[PM-41931] feat(dirt): Add browser health exclusion storage

src/Api/Vault/Models/Response/CipherResponseModel.cs

@@ -296,6 +296,9 @@ protected CipherResponseModel(
         Favorite = cipher.Favorite;
         Edit = cipher.Edit;
         ArchivedDate = cipher.ArchivedDate;
+        Exclusions = cipher.ExcludedRiskCategories == null
+            ? null
+            : JsonSerializer.Deserialize<List<string>>(cipher.ExcludedRiskCategories);
         ViewPassword = cipher.ViewPassword;
         Permissions = new CipherPermissionsResponseModel(user, cipher, organizationAbility);
     }
@@ -312,6 +315,7 @@ public static CipherResponseModel From(FullCipherAccess access, CipherDetails ci
     public bool Edit { get; set; }
     public bool ViewPassword { get; set; }
     public DateTime? ArchivedDate { get; set; }
+    public IEnumerable<string>? Exclusions { get; set; }
     public CipherPermissionsResponseModel Permissions { get; set; }
 }
 

src/Core/Dirt/Repositories/ICipherBrowserHealthExclusionRepository.cs

@@ -0,0 +1,7 @@
+namespace Bit.Core.Dirt.Repositories;
+
+public interface ICipherBrowserHealthExclusionRepository
+{
+    /// <summary>Excludes the user's personal, not-deleted logins from browser health, adding the risk category to the user's list once. The category must not be empty. Returns how many were excluded.</summary>
+    Task<int> ExcludeAsync(IEnumerable<Guid> cipherIds, Guid userId, string riskCategory);
+}

src/Core/Vault/Entities/Cipher.cs

@@ -27,6 +27,7 @@ public class Cipher : ITableObject<Guid>, ICloneable
     public Enums.CipherRepromptType? Reprompt { get; set; }
     public string Key { get; set; }
     public string Archives { get; set; }
+    public string Exclusions { get; set; }
 
     public void SetNewId()
     {

src/Core/Vault/Models/Data/CipherDetails.cs

@@ -11,6 +11,8 @@ public class CipherDetails : CipherOrganizationDetails
     public bool Manage { get; set; }
     // Per-user archived date from Archives JSON.
     public DateTime? ArchivedDate { get; set; }
+    // Per-user risk categories (JSON array) from the Exclusions JSON.
+    public string? ExcludedRiskCategories { get; set; }
     public CipherDetails() { }
 
     public CipherDetails(CipherOrganizationDetails cipher)
@@ -53,6 +55,7 @@ public CipherDetailsWithCollections(
         Key = cipher.Key;
         FolderId = cipher.FolderId;
         ArchivedDate = cipher.ArchivedDate;
+        ExcludedRiskCategories = cipher.ExcludedRiskCategories;
         Favorite = cipher.Favorite;
         Edit = cipher.Edit;
         ViewPassword = cipher.ViewPassword;

src/Infrastructure.Dapper/DapperServiceCollectionExtensions.cs

@@ -96,6 +96,7 @@ public static void AddDapperRepositories(this IServiceCollection services, bool
         services.AddSingleton<IOrganizationApplicationRepository, OrganizationApplicationRepository>();
         services.AddSingleton<IOrganizationDeleteTaskRepository, OrganizationDeleteTaskRepository>();
         services.AddSingleton<IOrganizationMemberBaseDetailRepository, OrganizationMemberBaseDetailRepository>();
+        services.AddSingleton<ICipherBrowserHealthExclusionRepository, CipherBrowserHealthExclusionRepository>();
 
         if (selfHosted)
         {

src/Infrastructure.Dapper/Dirt/CipherBrowserHealthExclusionRepository.cs

@@ -0,0 +1,33 @@
+using System.Data;
+using Bit.Core.Dirt.Repositories;
+using Bit.Core.Settings;
+using Bit.Infrastructure.Dapper.Repositories;
+using Dapper;
+using Microsoft.Data.SqlClient;
+
+namespace Bit.Infrastructure.Dapper.Dirt;
+
+public class CipherBrowserHealthExclusionRepository : BaseRepository, ICipherBrowserHealthExclusionRepository
+{
+    public CipherBrowserHealthExclusionRepository(GlobalSettings globalSettings)
+        : base(globalSettings.SqlServer.ConnectionString, globalSettings.SqlServer.ReadOnlyConnectionString)
+    {
+    }
+
+    public async Task<int> ExcludeAsync(IEnumerable<Guid> cipherIds, Guid userId, string riskCategory)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(riskCategory);
+
+        var ids = cipherIds.ToList();
+        if (ids.Count == 0)
+        {
+            return 0;
+        }
+
+        await using var connection = new SqlConnection(ConnectionString);
+        return await connection.ExecuteScalarAsync<int>(
+            "[dbo].[Cipher_UpdateManyExclusions]",
+            new { Ids = ids.ToGuidIdArrayTVP(), UserId = userId, Exclude = true, RiskCategory = riskCategory },
+            commandType: CommandType.StoredProcedure);
+    }
+}

src/Infrastructure.EntityFramework/Dirt/CipherBrowserHealthExclusionRepository.cs

@@ -0,0 +1,59 @@
+using AutoMapper;
+using Bit.Core.Dirt.Repositories;
+using Bit.Core.Utilities;
+using Bit.Core.Vault.Enums;
+using Bit.Infrastructure.EntityFramework.Repositories;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Bit.Infrastructure.EntityFramework.Dirt;
+
+public class CipherBrowserHealthExclusionRepository : BaseEntityFrameworkRepository, ICipherBrowserHealthExclusionRepository
+{
+    public CipherBrowserHealthExclusionRepository(IServiceScopeFactory serviceScopeFactory, IMapper mapper)
+        : base(serviceScopeFactory, mapper)
+    {
+    }
+
+    public async Task<int> ExcludeAsync(IEnumerable<Guid> cipherIds, Guid userId, string riskCategory)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(riskCategory);
+
+        var ids = cipherIds.ToList();
+        if (ids.Count == 0)
+        {
+            return 0;
+        }
+
+        await using var scope = ServiceScopeFactory.CreateAsyncScope();
+        var dbContext = GetDatabaseContext(scope);
+        var ciphers = await dbContext.Ciphers
+            .Where(c => ids.Contains(c.Id) && c.UserId == userId && c.OrganizationId == null
+                && c.Type == CipherType.Login && c.DeletedDate == null)
+            .ToListAsync();
+
+        foreach (var cipher in ciphers)
+        {
+            var exclusions = string.IsNullOrWhiteSpace(cipher.Exclusions)
+                ? new Dictionary<Guid, List<string>>()
+                : CoreHelpers.LoadClassFromJsonData<Dictionary<Guid, List<string>>>(cipher.Exclusions)
+                  ?? new Dictionary<Guid, List<string>>();
+            if (!exclusions.TryGetValue(userId, out var riskCategories) || riskCategories == null)
+            {
+                exclusions[userId] = [riskCategory];
+            }
+            else if (!riskCategories.Contains(riskCategory))
+            {
+                riskCategories.Add(riskCategory);
+            }
+            cipher.Exclusions = CoreHelpers.ClassToJsonData(exclusions);
+        }
+
+        if (ciphers.Count > 0)
+        {
+            await dbContext.UserBumpAccountRevisionDateAsync(userId);
+        }
+        await dbContext.SaveChangesAsync();
+        return ciphers.Count;
+    }
+}

src/Infrastructure.EntityFramework/EntityFrameworkServiceCollectionExtensions.cs

@@ -132,6 +132,7 @@ public static void AddPasswordManagerEFRepositories(this IServiceCollection serv
         services.AddSingleton<IOrganizationReportRepository, OrganizationReportRepository>();
         services.AddSingleton<IOrganizationApplicationRepository, OrganizationApplicationRepository>();
         services.AddSingleton<IOrganizationMemberBaseDetailRepository, OrganizationMemberBaseDetailRepository>();
+        services.AddSingleton<ICipherBrowserHealthExclusionRepository, CipherBrowserHealthExclusionRepository>();
         services.AddSingleton<IOrganizationDeleteTaskRepository, OrganizationDeleteTaskRepository>();
 
         if (selfHosted)

src/Infrastructure.EntityFramework/Repositories/Queries/UserCipherDetailsQuery.cs

@@ -71,7 +71,8 @@ from cg in cg_g.DefaultIfEmpty()
                         OrganizationUseTotp = o.UseTotp,
                         c.Reprompt,
                         c.Key,
-                        c.Archives
+                        c.Archives,
+                        c.Exclusions
                     };
 
         var query2 = from c in dbContext.Ciphers
@@ -95,7 +96,8 @@ from cg in cg_g.DefaultIfEmpty()
                          OrganizationUseTotp = false,
                          c.Reprompt,
                          c.Key,
-                         c.Archives
+                         c.Archives,
+                         c.Exclusions
                      };
 
         var union = query.Union(query2).Select(c => new CipherDetails
@@ -117,7 +119,8 @@ from cg in cg_g.DefaultIfEmpty()
             Manage = c.Manage,
             OrganizationUseTotp = c.OrganizationUseTotp,
             Key = c.Key,
-            ArchivedDate = GetArchivedDate(_userId, new Cipher { Id = c.Id, Archives = c.Archives })
+            ArchivedDate = GetArchivedDate(_userId, new Cipher { Id = c.Id, Archives = c.Archives }),
+            ExcludedRiskCategories = GetExcludedRiskCategories(_userId, c.Exclusions)
         });
         return union;
     }
@@ -143,6 +146,28 @@ from cg in cg_g.DefaultIfEmpty()
         }
     }
 
+
+    internal static string GetExcludedRiskCategories(Guid? userId, string exclusionsJson)
+    {
+        try
+        {
+            if (userId.HasValue && !string.IsNullOrWhiteSpace(exclusionsJson))
+            {
+                var exclusions = JsonSerializer.Deserialize<Dictionary<Guid, List<string>>>(exclusionsJson);
+                if (exclusions.TryGetValue(userId.Value, out var riskCategories))
+                {
+                    return JsonSerializer.Serialize(riskCategories);
+                }
+            }
+
+            return null;
+        }
+        catch
+        {
+            return null;
+        }
+    }
+
     private static Guid? GetFolderId(Guid? userId, Cipher cipher)
     {
         try

src/Infrastructure.EntityFramework/Vault/Repositories/CipherRepository.cs

@@ -518,6 +518,7 @@ public async Task<ICollection<CipherDetails>> GetManyByUserIdAsync(Guid userId,
                                         OrganizationUseTotp = false,
                                         Key = c.Key,
                                         ArchivedDate = c.ArchivedDate,
+                                        ExcludedRiskCategories = c.ExcludedRiskCategories,
                                     };
             }
 
@@ -574,6 +575,22 @@ await idsToMove.ForEachAsync(cipher =>
         }
     }
 
+    public override async Task ReplaceAsync(Core.Vault.Entities.Cipher cipher)
+    {
+        using (var scope = ServiceScopeFactory.CreateScope())
+        {
+            var dbContext = GetDatabaseContext(scope);
+            var entity = await dbContext.Ciphers.FindAsync(cipher.Id);
+            if (entity != null)
+            {
+                var mappedEntity = Mapper.Map<Cipher>(cipher);
+                dbContext.Entry(entity).CurrentValues.SetValues(mappedEntity);
+                dbContext.Entry(entity).Property(c => c.Exclusions).IsModified = false;
+                await dbContext.SaveChangesAsync();
+            }
+        }
+    }
+
     public async Task ReplaceAsync(CipherDetails cipher)
     {
         using (var scope = ServiceScopeFactory.CreateScope())
@@ -647,6 +664,7 @@ public async Task ReplaceAsync(CipherDetails cipher)
 
                 var mappedEntity = Mapper.Map<Cipher>(cipher);
                 dbContext.Entry(entity).CurrentValues.SetValues(mappedEntity);
+                dbContext.Entry(entity).Property(c => c.Exclusions).IsModified = false;
 
                 if (cipher.OrganizationId.HasValue)
                 {

src/Infrastructure.EntityFramework/Vault/Repositories/Queries/CipherDetailsQuery.cs

@@ -37,6 +37,7 @@ public virtual IQueryable<CipherDetails> Run(DatabaseContext dbContext)
                         ArchivedDate = !_userId.HasValue || c.Archives == null || !c.Archives.ToLowerInvariant().Contains(_userId.Value.ToString()) ?
                             null :
                             CoreHelpers.LoadClassFromJsonData<Dictionary<Guid, DateTime?>>(c.Archives)[_userId.Value],
+                        ExcludedRiskCategories = UserCipherDetailsQuery.GetExcludedRiskCategories(_userId, c.Exclusions),
                     };
         return query;
     }

src/Sql/dbo/Dirt/Stored Procedures/Cipher_UpdateManyExclusions.sql

@@ -0,0 +1,51 @@
+CREATE PROCEDURE [dbo].[Cipher_UpdateManyExclusions]
+    @Ids AS [dbo].[GuidIdArray] READONLY,
+    @UserId AS UNIQUEIDENTIFIER,
+    @Exclude AS BIT,
+    @RiskCategory AS NVARCHAR(50) = NULL
+AS
+BEGIN
+    SET NOCOUNT ON
+
+    UPDATE
+        C
+    SET
+        [Exclusions] = CASE
+            -- First exclusion for this user: start the user's array
+            WHEN @Exclude = 1 AND JSON_QUERY(C.[Exclusions], CONCAT('$."', @UserId, '"')) IS NULL THEN JSON_MODIFY(
+                COALESCE(C.[Exclusions], N'{}'),
+                CONCAT('$."', @UserId, '"'),
+                JSON_QUERY(JSON_MODIFY(N'[]', 'append $', @RiskCategory))
+            )
+            -- Category already excluded: keep the value
+            WHEN @Exclude = 1 AND EXISTS (
+                SELECT 1
+                FROM OPENJSON(C.[Exclusions], CONCAT('$."', @UserId, '"'))
+                WHERE [value] COLLATE Latin1_General_BIN2 = @RiskCategory -- exact match, like EF
+            ) THEN C.[Exclusions]
+            WHEN @Exclude = 1 THEN JSON_MODIFY(
+                C.[Exclusions],
+                CONCAT('append $."', @UserId, '"'),
+                @RiskCategory
+            )
+            -- NULL removes the user's key
+            ELSE JSON_MODIFY(COALESCE(C.[Exclusions], N'{}'), CONCAT('$."', @UserId, '"'), NULL)
+        END
+    FROM
+        [dbo].[Cipher] C
+        INNER JOIN @Ids I ON I.[Id] = C.[Id]
+    WHERE
+        C.[UserId] = @UserId
+        AND C.[OrganizationId] IS NULL
+        AND C.[Type] = 1 -- Login
+        AND C.[DeletedDate] IS NULL
+
+    DECLARE @Count INT = @@ROWCOUNT
+
+    IF @Count > 0
+    BEGIN
+        EXEC [dbo].[User_BumpAccountRevisionDate] @UserId
+    END
+
+    SELECT @Count
+END

src/Sql/dbo/Vault/Functions/CipherDetails.sql

@@ -34,6 +34,10 @@ SELECT
             OR C.[Archives] IS NULL
         THEN NULL
         ELSE TRY_CONVERT(DATETIME2(7), JSON_VALUE(C.[Archives], CONCAT('$."', @UserId, '"')))
-    END [ArchivedDate]
+    END [ArchivedDate],
+    CASE
+        WHEN @UserId IS NULL THEN NULL
+        ELSE JSON_QUERY(C.[Exclusions], CONCAT('$."', @UserId, '"'))
+    END [ExcludedRiskCategories]
 FROM
     [dbo].[Cipher] C;

src/Sql/dbo/Vault/Stored Procedures/Cipher/CipherDetails_Create.sql

@@ -19,7 +19,9 @@
     @Reprompt TINYINT,
     @Key VARCHAR(MAX) = NULL,
     @ArchivedDate DATETIME2(7) = NULL,
-    @Archives NVARCHAR(MAX) = NULL -- not used
+    @Archives NVARCHAR(MAX) = NULL, -- not used
+    @ExcludedRiskCategories NVARCHAR(MAX) = NULL, -- not used
+    @Exclusions NVARCHAR(MAX) = NULL -- not used
 AS
 BEGIN
     SET NOCOUNT ON

src/Sql/dbo/Vault/Stored Procedures/Cipher/CipherDetails_CreateWithCollections.sql

@@ -20,6 +20,8 @@
     @Key VARCHAR(MAX) = NULL,
     @ArchivedDate DATETIME2(7) = NULL,
     @Archives NVARCHAR(MAX) = NULL, -- not used
+    @ExcludedRiskCategories NVARCHAR(MAX) = NULL, -- not used
+    @Exclusions NVARCHAR(MAX) = NULL, -- not used
     @CollectionIds AS [dbo].[GuidIdArray] READONLY
 AS
 BEGIN

src/Sql/dbo/Vault/Stored Procedures/Cipher/CipherDetails_ReadByIdUserId.sql

@@ -21,6 +21,7 @@ SELECT
         [Key],
         [OrganizationUseTotp],
         [ArchivedDate],
+        [ExcludedRiskCategories],
         -- The highest rank holds Manage as 4, Edit as 2 and ViewPassword as 1; each flag is one part of it
         (MAX(R.[Rank]) / 2) % 2 AS [Edit],
         MAX(R.[Rank]) % 2 AS [ViewPassword],
@@ -48,5 +49,6 @@ SELECT
         [Reprompt],
         [Key],
         [OrganizationUseTotp],
-        [ArchivedDate]
+        [ArchivedDate],
+        [ExcludedRiskCategories]
 END

src/Sql/dbo/Vault/Stored Procedures/Cipher/CipherDetails_Update.sql

@@ -19,7 +19,9 @@
     @Reprompt TINYINT,
     @Key VARCHAR(MAX) = NULL,
     @ArchivedDate DATETIME2(7) = NULL,
-    @Archives NVARCHAR(MAX) = NULL -- not used
+    @Archives NVARCHAR(MAX) = NULL, -- not used
+    @ExcludedRiskCategories NVARCHAR(MAX) = NULL, -- not used
+    @Exclusions NVARCHAR(MAX) = NULL -- not used
 AS
 BEGIN
     SET NOCOUNT ON

src/Sql/dbo/Vault/Stored Procedures/Cipher/Cipher_Create.sql

@@ -12,7 +12,8 @@
     @DeletedDate DATETIME2(7),
     @Reprompt TINYINT,
     @Key VARCHAR(MAX) = NULL,
-    @Archives NVARCHAR(MAX) = NULL
+    @Archives NVARCHAR(MAX) = NULL,
+    @Exclusions NVARCHAR(MAX) = NULL -- not used
 AS
 BEGIN
     SET NOCOUNT ON

src/Sql/dbo/Vault/Stored Procedures/Cipher/Cipher_CreateWithCollections.sql

@@ -13,6 +13,7 @@
     @Reprompt TINYINT,
     @Key VARCHAR(MAX) = NULL,
     @Archives NVARCHAR(MAX) = NULL,
+    @Exclusions NVARCHAR(MAX) = NULL, -- not used
     @CollectionIds AS [dbo].[GuidIdArray] READONLY
 AS
 BEGIN