Admin Portal - Fix GetTwoFactorProviders wrong exception type handling on Organization and User

src/Core/AdminConsole/Entities/Organization.cs

@@ -1,6 +1,5 @@
 using System.ComponentModel.DataAnnotations;
 using System.Net;
-using System.Text.Json;
 using Bit.Core.Auth.Enums;
 using Bit.Core.Auth.Models;
 using Bit.Core.Billing.Enums;
@@ -480,7 +479,7 @@
 
             return _twoFactorProviders;
         }
-        catch (JsonException)
+        catch (Newtonsoft.Json.JsonException)
         {
             return null;
         }
@@ -543,7 +542,7 @@
     /// <summary>
     /// Updates the organization's properties from a self-hosted license file.
     /// </summary>
     public void UpdateFromLicense(OrganizationLicense license, IFeatureService featureService)
     {
         // The following properties are intentionally excluded from being updated:
         // - Id - self-hosted org will have its own unique Guid

src/Core/Auth/UserFeatures/TwoFactorAuth/Implementations/TwoFactorIsEnabledQuery.cs

@@ -8,20 +8,24 @@
 using Bit.Core.Entities;
 using Bit.Core.Exceptions;
 using Bit.Core.Repositories;
+using Microsoft.Extensions.Logging;
 
 namespace Bit.Core.Auth.UserFeatures.TwoFactorAuth.Implementations;
 
 public class TwoFactorIsEnabledQuery : ITwoFactorIsEnabledQuery
 {
     private readonly IUserRepository _userRepository;
     private readonly IHasPremiumAccessQuery _hasPremiumAccessQuery;
+    private readonly ILogger<TwoFactorIsEnabledQuery> _logger;
 
     public TwoFactorIsEnabledQuery(
         IUserRepository userRepository,
-        IHasPremiumAccessQuery hasPremiumAccessQuery)
+        IHasPremiumAccessQuery hasPremiumAccessQuery,
+        ILogger<TwoFactorIsEnabledQuery> logger)
     {
         _userRepository = userRepository;
         _hasPremiumAccessQuery = hasPremiumAccessQuery;
+        _logger = logger;
     }
 
     public async Task<IEnumerable<(Guid userId, bool twoFactorIsEnabled)>> TwoFactorIsEnabledAsync(IEnumerable<Guid> userIds)
@@ -130,11 +134,23 @@ public async Task<bool> TwoFactorIsEnabledAsync(ITwoFactorProvidersUser user)
     /// </summary>
     /// <param name="user">user with two factor providers</param>
     /// <returns>list of enabled provider types</returns>
-    private static IList<TwoFactorProviderType> GetEnabledTwoFactorProviders(User user)
+    private IList<TwoFactorProviderType> GetEnabledTwoFactorProviders(User user)
     {
         var providers = user.GetTwoFactorProviders();
 
-        if (providers == null || providers.Count == 0)
+        if (providers == null)
+        {
+            if (!string.IsNullOrWhiteSpace(user.TwoFactorProviders))
+            {
+                _logger.LogWarning(
+                    "Unable to parse TwoFactorProviders for user {UserId}; treating as no providers enabled.",
+                    user.Id);
+            }
+
+            return Array.Empty<TwoFactorProviderType>();
+        }
+
+        if (providers.Count == 0)
         {
             return Array.Empty<TwoFactorProviderType>();
         }

src/Core/Entities/User.cs

@@ -1,5 +1,4 @@
 using System.ComponentModel.DataAnnotations;
-using System.Text.Json;
 using Bit.Core.Auth.Enums;
 using Bit.Core.Auth.Models;
 using Bit.Core.Enums;
@@ -222,7 +221,7 @@ given user does or doesn't have this enabled. It is a non-zero chance.
 
             return _twoFactorProviders;
         }
-        catch (JsonException)
+        catch (Newtonsoft.Json.JsonException)
         {
             return null;
         }

test/Core.Test/AdminConsole/Entities/OrganizationTests.cs

@@ -100,6 +100,21 @@ public void GetTwoFactorProviders_SavedWithName_Success()
         Assert.Equal("Host_value", host);
     }
 
+    [Theory]
+    [InlineData("not-json-at-all")]
+    [InlineData("TwoFactorProviders" + "a0c30e2f-0ac1-4ffe-bc3a-47830b829a4f")]
+    [InlineData("{ unterminated")]
+    [InlineData("{ \"6\": \"not-a-provider-object\" }")]
+    public void GetTwoFactorProviders_InvalidJson_ReturnsNull(string invalidJson)
+    {
+        var organization = new Organization
+        {
+            TwoFactorProviders = invalidJson,
+        };
+
+        Assert.Null(organization.GetTwoFactorProviders());
+    }
+
     [Fact]
     public void UseDisableSmAdsForUsers_DefaultValue_IsFalse()
     {

test/Core.Test/Entities/UserTests.cs

@@ -143,6 +143,21 @@ public void GetTwoFactorProviders_SavedWithName_Success()
         Assert.Equal("test@email.com", emailMetaDataEmail);
     }
 
+    [Theory]
+    [InlineData("not-json-at-all")]
+    [InlineData("TwoFactorProviders" + "a0c30e2f-0ac1-4ffe-bc3a-47830b829a4f")]
+    [InlineData("{ unterminated")]
+    [InlineData("{ \"7\": \"not-a-provider-object\" }")]
+    public void GetTwoFactorProviders_InvalidJson_ReturnsNull(string invalidJson)
+    {
+        var user = new User
+        {
+            TwoFactorProviders = invalidJson,
+        };
+
+        Assert.Null(user.GetTwoFactorProviders());
+    }
+
     [Fact]
     public void SetUserKeyId_RoundTripsThroughTheColumn()
     {