[PM-15938] - Restrict viewing hidden input based on permission

[jaasen-livefront]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-15938

📔 Objective

This PR is a follow-up to the previous PR that was too restrictive and disabled all custom fields for users with except password permission, while this PR only disables hidden fields.

Changes to the input directive were required in order to allow a disabled prop to be string or boolean. This change has the drawback of requiring all bitInputs to be disabled individually and cannot be disabled at a form level. Feedback would be greatly appreciated on how this could be done in a less disruptive way.

eg.

<input bitInput disabled />

or

<input bitInput [disabled]='disabled' />

📸 Screenshots

⏰ Reminders before review

• Contributor guidelines followed
• All formatters and local linters executed and passed
• Written new unit and / or integration tests where applicable
• Protected functional changes with optionality (feature flags)
• Used internationalization (i18n) for all UI strings
• CI builds passed
• Communicated to DevOps any deployment requirements
• Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

• 👍 (:+1:) or similar for great changes
• 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
• ❓ (:question:) for questions
• 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
• 🎨 (:art:) for suggestions / improvements
• ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
• 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
• ⛏ (:pick:) for minor or nitpick changes

[github-actions]

Checkmarx One – Scan Summary & Details – 2cd4f44e-92c0-4530-9bab-9e86c89ff40a

New Issues (10)

Checkmarx found the following issues in this Pull Request

Severity	Issue	Source File / Package	Checkmarx Insight
	Client_Privacy_Violation	/libs/angular/src/admin-console/components/collections.component.ts: 36	details Method at line 36 of /libs/angular/src/admin-console/components/collections.component.ts sends user information outside the application. This may ... Attack Vector
	Client_Privacy_Violation	/apps/browser/src/vault/popup/components/vault-v2/attachments/open-attachments/open-attachments.component.ts: 50	details Method at line 50 of /apps/browser/src/vault/popup/components/vault-v2/attachments/open-attachments/open-attachments.component.ts sends user infor... Attack Vector
	Client_Privacy_Violation	/libs/angular/src/vault/components/add-edit.component.ts: 119	details Method at line 119 of /libs/angular/src/vault/components/add-edit.component.ts sends user information outside the application. This may constitute... Attack Vector
	Client_Privacy_Violation	/libs/angular/src/vault/components/add-edit.component.ts: 286	details Method load at line 286 of /libs/angular/src/vault/components/add-edit.component.ts sends user information outside the application. This may consti... Attack Vector
	Client_Privacy_Violation	/libs/angular/src/vault/components/add-edit.component.ts: 780	details Method loadAddEditCipherInfo at line 780 of /libs/angular/src/vault/components/add-edit.component.ts sends user information outside the application... Attack Vector
	Client_Privacy_Violation	/apps/browser/src/vault/popup/components/vault-v2/attachments/open-attachments/open-attachments.component.ts: 50	details Method OpenAttachmentsComponent at line 50 of /apps/browser/src/vault/popup/components/vault-v2/attachments/open-attachments/open-attachments.compo... Attack Vector
	Client_Privacy_Violation	/libs/angular/src/vault/components/add-edit.component.ts: 70	details Method at line 70 of /libs/angular/src/vault/components/add-edit.component.ts sends user information outside the application. This may constitute ... Attack Vector
	Client_Privacy_Violation	/libs/angular/src/vault/components/add-edit.component.ts: 278	details Method load at line 278 of /libs/angular/src/vault/components/add-edit.component.ts sends user information outside the application. This may consti... Attack Vector
	Client_Privacy_Violation	/libs/angular/src/vault/components/add-edit.component.ts: 281	details Method load at line 281 of /libs/angular/src/vault/components/add-edit.component.ts sends user information outside the application. This may consti... Attack Vector
	Client_Privacy_Violation	/libs/angular/src/vault/components/add-edit.component.ts: 776	details Method loadAddEditCipherInfo at line 776 of /libs/angular/src/vault/components/add-edit.component.ts sends user information outside the application... Attack Vector

[codecov]

Codecov Report

Attention: Patch coverage is 66.66667% with 3 lines in your changes missing coverage. Please review.

Project coverage is 35.11%. Comparing base (e060371) to head (46e3dfe).
Report is 8 commits behind head on main.

✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
libs/components/src/input/input.directive.ts	60.00%	2 Missing ⚠️
...omponents/custom-fields/custom-fields.component.ts	50.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #13016      +/-   ##
==========================================
- Coverage   35.20%   35.11%   -0.09%     
==========================================
  Files        2992     2990       -2     
  Lines       90670    91078     +408     
  Branches    16964    17051      +87     
==========================================
+ Hits        31918    31980      +62     
- Misses      56288    56605     +317     
- Partials     2464     2493      +29     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[willmartian]

Changes to the input directive were required in order to allow a disabled prop to be string or boolean.

At a high level, why is this change needed?

[jaasen-livefront]

Changes to the input directive were required in order to allow a disabled prop to be string or boolean.

At a high level, why is this change needed?

@willmartian The change was made to allow setting a bitInput as disabled like so:

<input bitInput [disabled]="isPartialEdit" />

as opposed to

<input bitInput disabled />

With the current implementation the first example doesn't work, the input isn't disabled. The second example works but unfortunately we need to be able to conditionally set it to satisfy the requirements of the ticket.