[PM-11516] Initial license file refactor

[cturnbull-bitwarden]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-11516

📔 Objective

This PR is the first, and most major iteration in a series of refactoring and cleaning up pull requests for our organization and user self-host licenses.

Currently, our licenses work based on an integer-based versioning system. Additionally, our cloud and self-host releases are at a minimum staggered by a couple of days, which can be even more if the self-host admins don't update immediately.

Suppose a new field is added to OrganizationLicense, for example, and the version is incremented by one to accommodate the new field. In that case, self-host instances will break in the intervening time because they're not expecting the new field, and their resulting hash will not match the hash in the license file.

To get around this, we've enabled Customer Success to generate licenses for any version current and prior using the Bitwarden Portal. While this workaround has been the status quo, we've decided to rectify this issue.

This pull request addresses the above problem by moving all current fields on OrganizationLicense and UserLicense into a new field, Token on each respective license. The Token is a string JWT containing a dictionary of claims that match the current fields, as well as a header and signature. In the above scenario, no additional versioning will be required from this point forward given that, if the self-host instance doesn't know to lookup a claim type, then it simply won't. The additional unused payload won't break the self-hosted instances ability to verify the signature using their public key.

I made some attempts to minimize the number of changes in this pull request by using the existing paradigms and patterns given that licenses touch a fair number of files. In future pull requests, I'll be aiming to separate out application logic from the licenses, like CanUse or VerifyData, into commands. Similarly, I'll be aiming to clean up or separate concerns in ILicensingService into commands and queries. Additionally, in a future PR I'll move billing related files to our own domain.

📸 Screenshots

⏰ Reminders before review

• Contributor guidelines followed
• All formatters and local linters executed and passed
• Written new unit and / or integration tests where applicable
• Protected functional changes with optionality (feature flags)
• Used internationalization (i18n) for all UI strings
• CI builds passed
• Communicated to DevOps any deployment requirements
• Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

• 👍 (:+1:) or similar for great changes
• 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
• ❓ (:question:) for questions
• 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
• 🎨 (:art:) for suggestions / improvements
• ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
• 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
• ⛏ (:pick:) for minor or nitpick changes

[github-actions]

Checkmarx One – Scan Summary & Details – 5cc62123-b97d-446b-aa91-b5f432aa838d

New Issues

Severity	Issue	Source File / Package	Checkmarx Insight
	CSRF	/src/Api/Controllers/LicensesController.cs: 44	Attack Vector
	Heap_Inspection	/src/Core/Billing/Licenses/LicenseConstants.cs: 33	Attack Vector
	Heap_Inspection	/src/Core/Billing/Licenses/LicenseConstants.cs: 27	Attack Vector

[github-actions]

LaunchDarkly flag references

🔍 1 flag added or modified

Name	Key	Aliases found	Info
Self host user licenses refactor	pm-11516-self-host-license-refactor

[codecov]

Codecov Report

Attention: Patch coverage is 16.56442% with 408 lines in your changes missing coverage. Please review.

Project coverage is 42.91%. Comparing base (0e32dcc) to head (4547e12).
Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
src/Core/Models/Business/OrganizationLicense.cs	36.53%	83 Missing and 16 partials ⚠️
...e/Billing/Licenses/Extensions/LicenseExtensions.cs	0.00%	89 Missing ⚠️
.../Core/Services/Implementations/LicensingService.cs	7.52%	86 Missing ⚠️
...mplementations/OrganizationLicenseClaimsFactory.cs	0.00%	55 Missing ⚠️
src/Core/Models/Business/UserLicense.cs	12.50%	34 Missing and 1 partial ⚠️
...rvices/Implementations/UserLicenseClaimsFactory.cs	0.00%	22 Missing ⚠️
...rvices/NoopImplementations/NoopLicensingService.cs	0.00%	9 Missing ⚠️
src/Core/Services/Implementations/UserService.cs	11.11%	7 Missing and 1 partial ⚠️
...le/Services/Implementations/OrganizationService.cs	0.00%	2 Missing ⚠️
src/Core/Billing/Licenses/Models/LicenseContext.cs	0.00%	2 Missing ⚠️
... and 1 more

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5002      +/-   ##
==========================================
- Coverage   43.14%   42.91%   -0.23%     
==========================================
  Files        1424     1429       +5     
  Lines       64924    65329     +405     
  Branches     5936     5987      +51     
==========================================
+ Hits        28009    28037      +28     
- Misses      35672    36046     +374     
- Partials     1243     1246       +3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[r-tome]

Looks good, great idea and execution!

⛏️: Is it possible to add tests for LicensingService?

[jonashendrickx]

You can probably leverage TimeProvider here.

[cturnbull-bitwarden]

I'll note it for the next set of reactors in the next PR. In this one, I wanted to keep the logic as identical as possible to how it's working right now, just with the change of using a JWT

[amorask-bitwarden]

❓ Out of curiosity, what's the purpose of this method returning a Task without doing anything asynchronously?

[cturnbull-bitwarden]

This came out of a discussion I had with platform on the approach. The idea was to have a single interface that could be used to generate claims for any object. If we needed to have some async IO in some speculative implementation to calculate the value for a claim, then this would allow for that.

[withinfocus]

Had to do some quick hacking on this one -- please catch back up to main.