Thanks to visit codestin.com
Credit goes to github.com

Skip to content

[PM-32572]Premium to organization upgrade does not set public/private key pair or default collection#7076

Open
cyprain-okeke wants to merge 5 commits intomainfrom
billing/pm-32572/premium-to-organization-upgrade-does-not-set-public-private-key-pair-or-default-collection
Open

[PM-32572]Premium to organization upgrade does not set public/private key pair or default collection#7076
cyprain-okeke wants to merge 5 commits intomainfrom
billing/pm-32572/premium-to-organization-upgrade-does-not-set-public-private-key-pair-or-default-collection

Conversation

@cyprain-okeke
Copy link
Contributor

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-32572

πŸ“” Objective

This PR fixes a bug where upgrading from a Premium individual subscription to an organization plan did not properly initialize the organization's
cryptographic key pair or create a default collection.

Bug Fix

Problem: When users upgraded their Premium subscription to an organization plan (Teams/Families/Enterprise), the resulting organization was
missing:

  1. Public/Private key pair - Required for organization-level encryption operations
  2. Default collection - Users expect a starter collection to organize their vault items

This left organizations in an incomplete state, potentially blocking users from properly sharing vault items or performing other organization
operations that depend on these keys.

Solution:

  • Added PublicKey and EncryptedPrivateKey as required parameters to the upgrade request
  • Organization entity now properly initializes with these keys during the upgrade flow
  • Added optional CollectionName parameter to allow creating a default collection
  • The owner is automatically granted "Can Manage" access to the default collection
  • Collection creation failures are handled gracefully (logged but don't block the upgrade)
  • Command now returns the new organization ID to enable client navigation

Changes

  • UpgradePremiumToOrganizationRequest: Added PublicKey, EncryptedPrivateKey, and optional CollectionName fields
  • UpgradePremiumToOrganizationCommand: Sets organization keys and creates default collection if requested
  • AccountBillingVNextController: Updated to pass new parameters through
  • Return type changed from None to Guid to return the created organization ID
  • Comprehensive test coverage for all scenarios including failure cases

πŸ“Έ Screenshots

@cyprain-okeke cyprain-okeke requested a review from a team as a code owner February 25, 2026 11:48
@github-actions
Copy link
Contributor

github-actions bot commented Feb 25, 2026

Logo
Checkmarx One – Scan Summary & Details – 4dcb2beb-8d8e-4168-a458-e0fcccc41620


New Issues (2) Checkmarx found the following issues in this Pull Request
# Severity Issue Source File / Package Checkmarx Insight
1 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs: 123
detailsMethod at line 123 of /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs gets a parameter from a user request from request. Thi...
Attack Vector
2 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 452
detailsMethod at line 452 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector

cyprain-okeke and others added 2 commits February 25, 2026 13:47
…rade-does-not-set-public-private-key-pair-or-default-collection
Assert.NotEqual(Guid.Empty, organizationId);

await _organizationRepository.Received(1).CreateAsync(
Arg.Is<Organization>(org =>
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⛏ Should the public and private keys be checked here also?

Copy link
Collaborator

@sbrown-livefront sbrown-livefront left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good! Small non-blocking comment on a test

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⛏️ I'm not sure this test is named correctly since the removal of a lot of the metadata changes nor is it testing anything we haven't tested I believe. Can we remove it?

…rade-does-not-set-public-private-key-pair-or-default-collection
@sonarqubecloud
Copy link

@codecov
Copy link

codecov bot commented Feb 25, 2026

Codecov Report

❌ Patch coverage is 94.73684% with 2 lines in your changes missing coverage. Please review.
βœ… Project coverage is 56.77%. Comparing base (5b20ee9) to head (21b5483).

Files with missing lines Patch % Lines
...Controllers/VNext/AccountBillingVNextController.cs 0.00% 2 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #7076      +/-   ##
==========================================
+ Coverage   56.76%   56.77%   +0.01%     
==========================================
  Files        2014     2014              
  Lines       88218    88251      +33     
  Branches     7855     7855              
==========================================
+ Hits        50073    50107      +34     
+ Misses      36321    36320       -1     
  Partials     1824     1824              

β˜” View full report in Codecov by Sentry.
πŸ“’ Have feedback on the report? Share it here.

πŸš€ New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • πŸ“¦ JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants