Merge branch 'main' into ac/pm-35351/post-public-members-no-longer-works-on-self-hosts

Author: r-tome

.claude/CONTRIBUTING.md

@@ -0,0 +1,101 @@
+# Contributing Claude Context to This Repo
+
+Every time you catch Claude making the same mistake twice, explain the same convention in chat, or hand a teammate a mental map they didn't have — that's knowledge worth encoding. This guide covers what belongs in this repo's `.claude/`, where to put it, and how to land it alongside the code it describes.
+
+## When to contribute here vs. elsewhere
+
+Ask: **is this knowledge specific to this codebase, or generic enough to work across repos?**
+
+- **Specific to this codebase** → contribute here, in `.claude/`.
+  Example: "how we add a new cipher type," "how our feature-flag system works."
+- **Generic, reusable across repos** → [`bitwarden/ai-plugins`](https://github.com/bitwarden/ai-plugins) — persona plugins (e.g., a code-review agent), tool integrations, or shared utilities.
+
+When unsure, keep it here. Promoting up to `ai-plugins` later is easier than pulling it back — see its [CONTRIBUTING.md](https://github.com/bitwarden/ai-plugins/blob/main/CONTRIBUTING.md) when you're ready.
+
+## Choose scope, then shape
+
+### 1. Scope — where does it apply?
+
+This is a monorepo. Claude loads every `CLAUDE.md` and `CLAUDE.local.md` by [walking up from the working directory](https://code.claude.com/docs/en/memory#how-claude-md-files-load) — looking in each ancestor directly, not in a nested `.claude/` subdirectory. Files below the working directory (including nested `.claude/skills/`) are loaded lazily when Claude reads into that subtree. Use that hierarchy:
+
+- **Applies everywhere in this repo** → root `CLAUDE.md` or `.claude/skills/`
+- **Applies only within one app, library, utility, or subtree** → nested `CLAUDE.md` or `.claude/skills/` in that directory
+
+Push rules as deep as they'll go — keeping app-specific rules local saves context for everyone else's sessions, not just yours.
+
+For rules that should apply only to certain file types (e.g., all `*Controller.cs` files), use [`.claude/rules/<name>.md` with a `paths:` frontmatter glob](https://code.claude.com/docs/en/memory#organize-rules-with-claude/rules/) instead of a nested `CLAUDE.md`.
+
+### 2. Shape — how should Claude use it?
+
+| You want to…                                            | Use                                                                                              |
+| ------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
+| State a rule Claude must always follow in its scope     | `CLAUDE.md`                                                                                      |
+| State a rule that applies only to certain file globs    | `.claude/rules/<name>.md` with `paths:` frontmatter                                              |
+| Teach a procedure Claude invokes on demand              | `.claude/skills/<name>/SKILL.md`                                                                 |
+| Give Claude a specialized subagent with its own context | `.claude/agents/<name>.md` (YAML frontmatter; `name` + `description` required)                   |
+| Add a user-invocable slash command                      | `.claude/commands/<name>.md`                                                                     |
+| Trigger a shell script on a Claude Code event           | _We have them, but no strict project enforcement yet — register yours in `settings.local.json`._ |
+
+Rule of thumb: **if Claude only needs it sometimes, it's a skill.** Once a `CLAUDE.md` loads, it stays in context for the rest of the session — keep each one lean, especially the root.
+
+## Security conventions
+
+Skills and agents that touch vault data, authentication, or cryptography must use Bitwarden's [Core Vocabulary](https://contributing.bitwarden.com/architecture/security/definitions) (Vault Data, Protected Data, Secure Channel, etc.) and re-state the zero-knowledge invariant inline. **Subagents run in a fresh context** and do not inherit this repo's `CLAUDE.md` — include the relevant definitions directly in the agent's system prompt.
+
+## What good contributions look like
+
+- **Grounded in the code.** Real files, real patterns, real commands.
+  If it could apply to any repo, it belongs in `ai-plugins`.
+- **Describes the "what" and "why," not the "who."**
+  Avoid team-persona framing. Describe the domain and its constraints; the team is an implementation detail.
+- **Short and specific.**
+  2,000 words of general advice isn't a skill.
+- **Active voice, direct language.**
+  "Invoke this skill when..." — not "This skill may be invoked when..."
+- **Reviewed like code.**
+  Teams of domain experts own `.claude/` in their areas — they're the ones shaping how Claude behaves for everyone who works there, so treat changes with the same seriousness as source.
+
+## Anti-patterns
+
+- **Team-persona agents** ("Team ABC engineer").
+  If a team's process is unique enough to warrant a persona, that's an SDLC signal to address, not a persona to encode.
+- **Root-level rules that only matter in one subtree.**
+  If it applies to `util/Seeder` only, put it in `util/Seeder/CLAUDE.md`.
+- **Duplicating `ai-plugins` content.**
+  Check existing plugin skills before writing a new one.
+- **Generic advice disguised as repo-local knowledge.**
+  "Write good tests" isn't repo-specific.
+  "Our integration tests must hit a real database because…" is.
+
+## Building a contribution
+
+The Claude Code ecosystem moves fast — last session's habits may already be out of date. Here's the workflow we follow.
+
+### 1. Start with the canonical docs
+
+A quick refresh before you begin goes a long way — the rules shift more often than you'd think:
+
+- [How Claude Code Works](https://code.claude.com/docs/en/how-claude-code-works) — the mental model.
+- [Best Practices for Claude Code](https://code.claude.com/docs/en/best-practices) — what Anthropic recommends.
+- [Extend Claude Code](https://code.claude.com/docs/en/features-overview) — what you can build (skills, agents, commands, hooks).
+- [The Complete Guide to Building Skills for Claude](https://resources.anthropic.com/hubfs/The-Complete-Guide-to-Building-Skill-for-Claude.pdf) - a must read for skill building
+
+### 2. Survey the landscape
+
+A quick skim of both goes a long way:
+
+- This repo's [`.claude/`](.) tree.
+- [`bitwarden/ai-plugins`](https://github.com/bitwarden/ai-plugins).
+
+Try to match the voice you see. "Invoke when the user asks to X" — not "This skill may be invoked when X." Direct, active, specific. Your contribution should read like the neighbors.
+
+### 3. Build iteratively
+
+When you're authoring a skill, start with `/skill-creator:skill-creator`. It runs an iterative loop — draft → test against evals → review outputs → refine — with benchmark stats and a side-by-side reviewer. You end up with a skill that's been exercised against concrete inputs before you open the PR.
+
+For agents, commands, hooks, and `CLAUDE.md` entries, start from an existing one in the repo and adapt it. No need to invent a new structure when a neighbor already solves the shape problem.
+
+### 4. Validate before you push
+
+- Run a local Bitwarden Claude Code review with `/bitwarden-code-review:code-review-local` — it writes findings to files so you can fix them before pushing, without posting anything to GitHub.
+- When you raise the PR, apply the `ai-review` label. Our reusable GitHub workflow watches for it and runs a Claude Code review automatically; without the label, the review doesn't fire.

.github/workflows/_move_edd_db_scripts.yml

@@ -7,6 +7,8 @@ on:
 permissions:
   pull-requests: write
   contents: write
+  id-token: write
+  actions: read
 
 jobs:
   setup:
@@ -55,13 +57,6 @@ jobs:
           tenant_id: ${{ secrets.AZURE_TENANT_ID }}
           client_id: ${{ secrets.AZURE_CLIENT_ID }}
 
-      - name: Retrieve Slack secrets
-        id: retrieve-slack
-        uses: bitwarden/gh-actions/get-keyvault-secrets@main
-        with:
-          keyvault: "bitwarden-ci"
-          secrets: "devops-alerts-slack-webhook-url"
-
       - name: Retrieve secrets
         id: retrieve-secret
         uses: bitwarden/gh-actions/get-keyvault-secrets@main
@@ -190,12 +185,3 @@ jobs:
               $(echo -e "$MOVED_FILES")
               ")
           echo "pr_url=${PR_URL}" >> "$GITHUB_OUTPUT"
-
-      - name: Notify Slack about creation of PR
-        if: ${{ steps.commit.outputs.pr_needed == 'true' }}
-        uses: act10ns/slack@44541246747a30eb3102d87f7a4cc5471b0ffb7d # v2.1.0
-        env:
-          SLACK_WEBHOOK_URL: ${{ steps.retrieve-slack.outputs.devops-alerts-slack-webhook-url }}
-        with:
-          message: "Created PR for moving EDD database scripts: ${{ steps.create-pr.outputs.pr_url }}"
-          status: ${{ job.status }}

.github/workflows/build.yml

@@ -594,50 +594,3 @@ jobs:
     permissions:
       contents: read
       id-token: write
-
-  check-failures:
-    name: Check for failures
-    if: always()
-    runs-on: ubuntu-22.04
-    needs:
-      - lint
-      - build-artifacts
-      - upload
-      - build-mssqlmigratorutility
-      - bitwarden-lite-build
-      - trigger-k8s-deploy
-    permissions:
-      id-token: write
-    steps:
-      - name: Check if any job failed
-        if: |
-          github.event_name != 'pull_request'
-          && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/rc' || github.ref == 'refs/heads/hotfix-rc')
-          && contains(needs.*.result, 'failure')
-        run: exit 1
-
-      - name: Log in to Azure
-        uses: bitwarden/gh-actions/azure-login@main
-        with:
-          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
-          client_id: ${{ secrets.AZURE_CLIENT_ID }}
-
-      - name: Retrieve secrets
-        id: retrieve-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@main
-        if: failure()
-        with:
-          keyvault: "bitwarden-ci"
-          secrets: "devops-alerts-slack-webhook-url"
-
-      - name: Log out from Azure
-        uses: bitwarden/gh-actions/azure-logout@main
-
-      - name: Notify Slack on failure
-        uses: act10ns/slack@44541246747a30eb3102d87f7a4cc5471b0ffb7d # v2.1.0
-        if: failure()
-        env:
-          SLACK_WEBHOOK_URL: ${{ steps.retrieve-secrets.outputs.devops-alerts-slack-webhook-url }}
-        with:
-          status: ${{ job.status }}

.github/workflows/repository-management.yml

@@ -241,5 +241,9 @@ jobs:
   move_edd_db_scripts:
     name: Move EDD database scripts
     needs: cut_branch
-    permissions: {}
+    permissions:
+      pull-requests: write
+      contents: write
+      id-token: write
+      actions: read
     uses: ./.github/workflows/_move_edd_db_scripts.yml

global.json

@@ -6,6 +6,6 @@
   "msbuild-sdks": {
     "Microsoft.Build.Traversal": "4.1.0",
     "Microsoft.Build.Sql": "1.0.0",
-    "Bitwarden.Server.Sdk": "1.5.1"
+    "Bitwarden.Server.Sdk": "1.5.2"
   }
 }

src/Api/Vault/Controllers/SyncController.cs

@@ -43,7 +43,7 @@ public class SyncController : Controller
     private readonly GlobalSettings _globalSettings;
     private readonly ICurrentContext _currentContext;
     private readonly Version _sshKeyCipherMinimumVersion = new(Constants.SSHKeyCipherMinimumVersion);
-    private readonly Version _bankAccountCipherMinimumVersion = new(Constants.BankAccountCipherMinimumVersion);
+    private readonly Version _pm32009NewItemTypeMinimumVersion = new(Constants.PM32009NewItemTypeMinimumVersion);
     private readonly IFeatureService _featureService;
     private readonly IApplicationCacheService _applicationCacheService;
     private readonly ITwoFactorIsEnabledQuery _twoFactorIsEnabledQuery;
@@ -171,9 +171,11 @@ private ICollection<CipherDetails> FilterUnsupportedCipherTypes(ICollection<Ciph
 
         if (!_featureService.IsEnabled(FeatureFlagKeys.PM32009_NewItemTypes)
             || _currentContext.ClientVersion == null
-            || _currentContext.ClientVersion < _bankAccountCipherMinimumVersion)
+            || _currentContext.ClientVersion < _pm32009NewItemTypeMinimumVersion)
         {
             unsupportedTypes.Add(Core.Vault.Enums.CipherType.BankAccount);
+            unsupportedTypes.Add(Core.Vault.Enums.CipherType.DriversLicense);
+            unsupportedTypes.Add(Core.Vault.Enums.CipherType.Passport);
         }
 
         return unsupportedTypes.Count == 0

src/Api/Vault/Models/CipherDriversLicenseModel.cs

@@ -0,0 +1,68 @@
+using Bit.Core.Utilities;
+using Bit.Core.Vault.Models.Data;
+
+namespace Bit.Api.Vault.Models;
+
+public class CipherDriversLicenseModel
+{
+    public CipherDriversLicenseModel() { }
+
+    public CipherDriversLicenseModel(CipherDriversLicenseData data)
+    {
+        FirstName = data.FirstName;
+        MiddleName = data.MiddleName;
+        LastName = data.LastName;
+        DateOfBirth = data.DateOfBirth;
+        LicenseNumber = data.LicenseNumber;
+        IssuingCountry = data.IssuingCountry;
+        IssuingState = data.IssuingState;
+        IssueDate = data.IssueDate;
+        IssuingAuthority = data.IssuingAuthority;
+        ExpirationDate = data.ExpirationDate;
+        LicenseClass = data.LicenseClass;
+    }
+
+    [EncryptedString]
+    [EncryptedStringLength(1000)]
+    public string? FirstName { get; set; }
+
+    [EncryptedString]
+    [EncryptedStringLength(1000)]
+    public string? MiddleName { get; set; }
+
+    [EncryptedString]
+    [EncryptedStringLength(1000)]
+    public string? LastName { get; set; }
+
+    [EncryptedString]
+    [EncryptedStringLength(1000)]
+    public string? DateOfBirth { get; set; }
+
+    [EncryptedString]
+    [EncryptedStringLength(1000)]
+    public string? LicenseNumber { get; set; }
+
+    [EncryptedString]
+    [EncryptedStringLength(1000)]
+    public string? IssuingCountry { get; set; }
+
+    [EncryptedString]
+    [EncryptedStringLength(1000)]
+    public string? IssuingState { get; set; }
+
+    [EncryptedString]
+    [EncryptedStringLength(1000)]
+    public string? IssueDate { get; set; }
+
+    [EncryptedString]
+    [EncryptedStringLength(1000)]
+    public string? IssuingAuthority { get; set; }
+
+    [EncryptedString]
+    [EncryptedStringLength(1000)]
+    public string? ExpirationDate { get; set; }
+
+    [EncryptedString]
+    [EncryptedStringLength(1000)]
+    public string? LicenseClass { get; set; }
+}

src/Api/Vault/Models/CipherPassportModel.cs

@@ -0,0 +1,78 @@
+using Bit.Core.Utilities;
+using Bit.Core.Vault.Models.Data;
+
+namespace Bit.Api.Vault.Models;
+
+public class CipherPassportModel
+{
+    public CipherPassportModel() { }
+
+    public CipherPassportModel(CipherPassportData data)
+    {
+        Surname = data.Surname;
+        GivenName = data.GivenName;
+        DateOfBirth = data.DateOfBirth;
+        Sex = data.Sex;
+        BirthPlace = data.BirthPlace;
+        Nationality = data.Nationality;
+        PassportNumber = data.PassportNumber;
+        PassportType = data.PassportType;
+        IssuingCountry = data.IssuingCountry;
+        IssuingAuthority = data.IssuingAuthority;
+        IssueDate = data.IssueDate;
+        ExpirationDate = data.ExpirationDate;
+        NationalIdentificationNumber = data.NationalIdentificationNumber;
+    }
+
+    [EncryptedString]
+    [EncryptedStringLength(1000)]
+    public string? Surname { get; set; }
+
+    [EncryptedString]
+    [EncryptedStringLength(1000)]
+    public string? GivenName { get; set; }
+
+    [EncryptedString]
+    [EncryptedStringLength(1000)]
+    public string? DateOfBirth { get; set; }
+
+    [EncryptedString]
+    [EncryptedStringLength(1000)]
+    public string? Sex { get; set; }
+
+    [EncryptedString]
+    [EncryptedStringLength(1000)]
+    public string? BirthPlace { get; set; }
+
+    [EncryptedString]
+    [EncryptedStringLength(1000)]
+    public string? Nationality { get; set; }
+
+    [EncryptedString]
+    [EncryptedStringLength(1000)]
+    public string? PassportNumber { get; set; }
+
+    [EncryptedString]
+    [EncryptedStringLength(1000)]
+    public string? PassportType { get; set; }
+
+    [EncryptedString]
+    [EncryptedStringLength(1000)]
+    public string? IssuingCountry { get; set; }
+
+    [EncryptedString]
+    [EncryptedStringLength(1000)]
+    public string? IssuingAuthority { get; set; }
+
+    [EncryptedString]
+    [EncryptedStringLength(1000)]
+    public string? IssueDate { get; set; }
+
+    [EncryptedString]
+    [EncryptedStringLength(1000)]
+    public string? ExpirationDate { get; set; }
+
+    [EncryptedString]
+    [EncryptedStringLength(1000)]
+    public string? NationalIdentificationNumber { get; set; }
+}