[PM-32477]PremiumStatusChanged Push Notification by cyprain-okeke · Pull Request #7198 · bitwarden/server

cyprain-okeke · 2026-03-11T12:38:27Z

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-32477

📔 Objective

Summary
Implement premium-status push notifications across billing flows so clients stay in sync whenever a user’s premium state changes.

Details

New adapter API for premium changes

Extend IPushNotificationAdapter with NotifyPremiumStatusChangedAsync(User user).
Implement in PushNotificationAdapter by delegating to IPushNotificationService.PushPremiumStatusChangedAsync(user).

Stripe payment and subscription handlers

PaymentSucceededHandler
- Inject IUserRepository.
- After EnablePremiumAsync(userId, subscription.GetCurrentPeriodEnd()), load the user and call NotifyPremiumStatusChangedAsync(user) so successful payments trigger a premium-status push.

SubscriptionDeletedHandler

Inject IUserRepository and IPushNotificationAdapter.
When a user subscription is deleted (userId present), call DisablePremiumAsync and then fetch the user and send NotifyPremiumStatusChangedAsync(user).

SubscriptionUpdatedHandler

Inject IUserRepository and IPushNotificationAdapter.
In DisableSubscriberAsync user branch: disable premium, fetch the user, then call NotifyPremiumStatusChangedAsync(user).
In EnableSubscriberAsync user branch: enable premium, fetch the user, then call NotifyPremiumStatusChangedAsync(user).

Premium subscription commands

CreatePremiumCloudHostedSubscriptionCommand
- After saving the user and PushSyncVaultAsync(user.Id), call PushPremiumStatusChangedAsync(user) so new/updated cloud subscriptions immediately push the status change.
CreatePremiumSelfHostedSubscriptionCommand
After writing the license and saving the user, call PushPremiumStatusChangedAsync(user) to broadcast the new premium status for self-hosted subscriptions.
UpgradePremiumToOrganizationCommand
- Inject IPushNotificationService.
- After downgrading the user’s personal premium while upgrading to an organization, call PushPremiumStatusChangedAsync(user) so clients see the user’s premium flag change.

Tests

Update billing service tests to:
- Use IUserRepository to return a User instance when subscriptions are enabled/disabled.
- Assert IPushNotificationAdapter.NotifyPremiumStatusChangedAsync(user) is called in subscription deleted/updated scenarios.
Update premium command tests to:
- Assert IPushNotificationService.PushPremiumStatusChangedAsync is called with a User whose Premium flag matches the expected post-command state (true for new subscriptions, false when upgrading to an organization).

📸 Screenshots

github-actions · 2026-03-11T12:49:47Z

Checkmarx One – Scan Summary & Details – 20a61883-b64f-475e-ba44-258ac0cf1900

New Issues (2)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1569	details Method at line 1569 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ... Attack Vector
2		CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1403	details Method at line 1403 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ... Attack Vector

Fixed Issues (2)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	~~CSRF~~	/src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 105
	~~CSRF~~	/src/Api/Vault/Controllers/CiphersController.cs: 293

…otification

codecov · 2026-03-11T13:23:18Z

Codecov Report

❌ Patch coverage is 61.36364% with 34 lines in your changes missing coverage. Please review.
✅ Project coverage is 57.43%. Comparing base (20d94c3) to head (cd1f7e8).

Files with missing lines	Patch %	Lines
...ervices/Implementations/PushNotificationAdapter.cs	0.00%	12 Missing ⚠️
...lling/Services/Implementations/LicensingService.cs	20.00%	12 Missing ⚠️
...ervices/Implementations/PaymentSucceededHandler.cs	0.00%	7 Missing ⚠️
src/Notifications/HubHelpers.cs	66.66%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7198   +/-   ##
=======================================
  Coverage   57.43%   57.43%           
=======================================
  Files        2032     2032           
  Lines       89377    89460   +83     
  Branches     7944     7948    +4     
=======================================
+ Hits        51331    51382   +51     
- Misses      36203    36234   +31     
- Partials     1843     1844    +1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

amorask-bitwarden · 2026-03-11T18:33:10Z

src/Billing/Services/Implementations/PaymentSucceededHandler.cs


            await userService.EnablePremiumAsync(userId.Value, subscription.GetCurrentPeriodEnd());
+            var user = await userRepository.GetByIdAsync(userId.Value);
+            await pushNotificationAdapter.NotifyPremiumStatusChangedAsync(user!);


❌ 2 things we should clean up here:

userService.EnablePremiumAsync makes no guarantees the User exists. It just skips the operation if the user is null, which means line 120 could result in an NRE. Not only that, but if the User that comes back from the DB is null, the Enable would be followed by us sending the notification anyway, which is incorrect.

This will never be hit for users on the new price because of the missed Price adaptation on line 113 - we should fix that.

amorask-bitwarden · 2026-03-11T18:34:57Z

src/Core/Platform/Push/IPushNotificationService.cs

            ExcludeCurrentContext = false,
        });
+
+    Task PushPremiumStatusChangedAsync(Entities.User user)


❌ We're no longer adding methods like this to the shared IPushNotificationService. Please follow the established pattern in the the Billing application's PushNotificationAdapter so that we own the code.

amorask-bitwarden · 2026-03-11T18:35:57Z

src/Billing/Services/Implementations/PushNotificationAdapter.cs

            ExcludeCurrentContext = false,
        });
+
+    public Task NotifyPremiumStatusChangedAsync(User user) =>


❌ Related to this comment, this should follow the pattern of the methods above.

amorask-bitwarden · 2026-03-11T18:36:53Z

src/Billing/Services/Implementations/SubscriptionDeletedHandler.cs

        {
            await _userService.DisablePremiumAsync(userId.Value, subscription.GetCurrentPeriodEnd());
+            var user = await _userRepository.GetByIdAsync(userId.Value);
+            await _pushNotificationAdapter.NotifyPremiumStatusChangedAsync(user!);


❌ Same issue as here.

amorask-bitwarden · 2026-03-11T18:37:43Z

src/Billing/Services/Implementations/SubscriptionUpdatedHandler.cs

+            {
+                await _userService.DisablePremiumAsync(userId.Value, currentPeriodEnd);
+                var user = await _userRepository.GetByIdAsync(userId.Value);
+                await _pushNotificationAdapter.NotifyPremiumStatusChangedAsync(user!);


❌ Same issue as here.

amorask-bitwarden · 2026-03-11T18:37:56Z

src/Billing/Services/Implementations/SubscriptionUpdatedHandler.cs

+            {
+                await _userService.EnablePremiumAsync(userId.Value, currentPeriodEnd);
+                var user = await _userRepository.GetByIdAsync(userId.Value);
+                await _pushNotificationAdapter.NotifyPremiumStatusChangedAsync(user!);


❌ Same issue as here.

amorask-bitwarden · 2026-03-11T18:39:29Z

src/Core/Billing/Premium/Commands/CreatePremiumCloudHostedSubscriptionCommand.cs


        await userService.SaveUserAsync(user);
        await pushNotificationService.PushSyncVaultAsync(user.Id);
+        await pushNotificationService.PushPremiumStatusChangedAsync(user);


❓ Wouldn't this be redundant? I assume a full sync would re-pull Premium status, right?

amorask-bitwarden · 2026-03-11T18:39:51Z

src/Core/Billing/Premium/Commands/CreatePremiumSelfHostedSubscriptionCommand.cs


        await userService.SaveUserAsync(user);
        await pushNotificationService.PushSyncVaultAsync(user.Id);
+        await pushNotificationService.PushPremiumStatusChangedAsync(user);


❓ Same question as here.

amorask-bitwarden · 2026-03-11T18:44:10Z

src/Core/Models/PushNotification.cs

+{
+    public Guid UserId { get; set; }
+    public bool Premium { get; set; }
+    public DateTime? PremiumExpirationDate { get; set; }


❓ Is there a client-side use-case for including the expiration date?

amorask-bitwarden · 2026-03-11T18:46:51Z

src/Core/Models/PushNotification.cs

    public Guid TargetOrganizationUserId { get; set; }
 }
+
+public class PremiumStatusPushNotification


❌ Please review the comments on lines 7 and 8 of this file regarding the location this file should live in.

djsmith85

It seems like after the comments from @amorask-bitwarden are addressed, a review from platform might not be necessary anymore. In case they do, please re-request a review.

…otification

sonarqubecloud · 2026-03-12T15:08:54Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

changes for the premium push notification

2dabe3e

cyprain-okeke requested review from a team as code owners March 11, 2026 12:38

cyprain-okeke requested review from amorask-bitwarden and djsmith85 March 11, 2026 12:38

Merge branch 'main' into billing/pm-32477/premiumStatusChanged-push-n…

80a0f4e

…otification

cyprain-okeke added 2 commits March 11, 2026 14:40

Fix the lint build

4055d78

implement the hub-helper

fa063c0

amorask-bitwarden requested changes Mar 11, 2026

View reviewed changes

djsmith85 reviewed Mar 12, 2026

View reviewed changes

cyprain-okeke and others added 3 commits March 12, 2026 13:02

Resolve the pr comments

1886e62

Merge branch 'main' into billing/pm-32477/premiumStatusChanged-push-n…

50317ab

…otification

fix the lint error

2c6281e

cyprain-okeke requested review from amorask-bitwarden and djsmith85 and removed request for djsmith85 March 12, 2026 12:22

Merge branch 'main' into billing/pm-32477/premiumStatusChanged-push-n…

cd1f7e8

…otification

Conversation

cyprain-okeke commented Mar 11, 2026

🎟️ Tracking

📔 Objective

📸 Screenshots

Uh oh!

github-actions bot commented Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

amorask-bitwarden Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

djsmith85 left a comment

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Mar 12, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions bot commented Mar 11, 2026 •

edited

Loading

codecov bot commented Mar 11, 2026 •

edited

Loading

amorask-bitwarden Mar 11, 2026 •

edited

Loading