[PM-36158] - Fix org cipher push notifications to fan out per authorized user

src/Core/Platform/Push/Engines/AzureQueuePushEngine.cs

@@ -33,19 +33,9 @@ public AzureQueuePushEngine(
 
     public async Task PushCipherAsync(Cipher cipher, PushType type, IEnumerable<Guid>? collectionIds)
     {
-        if (cipher.OrganizationId.HasValue)
-        {
-            var message = new SyncCipherPushNotification
-            {
-                Id = cipher.Id,
-                OrganizationId = cipher.OrganizationId,
-                RevisionDate = cipher.RevisionDate,
-                CollectionIds = collectionIds,
-            };
-
-            await SendMessageAsync(type, message, true);
-        }
-        else if (cipher.UserId.HasValue)
+        // Org cipher fan-out is handled upstream in MultiServicePushNotificationService,
+        // which resolves per-user access and calls PushAsync directly.
+        if (cipher.UserId.HasValue)
         {
             var message = new SyncCipherPushNotification
             {

src/Core/Platform/Push/Engines/MultiServicePushNotificationService.cs

@@ -1,4 +1,6 @@
 using Bit.Core.Enums;
+using Bit.Core.Models;
+using Bit.Core.Repositories;
 using Bit.Core.Settings;
 using Bit.Core.Vault.Entities;
 using Microsoft.Extensions.Logging;
@@ -8,6 +10,7 @@ namespace Bit.Core.Platform.Push.Internal;
 public class MultiServicePushNotificationService : IPushNotificationService
 {
     private readonly IPushEngine[] _services;
+    private readonly ICollectionCipherRepository _collectionCipherRepository;
 
     public Guid InstallationId { get; }
 
@@ -17,12 +20,14 @@ public class MultiServicePushNotificationService : IPushNotificationService
 
     public MultiServicePushNotificationService(
         IEnumerable<IPushEngine> services,
+        ICollectionCipherRepository collectionCipherRepository,
         ILogger<MultiServicePushNotificationService> logger,
         GlobalSettings globalSettings,
         TimeProvider timeProvider)
     {
         // Filter out any NoopPushEngine's
         _services = [.. services.Where(engine => engine is not NoopPushEngine)];
+        _collectionCipherRepository = collectionCipherRepository;
 
         Logger = logger;
         Logger.LogInformation("Hub services: {Services}", _services.Count());
@@ -66,10 +71,45 @@ private Task PushToServices(Func<IPushEngine, Task> pushFunc)
 #endif
     }
 
-    public Task PushCipherAsync(Cipher cipher, PushType pushType, IEnumerable<Guid>? collectionIds)
+    public async Task PushCipherAsync(Cipher cipher, PushType pushType, IEnumerable<Guid>? collectionIds)
     {
-        return PushToServices((s) => s.PushCipherAsync(cipher, pushType, collectionIds));
+        if (cipher.OrganizationId.HasValue)
+        {
+            var collectionIdList = collectionIds?.ToList() ?? [];
+            if (collectionIdList.Count == 0)
+            {
+                // Cannot fan out without collection IDs to determine which users have access.
+                return;
+            }
+
+            var userIds = await _collectionCipherRepository.GetUserIdsByCollectionIdsAsync(collectionIdList);
+            foreach (var userId in userIds)
+            {
+                var message = new SyncCipherPushNotification
+                {
+                    Id = cipher.Id,
+                    UserId = userId,
+                    OrganizationId = cipher.OrganizationId,
+                    RevisionDate = cipher.RevisionDate,
+                    CollectionIds = collectionIdList,
+                };
+
+                await PushToServices(s => s.PushAsync(new PushNotification<SyncCipherPushNotification>
+                {
+                    Type = pushType,
+                    Target = NotificationTarget.User,
+                    TargetId = userId,
+                    Payload = message,
+                    ExcludeCurrentContext = true,
+                }));
+            }
+
+            return;
+        }
+
+        await PushToServices(s => s.PushCipherAsync(cipher, pushType, collectionIds));
     }
+
     public Task PushAsync<T>(PushNotification<T> pushNotification) where T : class
     {
         return PushToServices((s) => s.PushAsync(pushNotification));

src/Core/Platform/Push/Engines/NotificationsApiPushEngine.cs

@@ -37,19 +37,9 @@ public NotificationsApiPushEngine(
 
     public async Task PushCipherAsync(Cipher cipher, PushType type, IEnumerable<Guid>? collectionIds)
     {
-        if (cipher.OrganizationId.HasValue)
-        {
-            var message = new SyncCipherPushNotification
-            {
-                Id = cipher.Id,
-                OrganizationId = cipher.OrganizationId,
-                RevisionDate = cipher.RevisionDate,
-                CollectionIds = collectionIds,
-            };
-
-            await SendMessageAsync(type, message, true);
-        }
-        else if (cipher.UserId.HasValue)
+        // Org cipher fan-out is handled upstream in MultiServicePushNotificationService,
+        // which resolves per-user access and calls PushAsync directly.
+        if (cipher.UserId.HasValue)
         {
             var message = new SyncCipherPushNotification
             {

src/Core/Platform/Push/Engines/RelayPushEngine.cs

@@ -45,16 +45,9 @@ public RelayPushEngine(
 
     public async Task PushCipherAsync(Cipher cipher, PushType type, IEnumerable<Guid>? collectionIds)
     {
-        if (cipher.OrganizationId.HasValue)
-        {
-            // We cannot send org pushes since access logic is much more complicated than just the fact that they belong
-            // to the organization. Potentially we could blindly send to just users that have the access all permission
-            // device registration needs to be more granular to handle that appropriately. A more brute force approach could
-            // me to send "full sync" push to all org users, but that has the potential to DDOS the API in bursts.
-
-            // await SendPayloadToOrganizationAsync(cipher.OrganizationId.Value, type, message, true);
-        }
-        else if (cipher.UserId.HasValue)
+        // Org cipher fan-out is handled upstream in MultiServicePushNotificationService,
+        // which resolves per-user access and calls PushAsync directly.
+        if (cipher.UserId.HasValue)
         {
             var message = new SyncCipherPushNotification
             {

src/Core/Platform/Push/NotificationHub/NotificationHubPushEngine.cs

@@ -44,16 +44,9 @@ public NotificationHubPushEngine(
 
     public async Task PushCipherAsync(Cipher cipher, PushType type, IEnumerable<Guid>? collectionIds)
     {
-        if (cipher.OrganizationId.HasValue)
-        {
-            // We cannot send org pushes since access logic is much more complicated than just the fact that they belong
-            // to the organization. Potentially we could blindly send to just users that have the access all permission
-            // device registration needs to be more granular to handle that appropriately. A more brute force approach could
-            // me to send "full sync" push to all org users, but that has the potential to DDOS the API in bursts.
-
-            // await SendPayloadToOrganizationAsync(cipher.OrganizationId.Value, type, message, true);
-        }
-        else if (cipher.UserId.HasValue)
+        // Org cipher fan-out is handled upstream in MultiServicePushNotificationService,
+        // which resolves per-user access and calls PushAsync directly.
+        if (cipher.UserId.HasValue)
         {
             var message = new SyncCipherPushNotification
             {

src/Core/Repositories/ICollectionCipherRepository.cs

@@ -15,6 +15,12 @@ public interface ICollectionCipherRepository
     Task UpdateCollectionsForCiphersAsync(IEnumerable<Guid> cipherIds, Guid userId, Guid organizationId,
         IEnumerable<Guid> collectionIds);
 
+    /// <summary>
+    /// Returns the distinct user IDs of all confirmed organization members who have access to any of the specified
+    /// collections, either directly via <c>CollectionUser</c> or via group membership.
+    /// </summary>
+    Task<ICollection<Guid>> GetUserIdsByCollectionIdsAsync(IEnumerable<Guid> collectionIds);
+
     /// <summary>
     /// Add the specified collections to the specified ciphers. If a cipher already belongs to a requested collection,
     /// no action is taken.

src/Infrastructure.Dapper/Repositories/CollectionCipherRepository.cs

@@ -71,6 +71,19 @@ public async Task<ICollection<CollectionCipher>> GetManyByUserIdCipherIdAsync(Gu
         }
     }
 
+    public async Task<ICollection<Guid>> GetUserIdsByCollectionIdsAsync(IEnumerable<Guid> collectionIds)
+    {
+        using (var connection = new SqlConnection(ConnectionString))
+        {
+            var results = await connection.QueryAsync<Guid>(
+                "[dbo].[CollectionCipher_ReadUserIdsByCollectionIds]",
+                new { CollectionIds = collectionIds.ToGuidIdArrayTVP() },
+                commandType: CommandType.StoredProcedure);
+
+            return results.ToList();
+        }
+    }
+
     public async Task UpdateCollectionsAsync(Guid cipherId, Guid userId, IEnumerable<Guid> collectionIds)
     {
         using (var connection = new SqlConnection(ConnectionString))

src/Infrastructure.EntityFramework/Repositories/CollectionCipherRepository.cs

@@ -87,6 +87,30 @@ public async Task<ICollection<CollectionCipher>> GetManyByUserIdCipherIdAsync(Gu
         }
     }
 
+    public async Task<ICollection<Guid>> GetUserIdsByCollectionIdsAsync(IEnumerable<Guid> collectionIds)
+    {
+        var collectionIdList = collectionIds.ToList();
+        using (var scope = ServiceScopeFactory.CreateScope())
+        {
+            var dbContext = GetDatabaseContext(scope);
+
+            var directUserIds = from cu in dbContext.CollectionUsers
+                                where collectionIdList.Contains(cu.CollectionId)
+                                join ou in dbContext.OrganizationUsers on cu.OrganizationUserId equals ou.Id
+                                where ou.Status == Core.Enums.OrganizationUserStatusType.Confirmed && ou.UserId != null
+                                select ou.UserId!.Value;
+
+            var groupUserIds = from cg in dbContext.CollectionGroups
+                               where collectionIdList.Contains(cg.CollectionId)
+                               join gu in dbContext.GroupUsers on cg.GroupId equals gu.GroupId
+                               join ou in dbContext.OrganizationUsers on gu.OrganizationUserId equals ou.Id
+                               where ou.Status == Core.Enums.OrganizationUserStatusType.Confirmed && ou.UserId != null
+                               select ou.UserId!.Value;
+
+            return await directUserIds.Union(groupUserIds).ToListAsync();
+        }
+    }
+
     public async Task UpdateCollectionsAsync(Guid cipherId, Guid userId, IEnumerable<Guid> collectionIds)
     {
         using (var scope = ServiceScopeFactory.CreateScope())

src/Notifications/HubHelpers.cs

@@ -54,12 +54,8 @@ public async Task SendNotificationToHubAsync(string notificationJson, Cancellati
                     await _hubContext.Clients.User(cipherNotification.Payload.UserId.Value.ToString())
                         .SendAsync(_receiveMessageMethod, cipherNotification, cancellationToken);
                 }
-                else if (cipherNotification.Payload.OrganizationId.HasValue)
-                {
-                    await _hubContext.Clients
-                        .Group(NotificationsHub.GetOrganizationGroup(cipherNotification.Payload.OrganizationId.Value))
-                        .SendAsync(_receiveMessageMethod, cipherNotification, cancellationToken);
-                }
+                // OrganizationId-only cipher notifications are no longer sent via push engines;
+                // MultiServicePushNotificationService fans out per-user before the message is queued.
 
                 break;
             case PushType.SyncFolderUpdate:

src/Sql/dbo/Stored Procedures/CollectionCipher_ReadUserIdsByCollectionIds.sql

@@ -0,0 +1,23 @@
+CREATE PROCEDURE [dbo].[CollectionCipher_ReadUserIdsByCollectionIds]
+    @CollectionIds AS [dbo].[GuidIdArray] READONLY
+AS
+BEGIN
+    SET NOCOUNT ON
+
+    -- Users with direct collection access
+    SELECT DISTINCT OU.[UserId]
+    FROM [dbo].[CollectionUser] CU
+    INNER JOIN [dbo].[OrganizationUser] OU ON OU.[Id] = CU.[OrganizationUserId]
+    WHERE CU.[CollectionId] IN (SELECT [Id] FROM @CollectionIds)
+        AND OU.[Status] = 2 -- Confirmed
+
+    UNION
+
+    -- Users with group-based collection access
+    SELECT DISTINCT OU.[UserId]
+    FROM [dbo].[CollectionGroup] CG
+    INNER JOIN [dbo].[GroupUser] GU ON GU.[GroupId] = CG.[GroupId]
+    INNER JOIN [dbo].[OrganizationUser] OU ON OU.[Id] = GU.[OrganizationUserId]
+    WHERE CG.[CollectionId] IN (SELECT [Id] FROM @CollectionIds)
+        AND OU.[Status] = 2 -- Confirmed
+END