Skip disabled access rules when resolving the governing rule

AccessRule.Enabled was never checked, so a disabled rule still governed its
collections. Because selection is oldest-wins and structural, a disabled but
permissive rule (e.g. empty conditions, which auto-grant) could shadow a newer
enabled restrictive rule and silently grant access the active rule would have
gated.

Drop rules with Enabled == false from the candidate set, alongside the existing
deleted-rule skip, so a disabled rule stops governing entirely. Pin Enabled in
the resolver test fixtures so a governing rule is deterministically enabled
(AutoFixture's bool sequence could otherwise disable it), and add coverage for a
disabled sole rule (ungoverned) and a disabled oldest rule (newer enabled rule
governs).

Author: Hinton

bitwarden_license/src/Services/Pam/Services/GoverningRuleResolver.cs

@@ -43,13 +43,15 @@ public GoverningRuleResolver(
             .Where(c => collectionIds.Contains(c.Id) && c.AccessRuleId.HasValue);
 
         // Load every rule on the collections through which the caller reaches the cipher, keeping each paired with
-        // the collection it gates. A rule that no longer loads (deleted after the collection was read — deletes clear
-        // the link, so this is only a race) is skipped, so a deleted rule stops governing.
+        // the collection it gates. A rule is dropped — so it stops governing — when it is disabled (Enabled is false;
+        // the admin has switched it off, and a disabled rule does not gate access) or no longer loads (deleted after
+        // the collection was read; deletes clear the link, so a missing rule is only a race). Dropping a disabled rule
+        // also stops it shadowing a newer active rule under the oldest-wins selection below.
         var candidates = new List<(Collection Collection, AccessRule Rule)>();
         foreach (var collection in governedCollections)
         {
             var accessRule = await _accessRuleRepository.GetByIdAsync(collection.AccessRuleId!.Value);
-            if (accessRule is not null)
+            if (accessRule is { Enabled: true })
             {
                 candidates.Add((collection, accessRule));
             }

bitwarden_license/test/Services/Pam.Test/Services/GoverningRuleResolverTests.cs

@@ -263,6 +263,7 @@ public async Task ResolveAsync_OldestGovernedRuleDeleted_NextRuleGoverns(
         olderRule.CreationDate = new DateTime(2026, 1, 1, 0, 0, 0, DateTimeKind.Utc);
         newerRule.CreationDate = new DateTime(2026, 6, 1, 0, 0, 0, DateTimeKind.Utc);
         newerRule.Conditions = """[{"kind":"human_approval"}]""";
+        newerRule.Enabled = true;
         olderCollection.AccessRuleId = olderRule.Id;
         newerCollection.AccessRuleId = newerRule.Id;
         SetupReachableCollections(sutProvider, userId, cipherId, olderCollection, newerCollection);
@@ -278,6 +279,40 @@ public async Task ResolveAsync_OldestGovernedRuleDeleted_NextRuleGoverns(
         Assert.True(result.RequiresHumanApproval);
     }
 
+    [Theory, BitAutoData]
+    public async Task ResolveAsync_DisabledRule_NotGoverned(
+        SutProvider<GoverningRuleResolver> sutProvider, Guid userId, Guid cipherId, Collection collection, AccessRule rule)
+    {
+        // A disabled rule is inactive and does not gate access, so a cipher reached only through it is ungoverned.
+        SetupGovernedCollection(sutProvider, userId, cipherId, collection, rule);
+        rule.Enabled = false;
+
+        Assert.Null(await sutProvider.Sut.ResolveAsync(userId, cipherId, _signals));
+    }
+
+    [Theory, BitAutoData]
+    public async Task ResolveAsync_OldestRuleDisabled_NewerEnabledRuleGoverns(
+        SutProvider<GoverningRuleResolver> sutProvider, Guid userId, Guid cipherId,
+        Collection olderCollection, AccessRule olderRule, Collection newerCollection, AccessRule newerRule)
+    {
+        // The oldest rule is disabled and auto-granting; the newer rule is enabled and needs human approval. A disabled
+        // rule must not shadow a newer active one, so the newer rule governs — access is not silently auto-granted.
+        olderRule.CreationDate = new DateTime(2026, 1, 1, 0, 0, 0, DateTimeKind.Utc);
+        olderRule.Conditions = "[]";
+        newerRule.CreationDate = new DateTime(2026, 6, 1, 0, 0, 0, DateTimeKind.Utc);
+        newerRule.Conditions = """[{"kind":"human_approval"}]""";
+        SetupGovernedCollections(sutProvider, userId, cipherId,
+            (olderCollection, olderRule), (newerCollection, newerRule));
+        olderRule.Enabled = false;
+
+        var result = await sutProvider.Sut.ResolveAsync(userId, cipherId, _signals);
+
+        Assert.NotNull(result);
+        Assert.Equal(newerCollection.Id, result!.CollectionId);
+        Assert.Equal(newerRule.Id, result.RuleId);
+        Assert.True(result.RequiresHumanApproval);
+    }
+
     [Theory, BitAutoData]
     public async Task ResolveAsync_TimeOfDayCondition_ParsedAndEvaluatedThroughResolver(
         SutProvider<GoverningRuleResolver> sutProvider, Guid userId, Guid cipherId, Collection collection, AccessRule rule)
@@ -318,6 +353,8 @@ private static void SetupGovernedCollections(
         foreach (var (collection, rule) in pairs)
         {
             collection.AccessRuleId = rule.Id;
+            // A governing rule must be enabled; pin it so the outcome does not depend on AutoFixture's bool sequence.
+            rule.Enabled = true;
         }
 
         SetupReachableCollections(sutProvider, userId, cipherId, pairs.Select(p => p.collection).ToArray());