependencies
---------
Co-authored-by: Daniel James Smith <djsmith85@users.noreply.github.com>
Adds a passkey report that shows users which of their logins could be upgraded with passkey authentication but haven't been yet. It pulls a directory of passkey-capable services from the server, matches them against the user's login items by domain, and flags any that are missing FIDO2 credentials. The report shows whether each service supports passwordless login, MFA, or both, and links out to setup instructions where available. There's an individual version that covers your personal vault and org memberships (with filtering), and an org-level version for admins. Requires premium and the PasskeyLoginReport feature flag.
* Implement AvatarIdPipe for consistent avatar identification across components and update usages in member dialogs and lists. Add tests for AvatarIdPipe and resolveAvatarId utility function to ensure correct behavior.
* Add AvatarIdPipe to bulk confirm and remove dialog components for enhanced avatar handling
* Refactor AvatarIdPipe and resolveAvatarId utility function documentation for clarity and conciseness. Remove redundant comments while retaining essential information about avatar id resolution.
* add new design for edit member dialog
* fix test
* fix stories
* replace radios, fix more actions, clean up design
* fix created date, update stories
* fix stories
* move sm check box
Uses Vfo1TerminologyService to gate the label behind the VFO1Foundation
feature flag, showing "New vault" when enabled and "New organization" otherwise.
Adds the "newVault" i18n key and unit tests covering both flag states and
the SingleOrg policy suppression of the add action.
Introduce a bitMenuClose marker directive: clicking an element (or descendant)
carrying it closes the enclosing bit-menu. bitMenuItem applies it automatically
via hostDirectives, so standard menu items keep closing as before. The menu now
detects the marker via a data attribute instead of emitting closed on every
content click, so non-item content (search fields, checkboxes, section headers)
no longer dismisses the menu unexpectedly.
Add bitMenuClose to the product-switcher's plain navigation links, which are not
bitMenuItems, to preserve their close-on-click behavior.
* feat: User is no longer logged out when their email is changed. This must be behind a feature flag until salt and email are seperated.
Addressed tech-debt as well enforcing strict typing, signals, and onPush for all components in this PR.
Updated multiple bulk dialog components to enhance the rendering of user avatars by incorporating the userId and avatarColor properties. This change ensures consistent avatar display across the application, improving user experience and visual coherence.
Add base English keys (sharedFolder, sharedFolders, myFolder, myFolders)
to the web, browser, desktop, and CLI en/messages.json files. Existing
collection*/folder* keys are preserved intact for rollback.
* Add AutoConfirmPolicy V2 component and associated templates
- Introduced AutoConfirmPolicyEditV2Component to handle the v2 experience for the auto-confirm policy, featuring a new layout and risk acceptance mechanism.
- Added HTML templates for the v2 component, including step content and footer.
- Updated AutoConfirmPolicy to reference the new v2 component.
- Created Storybook stories for both modal and drawer experiences of the auto-confirm policy.
- Enhanced tests to ensure proper rendering and functionality of the new v2 component.
This update aims to improve the user experience by clearly separating the v1 and v2 flows while maintaining shared logic where applicable.
* Enhance AutoConfirmPolicy integration in Storybook
- Added necessary providers for AutoConfirmPolicy in the policy drawer story to prevent NullInjectorError during component creation.
- Updated AutoConfirmPolicy class to explicitly type the v2 property, ensuring compatibility with the base class structure.
- Made the riskAccepted control public in AutoConfirmPolicyEditV2Component for direct test access.
These changes improve the stability and testability of the AutoConfirmPolicy components in the Storybook environment.
* Fix AutoConfirmPolicy behavior to reset switch value on risk un-acceptance
- Added a regression test to ensure that un-accepting risk after enabling the policy correctly resets the switch value to false, preventing the policy from being saved as enabled.
- Updated the AutoConfirmPolicyEditV2Component to set the switch value to false when the risk is unchecked, addressing a potential issue where a disabled FormControl could still return a true value.
These changes enhance the integrity of the policy management process by ensuring that the UI state accurately reflects the underlying data model.
* Remove redundant comments in AutoConfirmPolicyEditV2Component to streamline code readability and maintainability.
* Add UriMatchDefaultPolicy components and stories
- Introduced UriMatchDefaultPolicy and its v2 variant, enhancing the policy management experience.
- Created corresponding HTML template for the v2 component, featuring a switch for enabling the policy.
- Added unit tests for the UriMatchDefaultPolicy to ensure correct behavior and integration.
- Developed Storybook stories for both the default and v2 components to facilitate visual testing and documentation.
- Updated localization files to include descriptions for the new policy variants.
* Refactor URI match options rendering in policy edit component
Updated the HTML template for the URI match detection options in the policy edit component to use a new syntax for rendering options. This change enhances readability and maintainability of the code.
- Introduced mockBillingConstraintService to simulate seat limit checks.
- Added mockOrganizationMetadataService for organization metadata handling.
- Updated shared decorators to include these new mock services for testing purposes.
* add comma seperated SR only span
* ensure space chars are announced
* add missing key to story
* add missing i18n mock key
* show sr-only if showCount is false
* PM-38137 - Per-provider 2FA request and response models on client
Mirror the server-side per-provider model rewrite on the client:
- Existing PUT/DELETE setup request models drop SecretVerificationRequest
inheritance and become standalone with explicit userVerificationToken
fields. two-factor-email.request keeps its inheritance because it also
serves the login flow.
- New per-provider delete request models (YubiKey, Duo, Email,
OrganizationDuo, WebAuthn delete-all) — token-only shape mirroring
the server.
- Authenticator delete request file/class renamed from
disable-two-factor-authenticator to delete-two-factor-authenticator
to match server naming.
- New TwoFactorWebAuthnChallengeResponse wrapper around the FIDO2
options + minted token (replaces the bare ChallengeResponse payload
from get-webauthn-challenge).
- Response models for Duo, Email, WebAuthn, and YubiKey gain
userVerificationToken.
- Obsolete two-factor-provider.request deleted (no remaining consumers
after the disable-model rewrite).
* PM-38137 - Expose per-provider delete methods on 2FA service layer
Both TwoFactorApiService and TwoFactorService (abstractions and
implementations) pick up:
- New methods deleteTwoFactorYubiKey, deleteTwoFactorDuo,
deleteTwoFactorEmail, deleteTwoFactorOrganizationDuo, and
deleteTwoFactorWebAuthnAll routing to the corresponding per-provider
DELETE endpoints.
- Removal of legacy putTwoFactorDisable and
putTwoFactorOrganizationDisable (server endpoints are gone).
- Updated return type on getTwoFactorWebAuthnChallenge to the new
TwoFactorWebAuthnChallengeResponse wrapper.
DefaultTwoFactorApiService spec: legacy put*Disable tests removed,
five new deleteTwoFactor* tests added, WebAuthn challenge test asserts
the new wrapper.
* PM-38137 - Thread UV token through web 2FA setup components
Per-provider setup components (Authenticator, YubiKey, Duo, Email,
WebAuthn) instantiate request models directly, cache the user
verification token from the GET response, and thread it through every
PUT / DELETE / setup-POST call. Each component implements its own
disableMethod against the appropriate per-provider DELETE endpoint:
- Authenticator, YubiKey, Email each call their corresponding
deleteTwoFactor* method.
- Duo branches on organizationId between deleteTwoFactorDuo and
deleteTwoFactorOrganizationDuo (the component is shared between
personal Duo and OrgDuo setup).
- WebAuthn's "Disable All Keys" button calls
deleteTwoFactorWebAuthnAll (single round-trip; server-side handles
the wipe atomically). Per-credential remove continues to use
deleteTwoFactorWebAuthn.
- WebAuthn challenge consumer reads options + userVerificationToken
from the new wrapper response.
Base setup component disableMethod becomes protected abstract — every
subclass provides its own override. Parent settings page stops
rendering the lapsed-premium-only secondary "Disable" button; the
standard "Manage" button is now enabled for lapsed-premium users on
already-enrolled premium providers, so the same GET → DELETE flow
handles them.
* PM-38137 - Preserve lapsed-premium 2FA disable shortcut on settings list
Restores the dedicated "Disable" button shown on the 2FA settings list
when a user has lost premium but still has an enrolled premium provider
(YubiKey or Duo), and restores the disabled "Manage" button for
unenrolled premium providers — i.e., the exact UX present before this
branch.
Under the hood the shortcut now uses the new per-provider DELETE
architecture: in the user-verification dialog's verificationFn the
component calls the per-provider GET (now non-premium-gated) to mint a
UV token, then the per-provider DELETE with that token. Two server
round-trips behind one UV dialog interaction.
Avoids the regression where the standard manage flow would have opened
the full provider configuration screen to a lapsed-premium user and
let them attempt to add more keys before failing at PUT-time on the
server.
* PM-38137 - Add TODO to get rid of base 2FA setup component.
* PM-38137 - Rename 2FA update request models to TwoFactor<Provider>Update shape
Aligns every client 2FA update request-model class to the file-wide
TwoFactor<Provider> prefix already used by the Delete family:
UpdateTwoFactorAuthenticatorRequest -> TwoFactorAuthenticatorUpdateRequest
UpdateTwoFactorDuoRequest -> TwoFactorDuoUpdateRequest
UpdateTwoFactorYubikeyOtpRequest -> TwoFactorYubiKeyUpdateRequest
UpdateTwoFactorEmailRequest -> TwoFactorEmailUpdateRequest
UpdateTwoFactorWebAuthnRequest -> TwoFactorWebAuthnUpdateRequest
UpdateTwoFactorWebAuthnDeleteRequest -> TwoFactorWebAuthnDeleteRequest
The YubiKey rename also aligns the class name with the TwoFactorProviderType
enum value (YubiKey, not YubicoOtp). No HTTP route or wire-shape changes.
* PM-38137 - Split Email 2FA request models by flow
The shared TwoFactorEmailRequest split into purpose-specific models:
- TwoFactorEmailLoginRequest (anonymous login flow, secret-based) drops
the userVerificationToken field that the server-side login model no
longer accepts.
- TwoFactorEmailSetupRequest (authenticated setup-send, token-only:
email + userVerificationToken). postTwoFactorEmailSetup now takes this
narrower shape instead of the union.
* PM-38137 - Guard cached UV token against null overwrite on PUT response
Only PUT responses that re-mint a user-verification token should
overwrite the cached value on the component. Without the guard, a PUT
response with a null token clobbers the live token from the prior GET,
breaking any follow-up DELETE that still runs against the same component
instance.
Matches the existing guard pattern in two-factor-setup-webauthn.component.ts.
* PM-38137 - Refactor 2FA request DTOs to constructor parameters
Convert the 13 per-provider 2FA request models added in this branch from
field-assignment classes (with `!` definite-assignment assertions) to
constructor-parameter classes. Callers now pass every required field at
construction; missing fields become compile-time errors instead of silent
`undefined` payloads.
Consumers updated:
- apps/web/src/app/auth/settings/two-factor/two-factor-setup-{authenticator,duo,email,webauthn,yubikey,}.component.ts
- libs/common/src/auth/two-factor/services/default-two-factor-api.service.spec.ts
* PM-38137 - Add 2FA provider Details and per-action response classes
Client mirror of the new server response shapes. Adds:
- TwoFactor<Provider>DetailsResponse — five per-provider Details types
(Authenticator, Duo, Email, WebAuthn, YubiKey) carrying the shared
provider state used by both GET and Update response wrappers.
- TwoFactor<Provider>UpdateResponse — five per-endpoint PUT responses,
one per provider, each composing the matching Details type with no
user-verification token slot.
- TwoFactorOrganizationDuoResponse / TwoFactorOrganizationDuoUpdateResponse —
split from the user-scoped Duo wrappers so the two scopes can evolve
independently while sharing the inner TwoFactorDuoDetails.
- TwoFactorWebAuthnDeleteResponse — returned by the per-credential
WebAuthn DELETE; the updated credentials list travels in the body.
No service-surface or component wiring yet; those land in the next
commits.
* PM-38137 - Extract WebAuthn challenge response class and rename for clarity
The FIDO2 credential-creation options class previously lived inside
two-factor-web-authn.response.ts under the generic name
ChallengeResponse, which read like it could be any challenge response.
Moves the class to its own file (web-authn-challenge.response.ts) and
renames it to WebAuthnChallengeResponse so its scope is obvious at
every read site.
Touches the 2FA WebAuthn challenge wrapper (TwoFactorWebAuthnChallengeResponse)
and both passkey-login consumers (WebauthnLoginCredentialCreateOptionsResponse,
CredentialCreateOptionsView) to import the renamed type from its new
home.
* PM-38137 - Refactor 2FA service surface and components to per-action response types
Wires the client to the new per-action response shapes. The five
existing TwoFactor<Provider>Response classes are repurposed as the GET
response wrappers — each composes a TwoFactor<Provider>DetailsResponse
plus the freshly-minted user-verification token.
Service surface updated:
- DefaultTwoFactorApiService.getTwoFactor<Provider> returns the GET
wrapper; put returns the matching *UpdateResponse.
- The six hard-delete methods return Promise<void> and pass
hasResponse: false to ApiService.send — the matching server endpoints
now return 204 No Content with no body. deleteTwoFactorWebAuthn
(per-credential) keeps a body and returns TwoFactorWebAuthnDeleteResponse.
- TwoFactorService pass-through and abstractions updated to match.
- TwoFactorResponse discriminated union updated to reference the
per-provider GET response classes (plus TwoFactorOrganizationDuoResponse).
Web setup components updated:
- processResponse split into per-action handlers (GET, Update, Delete
where applicable) so each handler reads from the nested data
property on its specific response type.
- The runtime `if (response.userVerificationToken)` cache guard from
PM-38137-prior is dropped — the GET response type now guarantees the
token non-optionally, and Update/Delete response types carry no token
slot at all.
- DTO read sites updated from flat (`response.host`) to nested
(`response.duo.host`) across all five providers.
- The admin-console organization parent setup component is updated for
the new TwoFactorOrganizationDuoResponse name.
* PM-38137 - Move 2FA request/response models into two-factor feature folder
Relocates 2FA request and response model files from the convention folders
(libs/common/src/auth/models/{request,response}/) into the two-factor feature
folder, per the libs/common/src/auth/CLAUDE.md rule that new auth code belongs
in feature folders. Adds request/ and response/ barrels and re-exports them
from the two-factor index. Updates consumer imports across web, cli,
libs/auth, and libs/common.
Leaves identity-two-factor.response.ts (login-flow response, identity-token
group) and web-authn-challenge.response.ts (shared with webauthn-login)
in place to avoid cross-feature coupling.
* PM-38137 - Align authenticator delete request naming with sibling DTOs
Renames DeleteTwoFactorAuthenticatorRequest to TwoFactorAuthenticatorDeleteRequest
(file: two-factor-authenticator-delete.request.ts) so the authenticator delete
request matches the TwoFactor<Provider>Delete shape used by the duo, email,
yubikey, web-authn, and organization-duo deletes.
* PM-38137 - Move 2FA type aliases into two-factor feature folder with clearer names
Relocates the 2FA type aliases out of the convention folder
(libs/common/src/auth/types/) and into the two-factor feature folder per the
libs/common/src/auth/CLAUDE.md feature-folder rule. Renames the types so they
describe what they actually are: AuthResponseBase becomes
TwoFactorUserVerificationResult (the master-password/OTP verification proof
threaded into 2FA management request DTOs) and AuthResponse<T> becomes
TwoFactorSetupDialogData<T> (the payload passed as DIALOG_DATA into per-
provider 2FA setup dialogs). Consumers now import from the
@bitwarden/common/auth/two-factor barrel.
* PM-38137 - Correct 2FA dialog-data type docs to match constructor-param flow
TwoFactorUserVerificationResult feeds the initial GET / WebAuthn challenge POST
that mints the user-verification token, not the per-provider PUT/DELETE
endpoints — those take the cached UV token string directly. Also clarifies
that TwoFactorSetupDialogData<T> is the return type of TwoFactorVerifyDialog
before being forwarded as DIALOG_DATA to the per-provider setup dialogs.
* PM-38137 - Split TwoFactorUserVerificationResult into its own file
Extracts TwoFactorUserVerificationResult from two-factor-setup-dialog-data.ts
into two-factor-user-verification-result.ts so each type lives in its own
file. Consumers continue to import from the @bitwarden/common/auth/two-factor
barrel and are unchanged.
* PM-38137 - Convert two-factor API service imports to relative paths
Restores relative imports inside the three two-factor API service files
to match the pattern that landed on main. Sibling two-factor service files
were already relative; these three drifted to absolute @bitwarden/common
paths during the refactor.
* PM-38137 - Drop !: on cached userVerificationToken in 2FA setup components
Replaces the definite-assignment assertion on the cached
userVerificationToken with an honest string | undefined type and a
requireUserVerificationToken() helper that throws if the field hasn't
been populated yet. Aligns with the typescript-strict ADR (!: is reserved
for required @Input properties) and turns a silent undefined-into-request
hazard into an explicit runtime error. The base-class composition refactor
tracked by PM-39385 will eventually eliminate the cached field entirely.
* PM-38137 - Rename applyXxxState param to details for clarity
The applyXxxState helpers in the Duo, Email, WebAuthn, and YubiKey setup
components took a TwoFactorXxxDetailsResponse but named the parameter after
the wrapper field (yubiKey, duo, emailData, webAuthn), which made accesses
like yubiKey.key1 read as if poking the wrapper rather than the details.
Renames the parameter to details across all four; the enclosing function
name already establishes which provider it is.
* PM-38137 - 2FA Setup comp base - add TODO
* PM-38137 - Prefix applyXxxState param with provider name
Renames the applyXxxState parameter from details to <provider>Details in
the Duo, Email, WebAuthn, and YubiKey setup components. Trades a few extra
characters per access for clearer reading at the call site
(e.g. yubiKeyDetails.key1 over details.key1).
* PM-38137 - Rename applyXxxState to applyXxxDetails in 2FA setup components
The applyXxxState helpers project a per-provider details payload into
local form controls and display flags; "State" misleadingly suggested
writes to the app's state framework. Renames to applyXxxDetails across
authenticator, duo, email, webauthn, and yubikey setup components.
* PM-38137 - Run prettier on 2FA setup/verify components
* PM-38137 - Reword 2FA delete doc strings to drop stale disable verbiage
Updates the per-provider delete docstrings on the 2FA service abstractions
and one inline WebAuthn comment that still described the operation as
"disabling the provider" — the operation is a hard delete, not a soft
disable. User-facing UI strings (the "Disable" button label, dialog
title) and method names that mirror that UI concept are unchanged.
* PM-38137 - Inline processUpdate/processDeleteResponse pass-throughs
Removes the processUpdateResponse and processDeleteResponse helpers
in the 5 2FA setup components — each body was a single-line wrapper
that called applyXxxDetails(response.xxx). Call sites now apply the
details directly, which makes the unwrap visible inline. The
processGetResponse helper stays because it bundles two coordinated
steps (cache user-verification token + apply details).
Also drops now-unused TwoFactor*UpdateResponse imports in each file.
* PM-38137 - Replace endpoint-fragile 2FA response docstrings with single sentences
Each 2FA wrapper response file had a docstring naming the specific server
endpoint that produced it (e.g. \`POST /two-factor/get-authenticator\`),
which breaks the moment the server renames an endpoint. Replaces with
one-sentence descriptions that describe what the response represents —
no endpoint coupling.
* PM-38137 - Replay UV token on get-webauthn-challenge client call
Switches the WebAuthn challenge client call from a single-use
SecretVerificationRequest to the new TwoFactorWebAuthnChallengeRequest
carrying the cached user-verification token minted by
getTwoFactorWebAuthn. Drops the now-stale userVerificationToken field
from TwoFactorWebAuthnChallengeResponse — the original token stays
valid through the subsequent PUT. Fixes the passwordless (TDE /
Key Connector) WebAuthn enrollment failure where the second use of
the OTP was rejected.
* PM-38137 - Guard cached UV token in 2FA authenticator setup component
Adds the requireUserVerificationToken() helper already present in the
duo/email/webauthn/yubikey setup components. Authenticator was the
only setup component still passing the raw string | undefined field
into request DTOs — silently allowed only because the file is
@ts-strict-ignore. The helper throws if the token wasn't populated,
keeping all five components consistent.
---------
Co-authored-by: Patrick-Pimentel-Bitwarden <ppimentel@bitwarden.com>
* PM-39905 - Restructure organization-invite into subfolders with barrel imports
Split the flat feature folder into nested subfolders. Services get the
abstraction at the top with a nested implementations/ folder for the
default impl, its spec, and the state file. Models live in their own
subfolder. The state file also picks up the .state.ts naming convention.
External consumers now import through the root barrel per the auth
CLAUDE.md convention rather than deep-importing individual files.
Piggy-backed rename: OrganizationInviteService.getInvitePolicies ->
getOrgPoliciesForInvite. Mirrors getMasterPasswordPolicyOptionsForInvite
and is clearer about what the method returns.
* PM-39905 - Update organization-invite-flows doc for restructured paths + rename
Refresh the companion design doc to match this PR's changes:
- Source-file links point at the new subfolder locations (models/,
services/implementations/).
- getInvitePolicies references updated to getOrgPoliciesForInvite.
* PM-39905 - Expand organization-invite-flows doc with Key Connector SSO path
Add a third SSO subsection covering Key Connector JIT-provisioned users, plus
the corresponding member-decryption-option bullet under "The two acceptance
models". Rename "Why two cleanup points" -> "Why three cleanup points".
Also correct the MP command name to FinishSsoJitProvisionMasterPasswordCommand
(the prior SetInitialMasterPasswordCommand was renamed server-side and is now
marked [Obsolete]).
Notes the latent divergence in the KC path: neither the base component nor
the web override calls clearOrganizationInvite(), and fullSync doesn't touch
ORGANIZATION_INVITE_DISK, so the stashed invite persists on disk after
acceptance. Self-heals via subsequent overwrite or the email-mismatch guard.
---------
Co-authored-by: Patrick-Pimentel-Bitwarden <ppimentel@bitwarden.com>
* feat(platform): add Region.Gov and Gov entry to PRODUCTION_REGIONS [PM-38018]
Adds Gov: "Gov" to the Region const object (between EU and SelfHosted)
and appends a third entry to PRODUCTION_REGIONS alongside US and EU.
The CloudRegion type (Exclude<Region, "Self-hosted">) automatically
includes Gov.
The Gov entry uses bitwarden-gov.com as its domain with all subdomain
URLs explicit. The send URL is stored bare (no trailing /#/) per the
convention established by PM-2588 — getSendUrl() appends the hash at
read time.
Region.Gov is the foundational constant for the GovMode / FedRAMP cloud
environment work tracked under PM-35087. Flag-gated visibility in the
environment selector is introduced separately in PM-38019 via
AvailableRegionsService; this commit deliberately makes the region
unconditionally returned by EnvironmentService.availableRegions().
DEFAULT_MARKETING_EMAILS_PREF_BY_REGION in registration-start.component
gets a Gov: false entry to satisfy the Record<Region, boolean> type.
* feat: introduce AvailableRegionsService for runtime region filtering
Creates AvailableRegionsService and DefaultAvailableRegionsService in
libs/common/src/platform/. The service exposes availableRegions$, a
flag-gated Observable that wraps EnvironmentService.availableRegions()
and filters Region.Gov by the FedRampGovRegion feature flag. US and EU
are always present regardless of flag state.
EnvironmentService cannot hold this filter directly: ConfigService
depends on EnvironmentService to resolve API URLs, so wiring the
feature-flag check into EnvironmentService would create a circular
dependency. AvailableRegionsService sits above both and composes them.
The implementation uses startWith(false) so Gov is hidden until the flag
value arrives from the server. This avoids a flicker where Gov would
briefly appear during cold start before the flag resolves.
Registered in the renderer Angular DI module (covers web and desktop
renderer), the browser background script, and the CLI service container.
apps/desktop/src/main.ts intentionally excludes the service: no
main-process consumer needs a flag-gated region list, and desktop main
does not construct ConfigService, so registering here would require a
feature-flag shim to satisfy a constructor dependency with no consumer.
The accompanying spec covers four behaviors: Gov inclusion when the flag
is true, Gov exclusion when the flag is false, Gov exclusion on the
initial startWith(false) seed before the flag emits, and the US/EU
invariant across both flag states. Asserts inspect the last emission of
a take(2) window rather than firstValueFrom because the startWith(false)
seed always emits first regardless of the flag value, so asserting the
first emission would falsely pass for the wrong reason.
The selector-component migration that consumes this service lands in
a follow-up commit on the same branch. Shipping both in one PR closes
the release window where Gov could leak into the environment selector
because unmigrated selectors read EnvironmentService.availableRegions()
directly and never observe the flag.
* refactor(auth): migrate environment selector components to AvailableRegionsService
Migrates the three environment-selector components from
EnvironmentService.availableRegions() to AvailableRegionsService.
availableRegions$. Each component receives AvailableRegionsService via
constructor injection and replaces the synchronous availableRegions
array with the flag-gated Observable. All three templates switch from
synchronous-field iteration to the | async pipe.
The web selector resolves currentRegion synchronously via
EnvironmentService.availableRegions() rather than the flag-gated stream,
because origin validation must succeed regardless of flag state. The dropdown
options continue to use availableRegions$ | async. This pattern matches the
JSDoc guidance on AvailableRegionsService: the service is the UI display
source, while EnvironmentService.availableRegions() is the source for URL
resolution, origin validation, and stored-region rehydration.
The shared and registration components use combineLatest to pair the
flag-gated region list with the active-environment stream so
selectedRegion$ stays in sync with changes to either source. The
registration component's Environment import becomes unused after
combineLatest infers the type that the previous map(env: Environment)
annotation required, and is removed to satisfy ESLint's
@typescript-eslint/no-unused-vars rule.
Shipping this migration in the same PR as the AvailableRegionsService
introduction closes the release window where Gov could leak into any
client's environment selector. Unmigrated selectors read
EnvironmentService.availableRegions() directly and would surface Gov
unconditionally; migrating them in this PR makes the FedRampGovRegion
flag the single gate for selector visibility.
These three components live in Auth-owned paths
(libs/angular/src/auth/, apps/web/src/app/components/, and
libs/auth/src/angular/registration/). Auth is a required reviewer on
this PR.
* fix(auth): provide AvailableRegionsService mock in stories
* fix(auth): align env-picker dropdown icon vertically
The trigger's <bit-icon bwi-angle-down> renders inline-block with
vertical-align: baseline, which hangs below the baseline of the
line box. Combined with bitLink's tw-leading-none, this clipped
the text descenders of the "Accessing:" label on desktop and
browser login footers.
Adding tw-align-middle to the icon restores normal line-box
metrics and eliminates the clipping.
Root cause latent since PR #18816 migrated the trigger icon from
<i class="bwi"> to <bit-icon>. Web is unaffected because its
trigger uses an inline-flex <a bitLink>. This fix is
flag-independent — FedRampGovRegion only gates dropdown contents,
not the trigger label.
Refs: PM-39401
* Revert "fix(auth): align env-picker dropdown icon vertically"
This reverts commit 2d51461be9.
---------
Co-authored-by: kmancusi0105 <kmancusi@bitwarden.com>
* adding new toggle group styles
* add toggle responsive behavior
* use bit-icon
* updated documentation
* updated type caused error on empty string. Change do undefined
* fix tests. add label
* fix stale rendering possiblity
* fix label a11y bug. Tighten up comments
* more concise variable names
* skip contrast tests
* add internal comment
* migrate consumer toggles to use label input
* add metaData to option. Fix truncation broken after merge conflict
* fix type errors and expose options via signal
* fix tests
* mark toggle group as internal
* fix berries showing with no value in toggles
* revert selected to non-required input
* remove classes causing toggles to render at full width
* ensure toggle is set to first value if selected is undefined
* merge main and resolve conflict
* bring back truncation removed in merge conflict
* fix desktop divider and border not appearing
* label toggle groups to address a11y concerns
* Refactor policy definitions to remove deprecated versions and streamline components
- Removed unused policy versions (MasterPasswordPolicyV2, OrganizationDataOwnershipPolicyV2, PasswordGeneratorPolicyV2, ResetPasswordPolicyV2) from policy-edit definitions.
- Updated policy classes to include v2 components directly, ensuring the latest versions are utilized in the policy editor.
- Enhanced MultiStepPolicyEditDialog to prefer v2 components when available, improving the user experience with updated policy features.
- Added tests for new policy definitions and their components to ensure proper functionality and integration.
* Enhance MultiStepPolicyEditDialog to support v2 components and improve UI behavior
- Updated policy definitions to utilize v2 components directly, enhancing the user experience with improved dialog appearances.
- Removed the `showEnabledBadge` property from policy definitions, streamlining the component configuration.
- Implemented logic in MultiStepPolicyEditDialog to conditionally render the v2 component based on the dialog's state (drawer/modal).
- Added tests to verify the new v2 behavior and ensure proper rendering of components in different dialog states.
* Enhance policy definitions and MultiStepPolicyEditDialog behavior
- Updated MasterPasswordPolicy and OrganizationDataOwnershipPolicy to ensure proper handling of descriptions for v1 and v2 components.
- Modified MultiStepPolicyEditDialog to correctly render descriptions based on the active policy version, preventing v2 overrides from hiding v1 descriptions.
- Added tests to verify the correct behavior of description rendering in both v1 and v2 scenarios, ensuring consistent user experience across dialog states.
* Refactor policy dialog components and enhance testing for v2 behavior
- Updated policy dialog helper to streamline the rendering of modal and drawer components based on the `PolicyDrawers` feature flag.
- Introduced new stories for various policies to ensure visual consistency and catch potential design leaks between v1 and v2 components.
- Added regression tests for `MultiStepPolicyEditDialogComponent` to verify that v2 UI does not leak into the v1/modal experience.
- Enhanced existing policy definitions to utilize the updated dialog structure, ensuring a consistent user experience across different policy types.
* Refactor policy story definitions to enforce title requirements
- Updated policy story definitions to remove dynamic title assignment in favor of explicit string literals, ensuring compliance with Storybook v7+ requirements.
- Enhanced documentation within the policy dialog helper to clarify the necessity of setting titles directly in story files.
- Streamlined the creation of modal and drawer stories for various policies, improving consistency and maintainability across the codebase.
* feat(policies): inject EncryptService for policy metadata encryption in policy drawer story helper
* clean up types, fix tests
* update types
* update to SDK types
* refactor to use SDK client implementation
* bump SDK version
* refresh lock file
* Revert "refresh lock file"
This reverts commit bc32946128.
* update models for milestone 3 future work
* clean up
* more clean up
* add supportConfirmation to refresh, update doc
* clean up
* remove supportsConfirmation from update code path, rename
* fix test failures
* fix story
* Direct Keeper importer UI and a dummy access module (WIP)
* Add Keeper importer impl, fix it to run in the browser not node (WIP)
* Add request logging to Keeper client
* Auto-close Keeper device approval dialog on websocket notification
When user approves their device via email link, the websocket receives a
device_verified notification. Previously the dialog remained open requiring
manual dismissal. Now the dialog closes automatically when approval succeeds.
* Remove Continue button from Keeper device approval dialog
The button did not actually do anything useful since approval happens via
email link click. Updated dialog to show a message that it will close
automatically. Added missing Keeper i18n messages to web app.
* Add device approval method selection dialog for Keeper import
- Created KeeperApprovalMethodSelectComponent to let user choose between
Email and Keeper Push approval methods
- Removed TwoFactor from DeviceApprovalChannel (not supported yet)
- Show waiting dialog for Keeper Push approval (was missing)
- Added i18n messages for approval method selection
- Added debug logging for push requests
* Add Keeper data center region selection dropdown
- Added region dropdown with US, EU, AU, CA, JP, US (GOV) options
- Region is passed to Keeper client when opening vault
- Updated test script to select EU region
- Added i18n messages for region label
* Add verification code input to Keeper device approval dialog
Users can now either click the approval link in the email or enter the
6-digit verification code directly in the dialog. Both methods work to
approve the device and continue the import flow.
* Fix AES-CBC no-padding decryption for Keeper encryption params
Web Crypto API requires PKCS7 padding for AES-CBC decryption. The previous
workaround of appending zeros failed because decrypted zeros do not produce
valid PKCS7 padding bytes.
New approach: encrypt a proper PKCS7 padding block (16 bytes of 0x10) using
the last ciphertext block as IV, then append this encrypted padding to create
valid padded ciphertext that Web Crypto can decrypt.
* More scripts for testing
* Remove generated files we don't need
* Test scripts (remove later)
* Refactor the sync-down processing to be able to test easier
* Fix lint errors
* Cleanup
* New token
* New fixture and export
* Some tests
* Move the code into a new place
* Simplify Vault spec
* Use BaseImporter
* Add more record types
* Disable console.log in tests
* Update test data and tests
* Test each record type
* Fix folders
* Major refactor
* Decrypt shared record keys
* Remove account summary
* Add folders to records
* Build all paths
* Collect paths for all records
* uidToString
* Refactor base64 URL encoding/decoding using Utils from common library
* Add README for Direct Keeper importer and refactor VaultItem handling
* Refactor KeeperDirectImporter to streamline password and username handling in import process
* Implement reference collection and resolution in KeeperDirectImporter
* TODO
* More TODOs
* 2FA selection
* Handle SMS
* Add .proto and proto compiler to generate .ts from .proto
* Remove debugging code
* Delete debug scripts
* Update readme
* Update proto build script to disable ESLint checks for generated files
* Remove keeper-export.json
* Refactor ClientOptions to use KeeperRegion const object
* Remove includeSharedFolders option
* Make sure nx serve builds proto
* Clean up crypto
* Clean up crypto.ts
* cleanup
* Remove unnecessary exception class
* Move fixture into proper place, fix tests
* Move code around to match lastpass/access structure better
* Add protobuf generation step to CI test workflow
* Fix date expectations in keeper direct importer tests
* Build .proto files before typechecking
* Fix npm run test:types errors
* Rename .proto files to kebap case to prevent CI lint warnings about having capital case letters in filenames
* Commit generated protobuf TS files and remove build-time proto generation
The protobuf build step was causing CI issues. Generated TS files are now
committed directly. Proto source files remain as reference with a README
documenting how to regenerate.
* Change npx instruction to run directly from npm
* Add generated files README, update proto README
* Update TODO comment in vault.ts
* Add @protobuf-ts/runtime to Tools dep ownership in renovate config
* Implement Duo 2FA support for Keeper direct importer
- Fix Duo Passcode/SMS using wrong value type (TWO_FA_CODE_TOTP -> TWO_FA_CODE_DUO)
- Remove unnecessary socket wait after Passcode/SMS validation (token returned directly by API)
- Add waiting dialog for Duo Push/Voice methods instead of just showing a spinner
- Add code input support for Duo Passcode/SMS methods
- Make all Ui interface methods required
* Fix README
* Changes suggested by @quexten (doc comments)
* Fix TS type checked warnings
* Filter out unsupported 2FA methods from UI
* Skip file-based import flow for Keeper direct import
* Show error when no supported 2FA found but 2FA is required
* Migrate from @protobuf-ts/runtime to @bufbuild/protobuf
* Track possible cycles in the folder strcuture and break them (was suggested in review)
* Fix leftover merge conflict marker in web messages.json
* [PM-33198] angular modernization changes
* Remove KeeperPush from supported 2FAs for now, update README with more TODOs
* Reuse existing 'email' i18n key instead of keeperApprovalMethodEmail
* Reuse existing 'verificationCode' i18n key instead of keeperVerificationCode
* Replace keeperMFADesc with generic mfaTotpDesc i18n key
* Consolidate keeperTwoFactorSms and keeperDuoSms into generic textMessageSms i18n key
* Rename keeperTwoFactorBackup and keeperTwoFactorDuo to generic i18n keys
* Rename keeperDuo* i18n keys to generic duoVerification/duoPushWaiting/duoSmsWaiting/duoVoiceWaiting
* Consolidate keeperTwoFactorUnknown and keeperDuoUnknown into generic unknownMethod i18n key
* Reuse existing 'passcode' i18n key instead of keeperDuoPasscode
* Rename keeperRegion to generic dataCenterLocation i18n key
* Rename keeperSelectApprovalMethod* to generic selectApprovalMethod* i18n keys
* Rename keeperDeviceApprovalEmailDesc to generic approvalEmailDesc i18n key
* Rename generic keeper-prefixed i18n keys to content-driven names
* Rename keeperSelect* i18n keys to generic selectTwoFactorMethod/selectDuoMethod
* Rename remaining keeper-prefixed i18n keys to content-driven names
Consolidate keeperApprovalMethodPush and keeperTwoFactorKeeperPush into
single keeperPush key.
* Add Keeper DNA Push 2FA support for direct importer
* Add Keeper DNA manual code entry
* Add two-factor authentication as device approval method
* Mark DNA and backup codes as done.
* Add TryAnother sentinel and loop device approval flow
* Add 'Try another method' button to Keeper device approval
* Unify Keeper importer auth flow into a single dialog
* Remove unused per-state Keeper dialog components
* Hide empty Keeper email hint to remove gap below the field
* Defer Keeper password prompt until server requests it
* Split Keeper direct importer into its own format option
* Refine Keeper email and region field labels
* Redesign Keeper auth dialog and route Try another method back to selection
* Restyle Keeper master password dialog and route close to cancel
* Show Keeper email subtitle on every auth dialog stage
* Add Cancel to single-button Keeper auth stages and use Continue label
* Use radio buttons for Keeper two-factor method selection
* Group Keeper auth dialog by stage via reusable shell
Each @case now contains one self-contained <keeper-stage-shell> block
with a comment header. The shell wraps bit-dialog and holds the
stage-independent header bits (X close button, title with email
subtitle), forwarding bitDialogContent and bitDialogFooter slots through
via ngProjectAs. Footer projection is gated by an explicit [hasFooter]
input — bit-dialog detects its footer via contentChild on a real
DialogFooterDirective, and ngProjectAs alone does not satisfy that
check.
The shell also sets disableAnimations on the inner bit-dialog, so stage
transitions no longer slide.
* Use radio buttons for Keeper Duo and DNA method selection
* Move Keeper auth dialog footer buttons into the stage shell
* Match Keeper email approval dialog to design and fix Resend
- Split approvalCode email vs push: email gets "Email verification"
title, no spinner, and a Resend code link
- Update i18n copy for Approval methods, descriptions, and add
emailVerification, twoFactorMethod, plus refined approvalEmailDesc
- Fix Resend handling in handleDeviceApproval so re-requesting the
verification email keeps the dialog open instead of throwing
* Match Keeper push approval dialog to design
* Match Keeper 2FA code dialog to design and support resend
* Trigger 2FA push on device approval and wire resend
* Show method-specific copy for TOTP and SMS 2FA prompts
* Streamline Keeper DNA flow and pick up watch approval via socket
* Show loading spinner on Continue while validating master password
* Drop Try another method from 2FA and DNA push dialogs
* Tidy Keeper import callout copy and rename email field
* Unify device approval dialog titles and restore Try another method on 2FA approval
* Add Keeper Cloud SSO, admin approval, and browser auto-capture
* Add Keeper import Method dropdown for direct, CSV, and JSON
* Auto-capture Keeper SSO token in browser via spinner stage
* Mark temp feature for removal
* Retry Keeper approval and 2FA codes on server rejection
* Update Keeper push/admin approval dialog copy and add heading
* Skip Keeper SSO dialog on browser extension
* Confirm before cancelling Keeper admin approval flow
* Attach Keeper import async validator to email control
* Simplify Keeper spinner block spacing to typography defaults
* Restyle admin approval cancel confirmation as danger
* Restore missing ImportResult import after upstream merge
* Retry Keeper master password on server rejection
* Clean up PR hygiene: remove stray lock file and proto EOF blanks
* Use bitIconButton label input for accessible close button
* Reject Keeper SSO login when user closes IdP tab
* Restore Keeper csv/json importers for CLI and hide from web dropdown
* Move Keeper direct import out of async validator into explicit submit
* Fix strict-mode type errors in Keeper device approval flow
* Set organizationId on Keeper direct importer so org imports keep folders
* Require email for Keeper direct import and show login errors in the field
* Keep browser import in persistent context
* Fix package-lock.json to match @bufbuild/protobuf 2.11.0 in package.json
* Remove leftover merge conflict marker in web messages.json
* Fix formatting in vault.spec.ts
* Update Keeper importer README reviewers section
* Clarify Windows File Send test name
* Anchor Keeper SSO callback URL regex to https:// to prevent substring matches
* Route Keeper SSO script injection through BrowserApi abstraction
* Reject default Keeper SSO monitor promise instead of leaving it pending
* Replace string-matched Keeper auth errors with typed error codes
* Clean up Keeper importer dead code and i18n inconsistencies
* Resolve linked record keys and report skipped items in Keeper direct import
* Update partial import dialog copy and aggregate skipped items by type
* Show skipped item types in Keeper partial import dialog
* List skipped item names instead of record types in Keeper import dialog
* Revert "List skipped item names instead of record types in Keeper import dialog"
This reverts commit b504becf45.
* Identify Keeper import errors by record UID instead of decrypted name
* Relabel Keeper driverLicense import type as Driver's licence
* Fix NG0100 in import dialog when selecting Keeper format
* [PM-33198] adding opaque types for type safety
* [PM-33198] implement constant time checks to prevent timing attacks
* Address Keeper direct importer review feedback
- Move keeper from the pinned top of featuredImportOptions to its
alphabetical position after KeePass 2 (featured list renders in array order)
- Reword the import-keeper component comment from a review note into
production documentation
- Drop the now-resolved README note about the temporary pinning
* Abort Keeper import when a push socket message can't be processed
A push frame that failed to decrypt or parse was silently swallowed, so the
consumer racing on waitForMessage never resolved and the import hung with no
trace. Fail the socket instead: reject the waiting consumer, which unwinds the
login and surfaces a connection error to the user. The error carries only
structural metadata (stage, byte count, error name), never frame contents.
* Restart Keeper login when the login token expires during device approval
* Merge bitwarden:main
* Revert "Merge bitwarden:main"
This reverts commit b9c1f2df96.
* Map Keeper Direct import identity records to correct item types
driverLicense, ssnCard and passport now import as Identity and invalid SSH keys fall back to a secure note, matching the Keeper JSON importer.
---------
Co-authored-by: Alex Dragovich <adragovich@bitwarden.com>
Co-authored-by: Alex Dragovich <46065570+itsadrago@users.noreply.github.com>
* [PM-20344] Disallow multiple attachments with the same name, handle existing in zip export format
* Change duplicate cipher and attachment name logic slightly, replace disallowed characters
* Adjust character replacement to account for file suffix
