[PM-39557] Replace invite link key columns with an opaque Invite blob by r-tome · Pull Request #7896 · bitwarden/server

r-tome · 2026-06-30T15:42:12Z

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-39557

📔 Objective

Store the invite link's cryptographic material as a single opaque Invite blob plus a SupportsConfirmation flag instead of the separate EncryptedInviteKey/EncryptedOrgKey columns, so the server stays a pure storage/transport layer and the blob's format can evolve without AC changes.

…d EncryptedOrgKey with Invite blob and SupportsConfirmation flag. Update stored procedures and migration script accordingly.

…ptedInviteKey with Invite and add SupportsConfirmation flag. Update model snapshot for MySQL, PostgreSQL, and SQLite.

…and EncryptedOrgKey with Invite property and add SupportsConfirmation flag. Update related command and request classes accordingly.

…pportsConfirmation flag, reflecting recent schema changes.

…and EncryptedOrgKey with Invite property in Create and Refresh request models, and update OrganizationInviteLinkResponseModel to include SupportsConfirmation flag. Adjust related command request methods accordingly.

…s various controllers and models, ensuring consistency with recent schema changes. Adjust assertions and request models accordingly to reflect the new structure.

github-actions · 2026-06-30T15:43:04Z

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the replacement of the invite link's EncryptedInviteKey/EncryptedOrgKey columns with a single opaque Invite blob plus a SupportsConfirmation flag across the API models, entity, commands, Dapper repository/stored procedures, SSDT schema, EF migrations for all three providers, and the accompanying unit/integration tests. The change is internally consistent: the SSDT table's resulting column order matches what the dated migration produces (drop EncryptedOrgKey, rename EncryptedInviteKey → Invite, add SupportsConfirmation at the end), and the migration follows the idempotent COL_LENGTH guard pattern. Dropping the [EncryptedString] format check on Invite is intentional and documented — the server treats the value as an opaque blob it only stores and transports. Test coverage is thorough across request-model validation, command behavior, and repository round-trips.

No blocking findings. The open reviewer threads (column ordering, SupportsConfirmation sourcing) already capture the substantive discussion, and the code addresses the column-ordering concern.

r-tome · 2026-06-30T15:45:57Z

+            name: "EncryptedOrgKey",
+            table: "OrganizationInviteLink");
+
+        migrationBuilder.RenameColumn(


EF decided to rename this column instead of dropping and creating a new one. I guess there is no harm because this feature hasn't been rolled out yet.

Like the SQL migration, this will cause the table to end up with columns out of order from the definition defined in src/Sql/dbo/Tables/OrganizationInviteLink.sql, so I think these should be written so that the existing columns are dropped and then the new ones added at the end.

If you don't want to do that, you could have the SQL Server migration follow the EF pattern and drop EncryptedOrgKey, rename EncryptedInviteKey to Invite, then add SupportsConfirmation. It doesn't really matter except that the end-result of the tables should be consistent across environments.

sonarqubecloud · 2026-06-30T15:47:54Z

Quality Gate failed

Failed conditions
E Reliability Rating on New Code (required ≥ D)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

codecov · 2026-06-30T15:50:27Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 65.87%. Comparing base (e899a9c) to head (29dab05).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7896      +/-   ##
==========================================
+ Coverage   61.35%   65.87%   +4.51%     
==========================================
  Files        2236     2236              
  Lines       98547    98547              
  Branches     8911     8911              
==========================================
+ Hits        60468    64917    +4449     
+ Misses      35943    31397    -4546     
- Partials     2136     2233      +97

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

mkincaid-bw

Some minor changes requested.

mkincaid-bw · 2026-06-30T20:19:55Z

 CREATE TABLE [dbo].[OrganizationInviteLink]
 (
-    [Id]                 UNIQUEIDENTIFIER NOT NULL,
-    [Code]               UNIQUEIDENTIFIER NOT NULL,
-    [OrganizationId]     UNIQUEIDENTIFIER NOT NULL,
-    [AllowedDomains]     NVARCHAR(MAX)    NOT NULL,
-    [EncryptedInviteKey] NVARCHAR(MAX)    NOT NULL,
-    [EncryptedOrgKey]    NVARCHAR(MAX)    NULL,
-    [CreationDate]       DATETIME2(7)     NOT NULL,
-    [RevisionDate]       DATETIME2(7)     NOT NULL,
+    [Id]                   UNIQUEIDENTIFIER NOT NULL,
+    [Code]                 UNIQUEIDENTIFIER NOT NULL,
+    [OrganizationId]       UNIQUEIDENTIFIER NOT NULL,
+    [AllowedDomains]       NVARCHAR(MAX)    NOT NULL,
+    [Invite]               NVARCHAR(MAX)    NOT NULL,
+    [SupportsConfirmation] BIT              NOT NULL,
+    [CreationDate]         DATETIME2(7)     NOT NULL,
+    [RevisionDate]         DATETIME2(7)     NOT NULL,
    CONSTRAINT [PK_OrganizationInviteLink] PRIMARY KEY CLUSTERED ([Id] ASC),
    CONSTRAINT [FK_OrganizationInviteLink_Organization] FOREIGN KEY ([OrganizationId]) REFERENCES [dbo].[Organization] ([Id]) ON DELETE CASCADE
 );


The net result of the migration script will add these columns at the end, so the table definition will look like this:

CREATE TABLE [dbo].[OrganizationInviteLink] ( [Id] UNIQUEIDENTIFIER NOT NULL, [Code] UNIQUEIDENTIFIER NOT NULL, [OrganizationId] UNIQUEIDENTIFIER NOT NULL, [AllowedDomains] NVARCHAR(MAX) NOT NULL, [CreationDate] DATETIME2(7) NOT NULL, [RevisionDate] DATETIME2(7) NOT NULL, [Invite] NVARCHAR(MAX) NOT NULL, [SupportsConfirmation] BIT NOT NULL, CONSTRAINT [PK_OrganizationInviteLink] PRIMARY KEY CLUSTERED ([Id] ASC), CONSTRAINT [FK_OrganizationInviteLink_Organization] FOREIGN KEY ([OrganizationId]) REFERENCES [dbo].[Organization] ([Id]) ON DELETE CASCADE );

mkincaid-bw · 2026-06-30T20:52:25Z

+            name: "EncryptedOrgKey",
+            table: "OrganizationInviteLink");
+
+        migrationBuilder.RenameColumn(


Like the SQL migration, this will cause the table to end up with columns out of order from the definition defined in src/Sql/dbo/Tables/OrganizationInviteLink.sql, so I think these should be written so that the existing columns are dropped and then the new ones added at the end.

If you don't want to do that, you could have the SQL Server migration follow the EF pattern and drop EncryptedOrgKey, rename EncryptedInviteKey to Invite, then add SupportsConfirmation. It doesn't really matter except that the end-result of the tables should be consistent across environments.

Rewrite the OrganizationInviteLink migration to drop EncryptedOrgKey, rename EncryptedInviteKey to Invite, and add SupportsConfirmation at the end, matching the EF migrations. Reorder the SSDT table definition so SupportsConfirmation sits after RevisionDate, keeping src/Sql/dbo in sync with what a fresh run of all migrations produces across the four supported databases.

Renamed from 2026-06-30 so environments that already applied the previous version pick up the corrected script as a new, distinct migration.

…ngth - Add a required SupportsConfirmation field to the create/refresh API request models and command request records for forward-compatibility. The commands still hardcode the persisted value to false because auto confirmation isn't supported yet; when Milestone 3 ships the flow, the hardcode is removed without changing the request shape. - Cap Invite to 3000 characters via [EncryptedStringLength] on both request models to bound the opaque blob. Intentionally not adding [EncryptedString] — the server treats the blob as opaque so the format can evolve without server changes. - Update unit and integration tests to populate the now-required SupportsConfirmation field and assert the server-side override.

r-tome · 2026-07-02T13:12:38Z

@mkincaid-bw thanks for the review and suggestions! I have followed your suggestion to update sql to match EF and rename the existing column and add the new one at the end.

mkincaid-bw

DB Changes LGTM but I just wanted to leave a note since this could be flagged by others:

This PR technically violates EDD with the column drop/rename. However, the OrganizationInviteLink table in prod is currently empty and from what I understand, the code has never been enabled in prod, so we should be fine. I also checked QA and the table is empty there as well.

… SupportsConfirmation from requests - Modify CreateOrganizationInviteLinkCommand and RefreshOrganizationInviteLinkCommand to use the SupportsConfirmation value from the request instead of hardcoding it to false. - Update related tests to assert the correct SupportsConfirmation value based on the request input, ensuring consistency in behavior across the application.

r-tome · 2026-07-03T15:58:31Z

DB Changes LGTM but I just wanted to leave a note since this could be flagged by others:

This PR technically violates EDD with the column drop/rename. However, the OrganizationInviteLink table in prod is currently empty and from what I understand, the code has never been enabled in prod, so we should be fine. I also checked QA and the table is empty there as well.

@mkincaid-bw I agree this violates EDD. Thanks for checking prod and QA and since those tables are empty and this feature hasn't been released no data is at risk.

r-tome added 6 commits June 30, 2026 16:28

Refactor OrganizationInviteLink schema: replace EncryptedInviteKey an…

aefe0b1

…d EncryptedOrgKey with Invite blob and SupportsConfirmation flag. Update stored procedures and migration script accordingly.

Add migration for OrganizationInviteLink schema update: replace Encry…

edd544a

…ptedInviteKey with Invite and add SupportsConfirmation flag. Update model snapshot for MySQL, PostgreSQL, and SQLite.

Refactor OrganizationInviteLink handling: replace EncryptedInviteKey …

46154c5

…and EncryptedOrgKey with Invite property and add SupportsConfirmation flag. Update related command and request classes accordingly.

Update OrganizationInviteLinkRepository to use Invite property and Su…

9f7e263

…pportsConfirmation flag, reflecting recent schema changes.

Update tests to replace EncryptedInviteKey with Invite property acros…

de1ac3d

…s various controllers and models, ensuring consistency with recent schema changes. Adjust assertions and request models accordingly to reflect the new structure.

r-tome added the ai-review Request a Claude code review label Jun 30, 2026

r-tome commented Jun 30, 2026

View reviewed changes

r-tome marked this pull request as ready for review June 30, 2026 15:46

r-tome requested review from a team as code owners June 30, 2026 15:46

r-tome requested a review from jrmccannon June 30, 2026 15:46

JimmyVo16 reviewed Jun 30, 2026

View reviewed changes

Comment thread src/Api/AdminConsole/Models/Request/Organizations/RefreshOrganizationInviteLinkRequestModel.cs

mkincaid-bw requested changes Jun 30, 2026

View reviewed changes

r-tome added 4 commits July 2, 2026 11:54

Merge branch 'main' into ac/pm-39557/update-schema-to-use-invite-blob

1c4788b

Bump OrganizationInviteLink migration date to 2026-07-02

48e41fa

Renamed from 2026-06-30 so environments that already applied the previous version pick up the corrected script as a new, distinct migration.

r-tome requested review from JimmyVo16 and mkincaid-bw July 2, 2026 13:11

jrmccannon added the t:feature Change Type - Feature Development label Jul 2, 2026

mkincaid-bw previously approved these changes Jul 2, 2026

View reviewed changes

r-tome added 2 commits July 3, 2026 16:40

Merge branch 'main' into ac/pm-39557/update-schema-to-use-invite-blob

909d37e

r-tome dismissed mkincaid-bw’s stale review via 29dab05 July 3, 2026 15:50

r-tome requested a review from mkincaid-bw July 3, 2026 16:12

mkincaid-bw approved these changes Jul 6, 2026

View reviewed changes

JimmyVo16 approved these changes Jul 6, 2026

View reviewed changes

r-tome merged commit 7b36f20 into main Jul 6, 2026
56 checks passed

r-tome deleted the ac/pm-39557/update-schema-to-use-invite-blob branch July 6, 2026 17:01

Uh oh!

Conversation

r-tome commented Jun 30, 2026

🎟️ Tracking

📔 Objective

Uh oh!

github-actions Bot commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 Bitwarden Claude Code Review

Uh oh!

r-tome Jun 30, 2026

Choose a reason for hiding this comment

Uh oh!

mkincaid-bw Jun 30, 2026

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented Jun 30, 2026

Quality Gate failed

Uh oh!

codecov Bot commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

mkincaid-bw left a comment

Choose a reason for hiding this comment

Uh oh!

mkincaid-bw Jun 30, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

mkincaid-bw Jun 30, 2026

Choose a reason for hiding this comment

Uh oh!

r-tome commented Jul 2, 2026

Uh oh!

mkincaid-bw left a comment

Choose a reason for hiding this comment

Uh oh!

r-tome commented Jul 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions Bot commented Jun 30, 2026 •

edited

Loading

codecov Bot commented Jun 30, 2026 •

edited

Loading