Skip to content

[PM-33501] Prevent orphaned Sends during user and org deletion#7386

Open
harr1424 wants to merge 4 commits intomainfrom
PM-33501-Don-t-leave-orphaned-sends-in-storage
Open

[PM-33501] Prevent orphaned Sends during user and org deletion#7386
harr1424 wants to merge 4 commits intomainfrom
PM-33501-Don-t-leave-orphaned-sends-in-storage

Conversation

@harr1424
Copy link
Copy Markdown
Contributor

@harr1424 harr1424 commented Apr 3, 2026

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-33501

📔 Objective

This PR resolves the possibility of Sends becoming orphaned during user or organization deletion. It is worth noting that Sends aren't currently associated with organizations, but this functionality is planned, and code in this PR is intended to support the complete removal of Send data associated to a deleted organization.

@codecov
Copy link
Copy Markdown

codecov bot commented Apr 3, 2026

Codecov Report

❌ Patch coverage is 41.26984% with 37 lines in your changes missing coverage. Please review.
✅ Project coverage is 62.54%. Comparing base (2b7ba20) to head (74e8a75).

Files with missing lines Patch % Lines
...ndFeatures/Services/AzureSendFileStorageService.cs 0.00% 14 Missing ⚠️
...ucture.Dapper/Tools/Repositories/SendRepository.cs 0.00% 11 Missing ⚠️
...tityFramework/Tools/Repositories/SendRepository.cs 0.00% 7 Missing ⚠️
...eatures/Organizations/OrganizationDeleteCommand.cs 84.61% 0 Missing and 2 partials ⚠️
...s/SendFeatures/Commands/NonAnonymousSendCommand.cs 66.66% 0 Missing and 2 partials ⚠️
src/Core/Services/Implementations/UserService.cs 90.00% 0 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #7386      +/-   ##
==========================================
+ Coverage   58.44%   62.54%   +4.09%     
==========================================
  Files        2060     2060              
  Lines       91178    91238      +60     
  Branches     8114     8120       +6     
==========================================
+ Hits        53287    57061    +3774     
+ Misses      36002    32201    -3801     
- Partials     1889     1976      +87     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 3, 2026

Logo
Checkmarx One – Scan Summary & Details7ad3cbe5-5ec3-4b65-980a-9e277dc55fe9


New Issues (121) Checkmarx found the following issues in this Pull Request
# Severity Issue Source File / Package Checkmarx Insight
1 CRITICAL Stored_XSS /src/SharedWeb/Health/HealthCheckServiceExtensions.cs: 61
detailsThe method embeds untrusted data in generated output with WriteAsync, at line 60 of /src/SharedWeb/Health/HealthCheckServiceExtensions.cs. This ...
Attack Vector
2 CRITICAL Stored_XSS /util/Server/Startup.cs: 57
detailsThe method embeds untrusted data in generated output with WriteAsync, at line 59 of /util/Server/Startup.cs. This untrusted data is embedded int...
Attack Vector
3 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs: 55
detailsMethod at line 55 of /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs gets a parameter from a user request from user. This pa...
Attack Vector
4 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 145
detailsMethod at line 145 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from request. T...
Attack Vector
5 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 145
detailsMethod at line 145 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from request. T...
Attack Vector
6 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 97
detailsMethod at line 97 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. This...
Attack Vector
7 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 97
detailsMethod at line 97 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. This...
Attack Vector
8 MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 534
detailsMethod at line 534 of /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs gets a parameter from a user request from model. This par...
Attack Vector
9 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 229
detailsMethod at line 229 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. Thi...
Attack Vector
10 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1558
detailsMethod at line 1558 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
11 MEDIUM CSRF /src/Api/Tools/Controllers/SendsController.cs: 73
detailsMethod at line 73 of /src/Api/Tools/Controllers/SendsController.cs gets a parameter from a user request from id. This parameter value flows thro...
Attack Vector
12 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs: 145
detailsMethod at line 145 of /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs gets a parameter from a user request from user. This p...
Attack Vector
13 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 217
detailsMethod at line 217 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
14 MEDIUM CSRF /src/Api/Public/Controllers/CollectionsController.cs: 91
detailsMethod at line 91 of /src/Api/Public/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value ...
Attack Vector
15 MEDIUM CSRF /src/Api/Public/Controllers/CollectionsController.cs: 91
detailsMethod at line 91 of /src/Api/Public/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value ...
Attack Vector
16 MEDIUM CSRF /src/Api/Public/Controllers/CollectionsController.cs: 91
detailsMethod at line 91 of /src/Api/Public/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value ...
Attack Vector
17 MEDIUM CSRF /src/Api/Public/Controllers/CollectionsController.cs: 91
detailsMethod at line 91 of /src/Api/Public/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value ...
Attack Vector
18 MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 176
detailsMethod at line 176 of /src/Api/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value flows ...
Attack Vector
19 MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 176
detailsMethod at line 176 of /src/Api/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value flows ...
Attack Vector
20 MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 176
detailsMethod at line 176 of /src/Api/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value flows ...
Attack Vector
21 MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 176
detailsMethod at line 176 of /src/Api/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value flows ...
Attack Vector
22 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 173
detailsMethod at line 173 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. Thi...
Attack Vector
23 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 452
detailsMethod at line 452 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
24 MEDIUM CSRF /src/Api/Dirt/Controllers/OrganizationReportsController.cs: 189
detailsMethod at line 189 of /src/Api/Dirt/Controllers/OrganizationReportsController.cs gets a parameter from a user request from request. This paramet...
Attack Vector
25 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs: 104
detailsMethod at line 104 of /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs gets a parameter from a user request from user. This p...
Attack Vector
26 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/OrganizationBillingVNextController.cs: 107
detailsMethod at line 107 of /src/Api/Billing/Controllers/VNext/OrganizationBillingVNextController.cs gets a parameter from a user request from organiza...
Attack Vector
27 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1417
detailsMethod at line 1417 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
28 MEDIUM CSRF /src/Api/Dirt/Controllers/OrganizationReportsController.cs: 233
detailsMethod at line 233 of /src/Api/Dirt/Controllers/OrganizationReportsController.cs gets a parameter from a user request from request. This paramet...
Attack Vector
29 MEDIUM CSRF /src/Api/Dirt/Controllers/OrganizationReportsController.cs: 286
detailsMethod at line 286 of /src/Api/Dirt/Controllers/OrganizationReportsController.cs gets a parameter from a user request from request. This paramet...
Attack Vector
30 MEDIUM CSRF /src/Api/Dirt/Controllers/OrganizationReportsController.cs: 189
detailsMethod at line 189 of /src/Api/Dirt/Controllers/OrganizationReportsController.cs gets a parameter from a user request from request. This paramet...
Attack Vector
31 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1417
detailsMethod at line 1417 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
32 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1417
detailsMethod at line 1417 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
33 MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: 289
detailsMethod at line 289 of /src/Api/AdminConsole/Controllers/GroupsController.cs gets a parameter from a user request from orgUserId. This parameter ...
Attack Vector
34 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1385
detailsMethod at line 1385 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
35 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1446
detailsMethod at line 1446 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
36 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1148
detailsMethod at line 1148 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
37 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1032
detailsMethod at line 1032 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
38 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1281
detailsMethod at line 1281 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from organizationId. This parameter ...
Attack Vector
39 MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 394
detailsMethod at line 394 of /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs gets a parameter from a user request from model. This par...
Attack Vector
40 MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 385
detailsMethod at line 385 of /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs gets a parameter from a user request from model. This par...
Attack Vector
41 MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 385
detailsMethod at line 385 of /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs gets a parameter from a user request from id. This parame...
Attack Vector
42 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/OrganizationBillingVNextController.cs: 95
detailsMethod at line 95 of /src/Api/Billing/Controllers/VNext/OrganizationBillingVNextController.cs gets a parameter from a user request from organizat...
Attack Vector
43 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/ProviderBillingVNextController.cs: 82
detailsMethod at line 82 of /src/Api/Billing/Controllers/VNext/ProviderBillingVNextController.cs gets a parameter from a user request from provider. Th...
Attack Vector
44 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs: 93
detailsMethod at line 93 of /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs gets a parameter from a user request from user. This pa...
Attack Vector
45 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/OrganizationBillingVNextController.cs: 49
detailsMethod at line 49 of /src/Api/Billing/Controllers/VNext/OrganizationBillingVNextController.cs gets a parameter from a user request from organizat...
Attack Vector
46 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/ProviderBillingVNextController.cs: 40
detailsMethod at line 40 of /src/Api/Billing/Controllers/VNext/ProviderBillingVNextController.cs gets a parameter from a user request from provider. Th...
Attack Vector
47 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1226
detailsMethod at line 1226 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from model. This parameter value flo...
Attack Vector
48 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 173
detailsMethod at line 173 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. Thi...
Attack Vector
49 MEDIUM CSRF /src/Api/Vault/Controllers/SecurityTaskController.cs: 66
detailsMethod at line 66 of /src/Api/Vault/Controllers/SecurityTaskController.cs gets a parameter from a user request from taskId. This parameter value...
Attack Vector
50 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 721
detailsMethod at line 721 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from request. This parameter value fl...
Attack Vector
51 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 192
detailsMethod at line 192 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
52 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 664
detailsMethod at line 664 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
53 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 641
detailsMethod at line 641 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
54 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 126
detailsMethod at line 126 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
55 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 412
detailsMethod at line 412 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
56 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 385
detailsMethod at line 385 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
57 MEDIUM CSRF /src/Api/Auth/Controllers/EmergencyAccessController.cs: 173
detailsMethod at line 173 of /src/Api/Auth/Controllers/EmergencyAccessController.cs gets a parameter from a user request from model. This parameter val...
Attack Vector
58 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 825
detailsMethod at line 825 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
59 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 825
detailsMethod at line 825 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
60 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 825
detailsMethod at line 825 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows t...
Attack Vector
61 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 825
detailsMethod at line 825 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows t...
Attack Vector
62 MEDIUM CSRF /src/Api/NotificationCenter/Controllers/NotificationsController.cs: 61
detailsMethod at line 61 of /src/Api/NotificationCenter/Controllers/NotificationsController.cs gets a parameter from a user request from id. This param...
Attack Vector
63 MEDIUM CSRF /src/Api/NotificationCenter/Controllers/NotificationsController.cs: 67
detailsMethod at line 67 of /src/Api/NotificationCenter/Controllers/NotificationsController.cs gets a parameter from a user request from id. This param...
Attack Vector
64 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1446
detailsMethod at line 1446 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
65 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 790
detailsMethod at line 790 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
66 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 790
detailsMethod at line 790 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows t...
Attack Vector
67 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 763
detailsMethod at line 763 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
68 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 763
detailsMethod at line 763 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows t...
Attack Vector
69 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 790
detailsMethod at line 790 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows t...
Attack Vector
70 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 790
detailsMethod at line 790 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
71 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 763
detailsMethod at line 763 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows t...
Attack Vector
72 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 763
detailsMethod at line 763 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
73 MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: 138
detailsMethod at line 138 of /src/Api/AdminConsole/Controllers/GroupsController.cs gets a parameter from a user request from model. This parameter valu...
Attack Vector
74 MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: 166
detailsMethod at line 166 of /src/Api/AdminConsole/Controllers/GroupsController.cs gets a parameter from a user request from model. This parameter valu...
Attack Vector
75 MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: 166
detailsMethod at line 166 of /src/Api/AdminConsole/Controllers/GroupsController.cs gets a parameter from a user request from model. This parameter valu...
Attack Vector
76 MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 414
detailsMethod at line 414 of /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs gets a parameter from a user request from model. This par...
Attack Vector
77 MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 414
detailsMethod at line 414 of /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs gets a parameter from a user request from model. This par...
Attack Vector
78 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 558
detailsMethod at line 558 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector

More results are available on the CxOne platform

@harr1424 harr1424 marked this pull request as ready for review April 3, 2026 17:31
@harr1424 harr1424 requested review from a team as code owners April 3, 2026 17:31
@harr1424 harr1424 requested a review from r-tome April 3, 2026 17:31
@harr1424 harr1424 marked this pull request as draft April 3, 2026 18:02
@harr1424 harr1424 marked this pull request as ready for review April 3, 2026 18:03
itsadrago
itsadrago previously approved these changes Apr 3, 2026
[dbo].[OrganizationReport]
WHERE
[OrganizationId] = @Id
-- Delete Organization Owned Sends
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⛏️ Differs in formatting, add blank line before comment

@harr1424 harr1424 requested review from itsadrago and rkac-bw April 3, 2026 21:58
@harr1424 harr1424 marked this pull request as draft April 3, 2026 21:59
itsadrago
itsadrago previously approved these changes Apr 3, 2026
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud bot commented Apr 4, 2026

@harr1424 harr1424 marked this pull request as ready for review April 4, 2026 00:35
@harr1424 harr1424 requested a review from itsadrago April 4, 2026 00:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants