* Run side-effects in sdk unlock service
* Revert feature flag
* Tests and fix cli
* Set user ever had user key and add comment
* Update sdk
* Prettier
* Cleanup
* Only set biometric unlock when biometric enabled
* Clean up tests
* Fix DI
* Cleanup
* Cleanup
* Prettier
* Add test coverage and rename
* Cleanup tests
* Prettier
* Cleanup
* Refactor: Remove ConfigService dependency from auto-confirm related components
- Eliminated ConfigService from MainBackground, AutoConfirmPolicy, UserLayoutComponent, WebVaultPromptService, and organizationPolicyGuard.
- Updated logic to directly use organization properties instead of feature flags for auto-confirm functionality.
- Adjusted tests in DefaultAutomaticUserConfirmationService to reflect the removal of feature flag checks.
- Cleaned up unused imports related to ConfigService across various files.
* Refactor: Update date handling in tests and remove unused feature flag checks
- Changed date calculation in WebVaultExtensionPromptService tests to use milliseconds for accuracy.
- Removed unused feature flag checks from WebVaultPromptService tests, simplifying the logic and improving clarity.
* Refactor: Update organizationPolicyGuard to include ConfigService in feature callback
- Modified the organizationPolicyGuard to accept ConfigService as an additional parameter in the feature callback.
- Adjusted the SendComponent route to align with the updated guard implementation.
* Fix: Adjust date calculation in WebVaultExtensionPromptService tests for accuracy
- Updated the test to set the exact date to 30 days prior using setDate method for clarity and to avoid potential issues with DST boundaries.
* allow consumers of upload service to input block size
* implement progress bar for cipher attachment uploads
* refactor to use a constant for available block sizes
* rework tests to use AzureUploadBlockSize
* update cipher attachments to ensure 100% is shown for all attachments
* do not allocate real memory in test
* update file uploads to use `XMLHttpRequest` when possible to track progress
* remove unused block size
* update tests + make options optional
* fix unit tests to align with single block approach
* add optional chaining for optional parameter
* remove duplicate import
* catch error from xhr send
* remove redundant try/catch block
* use if/else syntax in attachment template
* add `applyPlatformHeaders` to consolidate header creations between methods.
* add feature flag for file upload changes for progress
* update constructor parameters
* only pass object when feature flag is enabled
* fix(saltForUser) [PM-33524] Update saltForUser$ for transition states
- e.g., TDE offboarding: user will have neither a master password nor
salt during transition. This is not a failure to make unlock data, it
is a gap in user state. A default salt should be provided to enable
the state transition.
* test(saltForUser) [PM-33524] Add test cases for user transition states
* docs(email-to-salt) [PM-33524] Annotate emailToSalt callsites with changes planned for Stage 3.
* docs(master-password-service) [PM-33524] Reintroduce/modify comments after main merge.
* [PM-34177] Fix feature flag key value for Organization Invite Links
* Rename feature flag key from OrganizationInviteLinks to GenerateInviteLink for clarity and consistency.
* [PM-25688] Migrate folder.request.ts to TS strict
* [PM-25688] Remove ts-strict-ignore from FolderWithIdRequest and update importer service to use FolderRequest instead
* [PM-25688] Add unit test to ensure Folder Id is never set for import request
* [PM-25688] Introduce FolderWithOptionalIdRequest for Import service
* switch back to default (Lock) session timeout action when PIN is enabled in master password less accounts.
* always reset to null (default) when only one action is available.
* unnecessary additional keys refresh on token storage migration
* Remove pm-23341-milestone-2 flagged logic from user-subscription component
Remove the enableDiscountDisplay$ feature flag observable and collapse the
ngIf/else template to always show the discount badge. The badge handles
null/no-discount gracefully.
* Remove PM23341_Milestone_2 flag definition from feature-flag enum
* Moved the task scheduler registration to the init method to ensure we're not re-registering it. Also made a no-op upload service for when the extension is popped out so we don't push events from both threads.
* PM-33353 - LoginStrategyService tests - add test to capture the bad behavior.
* PM-33353 - Extract Password Prelogin API logic to own service out of API service.
* PM-33353 - Rename prelogin request / response models to have password prefix for clarity
* PM-33353 - Build PasswordPrelogin domain service and domain model + tests
* PM-33353 - PasswordPrelogin - add barrel file
* PM-33353 - PasswordPreloginData - fromResponse - add validateKdfConfigForPrelogin so domain model is always valid.
* PM-33353 - Register PasswordPreloginApiService and PasswordPreloginService.
* PM-33353 - LoginComponent - wire up PasswordPreloginService
* PM-33353 - LoginStrategy updates - (1) Remove all password prelogin code from top level strategy service (2) Inject new PasswordPreloginService for use in the PasswordLoginStrategy.
* PM-33353 - Update Password Prelogin tests to use defaults
* PM-33353 - PasswordPreloginData model tests - update to use mins
* PM-33353 - Fix login strategy tests + get TS strict warnings fixed
* PM-33353 - Remove login component tests
* PM-33353 - Fix CLI
* PM-33353 - Password Login Strategy - add additional tests + fix misc issues + re-organized tests.
* PM-33353 - LoginComp - local AI review feedback - clean up prefetchPasswordPreloginData
* PM-33353 - Remove PM23801_PrefetchPasswordPrelogin feature flag
* PM-33353 - DefaultPasswordPreloginService - getPreloginData$ - fix shareReplay error bug state.
* PM-33353 - login-strategy.state.spec.ts - Remove incorrect todo and fix ts strict issues
* PM-33353 - Per PR feedback, Update PasswordPreloginService to add a cache clear mechanism to just tightly bound the service's memory to the lifetime of the key making process
* toggle autofill animation based on user setting
* toggle inline-menu animation based on user setting
* toggle notification animation based on user setting
* review feedback changes
* add tests
* reformat comments
* PM-32413 - Add hasPassword guard for future use.
* PM-32413 - Web - PasswordSettingsComp - add TODO for using new guard.
* PM-32413 - ChangePasswordComp - Add output emitter for when a password has been changed successfully.
* PM-32413 - Add feature flag
* PM-32413 - Desktop - implement change password component in a dialog.
* PM-32413 - Add change password to extension
* PM-32413 - Fix translations
* PM-32413 - Desktop - menu - add clean up todo
* PM-32413 - Feature flags - reset hardcoded true values
* PM-32413 - Add clean up todos
* PM-32413 - Extension Routing module - add hasPassword guard
* PM-32413 - add todo
* PM-32413 - Desktop / Extension - use InputPasswordFlow.ChangePassword instead of InputPasswordFlow.ChangePasswordWithOptionalUserKeyRotation
* PM-32413 - Finish last AI review items
* PM-32413 - Per PR feedback, update change-password-dialog title translation to one that we don't plan on removing.
* PM-32413 - Per PR feedback, update menu item id
* PM-32413 - Per local claud review - modify has-password to use UrlTree pattern.
* PM-32413 - ChangePassword comp - add this.passwordChanged.emit(); in newly flagged code branch
* feat: add full middleware pipeline support
* Retrieve cookies from storage and attach cookies using Electron session
* Register middleware to act on fetch redirect to acquire cookie for SSO
* Add missing tests
* fix: acquireCookies call
* fix: cookies not getting set
* feat: add vaultUrl to server communication config
* feat: adapt to receiving vaultUrl in acquireCookies
* fix: remove localhost connector override
* Fix requests can't be re-used
* Add small delay to ensure cookies are saved before retrying requests
* Fix vaultUrl being set twice
* Add mock clone method
* Fix sso-cookie.main tests
* Remove old FIXME
* Re-use request and fix test
* Add missing coverage checking that needsBootsrap is called
* In case the hostname can't be extracted, the response is returned
* Only check the responseType instead of also checking statuscodes for redirects
* Bump the sdk-version
* Prepend https:// if necessary before launching the connector url
* Add dialog to cookie acquisition
* Fix tests
* Add handling the user choosing cancel, which will now cancel the cookie acquisition
* Do not retry if needsBootstrap returns false
* Fix tests that hadn't been updated seen https:// was appended
* Move the sso cookie feature fully into desktop
* Move prompt to acquire cookie into ServerCommunicationConfigPlatformApiService and ensures that concurrent calls are dedupes during the callback await and when the dialog is open but no option has been chosen yet
* Fix broken import on sso-cookie.main.spec
* Update test suite, due to moving the dialog into the ServerCommunicationConfigPlatformApiService
* Fix import, that I missed from the move
* feat: move subscription into init function
---------
Co-authored-by: Andreas Coroiu <andreas.coroiu@gmail.com>
Co-authored-by: Daniel James Smith <djsmith85@users.noreply.github.com>
* feat: add full middleware pipeline support
* Retrieve cookies from storage and attach cookies using Electron session
* Register middleware to act on fetch redirect to acquire cookie for SSO
* Add missing tests
* fix: acquireCookies call
* fix: cookies not getting set
* feat: add vaultUrl to server communication config
* feat: adapt to receiving vaultUrl in acquireCookies
* fix: remove localhost connector override
* Fix requests can't be re-used
* Add small delay to ensure cookies are saved before retrying requests
* Fix vaultUrl being set twice
* Add mock clone method
* Fix sso-cookie.main tests
* Remove old FIXME
* Re-use request and fix test
* Add missing coverage checking that needsBootsrap is called
* In case the hostname can't be extracted, the response is returned
* Only check the responseType instead of also checking statuscodes for redirects
* Bump the sdk-version
* Prepend https:// if necessary before launching the connector url
* Do not retry if needsBootstrap returns false
---------
Co-authored-by: Andreas Coroiu <andreas.coroiu@gmail.com>
Co-authored-by: Daniel James Smith <djsmith85@users.noreply.github.com>
Updates the `ChangePasswordService` (`changePassword()` and `changePasswordForAccountRecovery()`) to use the new KM data types :
- `MasterPasswordAuthenticationData`
- `MasterPasswordUnlockData`
This allows us to move away from the deprecated `makeMasterKey()` method (which takes email as salt) as we seek to eventually separate the email from the salt.
Also moves current password validation into the default and web change password services.
Behind feature flag: `pm-27086-update-authentication-apis-for-input-password`
* [PM-27772] Add TrendWidget component with Chart.js implementation (#19078)
Add reusable TrendWidget component with Chart.js line chart for displaying risk trends over time in Access Intelligence.
- Configurable datetime/linear x-axis scales
- Theme-aware colors from design system (brand-700/400, gray-200/600)
- Full i18n support (10 new translation keys)
- Loading spinner and error state handling
- Proper Chart.js lifecycle management
* [PM-28530] Implement period selector UI component (#19162)
* feat(dirt): define TimePeriod type for risk-over-time period selector
Add const object type for 5 time periods (month, 3mo, 6mo, 12mo, all)
following ADR-0025 no-enum pattern. Includes PeriodOption interface
and PERIOD_OPTIONS config for rendering.
[PM-28530]
* feat(dirt): create PeriodSelectorComponent using bit-menu
Custom trigger button with bit-menu dropdown for risk-over-time
time period selection. No clear button, neutral styling matching
Figma design. Check icon marks current selection.
[PM-28530]
* feat(dirt): add barrel export for period selector
[PM-28530]
* feat(dirt): add i18n strings for period selector options
Add translation keys for time period labels: pastMonth, last3Months,
last6Months, last12Months, and timePeriod placeholder.
[PM-28530]
* feat(dirt): add Storybook stories for PeriodSelectorComponent
Stories for default state, pre-selected 3 months, and disabled state.
[PM-28530]
* test(dirt): add unit tests for PeriodSelectorComponent
Tests cover default state, period options with pre-translated labels,
selection changes, and selected label reactivity.
[PM-28530]
* feat(dirt): integrate PeriodSelector into TrendWidget component
Replace placeholder with dirt-period-selector dropdown. Add TimePeriod
to TrendWidgetTimespan mapping layer to bridge the two type systems.
Remove standalone Storybook story and disabled input per review feedback
— component now lives inside TrendWidget, not standalone.
[PM-28530]
* refactor(dirt): replace model() with signal() + output() for PeriodSelector
Switch from Angular's model() API to the signal() + output() pattern
used throughout the Access Intelligence module. This matches the
existing convention in TrendWidget (selectedTimespan/timespanChanged),
app-table-row-scrollable (checkboxChange/selectAllChange), and
review-applications-view (onToggleSelection/onToggleAll).
Changes:
- Replace model<TimePeriod>() with signal<TimePeriod>() for internal state
- Add explicit selectedPeriodChange output for parent notification
- Manual .emit() in selectPeriod() to match module convention
- Update test to verify output emission via subscribe spy
No functional change — both patterns emit selectedPeriodChange events.
The template binding (selectedPeriodChange)="..." is unchanged.
* refactor(dirt): update labels to match Figma and unify type system
Update period selector labels per Figma design:
- "Last 3 months" → "Past 3 months" (past3Months)
- "Last 6 months" → "Past 6 months" (past6Months)
- "Last 12 months" → "Past year" (pastYear)
- "All" → "All time" (allTime, new key — pre-existing "all" key untouched)
Rename TimePeriod const keys to match labels:
- Last3Months → Past3Months
- Last6Months → Past6Months
- Last12Months → PastYear
- All → AllTime
Wire values unchanged ("month", "3mo", "6mo", "12mo", "all") to
preserve server API compatibility.
Remove TrendWidgetTimespan entirely — TrendWidget now uses TimePeriod
directly for signals, outputs, and data model. Eliminates the temporary
mapping layer (timePeriodMap + onPeriodSelectorChange). Period selector
wires directly to onTimespanChange().
[PM-28530]
* [PM-28533] Add view selector to TrendWidget component (#19163)
Adds the view selector button group to the TrendWidget component. Hooks up to existing signal and emits events when the view mode is changed. In future development, the parent component of TrendWidget will need to handle these events to fetch updated chart data from the API.
View options are:
Applications
Passwords
Members
* Fix TimePeriod type errors in TrendWidget stories (#19239)
Replace invalid "past-month" string literals with TimePeriod.PastMonth
constant to match the TimePeriod type definition. The TimePeriod const
object uses "month" as the value for PastMonth, not "past-month".
* [PM-32056] Add feature flag for access intelligence trend chart (#19164)
* feat(dirt): add feature flag for access intelligence trend chart
Register the `pm-26961-access-intelligence-trend-chart` feature flag
to gate the upcoming TrendChart widget in the Activity tab. Default
is FALSE (disabled). PM-32057 will consume this flag when wiring up
the widget component.
[PM-32056]
* feat(dirt): read trend chart feature flag in activity component
Inject ConfigService into AllActivityComponent and read the
AccessIntelligenceTrendChart flag on init. This prepares the
component for the TrendChart widget to be conditionally rendered.
[PM-32056]
* feat(dirt): add conditional wrapper for trend chart widget
Add an @if block gated by the AccessIntelligenceTrendChart feature
flag in the Activity tab template. The TrendChart widget will be
placed inside this block when wired up.
[PM-32056]
* reset package files to main
* install chartjs using node v22
* add chartjs to dirt team deps (#19244)
* [PM-32055] Download TrendWidget chart to PNG and CSV (#19245)
This PR adds a download button to the TrendWidget component that supports downloading the "Risk over time" chart data as a PNG or in CSV format.
Logic to dynamically add a chart title and x/y axis labels is included. This required creating a service that recreates a copy of the chart with title and axis labels applied, in an off screen canvas element, and then exporting to blob for file download. This logic is owned by the ChartExportService.
* Fix readonly variables. Update chart variable to use signal
* Fix any type in test file
---------
Co-authored-by: Brad <44413459+lastbestdev@users.noreply.github.com>
Co-authored-by: Alex <55413326+AlexRubik@users.noreply.github.com>
Co-authored-by: Brad Deibert <bdeibert@bitwarden.com>
