[PM-45107] feat: Autoscale Privileged Controls seats when members get access

bitwarden_license/src/Commercial.Core/Billing/Providers/Services/BusinessUnitConverter.cs

@@ -3,6 +3,7 @@
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.AdminConsole.Entities.Provider;
 using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.AdminConsole.OrganizationFeatures.Organizations.Interfaces;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Billing;
 using Bit.Core.Billing.Constants;
@@ -31,13 +32,13 @@ public class BusinessUnitConverter(
     GlobalSettings globalSettings,
     ILogger<BusinessUnitConverter> logger,
     IMailService mailService,
-    IOrganizationService organizationService,
     IOrganizationUserRepository organizationUserRepository,
     IPricingClient pricingClient,
     IProviderOrganizationRepository providerOrganizationRepository,
     IProviderPlanRepository providerPlanRepository,
     IProviderRepository providerRepository,
     IProviderUserRepository providerUserRepository,
+    IReplaceOrganizationAndUpdateCacheCommand replaceOrganizationAndUpdateCacheCommand,
     IStripeAdapter stripeAdapter,
     ISubscriberService subscriberService,
     IUserRepository userRepository) : IBusinessUnitConverter
@@ -172,7 +173,7 @@ public async Task<Guid> FinalizeConversion(
 
         // Complete database updates for provider setup.
         await Task.WhenAll(
-            organizationService.ReplaceAndUpdateCacheAsync(organization),
+            replaceOrganizationAndUpdateCacheCommand.RunAsync(organization),
             providerOrganizationRepository.ReplaceAsync(providerOrganization),
             providerRepository.ReplaceAsync(provider),
             providerUserRepository.ReplaceAsync(providerUser));

bitwarden_license/src/Commercial.Core/Billing/Providers/Services/ProviderBillingService.cs

@@ -6,6 +6,7 @@
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.AdminConsole.Entities.Provider;
 using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.AdminConsole.OrganizationFeatures.Organizations.Interfaces;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Billing;
 using Bit.Core.Billing.Constants;
@@ -42,13 +43,13 @@ public class ProviderBillingService(
     IGlobalSettings globalSettings,
     ILogger<ProviderBillingService> logger,
     IOrganizationRepository organizationRepository,
-    IOrganizationService organizationService,
     IPriceIncreaseScheduler priceIncreaseScheduler,
     IPricingClient pricingClient,
     IProviderInvoiceItemRepository providerInvoiceItemRepository,
     IProviderOrganizationRepository providerOrganizationRepository,
     IProviderPlanRepository providerPlanRepository,
     IProviderUserRepository providerUserRepository,
+    IReplaceOrganizationAndUpdateCacheCommand replaceOrganizationAndUpdateCacheCommand,
     IStripeAdapter stripeAdapter,
     ISubscriberService subscriberService,
     ITaxService taxService)
@@ -149,7 +150,7 @@ await stripeAdapter.FinalizeInvoiceAsync(subscription.LatestInvoiceId,
         await ScaleSeats(provider, organization.PlanType, organization.Seats!.Value);
 
         await Task.WhenAll(
-            organizationService.ReplaceAndUpdateCacheAsync(organization),
+            replaceOrganizationAndUpdateCacheCommand.RunAsync(organization),
             providerOrganizationRepository.CreateAsync(providerOrganization)
         );
 

bitwarden_license/src/Commercial.Core/Providers/RemoveOrganizationFromProviderCommand.cs

@@ -3,6 +3,7 @@
 
 using Bit.Core.AdminConsole.Entities;
 using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.OrganizationFeatures.Organizations.Interfaces;
 using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers;
 using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
 using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.RevokeUser.v1;
@@ -26,7 +27,7 @@ public class RemoveOrganizationFromProviderCommand : IRemoveOrganizationFromProv
     private readonly IEventService _eventService;
     private readonly IMailService _mailService;
     private readonly IOrganizationRepository _organizationRepository;
-    private readonly IOrganizationService _organizationService;
+    private readonly IReplaceOrganizationAndUpdateCacheCommand _replaceOrganizationAndUpdateCacheCommand;
     private readonly IProviderOrganizationRepository _providerOrganizationRepository;
     private readonly IStripeAdapter _stripeAdapter;
     private readonly Bitwarden.Server.Sdk.Features.IFeatureService _featureService;
@@ -39,7 +40,7 @@ public RemoveOrganizationFromProviderCommand(
         IEventService eventService,
         IMailService mailService,
         IOrganizationRepository organizationRepository,
-        IOrganizationService organizationService,
+        IReplaceOrganizationAndUpdateCacheCommand replaceOrganizationAndUpdateCacheCommand,
         IProviderOrganizationRepository providerOrganizationRepository,
         IStripeAdapter stripeAdapter,
         Bitwarden.Server.Sdk.Features.IFeatureService featureService,
@@ -51,7 +52,7 @@ public RemoveOrganizationFromProviderCommand(
         _eventService = eventService;
         _mailService = mailService;
         _organizationRepository = organizationRepository;
-        _organizationService = organizationService;
+        _replaceOrganizationAndUpdateCacheCommand = replaceOrganizationAndUpdateCacheCommand;
         _providerOrganizationRepository = providerOrganizationRepository;
         _stripeAdapter = stripeAdapter;
         _featureService = featureService;
@@ -89,7 +90,7 @@ public async Task RemoveOrganizationFromProvider(
 
         await ResetOrganizationBillingAsync(organization, provider, organizationOwnerEmails);
 
-        await _organizationService.ReplaceAndUpdateCacheAsync(organization);
+        await _replaceOrganizationAndUpdateCacheCommand.RunAsync(organization);
 
         await _providerOrganizationRepository.DeleteAsync(providerOrganization);
 

bitwarden_license/src/Scim/Scim.csproj

@@ -9,6 +9,7 @@
   <PropertyGroup Condition=" '$(RunConfiguration)' == 'Scim' " />
   <ItemGroup>
     <ProjectReference Include="..\..\..\src\Core\Core.csproj" />
+    <ProjectReference Include="..\..\..\src\Libraries\Subscriptions.Organization\Subscriptions.Organization.csproj" />
     <ProjectReference Include="..\..\..\src\SharedWeb\SharedWeb.csproj" />
   </ItemGroup>
 

bitwarden_license/src/Scim/Startup.cs

@@ -8,6 +8,7 @@
 using Bit.Scim.Context;
 using Bit.Scim.Utilities;
 using Bit.SharedWeb.Utilities;
+using Bit.Subscriptions.Organization;
 using Duende.IdentityModel;
 using Microsoft.Extensions.DependencyInjection.Extensions;
 using Stripe;
@@ -72,6 +73,7 @@ public void ConfigureServices(IServiceCollection services)
         services.AddDefaultServices(globalSettings);
         services.AddDistributedCache(globalSettings);
         services.AddBillingOperations();
+        services.AddPrivilegedControlsSeatAutoscaling();
 
         services.TryAddSingleton<IHttpContextAccessor, HttpContextAccessor>();
 

bitwarden_license/src/Scim/packages.lock.json

@@ -1212,6 +1212,9 @@
           "ZiggyCreatures.FusionCache.Serialization.SystemTextJson": "[2.0.2, 2.0.2]"
         }
       },
+      "currentuser": {
+        "type": "Project"
+      },
       "data": {
         "type": "Project"
       },
@@ -1247,6 +1250,15 @@
           "linq2db.EntityFrameworkCore": "[8.8.0, 8.8.0]"
         }
       },
+      "invoicing": {
+        "type": "Project",
+        "dependencies": {
+          "Bitwarden.Server.Sdk.Environment": "[0.1.0, )",
+          "Bitwarden.Server.Sdk.Features": "[1.5.0, )",
+          "Core": "[2026.10.1, )",
+          "Stripe.net": "[52.1.0, 52.1.0]"
+        }
+      },
       "maildelivery": {
         "type": "Project",
         "dependencies": {
@@ -1255,6 +1267,13 @@
           "SendGrid": "[9.29.3, 9.29.3]"
         }
       },
+      "organizationauthorization": {
+        "type": "Project",
+        "dependencies": {
+          "Core": "[2026.10.1, )",
+          "CurrentUser": "[0.0.1, )"
+        }
+      },
       "pam.domain": {
         "type": "Project",
         "dependencies": {
@@ -1284,6 +1303,15 @@
       },
       "ssrfprotection": {
         "type": "Project"
+      },
+      "subscriptions.organization": {
+        "type": "Project",
+        "dependencies": {
+          "Core": "[2026.10.1, )",
+          "ExceptionHandling": "[0.0.1, )",
+          "Invoicing": "[0.0.1, )",
+          "OrganizationAuthorization": "[0.0.1, )"
+        }
       }
     }
   }

bitwarden_license/src/Sso/Controllers/AccountController.cs

@@ -12,6 +12,9 @@
 using Bit.Core.Auth.Models.Data;
 using Bit.Core.Auth.Repositories;
 using Bit.Core.Auth.UserFeatures.Registration;
+using Bit.Core.Billing.Organizations;
+using Bit.Core.Billing.Organizations.Commands;
+using Bit.Core.Billing.Organizations.Models;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Models.Api;
@@ -59,6 +62,8 @@ public class AccountController : Controller
     private readonly IOrganizationDomainRepository _organizationDomainRepository;
     private readonly IRegisterUserCommand _registerUserCommand;
     private readonly ISendOrganizationInvitesCommand _sendOrganizationInvitesCommand;
+    private readonly IReservePrivilegedControlsSeatsCommand _reservePrivilegedControlsSeatsCommand;
+    private readonly ISendPrivilegedControlsSeatNeededEmailCommand _sendPrivilegedControlsSeatNeededEmailCommand;
 
     public AccountController(
         IAuthenticationSchemeProvider schemeProvider,
@@ -80,7 +85,9 @@ public AccountController(
         IDataProtectorTokenFactory<SsoTokenable> dataProtector,
         IOrganizationDomainRepository organizationDomainRepository,
         IRegisterUserCommand registerUserCommand,
-        ISendOrganizationInvitesCommand sendOrganizationInvitesCommand)
+        ISendOrganizationInvitesCommand sendOrganizationInvitesCommand,
+        IReservePrivilegedControlsSeatsCommand reservePrivilegedControlsSeatsCommand,
+        ISendPrivilegedControlsSeatNeededEmailCommand sendPrivilegedControlsSeatNeededEmailCommand)
     {
         _schemeProvider = schemeProvider;
         _clientStore = clientStore;
@@ -102,6 +109,8 @@ public AccountController(
         _organizationDomainRepository = organizationDomainRepository;
         _registerUserCommand = registerUserCommand;
         _sendOrganizationInvitesCommand = sendOrganizationInvitesCommand;
+        _reservePrivilegedControlsSeatsCommand = reservePrivilegedControlsSeatsCommand;
+        _sendPrivilegedControlsSeatNeededEmailCommand = sendPrivilegedControlsSeatNeededEmailCommand;
     }
 
     [HttpGet]
@@ -693,10 +702,20 @@ SsoConfigurationData ssoConfigData
         // won't complete. Staged rows aren't seat-counted; a Staged→Invited promotion
         // consumes a seat and must gate here alongside the fresh-JIT case.
         var willPromoteStagedOrgUser = possibleOrgUser?.Status == OrganizationUserStatusType.Staged;
+        PrivilegedControlsSeatReservationResult? privilegedControlsSeatReservation = null;
 
         if (possibleOrgUser == null || willPromoteStagedOrgUser)
         {
             await EnsureSeatAvailableAsync(organization);
+
+            if (possibleOrgUser is { Status: OrganizationUserStatusType.Staged, AccessPam: true })
+            {
+                privilegedControlsSeatReservation = await _reservePrivilegedControlsSeatsCommand.RunAsync(organization, 1);
+                if (!privilegedControlsSeatReservation.Success)
+                {
+                    possibleOrgUser.AccessPam = false;
+                }
+            }
         }
 
         // If the email domain is verified, we can mark the email as verified
@@ -772,13 +791,21 @@ SsoConfigurationData ssoConfigData
 
             if (possibleOrgUser.Status == OrganizationUserStatusType.Staged)
             {
-                // Seat availability was verified up-front before user creation so safe to consume this seat.
+                // The member seat and the Privileged Controls seat were both reserved up-front before user
+                // creation, so it is safe to consume them here. AccessPam may have been cleared on this instance
+                // when no Privileged Controls seat was available, which the ReplaceAsync below saves.
                 possibleOrgUser.Status = OrganizationUserStatusType.Invited;
             }
 
             possibleOrgUser.UserId = newUser.Id;
             possibleOrgUser.RevisionDate = DateTime.UtcNow;
             await _organizationUserRepository.ReplaceAsync(possibleOrgUser);
+
+            if (privilegedControlsSeatReservation?.Error is PrivilegedControlsSeatLimitReachedError)
+            {
+                await _sendPrivilegedControlsSeatNeededEmailCommand.RunAsync(
+                    organization, possibleOrgUser.Email ?? newUser.Email);
+            }
         }
 
         // Create the SsoUser record to link the user to the SSO provider.
@@ -851,6 +878,17 @@ private async Task PromoteStagedOrgUserAndSendInviteAsync(
 
         var previousStatus = orgUser.Status;
         var previousRevisionDate = orgUser.RevisionDate;
+        var previousAccessPam = orgUser.AccessPam;
+
+        PrivilegedControlsSeatReservationResult? privilegedControlsSeatReservation = null;
+        if (orgUser.AccessPam)
+        {
+            privilegedControlsSeatReservation = await _reservePrivilegedControlsSeatsCommand.RunAsync(organization, 1);
+            if (!privilegedControlsSeatReservation.Success)
+            {
+                orgUser.AccessPam = false;
+            }
+        }
 
         orgUser.Status = OrganizationUserStatusType.Invited;
         orgUser.RevisionDate = DateTime.UtcNow;
@@ -873,10 +911,16 @@ await _sendOrganizationInvitesCommand.SendInvitesAsync(new SendInvitesRequest(
 
             orgUser.Status = previousStatus;
             orgUser.RevisionDate = previousRevisionDate;
+            orgUser.AccessPam = previousAccessPam;
             await _organizationUserRepository.ReplaceAsync(orgUser);
 
             throw;
         }
+
+        if (privilegedControlsSeatReservation?.Error is PrivilegedControlsSeatLimitReachedError)
+        {
+            await _sendPrivilegedControlsSeatNeededEmailCommand.RunAsync(organization, orgUser.Email!);
+        }
     }
 
     /// <summary>

bitwarden_license/src/Sso/Sso.csproj

@@ -13,6 +13,7 @@
 
   <ItemGroup>
     <ProjectReference Include="..\..\..\src\Core\Core.csproj" />
+    <ProjectReference Include="..\..\..\src\Libraries\Subscriptions.Organization\Subscriptions.Organization.csproj" />
     <ProjectReference Include="..\..\..\src\SharedWeb\SharedWeb.csproj" />
   </ItemGroup>
 

bitwarden_license/src/Sso/Startup.cs

@@ -8,6 +8,7 @@
 using Bit.Core.Utilities;
 using Bit.SharedWeb.Utilities;
 using Bit.Sso.Utilities;
+using Bit.Subscriptions.Organization;
 using Duende.IdentityServer.Services;
 using Stripe;
 
@@ -83,6 +84,7 @@ public void ConfigureServices(IServiceCollection services)
         services.AddDefaultServices(globalSettings);
         services.AddCoreLocalizationServices();
         services.AddBillingOperations();
+        services.AddPrivilegedControlsSeatAutoscaling();
 
         // TODO: Remove when OrganizationUser methods are moved out of OrganizationService, this noop dependency should
         // TODO: no longer be required - see PM-1880

bitwarden_license/src/Sso/packages.lock.json

@@ -1251,6 +1251,9 @@
           "ZiggyCreatures.FusionCache.Serialization.SystemTextJson": "[2.0.2, 2.0.2]"
         }
       },
+      "currentuser": {
+        "type": "Project"
+      },
       "data": {
         "type": "Project"
       },
@@ -1286,6 +1289,15 @@
           "linq2db.EntityFrameworkCore": "[8.8.0, 8.8.0]"
         }
       },
+      "invoicing": {
+        "type": "Project",
+        "dependencies": {
+          "Bitwarden.Server.Sdk.Environment": "[0.1.0, )",
+          "Bitwarden.Server.Sdk.Features": "[1.5.0, )",
+          "Core": "[2026.10.1, )",
+          "Stripe.net": "[52.1.0, 52.1.0]"
+        }
+      },
       "maildelivery": {
         "type": "Project",
         "dependencies": {
@@ -1294,6 +1306,13 @@
           "SendGrid": "[9.29.3, 9.29.3]"
         }
       },
+      "organizationauthorization": {
+        "type": "Project",
+        "dependencies": {
+          "Core": "[2026.10.1, )",
+          "CurrentUser": "[0.0.1, )"
+        }
+      },
       "pam.domain": {
         "type": "Project",
         "dependencies": {
@@ -1323,6 +1342,15 @@
       },
       "ssrfprotection": {
         "type": "Project"
+      },
+      "subscriptions.organization": {
+        "type": "Project",
+        "dependencies": {
+          "Core": "[2026.10.1, )",
+          "ExceptionHandling": "[0.0.1, )",
+          "Invoicing": "[0.0.1, )",
+          "OrganizationAuthorization": "[0.0.1, )"
+        }
       }
     }
   }