[PM-42584] Require single organization to enable fill assist policy

[bensbits91]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-42584

📔 Objective

Require that an org enable the “Single organization membership” policy before they can enable the “Activate fill assist” policy.

Context

PolicyType.FillAssist (added in PM-41311) can currently be enabled independently of Single organization. Because fill assist rule URLs are org-scoped, admins should not be able to enable Fill assist without Single organization first. Matches the existing prerequisite already enforced for UriMatchDefaults, ResetPassword, and MaximumVaultTimeout.

Change

FillAssistPolicyEventHandler implements IEnforceDependentPoliciesEvent with RequiredPolicies => [PolicyType.SingleOrg]. The SavePolicyCommand framework handles both directions automatically:

• Enabling Fill assist while SingleOrg is disabled → 400

• Disabling SingleOrg while Fill assist is enabled → 400

Both error messages are generated by the framework from PolicyType.GetName(). No new copy, no localization work.

NOTE: We decided to skip QA for these server changes. We'll do QA in the companion PR in clients for https://bitwarden.atlassian.net/browse/PM-42585

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

This PR makes FillAssistPolicyEventHandler implement IEnforceDependentPoliciesEvent with SingleOrg as a prerequisite, updates the FillAssist display name to match the admin console label, and enables SingleOrg first in the Put_FillAssistPolicy_Success integration test. The handler has a single IPolicyUpdateEvent registration in PolicyServiceCollectionExtensions, so PolicyEventHandlerHandlerFactory resolves it without the multiple-handler throw, and SavePolicyCommand.ValidatePolicyDependencies enforces both the enable and disable directions; data-only updates to an already-enabled policy are unaffected because isBeingEnabled requires a false-to-true transition. The display-name change is display-only — PolicyType.GetName() is reached from exactly three BadRequestException strings in SavePolicyCommand, no test asserts the FillAssist text, and no "Fill Assist" references remain anywhere in the repo. The previously flagged integration test failure is resolved: the test now enables SingleOrg on the fresh Enterprise org created per test before the FillAssist PUT.

Code Review Details

• ♻️ : No unit test asserts the new RequiredPolicies value; the three sibling handlers implementing this interface each have one (UriMatchDefaultPolicyEventHandlerTests, OrganizationUserNotificationPolicyEventHandlerTests, AutomaticUserConfirmationPolicyEventHandlerTests) and FillAssistPolicyEventHandlerTests already exists to host it
  • src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyEventHandlers/FillAssistPolicyEventHandler.cs:14

[bensbits91]

FYI: Changing this to be sentence case, and also so the text in the error toast (in clients) matches the policy name.

[codecov]

Codecov Report

❌ Patch coverage is 50.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 63.32%. Comparing base (955cfa2) to head (2ce483c).

Files with missing lines	Patch %	Lines
src/Core/AdminConsole/Enums/PolicyType.cs	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff            @@
##           main    #8266       +/-   ##
=========================================
+ Coverage      0   63.32%   +63.32%     
=========================================
  Files         0     2430     +2430     
  Lines         0   104922   +104922     
  Branches      0     9505     +9505     
=========================================
+ Hits          0    66447    +66447     
- Misses        0    36198    +36198     
- Partials      0     2277     +2277     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.