Skip to content

Conversation

@JimmyVo16
Copy link
Contributor

@JimmyVo16 JimmyVo16 commented Dec 3, 2025

๐ŸŽŸ๏ธ Tracking

https://bitwarden.atlassian.net/browse/PM-21742

๐Ÿ“” Objective

This is to add the templates for the organization confirmation email.
There is no code for wiring this up.

Enterprise and Teams
Design

Families and Free
Design

๐Ÿ“ธ Screenshots

Enterprise and Teams

image

Mobile

image

Families and Free

image

Mobile
Note: I couldnโ€™t get the mobile version to look like the design, mainly due to the button sizing. Iโ€™ll communicate this to product.

image

โฐ Reminders before review

  • Contributor guidelines followed
  • All formatters and local linters executed and passed
  • Written new unit and / or integration tests where applicable
  • Protected functional changes with optionality (feature flags)
  • Used internationalization (i18n) for all UI strings
  • CI builds passed
  • Communicated to DevOps any deployment requirements
  • Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

๐Ÿฆฎ Reviewer guidelines

  • ๐Ÿ‘ (:+1:) or similar for great changes
  • ๐Ÿ“ (:memo:) or โ„น๏ธ (:information_source:) for notes or general info
  • โ“ (:question:) for questions
  • ๐Ÿค” (:thinking:) or ๐Ÿ’ญ (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
  • ๐ŸŽจ (:art:) for suggestions / improvements
  • โŒ (:x:) or โš ๏ธ (:warning:) for more significant problems or concerns needing attention
  • ๐ŸŒฑ (:seedling:) or โ™ป๏ธ (:recycle:) for future improvements or indications of technical debt
  • โ› (:pick:) for minor or nitpick changes

@github-actions
Copy link
Contributor

github-actions bot commented Dec 3, 2025

Logo
Checkmarx One โ€“ Scan Summary & Details โ€“ c9567b6f-3637-400e-a736-12508cab5127

Fixed Issues (1)

Great job! The following issues were fixed in this Pull Request

Severity Issue Source File / Package
MEDIUM CSRF /src/Api/AdminConsole/Public/Controllers/MembersController.cs: 207

@codecov
Copy link

codecov bot commented Dec 3, 2025

Codecov Report

โœ… All modified and coverable lines are covered by tests.
โœ… Project coverage is 53.63%. Comparing base (b1390c9) to head (ab69748).
โš ๏ธ Report is 5 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #6683      +/-   ##
==========================================
- Coverage   53.65%   53.63%   -0.02%     
==========================================
  Files        1926     1926              
  Lines       85720    85717       -3     
  Branches     7687     7686       -1     
==========================================
- Hits        45989    45978      -11     
- Misses      37958    37966       +8     
  Partials     1773     1773              

โ˜” View full report in Codecov by Sentry.
๐Ÿ“ข Have feedback on the report? Share it here.

๐Ÿš€ New features to boost your workflow:
  • โ„๏ธ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • ๐Ÿ“ฆ JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

headAnchorElement +
`
</mj-text>
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change ensures we only add the text element when the component receives the respective input for the field. The current behavior adds an empty text element when no input is provided, which can impact spacing and style.

This change should not affect existing components, since the behavior remains the same for components that pass in data for that field.

@@ -1,4 +1,12 @@
const { BodyComponent } = require("mjml-core");

const BODY_TEXT_STYLES = `
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey folks, I got some feedback from Sukhleen that the font spacing doesnโ€™t align with the design. I think this wasnโ€™t caught earlier because the welcome email doesnโ€™t have multi-line text, but the org confirmation email does.

I also noticed that the style from mj-bw-icon-row-text isnโ€™t being applied to the text. I canโ€™t get the styling to apply through the CSS class; it might be related to how MJML renders it.

Image

The workaround is to inject the styling directly.

Iโ€™m open to any suggestions on how to handle this better.

@JimmyVo16 JimmyVo16 marked this pull request as ready for review December 8, 2025 16:05
@JimmyVo16 JimmyVo16 requested review from a team as code owners December 8, 2025 16:05
@claude
Copy link
Contributor

claude bot commented Dec 8, 2025

Claude finished @JimmyVo16's task โ€”โ€” View job


Review Complete โœ…

Todo List

  • Conduct comprehensive code review of PR changes
  • Analyze email template security and correctness
  • Review component changes in mj-bw-icon-row.js
  • Provide detailed feedback

Code Review: Organization Confirmation Email Templates

Overall Assessment: The templates are well-implemented with proper security considerations. The code is ready to merge once the minor issues below are addressed.


โœ… Security & Compliance

Zero-Knowledge Principles: โœ“ Pass

  • No vault data or encrypted content is exposed in these templates
  • Only organization metadata (name, plan type) is used, which is appropriate for this context

XSS Protection: โœ“ Pass

  • Handlebars double-brace syntax {{OrganizationName}} properly HTML-escapes output
  • No use of triple-brace {{{ or SafeString that would bypass escaping
  • All dynamic content is properly escaped

Sensitive Data Handling: โœ“ Pass

  • No PII, passwords, keys, or vault data in templates
  • Only organization name and contextual information displayed

๐Ÿ“ Findings by Severity

โ„น๏ธ Minor Issues

1. Identical Text Templates (src/Core/MailTemplates/Handlebars/MJML/AdminConsole/OrganizationConfirmation/organization-confirmation-*.text.hbs)

Both organization-confirmation-enterprise-teams.text.hbs and organization-confirmation-family-free.text.hbs contain identical content:

Thank you for confirming your organization, {{OrganizationName}}!

You've successfully confirmed your organization. Start adding members to your organization to get them started with Bitwarden!

Recommendation: Consider whether these should have different messaging based on organization type (Enterprise/Teams vs Families/Free), similar to how the HTML versions differ. If they're intentionally the same, this is fine.


๐ŸŽจ Suggestions for Improvement

2. Component Refactoring Quality (src/Core/MailTemplates/Mjml/components/mj-bw-icon-row.js)

The refactoring to add conditional rendering is well-done:

${this.getAttribute('text') ? `
  <mj-text ... font-family="'Open Sans', Helvetica, Arial, sans-serif" ...>
    ${this.getAttribute('text')}
  </mj-text>
` : ''}

Observations:

  • โœ“ Properly prevents empty text elements when no input provided
  • โœ“ Inline styling workaround for font spacing is reasonable given MJML rendering limitations
  • โœ“ Maintains backward compatibility for existing components

The author's note about inline styling being a workaround due to CSS class application issues is understandable given MJML's rendering behavior.

3. Missing Unit Tests

Per Bitwarden's development workflow, new features should include unit tests. Consider adding tests for:

  • Template rendering with various organization names (including special characters for XSS testing)
  • Component rendering with and without text attributes
  • Email generation for different organization types

4. Template Wiring

PR description states: "There is no code for wiring this up." These templates will remain unused until integrated. Consider:

  • Creating a follow-up ticket/PR for the integration work
  • Documenting where these templates should be called from
  • Ensuring the template names align with whatever naming convention the email service expects

๐Ÿ’ญ Design Feedback Notes

The author mentioned mobile button sizing doesn't match design and will communicate to product. This is appropriate to handle outside the code review process.


โœ… What Went Well

  1. Proper separation of concerns: MJML source โ†’ compiled HTML โ†’ Handlebars templates
  2. Responsive design: Both desktop and mobile considerations in templates
  3. Component reusability: Good use of shared components (mj-bw-icon-row, mj-bw-cta-button)
  4. Security-first approach: Proper output escaping throughout
  5. Clean file organization: Templates logically organized under AdminConsole/OrganizationConfirmation/

๐Ÿ” Additional Notes

  • File paths in MJML mj-include statements are correct relative to the email template location
  • Color schemes and branding appear consistent with Bitwarden design system
  • Email accessibility considerations present (alt text, semantic structure)

Recommendation

โœ… APPROVE - This PR is ready to merge once the team confirms:

  1. Whether text templates should differ between org types (or if identical is intentional)
  2. That missing tests are acceptable for template-only PRs (or will be added in integration PR)
  3. Timeline for wiring up these templates to the email service

BryanCunningham
BryanCunningham previously approved these changes Dec 8, 2025
jrmccannon
jrmccannon previously approved these changes Dec 8, 2025
Copy link
Contributor

@jrmccannon jrmccannon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me.

@JimmyVo16 JimmyVo16 dismissed stale reviews from jrmccannon and BryanCunningham via ad6bedd December 8, 2025 17:44
@JimmyVo16
Copy link
Contributor Author

Originally, I was thinking of having a PR for each template, but they share some logic, so itโ€™s easier to roll them into one PR. Sorry for the inconvenience, folks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants