[AC-108] Enterprise policies are not removed when downgraded to teams

[r-tome]

Type of change

- [X] Bug fix
- [ ] New feature development
- [ ] Tech debt (refactoring, code cleanup, dependency upgrades, etc)
- [ ] Build/deploy pipeline (DevOps)
- [ ] Other

Objective

If an organization has UsePolicies = false then any of its members should not be affected by any previously configured policy.

Code changes

Part of the solution was implemented on #2917 to select organization features for te selected plan. I've built further on that by setting the features for the Free and Families plans.

• src/Admin/Views/Organizations/Edit.cshtml: Setting trial = true when clicking trial buttons
• src/Admin/Views/Shared/_OrganizationFormScripts.cshtml: Using new parameter trial to set value for SalesAssistedTrialStarted. Added plans 'free' and 'families' to switch to toggle features
• src/Infrastructure.EntityFramework/Repositories/OrganizationUserRepository.cs: Filtering by organizations that have UsePolicies = true
• src/Sql/dbo/Stored Procedures/OrganizationUser_ReadByUserIdWithPolicyDetails.sql: Filtering by organizations that have UsePolicies = true
• util/Migrator/DbScripts/2023-06-13_00_OrgUserPolicyDetailsAddFilterOrgUsePolicies.sql: SQL migration file

Before you submit

• Please check for formatting errors (dotnet format --verify-no-changes) (required)
• If making database changes - make sure you also update Entity Framework queries and/or migrations
• Please add unit tests where it makes sense to do so (encouraged but not required)
• If this change requires a documentation update - notify the documentation team
• If this change has particular deployment requirements - notify the DevOps team

[eliykat]

A few notes, I'll review the rest once you've merged in master to clean up the diff.

[r-tome]

@eliykat I experimented with using IApplicationCacheService to get the OrganizationAbilities to the determine if a given OrganizationId has UsePolicies enabled. This is what the query method on PolicyService looked like:

private async Task<IEnumerable<OrganizationUserPolicyDetails>> QueryOrganizationUserPolicyDetailsAsync(Guid userId, PolicyType? policyType, OrganizationUserStatusType minStatus = OrganizationUserStatusType.Accepted)
    {
        // Check if the cached policies are available
        if (_cachedOrganizationUserPolicyDetails == null)
        {
            // Cached policies not available, retrieve from the repository
            _cachedOrganizationUserPolicyDetails = await _organizationUserRepository.GetByUserIdWithPolicyDetailsAsync(userId);
        }

        var excludedUserTypes = GetUserTypesExcludedFromPolicy(policyType);
        var orgAbilities = await _applicationCacheService.GetOrganizationAbilitiesAsync();
        return _cachedOrganizationUserPolicyDetails.Where(o =>
            (!orgAbilities.ContainsKey(o.OrganizationId) || orgAbilities[o.OrganizationId].Enabled && orgAbilities[o.OrganizationId].UsePolicies) &&
            (policyType == null || o.PolicyType == policyType) &&
            o.PolicyEnabled &&
            !excludedUserTypes.Contains(o.OrganizationUserType) &&
            o.OrganizationUserStatus >= minStatus &&
            !o.IsProvider);
    }

This worked perfectly until I also ran the Admin Panel alongside it and changed the UsePolicies value but then the cached value was not updated (even though we do update the organization abilities). Could this be an issue on my development environment?

[bitwarden-bot]

Checkmarx One – Scan Summary & Details – 8e7dbf3d-ab9d-492c-a9de-d24f82756df5

New Issues

Severity	Issue	Source File / Package	Checkmarx Insight
	Reflected_XSS_All_Clients	/src/Admin/Views/Shared/_OrganizationFormScripts.cshtml: 133	Attack Vector

[eliykat]

If the org abilities cache is in memory only, it wouldn't be shared between the projects. Did you find out whether it's in memory in prod, or is it hosted on a service like redis etc? (Or otherwise shared between the projects somehow?)

[r-tome]

@eliykat I've created another PR with the changes above implemented and tested it by using a service bus resource on Azure. It worked great!

[eliykat]

@r-tome just a reminder to close this one if it's no longer needed.