Skip to content

[PM-34773] Fix storage addition during active Phase 2 of schedule#7420

Merged
amorask-bitwarden merged 2 commits into
mainfrom
billing/PM-34773/fix-phase2-storage-addition
Apr 8, 2026
Merged

[PM-34773] Fix storage addition during active Phase 2 of schedule#7420
amorask-bitwarden merged 2 commits into
mainfrom
billing/PM-34773/fix-phase2-storage-addition

Conversation

@amorask-bitwarden
Copy link
Copy Markdown
Contributor

@amorask-bitwarden amorask-bitwarden commented Apr 8, 2026

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-34773

📔 Objective

Fixes a 500 error when adding or removing storage for Premium users or Families organizations whose subscription schedule has transitioned to Phase 2 (the migrated price is active).

The schedule-aware storage commands (introduced in PM-33898) reconstructed both schedule phases when updating storage. After Phase 2 activates, Phase 1's dates are in the past and Stripe rejects updates to ended phases. This PR:

  • Skips Phase 1 when its EndDate has passed, sending only the active phase(s) to Stripe
  • Strips the one-time migration discount from Phase 2 when it is already active, preventing Stripe from re-applying a consumed coupon
  • Guards against degenerate schedule states where no updatable phases remain
  • Uses subscription.TestClock.FrozenTime for accurate phase-ended detection in test clock environments

📸 Screenshots

Screen.Recording.2026-04-08.at.9.22.00.AM.mov

@amorask-bitwarden amorask-bitwarden marked this pull request as ready for review April 8, 2026 14:33
@amorask-bitwarden amorask-bitwarden requested a review from a team as a code owner April 8, 2026 14:33
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented Apr 8, 2026

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 8, 2026

Logo
Checkmarx One – Scan Summary & Detailsce289386-89a7-49f8-a9fb-7ab3f14d6448


New Issues (121) Checkmarx found the following issues in this Pull Request
# Severity Issue Source File / Package Checkmarx Insight
1 CRITICAL Stored_XSS /src/SharedWeb/Health/HealthCheckServiceExtensions.cs: 61
detailsThe method embeds untrusted data in generated output with WriteAsync, at line 60 of /src/SharedWeb/Health/HealthCheckServiceExtensions.cs. This ...
Attack Vector
2 CRITICAL Stored_XSS /util/Server/Startup.cs: 57
detailsThe method embeds untrusted data in generated output with WriteAsync, at line 59 of /util/Server/Startup.cs. This untrusted data is embedded int...
Attack Vector
3 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs: 55
detailsMethod at line 55 of /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs gets a parameter from a user request from user. This pa...
Attack Vector
4 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 145
detailsMethod at line 145 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from request. T...
Attack Vector
5 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 145
detailsMethod at line 145 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from request. T...
Attack Vector
6 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 97
detailsMethod at line 97 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. This...
Attack Vector
7 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 97
detailsMethod at line 97 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. This...
Attack Vector
8 MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 534
detailsMethod at line 534 of /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs gets a parameter from a user request from model. This par...
Attack Vector
9 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 229
detailsMethod at line 229 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. Thi...
Attack Vector
10 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1558
detailsMethod at line 1558 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
11 MEDIUM CSRF /src/Api/Tools/Controllers/SendsController.cs: 73
detailsMethod at line 73 of /src/Api/Tools/Controllers/SendsController.cs gets a parameter from a user request from id. This parameter value flows thro...
Attack Vector
12 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs: 145
detailsMethod at line 145 of /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs gets a parameter from a user request from user. This p...
Attack Vector
13 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 217
detailsMethod at line 217 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
14 MEDIUM CSRF /src/Api/Public/Controllers/CollectionsController.cs: 91
detailsMethod at line 91 of /src/Api/Public/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value ...
Attack Vector
15 MEDIUM CSRF /src/Api/Public/Controllers/CollectionsController.cs: 91
detailsMethod at line 91 of /src/Api/Public/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value ...
Attack Vector
16 MEDIUM CSRF /src/Api/Public/Controllers/CollectionsController.cs: 91
detailsMethod at line 91 of /src/Api/Public/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value ...
Attack Vector
17 MEDIUM CSRF /src/Api/Public/Controllers/CollectionsController.cs: 91
detailsMethod at line 91 of /src/Api/Public/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value ...
Attack Vector
18 MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 184
detailsMethod at line 184 of /src/Api/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value flows ...
Attack Vector
19 MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 184
detailsMethod at line 184 of /src/Api/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value flows ...
Attack Vector
20 MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 184
detailsMethod at line 184 of /src/Api/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value flows ...
Attack Vector
21 MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 184
detailsMethod at line 184 of /src/Api/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value flows ...
Attack Vector
22 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 173
detailsMethod at line 173 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. Thi...
Attack Vector
23 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 452
detailsMethod at line 452 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
24 MEDIUM CSRF /src/Api/Dirt/Controllers/OrganizationReportsController.cs: 187
detailsMethod at line 187 of /src/Api/Dirt/Controllers/OrganizationReportsController.cs gets a parameter from a user request from request. This paramet...
Attack Vector
25 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs: 104
detailsMethod at line 104 of /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs gets a parameter from a user request from user. This p...
Attack Vector
26 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/OrganizationBillingVNextController.cs: 107
detailsMethod at line 107 of /src/Api/Billing/Controllers/VNext/OrganizationBillingVNextController.cs gets a parameter from a user request from organiza...
Attack Vector
27 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1417
detailsMethod at line 1417 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
28 MEDIUM CSRF /src/Api/Dirt/Controllers/OrganizationReportsController.cs: 231
detailsMethod at line 231 of /src/Api/Dirt/Controllers/OrganizationReportsController.cs gets a parameter from a user request from request. This paramet...
Attack Vector
29 MEDIUM CSRF /src/Api/Dirt/Controllers/OrganizationReportsController.cs: 284
detailsMethod at line 284 of /src/Api/Dirt/Controllers/OrganizationReportsController.cs gets a parameter from a user request from request. This paramet...
Attack Vector
30 MEDIUM CSRF /src/Api/Dirt/Controllers/OrganizationReportsController.cs: 187
detailsMethod at line 187 of /src/Api/Dirt/Controllers/OrganizationReportsController.cs gets a parameter from a user request from request. This paramet...
Attack Vector
31 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1417
detailsMethod at line 1417 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
32 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1417
detailsMethod at line 1417 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
33 MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: 289
detailsMethod at line 289 of /src/Api/AdminConsole/Controllers/GroupsController.cs gets a parameter from a user request from orgUserId. This parameter ...
Attack Vector
34 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1385
detailsMethod at line 1385 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
35 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1446
detailsMethod at line 1446 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
36 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1148
detailsMethod at line 1148 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
37 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1032
detailsMethod at line 1032 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
38 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1281
detailsMethod at line 1281 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from organizationId. This parameter ...
Attack Vector
39 MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 394
detailsMethod at line 394 of /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs gets a parameter from a user request from model. This par...
Attack Vector
40 MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 385
detailsMethod at line 385 of /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs gets a parameter from a user request from model. This par...
Attack Vector
41 MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 385
detailsMethod at line 385 of /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs gets a parameter from a user request from id. This parame...
Attack Vector
42 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/OrganizationBillingVNextController.cs: 95
detailsMethod at line 95 of /src/Api/Billing/Controllers/VNext/OrganizationBillingVNextController.cs gets a parameter from a user request from organizat...
Attack Vector
43 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/ProviderBillingVNextController.cs: 82
detailsMethod at line 82 of /src/Api/Billing/Controllers/VNext/ProviderBillingVNextController.cs gets a parameter from a user request from provider. Th...
Attack Vector
44 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs: 93
detailsMethod at line 93 of /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs gets a parameter from a user request from user. This pa...
Attack Vector
45 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/OrganizationBillingVNextController.cs: 49
detailsMethod at line 49 of /src/Api/Billing/Controllers/VNext/OrganizationBillingVNextController.cs gets a parameter from a user request from organizat...
Attack Vector
46 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/ProviderBillingVNextController.cs: 40
detailsMethod at line 40 of /src/Api/Billing/Controllers/VNext/ProviderBillingVNextController.cs gets a parameter from a user request from provider. Th...
Attack Vector
47 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1226
detailsMethod at line 1226 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from model. This parameter value flo...
Attack Vector
48 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 173
detailsMethod at line 173 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. Thi...
Attack Vector
49 MEDIUM CSRF /src/Api/Vault/Controllers/SecurityTaskController.cs: 66
detailsMethod at line 66 of /src/Api/Vault/Controllers/SecurityTaskController.cs gets a parameter from a user request from taskId. This parameter value...
Attack Vector
50 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 721
detailsMethod at line 721 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from request. This parameter value fl...
Attack Vector
51 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 192
detailsMethod at line 192 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
52 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 641
detailsMethod at line 641 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
53 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 664
detailsMethod at line 664 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
54 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 412
detailsMethod at line 412 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
55 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 385
detailsMethod at line 385 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
56 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 126
detailsMethod at line 126 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
57 MEDIUM CSRF /src/Api/Auth/Controllers/EmergencyAccessController.cs: 173
detailsMethod at line 173 of /src/Api/Auth/Controllers/EmergencyAccessController.cs gets a parameter from a user request from model. This parameter val...
Attack Vector
58 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 825
detailsMethod at line 825 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
59 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 825
detailsMethod at line 825 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
60 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 825
detailsMethod at line 825 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows t...
Attack Vector
61 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 825
detailsMethod at line 825 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows t...
Attack Vector
62 MEDIUM CSRF /src/Api/NotificationCenter/Controllers/NotificationsController.cs: 67
detailsMethod at line 67 of /src/Api/NotificationCenter/Controllers/NotificationsController.cs gets a parameter from a user request from id. This param...
Attack Vector
63 MEDIUM CSRF /src/Api/NotificationCenter/Controllers/NotificationsController.cs: 61
detailsMethod at line 61 of /src/Api/NotificationCenter/Controllers/NotificationsController.cs gets a parameter from a user request from id. This param...
Attack Vector
64 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1446
detailsMethod at line 1446 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
65 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 763
detailsMethod at line 763 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows t...
Attack Vector
66 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 790
detailsMethod at line 790 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
67 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 763
detailsMethod at line 763 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
68 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 790
detailsMethod at line 790 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows t...
Attack Vector
69 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 790
detailsMethod at line 790 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows t...
Attack Vector
70 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 790
detailsMethod at line 790 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
71 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 763
detailsMethod at line 763 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows t...
Attack Vector
72 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 763
detailsMethod at line 763 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
73 MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: 138
detailsMethod at line 138 of /src/Api/AdminConsole/Controllers/GroupsController.cs gets a parameter from a user request from model. This parameter valu...
Attack Vector
74 MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: 166
detailsMethod at line 166 of /src/Api/AdminConsole/Controllers/GroupsController.cs gets a parameter from a user request from model. This parameter valu...
Attack Vector
75 MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: 166
detailsMethod at line 166 of /src/Api/AdminConsole/Controllers/GroupsController.cs gets a parameter from a user request from model. This parameter valu...
Attack Vector
76 MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 414
detailsMethod at line 414 of /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs gets a parameter from a user request from model. This par...
Attack Vector
77 MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 414
detailsMethod at line 414 of /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs gets a parameter from a user request from model. This par...
Attack Vector
78 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 558
detailsMethod at line 558 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector

More results are available on the CxOne platform

Copy link
Copy Markdown
Collaborator

@sbrown-livefront sbrown-livefront left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@amorask-bitwarden amorask-bitwarden merged commit a5052d8 into main Apr 8, 2026
45 checks passed
@amorask-bitwarden amorask-bitwarden deleted the billing/PM-34773/fix-phase2-storage-addition branch April 8, 2026 14:51
@codecov
Copy link
Copy Markdown

codecov Bot commented Apr 8, 2026

Codecov Report

❌ Patch coverage is 82.85714% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 58.50%. Comparing base (0760329) to head (45b5b7e).
⚠️ Report is 2 commits behind head on main.

Files with missing lines Patch % Lines
.../Commands/UpdateOrganizationSubscriptionCommand.cs 82.85% 6 Missing ⚠️
...ng/Premium/Commands/UpdatePremiumStorageCommand.cs 82.85% 6 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #7420      +/-   ##
==========================================
+ Coverage   58.49%   58.50%   +0.01%     
==========================================
  Files        2063     2063              
  Lines       91190    91241      +51     
  Branches     8130     8130              
==========================================
+ Hits        53343    53383      +40     
- Misses      35948    35959      +11     
  Partials     1899     1899              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

amorask-bitwarden added a commit that referenced this pull request Apr 8, 2026
@djsmith85 djsmith85 added the t:bugfix Change Type - Bugfix label May 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

t:bugfix Change Type - Bugfix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants