[PM-38923] feat: Add v2 UpdateOrganizationUser command with role-escalation validation

src/Api/AdminConsole/Controllers/OrganizationUsersController.cs

@@ -10,7 +10,6 @@
 using Bit.Api.AdminConsole.Models.Response.Organizations;
 using Bit.Api.Models.Response;
 using Bit.Core;
-using Bit.Core.AdminConsole.AbilitiesCache;
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.AdminConsole.Models.Data;
 using Bit.Core.AdminConsole.OrganizationFeatures.AccountRecovery;
@@ -37,6 +36,7 @@
 using Bit.Core.Exceptions;
 using Bit.Core.Models.Api;
 using Bit.Core.Models.Business;
+using Bit.Core.Models.Data;
 using Bit.Core.Models.Data.Organizations.OrganizationUsers;
 using Bit.Core.OrganizationFeatures.OrganizationSubscriptions.Interface;
 using Bit.Core.OrganizationFeatures.OrganizationUsers.Interfaces;
@@ -49,6 +49,7 @@
 using Microsoft.AspNetCore.Mvc;
 using V1_RevokeOrganizationUserCommand = Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.RevokeUser.v1.IRevokeOrganizationUserCommand;
 using V2_RevokeOrganizationUserCommand = Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.RevokeUser.v2;
+using V2_UpdateUserCommand = Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.UpdateUser.v2;
 
 namespace Bit.Api.AdminConsole.Controllers;
 
@@ -68,7 +69,6 @@ public class OrganizationUsersController : BaseAdminConsoleController
     private readonly IUpdateOrganizationUserCommand _updateOrganizationUserCommand;
     private readonly IAcceptOrgUserCommand _acceptOrgUserCommand;
     private readonly IAuthorizationService _authorizationService;
-    private readonly IOrganizationAbilityCacheService _organizationAbilityCacheService;
     private readonly ISsoConfigRepository _ssoConfigRepository;
     private readonly IOrganizationUserUserDetailsQuery _organizationUserUserDetailsQuery;
     private readonly IRemoveOrganizationUserCommand _removeOrganizationUserCommand;
@@ -91,6 +91,8 @@ public class OrganizationUsersController : BaseAdminConsoleController
     private readonly IUpdateUserResetPasswordEnrollmentCommand _updateUserResetPasswordEnrollmentCommand;
     private readonly IAcceptOrganizationInviteLinkCommand _acceptOrganizationInviteLinkCommand;
     private readonly IConfirmOrganizationInviteLinkCommand _confirmOrganizationInviteLinkCommand;
+    private readonly Bitwarden.Server.Sdk.Features.IFeatureService _featureService;
+    private readonly V2_UpdateUserCommand.IUpdateOrganizationUserCommand _updateOrganizationUserCommandVNext;
 
     public OrganizationUsersController(IOrganizationRepository organizationRepository,
         IOrganizationUserRepository organizationUserRepository,
@@ -104,7 +106,6 @@ public OrganizationUsersController(IOrganizationRepository organizationRepositor
         IUpdateOrganizationUserCommand updateOrganizationUserCommand,
         IAcceptOrgUserCommand acceptOrgUserCommand,
         IAuthorizationService authorizationService,
-        IOrganizationAbilityCacheService organizationAbilityCacheService,
         ISsoConfigRepository ssoConfigRepository,
         IOrganizationUserUserDetailsQuery organizationUserUserDetailsQuery,
         IRemoveOrganizationUserCommand removeOrganizationUserCommand,
@@ -126,7 +127,9 @@ public OrganizationUsersController(IOrganizationRepository organizationRepositor
         IUpdateUserResetPasswordEnrollmentCommand updateUserResetPasswordEnrollmentCommand,
         IGetPendingAutoConfirmUsersQuery getPendingAutoConfirmUsersQuery,
         IAcceptOrganizationInviteLinkCommand acceptOrganizationInviteLinkCommand,
-        IConfirmOrganizationInviteLinkCommand confirmOrganizationInviteLinkCommand)
+        IConfirmOrganizationInviteLinkCommand confirmOrganizationInviteLinkCommand,
+        Bitwarden.Server.Sdk.Features.IFeatureService featureService,
+        V2_UpdateUserCommand.IUpdateOrganizationUserCommand updateOrganizationUserCommandVNext)
     {
         _organizationRepository = organizationRepository;
         _organizationUserRepository = organizationUserRepository;
@@ -140,7 +143,6 @@ public OrganizationUsersController(IOrganizationRepository organizationRepositor
         _updateOrganizationUserCommand = updateOrganizationUserCommand;
         _acceptOrgUserCommand = acceptOrgUserCommand;
         _authorizationService = authorizationService;
-        _organizationAbilityCacheService = organizationAbilityCacheService;
         _ssoConfigRepository = ssoConfigRepository;
         _organizationUserUserDetailsQuery = organizationUserUserDetailsQuery;
         _removeOrganizationUserCommand = removeOrganizationUserCommand;
@@ -163,6 +165,8 @@ public OrganizationUsersController(IOrganizationRepository organizationRepositor
         _updateUserResetPasswordEnrollmentCommand = updateUserResetPasswordEnrollmentCommand;
         _acceptOrganizationInviteLinkCommand = acceptOrganizationInviteLinkCommand;
         _confirmOrganizationInviteLinkCommand = confirmOrganizationInviteLinkCommand;
+        _featureService = featureService;
+        _updateOrganizationUserCommandVNext = updateOrganizationUserCommandVNext;
     }
 
     [HttpGet("{id}")]
@@ -398,10 +402,11 @@ public async Task<ListResponseModel<OrganizationUserPublicKeyResponseModel>> Use
 
     [HttpPut("{id}")]
     [Authorize<ManageUsersRequirement>]
-    public async Task Put(Guid orgId, Guid id, [FromBody] OrganizationUserUpdateRequestModel model)
+    public async Task<IResult> Put([BindOrganization] Organization organization, Guid id, [FromBody] OrganizationUserUpdateRequestModel model)
     {
         var (organizationUser, currentAccess) = await _organizationUserRepository.GetByIdWithCollectionsAsync(id);
-        if (organizationUser == null || organizationUser.OrganizationId != orgId)
+
+        if (organizationUser == null || organizationUser.OrganizationId != organization.Id)
         {
             throw new NotFoundException();
         }
@@ -412,72 +417,110 @@ public async Task Put(Guid orgId, Guid id, [FromBody] OrganizationUserUpdateRequ
         // Authorization check:
         // If admins are not allowed access to all collections, you cannot add yourself to a group.
         // No error is thrown for this, we just don't update groups.
-        var organizationAbility = await _organizationAbilityCacheService.GetOrganizationAbilityAsync(orgId);
-        var groupsToSave = editingSelf && !organizationAbility.AllowAdminAccessToAllCollectionItems
+        var groupsToSave = editingSelf && !organization.AllowAdminAccessToAllCollectionItems
             ? null
             : model.Groups;
 
+        var currentAccessIds = currentAccess.Select(c => c.Id).ToHashSet();
+        var existingUserType = organizationUser.Type;
+
+        if (_featureService.IsEnabled(FeatureFlagKeys.ChangeMemberEmailNoMp))
+        {
+            var (collectionsToSave, postedCollections) = await GetAuthorizedCollectionsToSaveAsync(model, currentAccess);
+
+            var actingContext = _currentContext.GetOrganization(organization.Id);
+
+            var request = new V2_UpdateUserCommand.UpdateOrganizationUserRequest(
+                organizationUser,
+                organization,
+                currentAccessIds,
+                postedCollections,
+                model.Type.Value,
+                model.Permissions,
+                model.AccessSecretsManager,
+                collectionsToSave,
+                groupsToSave,
+                new StandardUser(
+                    userId,
+                    await _currentContext.OrganizationOwner(organization.Id),
+                    actingContext?.Type,
+                    actingContext?.Permissions),
+                model.DefaultUserCollectionName);
+
+            var result = await _updateOrganizationUserCommandVNext.UpdateUserAsync(request);
+            return Handle(result);
+        }
+
         // Authorization check:
         // If admins are not allowed access to all collections, you cannot add yourself to collections.
         // This is not caught by the requirement below that you can ModifyUserAccess and must be checked separately
-        var currentAccessIds = currentAccess.Select(c => c.Id).ToHashSet();
         if (editingSelf &&
-            !organizationAbility.AllowAdminAccessToAllCollectionItems &&
+            !organization.AllowAdminAccessToAllCollectionItems &&
             model.Collections.Any(c => !currentAccessIds.Contains(c.Id)))
         {
             throw new BadRequestException("You cannot add yourself to a collection.");
         }
 
+        var (collectionsToSaveV1, _) = await GetAuthorizedCollectionsToSaveAsync(model, currentAccess);
+
+        await _updateOrganizationUserCommand.UpdateUserAsync(model.ToOrganizationUser(organizationUser), existingUserType, userId,
+            collectionsToSaveV1, groupsToSave, model.DefaultUserCollectionName);
+
+        return TypedResults.Ok();
+    }
+
+    /// <summary>
+    /// Resolves the collection access to persist for an organization user update. Collections the saving user
+    /// cannot <see cref="BulkCollectionOperations.ModifyUserAccess"/> are validated and the user's current
+    /// access to them is preserved so it is not accidentally overwritten.
+    /// </summary>
+    private async Task<(List<CollectionAccessSelection> CollectionsToSave, ICollection<Collection> Collections)> GetAuthorizedCollectionsToSaveAsync(OrganizationUserUpdateRequestModel model, ICollection<CollectionAccessSelection> currentAccess)
+    {
         // Authorization check:
-        // You must have authorization to ModifyUserAccess for all collections being saved
-        var postedCollections = await _collectionRepository
-            .GetManyByManyIdsAsync(model.Collections.Select(c => c.Id));
-        foreach (var collection in postedCollections)
-        {
-            if (!(await _authorizationService.AuthorizeAsync(User, collection,
-                    BulkCollectionOperations.ModifyUserAccess))
-                .Succeeded)
-            {
-                throw new NotFoundException();
-            }
+        // You must have authorization to ModifyUserAccess for all collections being saved.
+        var postedCollections = await _collectionRepository.GetManyByManyIdsAsync(model.Collections.Select(c => c.Id));
+        if (postedCollections.Count != 0 &&
+            !(await _authorizationService.AuthorizeAsync(User, postedCollections, BulkCollectionOperations.ModifyUserAccess)).Succeeded)
+        {
+            throw new NotFoundException();
         }
 
         // The client only sends collections that the saving user has permissions to edit.
         // We need to combine these with collections that the user doesn't have permissions for, so that we don't
         // accidentally overwrite those
-        var currentCollections = await _collectionRepository
-            .GetManyByManyIdsAsync(currentAccess.Select(cas => cas.Id));
+        var currentCollections = await _collectionRepository.GetManyByManyIdsAsync(currentAccess.Select(cas => cas.Id));
 
         var readonlyCollectionIds = new HashSet<Guid>();
+
         foreach (var collection in currentCollections)
         {
-            if (!(await _authorizationService.AuthorizeAsync(User, collection, BulkCollectionOperations.ModifyUserAccess))
-                .Succeeded)
+            if (!(await _authorizationService.AuthorizeAsync(User, collection, BulkCollectionOperations.ModifyUserAccess)).Succeeded)
             {
                 readonlyCollectionIds.Add(collection.Id);
             }
         }
 
-        var editedCollectionAccess = model.Collections
-            .Select(c => c.ToSelectionReadOnly());
+        // Default user collections ("My Items") are never managed through this flow. Exclude any current-access
+        // defaults from the preserved set so they are not re-saved; posted defaults are rejected downstream.
+        var defaultCollectionIds = postedCollections
+            .Concat(currentCollections)
+            .Where(c => c.Type == CollectionType.DefaultUserCollection)
+            .Select(c => c.Id)
+            .ToHashSet();
+
+        var editedCollectionAccess = model.Collections.Select(c => c.ToSelectionReadOnly());
         var readonlyCollectionAccess = currentAccess
-            .Where(ca => readonlyCollectionIds.Contains(ca.Id));
+            .Where(ca => readonlyCollectionIds.Contains(ca.Id) && !defaultCollectionIds.Contains(ca.Id));
         var collectionsToSave = editedCollectionAccess
             .Concat(readonlyCollectionAccess)
             .ToList();
 
-        var existingUserType = organizationUser.Type;
-
-        await _updateOrganizationUserCommand.UpdateUserAsync(model.ToOrganizationUser(organizationUser), existingUserType, userId,
-            collectionsToSave, groupsToSave, model.DefaultUserCollectionName);
-    }
+        var collections = postedCollections
+            .Concat(currentCollections)
+            .DistinctBy(c => c.Id)
+            .ToList();
 
-    [HttpPost("{id}")]
-    [Obsolete("This endpoint is deprecated. Use PUT method instead")]
-    [Authorize<ManageUsersRequirement>]
-    public async Task PostPut(Guid orgId, Guid id, [FromBody] OrganizationUserUpdateRequestModel model)
-    {
-        await Put(orgId, id, model);
+        return (collectionsToSave, collections);
     }
 
     [HttpPut("{userId}/reset-password-enrollment")]

src/Core/AdminConsole/Entities/OrganizationUser.cs

@@ -2,20 +2,19 @@
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.AdminConsole.Enums;
 using Bit.Core.AdminConsole.Interfaces;
+using Bit.Core.AdminConsole.Models.Data;
 using Bit.Core.Enums;
 using Bit.Core.Models;
 using Bit.Core.Models.Data;
 using Bit.Core.Utilities;
 
-#nullable enable
-
 namespace Bit.Core.Entities;
 
 /// <summary>
 /// An association table between one <see cref="User"/> and one <see cref="Organization"/>, representing that user's
 /// membership in the organization. "Member" refers to the OrganizationUser object.
 /// </summary>
-public class OrganizationUser : ITableObject<Guid>, IExternal, IOrganizationUser
+public class OrganizationUser : ITableObject<Guid>, IExternal, IOrganizationUser, IOrganizationUserRole
 {
     /// <summary>
     /// A unique random identifier.
@@ -153,4 +152,19 @@ public void SetPermissions(Permissions permissions)
     {
         Permissions = CoreHelpers.ClassToJsonData(permissions);
     }
+
+    public OrganizationUser UpdateOrganizationUser(OrganizationUserType organizationUserType,
+        Permissions? permissions,
+        bool accessSecretsManager,
+        TimeProvider timeProvider)
+    {
+        if (permissions is not null)
+        {
+            SetPermissions(permissions);
+        }
+        Type = organizationUserType;
+        AccessSecretsManager = accessSecretsManager;
+        RevisionDate = timeProvider.GetUtcNow().UtcDateTime;
+        return this;
+    }
 }

src/Core/AdminConsole/Models/Data/CollectionAccessSelection.cs

@@ -24,4 +24,9 @@ public class CollectionAccessSelection
     /// deleting it, and assigning access for other users and groups.
     /// </summary>
     public bool Manage { get; set; }
+
+    /// <summary>
+    /// Manage is mutually exclusive with ReadOnly and HidePasswords.
+    /// </summary>
+    public bool Valid() => !(Manage && (ReadOnly || HidePasswords));
 }

src/Core/AdminConsole/Models/Data/IOrganizationUserRole.cs

@@ -0,0 +1,14 @@
+using Bit.Core.Enums;
+using Bit.Core.Models.Data;
+
+namespace Bit.Core.AdminConsole.Models.Data;
+
+/// <summary>
+/// The minimal role information needed to authorize whether one member can manage another.
+/// </summary>
+public interface IOrganizationUserRole
+{
+    OrganizationUserType Type { get; }
+    Guid OrganizationId { get; }
+    Permissions? GetPermissions();
+}

src/Core/AdminConsole/Models/Data/OrganizationUserRole.cs

@@ -0,0 +1,15 @@
+using Bit.Core.Enums;
+using Bit.Core.Models.Data;
+
+namespace Bit.Core.AdminConsole.Models.Data;
+
+/// <summary>
+/// A lightweight <see cref="IOrganizationUserRole"/> for when a full OrganizationUser isn't available.
+/// </summary>
+public sealed record OrganizationUserRole(
+    OrganizationUserType Type,
+    Guid OrganizationId,
+    Permissions? Permissions = null) : IOrganizationUserRole
+{
+    public Permissions? GetPermissions() => Permissions;
+}

src/Core/AdminConsole/Models/Data/StandardUser.cs

@@ -1,16 +1,15 @@
 using Bit.Core.Enums;
+using Bit.Core.Models.Data;
 
 namespace Bit.Core.AdminConsole.Models.Data;
 
-public class StandardUser : IActingUser
+public class StandardUser(Guid userId, bool isOrganizationOwner, OrganizationUserType? orgUserType = null,
+    Permissions? permissions = null) : IActingUser
 {
-    public StandardUser(Guid userId, bool isOrganizationOwner)
-    {
-        UserId = userId;
-        IsOrganizationOwnerOrProvider = isOrganizationOwner;
-    }
-
-    public Guid? UserId { get; }
-    public bool IsOrganizationOwnerOrProvider { get; }
+    public Guid? UserId { get; } = userId;
+    public bool IsOrganizationOwnerOrProvider { get; } = isOrganizationOwner;
+    public OrganizationUserType? OrganizationUserType { get; } = orgUserType;
+    public Permissions? Permissions { get; } = permissions;
     public EventSystemUser? SystemUserType => throw new Exception($"{nameof(StandardUser)} does not have a {nameof(SystemUserType)}");
+
 }

src/Core/AdminConsole/Models/Data/SystemUser.cs

@@ -2,15 +2,10 @@
 
 namespace Bit.Core.AdminConsole.Models.Data;
 
-public class SystemUser : IActingUser
+public class SystemUser(EventSystemUser systemUser) : IActingUser
 {
-    public SystemUser(EventSystemUser systemUser)
-    {
-        SystemUserType = systemUser;
-    }
-
     public Guid? UserId => throw new Exception($"{nameof(SystemUserType)} does not have a {nameof(UserId)}.");
 
     public bool IsOrganizationOwnerOrProvider => false;
-    public EventSystemUser? SystemUserType { get; }
+    public EventSystemUser? SystemUserType { get; } = systemUser;
 }

src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/OrganizationUserAction/Errors.cs

@@ -2,8 +2,12 @@
 
 namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.OrganizationUserAction;
 
-/// <summary>
-/// Returned when the acting user lacks the authority to act on the target member's role.
-/// </summary>
-public record CannotManageTargetUser()
-    : BadRequestError("You do not have permission to manage this user.");
+public record CannotManageTargetUser() : BadRequestError("You do not have permission to manage this user.");
+
+public record OnlyOwnersCanManageOwners() : BadRequestError("Only an Owner can manage another Owner's account.");
+
+public record CustomUsersCannotManageAdminsOrOwners() : BadRequestError("Custom users can not manage Admins or Owners.");
+
+public record CustomUsersCanOnlyGrantOwnPermissions() : BadRequestError("Custom users can only grant the same custom permissions that they have.");
+
+public record CannotBeAdminOfMultipleFreeOrganizations() : BadRequestError("User can only be an admin of one free organization.");