Skip to content

[PM-34147] Add GetManyConfirmedAcceptedDetailsByUserAsync to IOrganizationUserRepository#7399

Merged
JimmyVo16 merged 5 commits intomainfrom
ac/pm-34147/add-sprocs-for-accepted-users
Apr 10, 2026
Merged

[PM-34147] Add GetManyConfirmedAcceptedDetailsByUserAsync to IOrganizationUserRepository#7399
JimmyVo16 merged 5 commits intomainfrom
ac/pm-34147/add-sprocs-for-accepted-users

Conversation

@JimmyVo16
Copy link
Copy Markdown
Contributor

@JimmyVo16 JimmyVo16 commented Apr 6, 2026

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-34147

📔 Objective

  1. Add GetManyConfirmedAcceptedDetailsByUserAsync(Guid userId) to the IOrganizationUserRepository interface
  2. MSSQL implementation (Dapper stored procedure)
  3. EF Core implementation
  4. MSSQL migration script
  5. Add database integration tests.

📸 Screenshots

Migration was successful.

image

@JimmyVo16 JimmyVo16 self-assigned this Apr 6, 2026
@JimmyVo16 JimmyVo16 added the ai-review Request a Claude code review label Apr 6, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 6, 2026

Bitwarden Claude Code Review

Overall Assessment: APPROVE

This PR adds GetManyConfirmedAcceptedDetailsByUserAsync to IOrganizationUserRepository with both Dapper (stored procedure) and Entity Framework implementations, filtering organization user details to only Accepted and Confirmed status types. The implementations are consistent between Dapper and EF, follow established repository patterns, and the stored procedure correctly uses STATUS IN (1, 2) to match both statuses in a single query. The migration script properly uses CREATE OR ALTER, and the dead code removal in the EF repository (GetDetailsByUserAsync) is a welcome cleanup. Comprehensive database integration tests cover positive scenarios (confirmed, accepted, multi-org) and negative scenarios (invited, revoked, cross-user isolation).

Code Review Details

No findings. The code is clean and follows established patterns. Previous reviewer feedback (removing "And" from stored procedure names, using CREATE OR ALTER in migration scripts) has been addressed.

{
var dbContext = GetDatabaseContext(scope);
var view = new OrganizationUserOrganizationDetailsViewQuery();
var t = await (view.Run(dbContext)).ToArrayAsync();
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This isn’t related to my PR, but it’s dead code and not being used. It was introduced about five years ago. Since AC owns this code now, I think we should remove it.

@codecov
Copy link
Copy Markdown

codecov bot commented Apr 6, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.69%. Comparing base (ea32fd1) to head (e83678a).
⚠️ Report is 17 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #7399      +/-   ##
==========================================
+ Coverage   58.54%   62.69%   +4.15%     
==========================================
  Files        2063     2063              
  Lines       91186    91207      +21     
  Branches     8123     8123              
==========================================
+ Hits        53382    57185    +3803     
+ Misses      35894    32030    -3864     
- Partials     1910     1992      +82     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 6, 2026

Logo
Checkmarx One – Scan Summary & Details50b5e888-14b3-4d33-9f4e-815f187f3474


New Issues (124) Checkmarx found the following issues in this Pull Request
# Severity Issue Source File / Package Checkmarx Insight
1 CRITICAL Stored_XSS /src/SharedWeb/Health/HealthCheckServiceExtensions.cs: 61
detailsThe method embeds untrusted data in generated output with WriteAsync, at line 60 of /src/SharedWeb/Health/HealthCheckServiceExtensions.cs. This ...
Attack Vector
2 CRITICAL Stored_XSS /util/Server/Startup.cs: 57
detailsThe method embeds untrusted data in generated output with WriteAsync, at line 59 of /util/Server/Startup.cs. This untrusted data is embedded int...
Attack Vector
3 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs: 55
detailsMethod at line 55 of /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs gets a parameter from a user request from user. This pa...
Attack Vector
4 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 145
detailsMethod at line 145 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from request. T...
Attack Vector
5 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 145
detailsMethod at line 145 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from request. T...
Attack Vector
6 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 97
detailsMethod at line 97 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. This...
Attack Vector
7 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 97
detailsMethod at line 97 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. This...
Attack Vector
8 MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 512
detailsMethod at line 512 of /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs gets a parameter from a user request from model. This par...
Attack Vector
9 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 229
detailsMethod at line 229 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. Thi...
Attack Vector
10 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1558
detailsMethod at line 1558 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
11 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1558
detailsMethod at line 1558 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
12 MEDIUM CSRF /src/Api/Tools/Controllers/SendsController.cs: 73
detailsMethod at line 73 of /src/Api/Tools/Controllers/SendsController.cs gets a parameter from a user request from id. This parameter value flows thro...
Attack Vector
13 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs: 146
detailsMethod at line 146 of /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs gets a parameter from a user request from request. Thi...
Attack Vector
14 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs: 145
detailsMethod at line 145 of /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs gets a parameter from a user request from user. This p...
Attack Vector
15 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 217
detailsMethod at line 217 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
16 MEDIUM CSRF /src/Api/Public/Controllers/CollectionsController.cs: 91
detailsMethod at line 91 of /src/Api/Public/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value ...
Attack Vector
17 MEDIUM CSRF /src/Api/Public/Controllers/CollectionsController.cs: 91
detailsMethod at line 91 of /src/Api/Public/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value ...
Attack Vector
18 MEDIUM CSRF /src/Api/Public/Controllers/CollectionsController.cs: 91
detailsMethod at line 91 of /src/Api/Public/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value ...
Attack Vector
19 MEDIUM CSRF /src/Api/Public/Controllers/CollectionsController.cs: 91
detailsMethod at line 91 of /src/Api/Public/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value ...
Attack Vector
20 MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 184
detailsMethod at line 184 of /src/Api/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value flows ...
Attack Vector
21 MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 184
detailsMethod at line 184 of /src/Api/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value flows ...
Attack Vector
22 MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 184
detailsMethod at line 184 of /src/Api/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value flows ...
Attack Vector
23 MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 184
detailsMethod at line 184 of /src/Api/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value flows ...
Attack Vector
24 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 173
detailsMethod at line 173 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. Thi...
Attack Vector
25 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 452
detailsMethod at line 452 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
26 MEDIUM CSRF /src/Api/Dirt/Controllers/OrganizationReportsController.cs: 187
detailsMethod at line 187 of /src/Api/Dirt/Controllers/OrganizationReportsController.cs gets a parameter from a user request from request. This paramet...
Attack Vector
27 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs: 104
detailsMethod at line 104 of /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs gets a parameter from a user request from user. This p...
Attack Vector
28 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/OrganizationBillingVNextController.cs: 107
detailsMethod at line 107 of /src/Api/Billing/Controllers/VNext/OrganizationBillingVNextController.cs gets a parameter from a user request from organiza...
Attack Vector
29 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1417
detailsMethod at line 1417 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
30 MEDIUM CSRF /src/Api/Dirt/Controllers/OrganizationReportsController.cs: 284
detailsMethod at line 284 of /src/Api/Dirt/Controllers/OrganizationReportsController.cs gets a parameter from a user request from request. This paramet...
Attack Vector
31 MEDIUM CSRF /src/Api/Dirt/Controllers/OrganizationReportsController.cs: 231
detailsMethod at line 231 of /src/Api/Dirt/Controllers/OrganizationReportsController.cs gets a parameter from a user request from request. This paramet...
Attack Vector
32 MEDIUM CSRF /src/Api/Dirt/Controllers/OrganizationReportsController.cs: 187
detailsMethod at line 187 of /src/Api/Dirt/Controllers/OrganizationReportsController.cs gets a parameter from a user request from request. This paramet...
Attack Vector
33 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1417
detailsMethod at line 1417 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
34 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1417
detailsMethod at line 1417 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
35 MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: 289
detailsMethod at line 289 of /src/Api/AdminConsole/Controllers/GroupsController.cs gets a parameter from a user request from orgUserId. This parameter ...
Attack Vector
36 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1385
detailsMethod at line 1385 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
37 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1446
detailsMethod at line 1446 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
38 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1148
detailsMethod at line 1148 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector

More results are available on the CxOne platform


Fixed Issues (1) Great job! The following issues were fixed in this Pull Request
Severity Issue Source File / Package
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 287

@JimmyVo16 JimmyVo16 marked this pull request as ready for review April 6, 2026 20:32
@JimmyVo16 JimmyVo16 requested review from a team as code owners April 6, 2026 20:32
@JimmyVo16 JimmyVo16 requested a review from eliykat April 6, 2026 20:32
@JimmyVo16
Copy link
Copy Markdown
Contributor Author

I'm looking into Checkmarx. I feel like it's a false positive since I'm using an established pattern.

@JimmyVo16
Copy link
Copy Markdown
Contributor Author

Talked to Matt Andreko about Checkmarx, and this is a false positive. We’re looking into moving to a new system in the near future.

@@ -0,0 +1,14 @@
CREATE PROCEDURE [dbo].[OrganizationUserOrganizationDetails_ReadConfirmedAndAcceptedByUserId]
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We want to avoid using And in proc names (see note: "Do not use And between parameter names in procedure names"):
https://contributing.bitwarden.com/contributing/code-style/sql/#common-examples

@@ -0,0 +1,20 @@
IF OBJECT_ID('[dbo].[OrganizationUserOrganizationDetails_ReadConfirmedAndAcceptedByUserId]') IS NOT NULL
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@JimmyVo16 JimmyVo16 changed the title [PM-34147] Add GetManyConfirmedAndAcceptedDetailsByUserAsync to IOrganizationUserRepository [PM-34147] Add GetManyConfirmedAcceptedDetailsByUserAsync to IOrganizationUserRepository Apr 8, 2026
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud bot commented Apr 8, 2026

@JimmyVo16 JimmyVo16 requested a review from mkincaid-bw April 8, 2026 16:54
Copy link
Copy Markdown
Contributor

@mkincaid-bw mkincaid-bw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@JimmyVo16 JimmyVo16 merged commit 0bb818b into main Apr 10, 2026
51 checks passed
@JimmyVo16 JimmyVo16 deleted the ac/pm-34147/add-sprocs-for-accepted-users branch April 10, 2026 13:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ai-review Request a Claude code review

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants