Skip to content

[PM-34119] Web New Item Dialog#19953

Merged
nick-livefront merged 42 commits into
mainfrom
vault/pm-34119/new-item-type-dialog
Apr 14, 2026
Merged

[PM-34119] Web New Item Dialog#19953
nick-livefront merged 42 commits into
mainfrom
vault/pm-34119/new-item-type-dialog

Conversation

@nick-livefront
Copy link
Copy Markdown
Collaborator

@nick-livefront nick-livefront commented Apr 2, 2026

🎟️ Tracking

PM-34119

📔 Objective

Adds new item selection dialog in preparation for the addition of Bank Account, Driver's License, and Passport cipher types.

  • Adds AddItemGridComponent that stores all logic for for which item types are visible and is cross platform compatible.
  • When PM32009NewItemTypes feature flag is enabled the new button on the web vault and admin console will open the dialog rather than the dropdown menu.
  • @bitwarden/team-ui-foundation I made a few tweak to the dialog component, I'll make an inline comment there.

📸 Screenshots

Dark Mode Light Mode
web-dark-mode.mov
web-light-mode.mov

@codecov
Copy link
Copy Markdown

codecov Bot commented Apr 2, 2026

Codecov Report

❌ Patch coverage is 51.08696% with 45 lines in your changes missing coverage. Please review.
✅ Project coverage is 46.81%. Comparing base (7c7c07e) to head (5cb3243).
⚠️ Report is 97 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines Patch % Lines
...nents/new-cipher-menu/new-cipher-menu.component.ts 21.42% 11 Missing ⚠️
...nsole/organizations/collections/vault.component.ts 0.00% 10 Missing ⚠️
.../src/app/vault/individual-vault/vault.component.ts 0.00% 9 Missing ⚠️
libs/common/src/vault/types/cipher-menu-items.ts 0.00% 6 Missing ⚠️
...collections/vault-header/vault-header.component.ts 0.00% 3 Missing ⚠️
...s/components/src/dialog/dialog/dialog.component.ts 33.33% 2 Missing ⚠️
...ibs/components/src/dialog/dialog/dialog.stories.ts 0.00% 2 Missing ⚠️
...idual-vault/vault-header/vault-header.component.ts 50.00% 1 Missing ⚠️
...nents/add-item-dialog/add-item-dialog.component.ts 90.00% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main   #19953      +/-   ##
==========================================
+ Coverage   46.74%   46.81%   +0.06%     
==========================================
  Files        3879     3887       +8     
  Lines      116181   117069     +888     
  Branches    17700    17904     +204     
==========================================
+ Hits        54313    54801     +488     
- Misses      59395    59786     +391     
- Partials     2473     2482       +9     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 2, 2026

Logo
Checkmarx One – Scan Summary & Details942d89cb-9a37-4953-8d54-ec73af49eeb1


New Issues (19) Checkmarx found the following issues in this Pull Request
# Severity Issue Source File / Package Checkmarx Insight
1 HIGH CVE-2025-13631 Npm-electron-39.2.6
detailsRecommended version: 39.3.0
Description: Inappropriate implementation in Google Updater in Google Chrome on Mac prior to 143.0.7499.41 allowed a remote attacker to perform Privilege Escala...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
2 HIGH CVE-2025-13633 Npm-electron-39.2.6
detailsRecommended version: 39.3.0
Description: Use After Free in Digital Credentials in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
3 HIGH CVE-2025-13638 Npm-electron-39.2.6
detailsRecommended version: 39.3.0
Description: Use After Free in Media Stream in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a craft...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
4 HIGH CVE-2025-13639 Npm-electron-39.2.6
detailsRecommended version: 39.3.0
Description: Inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to perform arbitrary read/write via a craf...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
5 HIGH CVE-2025-13720 Npm-electron-39.2.6
detailsRecommended version: 39.3.0
Description: Bad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploi...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
6 HIGH CVE-2025-13721 Npm-electron-39.2.6
detailsRecommended version: 39.3.0
Description: Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
7 HIGH CVE-2026-0628 Npm-electron-39.2.6
detailsRecommended version: 39.3.0
Description: Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malic...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
8 HIGH CVE-2026-1861 Npm-electron-39.2.6
detailsRecommended version: 39.6.0
Description: Heap Buffer Overflow in libvpx in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a craf...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
9 HIGH CVE-2026-34770 Npm-electron-39.2.6
detailsRecommended version: 39.8.1
Description: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.x prior to 39....
Attack Vector: LOCAL
Attack Complexity: HIGH
Vulnerable Package
10 HIGH CVE-2026-34771 Npm-electron-39.2.6
detailsRecommended version: 39.8.0
Description: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.x prior to 39....
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
11 HIGH CVE-2026-34774 Npm-electron-39.2.6
detailsRecommended version: 39.8.1
Description: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 39.8.1, 40.x prior to 40....
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
12 HIGH CVE-2026-34780 Npm-electron-39.2.6
detailsRecommended version: 39.8.0
Description: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 39.0.0-alpha.1 prior to 39.8....
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
13 MEDIUM CVE-2025-13632 Npm-electron-39.2.6
detailsRecommended version: 39.3.0
Description: Inappropriate implementation in DevTools in Google Chrome prior to 143.0.7499.41 allowed an attacker who convinced a user to install a malicious ex...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
14 MEDIUM CVE-2025-13635 Npm-electron-39.2.6
detailsRecommended version: 39.3.0
Description: Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a local attacker to perform UI spoofing via a crafted HTM...
Attack Vector: LOCAL
Attack Complexity: LOW
Vulnerable Package
15 MEDIUM CVE-2025-13636 Npm-electron-39.2.6
detailsRecommended version: 39.3.0
Description: Inappropriate implementation in Split View in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in spec...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
16 MEDIUM CVE-2025-13637 Npm-electron-39.2.6
detailsRecommended version: 39.3.0
Description: Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in speci...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
17 MEDIUM CVE-2026-1527 Npm-undici-7.16.0
detailsDescription: Impact: When an application passes user-controlled input to the upgrade option of "client.request()", an attacker can inject CRLF sequences (\r\n) ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
18 MEDIUM Missing_HSTS_Header /apps/cli/src/auth/commands/login.command.ts: 571
detailsThe web-application does not define an HSTS header, leaving it vulnerable to attack.
Attack Vector
19 LOW CVE-2025-13640 Npm-electron-39.2.6
detailsRecommended version: 39.3.0
Description: Inappropriate implementation in Passwords in Google Chrome prior to 143.0.7499.41 allowed a local attacker to bypass authentication via physical ac...
Attack Vector: PHYSICAL
Attack Complexity: LOW
Vulnerable Package

Fixed Issues (1) Great job! The following issues were fixed in this Pull Request
Severity Issue Source File / Package
MEDIUM Missing_HSTS_Header /apps/browser/src/autofill/services/targeting-rules-data.service.ts: 199

Copy link
Copy Markdown
Collaborator Author

@nick-livefront nick-livefront Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@bitwarden/team-ui-foundation One change here to support the designs of the new item dialog. Figma

  • The dialog without a footer currently has extra padding on the bottom. I added a hasFooter conditional to only render the wrapping <div> when present. This also why there are storybook changes for existing implementations of the dialog.

vleague2
vleague2 previously approved these changes Apr 13, 2026
Copy link
Copy Markdown
Contributor

@vleague2 vleague2 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

UIF changes look fine!

Copy link
Copy Markdown
Contributor

@jrmccannon jrmccannon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. Just a few comments.

Comment thread libs/vault/src/components/add-item-dialog/add-item-dialog.component.ts Outdated
Copy link
Copy Markdown
Member

@shane-melton shane-melton left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, nice work! Just have one question/suggestion around the public API of the add-item-grid component.

Comment thread libs/vault/src/components/add-item-grid/add-item-grid.component.ts Outdated
@sonarqubecloud
Copy link
Copy Markdown

Copy link
Copy Markdown
Member

@shane-melton shane-melton left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great, nice work!

Copy link
Copy Markdown
Contributor

@jrmccannon jrmccannon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good! Thanks!

@nick-livefront nick-livefront merged commit c4d0cfd into main Apr 14, 2026
188 of 189 checks passed
@nick-livefront nick-livefront deleted the vault/pm-34119/new-item-type-dialog branch April 14, 2026 18:27
nikwithak pushed a commit that referenced this pull request Apr 15, 2026
* when the footer is not present in the dialog remove empty div

* add new item type feature flag

* add subtitle text to cipher menu items

* add add item dialog and associated components

* integrate the new item dialog into web and AC vaults

* add dialog header start slot for dialog

* fix menu trigger when feature flag is disabled

* add back button for cipher dialogs

* bind `this` for back action

* only show back button when a new cipher is being created

* fix edit access for new ciphers

* fix logic for adding a cipher and showing the back button

* add back action to the collection dialog

* add back action to folder dialog

* fix formatting and strict types

* update backAction getter for consistency

* add story without footer

* prettier fixes

* address local claude feedback

* update icons on dialog

* adjust spacing and sizes

* fix strict typings

* add typography import

* design pass after working on other platforms

* update to use the icon tile component

* address feedback from design

* update grid to use bit item

* remove dialog description

* update to single column when less than 6 items

* Revert "add dialog header start slot for dialog"

This reverts commit e029cde.

* remove back action for new cipher dialog

* match padding-top of dialog when there is no footer

* fix alignment of carrot

* remove tests associated back action

* use default bit-item styles for typography

* reduce margin of bit-item

* prefer `inject` function

* add readonly and protected

* move types into the grid component to streamline the api integration
@djsmith85 djsmith85 added cli CLI Application desktop Desktop Application t:feature Change Type - Feature Development feature-flag web browser Browser Extension labels Apr 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

browser Browser Extension cli CLI Application desktop Desktop Application feature-flag t:feature Change Type - Feature Development web

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants