QA-2420: add OrganizationCardCipherScene to the seeder

[awiester-bw]

🎟️ Tracking

QA-2420: https://bitwarden.atlassian.net/browse/QA-2420

📔 Objective

The seeder can create org-owned login ciphers but has no way to create an org-owned card cipher; card seeding exists user-side only. This blocks per-test seeding for the org ClientEvents card tests, whose cases view and edit a card in an org collection and need one already seeded. This adds OrganizationCardCipherScene, mirroring UserCardCipherScene for the card fields and OrganizationLoginCipherScene for owner resolution and collection-aware persistence: it resolves the org, encrypts the card with the org key (OrganizationId set, UserId null), and writes it to the requested collections through CreateAsync(cipher, collectionIds). CardCipherSeeder already produces an org-key card, so it is unchanged. The reflection-based scene registration picks the scene up automatically by class name.

Includes a factory unit test that seeds an org card with a generated org key and asserts ownership (Card type, OrganizationId set, UserId null) plus per-field decryption back to plaintext with the org key. Verified by a passing build (0 errors) and the code-review and security-review agent passes.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 63.71%. Comparing base (9a87169) to head (f020dcf).
⚠️ Report is 1 commits behind head on main.

❗ There is a different number of reports uploaded between BASE (9a87169) and HEAD (f020dcf). Click for more details.

HEAD has 1 upload less than BASE

Flag	BASE (9a87169)	HEAD (f020dcf)
	2	1

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8294      +/-   ##
==========================================
- Coverage   69.37%   63.71%   -5.67%     
==========================================
  Files        2470     2470              
  Lines      105809   105809              
  Branches     9564     9564              
==========================================
- Hits        73401    67411    -5990     
- Misses      29970    36079    +6109     
+ Partials     2438     2319     -119     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the new OrganizationCardCipherScene and the accompanying CardCipherSeederTests. The scene mirrors OrganizationLoginCipherScene for owner resolution and collection-aware persistence and UserCardCipherScene for card field construction; OrganizationId is set with UserId null, and the org key is the only key used for encryption, so no plaintext vault data reaches the database. Reprompt and Notes correctly flow through CipherSeed → CipherViewDto → EncryptedCipherDto → the entity (CipherEncryption.CreateEntity maps Reprompt), and reading cipher.Id after CreateAsync is safe despite the repository's SetNewId() call. Scene registration is reflection-based, so no DI or docs update is required.

Code Review Details

• ♻️ : Added test covers the unchanged CardCipherSeeder and duplicates existing coverage, while the new scene itself is unexercised
  • test/SeederApi.IntegrationTest/Factories/CardCipherSeederTests.cs:13

[claude]

♻️ DEBT: This test covers CardCipherSeeder (unchanged by this PR), and near-identical coverage already exists.

Details

RustSdkCipherTests.cs:463 (CipherSeeder_CardCipher_ProducesServerCompatibleFormat) already calls CardCipherSeeder.Create with an org key and OrganizationId set, and RustSdkCipherTests.cs:245 (EncryptFields_CardCipher_RoundtripDecrypt) already asserts per-field decryption back to plaintext with that key. The only assertion here not already covered elsewhere is Assert.Null(cipher.UserId).

Meanwhile the code this PR actually adds — OrganizationCardCipherScene's org resolution, Notes/Reprompt mapping, and the collection-aware CreateAsync(cipher, collectionIds) persistence — is not exercised. Consider either folding the UserId/Brand assertions into the existing RustSdkCipherTests card test, or replacing this with a scene test in the style of test/SeederApi.IntegrationTest/Scenes/SecretsManagerSceneTests.cs, which drives scenes through POST /seed and verifies persisted rows.

Not a blocker — 21 of 23 scenes have no test today, so this is consistent with the existing bar.

[theMickster]

I agree with Claude Code here @awiester-bw that the test does not add value beyond what is already lower in the stack for the RustSdkCipherTests. Will you please remove the test file? Thanks!

[theMickster]

The Claude Code Comment here is the one fix to the PR that we should make. Otherwise, I'm good with the code.

[theMickster]

I agree with Claude Code here @awiester-bw that the test does not add value beyond what is already lower in the stack for the RustSdkCipherTests. Will you please remove the test file? Thanks!