[PM-32572]Premium to organization upgrade does not set public/private key pair or default collection

[cyprain-okeke]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-32572

📔 Objective

This PR fixes a bug where upgrading from a Premium individual subscription to an organization plan did not properly initialize the organization's
cryptographic key pair or create a default collection.

Bug Fix

Problem: When users upgraded their Premium subscription to an organization plan (Teams/Families/Enterprise), the resulting organization was
missing:

1. Public/Private key pair - Required for organization-level encryption operations
2. Default collection - Users expect a starter collection to organize their vault items

This left organizations in an incomplete state, potentially blocking users from properly sharing vault items or performing other organization
operations that depend on these keys.

Solution:

• Added PublicKey and EncryptedPrivateKey as required parameters to the upgrade request
• Organization entity now properly initializes with these keys during the upgrade flow
• Added optional CollectionName parameter to allow creating a default collection
• The owner is automatically granted "Can Manage" access to the default collection
• Collection creation failures are handled gracefully (logged but don't block the upgrade)
• Command now returns the new organization ID to enable client navigation

Changes

• UpgradePremiumToOrganizationRequest: Added PublicKey, EncryptedPrivateKey, and optional CollectionName fields
• UpgradePremiumToOrganizationCommand: Sets organization keys and creates default collection if requested
• AccountBillingVNextController: Updated to pass new parameters through
• Return type changed from None to Guid to return the created organization ID
• Comprehensive test coverage for all scenarios including failure cases

📸 Screenshots

[github-actions]

Checkmarx One – Scan Summary & Details – aa4cad0d-1e34-49e0-a6cc-39fc6276d198

---

New Issues (2)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		Cxf5fb15b0-6576	Npm-serialize-javascript-6.0.2	details Description: serialize-javascript through 7.0.2 contains a code injection vulnerability due to improper escaping of "RegExp.flags" during serialization. Althoug... Attack Vector: NETWORK Attack Complexity: HIGH Vulnerable Package
2		CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 452	details Method at line 452 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow... Attack Vector

[sbrown-livefront]

⛏ Should the public and private keys be checked here also?

[sbrown-livefront]

Looks good! Small non-blocking comment on a test

[sbrown-livefront]

⛏️ I'm not sure this test is named correctly since the removal of a lot of the metadata changes nor is it testing anything we haven't tested I believe. Can we remove it?

[codecov]

Codecov Report

❌ Patch coverage is 94.73684% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 56.47%. Comparing base (d1a5c4d) to head (43f0ada).

Files with missing lines	Patch %	Lines
...Controllers/VNext/AccountBillingVNextController.cs	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7076      +/-   ##
==========================================
+ Coverage   56.45%   56.47%   +0.01%     
==========================================
  Files        2013     2013              
  Lines       88098    88131      +33     
  Branches     7860     7860              
==========================================
+ Hits        49739    49771      +32     
- Misses      36543    36544       +1     
  Partials     1816     1816              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.3% Duplication on New Code

See analysis details on SonarQube Cloud