[PM-32073] - Added Bulk Get Org Ability

[jrmccannon]

🎟️ Tracking

PM-32073

📔 Objective

This adds the bulk get implementation of the org ability from the extended cache (FusionCache). It also cleans up some test files.

[github-actions]

Bitwarden Claude Code Review

Overall Assessment: APPROVE

This PR adds GetOrganizationAbilitiesAsync to the IOrganizationAbilityCacheService interface and its ExtendedOrganizationAbilityCacheService implementation, which fans out to individual FusionCache lookups via Task.WhenAll. The FeatureRoutedCacheService correctly routes the new bulk path through the OrgAbilityExtendedCache feature flag, falling back to the in-memory service when disabled. CancellationToken support was added across the interface, and the DI lifetime was changed from scoped to singleton, which is safe since all injected dependencies are already singletons. Tests cover both flag-on and flag-off routing paths, and the integration test was improved to validate a meaningful cached property change.

Code Review Details

No findings. The implementation follows established caching and feature-flag patterns in the codebase. Cache key simplification from org-ability:{guid:N} to guid.ToString() is consistent since FusionCache namespaces by cache name. The fan-out pattern for bulk lookups is appropriate given the bounded cardinality of organization memberships per user.

[github-actions]

Checkmarx One – Scan Summary & Details – 37167581-c759-4fe9-9dbd-139af1e71732

---

New Issues (2)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		CSRF	src/Api/Vault/Controllers/CiphersController.cs: 1558	details Method at line 1558 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ... Attack Vector
2		CSRF	src/Api/Vault/Controllers/CiphersController.cs: 1385	details Method at line 1385 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ... Attack Vector

[codecov]

Codecov Report

❌ Patch coverage is 77.27273% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 59.08%. Comparing base (914d412) to head (7d0dde7).
⚠️ Report is 6 commits behind head on main.

Files with missing lines	Patch %	Lines
...esCache/ExtendedOrganizationAbilityCacheService.cs	58.33%	5 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7476   +/-   ##
=======================================
  Coverage   59.08%   59.08%           
=======================================
  Files        2078     2078           
  Lines       91488    91495    +7     
  Branches     8135     8136    +1     
=======================================
+ Hits        54053    54062    +9     
+ Misses      35507    35503    -4     
- Partials     1928     1930    +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[JaredScar]

Looks good to me, nice work fellow Jared

[JimmyVo16]

Nit (non-blocker): There will be a provider cache here, so it’ll probably make more sense to add “org” to this cache name. That said, we have a ticket to remove this whole class in the near future, and it’s only a local variable, so I’ll leave it up to you.

[JimmyVo16]

The changes for the multiple cases look good.

Side note: depending on the outcomes of 1 and 2, we should consider adding them to this PR since it’s touching the same area.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud